Pith. sign in

REVIEW 4 major objections 4 minor 3 cited by

Internal Activation Revision: Safeguarding Vision Language Models Without Parameter Update

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adding a contrastive activation vector to a VLM's internal activations during generation cuts jailbreak success rates by about half while barely reducing accuracy.

desk verdict Useful training-free VLM defense built on activation steering, but the headline ASR numbers are post-selection maxima from tuning on the evaluation benchmarks themselves. read the letter →

arxiv 2501.16378 v1 pith:S6CT7TRM submitted 2025-01-24 cs.LG cs.AIcs.CLcs.CV

Qing Li , Jiahui Geng , Zongxiong Chen , Kun Song , Lei Ma , Fakhri Karray This is my paper · ORCID
classification cs.LGcs.AIcs.CLcs.CV
keywords InternalactivationrevisionVisionlanguagemodelsafetyJailbreakdefensesteeringContrastivevectorsMassmeanshiftHead-levelinterventionMultimodal
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that vision-language models are easy to jailbreak because images shift the internal activations away from the text-only distributions on which the backbone LLM's safety alignment was learned, and that this alignment is not robust to the shift. To fix this without retraining, it proposes 'internal activation revision': at generation time, add a contrastive vector extracted from a few hundred safe and unsafe image-text examples to the activations of a chosen layer or attention head. In experiments on LLaVA-V1.5-7B/13B and Qwen2-VL-7B, the best variant (head-level revision with mass mean shift and multimodal response samples) cuts attack success rates by an average of 48.94%, 34.34%, 43.92%, and 52.98% on SafeBench, Safe-Unsafe, Unsafe, and MM-SafetyBench, while lowering ScienceQA accuracy by only 7.72% and GQA by 1.17%. The paper also shows the extracted vectors transfer to other models with the same hidden dimension.

What carries the argument

The load-bearing mechanism is mass mean shift (MMS): from N positive (safe) and N negative (unsafe) samples, the revision vector is the difference between the mean last-token activation of the negative cluster and the mean of the positive cluster at a chosen layer or attention head. At head level, the vector is added with strength α to 70% of heads before concatenation; at layer level, it is added after the MLP output. This single direction, extracted from 100–200 samples, is what carries the safety steering.

What would settle it

A jailbreak prompt constructed so that its activation displacement is orthogonal to the revision vector would evade the defense: measuring attack success rate on such prompts, or on a held-out attack family absent from the contrastive training samples, would settle whether the linear direction generalizes.

Watch

Extended reading notes

Core claim

The central claim is that VLM safety can be steered by a single linear 'safety direction' in activation space, computed as the mean difference between activations on harmful and benign multimodal prompts, and that adding this vector at the right layer or head redirects generation toward safe responses. The authors show that text-only probes and text-derived revision vectors fail on multimodal inputs, while vectors computed from multimodal positive/negative pairs succeed, locating the vulnerability in the image-induced activation shift. The strongest configuration, head-level revision with mass mean shift on Multi-Response samples, outperforms trained defenses such as MLLM-Protector and AdaShield on composite scores, and the dependence on layer and strength follows a clear pattern: middle layers offer the best safety-helpfulness trade-off.

Load-bearing premise

The assumption is that one linear direction, the mean difference between safe and unsafe activations, captures enough of the safety-relevant variation to block all future jailbreak attacks, including ones not seen in the contrastive sample.

