{"id":"d370d37c-ca46-4310-b938-b85f8be87a77","arxiv_id":"2502.00653","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Adversarial training with a contrastive embedding attack reduces jailbreak success rates to near zero across six multimodal LLMs and six attack methods while preserving utility.","lead":"SafeMLLM is a new training method that makes image-and-text AI models refuse harmful requests even when attackers add hidden noise to the input. Tests on six multimodal models and six jailbreak methods show attack success rates near zero while everyday question-answering quality is largely preserved.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"All reported white-box attacks are optimized against the original model, not against SafeMLLM; the central robustness claim is therefore unverified under the adaptive threat model the paper itself assumes.","rationale":"The reader's weakest_assumption identifies the embedding-surrogate gap, which is closely related to my concern. I agree that the surrogate is validated only against ImgJP, but I would put the weight on the absence of adaptive attacks: because the model and gradients are explicitly released, robustness must be measured against attackers who optimize on the defended model. The paper's non-adaptive results are plausible and internally consistent, and the utility preservation in Figure 3 and Table 4 is a useful positive signal, but they do not establish robustness in the stated white-box threat model. An adaptive VAA test would settle the question directly: VAA is a continuous pixel-space attack with many optimization steps, so if it succeeds against SafeMLLM, the central claim that SafeMLLM defends against white-box image attacks fails. If it fails, that is meaningful evidence in favor of the claim, while still leaving text-space adaptation as a further question. For these reasons I would keep the reader's CONDITIONAL verdict: the framework is plausible and worth conditional acceptance pending an adaptive evaluation, but not strong enough for unconditional ACCEPT.","tokens_in":27034,"tokens_out":5807,"duration_ms":64974,"concrete_test":"Run an adaptive version of the VAA attack against the released SafeMLLM weights: fix the SafeMLLM checkpoint, optimize a pixel-space perturbation via PGD for 5000 iterations on the 66 training toxic texts using SafeMLLM's own gradients, then evaluate ASR on the 40 held-out Harmful Instructions prompts. If ASR rises materially above the reported 0.42% average, the surrogate assumption and the white-box robustness claim are not supported.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The paper's threat model is explicitly white-box: Section 3.1 states that after tuning, the learned parameters and gradient information will be publicly released to potential attackers. The central claim, however, is supported only by non-adaptive attack evaluations. In Section 5.1, ImgJP, VAA, GCG, and AutoDAN are run with the hyperparameters and objectives from the original attack papers, optimized against the original MLLM, not against the released SafeMLLM checkpoint. Those measurements show that pre-existing attacks do not transfer well to SafeMLLM; they do not show that a white-box attacker who optimizes directly against SafeMLLM's gradients cannot find successful perturbations. The training-time surrogate in Section 3.2 (Eqs. 1-3) only optimizes two 8-token embedding matrices, which is a low-dimensional subspace of the actual perturbation spaces: image attacks operate in pixel space and text attacks operate over discrete token substitutions. Appendix H validates this surrogate only against ImgJP on two LLaVA models (Table 3), not against VAA, GCG, AutoDAN, and not under adaptation. The near-zero ASR values in Table 1 are therefore conditional on the unverified assumption that CoE-Attack perturbations cover the worst-case perturbations a white-box adversary can construct against the trained model.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SafeMLLM, an adversarial training framework for multimodal large language models (MLLMs) against jailbreak attacks. The defense alternates between an attack step, which optimizes two K-token embedding perturbations Ph and Pt under a contrastive objective (CoE-Attack), and a model-update step that minimizes a defense loss on toxic inputs plus a utility loss on benign inputs. The method is evaluated on six MLLMs (MiniGPT-v4, InstructBLIP, LLaVA, each in 7B/13B sizes) against six jailbreak attacks (ImgJP, VAA, GCG, AutoDAN, FigStep, MM-SafetyBench), reporting near-zero attack success rates (ASR) on SafeMLLM while preserving utility on benign benchmarks. The paper claims this is the first adversarial-tuning defense for MLLMs and emphasizes robustness in white-box scenarios.","tokens_in":27330,"tokens_out":4566,"duration_ms":42510,"significance":"If the claimed results hold, SafeMLLM would be a meaningful step toward principled defenses against jailbreak attacks on MLLMs: it is the first adversarial training framework for this setting, it is computationally efficient relative to pixel- or latent-level perturbation training, and it targets a clear threat model (white-box access to model parameters). The paper is transparent in its evaluation protocol: ASR is judged by a GPT-4-based judge, held-out attack datasets and official attack hyperparameters are used, and detailed appendices provide