Pith. sign in

REVIEW 3 major objections 5 minor 8 cited by

VLSBench: Unveiling Visual Leakage in Multimodal Safety

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Existing multimodal safety benchmarks leak the image's risk into the textual query, so models can refuse based on text alone; the paper introduces VLSBench to measure cross-modal safety without that leakage.

desk verdict VSIL is a real, well-measured problem, and VLSBench is a useful new benchmark—but the paper never audits its own benchmark with the same leakage metric, which is the one gap worth fixing. read the letter →

arxiv 2411.19939 v3 pith:LUBVFCQQ submitted 2024-11-29 cs.CR cs.AIcs.CLcs.CV

Xuhao Hu , Dongrui Liu , Hao Li , Xuanjing Huang , Jing Shao This is my paper · ORCID
classification cs.CRcs.AIcs.CLcs.CV
keywords multimodallargelanguagemodelssafetyalignmentvisualinformationleakagebenchmarktextualcross-modalityevaluationjailbreakrobustnessVSIL
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Existing multimodal safety benchmarks, the paper argues, are not really multimodal: the risky content shown in the image is almost always spelled out in the textual query, so a model can refuse without looking at the image. The paper calls this Visual Safety Information Leakage (VSIL) and shows that across four established benchmarks the text alone is judged harmful in more than 99% of the cases where the image-text pair is harmful. Because of this, simple text-only alignment performs as well as image-text alignment on those benchmarks, which the paper presents as evidence that the benchmarks are unreliable for cross-modal safety. To fix this, the paper builds VLSBench, 2.2k image-text pairs in which the query is harmless on its own and the image carries the risk. On VLSBench, text-only training falls behind multimodal training, and even strong closed models such as GPT-4o reach only about 21% safety rate, suggesting the field needs genuinely multimodal safety alignment rather than text-level refusal.

What carries the argument

The central object is the Visual Safety Information Leakage (VSIL) condition: for an unsafe image-text pair $(T,I)$, the safety judge labels the query alone as unsafe, $J(T,I)=J(T)=\mathrm{unsafe}$, so the image adds no safety information. The paper measures leakage through two rates, $R_1$ (fraction of pairs judged unsafe) and $R_2$ (fraction where both pair and query alone are unsafe); a near-zero $R_1-R_2$ is the leakage signature. The constructive machinery is a four-step pipeline: generate harmful queries and image descriptions from harmful elements with GPT-4o and from existing images with Qwen2-VL-72B; paraphrase those queries into harmless-sounding ones with a few-shot GPT-4o prompt and filter out queries that still leak risk or lose meaning; generate images with Stable-Diffusion-3.5-Large using iterative Qwen2-VL-72B checking and prompt refinement; and finally filter mismatched or safe pairs with GPT-4o and a small human review. Evaluation uses a GPT-4o judge that sorts responses into 'safe with refusal', 'safe with warning', and 'unsafe'.

What would settle it

Run the paper's own $R_1-R_2$ test on VLSBench with a strong multimodal judge or with human raters. If a substantial fraction of the final queries are judged unsafe by text alone (say $R_1-R_2 > 1\%$), the benchmark retains the leakage it claims to remove; if the texts stay harmless alone while the pairs are judged harmful, the central claim holds.

Watch

Extended reading notes

Core claim

On the paper's terms, the central discovery is that visual safety information leaks into the text of existing multimodal safety datasets: for an unsafe image-text pair $(T,I)$, the safety judge $J$ already labels the query alone as unsafe, $J(T,I)=J(T)=\mathrm{unsafe}$, so the image contributes nothing to the refusal decision. Quantitative evidence: on SafeBench, JailbreakV-raw, Harmbench-mm, and VLSafe the difference $R_1-R_2$ (harmful pair rate minus rate where text alone is also harmful) is below 1%. The paper then constructs VLSBench so that the text is neutral and the risk lives in the image, and shows that on this benchmark the ranking flips: textual SFT on LLaVA-v1.5-7B reaches 13.99% safety versus 21.26% for multimodal SFT, and on Qwen2-VL-7B 67.42% versus 78.39%, while on leakage-prone benchmarks text-only alignment is within about one percentage point of multimodal alignment. This reversal is the paper's evidence that VLSBench measures cross-modal safety rather than text-only refusal.

Load-bearing premise

The pipeline's GPT-4o paraphrase and filtration steps, with only a small human review, actually make every VLSBench query harmless on its own while the image-text pair stays harmful; the paper does not report a dataset-wide audit showing this for VLSBench itself.

