Pith. sign in

REVIEW 5 major objections 5 minor 52 references

Self-Aware Safety Augmentation: Leveraging Internal Semantic Understanding to Enhance Safety in Vision-Language Models

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper argues that vision-language models are vulnerable because safety perception matures in early layers before semantic understanding exists, and proposes SASA, a tuning-free projection of later semantic representations onto…

desk verdict Real on the three benchmarks, but the headline generalization claim is built on in-distribution few-shot classification; worth engaging for the projection trick, not yet a robust defense. read the letter →

arxiv 2507.21637 v1 pith:BS2TKH6D submitted 2025-07-29 cs.AI

Wanying Wang , Zeyu Ma , Han Zheng , Xin Tan , Mingang Chen This is my paper
classification cs.AI
keywords safetyalignmentvision-languagemodelsinternalrepresentationanalysisattentionheadimportancelinearprobingjailbreakdefensetuning-freelayer-wise
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Large vision-language models (LVLMs) are more easily jailbroken than their text-only backbones, and this paper traces the cause to an internal timing mismatch: the layers that decide whether an input is harmful are located early, while the layers that truly understand the input appear later. The authors propose Self-Aware Safety Augmentation (SASA), a tuning-free method that projects the richer semantic representations from intermediate fused layers onto the earlier safety layers, so the model can apply full understanding when it judges risk. A lightweight linear probe on the model's own output logits then blocks harmful prompts before generation. Across three popular LVLMs and several safety and utility benchmarks, SASA cuts attack success rate from near 90–99% to single digits, with minimal loss of helpfulness. The central claim is that the model already knows the input is dangerous internally, and the vulnerability is a failure of expression, not of comprehension.

What carries the argument

The key machinery is the self-aware projection step plus a final linear probe. For each token, the hidden state $\mathbf{h}_s$ of the chosen safety layer is replaced by $\operatorname{Proj}_{\mathbf{h}_f}(\mathbf{h}_s) = \frac{\langle \mathbf{h}_s, \mathbf{h}_f\rangle}{\langle \mathbf{h}_f, \mathbf{h}_f\rangle}\,\mathbf{h}_f$, where $\mathbf{h}_f$ is the hidden state of the later fused layer; this transfers the fused layer's semantic content into the early safety layer. The fused layer is selected as the layer where decoded token readability begins to rise sharply (layer 15 or 18 in the three studied models), and the target safety layer is chosen as the closest preceding layer that contains top safety-important heads (layer 13 or 17). A logistic-regression probe trained on only tens of examples then classifies the first-token output logits as harmful or benign, blocking generation before it starts.

What would settle it

Run SASA on an attack suite where the raw model's attack success rate is high (e.g., all of MM-SafetyBench rather than only the refused subset) and compare ASR with the projection applied to the identified safety layer versus a randomly chosen early layer; if both projections yield the same large ASR reduction, the safety-layer localization is not carrying the effect.

Watch

Extended reading notes

Core claim

The central discovery is a structural mismatch in the internal information flow of LVLMs: safety perception (localized as attention heads whose ablation sharply raises attack success rate) emerges in early layers, while semantic understanding (measured by separability of harmful and benign activations and by readability of decoded tokens) matures only in intermediate layers, and later layers increasingly sacrifice that discrimination for alignment with human language. The paper shows that the model's internal representations can distinguish harmful from benign inputs long before the output does, and that this latent discrimination is lost by the final layer. SASA recovers it by computing the projection of the intermediate fused-layer hidden states onto the earlier safety-layer hidden states at each token position, replacing the safety layer's own representation with the component aligned with the fused layer, then uses a linear probe on the final-layer logits to reject risky prompts before any text is generated.

Load-bearing premise

The load-bearing premise is that the safety-head importance scores computed on 100 examples that the model already refuses correctly identify the layers responsible for safety perception on the broader attack distribution where the raw model fails, so the projection target layer is not arbitrary.