ablations, hyperparameter analyses, and a limitation statement. The near-zero ASRs on non-adaptive attacks across six models and the improved utility over baselines are suggestive of genuine transfer robustness. However, the central white-box claim is not yet supported by the experiments, because all white-box attacks are optimized against the original, untuned MLLM rather than against the released SafeMLLM checkpoint.","major_comments":[{"comment":"Section 3.1 states that after tuning, the learned parameters θ* and gradient information will be publicly released to potential attackers, which defines a white-box threat model. Yet all white-box attacks in Table 1 (ImgJP, VAA, GCG, AutoDAN) are implemented with the original attack papers' settings (Appendix C) and optimized against the original MLLM, not against the tuned SafeMLLM checkpoint. The near-zero ASR values therefore demonstrate that pre-existing jailbreak attacks do not transfer to SafeMLLM, but they do not establish that a white-box adversary who optimizes directly against SafeMLLM's gradients cannot find successful perturbations. The paper's central claim to defend against white-box attacks (Abstract, §1, §5.1) is thus unverified under the threat model it assumes. I recommend either adding adaptive attack evaluations (e.g., running ImgJP, GCG, and AutoDAN optimizations against the tuned SafeMLLM) or explicitly reframing the contribution as robustness to transferred, non-adaptive attacks.","section":"§3.1, §5.1, Appendix C"},{"comment":"CoE-Attack trains the defense against two 8-token embedding perturbations Ph and Pt placed before and after the query (Eqs. 1-3). This surrogate lives in a low-dimensional subspace of the actual perturbation spaces: image attacks perturb pixel space (ImgJP, VAA), and text attacks perform discrete token substitutions (GCG, AutoDAN). Appendix H validates the surrogate only against ImgJP on the two LLaVA models (Table 3) and does not test VAA, GCG, or AutoDAN; moreover, that validation still does not adapt the attack to the tuned model. Consequently, the generalization of the defense to the other five evaluation attacks is an empirical claim with no direct support, and the statement in Appendix H that the embedding perturbations 'unify' jailbreak perturbations from different modalities remains an assumption rather than a demonstrated property.","section":"§3.2, Appendix H"},{"comment":"The hyperparameters λ and K are selected by minimizing ImgJP ASR on MiniGPT-v4-13B (Figure 8), and ImgJP is also one of the main evaluation attacks in Table 1. The reported ImgJP results are therefore partly a consequence of tuning on the evaluation metric, which weakens the independence of the headline numbers. The manuscript should state explicitly that λ and K were fixed on separate validation data before evaluating all attacks, or provide a sensitivity analysis showing that the main conclusions (e.g., near-zero ASR across models) hold for other reasonable choices of λ and K.","section":"Appendix I, §5.1"}],"minor_comments":[{"comment":"In the AutoDAN row, 'textbf0.50' appears to be a LaTeX formatting error; it should read '0.50'.","section":"Table 1"},{"comment":"In the inner attack loop, the update is written as '{Ph_{m-1}, Pt_{m-1}} to {Ph_m, Ph_m}'; the second updated matrix should be Pt_m.","section":"Algorithm 1"},{"comment":"The section headings contain the typo 'Impcat' in both occurrences; they should read 'Impact'.","section":"Appendix I"},{"comment":"Yu et al. (2024a) and Yu et al. (2024b) refer to the same MM-Vet paper; these should be merged to a single reference.","section":"References"},{"comment":"In the MiniGPT4-13B row, 'v5.8' appears to be a typographic artifact and should be '5.8'.","section":"Table 4"},{"comment":"No confidence intervals, standard deviations, or repeated runs are reported for any ASR or utility value; given the small evaluation sets (e.g., 40 prompts for VAA, 25 training queries for ImgJP), reporting variability would help assess the stability of the near-zero ASRs.","section":"§5.1"}],"recommendation":"major_revision","confidential_remarks":"The paper's core idea is interesting and the empirical study is broad, but the central white-box robustness claim presently rests on non-adaptive attack evaluation, which is not the threat model the authors state. This is a load-bearing issue that can be addressed within the manuscript's scope by running at least a subset of adaptive attacks (or by substantially reframing the claims). I would also encourage the authors to address the surrogate-validity concern with evidence beyond ImgJP on LLaVA. If those revisions are convincing, the paper could be a solid contribution to the MLLM safety literature."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here is my take for your book. This paper is a reasonable first attempt at adversarial tuning for MLLMs, but its central robustness claim is undercut by the evaluation protocol: every reported attack is the pre-optimized version from the original paper, run against the original model and then transferred to SafeMLLM. The paper explicitly adopts a white-box threat model (parameters and gradients released to attackers), so that protocol does not test what the paper claims. Pre-existing attacks not transferring well is evidence of robustness, but not proof against a white-box attacker who can optimize directly against the SafeMLLM checkpoint.