Editorial extensions

If this is right

  • Existing multimodal safety benchmark scores overstate how well MLLMs reject unsafe image-text input, because a text-only refusal can look like a multimodal refusal.
  • The earlier conclusion that textual unlearning or textual SFT is enough for multimodal safety holds only on leakage-prone data; on VLSBench it does not.
  • VLSBench's results show that even safety-aligned models reach at best 78.39% safety, so dedicated multimodal alignment remains an open problem.
  • Models rarely give safety warnings with explanations; most safe behavior is direct refusal, indicating current MLLMs are not good at safety reasoning as assistants.
  • If the benchmark is representative, future safety evaluations should report whether the image is necessary to detect risk, since that is the property VLSBench tests.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A quality gate for any future multimodal safety benchmark would be to report its own $R_1-R_2$ before release; if the queries alone are already flagged, the benchmark cannot measure cross-modal safety.
  • The paper's caption-substitution experiments point toward a cheap deployment-time defense of routing images through a caption and letting a text-only safety layer decide, though the reported numbers are mixed and should be tested on the full VLSBench.
  • If VSIL is common in real-world prompting, then jailbreak robustness results based on text-only attacks are incomplete: a model that refuses an explicit query may be bypassed when the same harmful intent is carried by the image alone.
  • A natural extension is to train or fine-tune models on VLSBench-style data and test whether safety generalizes across its 19 sub-categories, which would show whether the benchmark measures a transferable skill rather than a memorized refusal pattern.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper identifies a Visual Safety Information Leakage (VSIL) problem in existing multimodal safety benchmarks: the risky content of the image is already present in the textual query, so models can refuse on text alone. It quantifies this with an R1/R2 metric on four benchmarks using two judges, and shows that textual-only alignment performs nearly as well as multimodal alignment on those benchmarks. The authors then construct VLSBench, a 2.2k image-text dataset whose queries are intended to be harmless without the image while the image-text pair is harmful, and they report that current and safety-aligned MLLMs achieve low safety rates on it. The paper concludes that VSIL inflated prior benchmark results and that multimodal alignment becomes preferable once the leakage is removed.

Significance. The VSIL discovery is timely and important: it offers a concrete, measurable explanation for the counterintuitive result that textual alignment matches multimodal alignment in multimodal safety, and the R1-R2 evidence in Table 1 is a clean falsifiable statistic. The release of code and data, the wide model coverage, and the two-judge cross-check in Appendix C are strengths. However, the central property of the new benchmark — that its queries are harmless alone while the pairs are harmful — is never audited with the same R1/R2 procedure, and the only large-scale human check reported in Appendix G validates the evaluation judge rather than the dataset itself. The significance of the VLSBench contribution is therefore conditional on an additional dataset-level audit.

major comments (3)
  1. [Section 2.1 vs. Section 3.2 / Appendix F.3] The paper defines R1/R2 in Section 2.1 and uses R1-R2 < 1% on existing benchmarks as evidence of VSIL, but it never reports R1/R2 on VLSBench itself. Section 3.2 describes the construction filters, and Appendix F.3 states that the authors and three labelers verified criteria (a) harmless query and (b) matched, harmful pair, yet no counts, no removal rates, and no inter-annotator agreement are given. Because VLSBench's entire purpose is to be leakless, the released dataset's key property is currently asserted by pipeline design rather than measured. Please report R1/R2 (or an equivalent query-only-vs-pair harm rate) on VLSBench with at least two independent judges and a human-annotated sample, and compare the resulting gap with Table 1.
  2. [Appendix C / Table 7] The claim in Section 2.1 that 'R1-R2 is less than 1%' is only true for the LlamaGuard3-11B-Vision judge. The GPT-4o results in Appendix C show R1-R2 = 4.95% on SafeBench, 3.57% on JailbreakV-raw, and 4.36% on Harmbench-mm. The paper should either report the two judges separately throughout, present a judge-averaged or judge-marginalized estimate, or explicitly discuss why the LlamaGuard3-Vision result is the preferred measurement. This matters because the magnitude and universality of VSIL in existing benchmarks is the empirical motivation for building VLSBench.
  3. [Appendix G / Section 3.2] The human verification in Appendix G is a 200-sample validation of the GPT-4o response judge, not a validation of the VLSBench dataset labels. Since GPT-4o is used in Steps 2 and 4 of the construction pipeline to detokenify, filter, and label the final pairs, and GPT-4o is also the sole judge for all VLSBench experiments, the claim that VLSBench queries are harmless out of context and harmful in context is not independently grounded. Please provide a dataset-level human audit with sample size, per-category counts, and agreement rates for both criteria, and report how many samples were removed during Step 4 and Appendix F.3. Without this, the low safety rates in Tables 3-4 could be an artifact of the same judge used to construct and evaluate the benchmark.
minor comments (5)
  1. [Section 4.2] The sentence 'Table 2 shows a clear disparity between textual alignment methods and multimodal alignment methods' appears to refer to the VLSBench alignment results, which are in Table 4; Table 2 is the VSIL-era comparison and would instead support the opposite conclusion. Please correct the cross-reference.
  2. [Section 2.1 / Appendix D] The same dataset is called 'Chef' in Section 2.1 and 'Ch3ef' in Appendix D and elsewhere; please unify the notation.
  3. [Throughout] There are several typos and wording issues: 'compromises' for 'comprises' in Section 3.1 and Appendix F.1, 'Appdendix E.3' in Section 2.2.1, 'Evaluaiton' in Section E.3, and 'words cloud' for 'word cloud' in Appendix F.1.
  4. [Appendix H.1] The text says 'The experiment results shown in Table 7' but the safety-prompt results are presented in Figure 7; please fix the reference.
  5. [Section 4.2] The statement that 'Current MLLMs struggle to perform notable safety warnings without direct refusal' is hard to reconcile with Gemini-1.5-pro's 48.44% warning rate in Table 3; please qualify the claim to models with high refusal rates rather than presenting it as a general observation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: VSIL is measured with external judges and VLSBench's central claims rest on independent benchmarks and human-verified evaluation.

