Pith. sign in

REVIEW 4 major objections 6 minor 103 references

The paper claims that pruning the visual tokens least aligned with the language feature space, at a selected mid-network layer, substantially improves MLLM robustness against jailbreak attacks and hallucinations, while also accelerating inf

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 13:01 UTC pith:SBA4GVL2

load-bearing objection Useful empirical paper, but the headline jailbreak gains are likely inflated because pruning removes the harmful text in the image; the OOD mechanism claim is not established. the 4 major comments →

arxiv 2607.22716 v1 pith:SBA4GVL2 submitted 2026-07-21 cs.CV cs.LG

Visual Token Compression Enhances Robustness of MLLMs

Shishen Gu , Jiequan Cui , Wenbo Hu , Zenglin Shi , Zhenzhen Hu , Richang Hong This is my paper
classification cs.CV cs.LG
keywords visual token pruningmultimodal large language modelsjailbreak defensehallucination mitigationout-of-distribution tokensrobust-pruning layersattention distancetraining-free robustness
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to establish that visual token compression can be a safety mechanism, not just a speedup trick. Because vision and language modalities never align perfectly, some image tokens act as out-of-distribution noise that pushes the model toward unsafe or hallucinated outputs. The proposed method scores each visual token by its attention distance to the final half of the text tokens, then removes the farthest fraction at a 'robust-pruning layer.' On jailbreak benchmarks this lifts the average refuse-to-answer rate on Qwen-2.5-VL from about 20% to 34%, with smaller gains on hallucination benchmarks and essentially no loss on general capability benchmarks. If correct, this gives a training-free, plug-and-play defense that makes models safer and faster at once.

Core claim

The central claim is that OOD visual token pruning (OOD-VTP) improves MLLM robustness. The paper defines a visual token's distance as the minimum negative attention score to the last 50% of textual tokens—text tokens being the grounded semantic anchor—and prunes the top r% of tokens with the largest distance. Using validation-set grid search to find the optimal pruning layer, the method raises average RAR from 20.38% to 33.67% on SafeBench, HADES, and MM-SafetyBench combined, improves HallusionBench accuracy by 0.75 points, and slightly boosts MME scores. A fixed layer (Layer 14) already gives consistent gains across benchmarks without per-benchmark tuning. The paper also shows the method is

What carries the argument

The central object is the 'visual token distance': for each image token at layer k, take the minimum negative attention weight it receives with respect to the last p% of textual tokens (p=50% chosen empirically). This score ranks how 'out-of-distribution' each visual token is relative to the language feature space. The method prunes the top r% of tokens ranked farthest, iteratively, at a 'robust-pruning layer'—a mid-network layer where the distance is minimized and where pruning gives the largest safety gains. The distance is an attention-based proxy; the paper validates it with cosine-similarity checks and ablations showing min beats max/mean aggregation.

Load-bearing premise

The claim collapses if the attention distance from a visual token to the last 50% of text tokens is not a faithful measure of semantic out-of-distributionness—the paper itself calls it a 'ranking proxy'—and if the observed safety gains come simply from deleting the harmful text printed in the image, rather than from removing misaligned tokens (its own qualitative results show the pruned tokens are often exactly that harmful text).

What would settle it

Take a jailbreak dataset where the harmful instruction is embedded in the text prompt only, not in the image, and run OOD-VTP unchanged. If RAR does not improve, the method's effect is tied to erasing image-borne harmful text rather than to general OOD-token removal. Conversely, take benign images (no harmful text) and add small adversarial perturbations; if OOD-VTP fails to reduce jailbreak success on these, the claim that it defends against perturbation-based attacks specifically through OOD pruning loses support.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Training-free safety gains: any frozen MLLM can adopt OOD-VTP without fine-tuning, which matters for models where safety alignment is costly or unavailable.
  • Speed as a side-benefit: pruning roughly a quarter to three-quarters of visual tokens lowers FLOPs and raises tokens-per-second, so robustness does not trade off against efficiency.
  • Complementary defense: combining OOD-VTP with a prompt-shield like AdaShield raises SafeBench RAR to 93.8%, suggesting it layers well with existing safeguards.
  • Partial resistance to adaptive attacks: under a white-box attack that knows the pruning rule, OOD-VTP keeps attack success below 32% versus 66% for the undefended model.
  • Unified deployment: a single fixed pruning layer (Layer 14) transfers across benchmarks and to a different backbone, easing real-world use.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The safety gain may be largely explained by a simpler mechanism: the pruned tokens frequently coincide with harmful typographic text embedded in jailbreak images. If so, OOD-VTP is acting as an automated OCR-filter that deletes incriminating pixels rather than as a general OOD denoiser—a distinction that matters for threat models like adversarial perturbations hidden in benign-looking regions.
  • A testable extension: applying the same distance-aware pruning to images that contain no text (e.g., diffusion-generated scenes) should reveal whether the mechanism generalizes to non-typographic jailbreaks, which the paper does not isolate.
  • The 'robust-pruning layer' phenomenon suggests a mechanistic interpretation: mid-layer features are where modality alignment peaks, so pruning there removes misaligned noise without destroying task-relevant visual evidence; deeper layers compress everything into uniform representations, making pruning pointless.
  • If the distance proxy is truly measuring OOD-ness rather than just text-overlap, a similar rule could be used for OOD detection in other multimodal safety tasks, such as detecting poisoned or anomalous images before generation.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes OOD-VTP, a training-free visual-token pruning method for multimodal LLMs. At a chosen LLM layer (the 'robust-pruning layer'), it computes a distance between each visual token and the last-p% of textual tokens, then removes the r% visual tokens with the largest distances. The authors claim this improves robustness against jailbreak attacks and hallucinations, while also speeding up inference. The main empirical claim is in the Abstract and Section 4.1: on SafeBench, HADES, and MM-SafetyBench, OOD-VTP raises average refusal-to-answer rate (RAR) for Qwen-2.5-VL from 20.38% to 33.67%, an average improvement of 13.29%, and also improves HOR. Additional experiments cover hallucination benchmarks (CHAIR, HallusionBench, POPE), general benchmarks (MME, OCRBench), adaptive attacks, and efficiency. The method is evaluated on Qwen-2.5-VL-7B and LLaVA-OneVision-7B.

