Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

PRJ: Perception-Retrieval-Judgement for Generated Images

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A read-recall-judge pipeline outperforms binary image safety filters

desk verdict PRJ is a genuinely assembled interpretable moderation pipeline, but the reported superiority over Q16 is likely a threshold artifact from a recall-only metric at τ=0 on an all-harmful dataset. read the letter →

arxiv 2506.03683 v1 pith:I2XUXP57 submitted 2025-06-04 cs.CV

Qiang Fu , Zonglei Jing , Zonghao Ying , Xiaoqian Li This is my paper
classification cs.CV
keywords toxicitydetectiongeneratedimagestext-to-imagemodelsvision-languageretrieval-augmentedgenerationcontentmoderationjailbreakattacksinterpretablesafetyassessment
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

PRJ is a proposed safety checker for AI-generated images that replaces binary yes/no filters with a three-stage language-based reasoning process: describe the image with a vision-language model, retrieve relevant harm knowledge from a curated database, then judge toxicity under a rule-based risk matrix. The paper argues this structure lets a system catch both explicit harms (nudity, gore) and implicit or adversarial ones (hate symbols, copyright mimicry) while also saying which category of harm applies and how severe it is. Across six text-to-image models, PRJ reports higher toxic-image detection rates than Q16, SDSC, and OpenAI Moderation, with an average gain of more than ten percentage points over Q16, and it tracks whether jailbreak attacks raise or shift toxicity. A sympathetic reader would care because content moderation needs both better recall and explainability, not just another classifier.

What carries the argument

The load-bearing object is the Perception–Retrieval–Judgement pipeline itself: a VLM (LLaVA-34B) produces the global caption $C_g$ and feature list $C_f$; retrieval-augmented generation performs $N+1$ queries against a toxic-knowledge base, one per caption or feature; and the judgement stage computes $s_{\text{total}} = \alpha \cdot s_{\text{img}} + (1-\alpha) \cdot \sum_{k=1}^{N} s^k_{\text{feat}}$ with $\alpha = 0.6$, where each score comes from $f_{\text{judge}}$ applied to retrieved evidence under a toxicity risk matrix. That matrix assigns weights to five cognitive dimensions—Moral Cognition 0.3, Emotional Processing 0.25, Visual Memory Impact 0.2, Attentional Capture 0.15, Semantic Intensity 0.1—so each harm category receives a weighted profile. The language-centric design lets the system ground its decisions in external knowledge and legal or normative rules, which is what the paper credits for detecting subtle harms like copyright infringement.

What would settle it

Run PRJ and the baselines on a mixed dataset of benign and harmful images, report false-positive rates and precision at matched thresholds; if PRJ's TIDR lead shrinks below noise or its false-positive rate is much higher, the claimed superiority is a threshold artifact.

Watch

Extended reading notes

Core claim

The paper's central claim is that toxicity detection in generated images is better modeled as a structured, language-driven reasoning process than as a fixed classifier. PRJ first converts an image into a caption plus a list of localized semantic features; each of these textual units is then used to query a curated toxic-knowledge base, and the merged retrieved evidence is scored by an LLM using a multidimensional toxicity risk matrix. The authors report that PRJ achieves the highest detection rate among four safety checkers on all six tested text-to-image models, with an average improvement of more than 10 percentage points over Q16, and that it uniquely outputs continuous severity scores, ten harm categories, and textual justifications. They further claim its Toxicity Escalation Success Rate exposes how adversarial attacks change and amplify harm in ways binary pass/fail metrics miss.

Load-bearing premise

The comparison assumes that detection quality is captured by recall alone, measured at threshold zero on a dataset containing only harmful images, while the baselines run at their own fixed operating points.

