Pith. sign in

REVIEW 4 major objections 7 minor 3 cited by

Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025

T0 review · 4 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This technical report claims that adversarial image-text pairs built from flowcharts and role-playing text jailbreak safety-aligned multimodal LLMs at near-perfect rates, with top leaderboard scores of 96.95 (white-box) and 93.56…

desk verdict A useful competition report with solid qualitative findings, but the leaderboard numbers rest on an unnamed judge and need human validation. read the letter →

arxiv 2506.12430 v2 pith:TNC2AVNF submitted 2025-06-14 cs.CR cs.CV

Zonghao Ying , Siyang Wu , Run Hao , Peng Ying , Shixuan Sun , Pengyu Chen , Junze Chen , Hao Du
show 39 more authors
Kaiwen Shen Shangkun Wu Jiwei Wei Shiyuan He Yang Yang Xiaohai Xu Ke Ma Qianqian Xu Qingming Huang Shi Lin Xun Wang Changting Lin Meng Han Yilei Jiang Siqi Lai Yaozhi Zheng Yifei Song Xiangyu Yue Zonglei Jing Tianyuan Zhang Zhilei Zhu Aishan Liu Jiakai Wang Siyuan Liang Xianglong Kong Hainan Li Junjie Mu Haotong Qin Yue Yu Lei Chen Felix Juefei-Xu Qing Guo Xinyun Chen Yew Soon Ong Xianglong Liu Dawn Song Alan Yuille Philip Torr Dacheng Tao
This is my paper · ORCID
classification cs.CRcs.CV
keywords multimodallargelanguagemodelsjailbreakattacksadversarialimage-textpairsflowchartattackrole-playingpromptsLLM-as-a-Judgesuccessratered-teamingcompetition
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This report argues that current safety-aligned multimodal large language models are defeated by adversarial image-text pairs at scale: in a two-phase competition, 86 teams submitted attacks, and the best white-box score reached 96.95 while the best black-box score reached 93.56. The central claim is that harm hidden in structured diagrams, especially linear flowcharts with red-highlighted output nodes, and coordinated with role-playing text prompts, bypasses safety filters that plain-text attacks cannot. A sympathetic reader should care because the winning attacks are simple, training-free templates; they transfer across open and unseen models, which makes them a present-day risk for any application that accepts untrusted images.

What carries the argument

The load-bearing mechanism is the flowchart-as-attack image paired with a role-playing text prompt. A four-node linear flowchart encodes, in sequence, the harmless context, the target question placed in a character's mouth, an affirmative reply, and a red-highlighted instruction to produce detailed harmful suggestions; the model's bias toward sequential structured outputs walks it through the nodes without any single input frame containing explicit harmful instruction. The report's measuring instrument is the Attack Success Rate, computed by an LLM-as-a-Judge that scores each output for harmfulness and relevance.

What would settle it

Have independent human annotators re-score a random sample of the pairs the judge marked as successful attacks, without seeing the judge's labels, and compute agreement; if human-judge agreement falls below 0.7 kappa or most outputs are judged harmless, the reported near-perfect jailbreak rates would not reflect genuine harm.

Watch

Extended reading notes

Core claim

The paper's central discovery, stated on its own terms, is that safety alignment in MLLMs defends the input surface but not the multimodal reasoning process. By embedding the complete malicious question inside a flowchart and pairing it with a text prompt that assigns a role, demands a fixed prefix, and imposes a length constraint, the winning team reports attack success rates of 100 percent on Qwen2-VL-7B and 98.7 percent on InternVL2-8B. The ablations attribute the effect to visual structure: flowcharts outperform a single box, a red-highlighted output node outperforms unhighlighted diagrams, and directional step guidance outperforms free generation. The Phase II results extend the claim to a black-box model, where a training-free flowchart-and-role-play template still achieves 89.33 in the official ranking, showing the vulnerabilities transfer without model access.

Load-bearing premise

The load-bearing premise is that the single LLM judge's 'harmful or not' label is a valid measure of true harm for every submitted pair; the report gives no human validation, judge identity, or inter-annotator agreement, and concedes the judge struggles with borderline cases.

