Pith. sign in

REVIEW 2 major objections 3 minor 67 references

This paper claims an empirical safety–utility ceiling for non-iterative recovery-based defenses against encoded vision-language jailbreaks: no configuration of its recover-decode-reguard pipeline achieves both low attack success and low ove

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 13:01 UTC pith:XRX5GGHX

load-bearing objection Careful, honest empirical work on a real defense gap; the central ceiling claim is slightly overstated because the threshold sweep only covers the guard-alone baseline, not the amplified or reguard conditions. the 2 major comments →

arxiv 2607.26574 v1 pith:XRX5GGHX submitted 2026-07-29 cs.CR cs.AIcs.LG

Recover, Decode, Reguard: Guard-Agnostic Defense Amplification againstEncoded VLM Jailbreaks

Haoyu Zhang , Zhuoxi Wang , Shibo Zheng , Zijian Xiao , Xiangchen Guan , Mohammad Zandsalimy , Shanu Sushmita This is my paper
classification cs.CR cs.AIcs.LG
keywords encoded jailbreaksvision-language modelssafety guardsdecode gaprecover-and-decode amplifierreguardensemble evaluationover-refusal
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that a guard-agnostic recover-and-decode amplifier—a preprocessing step that transcribes image text and restates encoded requests in plain language before an off-the-shelf safety classifier—only partially closes the "decode gap" in vision-language model defenses. Under an ensemble of eleven encoding attacks scored best-of-suite, the strongest guard-plus-amplifier still breaks 63–65% of harmful behaviors, and adding a reguard layer that re-screens the raw pre-decode text cuts the residual to 43–65% but drives benign over-refusal to 81–92% for well-calibrated guards. The paper's central claim is an empirical ceiling: no configuration of the pipeline they study achieves both low attack success and low over-refusal, across five guards and two target models. A sympathetic reader should care because it maps where recovery-based defense works—and shows that robustness is bought with benign utility, or not bought at all.

Core claim

The central discovery is an empirical safety–utility ceiling for non-iterative recovery-based defenses against representation-shifting jailbreaks. The paper builds a recover→decode→reguard stack placed before any black-box guard: the target VLM transcribes image content, restates encoded text as its plain payload, and optionally a guard re-screens the recovered pre-decode text. Measured against an eleven-attack ensemble with a behavior counted broken if any attack succeeds, the undefended suite breaks 89–91% of behaviors; the best guard-plus-amplifier leaves 63–65%; reguard lowers that to 43–65% but raises benign over-refusal to 81–92%; a laxer guard that stays usable never drops below 48% a

What carries the argument

The recover-and-decode amplifier: a training-free, guard-agnostic preprocessor with two steps—recover, in which the target VLM transcribes image content to text, and decode, in which the VLM restates the encoded request as its plain-language payload—followed by the off-the-shelf guard, with an optional reguard layer that runs the same guard on the pre-decode union (raw text plus transcription). It is what converts any guard's reach from the surface form it sees to the meaning a plain-language request would have. The other load-bearing mechanism is the ensemble evaluation itself: an OR-reduction over eleven attacks (best-of-suite ASR) that exposes a roughly 3.5× gap between per-attack means a

Load-bearing premise

The ceiling is measured with two open 7–8B vision-language models acting as their own recoverers; if a much stronger recovery model achieved near-perfect transcription fidelity, the frontier could shift or disappear—the paper itself flags that proprietary or larger models may sit elsewhere.

