Pith. sign in

REVIEW 4 major objections 6 minor 3 cited by

Safety-aligned multimodal models can be continually tuned for new vision tasks without losing their safety guardrails, by selectively preserving safety-critical parameters and orthogonalizing updates.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 20:19 UTC pith:5SADATOL

load-bearing objection First serious treatment of post-alignment CVIT with a coherent method, but the safety numbers depend on an undisclosed 8-sample calibration set and an undefined Hessian inverse. the 4 major comments →

arxiv 2511.20158 v2 pith:5SADATOL submitted 2025-11-25 cs.CV

Harmonious Parameter Adaptation in Continual Visual Instruction Tuning for Safety-Aligned MLLMs

Ziqi Wang , Chang Che , Qi Wang , Hui Ma , Zenglin Shi , Cees G. M. Snoek , Meng Wang This is my paper
classification cs.CV
keywords continual visual instruction tuningmultimodal large language modelssafety alignmentcatastrophic forgettingparameter partitioningorthogonal parameter adjustmentpost-training adaptationvision-language safety
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper targets a gap in continual visual instruction tuning: almost all prior work tunes models that have not been safety-aligned, so it only worries about forgetting. After safety alignment, the paper argues, sequential fine-tuning erodes both task accuracy and the model's learned refusal behavior. It proposes a post-training procedure, HPA, that runs after each ordinary fine-tuning step, identifies which parameters carry safety vs task knowledge, retains the safety-critical ones in a balanced way, and makes remaining updates orthogonal to old representations. The claimed result is a consistently better safety-capability trade-off than existing baselines, especially when later tuning data contains small amounts of harmful content. If right, this makes post-alignment continual updates practical without re-running expensive safety alignment.

Core claim

HPA partitions each linear layer's weights into safety-focused and task-focused parameters using a Hessian-based sensitivity score, (w)^2/[H^-1]_ii, computed on tiny calibration sets: 8 harmful image-instruction pairs answered by the model itself for safety, and 128 samples from each new task. It then selects which positions to keep from the previous model using a balancing score that weighs safety focus against task focus, with retention shrinking in deeper layers, and finally projects the update orthogonal to the previous weights. On a six-task CVIT benchmark with two safety evaluations, HPA reports higher average task performance and less backward forgetting than the strongest baseline wh

What carries the argument

The central device is a post-hoc weight swap: after each task's fine-tuning, HPA computes a binary mask from Hessian-based per-parameter importance scores over a safety calibration set and a task calibration set, retaining the top safety-focused positions from the previous weights while allowing task-focused positions to update, then orthogonalizes the remaining update against the preserved parameter subspace.

Load-bearing premise

The entire parameter partition rests on a safety calibration set of only 8 harmful visual examples, paired with safe answers generated by the protected model itself, and the paper does not state where those examples come from or how they avoid overlapping the evaluation sets; if that tiny set is unrepresentative, the reported safety preservation is an artifact of the calibration rather than a property of the selected parameters.

