Pith. sign in

REVIEW 4 major objections 5 minor 27 cited by

Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversations

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single open-weights model, Llama Guard 3 Vision, screens both multimodal prompts and AI responses for 13 harm categories, beating GPT-4o on response classification F1 (0.938 vs 0.667) with a much lower false-positive rate.

desk verdict A useful open-weight multimodal safeguard, but the headline F1 advantage over GPT-4o is likely inflated by treating API refusals as unsafe, and the internal test set leaves the numbers unverifiable. read the letter →

arxiv 2411.10414 v1 pith:3W3C3MKA submitted 2024-11-15 cs.CV cs.CL

Jianfeng Chi , Ujjwal Karn , Hongyuan Zhan , Eric Smith , Javier Rando , Yiming Zhang , Kate Plawiak , Zacharie Delpierre Coudert
show 2 more authors
Kartikeya Upasani Mahesh Pasupuleti
This is my paper · ORCID
classification cs.CVcs.CL
keywords multimodalsafetycontentmoderationLlamaGuard3VisionMLCommonshazardtaxonomyadversarialrobustnesspromptclassificationresponsevision-languagemodel
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Llama Guard 3 Vision is a moderation model fine-tuned on Llama 3.2-Vision that classifies whether a multimodal conversation—user prompts containing images and text, and the AI's text responses to them—is safe or unsafe. The paper's central claim is that a single open-weights model can enforce a 13-category safety taxonomy (the MLCommons hazards) on both sides of an image-understanding conversation, and that it does so more accurately than the GPT-4o and GPT-4o mini baselines it is compared against. On the paper's internal test set, response classification reaches an F1 of 0.938 versus 0.667 for GPT-4o, with a much lower false-positive rate (0.016 versus 0.243). The authors also report that the model is markedly harder to fool with image-based adversarial attacks when it is used to vet the AI's response, rather than the user's prompt. If these numbers hold in practice, the model gives multimodal assistants an open system-level guardrail that previously existed only for text.

What carries the argument

The central object is the fine-tuned vision-language model itself, built on the Llama 3.2 11B vision backbone and trained with the Llama Guard input-output safeguarding task formulation. That formulation supplies four ingredients per example: a set of numbered unsafe-category guidelines (the MLCommons 13 hazards), a flag for whether to classify user messages or agent messages, the conversation including the user image, and a required output format of 'safe' or 'unsafe' plus the violated category indices. Training uses a hybrid dataset of 22,500 prompt-image pairs for prompt classification and 40,034 prompt-response-image triples for response classification, labeled by humans or Llama 3.1 405B, with text-only Llama Guard 3 data reused alongside dummy images. Two data augmentations prevent format memorization: randomly dropping non-violated categories from the guidelines and shuffling category indices across examples. The same task machinery, extended from text to images, is what carries the claim that one model can police both inputs and outputs of a multimodal assistant.

What would settle it

Construct a public, independently human-labeled test set of real user image-and-text conversations (for example, sampled from a deployed assistant's traffic) and run the released Llama Guard 3 Vision on it; if response-classification F1 falls below GPT-4o's or the false-positive rate rises well above the reported 0.016, the paper's central comparative claim is overstated.

Watch

Extended reading notes

Core claim

The paper introduces Llama Guard 3 Vision, a supervised fine-tune of the Llama 3.2 11B vision model, as a safeguard for human-AI image-understanding conversations. It predicts 'safe' or 'unsafe' labels, with the violating MLCommons hazard categories listed when unsafe, for two tasks: prompt classification (user's text-plus-image) and response classification (the agent's text reply in context). On the paper's internal benchmark, Llama Guard 3 Vision achieves 0.733 F1 in prompt classification and 0.938 F1 in response classification, outperforming GPT-4o (0.661 and 0.667) and GPT-4o mini (0.643 and 0.641) while keeping false-positive rates of 0.052 and 0.016 compared with GPT-4o's 0.485 and 0.243. Under white-box adversarial attacks, PGD on image pixels and GCG on text, the model remains substantially more resistant in response classification: even an unbounded PGD attack raises misclassification of unsafe responses from 6% to 27%, whereas prompt classification jumps from 21% to 82%. The authors attribute this to the model's reliance on the agent response for its safety judgment, which effectively ignores prompt-based perturbations.

