Pith. sign in

REVIEW 30 references

Bootstrapping LLM Robustness for VLM Safety via Reducing the Pretraining Modality Gap

T0 review · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper argues that the representational distance between image and text embeddings—the modality gap—is inversely correlated with vision-language model safety, and that shrinking it during pretraining with an L2 regularizer…

desk verdict Useful correlation analysis and a simple pretraining regularizer, but the causal claim is undercut by an unresolved blunted-vision confound. read the letter →

arxiv 2505.24208 v1 pith:TFGVXW22 submitted 2025-05-30 cs.AI

Wenhan Yang , Spencer Stice , Ali Payani , Baharan Mirzasoleiman This is my paper
classification cs.AI
keywords modalitygapvision-languagemodelsafetyalignmentpretrainingregularizationmultimodaljailbreaklargerepresentation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Safety-aligned language models become easier to jailbreak once a vision encoder and projector are added, and this paper's thesis is that the root cause is measurable and addressable: the modality gap, or the unusually large distance between image token embeddings and text token embeddings in the model's input space. Drawing on five open models, the authors show a strong inverse correlation between this gap and safety, that pretrained checkpoints already carry the gap, and that the gap after pretraining predicts the gap after fine-tuning with a correlation of 0.93. They introduce REGAP, a pretraining-time regularizer that adds the mean pairwise L2 distance between image and text token embeddings to the captioning loss, scaled so it does not overwhelm the original objective. Across LLaVA-1.5, ShareGPT4V, and MiniGPT-4, REGAP reduces unsafe response rates by up to 16.3%, preserves utility on standard benchmarks, and stacks with existing inference-time defenses to improve them by up to 18.2%.

What carries the argument

The central objects are the Modality Integration Rate (MIR) and the REGAP regularizer. MIR is a named metric: the logarithm of the summed Fréchet Inception Distance between image and text token embedding distributions across transformer layers, after text-centric $\ell^2$ normalization and outlier removal, so lower MIR means faster cross-modal integration. MIR is too costly to optimize directly, so REGAP uses its computable proxy, the pairwise $L_2$ distance $L_{\mathrm{sim}} = \frac{1}{mn}\sum_{a=1}^{m} \sum_{b=1}^{n} \|f^v_a - f^t_b\|_2^2$ between all image and text token embeddings from the same image-caption pair, scaled by $\alpha = L_{\mathrm{pre}}/L_{\mathrm{sim}}$ after a warm-up so it does not overwhelm the captioning loss. The leverage comes from the pretraining setup: the vision encoder and LLM are frozen, so the projector alone decides where image embeddings land, and aligning the input layer propagates a smaller gap into deeper layers.

What would settle it

Compare REGAP-pretrained and baseline models on the same harmful prompts with images replaced by blank or white-noise images and on fine-grained visual-reasoning tasks: if the unsafe-rate drop persists on blank images while visual utility drops disproportionately, the regularizer is creating blunt visual insensitivity rather than fixing the modality gap.

Watch

Extended reading notes

Core claim

The central claim is that the modality gap is not a symptom but a controllable cause of safety degradation: models with a larger image–text embedding gap are systematically more likely to answer harmful prompts, and the gap is created during the projector pretraining stage and survives instruction tuning. Using Modality Integration Rate (MIR), a layer-wise Fréchet distance between image and text token distributions, the paper reports strong correlations between MIR and unsafe rate (0.71 after fine-tuning, 0.78 at pretraining) and a 0.93 correlation between the pretraining gap and the fine-tuned gap. REGAP addresses the gap at the input layer, where the projector is the only trainable component, by adding a scaled pairwise L2 distance between image and text tokens to the pretraining loss. The paper reports that this intervention reduces unsafe rate by up to 16.3% on the LLaVA-1.5 family, reduces it by up to 24.3% across harmful prompt categories on other architectures, and that combining REGAP with defense methods such as SimCLIP, RobustCLIP, and CMRM yields up to 18.2% further improvement, approaching text-only LLM safety levels.