Editorial extensions

If this is right

  • SASA cuts average attack success rate by about 97% across LLaVA-1.5-7B, MiniGPT-v2-7B, and Qwen-VL-7B, while helpfulness accuracy on COCO-VQA, MM-Vet, and ScienceQA stays within about one point of the raw model.
  • The method needs no fine-tuning and only tens of training samples for the probe, so it can be deployed quickly and cheaply compared with safety fine-tuning or external filter models.
  • The probe generalizes zero-shot to unseen safety datasets (e.g., trained on VLGuard, applied to MM-SafetyBench with more than 80% accuracy), suggesting the projected representations capture a transferable notion of harmfulness.
  • SASA also improves safety on newer and larger models (Qwen2.5-VL, LLaVA-v1.5-13B, and LLaVA-next-8B) and on a LoRA fine-tuned variant, with the same pattern of early safety layers and later fused layers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: If SASA's mechanism is what the evidence suggests, then safety-aligned LVLMs could be improved at inference time without retraining by routing the model's own late-layer semantics back to early layers; one testable consequence is that the same projection should also improve performance on other early-layer-limited tasks, such as detecting subtle biases or factual inconsistencies.
  • Inference: The paper's layer localization relies on a safety-head importance metric computed on 100 already-refused harmful examples; a stress test for the mechanism would be to run SASA on a distribution of attacks that the raw model does not refuse, where the early layers failed to perceive harm, and check whether the gains persist.
  • Inference: Because the projection operates token-by-token and the probe looks only at first-token logits, the approach effectively buys safety at the cost of reading the first output token; combining it with decoding-time intervention, such as contrastive decoding from the fused layer, might yield further gains in both safety and helpfulness, but that extension is not in the paper.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper analyzes the internal dynamics of three LVLMs and identifies a 'structural mismatch': safety perception emerges in early layers, semantic understanding matures in intermediate layers, and linguistic alignment occurs in later layers. It proposes Self-Aware Safety Augmentation (SASA), which projects hidden states from a fused (semantic) layer onto an earlier safety layer and trains a linear probe on the output logits for harmful/benign classification, rejecting inputs when the probe output exceeds 0.5. Experiments on MM-SafetyBench, VLGuard, and FigStep report large ASR reductions (about 97% on average) with minimal utility loss, alongside ablations showing SASA outperforms direct linear probing.

Significance. The conceptual framing of the three capabilities is plausible and the layer-level analysis is a useful addition to the interpretability literature. The method is tuning-free, uses only a few dozen training samples, and the SASA-vs-direct-LP ablation (Table 2) isolates the contribution of the projection. If the empirical claims held on genuinely held-out attack distributions, SASA would be a valuable lightweight defense. However, the current evidence is weakened by the in-distribution evaluation and benchmark-in-the-loop selection of the layer indices, so the significance is conditional on additional validation.