Load-bearing premise

The internal training and test sets—labeled by people or by the Llama 3.1 405B model—are representative and correctly labeled; if those synthetic labels are systematically biased, or the test distribution fails to reflect real harmful multimodal conversations, the reported F1 and false-positive numbers overstate the model's practical safety performance.

Editorial extensions

If this is right

  • A single open-weights model can police both the input and the output of an image-understanding assistant, closing the coverage gap left by text-only guardrails.
  • Deploying the model in response-classification mode is the configuration the paper's results favor: it reaches 0.938 F1, keeps false positives at 0.016, and resists image-based attacks far better than prompt classification.
  • The MLCommons 13-hazard taxonomy becomes a checkable, shared yardstick for multimodal safety classifiers, with the reported per-category F1 scores serving as a published baseline.
  • The adversarial results show that prompt-only filtering of multimodal inputs is fragile—PGD on images and GCG on text both push misclassification of harmful prompts above 70%—so safety-critical deployments should run prompt and response classification together.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the reported numbers transfer to other distributions, the paper's robustness asymmetry suggests a design rule: put multimodal guardrails on the generation side, since output text is harder to perturb than input pixels or prompt text.
  • Because a substantial share of training labels come from Llama 3.1 405B, the model's judgment of what is unsafe may inherit that generator's blind spots; a human-only labeled evaluation set could quantify this effect.
  • The privacy category flags any attempt to identify a real person from an image as unsafe, which may make the model over-strict in benign assistant scenarios such as photo organization; application-specific tuning is a natural next step.
  • The single-image, English-only, 4-chunk rescaling constraints imply measurable degradation on multi-image conversations, non-English text, or high-resolution images—checking this is a direct follow-up measurement.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces Llama Guard 3 Vision, a multimodal safety classifier fine-tuned from Llama 3.2 11B Vision, designed to classify both user prompts and agent responses in conversations that contain images, using the MLCommons 13-hazard taxonomy. The authors report internal benchmark results in which the model outperforms GPT-4o and GPT-4o mini, especially on response classification (F1 0.938 vs 0.667/0.641), and they present white-box adversarial robustness experiments with PGD (image perturbations) and GCG (text suffixes), finding prompt classification substantially more attackable than response classification. The paper is written as a systems/white-paper contribution and includes candid limitations and deployment recommendations.

Significance. If the reported numbers are reliable, the paper provides a useful open-weights baseline for multimodal content moderation, a practical instantiation of the MLCommons taxonomy, and a clear robustness characterization. Strengths include the release of training recipes and a model card, the use of a standard 13-category taxonomy, explicit discussion of limitations, and the adversarial evaluation under two attack types. However, the central comparison to GPT-4o rests on an evaluation protocol that is not apples-to-apples, and the internal test set is neither released nor described in sufficient detail, so the magnitude of the claimed advantage is currently uncertain. These issues are load-bearing for the headline claim, though they appear addressable with additional analysis and disclosure.