Editorial extensions

If this is right

  • Revising activations at a single head level can block most tested jailbreaks on several VLMs without any parameter update or fine-tuning.
  • The safety gap between multimodal and unimodal inputs is largely reducible to an activation shift, so defenses at the activation level can be as effective as training-based alignment.
  • A revision vector computed once on LLaVA-V1.5-7B protects MiniGPT-V2 and InternVL2-8B, implying that steering vectors transfer across models with matching hidden dimensions.
  • Head-level revision preserves helpfulness better than layer-level revision, pointing to attention heads as the preferred intervention point for safety steering.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same contrastive-activation machinery could steer other failure modes in multimodal models, such as hallucination or sycophancy, by replacing the safe/unsafe contrast with a truthfulness or calibration contrast.
  • Because the vector is static and attack-agnostic, an adaptive attacker who crafts inputs that push activations along the steering direction might undo the defense; testing against such adaptive attacks would bound its real-world robustness.
  • The finding that the 9th layer shows early and clear separation between safe and unsafe activations suggests a general heuristic: pick the earliest layer where the contrast clusters cleanly, rather than searching all layers.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes internal activation revision, a training-free method that adds contrastive vectors to layer- or head-level activations of vision-language models during generation to improve safety. The authors argue that multimodal inputs shift internal activations and weaken safety alignment, and that adding revision vectors extracted from a few hundred positive and negative samples can steer the model toward safer outputs. They report large attack success rate (ASR) reductions on SafeBench, Safe-Unsafe, Unsafe, and MM-SafetyBench, with minimal accuracy loss on ScienceQA and GQA, for LLaVA-V1.5-7B/13B and Qwen2-VL-7B. The paper also claims cross-model transferability of the revision vectors and provides an analysis of why VLMs are more vulnerable than their LLM backbones.

Significance. If the evaluation protocol is corrected, the work has practical value as a data-efficient, training-free defense for VLMs. The probing analysis (Figure 3) provides evidence that safety classifiers trained on text-only data fail on multimodal inputs, supporting the activation-shift hypothesis. The systematic comparison of sample construction strategies and vector extraction methods is also a useful contribution. However, the current headline numbers are not credible as unbiased estimates because the revision layer, strength, and head ratio are selected on the same benchmarks that are then reported as evaluation results. The direction of the revision vector is also described inconsistently. These issues must be resolved before the central claim can be accepted.

major comments (4)
  1. [Revision Vectors Extraction, Equations (3)-(4)] The hyperparameter selection protocol invalidates the reported ASR reductions. The composite score CS in Eq. (7) is computed from the same safety benchmarks (SafeBench, MM-SafetyBench, Safe-Unsafe, Unsafe) and helpfulness benchmarks (ScienceQA, GQA) that are later reported in Table 2, and Table 3 shows that the choice of layer l and strength α is based on maximizing CS on exactly these benchmarks. The head ratio (70%) is similarly chosen on evaluation data in Appendix Figure 9. Consequently, the numbers in Table 2 are post-selection maxima, not the expected performance of a fixed configuration on unseen attacks. The authors should re-evaluate using a held-out validation set for parameter selection (e.g., a subset of each benchmark, or a separate safety/helpfulness set) and report results on the held-out test portions without per-benchmark tuning. Alternatively, they should report the performance of a single fixed configuration (e.g., layer 9, α=1.5, 70% heads) without selecting parameters on the evaluation benchmarks. As written, the central claim that the method 'significantly improves safety' is not supported by the reported numbers.
  2. [Evaluation, Table 2] There is a sign/direction inconsistency in the definition of the revision vector. The text states that MMS computes the vector pointing 'from the positive mean to the negative mean' (Section 'Revision Vectors Extraction'), while positive samples are defined as benign/safe and negative samples as harmful (Section 'Dataset'). Equation (3) then adds α times this vector to the residual stream: x_{l+1} = MLP(x'_l) + x'_l + α·r. If r points from the safe mean to the harmful mean, adding it would shift activations toward harmful behavior, which contradicts the reported safety improvements. The authors should clarify whether the intended direction is from negative to positive (i.e., μ_pos − μ_neg) or whether the update should instead subtract α·r. This is essential for reproducibility and for the logical consistency of the method.
  3. [Analysis and Discussion, item (4), Table 4] No uncertainty quantification is provided. The revision vectors are estimated from a few hundred randomly sampled positive and negative examples (100 or 200 samples, as described in 'Construction of contrastive samples'). Without reporting standard deviations or a sensitivity analysis over different random subsets and seeds, it is impossible to assess whether the ASR differences in Table 2 are within noise. Given the small sample sizes and the fact that the paper's central claim depends on these differences, the authors should report variability (e.g., mean ± std over at least 3 different random samples) or a sensitivity analysis.
  4. [Dataset and Construction of contrastive samples] The cross-model transferability claim is not sufficiently supported. Table 4 reports only composite scores for three layers (9, 14, 19) on MiniGPT-V2 and InternVL2-8B, without showing the underlying ASR and ACC values, and without explaining how the revision vectors from LLaVA-V1.5-7B are applied to models with potentially different layer counts and hidden dimensions. The text states that the models share the same representation dimension, but the layer mapping is not specified. This claim should be either substantiated with full metrics and a detailed adaptation procedure, or appropriately caveated as preliminary.
minor comments (4)
  1. [Abstract and Introduction] The phrase 'reducing attack success rates by an average of 48.94%, ...' is ambiguous. Based on the numbers in Table 2, these are absolute percentage-point reductions (e.g., 70.00% to 22.48% for LLaVA-V1.5-7B on SafeBench), not relative reductions. The authors should specify 'percentage points' to avoid misleading readers.
  2. [Appendix, Head-level Revision] The appendix states 'we selected some heads from the ninth layer for head revision,' but the main text (Section 'Impact of Layer, Head, and Strength α') selects the 19th layer for the optimal head-level revision. This inconsistency should be resolved.
  3. [Equation (7), Evaluation] The choice of λ = 3.0 in the composite score is stated to be 'empirically set' without further justification. A brief sensitivity analysis (e.g., how the ranking of configurations changes for λ ∈ {1,2,3,5}) would strengthen the parameter selection protocol.
  4. [Activation Visualization with t-SNE and Probing Analysis] The t-SNE visualization (Figure 2) and probing experiments (Figure 3) are only demonstrated on LLaVA-V1.5-7B. Confirming the activation-shift pattern on at least one additional model (e.g., Qwen2-VL-7B) would make the motivation more robust.