major comments (5)
  1. [Section 5.2, Table 1] The safety probe is trained on 10 samples per MM-SafetyBench scenario, 20 per VLGuard scenario, and 10 from FigStep, and then evaluated on the full versions of these same datasets. This is an in-distribution few-shot evaluation; the reported average ASR reduction of 97% may reflect the probe memorizing benchmark-specific patterns rather than a genuine strengthening of safety judgment. Please add held-out attack families (e.g., unseen jailbreak methods, adversarial image perturbations, or a different harm taxonomy) with a benign control to support the headline claim.
  2. [Section 4, Algorithm 1, Table 3] The fused layer (15 or 18) and safety layer (13 or 17) are selected from readability and head-importance analyses performed on the same benchmark families used for evaluation, and Table 3 further tunes these choices on those datasets. This benchmark-in-the-loop selection biases the reported performance upward. Please specify a layer-selection procedure that does not use the evaluation set, for example a separate validation set or pre-registered indices.
  3. [Section 5.2, Figure 9] The zero-shot generalization claim is not supported by the reported evidence: FigStep contains only harmful prompts, so a constant-reject detector trivially achieves 100% detection accuracy; the FigStep accuracy is uninformative without a benign control. Additionally, cross-dataset transfer among MM-SafetyBench, VLGuard, and FigStep does not constitute a held-out attack family because these benchmarks share overlapping harmful categories.
  4. [Section 3.3, Eqs. (4)-(7)] The safety-head importance scores are computed on 100 harmful examples where the model already refuses (D_S). This localizes heads involved in refusal on the model's existing safe distribution, not necessarily the heads responsible for safety on the attack distribution where the raw model fails. The projection target layer may therefore be arbitrary; the Table 3 observation that the nearest preceding layer works best is consistent with a layer-distance effect unrelated to safety heads. Please validate the localization with causal experiments on examples the raw model fails to reject, or temper the mechanistic interpretation.
  5. [Section 3.4, Figures 4-6] The central 'structural mismatch' claim rests on t-SNE visualizations, readable-token-rate curves, and cosine similarity trends, which are qualitative. No quantitative per-layer metric (e.g., clustering separability, linear-probe accuracy, or causal intervention) is provided to pin down the fused layer indices. Please report a quantitative criterion for selecting the fused layer.
minor comments (5)
  1. [Appendix C.2] The heading 'Anynasis on the Fine-tuned Model' contains a typo; it should read 'Analysis on the Fine-tuned Model'.
  2. [Section 3.4] The phrase 'exceptionally raw high Attack Success Rate' appears to have a typo; it should probably read 'exceptionally high Attack Success Rate'.
  3. [Section 4, Eq. (8)] Equation (8) projects H_s onto H_f (the result is collinear with H_f), while the prose says 'projecting the semantic-rich representations from fused layers onto the earlier safety-critical layers'; the wording should be aligned with the equation.
  4. [Figure 9] The y-axis label 'Accuracy' should distinguish detection accuracy from helpfulness accuracy; the current format conflates the two.
  5. [Section 5.2] The paper does not discuss the choice of the probe rejection threshold (0.5); a brief ROC analysis would clarify the safety-utility trade-off.

Circularity Check

1 steps flagged · score 4.0 of 10

Headline safety gain is an in-distribution few-shot probe result; the projection mechanism itself is parameter-free and has a controlled ablation, so the circularity is partial and mainly in the evaluation claim.

  1. fitted input called prediction [Section 5.2, main results paragraph and Table 1]
    "the classification probe associated with SASA was trained using only small data subsets: 10 samples from each of the 13 scenarios in MM-SafetyBench, 20 samples from each of the 2 scenarios evaluated in VLGuard, 10 samples from FigStep, and 50 samples from each of the three utility datasets"

    The probe is fit on samples drawn from exactly the benchmarks in which Table 1 then reports the ASR reductions supporting the abstract's 'average ASR reduction of 97%'. The reported safety improvement is therefore an in-distribution few-shot classification score on the training distribution, not a prediction about unseen attacks. The 'zero-shot' generalization in Figure 9 transfers only among MM-SafetyBench, VLGuard, and FigStep, the same benchmark families used for layer selection, and the FigStep 100% accuracy is trivially attained by always rejecting because FigStep contains only harmful prompts. Thus the headline quantitative claim is statistically coupled to the probe's training data rather than to the claimed structural-mismatch mechanism.

full rationale

The paper's central derivation is not circular in the constructional sense: SASA is a parameter-free projection of fused-layer hidden states onto an earlier safety layer, and the safety-layer and fused-layer indices are chosen by SHIPS and readability analyses, not by optimizing the evaluation metric. There is also no load-bearing self-citation chain; the SHIPS metric and linear probing are cited from external prior work. The main circularity concern is the evaluation loop: the probe is trained on small subsets of MM-SafetyBench, VLGuard, and FigStep and then Table 1 reports ASR on the full versions of those same benchmarks, so the headline 97% ASR reduction is an in-distribution few-shot classification result rather than a demonstration of robust safety on unseen attacks. The ablations in Table 2 do give partial independent evidence that SASA improves over a plain linear probe under identical training conditions, which keeps the circularity from being total. The uninformative FigStep zero-shot result (a harmful-only dataset, where constant rejection yields 100% detection) further weakens the generalization claim. Overall, the derivation is not definitionally circular, but a key empirical 'prediction' is statistically tied to its training distribution, warranting a partial circularity score of 4.