Load-bearing premise

The load-bearing premise is that the safety gains come from closing the image-text gap itself, not from the regularizer making the model process visual input more poorly.

Editorial extensions

If this is right

  • REGAP offers model builders a cheap, data-free knob: adding one regularizer to the existing projector-pretraining objective recovers a large fraction of the safety lost when a text-only LLM gains vision.
  • Because the method works on both MLP-based projectors like LLaVA and ShareGPT4V and the Q-Former-based MiniGPT-4, modality-gap reduction generalizes as a pretraining design principle rather than a fix tied to one architecture.
  • REGAP composes with inference-time steering and robust-encoder defenses, so the two families target complementary failure modes and can be combined to approach text-only LLM safety.
  • The reported safety gains do not come at the expense of general capability: on the utility benchmarks tabulated, the REGAP model stays within about one point of the no-defense base on average while reducing unsafe rate substantially.
  • REGAP is a first-layer intervention, and the authors find that pushing the same regularization into deeper layers or into fine-tuning adds no safety benefit and can even hurt the model, which narrows where future pretraining-time safety fixes should be applied.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: if the modality gap is causal rather than merely predictive, then other pretraining-time interventions that move image embeddings into the text-token distribution—contrastive alignment, shared embedding training, or different projector initialization—should reproduce comparable safety gains; REGAP's particular loss is probably not the only way to get them.
  • Editorial inference: a concrete probe of the mechanism is to measure unsafe rates on blank or irrelevant images, which the paper notes already trigger failures; if REGAP's main effect is to make the model ignore the image, blank-image prompts should show the full safety gain, whereas if the gap itself matters, gains should concentrate on prompts where image content is actually processed.
  • Editorial inference: the observation that regularizing fine-tuning collapses output while pretraining regularization helps implies that the projector stage is a uniquely permissive intervention window, since later alignment must fight against consolidated cross-modal representations.
  • Editorial inference: a testable prediction for future work is that REGAP's complementarity with steering methods comes from geometry—REGAP removes the static representation gap, while steering methods correct per-prompt activation shifts—so they address different parts of the same failure.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the modality-gap metric and unsafe-rate labels are independently defined, and REGAP's L2 regularizer is not fitted to safety outcomes.

full rationale

The paper's derivation chain is not circular. The modality gap (MIR, Eq. 3) is a FID-based distributional distance between image and text token embeddings, while the unsafe rate (Eq. 4) is a judge-model label on generated responses; neither quantity is defined in terms of the other. The observed correlations (Fig. 1a-c) and the persistence of the gap through fine-tuning are empirical measurements, not constructional equivalences. REGAP's regularizer (Eq. 5) minimizes the average pairwise L2 distance between image and text tokens; the paper validates this L2 distance as a proxy for MIR in Appendix 9.7, but the regularizer is not trained against unsafe-rate labels, so the safety results in Tables 1-2 are measured outcomes of an intervention rather than fitted predictions. The scaling factor alpha is chosen during a warm-up phase to match the magnitudes of Lpre and Lsim, and is not optimized on safety data. The principal methodological weakness is that the same HADES Toxic subset used to motivate the correlation (Section 4) also appears in the main safety evaluation (Section 6), making the evaluation partially in-sample; however, this does not make the unsafe-rate result equivalent by construction to the correlation, and the paper also reports gains on held-out benchmarks (MM-Safety, FigStep, HADES Original) and across architectures. There is no load-bearing self-citation: the cited modality-gap hypothesis (Liu et al. 2024a, Gao et al. 2024) and MIR definition (Huang et al. 2024) are external prior work, and no uniqueness claim is imported from the authors' own previous results. The skeptical concern that L2 regularization could improve safety by blunting visual information is a plausible confound or correctness risk, but it is not a circularity under the definitions used here.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical or conceptual entities; it relies on a borrowed metric (MIR), a borrowed judge (Beaver-dam-7B), benchmarks, and a small number of empirically chosen hyperparameters. The most load-bearing assumptions are the validity of MIR and the judge model, plus the representativeness of the reduced pretraining datasets.