What would settle it

Construct a disjoint safety calibration set by drawing harmful examples from categories not present in any evaluation set, then rerun HPA; if the safety-focused masks shift substantially or MASR/DASR rise above the reported levels, the safety guarantee depends on the specific 8-sample calibration rather than a stable property of the model.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Post-SA CVIT can be treated as a two-stage process: freely fine-tune, then apply HPA, avoiding any modification to the training pipeline or extra trainable modules.
  • A safety-aligned model can be continually updated across VQA, classification, captioning, and reasoning tasks with safety degradation held to a few percentage points of attack success rate.
  • Small amounts of harmful data in subsequent tuning tasks are not catastrophic under HPA; the paper reports mean attack success rate 7.22% vs 24.26% for the best prior safety-preserving baseline.
  • Layer-wise retention scheduling means the method adapts automatically to how much task-specific knowledge each layer encodes, rather than using one global retention rate.
  • The method needs only eight curated harmful examples at each adaptation step, making it usable when the original alignment data is private.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Extension the paper leaves implicit: because HPA operates on already-trained checkpoints and never touches the loss, it could be applied to any deployed aligned model whose original safety data is unavailable, not only during a predefined CVIT curriculum.
  • Neighboring problem: the same focus-partition-plus-orthogonality recipe should transfer to continual fine-tuning of text-only aligned LLMs, since nothing in the machinery depends on visual inputs; a direct test would be a two- or three-task text continual-learning setup with safety benchmarks.
  • Testable extension: if the safety-focused mask is stable across task orders and injection conditions, one could precompute it once from the initial aligned model instead of re-estimating it after every task; the paper's layer-wise analysis suggests but does not test this.
  • Caveat: because the safety calibration labels are the model's own safe responses, the estimated safety importance is tied to one refusal style; swapping in stricter external safety labels could change which parameters are marked safety-critical.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper studies continual visual instruction tuning (CVIT) applied to safety-aligned multimodal large language models (MLLMs), a setting the authors call post-SA CVIT. It observes that sequential fine-tuning degrades both previously learned task performance and the model's safety alignment. The paper proposes Harmonious Parameter Adaptation (HPA), a post-training framework with three components: (1) a focusing-based parameter partition that estimates safety-focus and task-focus importance scores from Hessian-based sensitivity on small calibration sets; (2) a harmoniously balanced selection mechanism that retains old safety-focused parameters via a layer-wise retention ratio and a balancing score; and (3) an orthogonal parameter adjustment that projects parameter updates away from previous weights. Experiments on a six-task CVIT benchmark and on VLGuard and Ch3EF safety benchmarks report that HPA outperforms existing continual learning, CVIT, and safety-preserving baselines in both task performance (AP, BWT) and safety (MASR, DASR), under both original data and a 0.1% harmful-data-injection condition. Code is promised but not reviewed.

Significance. If the results hold, HPA addresses an important and understudied problem: adapting safety-aligned MLLMs to new tasks without re-running expensive safety alignment. The method is post-training, does not modify the underlying fine-tuning pipeline, and its safety objective is grounded in external safety benchmarks rather than fit to them. The framework is conceptually reasonable, and the paper provides a clear modular design with ablations. However, the significance is tempered by several load-bearing reproducibility and validity issues: the Hessian inverse in Eq. (4) is undefined for the stated calibration-set sizes, the provenance and evaluation disjointness of the 8-sample safety calibration set are unspecified, and all experiments appear to be single runs with small margins in the key original-data safety comparison. These issues must be resolved before the central claim can be accepted.