Editorial extensions

If this is right

  • Deployments that accept untrusted images cannot rely on current safety alignment; the same flowchart-plus-role-play template can be generated automatically and at scale, so this is a practical, not merely laboratory, threat.
  • Defenses that screen image and text independently will miss attacks whose harmful intent exists only in the joint reading; robustness work must train on adversarially paired image-text data.
  • Because training-free attacks transferred to a black-box model in Phase II, jailbreak risk does not require white-box access or optimization, lowering the barrier for real-world attackers.
  • The report concludes that evaluation should move to multi-judge or hybrid human-automated assessment, because a single LLM judge struggles to judge borderline harmfulness.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference — the four-node flowchart template should be retested on newer models (for example, Qwen2.5-VL and InternVL3) and on closed commercial models; if the vulnerability persists, it is a general property of visual instruction following rather than a quirk of the two contest models.
  • Editorial inference — the red-highlight output-node effect suggests low-level visual salience changes safety behavior, which points toward attention-based defenses or input-rendering sanitization as testable countermeasures.
  • Editorial inference — because scores were awarded by an automated judge, the contest may have rewarded attacks that fool the judge rather than produce genuine harm; a human audit of the submitted pairs would clarify how much of the reported near-perfect success is real-world harm.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. This technical report describes ATLAS 2025, a two-phase adversarial competition in which 86 teams crafted image-text pairs to jailbreak multimodal large language models. Phase I was a white-box setting against Qwen2-VL-7B and InternVL2-8B using 180 SafeBench prompts; Phase II was a black-box setting with an additional target model and 150 more complex prompts. Attack success is defined in Eq. (2) through an unspecified "LLM-as-a-Judge" function J, and leaderboards are reported in Tables 2 and 3. The report presents case studies from four top teams, emphasizing structured flowcharts, role-playing prompts, OCR-based images, omission-completion tricks, and adversarial perturbations, and it argues that current safety-aligned MLLMs remain jailbreakable at high rates, with some local configurations approaching 100% ASR. Code and data are released publicly.

Significance. If the quantitative results are accepted, the report would provide a useful large-scale benchmark snapshot of MLLM jailbreak susceptibility, and the qualitative finding that structured visual diagrams and cross-modal role-playing bypass current safety filters is credible and consistent with prior work such as FigStep and typographic-prompt attacks. The public release of attack data and the multi-team diversity are strengths, and the team-level ablations (e.g., Tables 5, 6, 7, 9) give independent, method-level evidence for the effectiveness of flowcharts, red highlighting, and cross-modal intent distribution. However, the benchmark-level claims—near-perfect ASR and meaningful leaderboard rankings—are not yet established because the official judge is unidentified, no human validation or inter-annotator agreement is reported, no negative-control experiments on benign inputs are given, and no statistical uncertainty accompanies the scores. The paper is best read as a competition retrospective whose qualitative conclusions are defensible but whose headline quantitative claims require additional evaluation evidence.