full rationale

The central derivation is not circular. VSIL is defined via a safety judge J and then measured on four external benchmarks with LlamaGuard3-11B-Vision as J (Table 1), cross-checked with GPT-4o in Appendix C; R1 and R2 are computed quantities, not assumptions. The textual-versus-multimodal alignment comparison (Section 2.2) uses external baselines (VLGuard, SPA-VL, SafeRLHF) and an external judge (LlamaGuard3-8B), so the conclusion that textual alignment suffices on VSIL benchmarks is an empirical result, not an identity. For VLSBench, the pipeline (Section 3.2) uses GPT-4o for generation and filtration and GPT-4o as the evaluation judge; this same-model design is a validity limitation acknowledged in Section 6, and the 'leakless' property is asserted via the construction and a human review (Appendix F.3) rather than measured with the R1/R2 metric on the final set. That is missing validation, not circular derivation: the paper does not define VLSBench's harmlessness in terms of the evaluation outcome, and the judge itself is human-verified on 200 samples (Appendix G, Tables 13-15). Self-citations (Salad-Bench for taxonomy, Chef for images, SPA-VL for baselines) are either non-load-bearing or externally falsifiable and do not carry the argument. No equation or fitted parameter is reused as its own prediction.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The paper's claims rest on benchmark construction and judge-model assumptions, not on new physical or mathematical entities. No numeric free parameters are fitted to data. The main validation gap is the reliance on GPT-4o both as constructor and as judge.

assumptions (5)
  • domain assumption LlamaGuard3-11B-Vision and GPT-4o judges correctly identify harm in text-only and image-text inputs.
    The VSIL evidence (Table 1) and benchmark results depend on judge accuracy; only small human verification is provided for GPT-4o on VLSBench.
  • domain assumption The GPT-4o evaluation prompt correctly classifies responses as safe-refusal, safe-warning, or unsafe on VLSBench.
    Appendix G validates on 200 samples with human agreement, not on the full 2,241 pairs.
  • ad hoc to paper The construction pipeline (harmful query generation, detoxification, iterative image generation, and final filtering) removes VSIL while preserving harmfulness of the pair.
    Section 3.2 asserts this through design and a final manual review, with no dataset-wide quantitative leak audit.
  • domain assumption The 6-category, 19-subcategory safety taxonomy is an adequate representation of multimodal safety for benchmarking.
    Section 3.1 introduces the taxonomy; completeness is not empirically established.
  • domain assumption Stable-Diffusion-3.5-Large generated images carry the intended harmful visual content without being NSFW-detectable.
    Table 6 shows low NSFW detector scores, but the intended visual risk is not independently verified per image.

how reviews work

0 comments
Cite this review

Pith. "Pith review of VLSBench: Unveiling Visual Leakage in Multimodal Safety." pith.science (2026). https://pith.science/paper/LUBVFCQQ

@misc{pith2026241119939,
  author       = {Pith},
  title        = {Pith review of: VLSBench: Unveiling Visual Leakage in Multimodal Safety},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LUBVFCQQ}},
  note         = {Machine review of arXiv:2411.19939}
}
read the original abstract

Safety concerns of Multimodal large language models (MLLMs) have gradually become an important problem in various applications. Surprisingly, previous works indicate a counterintuitive phenomenon that using textual unlearning to align MLLMs achieves comparable safety performances with MLLMs aligned with image text pairs. To explain such a phenomenon, we discover a Visual Safety Information Leakage (VSIL) problem in existing multimodal safety benchmarks, i.e., the potentially risky content in the image has been revealed in the textual query. Thus, MLLMs can easily refuse these sensitive image-text pairs according to textual queries only, leading to unreliable cross-modality safety evaluation of MLLMs. We also conduct a further comparison experiment between textual alignment and multimodal alignment to highlight this drawback. To this end, we construct multimodal Visual Leakless Safety Bench (VLSBench) with 2.2k image-text pairs through an automated data pipeline. Experimental results indicate that VLSBench poses a significant challenge to both open-source and close-source MLLMs, e.g., LLaVA, Qwen2-VL and GPT-4o. Besides, we empirically compare textual and multimodal alignment methods on VLSBench and find that textual alignment is effective enough for multimodal safety scenarios with VSIL, while multimodal alignment is preferable for safety scenarios without VSIL. Code and data are released under https://github.com/AI45Lab/VLSBench

Figures

Figures reproduced from arXiv: 2411.19939 by the authors.