Assumptions & free parameters 5 free parameters · 7 assumptions · 0 invented entities

The method has no learned parameters in the projection, but its design relies on several unproven assumptions about what intermediate activations mean and on hyperparameters selected using the evaluation benchmarks. The main free parameters are the layer indices and the probe data budget; the axioms concern the interpretation of hidden states and the transfer of LLM safety-head analysis to LVLMs.

free parameters (5)
  • number of safety heads k = 5 (ablation), 10 (visualization)
    Used to identify safety-critical heads and select the safety layer. Not varied systematically; hand-chosen.
  • fused layer index = 15 (LLaVA, MiniGPT-v2), 18 (Qwen-VL)
    Selected by the readability heuristic using datasets that include the evaluation benchmarks.
  • safety layer index = 13 (LLaVA, MiniGPT-v2), 17 (Qwen-VL)
    Nearest layer preceding the fused layer that contains top safety heads; depends on head importance estimates on 100 successfully-rejected examples.
  • probe training samples per scenario = 10-20 per safety scenario, 50 per utility dataset
    Hand-chosen small data budget; the abstract's '5% of data' claim is not precisely defined.
  • probe rejection threshold = 0.5
    Standard logistic regression decision boundary.
assumptions (7)
  • domain assumption The last token hidden state represents the model's understanding at that layer.
    Invoked in Section 3.4 to justify analyzing final-token activations and decoding from intermediate layers.
  • domain assumption The proportion of readable top-5 decoded tokens reflects alignment with the linguistic output space.
    Used in Section 3.4 to locate fused and alignment layers via readability curves.
  • domain assumption t-SNE separation between harmful and benign activations indicates internal semantic understanding.
    Used to claim that middle layers (around layer 15) have rich semantic discrimination.
  • domain assumption SHIPS head importance computed on 100 successfully-refused harmful examples transfers to LVLMs and identifies safety-critical layers.
    Section 3.3 extends the LLM method of [48]; the selection of safety layers depends on this transfer.
  • ad hoc to paper Projecting the safety-layer hidden state onto the fused-layer direction transfers semantic information and improves safety.
    The core operation of SASA (Eq. 8) is proposed without a formal derivation or theoretical justification.
  • domain assumption Keyword-based ASR accurately measures safety behavior.
    All safety results are reported as refusal-keyword attack success rates, per Appendix E.
  • domain assumption Safety heads identified on the safe subset are relevant to the broader vulnerable distribution.
    Section 3.3 notes the analysis focuses on 'data that were initially safely rejected'; the method assumes these heads matter for the attacks the model fails to refuse.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Self-Aware Safety Augmentation: Leveraging Internal Semantic Understanding to Enhance Safety in Vision-Language Models." pith.science (2026). https://pith.science/paper/BS2TKH6D

@misc{pith2026250721637,
  author       = {Pith},
  title        = {Pith review of: Self-Aware Safety Augmentation: Leveraging Internal Semantic Understanding to Enhance Safety in Vision-Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BS2TKH6D}},
  note         = {Machine review of arXiv:2507.21637}
}
read the original abstract

Large vision-language models (LVLMs) are vulnerable to harmful input compared to their language-only backbones. We investigated this vulnerability by exploring LVLMs internal dynamics, framing their inherent safety understanding in terms of three key capabilities. Specifically, we define these capabilities as safety perception, semantic understanding, and alignment for linguistic expression, and experimentally pinpointed their primary locations within the model architecture. The results indicate that safety perception often emerges before comprehensive semantic understanding, leading to the reduction in safety. Motivated by these findings, we propose \textbf{Self-Aware Safety Augmentation (SASA)}, a technique that projects informative semantic representations from intermediate layers onto earlier safety-oriented layers. This approach leverages the model's inherent semantic understanding to enhance safety recognition without fine-tuning. Then, we employ linear probing to articulate the model's internal semantic comprehension to detect the risk before the generation process. Extensive experiments on various datasets and tasks demonstrate that SASA significantly improves the safety of LVLMs, with minimal impact on the utility.