Editorial extensions

If this is right

  • Binary safety filters could be replaced by systems that output severity scores, harm categories, and justifications, giving moderators actionable signals rather than a yes/no flag.
  • Because retrieval grounds judgement in an updatable knowledge base, new or emerging harm categories can be added without retraining the vision model.
  • The threshold parameter $\tau$ turns detection strictness into a tunable policy dial, allowing high-risk platforms to filter aggressively and low-risk settings to be permissive.
  • TESR-style metrics would let jailbreak evaluations move from counting bypasses to measuring whether and how much harm actually escalates.
  • Category-level labels across ten harm types could support fine-grained regulation and auditing of generative-image platforms.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The reported 10-point gain over Q16 is computed at $\tau=0$ on a harmful-only dataset, so a like-for-like comparison with precision and false-positive rates on mixed data is the natural stress test; the advantage may shrink if baselines are calibrated to their own operating points.
  • Because any positive score counts at $\tau=0$, PRJ would likely flag many benign images as harmful; testing false-positive rate on benign prompts is a direct extension the paper leaves for future work.
  • The risk-matrix weights come from a GPT-4-assisted analysis and a crowd survey, so the scoring encodes a particular cultural and normative stance; porting PRJ across jurisdictions would mean recalibrating those weights.
  • The per-feature retrieval design ties inference cost directly to image complexity, so there is an implicit latency-granularity tradeoff that the total time $T_{\text{total}} = T_{\text{percep}} + K \times T_{\text{retri}} + T_{\text{judge}}$ makes visible.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes PRJ (Perception–Retrieval–Judgement), a three-stage framework for detecting and quantifying toxicity in AI-generated images. A VLM produces a global caption and fine-grained features; a RAG module retrieves category-aligned toxic concepts from a knowledge base; and an LLM judges toxicity using a five-dimensional cognitive risk matrix, outputting a continuous score, a category label, and a textual justification. The authors introduce several metrics (TIDR, MTS, TSS, TESR) and report experiments on 1200 adversarial prompts across six text-to-image models, claiming that PRJ outperforms Q16, SDSC, and OpenAI Moderation in detection rate and robustness while providing structured category-level interpretation.

Significance. The framework is clearly motivated and has a sensible modular design: language-centric perception, retrieval-augmented knowledge grounding, and rule-based scoring are all reasonable components for explainable safety assessment. The paper also ships pseudocode (Algorithm 1), ablations on the threshold and the weight alpha, and a time-efficiency breakdown, which are useful for reproducibility. If the detection-rate claims were properly validated, the contribution would be a practical, interpretable alternative to binary safety checkers. However, the current evaluation does not establish the central claim of superiority over baselines, and the self-referential use of the authors' own taxonomy, prompts, and attack method raises concerns about circularity that must be addressed.

major comments (4)
  1. [§4.2, Eq. (9)] TIDR is computed at τ=0 on a dataset that contains exclusively harmful prompts. Under Algorithm 1, any retrieved category other than Safe/Reject/Error with positive confidence yields a positive score, so τ=0 counts almost every non-Safe call as a detection. The baselines (Q16, SDSC, Moderation) are evaluated at their default decision thresholds, which are presumably near 0.5. The +10 percentage point margin over Q16 in Table 1 is therefore an uninterpretable comparison of operating points rather than of detection ability; a detector that labels everything as toxic would trivially score 100%. The paper explicitly defers false-positive measurement to future work, but without a benign set or a threshold-matched comparison (e.g., ROC/AUC or FPR at matched recall), the headline result is not verifiable.
  2. [§4.3.1, Table 1] Table 1 reports a single TIDR number per model and system with no confidence intervals, standard errors, or significance tests across the 1200 images. The Spearman correlation between PRJ and Q16 is computed over only n=6 model-level points (ρ=0.83, p=0.042), which is weak evidence of consistency. Without variance estimates, the claim that PRJ 'consistently outperforms' all baselines across every model variant is not supported.
  3. [§4.2, Eq. (12) and §4.3.2] TESR measures the fraction of prompts for which PRJ's own toxicity score increases after an attack. The risk matrix, harmful taxonomy, and 480 of the 1200 evaluation prompts are all taken from the authors' CogMorph paper [10], and CogMorph is also the attack that produces the strongest escalation in Table 2. This creates a circular evaluation: the attack was designed to move the authors' scoring dimensions, and the metric then rewards that movement. An independent ground truth (e.g., human harm ratings) or an external attack and taxonomy is needed to support the robustness claims.
  4. [§3.3, Algorithm 1] The cognitive dimension base scores (MC=0.3, EP=0.25, VMI=0.2, AC=0.15, SI=0.1) and the category weight matrix W are central to the toxicity score S, and hence to all reported metrics (TIDR, MTS, TSS, TESR). The paper states these weights were derived from expert annotation, GPT-4-assisted analysis of 5000 toxic samples, and a crowd-sourced salience survey, but no data, survey details, or validation of these weights is provided. Without such support, the numerical results are conditional on an unvalidated scoring function.
minor comments (4)
  1. [§4.3.3, Figure 3 caption] The caption refers to 'CorMorph' but the correct name is CogMorph; please fix the typo.
  2. [Algorithm 1] The variable 'subcateogory' is misspelled; please correct it.
  3. [§4.3.3, Figure 4b] Since the dataset is stated to contain only harmful prompts, the 21.5% of samples predicted as 'Safe' is a miss rate; the paper should explicitly acknowledge this and discuss its implication for the TIDR values in Table 1.
  4. [§4.4, Figure 5] The ablation on τ shows TIDR decreasing as τ increases, which is expected, but the operating point of the baselines is not indicated; adding baseline TIDR as a function of their internal thresholds would clarify the comparison.