Figure 1
Figure 1. The existing visual safety information leakage (VSIL) problem leads to a shortcut alignment that simple [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Four examples in current benchmarks to show [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 4
Figure 4. The Detailed statistics of our VLSBench across 6 categories and 19 sub-categories Existing safety datasets are not challenging enough due to VSIL We also note that all the safety alignment methods exhibit an exceptionally high safety rate across all these evaluated safety datasets, which are over 90%. Also, many methods even perform nearly 100% safety rate like multi￾modal SFT on Qwen2-VL-7B. This phenomenon suggest… view at source ↗
Figures from the paper (16 more)
Figure 5
Figure 5. Figure 5: Overview of VLSBench construction pipeline. Our pipeline successfully prevents visual safety leakage. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Examples of our dataset across our three evaluation labels. We give an image-text pair and corresponding [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Safety Prompt used to enhance MLLMs’ safety on VLSBench. MMSafety reference the safety prompt used in MMSafetyBench (Liu et al., 2023b). This experiment is conducted in a subset of VLSBench with 500 samples. notably insufficient compared to multimodal SFT. This suggest…
Figure 8
Figure 8. Figure 8: Selected examples with VSIL: (a)-(e) is from JailbreakV (Luo et al., 2024), (f) is from SafeBench (Gong et al., 2023), (g)-(i) is from Ch3ef (Shi et al., 2024) and (j)-(l) is from Harmbench (Mazeika et al., 2024). 3 [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]
Figure 9
Figure 9. Figure 9: Words cloud of our VLSBench’s textual queries. [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 11
Figure 11. Figure 11: Prompt used to categorize our image-text [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]
Figure 10
Figure 10. Figure 10: The harmful elements: sensitive objects and [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 12
Figure 12. Figure 12: Evaluation method analysis. The Llama￾Guard model is not able to perceive the image and iden￾tify the risky content in image-text pairs which hinders its evaluation. On the other hand, GPT-based methods is able to correctly evaluate on our VLSBench with reli￾able expl…
Figure 13
Figure 13. Figure 13: Our GPT-4o evaluation prompt for our VLS [PITH_FULL_IMAGE:figures/full_fig_p021_13.png]
Figure 14
Figure 14. Figure 14: Selected models’ results on our VLSBench across 6 categories. Reported results include safe with refuse [PITH_FULL_IMAGE:figures/full_fig_p024_14.png]
Figure 18
Figure 18. Figure 18: Used prompt for GPT-4o to generate harmful queries and image descriptions with safety-related [PITH_FULL_IMAGE:figures/full_fig_p028_18.png]
Figure 19
Figure 19. Figure 19: Used prompt for GPT-4o to make the harmful query less obvious and less harmful, thus hiding the safety [PITH_FULL_IMAGE:figures/full_fig_p029_19.png]
Figure 20
Figure 20. Figure 20: Used prompt for GPT-4o to generate harmful queries with safety-related information from existing [PITH_FULL_IMAGE:figures/full_fig_p030_20.png]
Figure 21
Figure 21. Figure 21: Used prompt for GPT-4o to filter the unsuccessful revised query, which is still harmful or loses original [PITH_FULL_IMAGE:figures/full_fig_p030_21.png]
Figure 22
Figure 22. Figure 22: Used prompt for Qwen2-VL-72B for iterative image generation. [PITH_FULL_IMAGE:figures/full_fig_p031_22.png]
Figure 23
Figure 23. Figure 23: Used prompt for GPT-4o to the final filtration of image-text pair to filter out pairs that do not match [PITH_FULL_IMAGE:figures/full_fig_p031_23.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 8 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Multimodal Model Diffing for Feature Discovery and Control

    cs.CV 2026-08 conditional novelty 7.0 of 10

    By diffing base-language and multimodal sparse autoencoder features, MMDiff isolates causally relevant features that can be ablated or steered to control spatial, OCR, and safety behaviors in multimodal LLMs.

  2. Multimodal Reward Hacking in Reinforcement Learning

    cs.AI 2026-07 conditional novelty 6.5 of 10

    Imperfect multimodal RL rewards systematically create new failures (NRFR > RHR); scaling and answer-aware rewards help but do not eliminate hacking, and unreliable visual verifiers actively increase it.