What would settle it

Run the same eleven-attack suite with a recovery step whose decode fidelity approaches 100%—for example, a dedicated large-scale transcription model—and find a guard-plus-amplifier configuration with ensemble attack success below ~40% and benign over-refusal below ~35%; that operating point falls in the region the paper claims is empty.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Recovery-based preprocessing is a partial defense at best: the strongest guard-plus-amplifier still leaves 63–65% of behaviors broken under an eleven-attack ensemble, so deployers should not expect a single guard-agnostic preprocessor to restore protection.
  • Adding a reguard layer that re-screens the pre-decode text cuts the residual to 43–65% and repairs dispersed grid attacks, but at a steep utility cost for well-calibrated guards—benign over-refusal rises to 81–92%—so robustness is bought with benign utility.
  • Per-attack mean success rates understate a deployed attacker by roughly 3.5× because different attacks break different behaviors; evaluating defenses by the union over an attack suite is necessary to see the safety–utility trade-off.
  • The amplifier's benefit is bounded by the target model's recovery fidelity: the model that transcribes more faithfully (51.4% vs 41.6%) gains significantly from the amplifier on three of five guards, so fidelity is a necessary condition for recovery-based defense.
  • For code-based attacks, decoding to prose removes the syntactic signal a guard keys on; reguard barely blunts them, so code attacks remain the dominant residual across all configurations.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the ceiling is real, then guard-agnostic preprocessing alone cannot rescue black-box VLM safety; the frontier suggests progress requires either stronger guards that classify meaning rather than surface form, or model-internal defenses that operate on hidden states—families the paper explicitly does not evaluate.
  • The paper's direct measurement of decode fidelity suggests a cheap screening test for any new target VLM: measure how faithfully it restates encoded requests, and predict how much a recovery-based amplifier will help before deploying it.
  • A testable extension: apply the same best-of-suite ensemble protocol to iterative or multi-view recovery schemes (e.g., multiple transcription passes or verify-then-decide loops) to see whether they escape the frontier or merely slide along it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 3 minor

Summary. The paper proposes a guard-agnostic recover-and-decode preprocessing amplifier for black-box VLM safety guards, with an optional reguard layer that additionally screens the recovered pre-decode text. It evaluates this pipeline against an ensemble of eleven established encoded-jailbreak attacks (five text encodings, six image renders) on two 7–8B VLMs and five guards, scoring n=100 HarmBench/OR-Bench behaviors under a best-of-suite ensemble ASR (Eq. 1). The central finding is an empirical safety–utility ceiling: the undefended ensemble breaks 89–91% of behaviors, the best guard-plus-amplifier still leaves 63–65%, and the reguard layer reduces residual ASR to 43–65% but raises benign over-refusal to 81–92% for well-calibrated guards, so no evaluated configuration reaches both low attack-success and low over-refusal. The paper also contributes the amplifier implementation, an AutoAttack-style ensemble evaluation methodology, and a new adaptive attack against the decode mechanism.

Significance. If the ceiling claim holds, this is an important negative result for a natural class of non-iterative recovery-based VLM defenses, with direct deployment implications. The empirical work is unusually careful: paired exact McNemar tests with reported discordant counts, Wilson CIs and bootstrap intervals, a human-calibrated judge cross-checked by a second judge (r=0.975), component ablations separating recover from decode, decoder-scale and composition experiments, an explicit run-to-run drift analysis, and detailed reproducibility documentation. These practices substantially raise the credibility of the negative result and set a strong evaluative standard for the field. The paper is also commendably honest about limitations, including judge calibration scope and the conditional nature of the ceiling.