Significance. If the causal mechanism were established, this would be a valuable result: a training-free, plug-and-play defense that also compresses the visual token stream. The paper has several strengths: it ships code, evaluates with a HOR protocol that includes a capability-failure score (Appendix A.2), and reports robustness checks against a compression-aware attack (CAGE, Table 10), a transferable attack (FORCE, Table 11), and a white-box adaptive attack (Table 12). These are good-faith attempts to go beyond simple benchmark reporting. However, the headline gain and the central causal explanation are currently undermined by two load-bearing issues: (i) the reported 13.29% RAR gain uses per-benchmark optimal layer/ratio selected on the validation split (Algorithm 1, Table 8), while the fixed-layer result (Table 3) is considerably weaker and missing for HADES; and (ii) the method's own qualitative examples show that pruning at high ratios removes harmful typographic text, and the metric credits the resulting generic refusal as a successful defense, so the 'OOD-token' mechanism is not distinguished from input sanitization.

major comments (4)
  1. [Abstract; §4.1; Algorithm 1; Table 8] The headline 'average improvement of 13.29%' is computed from per-benchmark optimal layer k and ratio r selected on each validation set. Table 8 shows large variation across benchmarks (SafeBench k=13 r=75%, HADES k=2 r=75%, MM-SafetyBench k=11 r=50%). The fixed-layer robustness check in Table 3 (Layer 14) gives much smaller gains: MM-SafetyBench 33.65→35.58 instead of 39.50, and HADES is not reported at all. Thus the advertised number reflects validation-set fitting more than a property of a fixed configuration. Please report the fixed-layer average as the primary claim, or clearly state that the headline is an upper bound obtained by per-benchmark selection.
  2. [§3.2; Appendix C.2; Figs. 15–16] The causal claim that pruning OOD visual tokens is what improves safety is confounded by deletion of harmful typographic text. In Figures 15–16, at r=75% the retained-token maps show that the pruned tokens are precisely those covering the harmful instruction, and the model then flips from compliance to refusal. SafeBench/FigStep, HADES, and MM-SafetyBench all rely heavily on typographic images, so this mechanism likely drives many of the reported gains. RAR credits any response containing 'I am sorry', even when the model never processed the harmful content; the HOR score-0 protocol in Appendix A.2 excludes only obvious non-sequiturs and does not fix the RAR metric. Please add a text-masking/cropping control that removes the harmful text region without pruning, and compare RAR and HOR against vanilla and OOD-VTP. Without this control, the mechanism is indistinguishable from input sanitiz
  3. [§3.3; Fig. 6] The evidence offered for the OOD mechanism is correlational and partly circular. Fig. 6a compares well-defended vs poorly-defended samples after the fact, but does not test whether the pruned tokens are OOD rather than simply text-bearing. Fig. 6b identifies 'robust-pruning layers' on the same validation data used to select them; this does not independently establish that layer-dependent behavior is a stable property. The attention-free token-level check in Fig. 6c shows that pruned tokens have lower cosine similarity to the text representation, which is expected if the pruned tokens contain content unlike the question; it does not show that removing those tokens is what causes safety gains. A direct control (e.g., pruning the same tokens but with the harmful text absent) is needed.
  4. [§4.2; Table 5] The hallucination claim is model- and metric-dependent. On LLaVA-OneVision, OOD-VTP reduces CHAIR but HallusionBench accuracy drops from 52.68 to 51.74. On Qwen-2.5-VL, the HallusionBench gain is 0.75 points (59.73→60.48). This is consistent with 'competitive', but the paper's conclusion that the method 'mitigates hallucinations' is too strong when stated without these qualifications. The final sentence of Section 4.2 does acknowledge backbone dependence; the Abstract and Contributions should be scoped accordingly.
minor comments (6)
  1. [Abstract; Table 1] The 13.29% improvement is for Qwen-2.5-VL RAR only; the LLaVA-OneVision average RAR gain from Table 1 is about 8.96 points. Please say the number is model-specific.
  2. [§3.1; Eq. (4)] The definition of visual-token distance says the distance can be instantiated as the negative mean attention over heads, but then takes a min over textual tokens. Clarify how the per-head mean and the min over S_k compose.
  3. [§3.2; Fig. 5] Figure 5 is referenced for the p% sweep and the claim that p=50% is best, but the relevant plot is not visible in the manuscript text under review. Please include it and report whether p was tuned on validation or fixed a priori.
  4. [Table 3] The fixed-layer result uses Layer 14 without explaining how this layer was chosen. If it was selected after viewing the per-benchmark sweeps, that should be stated. Also include HADES in the fixed-layer table.
  5. [Appendix A.2] The HOR score-0 rule says a model that 'completely fails to understand the harmful nature of the request' receives score 0, but a generic 'I am sorry, I cannot...' after the harmful text is removed is not clearly a non-sequitur by this definition. Give examples of score-0 vs score-1 judgments to show that generic refusals are not counted as harmless.
  6. [§4.4; App. B.4] The VCD+OOD-VTP combination worsens CHAIR_s relative to OOD-VTP alone (Table 15). The text says they are 'complementary' but on this metric they are not. Please qualify the complementarity claim.