major comments (4)
  1. [§3.3, Eq. (4)] The Hessian inverse is undefined for the stated dimensions. With H=2X^T X and X∈R^{d×r}, the matrix H∈R^{r×r} has rank at most d. The safety calibration set has d=8 (Sec. 4.2), while every linear layer in LLaVA-v1.5-7B has r far larger than 8 (e.g., 4096); hence H is singular and H^{-1} does not exist. The task calibration set has d=128, which still exceeds d for many layers. No damping (e.g., H+λI), pseudo-inverse, or diagonal approximation is specified. Since ε and ζ drive mask selection (Eqs. 6-13), the method cannot be reproduced or evaluated as written. Please state the exact regularized importance formula and the value of any damping hyperparameter.
  2. [§4.2, Calibration Sets Construction and Table 1] The provenance of the 8 safety calibration samples is missing, creating a direct validity threat. The model is safety-aligned on VLGuard and SPA-VL and later evaluated on VLG-1 and VLG-2, both subsets of VLGuard. The paper does not state where the 'harmful visual samples' in D*_s were collected, how they were selected, or whether they are disjoint from VLG-1/VLG-2/Ch3EF. If D*_s is drawn from the VLGuard pool, the safety-focus scores and the reported MASR/DASR can be inflated by evaluation-set overlap. This is the load-bearing premise for the central safety-preservation claim. Please report the source, the selection protocol, and an explicit disjointness check against all evaluation sets.
  3. [§4.3, Table 1 and Table 5] All experiments appear to be single runs with no error bars, and the key Original Data safety gains over Safe Delta are small: MASR 4.75 vs 5.02 and DASR 1.89 vs 2.15. The supplementary calibration-size ablation (Table 5) shows that increasing |D*_s| from 8 to 16 changes MASR by 1.35 points, which is larger than the reported advantage over Safe Delta. Without multiple seeds and standard deviations (or another significance measure), the central claim that HPA 'better maintains high safety' is not statistically supported. Please provide repeated-run statistics for the main comparisons and for the ablations.
  4. [§4.1, Table 1] The table caption labels all entries as 'Performance metrics (%)', but Flickr30k values exceed 100 (e.g., DirFT 152.60, HPA 144.80). If Flickr30k is scored by CIDEr or another unbounded metric, then AP and BWT average percentages with a non-percentage score, making the reported AP/BWT comparisons quantitatively ill-defined. Please specify the evaluation metric used for each dataset and either recompute AP/BWT on comparable normalized scores or clarify the table units.
minor comments (6)
  1. [§3.4, Eq. (7)] The dimension of φ^l is written as R^{⌊c·(k%−ps%)⌋}, but the selection is described as taking the top-(p−p_s)% indices from all c columns. These are inconsistent; please clarify the relationship between k, p, and p_s and the length of φ^l.
  2. [§3.3, Eq. (4)] Please clarify how X is constructed for each layer: which layer's input activations are used, how many forward passes are performed, and how the per-layer Hessian H is computed and stored. This is needed for reproducibility.
  3. [Algorithm 1 and §3] Please state explicitly whether the adapted weights \hat{W}_t^l are used as the initialization for the next task's fine-tuning or only for evaluation. This affects the interpretation of the continual-learning pipeline.
  4. [§4.2] The random sampling of D*_t is not seeded. For reproducibility, please report the random seed or the exact sampling protocol used to construct the 128-sample task calibration sets.
  5. [References] Several references have malformed page ranges or trailing numbers (e.g., [5], [19], [23], [40]). Please clean up the reference formatting.
  6. [Figures 3 and 4] The x-axes of Figures 3 and 4 are not clearly specified. Please define the ranges for p and α and state what the plotted curves represent.

Circularity Check

0 steps flagged

No significant circularity; HPA is validated on external safety benchmarks, with only minor self-referentiality in the safety calibration set.

full rationale

The claimed derivation chain is not circular in the load-bearing sense. The safety-focus score ε in Eq. (4) is computed from the safety calibration set D*_s, constructed in Sec. 4.2 by pairing harmful visual samples with safe answers generated by the aligned model f(x;θ0). This is self-referential in that 'safety' is operationalized via the model's own current safe behavior, but the paper's claim that HPA preserves safety is evaluated on external benchmarks (VLGuard, Ch3EF) that are not used to fit the mask or calibrate the importance scores. No equation or construction reduces the reported safety metrics to the calibration set; the evaluation is an independent empirical test. The related-work self-citations (SMoLoRA [29], LiLoRA [2]) are non-load-bearing; HPA's method does not depend on them. No uniqueness theorem or ansatz is imported via self-citation. The Hessian inverse in Eq. (4) with d=8 and r typically >8 is underdetermined without regularization, but this is a reproducibility/correctness concern, not circularity. Likewise, the undisclosed provenance of the 8 harmful samples in D*_s could raise data-contamination concerns if they overlap with evaluation subsets, but the paper provides no evidence of such overlap, so it cannot be claimed as a demonstrated circular step. Overall, the central derivation is self-contained against external benchmarks and the score reflects only the minor self-referential construction of the safety calibration set and non-load-bearing self-citations.

Axiom & Free-Parameter Ledger

7 free parameters · 6 axioms · 0 invented entities

The central claim rests on a chain of heuristic assumptions: Hessian-based importance with tiny calibration sets, self-generated safety targets, hand-set retention ratios, and layer-specific decay. No new physical or mathematical entities are introduced; the free parameters and domain assumptions are the main source of uncertainty.

