Pith. sign in

REVIEW 3 major objections 5 minor 24 references

Activation Steering Meets Preference Optimization: Defense Against Jailbreaks in Vision Language Models

T0 review · 3 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SPO-VLM defends vision language models against jailbreaks by initializing steering vectors from contrastive activations, then refining them with sequence-level preference optimization; the paper reports lower attack success than prior steer

desk verdict The empirical story is promising, but the PPO update in Eq. (5) is not a valid importance-sampling ratio, so the central claim that Stage II optimizes the stated reward is not supported as written. read the letter →

arxiv 2509.00373 v1 pith:LULA7QCB submitted 2025-08-30 cs.CV cs.AI

Sihao Wu , Gaojie Jin , Wei Huang , Jianhong Wang , Xiaowei Huang This is my paper
classification cs.CVcs.AI
keywords visionlanguagemodelsactivationsteeringjailbreakdefensepreferenceoptimizationPPOmultimodalsafetyvisualgrounding
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Vision-language models are vulnerable to jailbreaks that hide harmful instructions in images. SPO-VLM defends them without retraining: it first computes layer-specific steering vectors from contrastive safe/unsafe prompt data, then refines a combined vector with sequence-level preference optimization under a PPO-style objective. The paper reports that on Qwen2-VL-7B, MiniGPT-4-13B, and LLaVA-v1.5-13B, this lowers toxicity and jailbreak attack success rates below the ASTRA baseline on RealToxicityPrompt, AdvBench, and Anthropic Harmful, while visual benchmarks like MM-Vet, SQA, CogVLM, and MME stay close to or above the unmodified model. If the results hold, the method offers a way to harden multimodal models without weight updates or utility loss.

What carries the argument

The load-bearing object is the layer-ℓ steering vector v^ℓ, a single direction in the residual stream. Stage I initializes it as v^ℓ = Σ_j α_j v^ℓ_j, with v^ℓ_j a difference-in-mean activation between positive and negative instruction sets; Stage II updates it through Eq. (7), a clipped PPO objective whose policy ratio (Eq. 5) compares the steered and unsteered probabilities of preferred and dispreferred responses. The base VLM stays frozen; all behavioral change comes from this vector.

What would settle it

Take a set of preference pairs, compute the paper's training-ratio quantity for each pair, and compare it against the actual likelihood ratio of the steered and unsteered models on the same response. If the two disagree in sign or magnitude, the clipped PPO objective is not being applied to a valid probability ratio. Separately, replace the visual-consistency reward with a constant and rerun the main table; if attack success and visual scores do not move, that reward term contributes nothing.

Watch

Extended reading notes

Core claim

SPO-VLM's central claim is that the steering vector itself can be the only learnable parameter in a defense. Stage I forms it as a weighted sum of difference-in-mean activations from safe and unsafe prompt sets; Stage II applies it to late-layer residual streams during rollouts and optimizes it with sequence-level PPO. The reward combines a toxicity penalty from Detoxify and a visual-consistency term based on cosine similarity between image and caption tokens. Results: on Qwen2-VL-7B, AdvBench jailbreak ASR drops from 75.00 to 6.38 and MM-Vet rises from 49.13 to 49.80; on MiniGPT-4-13B and LLaVA-v1.5-13B, ASR is lower than ASTRA with less visual degradation, and the defense transfers to unse

Load-bearing premise

The load-bearing premise is that the quantity called the policy ratio in the training update can be used exactly like the probability ratio PPO is designed for, and that the visual-consistency reward, which by its formula depends only on the image, can tell good responses from bad ones; if either premise fails, the second-stage update does not do what the paper claims.