Circularity Check

2 steps flagged · score 2.0 of 10

The headline safety gains are selected by tuning layer, strength, and head ratio on the evaluation benchmarks themselves, but the revision vectors are estimated from held-out training data, so the core method is not circular.

  1. fitted input called prediction [Section 'Evaluation' (Eq. 7) and 'Defense Effectiveness' (Table 2)]
    "The composite score plays a crucial role in determining the optimal revision layer and strength. We empirically set λ = 3.0 to balance safety and helpfulness. ... Table 2 highlights the optimal results across various settings determined through hyperparameter search, with a detailed analysis provided in the following subsection."

    Equation (7) defines CS using Dsafety = SafeBench, Safe-Unsafe, Unsafe, and MM-SafetyBench and Dhelpfulness = ScienceQA and GQA, which are exactly the datasets reported in Table 2. The layer l, strength α, and variant are then selected to maximize CS on these same evaluation benchmarks, and Table 2 reports the selected configuration as the method's result. The headline ASR reductions are therefore maxima of a grid search evaluated on the target test sets, not the expected performance of a fixed configuration on unseen data. The reported 'prediction' is partially selected by the target quantities themselves.

  2. fitted input called prediction [Appendix 'Head-level Revision' and Figure 9]
    "For head-level revision, we select the optimal proportion of modified heads per layer, which we empirically set at 70%. ... Figure 9 illustrates when the head ratio is increased from 70% to 80%, the accuracy of ScienceQA declines significantly without much gain in safety performance. ... Therefore, we choose 70% heads for our experiments."

    The 70% head ratio is chosen by inspecting safety (ASR on SafeBench) and helpfulness (ACC on ScienceQA) on the same evaluation benchmarks that later appear in the headline results. Selecting this design choice on the target benchmarks, and then reporting the corresponding results as the method's performance, means the reported numbers co-vary with the evaluation labels. This is a mild test-set selection effect rather than a constructional equivalence, but it inflates the headline gains.

full rationale

The core derivation is not circular: the revision vectors are computed as mean-difference or probe directions from positive and negative samples drawn from VLGuard training data and Refusal, not from the safety evaluation benchmarks, and safety/helpfulness are measured on held-out datasets. No load-bearing claim reduces to a self-citation, an imported uniqueness theorem, or a definitional identity. The only circularity is in the evaluation protocol: the layer, strength, head ratio, and variant are chosen by maximizing the composite score computed on the very benchmarks used for the reported ASR reductions and accuracy changes. This makes the abstract and Table 2 numbers post-selection maxima and mildly overstates expected performance, but the method itself remains a genuine steering procedure whose vector is independent of the test labels. A score of 2 reflects this partial selection-basis circularity without treating the central contribution as equivalent to its inputs.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim depends on several tuned hyperparameters (alpha, layer, head ratio) selected on the evaluation benchmarks, plus structural assumptions about linear separability of safety directions and the validity of the Perspective API judge. No new physical or conceptual entities are introduced.