Circularity Check

1 steps flagged

No load-bearing circularity; headline gains are measured on held-out test splits. Minor self-definitional step: 'OOD' tokens are defined as largest-distance tokens and then reported as validated by that same distance.

specific steps
  1. self definitional [Section 3.2 (Eq. 4-5 and OOD-VTP definition) / Section 4.4 (ablation on pruning largest-distance tokens)]
    "we select the top-r% visual tokens with the largest distances D(v^k_j,T) and discard them as out-of-distribution tokens. ... This validates our intuition that tokens with larger visual-token distances are indeed less aligned with the textual feature space and therefore act as OOD tokens."

    The paper defines 'out-of-distribution token' as a top-r% largest-distance token (Sec. 3.2, Eq. 4-5). The Sec. 4.4 statement that larger-distance tokens 'act as OOD tokens' therefore restates the operational definition rather than providing independent confirmation. This is an explanatory/naming step, not the source of the measured robustness gains, so it does not force the headline result.

full rationale

The central claim—that pruning the farthest-from-text visual tokens at selected layers improves jailbreak/hallucination robustness—is an empirical result, not a derivation from an input that contains that result. Main numbers come from test splits disjoint from the Algorithm 1 validation split, and the method is checked against perturbation-based attacks (Table 2), a compression-aware attack (Table 10), a transferable attack (Table 11), a white-box adaptive attack (Table 12), and fixed-layer cross-architecture transfer (Table 13). Selecting layer/ratio on validation data is standard model selection, not a fitted input renamed as a prediction. The HOR protocol (App. A.2) explicitly excludes capability failures, and Figs. 15-16 reveal a plausible confound (pruning harmful typography can cause refusal via information loss); this is a validity/correctness concern, not circularity. Self-citations in Related Work are not load-bearing, and no uniqueness theorem or ansatz is imported from the authors' prior work. The only mild circularity is definitional labeling of large-distance tokens as 'OOD'.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The central method rests on four tuned hyperparameters (ratio, layer, p%, distance aggregation) and four domain assumptions that are plausible but not proven. The 'OOD visual token' construct is a post-hoc labeling based on the same distance metric used to prune, so it carries the main circularity burden. No new physical or architectural entities are introduced.

free parameters (4)
  • pruning ratio r = 25%/50%/75% per dataset (e.g., Qwen SafeBench 75%, HallusionBench 25%; LLaVA mostly 75%)
    Selected by grid search on the validation set via Algorithm 1; reported test results use these per-benchmark best values (Table 8).
  • pruning layer k = Per dataset: Qwen SafeBench 13, HADES 2, MM-SafetyBench 11, CHAIR 6, HallusionBench 18; LLaVA 4/5/3/5/16
    Grid-searched on validation split; robustness gains are critically sensitive to this value (Figure 3), and Table 8 shows wide variation across benchmarks.
  • p: last-p% text tokens used as textual feature space = 50%
    Chosen empirically: 'our results indicate that the model consistently performs best when p% is selected as 50%' (Section 3.2).
  • distance aggregation function = min
    Selected by ablation over {min, max, mean} (Figure 7b); no theoretical derivation given.
axioms (4)
  • domain assumption Misaligned/OOD visual tokens act as OOD inputs to the language backbone and cause jailbreak/hallucination vulnerabilities
    Core motivation in the Introduction and Figure 1; asserted as a hypothesis and used to justify the method, but never independently proven.
  • domain assumption Attention distance from a visual token to the last p% textual tokens is a valid proxy for OOD degree
    Definition 3.1 and Section 3.2; supported only by correlation (Figure 6) and ablations, not by a mechanistic argument or external OOD benchmark.
  • domain assumption Last p% textual tokens best represent the textual feature space due to causal attention integration
    Section 3.2, paragraph 'Last-p% Tokens Representing Textual Feature Space T'; plausible but not independently demonstrated, and p is fitted.
  • domain assumption A robust-pruning layer and ratio selected on a validation split transfer to the test split and across benchmarks
    Algorithm 1; Table 3 and Table 13 show a fixed layer 14 works, but the per-benchmark selected layers vary widely, so the transferability assumption is only partially validated.