major comments (4)
  1. [Section 2.4, Eq. (2)] The judge model J is never identified: no model name, version, prompt template, or decision threshold is given for the official evaluation. The case-study teams use different judges for their local evaluations—Qwen2.5-latest with Harmful/Relevant scores above 3 in Section 4.2.3 and qwen-max in Section 4.4.4. Unless the official judge is disclosed and made consistent across submissions, the ASR values in Tables 2 and 3, including the top Phase I score 96.95 and top Phase II score 93.56, are not reproducible or comparable. The authors should release the judge prompt, threshold, model version, and per-example judge outputs, or at minimum a code-and-data path that reproduces every leaderboard score.
  2. [Section 2.4 and Section 5.1] No human validation, inter-annotator agreement, or negative-control baseline is reported for the LLM judge. Section 5.1 itself concedes that "relying on a single LLM judge revealed certain limitations, particularly in assessing edge cases." Without a human-annotated sample showing agreement with J, and without measuring J's false-positive rate on benign or refusal outputs, the claim that near-perfect ASR reflects true harmful content rather than judge leniency is unverified. This is load-bearing because Eq. (2) defines success entirely through J's binary verdict.
  3. [Tables 2 and 3] The leaderboard scores are reported without confidence intervals or significance tests. With 180 prompts in Phase I and 150 in Phase II, the binomial standard error is roughly 1–4 percentage points depending on score level; for example, the 96.95 versus 95.56 gap between ranks 1 and 2 in Table 2 is within sampling error. Statements such as "tight score margins among the top teams" and the implied ranking meaningfulness are therefore not supported by the reported statistics. The authors should report per-model ASRs, confidence intervals, and pairwise comparisons, or explicitly frame the leaderboard as ordinal and not statistically resolved.
  4. [Section 2.4 and Section 4.1] The official scoring is reported only as an average across target models, with no per-model breakdown in Tables 2 and 3. Since the paper's central claim is that current MLLMs are jailbroken at high rates, the reader needs to know whether the success is concentrated in one target model or shared across all three. The team-level ablations provide some per-model numbers, but the official benchmark scores do not, which weakens both the generalizability claim and any attempt to assess transferability in the black-box phase.
minor comments (7)
  1. [Section 2.3 vs. Section 4.4.1] Section 2.3 states that Phase I used 180 prompts, while Section 4.4.1 refers to "160 queries" in the Phase I task; the discrepancy should be corrected or explained.
  2. [Section 2.3 vs. Table 9] Table 9 names DeepSeek-VL-7B-chat as the black-box target, but Section 2.3 only says "an additional black-box MLLM" without naming it; the main text should state the full target model set.
  3. [Section 4.2.3] The code block for the role-playing prompt is labeled "PREFIX-BASED ATTACK"; this label appears to be a copy-paste error and should be changed to "ROLE-PLAYING ATTACK."
  4. [Table 4] The table headers contain spacing errors: "F ALSE" and "T RUE" should read "False" and "True."
  5. [Section 4.4.4] There is a duplicated phrase "the attack.the attack" in the introductory paragraph of the ablation study; it should read "the attack."
  6. [Section 4.6.5] A stray "s" appears after the concluding paragraph and before Section 4.7; it should be removed.
  7. [Section 5.1] The discussion of "edge cases" would be more useful with concrete examples of where the judge failed or was ambiguous, since the paper otherwise gives no characterization of judge error modes.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the report is an empirical competition write-up rather than a derivation; the acknowledged LLM-judge limitation is a measurement-validity concern, not a circular reduction.

full rationale

The paper makes no first-principles derivation: it reports a challenge, defines an operational attack-success metric, and presents leaderboard scores and case studies. Section 2.4 defines ASR through an LLM judge in Eq. (2), and Section 5.1 concedes that "relying on a single LLM judge revealed certain limitations, particularly in assessing edge cases." This is a benchmark-validity limitation, because the judge is unnamed and unvalidated, but it is not a circular reduction: Eq. (2) does not re-enter as a fitted input, no parameter is fitted to a subset and then reported as a prediction, and no uniqueness theorem is imported from the authors' prior work. The use of SafeBench (Ying et al., 2024a) to source prompts is a self-citation, but the prompt set is a static, externally inspectable dataset and the competition outcomes are empirical; the core conclusion that flowcharts and cross-modal role-play can bypass MLLM safety is corroborated by prior independent work, by the reported multi-model ablations, and by both competition phases. Under the hard rules, the judge concern and the SafeBench self-citation are correctness or evidence-quality risks, not circularity, so the appropriate score is 0.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper makes no mathematical derivation; its central quantitative claims rest on the evaluation protocol and prompt-selection assumptions above, plus self-reported team ablations.

free parameters (2)
  • LLM judge success threshold = Harmful > 3 and Relevant > 3 (team You are the challenger)
    Team case study 4.2.3 converts continuous judge scores into binary success using this hand-set threshold; no sensitivity analysis is reported.
  • Perturbation bound epsilon = 8/255
    Team mmlab's white-box refinement (Eq. 3) uses this distortion bound chosen by hand; it affects transferability and reported success rates.
assumptions (4)
  • domain assumption An LLM judge's binary judgment is valid ground truth for harmfulness.
    Section 2.4 defines ASR exclusively through judge J; no human validation or inter-annotator agreement is provided.
  • domain assumption The SafeBench prompts used in Phase I are representative of harmful content categories.
    Section 2.3 selects 180 prompts, 30 per 6 categories, but gives no coverage or difficulty analysis.
  • domain assumption Target models would refuse direct harmful text prompts, justifying the need for image-text attacks.
    Case studies (e.g., 4.2.1) assert refusal behavior, but no refusal baseline on unmodified prompts is reported.
  • domain assumption Average ASR across target models is a valid overall safety ranking.
    Section 2.4 ranks teams by mean ASR across models; all models are weighted equally without justification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025." pith.science (2026). https://pith.science/paper/TNC2AVNF