free parameters (5)
  • revision strength alpha = 1.5 for layer-level, 2.0 for head-level on LLaVA-7B; grid searched over 0.5-2.5
    Controls the magnitude of activation shift; chosen by maximizing composite score computed on evaluation benchmarks (Table 3, Figure 6). Central to the reported safety/helpfulness trade-off.
  • revision layer = Layer 9 for layer-level; layer 19 for head-level (LLaVA-7B)
    Selected from the set {4,9,14,19,24,29,31} based on composite score on SafeBench and ScienceQA; deeper layers hurt helpfulness, shallow layers help little.
  • head ratio = 70% of heads in the selected layer
    Empirically chosen; 60% improves safety, 80% degrades ScienceQA (Appendix, Figure 9). Not derived from a principle.
  • lambda in composite score = 3.0
    Set empirically to balance safety and helpfulness in the objective used to pick hyperparameters (Equation 7).
  • sample size for revision vectors = 100-200 entries
    The paper samples 100 harmful plus 100 benign instructions (Multi-Instruction) or 200 response pairs (Multi-Response) from VLGuard training split; the exact choice is not ablated but is small.
assumptions (4)
  • standard math Transformer decoder residual stream equations (1) and (2) describe the VLM architecture.
    Invoked in Section 3 Preliminary as the substrate for revision equations (3) and (4).
  • domain assumption The distribution shift between text-only and image-text activations is causally linked to VLM safety vulnerability.
    Section 3 hypothesizes that activation differences 'may lead to weaker robustness'; the intervention is motivated by this, but no controlled causal test is provided.
  • domain assumption A single linear direction in activation space can separate safe from unsafe behavior across diverse inputs.
    The MMS and PWD revision vectors assume a global steerable direction; the paper validates this only on the tested benchmarks, not as a guarantee.
  • domain assumption Perspective API is a valid automated judge for labeling responses as safe or harmful in ASR measurement.
    Used to compute attack success rates in Section 4 Evaluation; no human verification or agreement reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Internal Activation Revision: Safeguarding Vision Language Models Without Parameter Update." pith.science (2026). https://pith.science/paper/S6CT7TRM

@misc{pith2026250116378,
  author       = {Pith},
  title        = {Pith review of: Internal Activation Revision: Safeguarding Vision Language Models Without Parameter Update},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/S6CT7TRM}},
  note         = {Machine review of arXiv:2501.16378}
}
read the original abstract

Vision-language models (VLMs) demonstrate strong multimodal capabilities but have been found to be more susceptible to generating harmful content compared to their backbone large language models (LLMs). Our investigation reveals that the integration of images significantly shifts the model's internal activations during the forward pass, diverging from those triggered by textual input. Moreover, the safety alignments of LLMs embedded within VLMs are not sufficiently robust to handle the activations discrepancies, making the models vulnerable to even the simplest jailbreaking attacks. To address this issue, we propose an \textbf{internal activation revision} approach that efficiently revises activations during generation, steering the model toward safer outputs. Our framework incorporates revisions at both the layer and head levels, offering control over the model's generation at varying levels of granularity. In addition, we explore three strategies for constructing positive and negative samples and two approaches for extracting revision vectors, resulting in different variants of our method. Comprehensive experiments demonstrate that the internal activation revision method significantly improves the safety of widely used VLMs, reducing attack success rates by an average of 48.94\%, 34.34\%, 43.92\%, and 52.98\% on SafeBench, Safe-Unsafe, Unsafe, and MM-SafetyBench, respectively, while minimally impacting model helpfulness.

Figures

Figures reproduced from arXiv: 2501.16378 by the authors.