Editorial extensions

If this is right

  • SPO-VLM reports the lowest jailbreak ASR among the compared methods on all three VLMs; for Qwen2-VL-7B, AdvBench ASR falls from 75.00 (original) to 7.69 (ASTRA) to 6.38 (SPO-VLM).
  • The defense generalizes to structure-based attacks from MM-SafetyBench that were not used in training, including combined SD+OCR attacks.
  • Visual understanding is preserved or improved: Qwen2-VL-7B MM-Vet rises to 49.80 from 49.13, while ASTRA drops to 48.66; MiniGPT-4 and LLaVA also retain much more of their visual scores than ASTRA.
  • Because only the steering vector is updated, the defense can be applied inference-time without changing model weights, making it modular and cheaper than full RLHF fine-tuning.
  • Ablation shows Stage I alone reduces Qwen2-VL-7B AdvBench ASR from 75.00 to 10.96; adding Stage II cuts it to 6.38, showing the preference-optimization stage is load-bearing for the final safety gain.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The recipe is not safety-specific: swapping the reward terms could steer other behavior axes—hallucination, sycophancy, or refusal calibration—without retraining the base model. The paper demonstrates only safety.
  • Making the Stage-I weights α learnable in Stage II, instead of the fixed 0.5/0.4/0.4 combination, would let the data decide how much each toxicity attribute contributes.
  • The same sequence-level ratio could support online adaptation: a deployed model could update its steering vector on fresh preference pairs without weight updates, if Eq. (5)'s estimator is valid.
  • Applying the sequence-level PPO objective to text-only LLMs would clarify how much of the gain comes from the Eq. (5) ratio versus the visual rewards, since text-only steering baselines are more developed.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes SPO-VLM, a two-stage defense for vision-language models against jailbreak attacks. Stage I constructs an initial steering vector as a weighted combination of difference-in-mean activation vectors computed from contrastive datasets (RealToxicityPrompt, AdvBench, Anthropic Harmful). Stage II refines this vector through a sequence-level preference-optimization procedure: a PPO-style clipped objective is applied to a 'policy ratio' defined in Eq. (5), with rewards combining a detoxification score and a visual-consistency term. Experiments on MiniGPT-4-13B, Qwen2-VL-7B, and LLaVA-v1.5-13B report lower toxicity and jailbreak ASR than ASTRA while preserving or improving visual-understanding scores on several benchmarks. The paper also reports transfer results on MM-SafetyBench and an ablation on Qwen2-VL-7B.

Significance. If the proposed optimization were valid and the evaluations were unbiased, the work would be a meaningful contribution: activation-space intervention with preference-based refinement is a plausible direction, and the reported safety improvements over ASTRA are substantial. The paper also promises code, model weights, and an evaluation toolkit, which is commendable for reproducibility. However, the central methodological novelty—the PPO-style update of Eq. (7)—rests on a policy ratio that is not a valid importance-sampling estimator, and the visual reward does not depend on the generated response. These issues are load-bearing rather than cosmetic. The evaluation also shares training and evaluation data/reward metrics, making the main safety claims difficult to interpret. The significance of the paper is therefore contingent on a reworking of the optimization objective and a decontaminated evaluation.

major comments (3)
  1. [Eq. (5) and Algorithm 1, line 9] The quantity in Eq. (5) is not a PPO policy ratio. Standard PPO uses π_θ(a|s)/π_old(a|s) for a single sampled action a. Here the expression is a difference of two likelihood ratios involving two different responses r_T and r_O. This difference can be negative or zero and does not correspond to the probability ratio of any single sampling distribution. No derivation is given showing that its expectation relates to the gradient of a well-defined objective. Consequently, the clipped objective in Eq. (7) and the gradient update in Algorithm 1 are not justified. Since Stage II is the claimed novelty, this invalidates the central mechanism by which SPO-VLM is said to refine steering vectors.
  2. [Eq. (6)] R_visual(qv) depends only on the visual input qv, not on the generated response r. As written, it assigns the same reward to the preferred response r_T and the dispreferred response r_O. Thus it cannot provide a visual-consistency preference signal between the two responses, contrary to the text's claim that 'visual-consistency rewards based on caption-image alignment' guide optimization. The reward also appears to compare the image to a caption, but no caption variable is defined in the tuple (qt, qv, r_T, r_O). This needs clarification or correction.
  3. [Section 5.1 and Table 1] The evaluation is circular in two respects. First, the steering vectors are initialized from RealToxicityPrompt, AdvBench, and Anthropic Harmful, and the main safety evaluation measures exactly those benchmarks. Second, the toxicity reward R_detoxify uses the Detoxify classifier, and the toxicity evaluation metric is also Detoxify. Thus the reported in-distribution safety gains may reflect overfitting to the training/evaluation signal rather than generalized defense. The transfer experiment on MM-SafetyBench mitigates this concern partially, but the primary safety claims still need a decontaminated evaluation or a clear separation of steering-vector construction data from evaluation data.
minor comments (5)
  1. [Eq. (7)] The objective is written as min_v over the expectation, which is inconsistent with the usual PPO maximization and with Algorithm 1's gradient-descent update. Please clarify the sign convention and the optimization direction.
  2. [Section 4.2] The preference dataset D is not described: how are the target responses r_T and undesired responses r_O constructed? Is r_O generated by the unsteered model, by a harmful model, or by a hand-crafted template? This is important for interpreting Eq. (5).
  3. [Section 5.1] Hyperparameters α_j, β, ε, c1, learning rate η, and batch size m are not reported. The paper lists some inference settings but omits the training hyperparameters needed for reproducibility.
  4. [Table 1] No standard deviations or multiple-seed results are reported. Given the small differences (e.g., Qwen2-VL AdvBench 7.69 vs. 6.38), it is unclear whether the improvements are statistically significant.
  5. [Section 5.2] The text states 'SPO-VLM reduces the average ASR on AdvBench by approximately 1.28%' and 'cuts the average ASR on Anthropic Harmful nearly in half'. These numbers appear inconsistent with Table 1; please recompute and state the calculation basis.