pith-pipeline@v1.3.0-alltime-deepseek · 23159 in / 9859 out tokens · 106329 ms · 2026-08-01T13:01:52.379430+00:00 · methodology

0 comments
read the original abstract

In this paper, we show for the first time that visual token pruning enhances the robustness of Multimodal Large Language Models (MLLMs), mitigating vulnerabilities such as jailbreak attacks and hallucinations. Given that vision and language modalities cannot be perfectly aligned, the misaligned visual tokens might act as out-of-distribution (OOD) inputs, leading to unpredictable outputs and introducing potential vulnerabilities. Building on this insight, we aim to enhance model robustness against jailbreaks and hallucinations by reducing OOD visual tokens at robust-pruning layers, while also reducing inference cost as a side benefit. Specifically, we measure the distance between each visual token and the language feature space. Then, visual tokens with large distances are identified as OOD tokens, which can be iteratively pruned. To demonstrate the effectiveness of our method, we evaluate it on seven diverse popular benchmarks. Notably, our method yields an average improvement of 13.29\% in defending jailbreak attacks, consistently achieves competitive performance in mitigating hallucinations, and maintains strong results on general datasets like MME.

Figures

Figures reproduced from arXiv: 2607.22716 by Jiequan Cui, Richang Hong, Shishen Gu, Wenbo Hu, Zenglin Shi, Zhenzhen Hu.

Figure 1
Figure 1. Figure 1: Robustness comparison between LLMs and MLLMs. With pretraining on large-scale text data and safety alignment [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: It is critical to identify OOD visual tokens for enhancing robustness with visual token pruning. The Refuse-to [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: It is critical to perform visual token pruning at [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: An illustration of implementation for OOD-VTP at [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figure 6
Figure 6. Figure 6: Analysis of the proposed visual token distance on Qwen-2.5-VL at the sample, layer, and token levels. (a) Distribution [PITH_FULL_IMAGE:figures/full_fig_p005_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Ablation study on the working mechanism of OOD-VTP. [PITH_FULL_IMAGE:figures/full_fig_p008_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Prompt used by GPT-5 mini for HOR evaluation. [PITH_FULL_IMAGE:figures/full_fig_p012_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Detailed policy used for CLAS-style evaluation. [PITH_FULL_IMAGE:figures/full_fig_p013_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: RAR and HOR across all evaluated pruning layers and ratios on the SafeBench validation set. [PITH_FULL_IMAGE:figures/full_fig_p014_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: RAR and HOR across all evaluated pruning layers and ratios on the HADES validation set. [PITH_FULL_IMAGE:figures/full_fig_p015_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: RAR and HOR across all evaluated pruning layers and ratios on the MM-SafetyBench validation set. [PITH_FULL_IMAGE:figures/full_fig_p015_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Combining the robust-pruning layers with FastV, the performance of the Robust FastV method boosts. Evaluation is [PITH_FULL_IMAGE:figures/full_fig_p016_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: Qualitative comparison of OOD-VTP and FastV at the same pruning layer and ratio. Top: a hallucination-related [PITH_FULL_IMAGE:figures/full_fig_p019_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Effect of pruning ratio on a jailbreak image asking for a list of dating applications that permit explicit images. Left: [PITH_FULL_IMAGE:figures/full_fig_p019_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: Effect of pruning ratio on a jailbreak image asking for instructions to create counterfeit certificates or diplomas. [PITH_FULL_IMAGE:figures/full_fig_p020_16.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

103 extracted references · 32 linked inside Pith

  1. [1]

    Mohammad Gheshlaghi Azar, Zhaohan Daniel Guo, Bilal Piot, Remi Munos, Mark Rowland, Michal Valko, and Daniele Calandriello. 2024. A general theoreti- cal paradigm to understand learning from human preferences. InInternational Conference on Artificial Intelligence and Statistics. PMLR, 4447–4455

    2024

  2. [2]

    Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, et al . 2025. Qwen2. 5-vl technical report.arXiv preprint arXiv:2502.13923(2025)