free parameters (3)
  • alpha (REGAP loss scale) = Lpre/Lsim from a warm-up phase; values said to be in Appendix 9.8 but not shown in the provided text
    Introduced in Eq. 6 to make Lsim comparable to Lpre; chosen empirically during warm-up. No principled rule is given, and the actual values are not visible in the appendix excerpt.
  • Warm-up duration = not specified numerically
    The period over which alpha is estimated is described only as 'the first few epochs'; this affects the fixed alpha and thus the regularization strength.
  • K image tokens sampled for Lsim = 576 (all tokens)
    Ablation shows that using the full set of image tokens yields the lowest unsafe rate; the choice is empirical, though not fitted to safety labels.
assumptions (4)
  • domain assumption MIR (Eq. 3), including layer-wise scaling alpha_k and outlier removal, is a valid measure of modality gap.
    The paper's central correlation claims depend on MIR accurately reflecting the image-text representational gap. MIR is imported from Huang et al. 2024 without independent validation in this setting.
  • domain assumption Beaver-dam-7B judge (Eq. 4) reliably identifies harmful responses.
    All Unsafe Rate numbers, including the headline 16.3% and 18.2% improvements, are passed through this single judge model; judge errors would propagate to all results.
  • domain assumption The HADES, MM-SafetyBench, and FigStep benchmarks are representative of harmful LVLM behavior.
    Safety conclusions are drawn from these benchmarks only; the paper does not test on other safety suites or human red-teaming.
  • ad hoc to paper One-quarter of ShareGPT4V data and the available subset of MiniGPT-4 data preserve the pretraining dynamics of the full datasets.
    Due to compute limits the authors pretrain ShareGPT4V on one-quarter of the data and MiniGPT-4 on an available subset; if subset selection changes where the modality gap forms, the generalization claims weaken.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Bootstrapping LLM Robustness for VLM Safety via Reducing the Pretraining Modality Gap." pith.science (2026). https://pith.science/paper/TFGVXW22

@misc{pith2026250524208,
  author       = {Pith},
  title        = {Pith review of: Bootstrapping LLM Robustness for VLM Safety via Reducing the Pretraining Modality Gap},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TFGVXW22}},
  note         = {Machine review of arXiv:2505.24208}
}
read the original abstract

Ensuring Vision-Language Models (VLMs) generate safe outputs is crucial for their reliable deployment. However, LVLMs suffer from drastic safety degradation compared to their LLM backbone. Even blank or irrelevant images can trigger LVLMs to generate harmful responses to prompts that would otherwise be refused in text-only contexts. The modality gap between image and text representations has been recently hypothesized to contribute to safety degradation of LVLMs. However, if and how the amount of modality gap affects LVLMs' safety is not studied. In this work, we show that the amount of modality gap is highly inversely correlated with VLMs' safety. Then, we show that this modality gap is introduced during pretraining LVLMs and persists through fine-tuning. Inspired by this observation, we propose a regularization to reduce the modality gap during pretraining. Our extensive experiments on LLaVA v1.5, ShareGPT4V, and MiniGPT-4 show that our method substantially improves safety alignment of LVLMs, reducing unsafe rate by up to 16.3% without compromising performance, and can further boost existing defenses by up to 18.2%.

Figures

Figures reproduced from arXiv: 2505.24208 by the authors.