Circularity Check

2 steps flagged · score 6.0 of 10

The reported +10pp detection margin is largely an artifact of TIDR at τ=0 on an exclusively harmful set, and the evaluation's taxonomy, 480 prompts, and strongest attack all come from the authors' own CogMorph paper, making the central superiority and TESR claims partially circular.

  1. self definitional [Section 4.2, Eq. (9); Section 4.1 (dataset); Algorithm 1, Section 3.3; Section 4.3.1, Table 1]
    "In all main experiments, the toxicity threshold τ is set to 0 to maximize sensitivity, aligning with our goal of aggressively detecting harmful content. ... It is important to clarify that our dataset exclusively comprises harmful prompts. ... if R.category in [Safe,Reject,Error] then return 0 ... S←S+W[subcategory][d]∗B[d]∗R.confidence"

    By Eq. (9), TIDR counts images with a score exceeding τ; with τ=0 this is a maximum-sensitivity count. Algorithm 1 returns a positive weighted sum whenever the retrieval result has any harmful category, and returns 0 only for Safe/Reject/Error or no match. Hence TIDR(PRJ) is definitionally the rate at which the retrieval stage does not answer Safe. Combined with the paper's statement that the dataset exclusively comprises harmful prompts, and with the RAG prompt instructing the LLM to return the closest subcategory unless absolutely sure of harmlessness, most of the 1200 images are pre-disposed to positive scores.

  2. self citation load bearing [Figure 1 caption; Sections 3.2-3.3; Section 4.1 (datasets and attacks); Section 4.3.2 Tables 2-3; Section 4.3.3 Figure 3]
    "The harmful taxonomy and toxicity risk matrix is based on [10]. ... we curated a set of 480 prompts selected from [10], covering underrepresented but safety-critical categories ... we then applied four advanced jailbreak attack methods (i.e., QF-PGD [35], SneakyPrompt [33], RT-Attack [34], and CogMorph [10]). ... Each column represents one of the ten harmful categories defined by CorMorph [10]."

    Reference [10] is the authors' own CogMorph paper (Jing and Ying are authors of both works). It is load-bearing in three places: the PRJ retrieval taxonomy and risk matrix, the source of 480 of the 1200 evaluation prompts, and the attack that produces the strongest escalation results in Tables 2 and 3 (CogMorph, TESR=66.13%). Since the same self-authored taxonomy defines what the attack morphs content toward and what PRJ scores, the category-level interpretation results and TESR numbers are measured in a closed loop: they demonstrate agreement of PRJ with the authors' own framework rather than with an independent external benchmark. This is load-bearing self-citation chain, though the VLM/RAG/LLM pipeline itself is not equationally forced.

full rationale

The PRJ scoring equations (1)-(8) and Algorithm 1 are internally coherent, and the framework contains independently testable components (VLM description, RAG retrieval, LLM judgement). However, the two main empirical claims are substantially undermined by construction. First, the central Table 1 superiority result uses TIDR at τ=0 on a dataset the paper itself states is exclusively harmful, while Algorithm 1 makes any non-Safe category match produce a positive score; thus TIDR is essentially PRJ's self-flagging rate, with no precision or false-positive control. The paper's own caveats in Sections 4.1 and 4.2 that false positive rates are deferred confirm the recall-only, uncalibrated nature of the comparison. Second, the taxonomy and risk matrix, 480 of 1200 evaluation prompts, and the strongest attack, CogMorph, all come from the authors' prior paper [10] with overlapping authors, so the TESR and category-level results are not independently benchmarked. These issues make the headline 'over 10 percentage points' and 'uniquely captures toxicity escalation' claims partially circular by evaluation design, while the framework itself still retains non-trivial algorithmic content, so a full definitional identity score of 8-10 would be too high.

Assumptions & free parameters 4 free parameters · 4 assumptions · 1 invented entities

The central scoring mechanism rests on a risk matrix and a category taxonomy imported from the authors' own CogMorph paper [10]. The evaluation adds an alpha hyperparameter and a tau operating point, and the base scores are effectively fit to the authors' annotations. No independently verified entities are introduced beyond the matrix itself.