major comments (4)
  1. [Section 4.1, Table 1] The baseline comparison is asymmetric. The paper states that GPT-4o and GPT-4o mini APIs 'sometimes reject our safety classification request for the safety reasons' and that for such rejected requests the authors 'consider that GPT-4o (mini) classifies it as unsafe.' This convention assigns an unsafe label with no category to outputs that contain no moderation verdict, thereby penalizing the baseline's precision and F1 on exactly the safety-relevant cases the benchmark is intended to measure. The reported FPR for GPT-4o response classification (0.243) suggests this occurs at a nontrivial rate. Because the headline claim is that Llama Guard 3 Vision outperforms GPT-4o, the paper should quantify the rejection rate and provide a re-analysis that either excludes rejected requests, treats them as a separate outcome, or otherwise demonstrates that the F1 gap in Table 1 is not an artifact of this scoring convention.
  2. [Section 4.1, Tables 1 and 2] The internal test set is unreleased and its construction is under-described. No information is given about the number of test examples per category, the train/test separation relative to the data described in Section 3.2, or the human/LLM label agreement. Table 2 reports category-level F1 scores with no confidence intervals or significance tests relative to the GPT-4o baselines. Without this information, the central quantitative claims cannot be independently reproduced or assessed for statistical reliability. The paper should report the test-set size and composition, the label-source breakdown, and error bars or a significance test for the main F1 differences.
  3. [Section 3.2] The data collection section states that samples are labeled 'either by humans or the Llama 3.1 405B model,' and the test set appears to be drawn from the same internal pipeline. If a large fraction of the benchmark labels is LLM-generated, the evaluation may be biased toward the Llama family's safety judgments, which would favor Llama Guard 3 Vision. The paper should specify the fraction of synthetic labels in both the training and test sets, report the agreement rate between human and Llama 3.1 405B labels, and describe how the test set was held out from the data collection process to avoid train/test contamination.
  4. [Section 4.2, Tables 3 and 4] The adversarial robustness results are based on 100 conversations for the PGD evaluation and another 100 for the GCG evaluation, with no confidence intervals or description of how these subsets were sampled from the test set. Given the large observed gaps (e.g., prompt classification misclassification rising from 21% to 70% under an 8/255 PGD attack), the qualitative conclusions may be robust, but the paper should report the variance (e.g., bootstrap intervals) and explain how the 100 examples were selected, since these numbers are used to support the claim that response classification is more robust than prompt classification.
minor comments (5)
  1. [Abstract and Section 1] The word 'mutimodal' appears instead of 'multimodal' in the abstract and in the introduction; please fix the typo.
  2. [Section 3.3] The model is described as 'the Llama 3.2 11B vision model'; consider stating the exact parameter count and clarifying whether '11B' refers to total parameters or active parameters.
  3. [Section 4.1] The GPT-4o baseline is referenced as (Achiam et al., 2023), which is the GPT-4 technical report; please cite the specific GPT-4o system card or documentation used for the API evaluation.
  4. [Section 4.1, Table 1] No sample sizes are reported for the internal test set; adding the number of prompt-classification and response-classification examples per category would help interpret the F1 and FPR numbers.
  5. [Section 6] The phrase 'Somehazardcategoriesmayrequirefactual, up-to-dateknowledgetobeevaluated' has missing spaces; please correct the formatting.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central F1 claim is an empirical measurement on an internal benchmark, not a quantity derived from its own inputs.

full rationale

The paper's central claim is that Llama Guard 3 Vision achieves strong F1 scores on an internal benchmark and outperforms GPT-4o baselines. This is a measured empirical result from supervised fine-tuning and evaluation, not a derivation in which an output is equivalent to an input by construction. The training data includes labels from humans and Llama 3.1 405B (Section 3.2), but the paper does not state that test labels are generated by the same model, so no fitted-input-called-prediction can be exhibited from the text. Self-citations to Llama Guard and Llama Team works are used as data sources, architecture predecessors, and teacher-label providers; they are not load-bearing premises that force the reported outcome. The treatment of GPT-4o API-rejected requests as 'unsafe' (Section 4.1) is a potential evaluation-validity concern and could bias the comparison, but it is not a circular reduction of the paper's own claims. The unreleased internal test set limits independent verification, but lack of public reproducibility is not circularity. Overall, no circular step is identifiable from the quoted evidence.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

No fitted numerical parameters are used in a derivation; the paper is an empirical model report. Training hyperparameters (learning rate 1e-5, 3600 steps) are standard and reported but not fitted to the evaluation. No new theoretical entities are introduced.