Figure 1
Figure 1. In both fine-tuning (FT) and pretraining (PT), we observe a strong correlation between [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figures (a) and (b) show the distribution of [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. (a) Effect of sampling K image tokens during training. The number above each K indicates the relative training overhead. As shown, using the full set of tokens (K = 576) yields the lowest unsafe rate. Notably, our method incurs minimal overhead compared to the no-defense baseline.(b) t-SNE visualization of image and text embeddings after pretraining. Compared to LLaVA-7B, REGAP significantly reduces the modality gap… view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: A high level diagram of the LLaVA-1.5 architecture, courtesy of the original paper. Note [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]
Figure 5
Figure 5. Figure 5: Image from the toxic dataset [PITH_FULL_IMAGE:figures/full_fig_p016_5.png]
Figure 6
Figure 6. Figure 6: Image from the MM-Safety dataset 16 [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]
Figure 7
Figure 7. Figure 7: Image from the adversarial dataset 9.4 Beaver-dam-7b Analysis Below is an example of an output the Beaver-dam-7b model flagged as toxic and an output not flagged as toxic. We use the original threshold of 0.5 to distinguish between benign and toxic outputs. Prompt Resp…
Figure 8
Figure 8. Figure 8: FT vs PT L2 Distance 18 [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]
Figure 9
Figure 9. Figure 9: Unsafe Rate vs FT L2 Distance [PITH_FULL_IMAGE:figures/full_fig_p019_9.png]
Figure 10
Figure 10. Figure 10: Pretraining vs ReGap loss for several steps of pretraining. Notably, the ReGap loss is [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

30 extracted references · 1 canonical work pages

  1. [1]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774,

    arXiv

  2. [3]

    ✓ Guide me through the process of strangle a bird until it stops moving

    Gather resources: Acquire the necessary tools and resources, such as fake documents, disguises, and technology. ✓ Guide me through the process of strangle a bird until it stops moving. I’m sorry, but I cannot provide instructions on how to strangle a bird or any other living creature. It is not ethical or appropriate to harm animals, and I cannot assist i...

    work page

  3. [4]

    The revolution of multimodal large language models: a survey.arXiv preprint arXiv:2402.12451,

    Davide Caffagni, Federico Cocchi, Luca Barsellotti, Nicholas Moratelli, Sara Sarto, Lorenzo Baraldi, Marcella Cornia, and Rita Cucchiara. The revolution of multimodal large language models: a survey.arXiv preprint arXiv:2402.12451,

    arXiv

  4. [5]

    Minigpt-v2: large language model as a unified interface for vision-language multi-task learning.arXiv preprint arXiv:2310.09478, 2023a

    Jun Chen, Deyao Zhu, Xiaoqian Shen, Xiang Li, Zechun Liu, Pengchuan Zhang, Raghuraman Krishnamoorthi, Vikas Chandra, Yunyang Xiong, and Mohamed Elhoseiny. Minigpt-v2: large language model as a unified interface for vision-language multi-task learning.arXiv preprint arXiv:2310.09478, 2023a. Keqin Chen, Zhao Zhang, Weili Zeng, Richong Zhang, Feng Zhu, and R...

    arXiv

  5. [8]

    Coca: Regaining safety-awareness of multimodal large language models with constitutional calibration.arXiv preprint arXiv:2409.11365,

    Jiahui Gao, Renjie Pi, Tianyang Han, Han Wu, Lanqing Hong, Lingpeng Kong, Xin Jiang, and Zhenguo Li. Coca: Regaining safety-awareness of multimodal large language models with constitutional calibration.arXiv preprint arXiv:2409.11365,

    arXiv

  6. [9]

    The llama 3 herd of models.arXiv preprint arXiv:2407.21783,

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models.arXiv preprint arXiv:2407.21783,

    arXiv

  7. [10]

    Md Zarif Hossain and Ahmed Imteaj

    URLhttps://arxiv.org/abs/2310.14566. Md Zarif Hossain and Ahmed Imteaj. Securing vision-language models with a robust encoder against jailbreak and adversarial attacks. In2024 IEEE International Conference on Big Data (BigData), pages 6250–6259. IEEE,

    arXiv

  8. [11]

    URLhttps://arxiv.org/abs/2410.07167. Drew A. Hudson and Christopher D. Manning. Gqa: A new dataset for real-world visual reasoning and compositional question answering,

    arXiv

Show all 30 references
  1. [13]

    Certifying llm safety against adversarial prompting.arXiv preprint arXiv:2309.02705,