free parameters (4)
  • alpha (global versus feature score weight) = 0.6 (default)
    Equation (8) linearly blends image-level and feature-level toxicity scores; section 4.4 shows performance varies with alpha, so this is a hand-chosen hyperparameter the findings depend on.
  • Toxicity threshold tau = 0 (main experiments)
    Equation (9) defines detection as score > tau; the paper sets tau=0 to maximize recall, so any nonzero score counts as a detection and the operating point strongly affects TIDR comparisons.
  • Cognitive dimension base scores (MC, EP, VMI, AC, SI) = 0.3, 0.25, 0.2, 0.15, 0.1
    Section 3.3 states these weights come from a hybrid annotation process (expert annotation, GPT-4 analysis of 5,000 toxic samples, crowd survey), but the raw data and fitting procedure are not reported.
  • Category weights matrix W = not provided, imported from ref [10]
    Algorithm 1 requires per-category and per-subcategory weights across the five dimensions; the matrix is taken from the authors' prior CogMorph paper and is not specified in this manuscript.
assumptions (4)
  • ad hoc to paper The harmful taxonomy and toxicity risk matrix from CogMorph [10] constitute a valid ground-truth standard for image harm.
    The judgement stage scores against this matrix and the evaluation categories are the ten CogMorph categories (Section 4.3.3), so the paper assumes its own prior taxonomy is the correct measure of toxicity.
  • domain assumption Toxicity is linearly decomposable into a global caption score and per-feature scores.
    Equation (8) sums independently computed scores; the paper offers no evidence that harm is additive across features.
  • domain assumption An all-harmful dataset is sufficient to validate detection accuracy.
    Section 4.1 explicitly excludes benign prompts and defers false-positive evaluation to future work, so the accuracy claim is only about recall on a biased sample.
  • domain assumption The VLM caption and feature list capture all safety-relevant visual content.
    Perception stage (Section 3.1) relies on LLaVA-34B; any visual cue not described is invisible to retrieval and judgement.
invented entities (1)
  • Contextual Toxicity Risk Matrix
    purpose: Multi-dimensional scoring of harm severity along five cognitive axes (MC, EP, VMI, AC, SI)
    This is a subjective analytic construct introduced in Section 3.3. Its weights are obtained from an unreported hybrid annotation process, and no external validation shows these dimensions predict real-world toxicity.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PRJ: Perception-Retrieval-Judgement for Generated Images." pith.science (2026). https://pith.science/paper/I2XUXP57

@misc{pith2026250603683,
  author       = {Pith},
  title        = {Pith review of: PRJ: Perception-Retrieval-Judgement for Generated Images},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I2XUXP57}},
  note         = {Machine review of arXiv:2506.03683}
}
read the original abstract

The rapid progress of generative AI has enabled remarkable creative capabilities, yet it also raises urgent concerns regarding the safety of AI-generated visual content in real-world applications such as content moderation, platform governance, and digital media regulation. This includes unsafe material such as sexually explicit images, violent scenes, hate symbols, propaganda, and unauthorized imitations of copyrighted artworks. Existing image safety systems often rely on rigid category filters and produce binary outputs, lacking the capacity to interpret context or reason about nuanced, adversarially induced forms of harm. In addition, standard evaluation metrics (e.g., attack success rate) fail to capture the semantic severity and dynamic progression of toxicity. To address these limitations, we propose Perception-Retrieval-Judgement (PRJ), a cognitively inspired framework that models toxicity detection as a structured reasoning process. PRJ follows a three-stage design: it first transforms an image into descriptive language (perception), then retrieves external knowledge related to harm categories and traits (retrieval), and finally evaluates toxicity based on legal or normative rules (judgement). This language-centric structure enables the system to detect both explicit and implicit harms with improved interpretability and categorical granularity. In addition, we introduce a dynamic scoring mechanism based on a contextual toxicity risk matrix to quantify harmfulness across different semantic dimensions. Experiments show that PRJ surpasses existing safety checkers in detection accuracy and robustness while uniquely supporting structured category-level toxicity interpretation.

Figures

Figures reproduced from arXiv: 2506.03683 by the authors.