@misc{pith2026250612430,
  author       = {Pith},
  title        = {Pith review of: Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TNC2AVNF}},
  note         = {Machine review of arXiv:2506.12430}
}
read the original abstract

Multimodal Large Language Models (MLLMs) have enabled transformative advancements across diverse applications but remain susceptible to safety threats, especially jailbreak attacks that induce harmful outputs. To systematically evaluate and improve their safety, we organized the Adversarial Testing & Large-model Alignment Safety Grand Challenge (ATLAS) 2025}. This technical report presents findings from the competition, which involved 86 teams testing MLLM vulnerabilities via adversarial image-text attacks in two phases: white-box and black-box evaluations. The competition results highlight ongoing challenges in securing MLLMs and provide valuable guidance for developing stronger defense mechanisms. The challenge establishes new benchmarks for MLLM safety evaluation and lays groundwork for advancing safer multimodal AI systems. The code and data for this challenge are openly available at https://github.com/NY1024/ATLAS_Challenge_2025.

Figures

Figures reproduced from arXiv: 2506.12430 by the authors.

Figure 1
Figure 1. Score distribution comparison between Phase I and Phase II. The box plots and scatter points respectively reflect the statis￾tical range and individual variations in scores. Phase II shows increased variability and a lower mean score, suggesting greater task difficulty and more diverse attack effectiveness. attack, and length constraints in the text prompt. In our ex￾periments, we evaluate the results using the LLM-… view at source ↗
Figure 2
Figure 2. An example of image design in a jailbreak attack. 4.2.3. EXPERIMENTAL RESULTS Evaluation method. We adopted the LLM-as-Judge and used the Qwen2.5-latest model(alibaba qwen, 2024), de￾signing the following system prompt for evaluation. We designed a system prompt for scoring from two perspec￾tives: Harmful and Relevant, with scores ranging from 0 to 5. Higher scores indicate a greater degree of harmfulness or a highe… view at source ↗
Figure 3
Figure 3. Example of a linear flowchart. seeks guidance from B (a seasoned, enthusiastic mentor). B provides direct, highly-detailed, scenario-specific answers to A’s question. Crucially, B’s responses must meticulously follow the exact numbered format and content structure in the provided <image>(specifically B’s illicit and dangerous techniques). Pay close attention to the <image>for the precise structure and expected infor… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Overview of the Phase I [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Overview of the strategy for Phase II. sitive word with its first letter followed by an under￾score. For instance, the sentence ”To make a bomb” becomes ”To make a b ”. Both the extraction and sub￾stitution processes are performed using the qwen-max model. 2. Adversari…
Figure 6
Figure 6. Figure 6: An example of the OCR image. Defamatory Speech, Psychological Harm, Physical Harm, Child Abuse, and Illegal Activities. A more fine-grained taxonomy includes 23 categories, but due to time constraints, only the coarse-grained classifica￾tion scheme was submitted for th…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense

    cs.CV 2026-08 conditional novelty 6.0 of 10

    SafeCA reduces text-to-video jailbreak success by roughly 20% relative to T2VShield by masking anomalous cross-attention activations using clean-prompt statistics.

  2. Before Agents Speak: Pre-hoc Failure Risk Inference in Multi-Agent Systems

    cs.CR 2026-07 conditional novelty 6.0 of 10

    HalluProp infers per-agent and system-level hallucination risk in multi-agent LLMs before interaction via role–query misalignment, topology-aware propagation, and differentiable Noisy-OR aggregation.