  3. USB: A Comprehensive and Unified Safety Evaluation Benchmark for Multimodal Large Language Models

    cs.CR 2025-05 conditional novelty 6.0 of 10

    USB-SafeBench is a unified MLLM safety benchmark with 61 risk categories, 4 modality combinations, and dual-language vulnerability and oversensitivity tests.

  4. Implicit Jailbreak Attacks via Cross-Modal Information Concealment on Vision-Language Models

    cs.LG 2025-05 reject novelty 6.0 of 10

    IJA hides a malicious instruction in image steganography and uses a benign extraction prompt plus iterative template refinement to make multimodal LLMs execute it.

  5. ShieldVLM: Safeguarding the Multimodal Implicit Toxicity via Deliberative Reasoning with LVLMs

    cs.MM 2025-05 conditional novelty 6.0 of 10

    ShieldVLM detects multimodal implicit toxicity through deliberate cross-modal reasoning, outperforming existing moderation APIs and models on the new MMIT benchmark.

  6. MM-RLHF: The Next Step Forward in Multimodal LLM Alignment

    cs.CL 2025-02 conditional novelty 6.0 of 10

    A human-annotated multimodal preference dataset plus critique-based reward modeling and reward-margin-weighted DPO improves MLLM performance across many benchmarks.

  7. Layer-Aware Representation Filtering: Purifying Finetuning Data to Preserve LLM Safety Alignment

    cs.CR 2025-07 conditional novelty 5.0 of 10

    LARF ranks fine-tuning samples by how close their hidden representations lie to unsafe versus safe reference responses, and removing the top-ranked samples preserves safety alignment.

  8. Plane Geometry Problem Solving with Multi-modal Reasoning: A Survey

    cs.CV 2025-05 accept novelty 4.0 of 10

    A survey of plane geometry problem solving that classifies methods into an encoder-decoder framework and analyzes hallucination and data leakage in current benchmarks.

Reference graph

Works this paper leans on

65 extracted references · 5 canonical work pages · cited by 8 Pith papers

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Anthropic . 2024. Claude 3.5: Sonnet . https://www.anthropic.com/news/claude-3-5-sonnet

    work page 2024

  4. [4]

    Jinze Bai, Shuai Bai, Shusheng Yang, Shijie Wang, Sinan Tan, Peng Wang, Junyang Lin, Chang Zhou, and Jingren Zhou. 2023. Qwen-vl: A versatile vision-language model for understanding, localization, text reading, and beyond. arXiv preprint arXiv:2308.12966

    arXiv 2023

  5. [5]

    Trishna Chakraborty, Erfan Shayegani, Zikui Cai, Nael Abu-Ghazaleh, M Salman Asif, Yue Dong, Amit K Roy-Chowdhury, and Chengyu Song. 2024. Cross-modal safety alignment: Is textual unlearning all you need? arXiv preprint arXiv:2406.02575

    arXiv 2024

  6. [6]

    Dongping Chen, Ruoxi Chen, Shilin Zhang, Yaochen Wang, Yinuo Liu, Huichi Zhou, Qihui Zhang, Yao Wan, Pan Zhou, and Lichao Sun. 2024 a . Mllm-as-a-judge: Assessing multimodal llm-as-a-judge with vision-language benchmark. In Forty-first International Conference on Machine Learning

    2024

  7. [7]

    Lin Chen, Jinsong Li, Xiaoyi Dong, Pan Zhang, Yuhang Zang, Zehui Chen, Haodong Duan, Jiaqi Wang, Yu Qiao, Dahua Lin, et al. 2024 b . Are we on the right way for evaluating large vision-language models? arXiv preprint arXiv:2403.20330

    arXiv 2024

  8. [8]

    Yangyi Chen, Karan Sikka, Michael Cogswell, Heng Ji, and Ajay Divakaran. 2024 c . Dress: Instructing large vision-language models to align and interact with humans via natural language feedback. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14239--14250

    work page 2024

Show all 65 references
  1. [9]

    Zhe Chen, Weiyun Wang, Yue Cao, Yangzhou Liu, Zhangwei Gao, Erfei Cui, Jinguo Zhu, Shenglong Ye, Hao Tian, Zhaoyang Liu, et al. 2024 d . Expanding performance boundaries of open-source multimodal models with model, data, and test-time scaling. arXiv preprint arXiv:2412.05271

    2024 arXiv

  2. [10]

    Zhe Chen, Jiannan Wu, Wenhai Wang, Weijie Su, Guo Chen, Sen Xing, Muyan Zhong, Qinglong Zhang, Xizhou Zhu, Lewei Lu, Bin Li, Ping Luo, Tong Lu, Yu Qiao, and Jifeng Dai. 2023. Internvl: Scaling up vision foundation models and aligning for generic visual-linguistic tasks. arXiv ...