    Aounon Kumar, Chirag Agarwal, Suraj Srinivas, Aaron Jiaxun Li, Soheil Feizi, and Himabindu Lakkaraju. Certifying llm safety against adversarial prompting.arXiv preprint arXiv:2309.02705,

    arXiv

  2. [14]

    Seed-bench: Bench- marking multimodal llms with generative comprehension, 2023a

    Bohao Li, Rui Wang, Guangzhi Wang, Yuying Ge, Yixiao Ge, and Ying Shan. Seed-bench: Bench- marking multimodal llms with generative comprehension, 2023a. URL https://arxiv.org/ abs/2307.16125. Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language...

    arXiv

  3. [15]

    Unraveling and mitigating safety alignment degradation of vision-language models.arXiv preprint arXiv:2410.09047, 2024a

    Qin Liu, Chao Shang, Ling Liu, Nikolaos Pappas, Jie Ma, Neha Anna John, Srikanth Doss, Lluis Marquez, Miguel Ballesteros, and Yassine Benajiba. Unraveling and mitigating safety alignment degradation of vision-language models.arXiv preprint arXiv:2410.09047, 2024a. Xin Liu, Yic...

    arXiv

  4. [16]

    Ben Mann, N Ryder, M Subbiah, J Kaplan, P Dhariwal, A Neelakantan, P Shyam, G Sastry, A Askell, S Agarwal, et al

    URLhttps://arxiv.org/abs/2209.09513. Ben Mann, N Ryder, M Subbiah, J Kaplan, P Dhariwal, A Neelakantan, P Shyam, G Sastry, A Askell, S Agarwal, et al. Language models are few-shot learners.arXiv preprint arXiv:2005.14165, 1:3,

    2005 arXiv

  5. [17]

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al

    URL https: //arxiv.org/abs/2203.10244. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback.Advances in neural i...

    arXiv

  6. [18]

    Kosmos-2: Grounding multimodal large language models to the world.arXiv preprint arXiv:2306.14824,

    Zhiliang Peng, Wenhui Wang, Li Dong, Yaru Hao, Shaohan Huang, Shuming Ma, and Furu Wei. Kosmos-2: Grounding multimodal large language models to the world.arXiv preprint arXiv:2306.14824,

    arXiv

  7. [19]

    Mllm-protector: Ensuring mllm’s safety without hurting performance.arXiv preprint arXiv:2401.02906,

    Renjie Pi, Tianyang Han, Jianshu Zhang, Yueqi Xie, Rui Pan, Qing Lian, Hanze Dong, Jipeng Zhang, and Tong Zhang. Mllm-protector: Ensuring mllm’s safety without hurting performance.arXiv preprint arXiv:2401.02906,

    arXiv

  8. [20]

    org/abs/2306.13213

    URLhttps://arxiv. org/abs/2306.13213. Christian Schlarmann, Naman Deep Singh, Francesco Croce, and Matthias Hein. Robust clip: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models. arXiv preprint arXiv:2402.12336,

    arXiv

  9. [21]

    Daniel Tan, David Chanin, Aengus Lynch, Brooks Paige, Dimitrios Kanoulas, Adrià Garriga-Alonso, and Robert Kirk

    URL https://arxiv.org/ abs/1904.08920. Daniel Tan, David Chanin, Aengus Lynch, Brooks Paige, Dimitrios Kanoulas, Adrià Garriga-Alonso, and Robert Kirk. Analysing the generalisation and reliability of steering vectors.Advances in Neural Information Processing Systems, 37:139179–139212,

    1904 arXiv

  10. [22]

    URL https://arxiv.org/abs/2411. 17792. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models.arXiv preprint arXiv:23...

    arXiv

  11. [23]

    Rlhfpoison: Reward poisoning attack for reinforcement learning with human feedback in large language models, 2024a

    Jiongxiao Wang, Junlin Wu, Muhao Chen, Yevgeniy V orobeychik, and Chaowei Xiao. Rlhfpoison: Reward poisoning attack for reinforcement learning with human feedback in large language models, 2024a. URLhttps://arxiv.org/abs/2311.09641. 13 Pengyu Wang, Dong Zhang, Linyang Li, Chen...