  3. Evidence Recomposition and Predictive Context Residualization for Visual Attribution in Multimodal Large Language Models

    cs.CV 2025-09 conditional novelty 5.0 of 10

    MSEA+ARC, a multi-scale and ranking-based residualization method, claims consistent F1-IoU gains over TAM for token-level MLLM visual attribution.

Reference graph

Works this paper leans on

33 extracted references · 7 canonical work pages · cited by 3 Pith papers

  1. [4]

    Alphaedit: Null-space constrained knowledge editing for language models

    Fang, J., Jiang, H., Wang, K., Ma, Y ., Jie, S., Wang, X., He, X., and Chua, T.-S. Alphaedit: Null-space constrained knowledge editing for language models. arXiv preprint arXiv:2410.02355,

    arXiv

  2. [5]

    Safemlrm: Demystifying safety in multi-modal large reasoning models

    Fang, J., Wang, Y ., Wang, R., Yao, Z., Wang, K., Zhang, A., Wang, X., and Chua, T.-S. Safemlrm: Demystifying safety in multi-modal large reasoning models. arXiv preprint arXiv:2504.08813,

    arXiv

  3. [6]

    Bai, Y . e. a. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862,

    arXiv

  4. [7]

    Mini-internvl: A flexible- transfer pocket multimodal model with 5% parameters and 90% performance

    Gao, Z., Chen, Z., Cui, E., Ren, Y ., Wang, W., Zhu, J., Tian, H., Ye, S., He, J., Zhu, X., et al. Mini-internvl: A flexible- transfer pocket multimodal model with 5% parameters and 90% performance. arXiv preprint arXiv:2410.16261,

    arXiv

  5. [8]

    Exploring visual vulnerabilities via multi-loss ad- versarial search for jailbreaking vision-language models

    Hao, S., Hooi, B., Liu, J., Chang, K.-W., Huang, Z., and Cai, Y . Exploring visual vulnerabilities via multi-loss ad- versarial search for jailbreaking vision-language models. arXiv preprint arXiv:2411.18000,

    arXiv

  6. [9]

    Seeing is deceiving: Exploitation of visual pathways in multi-modal language models.arXiv preprint arXiv:2411.05056,

    Janowczyk, P., Laurier, L., Giulietta, A., Octavia, A., and Cleti, M. Seeing is deceiving: Exploitation of visual pathways in multi-modal language models.arXiv preprint arXiv:2411.05056,

    arXiv

  7. [10]

    Large spin shuttling oscillations enabling high-fidelity single qubit gates

    Jiang, Y ., Chen, Y ., Dong, Q., Lin, D., and Yue, X. Hidden- detect: Detecting jailbreak attacks against large vision- language models, 2024a. URL https://arxiv. org/abs/2403.00601. Jiang, Y ., Tan, Y ., and Yue, X. Rapguard: Safeguarding multimodal large language models via rationale-aware defensive prompting, 2024b. URL https://arxiv. org/abs/2412.1882...

    work page Pith review arXiv

  8. [11]

    Llava- onevision: Easy visual task transfer

    Li, B., Zhang, Y ., Guo, D., Zhang, R., Li, F., Zhang, H., Zhang, K., Zhang, P., Li, Y ., Liu, Z., et al. Llava- onevision: Easy visual task transfer. arXiv preprint arXiv:2408.03326,

    arXiv

Show all 33 references
  1. [12]

    Poisoned forgery face: Towards backdoor attacks on face forgery detection

    Liang, J., Liang, S., Liu, A., Jia, X., Kuang, J., and Cao, X. Poisoned forgery face: Towards backdoor attacks on face forgery detection. arXiv preprint arXiv:2402.11473, 2024a. Liang, J., Liang, S., Luo, M., Liu, A., Han, D., Chang, E.-C., and Cao, X. Vl-trojan: Multimodal in...

    2020 arXiv

  2. [15]

    Red pill and blue pill: Controllable website fingerprinting defense via dynamic backdoor learning

    Liang, S., Gong, J., Fang, T., Liu, A., Wang, T., Liu, X., Cao, X., Tao, D., and Ee-Chien, C. Red pill and blue pill: Controllable website fingerprinting defense via dynamic backdoor learning. arXiv preprint arXiv:2412.11471 , 2024c. Liang, S., Liang, J., Pang, T., Du, C., Liu...