Figures

Figures reproduced from arXiv: 2507.21637 by the authors.

Figure 1
Figure 1. Overall Workflow of Self-Aware Safety Augmentation (SASA). [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The top 10 safety attention heads with the highest [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. t-SNE visualization of internal token activations from the 5th, 10th, 15th, 20th, 25th and 31st layers of MiniGPT-v2. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (9 more)
Figure 6
Figure 6. Figure 6: Cosine similarity between hidden states of text and [PITH_FULL_IMAGE:figures/full_fig_p005_6.png]
Figure 7
Figure 7. Figure 7: t-SNE visualization of internal representations at [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]
Figure 8
Figure 8. Figure 8: The performance of various methods on 6 datasets. The Y-axis is aver￾age accuracy, while the X-axis denotes com￾putational cost. The size of each marker corresponds to the number of parameters. performance comparable to that of direct fine-tuning. However, we emphasize…
Figure 9
Figure 9. Figure 9: Generalization of SASA. Accuracy is reported on MM-SafetyBench and VLGuard with probes trained in-domain and cross-domain. As FigStep has only malicious prompts, zero￾shot accuracy from other datasets is reported. confirmed, as targeting projection towards layers housi…
Figure 10
Figure 10. Figure 10: t-SNE visualization of internal token activations from the 5th, 10th, 15th, 20th, 25th and 31st layers of LLaVA-1.5-7B. [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 11
Figure 11. Figure 11: t-SNE visualization of internal representations at layers 13 and 31 of LLaVA-1.5-7B, comparing original and projected [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]
Figure 12
Figure 12. Figure 12: t-SNE visualization of internal token activations from the 5th, 10th, 15th, 20th, 25th and 31st layers of Qwen-VL-7B. [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]
Figure 13
Figure 13. Figure 13: t-SNE visualization of internal representations at layers 17 and 31 of Qwen-VL-7B, comparing original and projected [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]
Figure 14
Figure 14. Figure 14: Head importance score on the safety dataset and utility dataset. [PITH_FULL_IMAGE:figures/full_fig_p012_14.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

52 extracted references · 23 canonical work pages

  1. [1]

    Gilles Baechler, Srinivas Sunkara, Maria Wang, Fedir Zubach, Hassan Mansoor, Vincent Etter, Victor Cărbune, Jason Lin, Jindong Chen, and Abhanshu Sharma

  2. [2]

    Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, Humen Zhong, Yuanzhi Zhu, Mingkun Yang, Zhaohai Li, Jianqiang Wan, Pengfei Wang, Wei Ding, Zheren Fu, Yiheng Xu, Jiabo Ye, Xi Zhang, Tianbao Xie, Zesen Cheng, Hang Zhang, Zhibo Yang, Haiyang Xu, and Junyang Lin. 2025. Qwen2.5-VL Technical Rep...

    arXiv 2025

  3. [3]

    Samyadeep Basu, Martin Grayson, Cecily Morrison, Besmira Nushi, Soheil Feizi, and Daniela Massiceti. 2024. Understanding Information Storage and Transfer in Multi-Modal Large Language Models. In Advances in Neural In- formation Processing Systems , A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang (Eds.), Vol. 37. Curran As...

    work page 2024

  4. [4]

    T.B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Askell Amanda, Sandhini Agarwal, Ariel Herbert-Voss, Gretchen Krueger, Henighan Tom, Rewon Child, A. Ramesh, DanielM. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, EricJ. Sigler, Mateusz Litwin, Sco...

    work page 2020

  5. [5]

    Salman Asif, Yue Dong, Amit K

    Trishna Chakraborty, Erfan Shayegani, Zikui Cai, Nael Abu-Ghazaleh, M. Salman Asif, Yue Dong, Amit K. Roy-Chowdhury, and Chengyu Song. 2024. Cross-Modal Safety Alignment: Is textual unlearning all you need? arXiv:2406.02575 [cs.CL] https://arxiv.org/abs/2406.02575

    arXiv 2024

  6. [6]