free parameters (7)
  • p_max = 15
    Maximum retention ratio of safety-focused parameters, hand-set in Sec 4.2; Fig 3 shows performance varies with p.
  • p_min = 5
    Minimum retention ratio in the deepest layer, hand-set; sensitivity shown in Fig 3.
  • alpha_0 = 0.4
    Lower bound for the adaptive balancing coefficient alpha in Eq. 8; hand-set and explored in Fig 4.
  • alpha_1 = 0.8
    Upper bound for alpha; hand-set; Fig 4 shows fixed-alpha sensitivity.
  • k = 2*p_l
    Ratio of focused parameters chosen by hand to avoid boundary cases (Supp. E); directly controls the size of the candidate set.
  • safety_calibration_size = 8
    Number of harmful samples in D*_s; Supp. Table 5 shows safety and task scores change with this size, so results depend on this choice.
  • task_calibration_size = 128
    Number of task samples per calibration set; fixed and not ablated in the main text.
axioms (6)
  • domain assumption H = 2X^T X is an adequate Hessian approximation for parameter importance in a nonlinear MLLM.
    Used in Eq. 4; borrowed from quadratic pruning theory but applied to 7B-parameter nonlinear model with only 8 or 128 calibration samples.
  • ad hoc to paper D*_s, built from 8 harmful visual samples with safe answers generated by the aligned model, faithfully represents the safety objective.
    Sec 4.2 states the construction but gives no evidence of representativeness; the ablation in Supp. Table 5 shows the method is sensitive to D*_s size.
  • domain assumption Squared weight differences between consecutive checkpoints, weighted by inverse Hessian diagonals, identify parameters truly focused on safety or task.
    This is the core of the partition step (Eq. 4-5); not independently validated beyond the benchmark numbers.
  • ad hoc to paper Retaining p% of columns from W_{t-1} preserves safety without excessive harm to current task learning.
    p is hand-set and layer-decayed (Eq. 9); there is no theoretical or empirical guarantee outside the tested ranges.
  • domain assumption Deeper layers encode more task-specific knowledge, motivating lower retention in deeper layers.
    Invoked in Sec 3.4 with citation [14]; used to justify Eq. 9 but not verified for safety-critical parameters.
  • domain assumption Orthogonalizing the update with respect to the immediately previous weights reduces interference with all earlier tasks.
    Sec 3.5 projects only onto W_{t-1}, not onto the full history of previous weights; the link to multi-task forgetting is heuristic.

pith-pipeline@v1.3.0-alltime-deepseek · 14855 in / 14807 out tokens · 144817 ms · 2026-08-03T20:19:43.362842+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Harmonious Parameter Adaptation in Continual Visual Instruction Tuning for Safety-Aligned MLLMs." pith.science (2026). https://pith.science/paper/5SADATOL

@misc{pith2026251120158,
  author       = {Pith},
  title        = {Pith review of: Harmonious Parameter Adaptation in Continual Visual Instruction Tuning for Safety-Aligned MLLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5SADATOL}},
  note         = {Machine review of arXiv:2511.20158}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

While continual visual instruction tuning (CVIT) has shown promise in adapting multimodal large language models (MLLMs), existing studies predominantly focus on models without safety alignment. This critical oversight ignores the fact that real-world MLLMs inherently require such mechanisms to mitigate potential risks. In this work, we shift our focus to CVIT for safety-aligned MLLMs and observe that during continual adaptation, the model not only suffers from task forgetting but also exhibits degradation in its safety. Achieving a harmonious balance between safety and task performance remains a crucial challenge. To address this, we propose Harmonious Parameter Adaptation (HPA), a post-training framework composed of focusing-based parameter partition, harmoniously balanced parameter selection, and orthogonal parameter adjustment. Specifically, HPA partitions parameters into two types based on their focus on safety or task performance, and selects the focused ones to preserve from a balanced perspective. In addition, HPA imposes orthogonality constraints on parameter updates to further alleviate catastrophic forgetting. Extensive experiments on the CVIT benchmark and safety evaluation datasets demonstrate that HPA better maintains high safety and mitigates forgetting than existing baselines. Code is available at https://github.com/Minato-Zackie/HPA.

Figures

Figures reproduced from arXiv: 2511.20158 by Cees G. M. Snoek, Chang Che, Hui Ma, Meng Wang, Qi Wang, Zenglin Shi, Ziqi Wang.