assumptions (3)
  • domain assumption The MLCommons 13-hazard taxonomy is an adequate and sufficient safety taxonomy for multimodal conversations.
    Section 2 defines all safety categories and the model is trained and evaluated solely on these categories. If the taxonomy omits or conflates harms, the safety claim is limited.
  • domain assumption The human and Llama 3.1 405B-generated labels used for training and evaluation are accurate.
    Section 3.2 states labels come from humans or the Llama 3.1 405B model; the central F1 numbers depend on these labels being correct. No inter-annotator agreement or label-quality audit is reported.
  • ad hoc to paper Rejected GPT-4o classification requests are equivalent to an 'unsafe' verdict.
    Section 4.1 says API rejections are counted as unsafe; this plausible choice changes the baseline numbers and is not separately analyzed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversations." pith.science (2026). https://pith.science/paper/3W3C3MKA

@misc{pith2026241110414,
  author       = {Pith},
  title        = {Pith review of: Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3W3C3MKA}},
  note         = {Machine review of arXiv:2411.10414}
}
read the original abstract

We introduce Llama Guard 3 Vision, a multimodal LLM-based safeguard for human-AI conversations that involves image understanding: it can be used to safeguard content for both multimodal LLM inputs (prompt classification) and outputs (response classification). Unlike the previous text-only Llama Guard versions (Inan et al., 2023; Llama Team, 2024b,a), it is specifically designed to support image reasoning use cases and is optimized to detect harmful multimodal (text and image) prompts and text responses to these prompts. Llama Guard 3 Vision is fine-tuned on Llama 3.2-Vision and demonstrates strong performance on the internal benchmarks using the MLCommons taxonomy. We also test its robustness against adversarial attacks. We believe that Llama Guard 3 Vision serves as a good starting point to build more capable and robust content moderation tools for human-AI conversation with multimodal capabilities.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 27 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Whose Refusal Is It? The Unmeasured Contribution of Black-Box Multimodal Guardrails

    cs.CR 2026-08 conditional novelty 7.0 of 10

    The reported benefit of a multimodal guardrail is a sum of guard blocks and the target model's own refusals, and evaluation protocol alone can move the guardrail's measured share from 0% to 99%.

  2. Human-Guided Harm Recovery for Computer Use Agents

    cs.AI 2026-04 conditional novelty 7.0 of 10

    Introduces harm recovery as a post-execution safeguard for computer-use agents, operationalized via a human-preference rubric, reward model, and BackBench benchmark that shows improved recovery trajectories.

  3. BadVideo: Stealthy Backdoor Attack against Text-to-Video Generation

    cs.CV 2025-04 conditional novelty 7.0 of 10

    BadVideo shows that text-to-video models can be backdoored by poisoning fine-tuning data with temporally distributed malicious content that evades frame-based moderation.

  4. MSTS: A Multimodal Safety Test Suite for Vision-Language Models

    cs.CL 2025-01 conditional novelty 7.0 of 10

    MSTS is a 400-prompt multimodal safety benchmark showing that open vision-language models give unsafe responses to up to 14% of prompts, and that image-plus-text inputs trigger more unsafe answers than text alone.

  5. MMAligner: Safeguarding Multimodal Large Language Models through Representation Calibration

    cs.CR 2026-08 conditional novelty 6.0 of 10

    Safety failures in multimodal LLMs happen because unsafe image-plus-text inputs shift internal representations past a still-working refusal boundary, and a representation-calibration fine-tune restores refusal with un...

  6. Harm is not Universal: Community-Specific Toxicity Detection is Urgently Needed

    cs.CV 2026-07 conditional novelty 6.0 of 10

    SoTA T2I toxicity detectors miss ~35% of disability-community harms; zero-shot CTD fails below random, while ICL/VQA/LoRA improve but stay well below general TD performance.

  7. When Are Reasoning-Based Guardrails Not Efficient? ResponseGuard: A Fast Vision-Language Guard for Real-Time Moderation

    cs.CV 2026-07 conditional novelty 6.0 of 10

    A label-only 2B guard outperforms a 3B reasoning-based vision-language guard on response-harmfulness detection at about 150x lower latency, with the remaining image gap attributed to frozen encoders.