    2023 arXiv

  3. [11]

    Chenhang Cui, Gelei Deng, An Zhang, Jingnan Zheng, Yicong Li, Lianli Gao, Tianwei Zhang, and Tat-Seng Chua. 2024. Safe+ safe= unsafe? exploring how safe images can be exploited to jailbreak large vision-language models. arXiv preprint arXiv:2411.11496

    2024 arXiv

  4. [12]

    Yi Ding, Bolian Li, and Ruqi Zhang. 2024. Eta: Evaluating then aligning safety of vision language models at inference time. arXiv preprint arXiv:2410.06625

    2024 arXiv

  5. [13]

    Yi Ding, Lijun Li, Bing Cao, and Jing Shao. 2025. Rethinking bottlenecks in safety fine-tuning of vision language models. arXiv preprint arXiv:2501.18533

    2025

  6. [14]

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783

    2024 arXiv

  7. [15]

    Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas M \"u ller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. 2024. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first International Conference o...

    2024

  8. [16]

    Team GLM, Aohan Zeng, Bin Xu, Bowen Wang, Chenhui Zhang, Da Yin, Diego Rojas, Guanyu Feng, Hanlin Zhao, Hanyu Lai, Hao Yu, Hongning Wang, Jiadai Sun, Jiajie Zhang, Jiale Cheng, Jiayi Gui, Jie Tang, Jing Zhang, Juanzi Li, Lei Zhao, Lindong Wu, Lucen Zhong, Mingdao Liu, Minlie H...

    2024 arXiv

  9. [17]

    Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2023. Figstep: Jailbreaking large vision-language models via typographic visual prompts. arXiv preprint arXiv:2311.05608

    2023 arXiv

  10. [18]

    Yunhao Gou, Kai Chen, Zhili Liu, Lanqing Hong, Hang Xu, Zhenguo Li, Dit-Yan Yeung, James T Kwok, and Yu Zhang. 2024. Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation. arXiv preprint arXiv:2403.09572

    2024 arXiv

  11. [20]

    Tianle Gu, Zeyang Zhou, Kexin Huang, Dandan Liang, Yixu Wang, Haiquan Zhao, Yuanqi Yao, Xingge Qiao, Keqing Wang, Yujiu Yang, et al. 2024 b . Mllmguard: A multi-dimensional safety evaluation suite for multimodal large language models. arXiv preprint arXiv:2406.07594

    2024 arXiv

  12. [21]

    Ting-Yao Hsu, Chieh-Yang Huang, Ryan Rossi, Sungchul Kim, C Lee Giles, and Ting-Hao K Huang. 2023. Gpt-4 as an effective zero-shot evaluator for scientific figure captions. arXiv preprint arXiv:2310.15405

    2023 arXiv

  13. [22]

    Zhen Huang, Zengzhi Wang, Shijie Xia, and Pengfei Liu. 2024. Olympicarena medal ranks: Who is the most intelligent ai so far? arXiv preprint arXiv:2406.16772

    2024 arXiv

  14. [23]

    Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. 2024. Gpt-4o system card. arXiv preprint arXiv:2410.21276

    2024 arXiv

  15. [24]

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. 2023. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674

    2023 arXiv

  16. [25]

    Jiaming Ji, Donghai Hong, Borong Zhang, Boyuan Chen, Josef Dai, Boren Zheng, Tianyi Qiu, Boxun Li, and Yaodong Yang. 2024. Pku-saferlhf: A safety alignment preference dataset for llama family models. arXiv preprint arXiv:2406.15513

    2024 arXiv

  17. [26]

    Yilei Jiang, Yingshui Tan, and Xiangyu Yue. 2024. Rapguard: Safeguarding multimodal large language models via rationale-aware defensive prompting. arXiv preprint arXiv:2412.18826

    2024 arXiv

  18. [27]

    Bo Li, Kaichen Zhang, Hao Zhang, Dong Guo, Renrui Zhang, Feng Li, Yuanhan Zhang, Ziwei Liu, and Chunyuan Li. 2024 a . https://llava-vl.github.io/blog/2024-05-10-llava-next-stronger-llms/ Llava-next: Stronger llms supercharge multimodal capabilities in the wild

    2024

  19. [28]

    Lijun Li, Bowen Dong, Ruohui Wang, Xuhao Hu, Wangmeng Zuo, Dahua Lin, Yu Qiao, and Jing Shao. 2024 b . Salad-bench: A hierarchical and comprehensive safety benchmark for large language models. arXiv preprint arXiv:2402.05044

    2024 arXiv

  20. [29]

    Xirui Li, Hengguang Zhou, Ruochen Wang, Tianyi Zhou, Minhao Cheng, and Cho-Jui Hsieh. 2024 c . Mossbench: Is your multimodal language model oversensitive to safe queries? arXiv preprint arXiv:2406.17806

    2024 arXiv

  21. [30]

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll \'a r, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. In Computer Vision--ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, ...