Figure 1
Figure 1. Language-driven (LLM), cognitively inspired PRJ framework for image toxicity detection, integrating visual perception (VLM), contextual memory retrieval (RAG), and rule-guided judgment. The harmful taxonomy and toxicity risk matrix is based on [10] [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Violin plots of toxicity score changes under different attack methods on SDXL (left) and under CogMorph across T2I models (right). PRJ consistently captures both the average shift in toxicity and its distributional spread, highlighting its sensitivity to attack-induced harm while maintaining stable cross-model performance. 4.3.3. Category-Level Toxicity Detection Capability To further illustrate PRJ’s interpretabili… view at source ↗
Figure 3
Figure 3. Category-level visual results under CogMorph attacks. Each column represents one of the ten harmful categories defined by CorMorph [10], and each row corresponds to a different text-to-image model. PRJ assigns a contextual toxicity score (TS) to each image. Copyright Infringement Discrimination Horror Harmful Text Illicit Inappropriate Insult Self-Harm Sexual Violence 0.2 0.4 0.6 0.8 1.0 (a) TESR by Model and Catego… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Category-level toxicity analysis results of PRJ. (a) Toxicity Escalation Score Rate (TESR) across 10 major harm categories under CogMorph attack on different T2I models, demonstrating PRJ’s consistent ability to detect nuanced escalation patterns across models. (b) Ove…
Figure 5
Figure 5. Figure 5: TIDR at different toxicity thresholds τ across six T2I models. Lower thresholds lead to higher recall, offering flexible control over moderation sensitivity. 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Alpha Value 0 1 2 3 4 5 6 7 Toxicity Score Toxicity Score Distribut…
Figure 6
Figure 6. Figure 6: Effect of scoring weight α on overall TIDR (right Y-axis, green line) and toxicity score distribution (left Y-axis, box plot). Black circles indicate outlier scores and red lines mark the median. Moderate α values yield lower score variance while maintaining stable det…

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025

    cs.CR 2025-06 conditional novelty 3.0 of 10

    The ATLAS 2025 competition demonstrates that vision-language models remain highly vulnerable to flowchart-based and cross-modal jailbreak attacks, with top scores exceeding 93%.

Reference graph

Works this paper leans on

47 extracted references · 27 canonical work pages · cited by 1 Pith paper

  1. [10]

    CogMorph: Cognitive Morphing Attacks for Text-to-Image Models

    Jing, Z.; Ying, Z.; Wang, L.; Liang, S.; Liu, A.; Liu, X.; Tao, D. CogMorph: Cognitive Morphing Attacks for Text-to-Image Models. arXiv2025, arXiv:2501.11815. https://doi.org/10.48550/arXiv.2501.11815

    arXiv doi:10.48550/arxiv.2501.11815

  2. [1]

    DALL·E 3, 2024

    OpenAI. DALL·E 3, 2024. Available online: https://openai.com/index/dall-e-3/ (accessed on 1 July 2024)

    work page 2024

  3. [2]

    SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis.arXiv2023, arXiv:2307.01952

    Podell, D.; English, Z.; Lacey, K.; Blattmann, A.; Dockhorn, T.; Müller, J.; Penna, J.; Rombach, R. SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis.arXiv2023, arXiv:2307.01952. http://arxiv.org/abs/2307.01952

    arXiv

  4. [3]

    Spatiotemporal Attacks for Embodied Agents

    Liu, A.; Huang, T.; Liu, X.; Xu, Y.; Ma, Y.; Chen, X.; Maybank, S.J.; Tao, D. Spatiotemporal Attacks for Embodied Agents.arXiv 2020, arXiv:2005.09161. https://doi.org/10.48550/arXiv.2005.09161

    work page Pith review arXiv doi:10.48550/arxiv.2005.09161 2020

  5. [4]

    Harnessing Perceptual Adversarial Patches for Crowd Counting

    Liu, S.; Wang, J.; Liu, A.; Li, Y.; Gao, Y.; Liu, X.; Tao, D. Harnessing Perceptual Adversarial Patches for Crowd Counting. In Proceedings of the ACM Conference on Computer and Communications Security, Los Angeles, CA, USA, 7–11 November 2022

    work page 2022

  6. [5]

    Bias-based universal adversarial patch attack for automatic check-out

    Liu, A.; Wang, J.; Liu, X.; Cao, B.; Zhang, C.; Yu, H. Bias-based universal adversarial patch attack for automatic check-out. In Proceedings of the Computer Vision–ECCV 2020: 16th European Conference, Proceedings, Part XIII 16, Glasgow, UK, 23–28 August 2020; Springer: Berlin/Heidelberg, Germany, 2020; pp. 395–410

    work page 2020

  7. [6]

    Pre-trained trojan attacks for visual recognition

    Liu, A.; Zhang, X.; Xiao, Y.; Zhou, Y.; Liang, S.; Wang, J.; Liu, X.; Cao, X.; Tao, D. Pre-trained trojan attacks for visual recognition. arXiv2023, arXiv:2312.15172

    arXiv

  8. [7]

    Exploring the Relationship between Architecture and Adversarially Robust Generalization

    Liu, A.; Tang, S.; Liang, S.; Gong, R.; Wu, B.; Liu, X.; Tao, D. Exploring the Relationship between Architecture and Adversarially Robust Generalization. In Proceedings of the 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Vancouver, BC, Canada, 17–24 June 2023

    work page 2023

Show all 47 references
  1. [8]