Figure 1
Figure 1. Computation flow at the transformer layer [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. 2D t-SNE visualization of internal activations from [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Accuracies across each head and layer for [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Revision vectors extraction methods: probe weight [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: An example of Multi-Response. our classification dataset denoted as {((x ′ )l,h, y)i}M i=1. In this notation, (x ′ )l,h represents the internal state extracted from the h-th head of the l-th layer, with y = 1 indicating a safe instruction. Each probe utilizes a feedfor…
Figure 6
Figure 6. Figure 6: ASR on SafeBench (Left) and ACC on ScienceQA [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 6
Figure 6. Figure 6: (3) Text-Response and Multi-Instruction for revision vec￾tors are less effective than Multi-Response. The head￾level composite score of Multi-Instruction averages 20.15 across the three models, whereas Text-Response performs even worse, with an average score of only 11…
Figure 8
Figure 8. Figure 8: Accuracy of classier across different layers. [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: Impact of modified heads ratio on safety (ASR on [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: Detailed information of ASR on Safe-Unsafe and Unsafe, and accuracy on GQA. [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 11
Figure 11. Figure 11: Detailed information of ASR on Safe-Unsafe and Unsafe, and accuracy on GQA. [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]
Figure 12
Figure 12. Figure 12: An example of using different strength α [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Secure Tug-of-War (SecTOW): Iterative Defense-Attack Training with Reinforcement Learning for Multimodal Model Security

    cs.CR 2025-07 conditional novelty 6.0 of 10

    An iterative attacker-defender reinforcement learning method that makes a multimodal LLM refuse more jailbreak prompts without over-refusing ordinary queries.

  2. Self-Aware Safety Augmentation: Leveraging Internal Semantic Understanding to Enhance Safety in Vision-Language Models

    cs.AI 2025-07 conditional novelty 6.0 of 10

    A tuning-free method that projects middle-layer semantic representations back onto early safety layers, improving vision-language model safety with minimal utility loss.

  3. VSCBench: Bridging the Gap in Vision-Language Model Safety Calibration

    cs.IR 2025-05 conditional novelty 5.0 of 10

    A new benchmark, VSCBench, measures oversafety and undersafety in vision-language models and shows that most models, including proprietary ones, are miscalibrated on at least one safety dimension.

Reference graph

Works this paper leans on

36 extracted references · 22 canonical work pages · cited by 3 Pith papers

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Azaria, A.; and Mitchell, T. 2023. The Internal State of an LLM Knows When It ' s Lying. In Bouamor, H.; Pino, J.; and Bali, K., eds., Findings of the Association for Computational Linguistics: EMNLP 2023, 967--976. Singapore: Association for Computational Linguistics

    work page 2023

  4. [4]

    Bai, J.; Bai, S.; Yang, S.; Wang, S.; Tan, S.; Wang, P.; Lin, J.; Zhou, C.; and Zhou, J. 2023. Qwen-vl: A versatile vision-language model for understanding, localization, text reading, and beyond. arXiv preprint arXiv:2308.12966, 1(2): 3

    arXiv 2023

  5. [5]

    Chen, J.; Zhu, D.; Shen, X.; Li, X.; Liu, Z.; Zhang, P.; Krishnamoorthi, R.; Chandra, V.; Xiong, Y.; and Elhoseiny, M. 2023. MiniGPT-v2: large language model as a unified interface for vision-language multi-task learning. arXiv preprint arXiv:2310.09478

    arXiv 2023

  6. [6]

    Chen, Z.; Wu, J.; Wang, W.; Su, W.; Chen, G.; Xing, S.; Zhong, M.; Zhang, Q.; Zhu, X.; Lu, L.; et al. 2024. Internvl: Scaling up vision foundation models and aligning for generic visual-linguistic tasks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 24185--24198

    work page 2024

  7. [7]

    Gong, Y.; Ran, D.; Liu, J.; Wang, C.; Cong, T.; Wang, A.; Duan, S.; and Wang, X. 2023. Figstep: Jailbreaking large vision-language models via typographic visual prompts. ArXiv preprint, abs/2311.05608

    arXiv 2023

  8. [8]

    A.; and Manning, C

    Hudson, D. A.; and Manning, C. D. 2019. GQA: A New Dataset for Real-World Visual Reasoning and Compositional Question Answering. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019 , 6700--6709. Computer Vision Foundation / IEEE

    work page 2019

Show all 36 references
  1. [9]

    Ji, J.; Qiu, T.; Chen, B.; Zhang, B.; Lou, H.; Wang, K.; Duan, Y.; He, Z.; Zhou, J.; Zhang, Z.; et al. 2023. Ai alignment: A comprehensive survey. ArXiv preprint, abs/2310.19852

    2023 arXiv

  2. [10]

    Jigsaw; and team, G. C. A. T. 2024. Conversation-AI. https://perspectiveapi.com/

    2024

  3. [11]

    J.; Wexler, J.; Vi \' e gas, F

    Kim, B.; Wattenberg, M.; Gilmer, J.; Cai, C. J.; Wexler, J.; Vi \' e gas, F. B.; and Sayres, R. 2018. Interpretability Beyond Feature Attribution: Quantitative Testing with Concept Activation Vectors (TCAV) . In Dy, J. G.; and Krause, A., eds., Proceedings of the 35th Internat...