Circularity Check

2 steps flagged · score 6.0 of 10

Safety results in Table 1 are in-distribution fits: the steering vector is built from and refined on the same benchmarks and same toxicity classifier used for evaluation, so the central safety claim is partially circular.

  1. fitted input called prediction [Section 5.1 (Steering Activation Construction; Evaluation Datasets) and Table 1]
    "We initialize the steering vectors using the Stage I method applied to the RealToxicityPrompt, AdvBench, and Anthropic Harmful datasets. ... We evaluate our approach under three experimental settings: (1) Toxicity assessment, using the RealToxicityPrompts benchmark; (2) Jailbreak detection, evaluating on two datasets: AdvBench and Anthropic Harmful."

    The Stage I vector is computed by Eq. (4) as the difference of mean activations on positive/negative sets derived from these exact datasets, and Stage II then optimizes v with PPO on preference data. Table 1 reports toxicity/ASR on the same three benchmarks. The reported safety improvements are therefore values of the fitting objective on the fitting distribution, not predictions on held-out jailbreak inputs. The only out-of-distribution safety evaluation is the separate MM-SafetyBench transfer test in Fig. 3; the headline Table 1 safety claim reduces to the construction inputs.

  2. self definitional [Section 4.2 Eq. (6) and Section 5.1 (Evaluation Metrics)]
    "The detoxification reward component penalizes toxic content using an exponential decay function: Rdetoxify(r) = 2 · [exp(−β · toxicity(r)) − 0.5], where toxicity(r) ∈ [0, 1] is computed using a pre-trained toxicity classifier. ... For toxicity assessment, we employ the Detoxify classifier (Hanu and Unitary team, 2020) to compute toxicity scores."

    R_detoxify is a monotone transform of the exact Detoxify toxicity score that is later reported as the safety metric in Table 1. Because PPO maximizes this reward, the reported RealToxicityPrompt toxicity reduction is the training signal itself rather than an independent safety measurement. The 'safety' quantity is defined through the same classifier that is being optimized, so the toxicity-based part of the central claim is self-referential.

full rationale

The derivation of the steering vector itself (difference-in-mean activations plus PPO refinement) is not circular in its equations: Eq. (4) is a standard activation-space construction and Eq. (7) is a PPO-style update, both applied to the learned v. However, the empirical support for the paper's central safety claim is substantially in-distribution. Stage I is initialized on RealToxicityPrompt, AdvBench, and Anthropic Harmful, and Table 1 evaluates on exactly those benchmarks; additionally, the Detoxify classifier used for the training reward is the same metric used for toxicity evaluation. These two overlaps mean the headline safety numbers are partially forced by the training setup rather than by independent generalization. The MM-SafetyBench transfer results and the benign visual-understanding benchmarks are not fitted in the same way and give the framework some independent content, so the circularity is partial rather than total. The mathematical concerns about the validity of Eq. (5) as an importance-sampling ratio and the input-dependence of R_visual are correctness/rigor issues, not circularity, and are not scored here.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim rests on hand-chosen combination weights, per-model steering hyperparameters, and an unvalidated PPO variant, plus the assumption that the same benchmark datasets used to build the steering vectors also provide valid held-out safety metrics.