Figure 1
Figure 1. Figure 1: Unsafety Variation (on the safety benchmark) and Ac [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of HPA Framework. HPA consists of three components: (1) [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 5
Figure 5. Figure 5: Layer-wise proportion of safety-focused parameters lo [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 3
Figure 3. Figure 3: Effect of different parameter retention rates [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figure 7
Figure 7. Figure 7: Variations in task and safety performance across different CVIT stages. Our method consistently sustains high capability and [PITH_FULL_IMAGE:figures/full_fig_p012_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Additional Case Studies. 3 [PITH_FULL_IMAGE:figures/full_fig_p013_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. StrLoRA: Towards Streaming Continual Visual Instruction Tuning for MLLMs

    cs.CV 2026-05 unverdicted novelty 7.0

    StrLoRA is a regularized two-stage expert routing method for streaming CVIT that selects experts via textual instructions and applies token-wise cross-modal weighting with historical routing alignment.

  2. ProtoAda: Prototype-Guided Adaptive Adapter Expansion and Geometric Consolidation for Multimodal Continual Instruction Tuning

    cs.CV 2026-06 unverdicted novelty 6.0

    ProtoAda uses format-aware prototypes for better task routing and geometry-aware consolidation to reduce interference in multimodal continual instruction tuning.

  3. CRAM: Centroid-Routing and Adaptive MoE for Multimodal Continual Instruction Tuning

    cs.CL 2026-06 unverdicted novelty 5.0

    CRAM uses adaptive MoE with centroid routing and orthogonality constraints to enable parameter-efficient multimodal continual instruction tuning while mitigating forgetting.

Reference graph

Works this paper leans on

40 extracted references · 9 linked inside Pith · cited by 3 Pith papers

  1. [1]

    Continual learning with tiny episodic memories

    Arslan Chaudhry, Marcus Rohrbach, Mohamed Elhoseiny, Thalaiyasingam Ajanthan, P Dokania, P Torr, and M Ran- zato. Continual learning with tiny episodic memories. In Workshop on Multi-Task and Lifelong Reinforcement Learn- ing, 2019. 6

    2019

  2. [2]

    Lora in lora: Towards parameter-efficient architecture expansion for continual visual instruction tun- ing.arXiv preprint arXiv:2508.06202, 2025

    Chang Che, Ziqi Wang, Pengwan Yang, Qi Wang, Hui Ma, and Zenglin Shi. Lora in lora: Towards parameter-efficient architecture expansion for continual visual instruction tun- ing.arXiv preprint arXiv:2508.06202, 2025. 2

    Pith/arXiv arXiv 2025

  3. [3]

    Coin: A benchmark of continual instruction tuning for multimodel large language models

    Cheng Chen, Junchen Zhu, Xu Luo, Heng T Shen, Jingkuan Song, and Lianli Gao. Coin: A benchmark of continual instruction tuning for multimodel large language models. Advances in Neural Information Processing Systems, 37: 57817–57840, 2024. 1, 2

    2024

  4. [4]

    Sefe: Superfi- cial and essential forgetting eliminator for multimodal con- tinual instruction tuning

    Jinpeng Chen, Runmin Cong, Yuzhi Zhao, Hongzheng Yang, Guangneng Hu, Horace Ip, and Sam Kwong. Sefe: Superfi- cial and essential forgetting eliminator for multimodal con- tinual instruction tuning. InForty-second International Con- ference on Machine Learning, 2025. 2, 6

    2025

  5. [5]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. InCVPR, 2009. 5, 1

    2009

  6. [6]

    Rethinking bottlenecks in safety fine-tuning of vision language models

    Yi Ding, Lijun Li, Bing Cao, and Jing Shao. Rethinking bottlenecks in safety fine-tuning of vision language models. arXiv preprint arXiv:2501.18533, 2025. 1

    arXiv 2025

  7. [7]

    Spdy: Accurate pruning with speedup guarantees

    Elias Frantar and Dan Alistarh. Spdy: Accurate pruning with speedup guarantees. InInternational conference on machine learning, pages 6726–6743. PMLR, 2022. 3

    2022

  8. [8]