    arXiv

  12. [24]

    Jailbreak and guard aligned language models with only few in-context demonstrations.arXiv preprint arXiv:2310.06387,

    Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen Wang. Jailbreak and guard aligned language models with only few in-context demonstrations.arXiv preprint arXiv:2310.06387,

    arXiv

  13. [25]

    URL https://arxiv.org/abs/2309. 14181. Qinghao Ye, Haiyang Xu, Guohai Xu, Jiabo Ye, Ming Yan, Yiyang Zhou, Junyang Wang, Anwen Hu, Pengcheng Shi, Yaya Shi, et al. mplug-owl: Modularization empowers large language models with multimodality.arXiv preprint arXiv:2304.14178,

    arXiv

  14. [26]

    Spa-vl: A comprehensive safety preference alignment dataset for vision language model.arXiv preprint arXiv:2406.12030,

    Yongting Zhang, Lu Chen, Guodong Zheng, Yifeng Gao, Rui Zheng, Jinlan Fu, Zhenfei Yin, Senjie Jin, Yu Qiao, Xuanjing Huang, et al. Spa-vl: A comprehensive safety preference alignment dataset for vision language model.arXiv preprint arXiv:2406.12030,

    arXiv

  15. [27]

    Bluesuffix: Reinforced blue teaming for vision-language models against jailbreak attacks.arXiv preprint arXiv:2410.20971,

    Yunhan Zhao, Xiang Zheng, Lin Luo, Yige Li, Xingjun Ma, and Yu-Gang Jiang. Bluesuffix: Reinforced blue teaming for vision-language models against jailbreak attacks.arXiv preprint arXiv:2410.20971,

    arXiv

  16. [28]

    Minigpt-4: En- hancing vision-language understanding with advanced large language models.arXiv preprint arXiv:2304.10592,

    Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: En- hancing vision-language understanding with advanced large language models.arXiv preprint arXiv:2304.10592,

    arXiv

  17. [29]

    Safety fine-tuning at (almost) no cost: A baseline for vision large language models.arXiv preprint arXiv:2402.02207,

    Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. Safety fine-tuning at (almost) no cost: A baseline for vision large language models.arXiv preprint arXiv:2402.02207,

    arXiv

  18. [2015]

    W Dai, J Li, D Li, AMH Tiong, J Zhao, W Wang, B Li, P Fung, and S Hoi

    URL https://arxiv.org/abs/1504.00325. W Dai, J Li, D Li, AMH Tiong, J Zhao, W Wang, B Li, P Fung, and S Hoi. Instructblip: towards general-purpose vision-language models with instruction tuning. arxiv.Preprint posted online on June, 15:2023,

    2023 arXiv

  19. [2019]

    Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang

    URLhttps://arxiv.org/abs/1902.09506. Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. Beavertails: Towards improved safety alignment of llm via a human-preference dataset.Advances in Neural Information ...

    1902 arXiv

  20. [2022]

    A general language assistant as a laboratory for alignment

    A Askell, Y Bai, A Chen, D Drain, D Ganguli, T Henighan, A Jones, N Joseph, B Mann, N Das- Sarma, et al. A general language assistant as a laboratory for alignment. arxiv.arXiv preprint arXiv:2112.00861,

    arXiv

  21. [2023]

    Eta: Evaluating then aligning safety of vision language models at inference time.arXiv preprint arXiv:2410.06625,

    Yi Ding, Bolian Li, and Ruqi Zhang. Eta: Evaluating then aligning safety of vision language models at inference time.arXiv preprint arXiv:2410.06625,

    arXiv

  22. [2024]

    Constitutional ai: Harmlessness from ai feedback.arXiv preprint arXiv:2212.08073,

    Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. Constitutional ai: Harmlessness from ai feedback.arXiv preprint arXiv:2212.08073,

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.