    2018

  4. [12]

    Li, K.; Patel, O.; Vi \'e gas, F.; Pfister, H.; and Wattenberg, M. 2023. Inference-Time Intervention: Eliciting Truthful Answers from a Language Model. In Thirty-seventh Conference on Neural Information Processing Systems

    2023

  5. [13]

    Li, Q.; Geng, J.; Lyu, C.; Zhu, D.; Panov, M.; and Karray, F. 2024. Reference-free Hallucination Detection for Large Vision-Language Models. In Al-Onaizan, Y.; Bansal, M.; and Chen, Y.-N., eds., Findings of the Association for Computational Linguistics: EMNLP 2024, 4542--4551....

    2024

  6. [14]

    Liu, H.; Li, C.; Li, Y.; and Lee, Y. J. 2024. Improved baselines with visual instruction tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 26296--26306

    2024

  7. [15]

    Liu, H.; Li, C.; Wu, Q.; and Lee, Y. J. 2023 a . Visual Instruction Tuning. In Oh, A.; Naumann, T.; Globerson, A.; Saenko, K.; Hardt, M.; and Levine, S., eds., Advances in Neural Information Processing Systems, volume 36, 34892--34916. Curran Associates, Inc

    2023

  8. [16]

    Liu, X.; Zhu, Y.; Gu, J.; Lan, Y.; Yang, C.; and Qiao, Y. 2025. Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. In European Conference on Computer Vision, 386--403. Springer

    2025

  9. [17]

    Liu, X.; Zhu, Y.; Lan, Y.; Yang, C.; and Qiao, Y. 2023 b . Query-relevant images jailbreak large multi-modal models. ArXiv preprint, abs/2311.17600

    2023 arXiv

  10. [18]

    Lu, P.; Mishra, S.; Xia, T.; Qiu, L.; Chang, K.-W.; Zhu, S.-C.; Tafjord, O.; Clark, P.; and Kalyan, A. 2022. Learn to explain: Multimodal reasoning via thought chains for science question answering. Advances in Neural Information Processing Systems, 35: 2507--2521

    2022

  11. [19]

    Nejadgholi, I.; Fraser, K.; and Kiritchenko, S. 2022. Improving Generalizability in Implicitly Abusive Language Detection with Concept Activation Vectors. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 5517--...

    2022

  12. [20]

    F.; Leike, J.; and Lowe, R

    Ouyang, L.; Wu, J.; Jiang, X.; Almeida, D.; Wainwright, C.; Mishkin, P.; Zhang, C.; Agarwal, S.; Slama, K.; Ray, A.; Schulman, J.; Hilton, J.; Kelton, F.; Miller, L.; Simens, M.; Askell, A.; Welinder, P.; Christiano, P. F.; Leike, J.; and Lowe, R. 2022. Training language model...

    2022

  13. [21]

    Pantazopoulos, G.; Parekh, A.; Nikandrou, M.; and Suglia, A. 2024. Learning To See But Forgetting To Follow: Visual Instruction Tuning Makes LLM s More Prone To Jailbreak Attacks. In Dinkar, T.; Attanasio, G.; Curry, A. C.; Konstas, I.; Hovy, D.; and Rieser, V., eds., Proceedi...

    2024

  14. [22]

    Pi, R.; Han, T.; Zhang, J.; Xie, Y.; Pan, R.; Lian, Q.; Dong, H.; Zhang, J.; and Zhang, T. 2024. MLLM -Protector: Ensuring MLLM ' s Safety without Hurting Performance. In Al-Onaizan, Y.; Bansal, M.; and Chen, Y.-N., eds., Proceedings of the 2024 Conference on Empirical Methods...