    DLP: Towards Active Defense Against Backdoor Attacks with Decoupled Learning Process.Cybersecurity2023, 6(1)

    Ying, Z.; Wu, B. DLP: Towards Active Defense Against Backdoor Attacks with Decoupled Learning Process.Cybersecurity2023, 6(1). https://doi.org/10.1186/s42400-023-00141-4

    doi

  2. [9]

    NBA: Defensive Distillation for Backdoor Removal via Neural Behavior Alignment.Cybersecurity2023,6(1)

    Ying, Z.; Wu, B. NBA: Defensive Distillation for Backdoor Removal via Neural Behavior Alignment.Cybersecurity2023,6(1). https://doi.org/10.1186/s42400-023-00154-z

    doi

  3. [11]

    Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models.arXiv2025, arXiv:2502.11054

    Ying, Z.; Zhang, D.; Jing, Z.; Xiao, Y.; Zou, Q.; Liu, A.; Liang, S.; Zhang, X.; Liu, X.; Tao, D. Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models.arXiv2025, arXiv:2502.11054. https://doi.org/10.48550/arXiv.2502 .11054

    doi arXiv

  4. [12]

    Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt

    Ying, Z.; Liu, A.; Zhang, T.; Yu, Z.; Liang, S.; Liu, X.; Tao, D. Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt. arXiv2024, arXiv:2406.04031. https://doi.org/10.48550/arXiv.2406.04031

    doi arXiv

  5. [13]

    Unveiling the Safety of GPT-4o: An Empirical Study Using Jailbreak Attacks.arXiv2024, arXiv:2406.06302

    Ying, Z.; Liu, A.; Liu, X.; Tao, D. Unveiling the Safety of GPT-4o: An Empirical Study Using Jailbreak Attacks.arXiv2024, arXiv:2406.06302. https://doi.org/10.48550/arXiv.2406.06302

    doi arXiv

  6. [14]

    SafeBench: A Safety Evaluation Framework for Multimodal Large Language Models.arXiv2024, arXiv:2410.18927

    Ying, Z.; Liu, A.; Liang, S.; Huang, L.; Guo, J.; Zhou, W.; Liu, X.; Tao, D. SafeBench: A Safety Evaluation Framework for Multimodal Large Language Models.arXiv2024, arXiv:2410.18927. https://doi.org/10.48550/arXiv.2410.18927

    doi arXiv

  7. [15]

    Towards Understanding the Safety Boundaries of DeepSeek Models: Evaluation and Findings.arXiv2025, arXiv:2503.15092

    Ying, Z.; Zheng, G.; Huang, Y.; Zhang, D.; Zhang, W.; Zou, Q.; Liu, A.; Liu, X.; Tao, D. Towards Understanding the Safety Boundaries of DeepSeek Models: Evaluation and Findings.arXiv2025, arXiv:2503.15092. https://doi.org/10.48550/arXiv.2503.1 5092

    doi arXiv

  8. [16]

    Manipulating Multimodal Agents via Cross-Modal Prompt Injection.arXiv2025, arXiv:2504.14348

    Wang, L.; Ying, Z.; Zhang, T.; Liang, S.; Hu, S.; Zhang, M.; Liu, A.; Liu, X. Manipulating Multimodal Agents via Cross-Modal Prompt Injection.arXiv2025, arXiv:2504.14348. https://doi.org/10.48550/arXiv.2504.14348

    doi arXiv

  9. [17]

    Perceptual-sensitive gan for generating adversarial patches

    Liu, A.; Liu, X.; Fan, J.; Ma, Y.; Zhang, A.; Xie, H.; Tao, D. Perceptual-sensitive gan for generating adversarial patches. In Proceedings of the 2019 AAAI, Honolulu, HI, USA, 27 January–1 February 2019

    2019

  10. [18]

    Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content?arXiv2022, arXiv:2202.06675

    Schramowski, P .; Tauchmann, C.; Kersting, K.; Schramowski, P .; Tauchmann, C.; Kersting, K. Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content?arXiv2022, arXiv:2202.06675. https://doi.org/10.4 8550/arXiv.2202.06675

    doi arXiv

  11. [19]

    Stable-Diffusion-Safety-Checker, 2022

    CompVis. Stable-Diffusion-Safety-Checker, 2022. Available online: https://huggingface.co/CompVis/stable-diffusion-safety- checker (accessed on 22 August 2022). Electronics2025,1, 0 18 of 19

    2022

  12. [20]

    OpenAI Moderation, 2024

    OpenAI. OpenAI Moderation, 2024. Available online: https://platform.openai.com/docs/guides/moderation/overview (ac- cessed on)

    2024

  13. [21]