  8. SeerGuard: A Safety Framework for Mobile GUI Agents via World Model Prediction

    cs.AI 2026-07 conditional novelty 6.0 of 10

    SeerGuard adds pre-execution instruction screening and action-level semantic next-state prediction to mobile GUI agents, improving safety-utility and risk-cost scores on MobileSafetyBench.

  9. Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models

    cs.CV 2026-02 conditional novelty 6.0 of 10

    A multi-turn attack that alternates text and image prompts and adapts its trajectory outperforms existing jailbreak methods on four vision-language models, reaching up to 100% attack success rate.

  10. Efficiency vs. Alignment: Investigating Safety and Fairness Risks in Parameter-Efficient Fine-Tuning of LLMs

    cs.AI 2025-11 conditional novelty 6.0 of 10

    Benign PEFT fine-tuning changes LLM safety and fairness: adapter-based methods (LoRA, IA3) preserve alignment better than prompt-based methods, and the base model strongly moderates outcomes.

  11. MetaBreak: Jailbreaking Online LLM Services via Special Token Manipulation

    cs.CR 2025-10 conditional novelty 6.0 of 10

    Special tokens that structure LLM conversations can be injected and swapped for lookalike words to bypass both built-in safety and external content filters.

  12. Secure Tug-of-War (SecTOW): Iterative Defense-Attack Training with Reinforcement Learning for Multimodal Model Security

    cs.CR 2025-07 conditional novelty 6.0 of 10

    An iterative attacker-defender reinforcement learning method that makes a multimodal LLM refuse more jailbreak prompts without over-refusing ordinary queries.

  13. WebGuard: Building a Generalizable Guardrail for Web Agents

    cs.AI 2025-07 conditional novelty 6.0 of 10

    WebGuard introduces an action-level risk dataset for web agents and shows that a fine-tuned 7B model improves risk-prediction accuracy from about 38% to 80% and high-risk recall from 20% to 76%, still below deployment...

  14. VLMs Can Aggregate Scattered Training Patches

    cs.CV 2025-06 conditional novelty 6.0 of 10

    Open-source VLMs can infer image IDs or safety labels after training only on scattered patches of those images, a capability that can be abused to bypass image moderation.

  15. Implicit Jailbreak Attacks via Cross-Modal Information Concealment on Vision-Language Models

    cs.LG 2025-05 reject novelty 6.0 of 10

    IJA hides a malicious instruction in image steganography and uses a benign extraction prompt plus iterative template refinement to make multimodal LLMs execute it.

  16. ShieldVLM: Safeguarding the Multimodal Implicit Toxicity via Deliberative Reasoning with LVLMs

    cs.MM 2025-05 conditional novelty 6.0 of 10

    ShieldVLM detects multimodal implicit toxicity through deliberate cross-modal reasoning, outperforming existing moderation APIs and models on the new MMIT benchmark.

  17. CAPTURE: Context-Aware Prompt Injection Testing and Robustness Enhancement

    cs.CL 2025-05 conditional novelty 6.0 of 10

    CAPTURE, a context-aware benchmark, finds current prompt guardrails either miss context-aware attacks or over-block safe prompts, and a model trained on its data reduces both error types on the new test sets.

  18. Position: Adversarial ML for LLMs Is Not Making Any Progress

    cs.LG 2025-02 conditional novelty 6.0 of 10

    The authors argue that LLM-era adversarial machine learning is less well-defined, harder to solve, and harder to evaluate, so meaningful progress may not be achievable or trackable in the current paradigm.

  19. Speaking images. A novel framework for the automated self-description of artworks

    cs.CV 2025-05 conditional novelty 5.0 of 10

    A four-stage open-source AI pipeline turns a digitized artwork into a short video where a depicted person animates and narrates the scene.

  20. Security Concerns for Large Language Models: A Survey

    cs.CR 2025-05 conditional novelty 5.0 of 10

    A survey that classifies LLM security threats and argues that intrinsic agentic risks, such as scheming, are underappreciated and poorly defended.