    Jun Chen, Deyao Zhu, Xiaoqian Shen, Xiang Li, Zechun Liu, Pengchuan Zhang, Raghuraman Krishnamoorthi, Vikas Chandra, Yunyang Xiong, and Mohamed Elhoseiny. 2023. MiniGPT-v2: large language model as a unified interface for vision-language multi-task learning. arXiv:2310.09478 [cs.CV] https://arxiv.org/ abs/2310.09478

    arXiv 2023

  7. [7]

    Shuo Chen, Zhen Han, Bailan He, Zifeng Ding, Wenqian Yu, Philip Torr, Volker Tresp, and Jindong Gu. 2024. Red Teaming GPT-4V: Are GPT-4V Safe Against Uni/Multi-Modal Jailbreak Attacks?. In ICLR 2024 Workshop on Secure and Trust- worthy Large Language Models . https://openreview.net/forum?id=WubY1GeLij

    work page 2024

  8. [8]

    Glass, and Pengcheng He

    Yung-Sung Chuang, Yujia Xie, Hongyin Luo, Yoon Kim, James R. Glass, and Pengcheng He. 2024. DoLa: Decoding by Contrasting Layers Improves Factuality in Large Language Models. In The Twelfth International Conference on Learning Representations

    work page 2024

Show all 52 references
  1. [9]

    Yi Ding, Bolian Li, and Ruqi Zhang. 2025. ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time. In The Thirteenth Interna- tional Conference on Learning Representations . https://openreview.net/forum?id= QoDDNkx4fP

    2025

  2. [10]

    Soumya Suvra Ghosal, Souradip Chakraborty, Vaibhav Singh, Tianrui Guan, Mengdi Wang, Ahmad Beirami, Furong Huang, Alvaro Velasquez, Dinesh Manocha, and Amrit Singh Bedi. 2024. Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment. https:/...

    2024 arXiv

  3. [11]

    Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2023. Figstep: Jailbreaking large vision- language models via typographic visual prompts. arXiv preprint arXiv:2311.05608 (2023)

    2023 arXiv

  4. [12]

    Kwok, and Yu Zhang

    Yunhao Gou, Kai Chen, Zhili Liu, Lanqing Hong, Hang Xu, Zhenguo Li, Dit-Yan Yeung, James T. Kwok, and Yu Zhang. 2024. Eyes Closed, Safety on: Protecting Multimodal LLMs via Image-to-Text Transformation. InComputer Vision – ECCV 2024: 18th European Conference, Milan, Italy, Sep...

    2024 doi

  5. [13]

    Jiachen Jiang, Jinxin Zhou, and Zhihui Zhu. 2025. Tracing Representation Pro- gression: Analyzing and Enhancing Layer-Wise Similarity. In The Thirteenth International Conference on Learning Representations . https://openreview.net/ forum?id=vVxeFSR4fU

    2025

  6. [14]

    Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. 2023. BLIP-2: bootstrap- ping language-image pre-training with frozen image encoders and large language models. In Proceedings of the 40th International Conference on Machine Learning . 19730–19742

    2023

  7. [15]

    Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. 2022. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In International conference on machine learning . PMLR, 12888–12900

    2022

  8. [16]

    Qing Li, Jiahui Geng, Zongxiong Chen, Kun Song, Lei Ma, and Fakhri Karray. 2025. Internal Activation Revision: Safeguarding Vision Language Models Without Parameter Update. arXiv preprint arXiv:2501.16378 (2025)

    2025 arXiv

  9. [18]

    Shen Li, Liuyi Yao, Lan Zhang, and Yaliang Li. 2025. Safety Layers in Aligned Large Language Models: The Key to LLM Security. In The Thirteenth Interna- tional Conference on Learning Representations . https://openreview.net/forum?id= kUH1yPMAn7

    2025

  10. [19]

    Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. 2024. Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jail- breaking multimodal large language models. InEuropean Conference on Computer Vision. Springer, 174–189

    2024

  11. [20]