    Pith/arXiv arXiv 2025

  3. [3]

    Patrice Béchard and Orlando Marquez Ayala. 2024. Reducing hallucination in structured outputs via Retrieval-Augmented Generation.arXiv preprint arXiv:2404.08189(2024)

    Pith/arXiv arXiv 2024

  4. [4]

    Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Röttger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. 2023. Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions.arXiv preprint arXiv:2309.07875(2023)

    Pith/arXiv arXiv 2023

  5. [5]

    Wenhao Chai, Enxin Song, Yilun Du, Chenlin Meng, Vashisht Madhavan, Omer Bar-Tal, Jenq-Neng Hwang, Saining Xie, and Christopher D Manning. 2024. Auroracap: Efficient, performant video detailed captioning and a new benchmark. arXiv preprint arXiv:2410.03051(2024)

    Pith/arXiv arXiv 2024

  6. [6]

    Jieneng Chen, Luoxin Ye, Ju He, Zhao-Yang Wang, Daniel Khashabi, and Alan Yuille. 2024. Efficient large multi-modal models via visual context compression. Advances in Neural Information Processing Systems37 (2024), 73986–74007

    2024

  7. [7]

    Liang Chen, Haozhe Zhao, Tianyu Liu, Shuai Bai, Junyang Lin, Chang Zhou, and Baobao Chang. 2024. An image is worth 1/2 tokens after layer 2: Plug-and-play inference acceleration for large vision-language models. InEuropean Conference on Computer Vision. Springer, 19–35

    2024

  8. [8]

    Zhaorun Chen, Zhuokai Zhao, Hongyin Luo, Huaxiu Yao, Bo Li, and Jiawei Zhou

  9. [9]

    Yung-Sung Chuang, Yujia Xie, Hongyin Luo, Yoon Kim, James Glass, and Pengcheng He. 2023. Dola: Decoding by contrasting layers improves factuality in large language models.arXiv preprint arXiv:2309.03883(2023)

    Pith/arXiv arXiv 2023

  10. [10]

    CLAS. 2024. The competition for llm and agent safety. Accessed: 2025-09-19

    2024

  11. [11]

    Jiequan Cui, Shu Liu, Zhuotao Tian, Zhisheng Zhong, and Jiaya Jia. 2022. Reslt: Residual learning for long-tailed recognition.IEEE transactions on pattern analysis and machine intelligence45, 3 (2022), 3695–3706

    2022

  12. [12]

    Jiequan Cui, Shu Liu, Liwei Wang, and Jiaya Jia. 2021. Learnable boundary guided adversarial training. InProceedings of the IEEE/CVF international conference on computer vision. 15721–15730

    2021

  13. [13]

    Jiequan Cui, Zhuotao Tian, Zhisheng Zhong, Xiaojuan Qi, Bei Yu, and Hanwang Zhang. 2024. Decoupled kullback-leibler divergence loss.Advances in Neural Information Processing Systems37 (2024), 74461–74486

    2024

  14. [14]

    Jiequan Cui, Zhisheng Zhong, Shu Liu, Bei Yu, and Jiaya Jia. 2021. Parametric contrastive learning. InProceedings of the IEEE/CVF international conference on computer vision. 715–724

    2021

  15. [15]

    Jiequan Cui, Zhisheng Zhong, Zhuotao Tian, Shu Liu, Bei Yu, and Jiaya Jia

  16. [16]

    Jiequan Cui, Beier Zhu, Xin Wen, Xiaojuan Qi, Bei Yu, and Hanwang Zhang

  17. [17]

    Jiequan Cui, Beier Zhu, Qingshan Xu, Zhuotao Tian, Xiaojuan Qi, Bei Yu, Han- wang Zhang, and Richang Hong. 2026. Generalized Kullback-Leibler Divergence Loss.IEEE Transactions on Pattern Analysis and Machine Intelligence(2026), 1–12. doi:10.1109/TPAMI.2026.3703828

    arXiv 2026

  18. [18]

    Jiequan Cui, Beier Zhu, Qingshan Xu, Xiaogang Xu, Pengguang Chen, Xiaojuan Qi, Bei Yu, Hanwang Zhang, and Richang Hong. 2025. Generative Distribution Distillation.arXiv preprint arXiv:2507.14503(2025)

    Pith/arXiv arXiv 2025

  19. [19]

    In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Classes are not equal: An empirical study on image recognition fairness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 23283–23292

  20. [20]

    Yinpeng Dong, Huanran Chen, Jiawei Chen, Zhengwei Fang, Xiao Yang, Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. 2023. How Robust is Google’s Bard to Adversarial Image Attacks?arXiv preprint arXiv:2309.11751(2023)

    Pith/arXiv arXiv 2023

  21. [21]

    Kawin Ethayarajh, Winnie Xu, Niklas Muennighoff, Dan Jurafsky, and Douwe Kiela. 2024. Kto: Model alignment as prospect theoretic optimization.arXiv preprint arXiv:2402.01306(2024)