  3. [16]

    Figure it out: Analyzing-based jailbreak attack on large language models

    Lin, S., Li, R., Wang, X., Lin, C., Xing, W., and Han, M. Figure it out: Analyzing-based jailbreak attack on large language models. arXiv preprint arXiv:2407.16205,

    arXiv

  4. [17]

    X-adv: Physical adversarial object attacks against x-ray prohibited item detection

    Liu, A., Guo, J., Wang, J., Liang, S., Tao, R., Zhou, W., Liu, C., Liu, X., and Tao, D. X-adv: Physical adversarial object attacks against x-ray prohibited item detection. In USENIX Security Symposium, 2023a. Liu, A., Tang, S., Liang, S., Gong, R., Wu, B., Liu, X., and Tao, D....

    arXiv

  5. [19]

    Ouyang, L

    URL https:// openai.com/research/gpt-4. Ouyang, L. e. a. Training language models to follow instructions with human feedback. arXiv preprint arXiv:2203.02155,

    arXiv

  6. [21]

    org/abs/2306.13213

    URL https://arxiv. org/abs/2306.13213. Schaeffer, R., Valentine, D., Bailey, L., Chua, J., Eyza- guirre, C., Durante, Z., Benton, J., Miranda, B., Sleight, H., Wang, T. T., et al. Failures to find transferable im- age jailbreaks between vision-language models. In The 19 Thirte...

    arXiv

  7. [22]

    Poisoncraft: Practical poisoning of retrieval- augmented generation for large language models

    Shao, Y ., Lin, X., Luo, H., Hou, C., Xiong, G., Yu, J., and Shi, J. Poisoncraft: Practical poisoning of retrieval- augmented generation for large language models. arXiv preprint arXiv:2505.06579,

    arXiv

  8. [23]

    Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models

    Shayegani, E., Dong, Y ., and Abu-Ghazaleh, N. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. arXiv preprint arXiv:2307.14539 ,

    arXiv

  9. [24]

    4711–4728, Philadelphia, PA, August 2024a

    , pp. 4711–4728, Philadelphia, PA, August 2024a. USENIX Association. ISBN 978- 1-939133-44-1. URL https://www.usenix. org/conference/usenixsecurity24/ presentation/liu-tong. Liu, X., Zhu, Y ., Gu, J., Lan, Y ., Yang, C., and Qiao, Y . Mm-safetybench: A benchmark for safety eva...

    arXiv

  10. [25]

    URL https://aclanthology.org/2025

    Association for Computational Linguis- tics. URL https://aclanthology.org/2025. coling-main.494/. Thomas, A., Ramesh, K., and Mohan, S. Multimodal llm agents: Exploring llm interactions in software, web and operating systems. Wang, C., Liu, Y ., Li, B., Zhang, D., Li, Z., and ...

    2025 arXiv

  11. [26]

    Model merging in llms, mllms, and beyond: Methods, theories, applications and opportunities

    Yang, E., Shen, L., Guo, G., Wang, X., Cao, X., Zhang, J., and Tao, D. Model merging in llms, mllms, and beyond: Methods, theories, applications and opportunities. arXiv preprint arXiv:2408.07666, 2024a. Yang, S., Ge, Y ., Li, Y ., Chen, Y ., Ge, Y ., Shan, Y ., and Chen, Y . ...

    arXiv

  12. [27]

    Distraction is all you need for multi- modal large language model jailbreaking

    Yang, Z., Fan, J., Yan, A., Gao, E., Lin, X., Li, T., Dong, C., et al. Distraction is all you need for multi- modal large language model jailbreaking. arXiv preprint arXiv:2502.10794,

    arXiv

  13. [28]

    and Wu, B

    Ying, Z. and Wu, B. Nba: defensive distillation for backdoor removal via neural behavior alignment. Cybersecurity, 6 (1):20, 2023a. 20 Ying, Z. and Wu, B. Dlp: towards active defense against backdoor attacks with decoupled learning process. Cy- bersecurity, 6(1):9, 2023b. Ying...