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. InEuropean Conference on Computer Vision. Springer, 740–755

    2014

  12. [21]

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. Visual Instruc- tion Tuning. arXiv:2304.08485 [cs.CV] https://arxiv.org/abs/2304.08485

    2023 arXiv

  13. [22]

    Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, and Chao Yang. 2025. MM- SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models. In European Conference on Computer Vision . 386–403

    2025

  14. [23]

    Liming Lu, Shuchao Pang, Siyuan Liang, Haotian Zhu, Xiyu Zeng, Aishan Liu, Yunhuai Liu, and Yongbin Zhou. 2025. Adversarial Training for Multimodal Large Language Models against Jailbreak Attacks. arXiv:2503.04833 [cs.CV] https://arxiv.org/abs/2503.04833

    2025

  15. [24]

    Pan Lu, Swaroop Mishra, Tanglin Xia, Liang Qiu, Kai-Wei Chang, Song-Chun Zhu, Oyvind Tafjord, Peter Clark, and Ashwin Kalyan. 2022. Learn to explain: Multi- modal reasoning via thought chains for science question answering. Advances in Neural Information Processing Systems 35 ...

    2022

  16. [25]

    Clement Neo, Luke Ong, Philip Torr, Mor Geva, David Krueger, and Fazl Barez

  17. [26]

    Zhenxing Niu, Haodong Ren, Xinbo Gao, Gang Hua, and Rong Jin. 2024. Jail- breaking attack against multimodal large language model. arXiv preprint arXiv:2402.02309 (2024)

    2024 arXiv

  18. [27]

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. Training language models to follow instructions with human feedback. Advances in neural information processing systems 35...

    2022

  19. [29]

    Haowen Pan, Yixin Cao, Xiaozhi Wang, Xun Yang, and Meng Wang. 2024. Finding and Editing Multi-Modal Neurons in Pre-Trained Transformers. In Findings of the Association for Computational Linguistics ACL 2024 . 1012–1037

    2024

  20. [30]

    Renjie Pi, Tianyang Han, Jianshu Zhang, Yueqi Xie, Rui Pan, Qing Lian, Hanze Dong, Jipeng Zhang, and Tong Zhang. 2024. MLLM-Protector: Ensuring MLLM’s Safety without Hurting Performance. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing ...

    2024

  21. [31]

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the AAAI conference on artificial intelligence , Vol. 38. 21527–21536

    2024

  22. [32]

    Qwen, :, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, Junyang Lin, Kai Dang, Keming Lu, Keqin Bao, Kexin Yang, ...

    2025 arXiv

  23. [33]

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learni...

    2021

  24. [34]

    Sarah Schwettmann, Neil Chowdhury, Samuel Klein, David Bau, and Antonio Torralba. 2023. Multimodal Neurons in Pretrained Text-Only Transformers. In 2023 IEEE/CVF International Conference on Computer Vision Workshops (ICCVW) . 2854–2859. doi:10.1109/ICCVW60793.2023.00308

    2023

  25. [35]

    Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. 2024. Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models. In The MM ’25, October 27–31, 2025, Dublin, Ireland Wanying Wang, Zeyu Ma, Han Zheng, Xin Tan, Mingang Chen Twelfth International Conf...

    2024

  26. [36]

    Guobin Shen, Dongcheng Zhao, Yiting Dong, Xiang He, and Yi Zeng. 2025. Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models. InThe Thirteenth International Conference on Learning Representations. https://openreview.ne...

    2025

  27. [37]

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yas- mine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhos- ale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucu- rull, David Esiobu, Jude Fernandes, Jeremy...