    Sparsegpt: Massive language models can be accurately pruned in one-shot

    Elias Frantar and Dan Alistarh. Sparsegpt: Massive language models can be accurately pruned in one-shot. InInterna- tional conference on machine learning, pages 10323–10337. PMLR, 2023. 3

    2023

  9. [9]

    Learn- ing both weights and connections for efficient neural net- work.Advances in neural information processing systems, 28, 2015

    Song Han, Jeff Pool, John Tran, and William Dally. Learn- ing both weights and connections for efficient neural net- work.Advances in neural information processing systems, 28, 2015. 3

    2015

  10. [10]

    Continual instruction tuning for large multimodal models

    Jinghan He, Haiyun Guo, Ming Tang, and Jinqiao Wang. Continual instruction tuning for large multimodal models. arXiv preprint arXiv:2311.16206, 2023. 1, 2

    Pith/arXiv arXiv 2023

  11. [11]

    Lora: Low-rank adaptation of large language models.ICLR, 1(2):3, 2022

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models.ICLR, 1(2):3, 2022. 6

    2022

  12. [12]

    Learn from downstream and be yourself in multimodal large language models fine-tuning

    Wenke Huang, Jian Liang, Zekun Shi, Didi Zhu, Guancheng Wan, He Li, Bo Du, Dacheng Tao, and Mang Ye. Learn from downstream and be yourself in multimodal large language models fine-tuning. InForty-second International Confer- ence on Machine Learning, 2025. 3

    2025

  13. [13]

    Beavertails: Towards improved safety align- ment of llm via a human-preference dataset.Advances in Neural Information Processing Systems, 36:24678–24704,

    Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. Beavertails: Towards improved safety align- ment of llm via a human-preference dataset.Advances in Neural Information Processing Systems, 36:24678–24704,

  14. [14]

    How large language models en- code context knowledge? a layer-wise probing study

    Tianjie Ju, Weiwei Sun, Wei Du, Xinwei Yuan, Zhaochun Ren, and Gongshen Liu. How large language models en- code context knowledge? a layer-wise probing study. In Proceedings of the 2024 Joint International Conference on Computational Linguistics, Language Resources and Evalu- ation (LREC-COLING 2024), pages 8235–8246, 2024. 5

    2024

  15. [15]

    Overcoming catastrophic forgetting in neu- ral networks.Proceedings of the national academy of sci- ences, 114(13):3521–3526, 2017

    James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Grabska- Barwinska, et al. Overcoming catastrophic forgetting in neu- ral networks.Proceedings of the national academy of sci- ences, 114(13):3521–3526, 2017. 6

    2017

  16. [16]

    Safety layers in aligned large language models: The key to llm security

    Shen Li, Liuyi Yao, Lan Zhang, and Yaliang Li. Safety layers in aligned large language models: The key to llm security. In The Thirteenth International Conference on Learning Rep- resentations, 2025. 2, 6

    2025

  17. [17]

    Visual instruction tuning.NeurIPS, 2024

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning.NeurIPS, 2024. 1, 6

    2024

  18. [18]

    Safe delta: Consistently preserving safety when fine-tuning llms on di- verse datasets

    Ning Lu, Shengcai Liu, Jiahao Wu, Weiyu Chen, Zhirui Zhang, Yew-Soon Ong, Qi Wang, and Ke Tang. Safe delta: Consistently preserving safety when fine-tuning llms on di- verse datasets. InForty-second International Conference on Machine Learning, 2025. 2, 6

    2025

  19. [19]

    Learn to explain: Multimodal reasoning via thought chains for science question answering.NeurIPS,

    Pan Lu, Swaroop Mishra, Tanglin Xia, Liang Qiu, Kai-Wei Chang, Song-Chun Zhu, Oyvind Tafjord, Peter Clark, and Ashwin Kalyan. Learn to explain: Multimodal reasoning via thought chains for science question answering.NeurIPS,

  20. [20]

    Sea: Low-resource safety alignment for mul- timodal large language models via synthetic embeddings

    Weikai Lu, Hao Peng, Huiping Zhuang, Cen Chen, and Ziqian Zeng. Sea: Low-resource safety alignment for mul- timodal large language models via synthetic embeddings. arXiv preprint arXiv:2502.12562, 2025. 2