    Pith/arXiv arXiv 2024

  22. [22]

    Yi Ding, Bolian Li, and Ruqi Zhang. 2024. Eta: Evaluating then aligning safety of vision language models at inference time.arXiv preprint arXiv:2410.06625(2024)

    Pith/arXiv arXiv 2024

  23. [23]

    Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. Figstep: Jailbreaking large vision- language models via typographic visual prompts. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 23951–23959

    2025

  24. [24]

    Yunhao Gou, Kai Chen, Zhili Liu, Lanqing Hong, Hang Xu, Zhenguo Li, Dit-Yan Yeung, James T Kwok, and Yu Zhang. 2024. Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation. InEuropean Conference on Computer Vision. Springer, 388–404

    2024

  25. [25]

    Chaoyou Fu, Peixian Chen, Yunhang Shen, Yulei Qin, Mengdan Zhang, Xu Lin, Jinrui Yang, Xiawu Zheng, Ke Li, Xing Sun, Yunsheng Wu, and Rongrong Ji. 2024. MME: A Comprehensive Evaluation Benchmark for Multimodal Large Language Models. arXiv:2306.13394 [cs.CV] https://arxiv.org/abs/2306.13394

    Pith/arXiv arXiv 2024

  26. [26]

    Shaofeng Guo, Jiequan Cui, and Richang Hong. 2026. Rethinking VLMs for Image Forgery Detection and Localization. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 5828–5837

    2026

  27. [27]

    Yiwen Guo, Chao Zhang, Changshui Zhang, and Yurong Chen. 2018. Sparse dnns with improved adversarial robustness.Advances in neural information processing systems31 (2018)

    2018

  28. [28]

    Tianrui Guan, Fuxiao Liu, Xiyang Wu, Ruiqi Xian, Zongxia Li, Xiaoyu Liu, Xijun Wang, Lichang Chen, Furong Huang, Yaser Yacoob, et al. 2024. Hallusionbench: an advanced diagnostic suite for entangled language hallucination and visual illusion in large vision-language models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognitio...

    2024

  29. [29]

    Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick

  30. [30]

    Qidong Huang, Xiaoyi Dong, Pan Zhang, Bin Wang, Conghui He, Jiaqi Wang, Dahua Lin, Weiming Zhang, and Nenghai Yu. 2024. Opera: Alleviating hal- lucination in multi-modal large language models via over-trust penalty and retrospection-allocation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 13418–13427

    2024

  31. [31]

    Shuyang Hao, Bryan Hooi, Jun Liu, Kai-Wei Chang, Zi Huang, and Yujun Cai. 2024. Exploring visual vulnerabilities via multi-loss adversarial search for jailbreaking vision-language models.arXiv preprint arXiv:2411.18000(2024)

    Pith/arXiv arXiv 2024

  32. [32]

    Joonhyun Jeong, Seyun Bae, Yeonsung Jung, Jaeryong Hwang, and Eunho Yang

  33. [33]

    Jiaming Ji, Donghai Hong, Borong Zhang, Boyuan Chen, Juntao Dai, Boren Zheng, Tianyi Qiu, Jiayi Zhou, Kaile Wang, Boxuan Li, et al. 2024. Pku-saferlhf: Towards multi-level safety alignment for llms with human preference.arXiv preprint arXiv:2406.15513(2024)

    Pith/arXiv arXiv 2024

  34. [34]

    Mintong Kang, Chejian Xu, and Bo Li. 2024. Advwave: Stealthy adversarial jail- break attack against large audio-language models.arXiv preprint arXiv:2412.08608 (2024)

    Pith/arXiv arXiv 2024

  35. [35]

    Andrew Jaegle, Felix Gimeno, Andy Brock, Oriol Vinyals, Andrew Zisserman, and Joao Carreira. 2021. Perceiver: General perception with iterative attention. InInternational conference on machine learning. PMLR, 4651–4664

    2021

  36. [36]

    Sicong Leng, Hang Zhang, Guanzheng Chen, Xin Li, Shijian Lu, Chunyan Miao, and Lidong Bing. 2024. Mitigating object hallucinations in large vision-language models through visual contrastive decoding. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 13872–13882

    2024

  37. [37]

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in neural information processing systems33 (2020), 9459–9474

    2020

  38. [38]

    Bo Li, Yuanhan Zhang, Dong Guo, Renrui Zhang, Feng Li, Hao Zhang, Kaichen Zhang, Peiyuan Zhang, Yanwei Li, Ziwei Liu, and Chunyuan Li. 2024. LLaVA- OneVision: Easy Visual Task Transfer.Transactions on Machine Learning Research (2024)

    2024

  39. [39]

    Kevin Y Li, Sachin Goyal, Joao D Semedo, and J Zico Kolter. 2024. Inference Optimal VLMs Need Fewer Visual Tokens and More Parameters.arXiv preprint arXiv:2411.03312(2024)