free parameters (6)
  • Attribute combination weights α_j (α_1=0.5, α_2=0.4, α_3=0.4) = 0.5, 0.4, 0.4
    Chosen by hand in Section 5.1; no tuning procedure or validation split described.
  • Steering layer ℓ = 20 (13B models), 14 (7B models)
    Set per model with no justification in Section 5.1.
  • Inference steering strength α and temperature = α=10, temp=0.2 (LLaVA); α=7, temp=0.2 (Qwen); α=7, temp=1.2 (MiniGPT)
    Tuned per model at test time (Section 5.1).
  • Reward penalty strength β = not specified
    Controls the detoxify exponential penalty in R_detoxify (Eq. 6); no value is given.
  • PPO clip range ε and critic coefficient c1 = not specified
    Hyperparameters of the optimization that are never reported.
  • Learning rate η and batch size m = not specified
    Gradient-descent updates for the steering vector (Algorithm 1) lack reported schedules.
assumptions (5)
  • domain assumption Linear representation hypothesis: target behaviors are encoded as linear directions in activation space, so difference-in-means vectors (Eq. 2) can shift behavior.
    Invoked in Section 3.2 and Stage I; relied on from citations Arditi et al., 2024 and Park et al., 2024.
  • domain assumption The steering intervention a+v does not break the autoregressive validity of the VLM.
    Stage II assumes that adding a vector to layer ℓ activations yields a properly normalized policy π_{L+1}, used in Eq. (5).
  • domain assumption Detoxify and HarmBench classifiers are valid proxies for harm.
    Used both as reward and evaluation without discussion of their failure modes.
  • ad hoc to paper The clipped PPO objective with the difference-of-ratios in Eq. (5) is a valid estimator for optimizing the steering vector.
    This is a nonstandard objective introduced in Section 4.2; no derivation or convergence argument is provided.
  • domain assumption Cosine similarity between mean-pooled image and caption hidden states measures visual grounding.
    R_visual in Eq. (6) assumes CLIP-like embeddings are comparable across modalities.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Activation Steering Meets Preference Optimization: Defense Against Jailbreaks in Vision Language Models." pith.science (2026). https://pith.science/paper/LULA7QCB

@misc{pith2026250900373,
  author       = {Pith},
  title        = {Pith review of: Activation Steering Meets Preference Optimization: Defense Against Jailbreaks in Vision Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LULA7QCB}},
  note         = {Machine review of arXiv:2509.00373}
}
read the original abstract

Vision Language Models (VLMs) have demonstrated impressive capabilities in integrating visual and textual information for understanding and reasoning, but remain highly vulnerable to adversarial attacks. While activation steering has emerged as a promising defence, existing approaches often rely on task-specific contrastive prompts to extract harmful directions, which exhibit suboptimal performance and can degrade visual grounding performance. To address these limitations, we propose \textit{Sequence-Level Preference Optimization} for VLM (\textit{SPO-VLM}), a novel two-stage defense framework that combines activation-level intervention with policy-level optimization to enhance model robustness. In \textit{Stage I}, we compute adaptive layer-specific steering vectors from diverse data sources, enabling generalized suppression of harmful behaviors during inference. In \textit{Stage II}, we refine these steering vectors through a sequence-level preference optimization process. This stage integrates automated toxicity assessment, as well as visual-consistency rewards based on caption-image alignment, to achieve safe and semantically grounded text generation. The two-stage structure of SPO-VLM balances efficiency and effectiveness by combining a lightweight mitigation foundation in Stage I with deeper policy refinement in Stage II. Extensive experiments shown SPO-VLM enhances safety against attacks via activation steering and preference optimization, while maintaining strong performance on benign tasks without compromising visual understanding capabilities. We will release our code, model weights, and evaluation toolkit to support reproducibility and future research. \textcolor{red}{Warning: This paper may contain examples of offensive or harmful text and images.}

Figures

Figures reproduced from arXiv: 2509.00373 by the authors.