    Pith/arXiv arXiv 2025

  21. [21]

    A comprehensive overview of large language models.ACM Transactions on Intelligent Systems and Technology, 16(5):1–72, 2025

    Humza Naveed, Asad Ullah Khan, Shi Qiu, Muhammad Saqib, Saeed Anwar, Muhammad Usman, Naveed Akhtar, Nick Barnes, and Ajmal Mian. A comprehensive overview of large language models.ACM Transactions on Intelligent Systems and Technology, 16(5):1–72, 2025. 1

    2025

  22. [22]

    Flickr30k entities: Collecting region-to-phrase corre- spondences for richer image-to-sentence models

    Bryan A Plummer, Liwei Wang, Chris M Cervantes, Juan C Caicedo, Julia Hockenmaier, and Svetlana Lazeb- nik. Flickr30k entities: Collecting region-to-phrase corre- spondences for richer image-to-sentence models. InPro- ceedings of the IEEE international conference on computer vision, pages 2641–2649, 2015. 5, 1

    2015

  23. [23]

    Assessment of multimodal large language models in alignment with human values.arXiv preprint arXiv:2403.17830, 2024

    Zhelun Shi, Zhipin Wang, Hongxing Fan, Zaibin Zhang, Li- jun Li, Yongting Zhang, Zhenfei Yin, Lu Sheng, Yu Qiao, and Jing Shao. Assessment of multimodal large language models in alignment with human values.arXiv preprint arXiv:2403.17830, 2024. 5, 6, 1

    Pith/arXiv arXiv 2024

  24. [24]

    Drivelm: Driving with graph visual question answering

    Chonghao Sima, Katrin Renz, Kashyap Chitta, Li Chen, Hanxue Zhang, Chengen Xie, Jens Beißwenger, Ping Luo, Andreas Geiger, and Hongyang Li. Drivelm: Driving with graph visual question answering. InEuropean conference on computer vision, pages 256–274. Springer, 2024. 5, 1

    2024

  25. [25]

    Towards vqa models that can read

    Amanpreet Singh, Vivek Natarajan, Meet Shah, Yu Jiang, Xinlei Chen, Dhruv Batra, Devi Parikh, and Marcus Rohrbach. Towards vqa models that can read. InCVPR, pages 8317–8326, 2019. 5, 1

    2019

  26. [26]

    Llama: Open and efficient foundation language models

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth´ee Lacroix, Baptiste 9 Rozi`ere, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023. 1

    Pith/arXiv arXiv 2023

  27. [27]

    A comprehensive survey of continual learning: theory, method and application.IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024

    Liyuan Wang, Xingxing Zhang, Hang Su, and Jun Zhu. A comprehensive survey of continual learning: theory, method and application.IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024. 6

    2024

  28. [28]

    Qwen2-vl: Enhancing vision-language model’s perception of the world at any resolution.CoRR, 2024

    Peng Wang, Shuai Bai, Sinan Tan, Shijie Wang, Zhihao Fan, Jinze Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, et al. Qwen2-vl: Enhancing vision-language model’s perception of the world at any resolution.CoRR, 2024. 1

    2024

  29. [29]

    Smolora: Exploring and defying dual catastrophic forgetting in continual visual instruction tuning

    Ziqi Wang, Chang Che, Qi Wang, Yangyang Li, Zenglin Shi, and Meng Wang. Smolora: Exploring and defying dual catastrophic forgetting in continual visual instruction tuning. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 177–186, 2025. 1, 2

    2025

  30. [30]

    Adversary-aware dpo: Enhancing safety alignment in vision language models via adversarial training.arXiv preprint arXiv:2502.11455, 2025

    Fenghua Weng, Jian Lou, Jun Feng, Minlie Huang, and Wen- jie Wang. Adversary-aware dpo: Enhancing safety alignment in vision language models via adversarial training.arXiv preprint arXiv:2502.11455, 2025. 1, 2

    Pith/arXiv arXiv 2025

  31. [31]

    A survey of safety on large vision- language models: Attacks, defenses and evaluations.arXiv preprint arXiv:2502.14881, 2025