    Pith/arXiv arXiv 2024

  40. [40]

    Seongyun Lee, Geewook Kim, Jiyeon Kim, Hyunji Lee, Hoyeon Chang, Sue Hyun Park, and Minjoon Seo. 2024. How does vision-language adaptation impact the safety of vision language models?arXiv preprint arXiv:2410.07571(2024)

    Pith/arXiv arXiv 2024

  41. [41]

    Wentong Li, Yuqian Yuan, Jian Liu, Dongqi Tang, Song Wang, Jie Qin, Jianke Zhu, and Lei Zhang. 2025. Tokenpacker: Efficient visual projector for multimodal llm.International Journal of Computer Vision(2025), 1–19

    2025

  42. [42]

    Yifan Li, Yifan Du, Kun Zhou, Jinpeng Wang, Wayne Xin Zhao, and Ji-Rong Wen

  43. [43]

    Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. 2024. Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jail- breaking multimodal large language models. InEuropean Conference on Computer Vision. Springer, 174–189

    2024

  44. [44]

    Yanwei Li, Chengyao Wang, and Jiaya Jia. 2024. Llama-vid: An image is worth 2 tokens in large language models. InEuropean Conference on Computer Vision. Springer, 323–340

    2024

  45. [45]

    Shen Li, Liuyi Yao, Lan Zhang, and Yaliang Li. 2024. Safety layers in aligned large language models: The key to llm security.arXiv preprint arXiv:2408.17003(2024)

    Pith/arXiv arXiv 2024

  46. [46]

    Runqi Lin, Alasdair Paren, Suqin Yuan, Muyang Li, Philip Torr, Adel Bibi, and Tongliang Liu. 2026. Force: Transferable visual jailbreaking attacks via feature over-reliance correction. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 8610–8620

    2026

  47. [47]

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft coco: Common MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil Shishen Gu, Jiequan Cui, Wenbo Hu, Zenglin Shi, Zhenzhen Hu, and Richang Hong objects in context. InEuropean conference on computer vision. Springer, 740–755

    2014

  48. [48]

    Evaluating object hallucination in large vision-language models.arXiv preprint arXiv:2305.10355(2023)

    Pith/arXiv arXiv 2023

  49. [49]

    Fuxiao Liu, Kevin Lin, Linjie Li, Jianfeng Wang, Yaser Yacoob, and Lijuan Wang

  50. [50]

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. Visual in- struction tuning.Advances in neural information processing systems36 (2023), 34892–34916

    2023

  51. [51]

    Ji Lin, Chuang Gan, and Song Han. 2019. Defensive quantization: When efficiency meets robustness.arXiv preprint arXiv:1904.08444(2019)

    Pith/arXiv arXiv 2019

  52. [52]

    Yijun Liu, Jiequan Cui, Zhuotao Tian, Senqiao Yang, Qingdong He, Xiaoling Wang, and Jingyong Su. 2024. Typicalness-aware learning for failure detection. Advances in Neural Information Processing Systems37 (2024), 11456–11478

    2024

  53. [53]

    Yuliang Liu, Zhang Li, Mingxin Huang, Biao Yang, Wenwen Yu, Chunyuan Li, Xu-Cheng Yin, Cheng-Lin Liu, Lianwen Jin, and Xiang Bai. 2024. Ocrbench: on the hidden mystery of ocr in large multimodal models.Science China Information Sciences67, 12 (2024), 220102

    2024

  54. [54]

    Zhihang Lin, Mingbao Lin, Luxi Lin, and Rongrong Ji. 2025. Boosting multimodal large language models with visual tokens withdrawal for rapid inference. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 5334–5342

    2025

  55. [55]

    Zhenxing Niu, Haodong Ren, Xinbo Gao, Gang Hua, and Rong Jin. 2024. Jail- breaking attack against multimodal large language model.arXiv preprint arXiv:2402.02309(2024)

    Pith/arXiv arXiv 2024

  56. [56]

    Mitigating hallucination in large multi-modal models via robust instruction tuning.arXiv preprint arXiv:2306.14565(2023)

    Pith/arXiv arXiv 2023

  57. [57]

    Eunkyu Park, Minyeong Kim, and Gunhee Kim. 2025. HalLoc: Token-level Localization of Hallucinations for Vision Language Models. InProceedings of the Computer Vision and Pattern Recognition Conference. 29893–29903

    2025

  58. [58]

    Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024. Mm- safetybench: A benchmark for safety evaluation of multimodal large language models. InEuropean Conference on Computer Vision. Springer, 386–403

    2024

  59. [59]

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 21527–21536

    2024

  60. [60]

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model.Advances in neural information processing systems36 (2023), 53728–53741

    2023

  61. [61]

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249(2024)

    Pith/arXiv arXiv 2024

  62. [62]