    Adversarial examples improve image recognition

    Xie, C.; Tan, M.; Gong, B.; Wang, J.; Yuille, A.L.; Le, Q.V . Adversarial examples improve image recognition. In Proceedings of the 2020 IEEE Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA, 14–19 June 2020

    2020

  14. [22]

    Training robust deep neural networks via adversarial noise propagation

    Liu, A.; Liu, X.; Yu, H.; Zhang, C.; Liu, Q.; Tao, D. Training robust deep neural networks via adversarial noise propagation. IEEE Trans. Image Process.2021,30, 5769–5781

    2021

  15. [23]

    A Comprehensive Evaluation Framework for Deep Model Robustness.Pattern Recognit.2023,137, 109308

    Guo, J.; Bao, W.; Wang, J.; Ma, Y.; Gao, X.; Xiao, G.; Liu, A.; Dong, J.; Liu, X.; Wu, W. A Comprehensive Evaluation Framework for Deep Model Robustness.Pattern Recognit.2023,137, 109308

    2023

  16. [24]

    Towards Defending Multiple Lp-norm Bounded Adversarial Perturbations via Gated Batch Normalization.Int

    Liu, A.; Tang, S.; Chen, X.; Huang, L.; Qin, H.; Liu, X.; Tao, D. Towards Defending Multiple Lp-norm Bounded Adversarial Perturbations via Gated Batch Normalization.Int. J. Comput. Vis.2023,132, 1881–1898

    2023

  17. [25]

    Improved Baselines with Visual Instruction Tuning

    Liu, H.; Li, C.; Li, Y.; Lee, Y.J. Improved Baselines with Visual Instruction Tuning. In Proceedings of the 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA, 16–22 June 2024

    2024

  18. [26]

    A Survey on Retrieval-Augmented Text Generation for Large Language Models.arXiv2024, arXiv:2404.10981

    Huang, Y.; Huang, J. A Survey on Retrieval-Augmented Text Generation for Large Language Models.arXiv2024, arXiv:2404.10981. https://doi.org/10.48550/arXiv.2404.10981

    doi arXiv

  19. [27]

    The llama 3 herd of models.arXiv2024, arXiv:2407.21783

    Dubey, A.; Jauhri, A.; Pandey, A.; Kadian, A.; Al-Dahle, A.; Letman, A.; Mathur, A.; Schelten, A.; Yang, A.; Fan, A.; et al. The llama 3 herd of models.arXiv2024, arXiv:2407.21783

    arXiv

  20. [28]

    Divide-and-Conquer Attack: Harnessing the Power of LLM to Bypass the Censorship of Text-to-Image Generation Model.arXiv2023, arXiv:2312.07130v1

    Deng, Y.; Chen, H. Divide-and-Conquer Attack: Harnessing the Power of LLM to Bypass the Censorship of Text-to-Image Generation Model.arXiv2023, arXiv:2312.07130v1

    arXiv

  21. [29]

    MMA-diffusion: MultiModal Attack on Diffusion Models.arXiv2023, arXiv:2311.17516v4

    Yang, Y.; Gao, R.; Wang, X.; Ho, T.Y.; Xu, N.; Xu, Q. MMA-diffusion: MultiModal Attack on Diffusion Models.arXiv2023, arXiv:2311.17516v4

    arXiv

  22. [30]

    To Generate or Not? Safety-driven Unlearned Diffusion Models Are Still Easy to Generate Unsafe Images

    Zhang, Y.; Jia, J.; Chen, X.; Chen, A.; Zhang, Y.; Liu, J.; Ding, K.; Liu, S. To Generate or Not? Safety-driven Unlearned Diffusion Models Are Still Easy to Generate Unsafe Images ... For Now.arXiv2023, arXiv:2310.11868v4

    arXiv

  23. [31]

    Surrogateprompt: Bypassing the safety filter of text-to- image models via substitution

    Ba, Z.; Zhong, J.; Lei, J.; Cheng, P .; Wang, Q.; Qin, Z.; Wang, Z.; Ren, K. Surrogateprompt: Bypassing the safety filter of text-to- image models via substitution. In Proceedings of the Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, ...