    2014

  22. [31]

    Haotian Liu, Chunyuan Li, Yuheng Li, Bo Li, Yuanhan Zhang, Sheng Shen, and Yong Jae Lee. 2024 a . https://llava-vl.github.io/blog/2024-01-30-llava-next/ Llava-next: Improved reasoning, ocr, and world knowledge

    2024

  23. [32]

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023 a . Visual instruction tuning. In Visual instruction tuning

    2023

  24. [33]

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2024 b . Visual instruction tuning. Advances in neural information processing systems, 36

    2024

  25. [34]

    X Liu, Y Zhu, J Gu, Y Lan, C Yang, and Y Qiao. 2023 b . Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. arXiv preprint arXiv:2311.17600

    2023 arXiv

  26. [35]

    Weidi Luo, Siyuan Ma, Xiaogeng Liu, Xiaoyu Guo, and Chaowei Xiao. 2024. Jailbreakv-28k: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. arXiv preprint arXiv:2404.03027

    2024 arXiv

  27. [36]

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249

    2024 arXiv

  28. [37]

    OpenAI. 2024. https://openai.com/chatgpt/overview/ Chatgpt overview

    2024

  29. [38]

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 3...

    2022

  30. [39]

    Yiting Qu, Xinyue Shen, Yixin Wu, Michael Backes, Savvas Zannettou, and Yang Zhang. 2024. Unsafebench: Benchmarking image safety classifiers on real-world and ai-generated images. arXiv preprint arXiv:2405.03486

    2024 arXiv

  31. [40]

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2024. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems, 36

    2024

  32. [41]

    John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347

    2017 arXiv

  33. [42]

    Zhelun Shi, Zhipin Wang, Hongxing Fan, Zaibin Zhang, Lijun Li, Yongting Zhang, Zhenfei Yin, Lu Sheng, Yu Qiao, and Jing Shao. 2024. Assessment of multimodal large language models in alignment with human values. arXiv preprint arXiv:2403.17830

    2024 arXiv

  34. [43]

    Gemini Team, Petko Georgiev, Ving Ian Lei, Ryan Burnell, Libin Bai, Anmol Gulati, Garrett Tanzer, Damien Vincent, Zhufeng Pan, Shibo Wang, et al. 2024. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context. arXiv preprint arXiv:2403.05530

    2024 arXiv

  35. [44]

    Qwen Team. 2024. https://qwenlm.github.io/blog/qvq-72b-preview/ Qvq: To see the world with wisdom

    2024

  36. [45]

    Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ritik Dutta, Rylan Schaeffer, et al. 2023. Decodingtrust: A comprehensive assessment of trustworthiness in gpt models. In NeurIPS

    2023

  37. [46]

    Peng Wang, Shuai Bai, Sinan Tan, Shijie Wang, Zhihao Fan, Jinze Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Yang Fan, Kai Dang, Mengfei Du, Xuancheng Ren, Rui Men, Dayiheng Liu, Chang Zhou, Jingren Zhou, and Junyang Lin. 2024 a . Qwen2-vl: Enhancing vision-language m...

    2024 arXiv

  38. [47]

    Pengyu Wang, Dong Zhang, Linyang Li, Chenkun Tan, Xinghao Wang, Ke Ren, Botian Jiang, and Xipeng Qiu. 2024 b . Inferaligner: Inference-time alignment for harmlessness through cross-model guidance. arXiv preprint arXiv:2401.11206

    2024 arXiv

  39. [48]

    Siyin Wang, Xingsong Ye, Qinyuan Cheng, Junwen Duan, Shimin Li, Jinlan Fu, Xipeng Qiu, and Xuanjing Huang. 2024 c . https://arxiv.org/abs/2406.15279 Cross-modality safety alignment . arXiv preprint arXiv:2406.15279

    2024 arXiv

  40. [49]

    Yuxia Wang, Haonan Li, Xudong Han, Preslav Nakov, and Timothy Baldwin. 2024 d . Do-not-answer: Evaluating safeguards in llms. In Findings of the Association for Computational Linguistics: EACL 2024, pages 896--911

    2024

  41. [50]

    Zhenting Wang, Shuming Hu, Shiyu Zhao, Xiaowen Lin, Felix Juefei-Xu, Zhuowei Li, Ligong Han, Harihar Subramanyam, Li Chen, Jianfa Chen, et al. 2024 e . Mllm-as-a-judge for image safety without human labeling. arXiv preprint arXiv:2501.00192

    2024 arXiv

  42. [51]

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824--24837

    2022

  43. [52]