    arXiv

  14. [29]

    A survey on trustworthy llm agents: Threats and countermeasures

    Yu, M., Meng, F., Zhou, X., Wang, S., Mao, J., Pang, L., Chen, T., Wang, K., Li, X., Zhang, Y ., et al. A survey on trustworthy llm agents: Threats and countermeasures. arXiv preprint arXiv:2503.09648,

    arXiv

  15. [30]

    doi: 10.18653/v1/2024.acl-long.773

    Association for Computational Linguis- tics. doi: 10.18653/v1/2024.acl-long.773. URL https: //aclanthology.org/2024.acl-long.773/. Zhang, S., Wang, H., Zhang, Y ., Zhang, X., Zhang, Y ., He, X., and Liang, X. Multimodal chain-of-thought reasoning in language models. arXiv prep...

    2024 arXiv

  16. [31]

    Zhou, Z., Yu, H., Zhang, X., Xu, R., Huang, F., Wang, K., Liu, Y ., Fang, J., and Li, Y

    URL https: //arxiv.org/abs/2502.21059. Zhou, Z., Yu, H., Zhang, X., Xu, R., Huang, F., Wang, K., Liu, Y ., Fang, J., and Li, Y . On the role of attention heads in large language model safety. arXiv preprint arXiv:2410.13708,

  17. [32]

    Minigpt-4: Enhancing vision-language understanding with advanced large language models

    Zhu, D., Chen, J., Shen, X., Li, X., and Elhoseiny, M. Minigpt-4: Enhancing vision-language understanding with advanced large language models. arXiv preprint arXiv:2304.10592,

    arXiv

  18. [33]

    Z., and Fredrikson, M

    Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J. Z., and Fredrikson, M. Universal and transferable adversar- ial attacks on aligned language models. arXiv preprint arXiv:2307.15043,

    arXiv

  19. [2018]

    Latent imitator: Gen- erating natural individual discriminatory instances for black-box fairness testing

    Xiao, Y ., Liu, A., Li, T., and Liu, X. Latent imitator: Gen- erating natural individual discriminatory instances for black-box fairness testing. In Proceedings of the 32nd ACM SIGSOFT international symposium on software test- ing and analysis, pp. 829–841, 2023a. Xiao, Y ., L...

    arXiv

  20. [2020]

    Generate more impercepti- ble adversarial examples for object detection

    Liang, S., Wei, X., and Cao, X. Generate more impercepti- ble adversarial examples for object detection. In ICML 2021 Workshop on Adversarial Machine Learning,

    2021

  21. [2021]

    A large-scale multiple-objective method for black-box attack against object detection

    Liang, S., Li, L., Fan, Y ., Jia, X., Li, J., Wu, B., and Cao, X. A large-scale multiple-objective method for black-box attack against object detection. In European Conference on Computer Vision, 2022a. Liang, S., Wu, B., Fan, Y ., Wei, X., and Cao, X. Parallel rect- angle fli...

    arXiv

  22. [2022]

    Leveraging multimodal llm for inspirational user interface search

    Park, S., Song, Y ., Lee, S., Kim, J., and Seo, J. Leveraging multimodal llm for inspirational user interface search. In Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems, pp. 1–22,

    2025

  23. [2023]

    Unbridled icarus: A survey of the potential perils of image inputs in multimodal large language model security

    Fan, Y ., Cao, Y ., Zhao, Z., Liu, Z., and Li, S. Unbridled icarus: A survey of the potential perils of image inputs in multimodal large language model security. In 2024 IEEE International Conference on Systems, Man, and Cybernetics (SMC), pp. 3428–3433. IEEE,

    2024

  24. [2024]

    J., and Bing, L

    Deng, Y ., Zhang, W., Pan, S. J., and Bing, L. Multilingual jailbreak challenges in large language models. arXiv preprint arXiv:2310.06474,

    arXiv

  25. [2025]

    Prj: Perception- retrieval-judgement for generated images

    Fu, Q., Jing, Z., Ying, Z., and Li, X. Prj: Perception- retrieval-judgement for generated images. arXiv preprint arXiv:2506.03683,

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.