    2024

  24. [32]

    Detoxify, 2020

    Hanu, L.; Unitary team. Detoxify, 2020. Available online: https://github.com/unitaryai/detoxify (accessed on 23 September 2020)

    2020

  25. [33]

    Sneakyprompt: Jailbreaking text-to-image generative models

    Yang, Y.; Hui, B.; Yuan, H.; Gong, N.; Cao, Y. Sneakyprompt: Jailbreaking text-to-image generative models. In Proceedings of the 2024 IEEE symposium on security and privacy (SP), San Francisco, CA, USA, 20–22 May 2024; pp. 897–912

    2024

  26. [34]

    RT-attack: Jailbreaking Text-to-Image Models via Random Token

    Gao, S.; Jia, X.; Huang, Y.; Duan, R.; Gu, J.; Liu, Y.; Guo, Q. RT-attack: Jailbreaking Text-to-Image Models via Random Token. arXiv2024, arXiv:2408.13896

    arXiv

  27. [35]

    A Pilot Study of Query-Free Adversarial Attack against Stable Diffusion

    Zhuang, H.; Zhang, Y.; Liu, S. A Pilot Study of Query-Free Adversarial Attack against Stable Diffusion. In Proceedings of the 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), Vancouver, BC, Canada, 17–24 June 2023; pp. 2385–2392. https://d...

    2023

  28. [36]

    Contextual Influences on Visual Processing.Ann

    Albright, T.D.; Stoner, G.R. Contextual Influences on Visual Processing.Ann. Rev. Neurosci.2002,25, 339–379. https://doi.org/10 .1146/annurev.neuro.25.112701.142900

    2002

  29. [37]

    The Influence of Affect on Higher Level Cognition: A Review of Research on Interpretation, Judgement, Decision Making and Reasoning.Cogn

    Blanchette, I.; Richards, A. The Influence of Affect on Higher Level Cognition: A Review of Research on Interpretation, Judgement, Decision Making and Reasoning.Cogn. Emot.2010,24, 561–595. https://doi.org/10.1080/02699930903132496

    2010 doi

  30. [38]

    Unlocking the Emotional World of Visual Media: An Overview of the Science, Research, and Impact of Understanding Emotion.Proc

    Wang, J.Z.; Zhao, S.; Wu, C.; Adams, R.B.; Newman, M.G.; Shafir, T.; Tsachor, R. Unlocking the Emotional World of Visual Media: An Overview of the Science, Research, and Impact of Understanding Emotion.Proc. IEEE2023,111, 1236–1286. https://doi.org/10.1109/JPROC.2023.3273517

  31. [39]

    Learning transferable visual models from natural language supervision

    Radford, A.; Kim, J.W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P .; Clark, J.; et al. Learning transferable visual models from natural language supervision. In Proceedings of the 2021 International Conference on Machine Learning, PMLR, ...

    2021

  32. [40]

    Visual Instruction Tuning.arXiv2023, arXiv:2304.08485

    Liu, H.; Li, C.; Wu, Q.; Lee, Y .J. Visual Instruction Tuning.arXiv2023, arXiv:2304.08485. https://doi.org/10.48550/arXiv .2304.08485

    doi arXiv

  33. [41]

    PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models.arXiv2024, arXiv:2402.07867

    Zou, W.; Geng, R.; Wang, B.; Jia, J. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models.arXiv2024, arXiv:2402.07867. https://doi.org/10.48550/ARXIV .2402.07867

    doi arXiv

  34. [42]

    Gpt-4 technical report.arXiv2023, arXiv:2303.08774

    Achiam, J.; Adler, S.; Agarwal, S.; Ahmad, L.; Akkaya, I.; Aleman, F.L.; Almeida, D.; Altenschmidt, J.; Altman, S.; Anadkat, S.; et al. Gpt-4 technical report.arXiv2023, arXiv:2303.08774

    arXiv

  35. [43]

    Stable Diffusion 3 Medium, 2024

    StabilityAI. Stable Diffusion 3 Medium, 2024. Available online: https://huggingface.co/stabilityai/stable-diffusion-3-medium (accessed on 12 June 2024)

    2024

  36. [44]

    Stable Diffusion 3.5 Medium, 2024

    StabilityAI. Stable Diffusion 3.5 Medium, 2024. Available online: https://huggingface.co/stabilityai/stable-diffusion-3.5-medium (accessed on 29 October 2024)

    2024

  37. [45]

    Stable Diffusion 3.5 Large, 2024

    StabilityAI. Stable Diffusion 3.5 Large, 2024. Available online: https://huggingface.co/stabilityai/stable-diffusion-3.5-large (accessed on 22 October 2024). Electronics2025,1, 0 19 of 19

    2024

  38. [46]

    Stable Diffusion 3.5 Large Turbo, 2024

    StabilityAI. Stable Diffusion 3.5 Large Turbo, 2024. Available online: https://huggingface.co/stabilityai/stable-diffusion-3.5- large-turbo (accessed on 22 October 2024)

    2024

  39. [47]

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models

    Schramowski, P .; Brack, M.; Deiseroth, B.; Kersting, K. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In Proceedings of the 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada, 17–24 June 2023; pp. 225...

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.