    2023 arXiv

  28. [38]

    Yu Wang, Xiaogeng Liu, Yu Li, Muhao Chen, and Chaowei Xiao. 2024. Adashield: Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting. In European Conference on Computer Vision . Springer, 77–94

    2024

  29. [39]

    Shicheng Xu, Liang Pang, Yunchang Zhu, Huawei Shen, and Xueqi Cheng. 2025. Cross-Modal Safety Mechanism Transfer in Large Vision-Language Models. In The Thirteenth International Conference on Learning Representations . https: //openreview.net/forum?id=45rvZkJbuX

    2025

  30. [40]

    Yue Xu, Xiuyuan Qi, Zhan Qin, and Wenjie Wang. 2024. Defending jailbreak attack in vlms via cross-modality information detector. arXiv e-prints (2024), arXiv–2407

    2024

  31. [41]

    Weikai Yang, Mengchen Liu, Zheng Wang, and Shixia Liu. 2024. Foundation models meet visualizations: Challenges and opportunities. Computational Visual Media 10, 3 (2024), 399–424

    2024

  32. [42]

    Weihao Yu, Zhengyuan Yang, Linjie Li, Jianfeng Wang, Kevin Lin, Zicheng Liu, Xinchao Wang, and Lijuan Wang. 2024. MM-Vet: Evaluating Large Multimodal Models for Integrated Capabilities. In Forty-first International Conference on Machine Learning. https://openreview.net/forum?i...

    2024

  33. [43]

    Zhi Zhang, Srishti Yadav, Fengze Han, and Ekaterina Shutova. 2024. Cross-modal Information Flow in Multimodal Large Language Models. arXiv:2411.18620 [cs.AI] https://arxiv.org/abs/2411.18620

    2024 arXiv

  34. [44]

    Qinyu Zhao, Ming Xu, Kartik Gupta, Akshay Asthana, Liang Zheng, and Stephen Gould. 2025. The First to Know: How Token Distributions Reveal Hidden Knowl- edge in Large Vision-Language Models?. In Computer Vision – ECCV 2024 , Aleš Leonardis, Elisa Ricci, Stefan Roth, Olga Russa...

    2025

  35. [45]

    Shiji Zhao, Ranjie Duan, Fengxiang Wang, Chi Chen, Caixin Kang, Jialing Tao, YueFeng Chen, Hui Xue, and Xingxing Wei. 2025. Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency. arXiv preprint arXiv:2501.04931 (2025)

    2025 arXiv

  36. [46]

    Zheng Zhao, Yftah Ziser, and Shay B Cohen. 2024. Layer by Layer: Uncover- ing Where Multi-Task Learning Happens in Instruction-Tuned Large Language Models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 15195–15214

    2024

  37. [47]

    Ziwei Zheng, Junyao Zhao, Le Yang, Lijun He, and Fan Li. 2025. Spot Risks Before Speaking! Unraveling Safety Attention Heads in Large Vision-Language Models. arXiv preprint arXiv:2501.02029 (2025)

    2025 arXiv

  38. [48]

    Zhenhong Zhou, Haiyang Yu, Xinghua Zhang, Rongwu Xu, Fei Huang, Kun Wang, Yang Liu, Junfeng Fang, and Yongbin Li. 2025. On the Role of Attention Heads in Large Language Model Safety. InThe Thirteenth International Conference on Learning Representations. https://openreview.net/...

    2025

  39. [49]

    Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. 2024. MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Models. In The Twelfth International Conference on Learning Represen- tations. https://openreview.net/forum?id=1tZbq88f27

    2024

  40. [50]

    Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. 2024. Safety fine-tuning at (almost) no cost: a baseline for vision large language models. In Proceedings of the 41st International Conference on Machine Learning. 62867–62891

    2024

  41. [51]

    Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, et al

  42. [2023]

    net”, “netting

    Representation engineering: A top-down approach to ai transparency. arXiv:2310.01405 Self-Aware Safety Augmentation MM ’25, October 27–31, 2025, Dublin, Ireland A t-SNE Visualization We present the t-SNE visualization results illustrating layer-wise activations from early to d...

    2025 arXiv

  43. [2024]

    In Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence

    Screenai: A vision-language model for ui and infographics understanding. In Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence. 3058–3068

  44. [2025]

    In The Thirteenth International Conference on Learning Representations

    Towards Interpreting Visual Information Processing in Vision-Language Models. In The Thirteenth International Conference on Learning Representations . doi:10.48550/ARXIV.2410.07149

    doi arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.