\n\nThe new piece is real. CoE-Attack optimizes two K-token embedding matrices placed around the query, with a contrastive loss on affirmative versus refusal continuations, and uses that to fine-tune the LoRA adapter and decoder. The evaluation is broad—six MLLMs, six attack types, utility checks on LLaVA-Instruct and MM-Vet—and the ablation study showing the target loss and contrastive loss each matter is useful. If the numbers are reproducible, the method does seem to suppress the tested attacks and keep most utility.\n\nSoft spots beyond the missing adaptive attacks: no confidence intervals or multiple runs in the main table; hyperparameters lambda and K are selected on the ImgJP evaluation set (Appendix I); no code released at submission; and the defense baseline coverage is thin (only VLGuard, R2D2, CAT). The low-dimensional surrogate attack (8 token embeddings) is only validated against ImgJP on two LLaVA models in Appendix H, not against GCG, AutoDAN, or VAA, and not under adaptation. These are addressable, but they matter.\n\nWho is this for? Researchers working on MLLM safety and adversarial robustness. The framework idea is worth discussing in a reading group. My recommendation: send it to peer review, but with the expectation of major revision. The authors should run adaptive attacks, report variance, state clearly what non-adaptive results do and do not support, and release code and checkpoints.","headline":"A plausible first adversarial-tuning framework for MLLMs, but the headline white-box robustness claims are only supported by non-adaptive attacks.","tokens_in":27871,"tokens_out":4309,"would_cite":true,"duration_ms":42304,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SafeMLLM proposes adversarial training at the token-embedding level to defend MLLMs against image, text, and image-text jailbreak attacks, reporting near-zero attack success rates across six models while preserving utility.","keywords":["multimodal large language models","jailbreak attacks","adversarial training","contrastive embedding attack","safety alignment","white-box robustness","attack success rate","vision-language model defense"],"falsifier":"Run the white-box attacks used in the paper (ImgJP, VAA, GCG, AutoDAN) against a SafeMLLM-tuned model but with perturbations optimized outside the 8-token embedding manifold—for instance, full pixel-space image noise, a 64-token suffix, or latents in intermediate decoder layers—and compare ASR with the reported near-zero numbers. If any of these variants raises ASR substantially, the embedding surrogate does not cover the real attack space.","tokens_in":26827,"feed_emoji":"🛡️","tokens_out":9132,"duration_ms":75977,"temperature":0.7,"pith_summary":"SafeMLLM is an adversarial training framework for multimodal large language models that aims to neutralize jailbreak attacks at the token-embedding level, rather than relying on external filters or static safety fine-tuning. The paper's central claim is that optimizing two short embedding perturbations—one in the image slot and one in the text-suffix slot—under a contrastive attack objective produces models that reject harmful queries across image-based, text-based, and image-text jailbreak attacks, including white-box attacks that defeat safety-aligned baselines. Across six MLLMs, the paper reports average attack success rates of 1.50% on ImgJP, 0.42% on VAA, 0.00% on GCG, and 0.17% on AutoDAN, with zero ASR on the black-box FigStep and MM-SafetyBench sets, while utility on benign instruction data and MM-Vet stays at or above the original model. If correct, this makes adversarial training a practical, architecture-preserving defense for open-ended multimodal generation.","feed_headline":"SafeMLLM cuts jailbreak success to near zero","feed_subtitle":"Adversarial tuning on token embeddings blocks image, text, and image-text jailbreaks across six multimodal LLMs.","key_machinery":"The load-bearing mechanism is CoE-Attack, a contrastive embedding attack. It represents a jailbreak attempt as two learnable perturbation matrices $P^h_0 \\in \\mathbb{R}^{K \\times C}$ and $P^t_0 \\in \\mathbb{R}^{K \\times C}$ inserted before and after a toxic query, with $K=8$ tokens in the paper's experiments, so that image and text attacks are unified into one optimization problem. The attack objective combines a target term that raises the log-likelihood of an affirmative response and a contrastive term $\\log \\sigma(\\log p(c_n) - \\log p(r_n))$ that widens the gap between affirmative and refusal probabilities without collapsing the model into incoherent text. The same contrastive structure is inverted in Step II's defense loss so the model learns to produce the safety response under adversarial embeddings, and the utility loss prevents over-refusal on benign inputs.","core_discovery":"SafeMLLM's discovery is that a jailbreak defense can be trained end-to-end by treating token embeddings as the attack surface. In Step I, CoE-Attack fixes the model parameters and optimizes two $K$-token matrices, $P^h_0$ placed where an adversarial image enters and $P^t_0$ placed where a text suffix enters, to maximize the probability of an affirmative label $c_n$ while using a contrastive term to suppress the refusal label $r_n$. In Step II, the learned perturbations are frozen and the model's LoRA parameters are updated so that the safety response wins under those