  21. GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning

    cs.AI 2025-05 conditional novelty 5.0 of 10

    GuardReasoner-VL, a 3B/7B VLM guard model trained with reasoning SFT and online RL, reports large F1 gains over existing VLM guard models on 14 safety benchmarks.

  22. Multi-Modal One-Shot Federated Ensemble Learning for Medical Data with Vision Large Language Model

    cs.LG 2025-01 conditional novelty 5.0 of 10

    FedMME fuses vision-LLM-generated text features with image features and uses client voting to improve one-shot federated medical image classification.

  23. The Boy Who Cried Wolf: Adversarial Misclassification of Safe Inputs as Unsafe in Multimodal Guardrails

    cs.CR 2026-08 conditional novelty 4.0 of 10

    Adversarial images aligned with the latent distribution of unsafe content can force multimodal guard models to falsely reject safe user requests with up to 84% success.

  24. A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Models

    cs.CL 2025-09 conditional novelty 4.0 of 10

    A structured literature survey concluding that reasoning capabilities do not automatically make LLMs more trustworthy and can introduce new vulnerabilities in safety, robustness, and privacy.

  25. Safety in Large Reasoning Models: A Survey

    cs.CL 2025-04 conditional novelty 4.0 of 10

    A comprehensive survey categorizes the safety risks, attacks, and defenses of large reasoning models into a three-part taxonomy.

  26. Universal Adversarial Attack on Aligned Multimodal LLMs

    cs.AI 2025-02 conditional novelty 4.0 of 10

    A single optimized image, trained through the vision and language modules, makes aligned multimodal LLMs produce dangerous responses across diverse prompts and some models.

  27. Agentic Web: Weaving the Next Web with AI Agents

    cs.AI 2025-07 conditional novelty 3.0 of 10

    A position paper defines the Agentic Web as the next web era and proposes a three-dimensional conceptual framework for understanding and building it.

Reference graph

Works this paper leans on

24 extracted references · 2 canonical work pages · cited by 27 Pith papers

  1. [1]

    Gpt-4 technical report.arXiv preprint arXiv:2303.08774,

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report.arXiv preprint arXiv:2303.08774,

    arXiv

  2. [2]

    Aleksander Madry

    https://github.com/meta-llama/PurpleLlama/blob/main/ Llama-Guard2/MODEL_CARD.md, 2024b. Aleksander Madry. Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083,

    arXiv

  3. [5]

    Gemini: a family of highly capable multimodal models.arXiv preprint arXiv:2312.11805,

    Google Gemini Team. Gemini: a family of highly capable multimodal models.arXiv preprint arXiv:2312.11805,

    arXiv

  4. [7]

    Llama guard: Llm-based input-output safeguard for human-ai conversations

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674,

    arXiv

  5. [8]

    Baseline defenses for adversarial attacks against aligned language models

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614,

    arXiv

  6. [9]

    Scaling laws for neural language models.arXiv preprint arXiv:2001.08361,

    Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. Scaling laws for neural language models.arXiv preprint arXiv:2001.08361,

    arXiv 2001

  7. [10]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. InComputer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740–755. Springer,

    2014

  8. [11]

    The llama 3 herd of models, 2024a.https://arxiv.org/abs/2407.21783

    AI @ Meta Llama Team. The llama 3 herd of models, 2024a.https://arxiv.org/abs/2407.21783. AI @ Meta Llama Team. Meta llama guard

    arXiv

Show all 24 references
  1. [14]

    Safety alignment should be made more than just a few tokens deep.arXiv preprint arXiv:2406.05946,

    Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. Safety alignment should be made more than just a few tokens deep.arXiv preprint arXiv:2406.05946,

    arXiv

  2. [15]

    Gradient-based jailbreak images for multimodal fusion models.arXiv preprint arXiv:2410.03489,

    Javier Rando, Hannah Korevaar, Erik Brinkman, Ivan Evtimov, and Florian Tramèr. Gradient-based jailbreak images for multimodal fusion models.arXiv preprint arXiv:2410.03489,

    arXiv

  3. [16]

    Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199,

    C Szegedy. Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199,

    arXiv

  4. [18]