    2024

  15. [23]

    D.; Ermon, S.; and Finn, C

    Rafailov, R.; Sharma, A.; Mitchell, E.; Manning, C. D.; Ermon, S.; and Finn, C. 2023. Direct Preference Optimization: Your Language Model is Secretly a Reward Model. In Oh, A.; Naumann, T.; Globerson, A.; Saenko, K.; Hardt, M.; and Levine, S., eds., Advances in Neural Informat...

    2023

  16. [24]

    Rimsky, N. 2023. Red-teaming language models via activation engineering. https://github.com/nrimsky/LM-exp/

    2023

  17. [25]

    Rimsky, N.; Gabrieli, N.; Schulz, J.; Tong, M.; Hubinger, E.; and Turner, A. 2024. Steering Llama 2 via Contrastive Activation Addition. In Ku, L.-W.; Martins, A.; and Srikumar, V., eds., Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (...

    2024

  18. [26]

    R \"o ttger, P.; Kirk, H.; Vidgen, B.; Attanasio, G.; Bianchi, F.; and Hovy, D. 2024. XST est: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models. In Duh, K.; Gomez, H.; and Bethard, S., eds., Proceedings of the 2024 Conference of the North Ame...

    2024

  19. [27]

    Song, D.; Xie, X.; Song, J.; Zhu, D.; Huang, Y.; Juefei-Xu, F.; and Ma, L. 2024. LUNA: A Model-Based Universal Analysis Framework for Large Language Models. IEEE Transactions on Software Engineering

    2024

  20. [28]

    Taori, R.; Gulrajani, I.; Zhang, T.; Dubois, Y.; Li, X.; Guestrin, C.; Liang, P.; and Hashimoto, T. B. 2023. Stanford Alpaca: An Instruction-following LLaMA model. https://github.com/tatsu-lab/stanford_alpaca

    2023

  21. [29]

    Tenney, I.; Das, D.; and Pavlick, E. 2019. BERT Rediscovers the Classical NLP Pipeline. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, 4593--4601. Florence, Italy: Association for Computational Linguistics

    2019

  22. [30]

    Turner, A.; Thiergart, L.; Udell, D.; Leech, G.; Mini, U.; and MacDiarmid, M. 2023. Activation addition: Steering language models without optimization. ArXiv preprint, abs/2308.10248

    2023 arXiv

  23. [31]

    N.; Kaiser, L.; and Polosukhin, I

    Vaswani, A.; Shazeer, N.; Parmar, N.; Uszkoreit, J.; Jones, L.; Gomez, A. N.; Kaiser, L.; and Polosukhin, I. 2017. Attention is All you Need. In Guyon, I.; von Luxburg, U.; Bengio, S.; Wallach, H. M.; Fergus, R.; Vishwanathan, S. V. N.; and Garnett, R., eds., Advances in Neura...

    2017

  24. [32]

    Wang, Y.; Liu, X.; Li, Y.; Chen, M.; and Xiao, C. 2025. AdaShield : Safeguarding Multimodal Large Language Models from Structure-Based Attack viaAdaptive Shield Prompting. In Leonardis, A.; Ricci, E.; Roth, S.; Russakovsky, O.; Sattler, T.; and Varol, G., eds., Computer Vision...

    2025

  25. [33]

    Zhang, Y.; Chen, L.; Zheng, G.; Gao, Y.; Zheng, R.; Fu, J.; Yin, Z.; Jin, S.; Qiao, Y.; Huang, X.; et al. 2024. SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Model. ArXiv preprint, abs/2406.12030

    2024 arXiv

  26. [34]

    Zhu, D.; Chen, D.; Li, Q.; Chen, Z.; Ma, L.; Grossklags, J.; and Fritz, M. 2024. P o LLM graph: Unraveling Hallucinations in Large Language Models via State Transition Dynamics. In Duh, K.; Gomez, H.; and Bethard, S., eds., Findings of the Association for Computational Linguis...

    2024

  27. [35]

    Zhu, D.; Chen, J.; Shang, W.; Zhou, X.; Grossklags, J.; and Hassan, A. E. 2021. Deepmemory: model-based memorization analysis of deep neural language models. In 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE), 1003--1015. IEEE

    2021

  28. [36]

    Zong, Y.; Bohdal, O.; Yu, T.; Yang, Y.; and Hospedales, T. 2024. Safety fine-tuning at (almost) no cost: A baseline for vision large language models. ArXiv preprint, abs/2402.02207

    2024 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.