Figure 1
Figure 1. Overview of the SPO-VLM framework. Stage I (left top) initializes attribute [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Comparison of safety enhancement methods in terms of safety and visual under￾standing capabilities. Each shape denotes one method. SPO-VLM demonstrates enhanced safety performance. As shown in Ta￾ble 1, SPO-VLM achieves superior safety performance. In the RealToxicityPrompt dataset, SPO-VLM achieves the lowest tox￾icity score, reducing it by more than 27.79% compared to the original model. Compared to ASTRA, SPO-VLM… view at source ↗
Figure 3
Figure 3. Evaluation of defense transferability under structure-based attacks using MM [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

24 extracted references · 1 canonical work pages

  1. [5]

    Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt

    URL https://arxiv.org/ abs/2406.00045. Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. Are aligned neural networks adversarially aligned? Advances in Neural Information Process- ing Systems , 36:61478–61500,

    arXiv

  2. [7]

    Chaoyou Fu, Peixian Chen, Yunhang Shen, Yulei Qin, Mengdan Zhang, Xu Lin, Jinrui Yang, Xiawu Zheng, Ke Li, Xing Sun, et al

    URL https://openreview.net/forum?id=vvoWPYqZJA. Chaoyou Fu, Peixian Chen, Yunhang Shen, Yulei Qin, Mengdan Zhang, Xu Lin, Jinrui Yang, Xiawu Zheng, Ke Li, Xing Sun, et al. Mme: A comprehensive evaluation benchmark for multimodal large language models. arXiv preprint arXiv:2306.13394 ,

    arXiv

  3. [8]

    Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A

    URL https: //arxiv.org/abs/2209.07858. Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. Re- altoxicityprompts: Evaluating neural toxic degeneration in language models,

    arXiv

  4. [11]

    org/abs/2502.01042

    URL https://arxiv. org/abs/2502.01042. Laura Hanu and Unitary team. Detoxify. Github. https://github.com/unitaryai/detoxify,

    arXiv

  5. [12]

    Qing Li, Jiahui Geng, Zongxiong Chen, Kun Song, Lei Ma, and Fakhri Karray

    URL https://arxiv.org/abs/2306.03341. Qing Li, Jiahui Geng, Zongxiong Chen, Kun Song, Lei Ma, and Fakhri Karray. Internal ac- tivation revision: Safeguarding vision language models without parameter update, 2025a. URL https://arxiv.org/abs/2501.16378. Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. Images are achilles’ heel of alignment: ...

    arXiv

  6. [13]

    Autodan: Generating stealthy jailbreak prompts on aligned large language models, 2024a

    Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models, 2024a. URL https://arxiv.org/ abs/2310.04451. Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. Mm-safetybench: A benchmark for safety evaluation of multimodal large language models, 2024b. URL https://arx...

    arXiv

  7. [14]

    Zhenxing Niu, Haodong Ren, Xinbo Gao, Gang Hua, and Rong Jin

    URL https://arxiv.org/abs/2402.04249. Zhenxing Niu, Haodong Ren, Xinbo Gao, Gang Hua, and Rong Jin. Jailbreaking attack against multimodal large language model,

    arXiv

  8. [15]

    Kiho Park, Yo Joong Choe, and Victor Veitch

    URL https://arxiv.org/abs/2203.02155. Kiho Park, Yo Joong Choe, and Victor Veitch. The linear representation hypothesis and the geometry of large language models,

    arXiv

Show all 24 references
  1. [16]

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Pra- teek Mittal

    URL https://arxiv.org/abs/2311.03658. Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Pra- teek Mittal. Visual adversarial examples jailbreak aligned large language models,

    arXiv

  2. [17]

    Christian Schlarmann and Matthias Hein

    URL https://arxiv.org/abs/2306.13213. Christian Schlarmann and Matthias Hein. On the adversarial robustness of multi-modal foundation models,

    arXiv

  3. [18]