    Finetuned language models are zero-shot learners.arXiv preprint arXiv:2109.01652,

    Jason Wei, Maarten Bosma, Vincent Y Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M Dai, and Quoc V Le. Finetuned language models are zero-shot learners.arXiv preprint arXiv:2109.01652,

    arXiv

  5. [19]

    Rigorllm: Resilient guardrails for large language models against undesired content.arXiv preprint arXiv:2403.13031,

    Zhuowen Yuan, Zidi Xiong, Yi Zeng, Ning Yu, Ruoxi Jia, Dawn Song, and Bo Li. Rigorllm: Resilient guardrails for large language models against undesired content.arXiv preprint arXiv:2403.13031,

    arXiv

  6. [20]

    Shieldgemma: Generative ai content moderation based on gemma

    Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, et al. Shieldgemma: Generative ai content moderation based on gemma. arXiv preprint arXiv:2407.21772,

    arXiv

  7. [21]

    Backtracking improves generation safety.arXiv preprint arXiv:2409.14586,

    Yiming Zhang, Jianfeng Chi, Hailey Nguyen, Kartikeya Upasani, Daniel M Bikel, Jason Weston, and Eric Michael Smith. Backtracking improves generation safety.arXiv preprint arXiv:2409.14586,

    arXiv

  8. [22]

    Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043,

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043,

    arXiv

  9. [23]

    Improving alignment and robustness with short circuiting.arXiv preprint arXiv:2406.04313,

    Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, Rowan Wang, Zico Kolter, Matt Fredrikson, and Dan Hendrycks. Improving alignment and robustness with short circuiting.arXiv preprint arXiv:2406.04313,

    arXiv

  10. [24]

    9 Appendix A Acknowledgement This work was made possible by a large group of contributors. We extend our gratitude to the following people: Tamar Glaser, Govind Thattai, Jana Vranes, Saghar Hosseini, Guillem Braso, Madian Khabsa, Archie Sravankumar, Ning Zhang, Ankit Ramchanda...

    2017

  11. [2015]

    Foundational challenges in assuring alignment and safety of large language models

    Usman Anwar, Abulhair Saparov, Javier Rando, Daniel Paleka, Miles Turpin, Peter Hase, Ekdeep Singh Lubana, Erik Jenner, Stephen Casper, Oliver Sourbut, et al. Foundational challenges in assuring alignment and safety of large language models. arXiv preprint arXiv:2404.09932,

    arXiv

  12. [2020]

    Large language models as tool makers.arXiv preprint arXiv:2305.17126,

    Tianle Cai, Xuezhi Wang, Tengyu Ma, Xinyun Chen, and Denny Zhou. Large language models as tool makers.arXiv preprint arXiv:2305.17126,

    arXiv

  13. [2021]

    Openai o1 system card, 2024.https://cdn.openai.com/o1-system-card-20240917.pdf

    OpenAI. Openai o1 system card, 2024.https://cdn.openai.com/o1-system-card-20240917.pdf . Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow ins...

    2024

  14. [2022]

    Introducing v0

    Bertie Vidgen, Adarsh Agrawal, Ahmed M Ahmed, Victor Akinwande, Namir Al-Nuaimi, Najla Alfaraj, Elie Alhajjar, Lora Aroyo, Trupti Bavalatti, Borhane Blili-Hamelin, et al. Introducing v0. 5 of the ai safety benchmark from mlcommons. arXiv preprint arXiv:2404.12241,

    arXiv

  15. [2023]

    Aegis: Online adaptive ai content safety moderation with ensemble of llm experts.arXiv preprint arXiv:2404.05993,

    Shaona Ghosh, Prasoon Varshney, Erick Galinkin, and Christopher Parisien. Aegis: Online adaptive ai content safety moderation with ensemble of llm experts.arXiv preprint arXiv:2404.05993,

    arXiv

  16. [2024]

    Language models are few-shot learners.arXiv preprint arXiv:2005.14165,

    Tom B Brown. Language models are few-shot learners.arXiv preprint arXiv:2005.14165,

    2005 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.