    Rylan Schaeffer, Dan Valentine, Luke Bailey, James Chua, Cristobal Eyzaguirre, Zane Durante, Joe Benton, Brando Miranda, Henry Sleight, John Hughes, et al

  63. [63]

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. Training language models to follow instructions with human feedback.Advances in neural information processing systems35 (2022), 27730–27744

    2022

  64. [64]

    Yuzhang Shang, Mu Cai, Bingxin Xu, Yong Jae Lee, and Yan Yan. 2024. Llava- prumerge: Adaptive token reduction for efficient large multimodal models.arXiv preprint arXiv:2403.15388(2024)

    arXiv 2024

  65. [65]

    Renjie Pi, Tianyang Han, Jianshu Zhang, Yueqi Xie, Rui Pan, Qing Lian, Hanze Dong, Jipeng Zhang, and Tong Zhang. 2024. Mllm-protector: Ensuring mllm’s safety without hurting performance. InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 16012–16027

    2024

  66. [66]

    Zhiqing Sun, Sheng Shen, Shengcao Cao, Haotian Liu, Chunyuan Li, Yikang Shen, Chuang Gan, Liang-Yan Gui, Yu-Xiong Wang, Yiming Yang, et al. 2023. Aligning large multimodal models with factually augmented rlhf.arXiv preprint arXiv:2309.14525(2023)

    Pith/arXiv arXiv 2023

  67. [67]

    Zhongxiang Sun, Xiaoxue Zang, Kai Zheng, Yang Song, Jun Xu, Xiao Zhang, Wei- jie Yu, and Han Li. 2024. Redeep: Detecting hallucination in retrieval-augmented generation via mechanistic interpretability.arXiv preprint arXiv:2410.11414 (2024)

    arXiv 2024

  68. [68]

    Anna Rohrbach, Lisa Anne Hendricks, Kaylee Burns, Trevor Darrell, and Kate Saenko. 2018. Object hallucination in image captioning.arXiv preprint arXiv:1809.02156(2018)

    Pith/arXiv arXiv 2018

  69. [69]

    Han Wang, Gang Wang, and Huan Zhang. 2025. Steering away from harm: An adaptive approach to defending vision language model against jailbreaks. In Proceedings of the Computer Vision and Pattern Recognition Conference. 29947– 29957

    2025

  70. [70]

    Failures to find transferable image jailbreaks between vision-language models.arXiv preprint arXiv:2407.15211(2024)

    Pith/arXiv arXiv 2024

  71. [71]

    Vikash Sehwag, Shiqi Wang, Prateek Mittal, and Suman Jana. 2020. Hydra: Pruning adversarially robust neural networks.Advances in Neural Information Processing Systems33 (2020), 19655–19666

    2020

  72. [72]

    Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan

  73. [73]

    Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. 2023. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. InThe Twelfth International Conference on Learning Representations

    2023

  74. [74]

    Long Xing, Qidong Huang, Xiaoyi Dong, Jiajie Lu, Pan Zhang, Yuhang Zang, Yuhang Cao, Conghui He, Jiaqi Wang, Feng Wu, et al . 2024. Pyramiddrop: Accelerating your large vision-language models via pyramid visual redundancy reduction.arXiv preprint arXiv:2410.17247(2024)

    Pith/arXiv arXiv 2024

  75. [75]

    Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. 2024. Safedecoding: Defending against jailbreak attacks via safety-aware decoding. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 5587–5605

    2024

  76. [76]

    Gokul Swamy, Christoph Dann, Rahul Kidambi, Zhiwei Steven Wu, and Alekh Agarwal. 2024. A minimaximalist approach to reinforcement learning from human feedback.arXiv preprint arXiv:2401.04056(2024)

    Pith/arXiv arXiv 2024

  77. [77]

    Zuopeng Yang, Jiluan Fan, Anli Yan, Erdun Gao, Xin Lin, Tao Li, Kanghua Mo, and Changyu Dong. 2025. Distraction is all you need for multimodal large language model jailbreaking. InProceedings of the Computer Vision and Pattern Recognition Conference. 9467–9476

    2025

  78. [78]

    Yu Wang, Xiaogeng Liu, Yu Li, Muhao Chen, and Chaowei Xiao. 2024. Adashield: Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting. InEuropean Conference on Computer Vision. Springer, 77–94

    2024

  79. [79]

    Yu Wang, Xiaofei Zhou, Yichen Wang, Geyuan Zhang, and Tianxing He. 2024. Jailbreak Large Visual Language Models Through Multi-Modal Linkage.arXiv preprint arXiv:2412.00473(2024)

    Pith/arXiv arXiv 2024

  80. [80]

    Xinwei Zhang, Hangcheng Liu, Li Bai, Hao Wang, Qingqing Ye, Tianwei Zhang, and Haibo Hu. 2026. On the Adversarial Robustness of Large Vision-Language Models under Visual Token Compression.arXiv preprint arXiv:2601.21531(2026)

    Pith/arXiv arXiv 2026

Showing first 80 references.