    John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov

    URL https://arxiv.org/abs/2308.10741. John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. Proximal policy optimization algorithms,

    arXiv

  4. [20]

    Nishant Subramani, Nivedita Suresh, and Matthew E

    URL https://arxiv.org/abs/2009.01325. Nishant Subramani, Nivedita Suresh, and Matthew E. Peters. Extracting latent steering vectors from pretrained language models,

    2009 arXiv

  5. [21]

    Han Wang, Gang Wang, and Huan Zhang

    URL https://arxiv.org/abs/2201.08239. Han Wang, Gang Wang, and Huan Zhang. Steering away from harm: An adaptive approach to defending vision language model against jailbreaks, 2024a. URL https://arxiv.org/ abs/2411.16721. Peng Wang, Shuai Bai, Sinan Tan, Shijie Wang, Zhihao Fa...

    arXiv

  6. [22]

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J

    URL https://arxiv.org/abs/1909.08593. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models,

    1909 arXiv

  7. [23]

    Xiaohan Zou, Jian Kang, George Kesidis, and Lu Lin

    URL https://arxiv.org/abs/2307.15043. Xiaohan Zou, Jian Kang, George Kesidis, and Lu Lin. Understanding and rectifying safety perception distortion in vlms,

    arXiv

  8. [24]

    URL https://arxiv.org/abs/2502.13095

    arXiv

  9. [1952]

    semanticscholar.org/CorpusID:125209808

    URL https://api. semanticscholar.org/CorpusID:125209808. Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Lan- guage models are few-shot learners. Advances in neural...

    1901

  10. [2017]

    Nisan Stiennon, Long Ouyang, Jeff Wu, Daniel M

    URL https://arxiv.org/abs/1707.06347. Nisan Stiennon, Long Ouyang, Jeff Wu, Daniel M. Ziegler, Ryan Lowe, Chelsea Voss, Alec Radford, Dario Amodei, and Paul Christiano. Learning to summarize from human feed- back,

    arXiv

  11. [2020]

    Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang

    URL https://arxiv.org/abs/2009.11462. Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. Figstep: Jailbreaking large vision-language models via typo- graphic visual prompts,

    2009 arXiv

  12. [2021]

    URL https://arxiv.org/abs/ 2112.00861. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, Nicholas Joseph, Saurav Kadavath, Jackson Kernion, Tom Conerly, Sheer El-Showk, Nelson Elhage, Zac Hat...

    arXiv

  13. [2022]

    Ralph Allan Bradley and Milton E

    URL https://arxiv.org/ abs/2204.05862. Ralph Allan Bradley and Milton E. Terry. Rank analysis of incomplete block designs: I. the method of paired comparisons. Biometrika, 39:324,

    arXiv

  14. [2023]

    Wenliang Dai, Junnan Li, Dongxu Li, Anthony Tiong, Junqi Zhao, Weisheng Wang, Boyang Li, Pascale Fung, and Steven Hoi

    URL https://arxiv.org/abs/2310.09478. Wenliang Dai, Junnan Li, Dongxu Li, Anthony Tiong, Junqi Zhao, Weisheng Wang, Boyang Li, Pascale Fung, and Steven Hoi. InstructBLIP: Towards general-purpose vision-language models with instruction tuning. In Thirty-seventh Conference on Ne...

    arXiv

  15. [2024]

    URL https://arxiv.org/abs/2406.11717. Amanda Askell, Yuntao Bai, Anna Chen, Dawn Drain, Deep Ganguli, Tom Henighan, Andy Jones, Nicholas Joseph, Ben Mann, Nova DasSarma, Nelson Elhage, Zac Hatfield-Dodds, Activation Steering Meets Preference Optimization Danny Hernandez, Jacks...

    arXiv

  16. [2025]

    Xingang Guo, Fangxu Yu, Huan Zhang, Lianhui Qin, and Bin Hu

    URL https://arxiv.org/abs/2311.05608. Xingang Guo, Fangxu Yu, Huan Zhang, Lianhui Qin, and Bin Hu. Cold-attack: Jailbreaking llms with stealthiness and controllability,

    arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.