    Yuanwei Wu, Xiang Li, Yixin Liu, Pan Zhou, and Lichao Sun. 2023. Jailbreaking gpt-4v via self-adversarial attacks with system prompts. arXiv preprint arXiv:2311.09127

    2023 arXiv

  44. [53]

    Zihui Wu, Haichang Gao, Jianping He, and Ping Wang. 2024. The dark side of function calling: Pathways to jailbreaking large language models. arXiv preprint arXiv:2407.17915

    2024 arXiv

  45. [54]

    Guowei Xu, Peng Jin, Li Hao, Yibing Song, Lichao Sun, and Li Yuan. 2024. Llava-o1: Let vision language models reason step-by-step. arXiv preprint arXiv:2411.10440

    2024 arXiv

  46. [55]

    Yuan Yao, Tianyu Yu, Ao Zhang, Chongyi Wang, Junbo Cui, Hongji Zhu, Tianchi Cai, Haoyu Li, Weilin Zhao, Zhihui He, et al. 2024. Minicpm-v: A gpt-4v level mllm on your phone. arXiv preprint arXiv:2408.01800

    2024 arXiv

  47. [56]

    Shukang Yin, Chaoyou Fu, Sirui Zhao, Ke Li, Xing Sun, Tong Xu, and Enhong Chen. 2023. A survey on multimodal large language models. arXiv preprint arXiv:2306.13549

    2023 arXiv

  48. [57]

    Weihao Yu, Zhengyuan Yang, Linjie Li, Jianfeng Wang, Kevin Lin, Zicheng Liu, Xinchao Wang, and Lijuan Wang. 2023. Mm-vet: Evaluating large multimodal models for integrated capabilities. arXiv preprint arXiv:2308.02490

    2023 arXiv

  49. [58]

    Xiang Yue, Yuansheng Ni, Kai Zhang, Tianyu Zheng, Ruoqi Liu, Ge Zhang, Samuel Stevens, Dongfu Jiang, Weiming Ren, Yuxuan Sun, et al. 2024. Mmmu: A massive multi-discipline multimodal understanding and reasoning benchmark for expert agi. In Proceedings of the IEEE/CVF Conferenc...

    2024

  50. [59]

    Kaichen Zhang, Bo Li, Peiyuan Zhang, Fanyi Pu, Joshua Adrian Cahyono, Kairui Hu, Shuai Liu, Yuanhan Zhang, Jingkang Yang, Chunyuan Li, and Ziwei Liu. 2024 a . https://arxiv.org/abs/2407.12772 Lmms-eval: Reality check on the evaluation of large multimodal models . Preprint, arX...

    2024 arXiv

  51. [60]

    Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei. 2024 b . Negative preference optimization: From catastrophic collapse to effective unlearning. arXiv preprint arXiv:2404.05868

    2024 arXiv

  52. [61]

    Yichi Zhang, Yao Huang, Yitong Sun, Chang Liu, Zhe Zhao, Zhengwei Fang, Yifan Wang, Huanran Chen, Xiao Yang, Xingxing Wei, et al. 2024 c . Benchmarking trustworthiness of multimodal large language models: A comprehensive study. arXiv preprint arXiv:2406.07057

    2024 arXiv

  53. [62]

    Yongting Zhang, Lu Chen, Guodong Zheng, Yifeng Gao, Rui Zheng, Jinlan Fu, Zhenfei Yin, Senjie Jin, Yu Qiao, Xuanjing Huang, et al. 2024 d . Spa-vl: A comprehensive safety preference alignment dataset for vision language model. arXiv preprint arXiv:2406.12030

    2024 arXiv

  54. [63]

    Zhexin Zhang, Junxiao Yang, Pei Ke, Shiyao Cui, Chujie Zheng, Hongning Wang, and Minlie Huang. 2024 e . Safe unlearning: A surprisingly effective and generalizable solution to defend against jailbreak attacks. arXiv preprint arXiv:2407.02855

    2024 arXiv

  55. [64]

    Yaowei Zheng, Richong Zhang, Junhao Zhang, Yanhan Ye, Zheyan Luo, Zhangchi Feng, and Yongqiang Ma. 2024. http://arxiv.org/abs/2403.13372 Llamafactory: Unified efficient fine-tuning of 100+ language models . In Proceedings of the 62nd Annual Meeting of the Association for Compu...

    2024 arXiv

  56. [65]

    Kaiwen Zhou, Chengzhi Liu, Xuandong Zhao, Anderson Compalas, Dawn Song, and Xin Eric Wang. 2024. Multimodal situational safety. arXiv preprint arXiv:2410.06172

    2024 arXiv

  57. [66]

    Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. 2024. Safety fine-tuning at (almost) no cost: A baseline for vision large language models. arXiv preprint arXiv:2402.02207

    2024 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.