same embeddings, with a utility loss on benign image-question pairs preserving normal behavior. Repeating these steps yields fine-tuned MiniGPT-v4, InstructBLIP, and LLaVA models at 7B and 13B scale with near-zero ASR across all six tested attack families, which the paper interprets as evidence that embedding-level adversarial training transfers across modalities and attack types.","pith_inferences":["If SafeMLLM's premise is right, then an adversarial test that optimizes perturbations outside the 8-token embedding manifold—real pixel noise, longer suffixes, or intermediate-layer latent perturbations—would be the decisive stress test; the paper's Appendix H only compares the surrogate against ImgJP.","The contrastive pairing of affirmative and refusal labels could be reused as a generic safety regularizer in instruction tuning, potentially reducing over-refusal without a dedicated attack loop, though the paper does not make this claim.","The near-zero black-box results suggest the defense is not merely an artifact of the embedding surrogate, but the paper does not establish the same for audio or video inputs, a limitation it explicitly acknowledges."],"forward_implications":["If the central claim is correct, MLLM jailbreak defense no longer requires a third-party inference-time filter: a four-GPU-hour fine-tuning pass with LoRA is enough to bring white-box and black-box attacks to near-zero success.","The same embedding-level perturbation set defends three different attack families—image, text, and image-text—meaning a single tuning procedure can replace per-attack safety alignment.","The reported gap between 7B and 13B models implies that larger decoders absorb the adversarial embedding signal better, so robustness from this method should improve as model capacity grows.","Because the vision encoder stays frozen and only the adapter and decoder are tuned, the method can be applied to existing open MLLMs without changing their deployment architecture."],"supporting_citations":[{"why":"Defines the white-box image jailbreak attack ImgJP and the AdvBench evaluation setting that SafeMLLM must survive.","marker":"Niu et al., 2024"},{"why":"Defines the VAA image attack and the Harmful Instructions dataset used in the white-box robustness evaluation.","marker":"Qi et al., 2024a"},{"why":"Defines the GCG text-suffix attack and the AdvBench dataset used for both GCG and AutoDAN evaluations.","marker":"Zou et al., 2023"},{"why":"Defines AutoDAN, the genetic-algorithm text jailbreak used as a white-box baseline.","marker":"Liu et al., 2024b"},{"why":"Defines FigStep, the black-box typographic image-text attack, and supplies SafeBench-Tiny.","marker":"Gong et al., 2023"},{"why":"Defines MM-SafetyBench, the black-box image-text benchmark for cross-modality generalization.","marker":"Liu et al., 2023b"},{"why":"Supplies VLGuard, the safety fine-tuning baseline that SafeMLLM outperforms under white-box attacks.","marker":"Zong et al., 2024"},{"why":"Supplies R2D2, an LLM adversarial-training baseline adapted to the decoder for comparison.","marker":"Mazeika et al., 2024"},{"why":"Supplies CAT, the other LLM adversarial-training baseline used for comparison.","marker":"Xhonneux et al., 2024"},{"why":"Supplies LoRA, the parameter-efficient tuning mechanism through which SafeMLLM updates the adapter and decoder.","marker":"Hu et al., 2022"}],"fun_headline_variants":["Embedding-level adversarial training blocks MLLM jailbreaks","SafeMLLM thwarts jailbreaks with contrastive embedding attack","Token-embedding defense cuts jailbreak success to near zero","Adversarial training on token embeddings makes MLLMs robust","Contrastive embedding attack trains MLLMs against jailbreaks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method's robustness rests on the assumption that the eight-token embedding perturbations learned by CoE-Attack faithfully represent the space of jailbreak perturbations that real image and text attacks produce; the paper validates this surrogate directly against only one attack, ImgJP, and generalizes to the others empirically.","fun_headline_variants_meta":{"raw":{"variants":["Embedding-level adversarial training blocks MLLM jailbreaks","SafeMLLM thwarts jailbreaks with contrastive embedding attack","Token-embedding defense cuts jailbreak success to near zero","Adversarial training on token embeddings makes MLLMs robust","Contrastive embedding attack trains MLLMs against jailbreaks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000229,"raw_usage":{"total_tokens":1474,"prompt_tokens":939,"completion_tokens":535,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":555,"completion_tokens_details":{"reasoning_tokens":463}},"tokens_in":555,"tokens_out":535,"duration_ms":5369,"temperature":1.0,"reasoning_tokens":463,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T18:10:58.488389+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the white-box attacks used in the paper (ImgJP, VAA, GCG, AutoDAN) against a SafeMLLM-tuned model but with perturbations optimized outside the 8-token embedding manifold—for instance, full pixel-space image noise, a 64-token suffix, or latents in intermediate decoder layers—and compare ASR with the reported near-zero numbers. If any of these variants raises ASR substantially, the embedding surrogate does not cover the real attack space.","supporting_citations":[],"review_version":1}