    Mang Ye, Xuankun Rong, Wenke Huang, Bo Du, Nenghai Yu, and Dacheng Tao. A survey of safety on large vision- language models: Attacks, defenses and evaluations.arXiv preprint arXiv:2502.14881, 2025. 1

    Pith/arXiv arXiv 2025

  32. [32]

    Towards robust multimodal large lan- guage models against jailbreak attacks.CoRR, 2025

    Ziyi Yin, Yuanpu Cao, Han Liu, Ting Wang, Jinghui Chen, and Fenhlong Ma. Towards robust multimodal large lan- guage models against jailbreak attacks.CoRR, 2025. 1

    2025

  33. [33]

    Enhanc- ing multimodal continual instruction tuning with branchlora

    Duzhen Zhang, Yong Ren, Zhong-Zhi Li, Yahan Yu, Jiahua Dong, Chenxing Li, Zhilong Ji, and Jinfeng Bai. Enhanc- ing multimodal continual instruction tuning with branchlora. arXiv preprint arXiv:2506.02041, 2025. 2

    Pith/arXiv arXiv 2025

  34. [34]

    Spa-vl: A comprehensive safety preference alignment dataset for vision language models

    Yongting Zhang, Lu Chen, Guodong Zheng, Yifeng Gao, Rui Zheng, Jinlan Fu, Zhenfei Yin, Senjie Jin, Yu Qiao, Xuanjing Huang, et al. Spa-vl: A comprehensive safety preference alignment dataset for vision language models. InProceed- ings of the Computer Vision and Pattern Recognition Con- ference, pages 19867–19878, 2025. 1, 2, 6

    2025

  35. [35]

    Mllm-cl: Continual learning for multimodal large language models.arXiv preprint arXiv:2506.05453, 2025

    Hongbo Zhao, Fei Zhu, Rundong Wang, Gaofeng Meng, and Zhaoxiang Zhang. Mllm-cl: Continual learning for multimodal large language models.arXiv preprint arXiv:2506.05453, 2025. 2, 5, 1

    arXiv 2025

  36. [36]

    Beyond anti-forgetting: Multimodal contin- ual instruction tuning with positive forward transfer.arXiv preprint arXiv:2401.09181, 2024

    Junhao Zheng, Qianli Ma, Zhen Liu, Binquan Wu, and Huawen Feng. Beyond anti-forgetting: Multimodal contin- ual instruction tuning with positive forward transfer.arXiv preprint arXiv:2401.09181, 2024. 2

    Pith/arXiv arXiv 2024

  37. [37]

    How alignment and jailbreak work: Explain llm safety through intermediate hidden states

    Zhenhong Zhou, Haiyang Yu, Xinghua Zhang, Rongwu Xu, Fei Huang, and Yongbin Li. How alignment and jailbreak work: Explain llm safety through intermediate hidden states. InFindings of the Association for Computational Linguis- tics: EMNLP 2024, pages 2461–2488, 2024. 2

    2024

  38. [38]

    Minigpt-4: Enhancing vision-language understanding with advanced large language models

    Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mo- hamed Elhoseiny. Minigpt-4: Enhancing vision-language understanding with advanced large language models. In 12th International Conference on Learning Representations, ICLR 2024, 2024. 1

    2024

  39. [39]

    Model tailor: mitigating catastrophic forgetting in multi-modal large lan- guage models

    Didi Zhu, Zhongyi Sun, Zexi Li, Tao Shen, Ke Yan, Shouhong Ding, Chao Wu, and Kun Kuang. Model tailor: mitigating catastrophic forgetting in multi-modal large lan- guage models. InProceedings of the 41st International Con- ference on Machine Learning, pages 62581–62598, 2024. 1, 2, 6

    2024

  40. [40]

    Safety fine-tuning at (al- most) no cost: A baseline for vision large language mod- els

    Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. Safety fine-tuning at (al- most) no cost: A baseline for vision large language mod- els. InInternational Conference on Machine Learning, pages 62867–62891. PMLR, 2024. 1, 2, 5, 6 10 Harmonious Parameter Adaptation in Continual Visual Instruction Tuning for Safety-Aligned MLLM...

    2024