major comments (2)
  1. [§5 RQ4 / Appendix Q (Tables 16–17, Fig. 4)] The threshold sweep is performed only for the guard-alone (gb) condition: the as-shipped check reproduces guard-alone ASRs, and the curves are derived from guard scores on the raw input. The amplifier (mc) and reguard (+rg) conditions feed the guard different inputs—decoded payload and recovered pre-decode union—so their score distributions and ROC curves can differ. The claim that 'recalibration moves guards along the frontier, not off it' is therefore demonstrated only for guard-alone and does not bound the reachable frontier of the amplified pipeline. Since the central claim is that no configuration reaches both low ASR and low over-refusal, and thresholds are explicitly an evaluated configuration axis, this is load-bearing. Please sweep (or sample) decision thresholds inside mc and +rg, using stored guard scores on the decoded/recovered text, and report the resulting safety–utility c
  2. [§6 Limitations; Appendix C; Appendix M] The ceiling is measured with two 7–8B VLMs as recoverers; only the decoder was scaled to 70B, not the recoverer. Since the amplifier's benefit is shown to track recovery fidelity (Appendix C: 41.6% vs 51.4% match rates), a stronger recoverer could plausibly shift the frontier. The paper's explicit 'we evaluate' scoping is internally consistent, but the abstract's 'empirical safety–utility ceiling' may overstate the result unless this condition is made more prominent. A concrete test—replacing the recoverer with a much larger or dedicated recovery model and re-measuring the ensemble—would materially strengthen the generality claim.
minor comments (3)
  1. [Appendix preamble] The statement 'nothing here is load-bearing for them' is contradicted by the main text's reliance on Appendix Q for the threshold sweep and Appendix P for the statistical tables; the statement should be removed or qualified.
  2. [Table 2] The recover-only row's note that its five text attacks are taken from guard-alone is easy to miss and could confuse readers; consider labeling the row explicitly as a hybrid assembly.
  3. [Abstract] The abstract's '81–92%' over-refusal range refers to well-calibrated guards; the exception of LlamaGuard-3 (33% over-refusal but 48% ASR) is handled in the main text but would benefit from a brief qualifier in the abstract to avoid over-generalized reading.

Circularity Check

0 steps flagged

No significant circularity: the central claim is an empirical measurement against external benchmarks and published attacks, not a derivation that reduces to its own inputs.

full rationale

The paper's central claim—an empirical safety–utility ceiling for non-iterative recovery-based defenses—is presented and supported as an experimental measurement, not as a mathematical derivation from assumptions that already contain the result. The architecture (recover→decode→reguard) is explicitly specified in Algorithm 1, the evaluation uses external benchmarks (HarmBench, OR-Bench) and published attacks, and all headline numbers are best-of-suite empirical ASRs with paired significance tests. There is no fitted parameter that is then renamed as a prediction; the threshold sweep in Appendix Q is a robustness check on operating points, and the paper explicitly labels the ceiling as empirical rather than a proven law (§6 Limitations). The one place where an identity in the pipeline appears—the recover-only ablation reusing guard-alone text entries because both paths hand the guard the same string—is openly disclosed as an identity by construction and is used only to assemble a hybrid ablation condition, not to manufacture a prediction. No load-bearing self-citation, uniqueness theorem, or ansatz-smuggling citation is used; the method is self-contained against external baselines and the authors' own adaptive attack is explicitly a check on the published mechanism, not a fitted input. The skeptical concern that the threshold sweep does not cover the amplifier/reguard conditions is a question about the generality of an empirical claim, not about circularity of a derivation.

Axiom & Free-Parameter Ledger

0 free parameters · 6 axioms · 0 invented entities

The paper is an empirical evaluation with no fitted mathematical parameters and no newly postulated entities. Its load-bearing inputs are domain assumptions about the existence of the decode gap, the fidelity of the 7–8B self-recovery, the validity of the benchmarks, the reliability of the judge, the representativeness of the eleven-attack suite (as a lower bound), and the paired-run methodology that makes contrasts meaningful despite run-to-run drift.

axioms (6)
  • domain assumption Guards classify surface form, not meaning; the 'decode gap' exists.
    Central motivation for the amplifier; if guards understood semantics regardless of surface form, the defense has no purpose. Section 1.
  • domain assumption Recovery and decode by the target VLM can surface the payload with sufficient fidelity.
    The amplifier's effectiveness depends on the target transcribing and restating correctly; fidelity is measured in Appendix C and found partial (41.6%/51.4%). Sections 4 and C.
  • domain assumption HarmBench and OR-Bench are valid standardized benchmarks for harmful behavior and benign over-refusal.
    All ASR and over-refusal numbers are computed on these n=100 sets. Sections 5 and J.
  • domain assumption gpt-5-mini judge labels are sufficiently reliable for relative contrasts (κ=0.68 harm, 0.79 refusal).
    All scored numbers rest on this judge; cross-checked with gpt-5-nano and a human panel. Appendix I.
  • domain assumption The representational-shifting attack suite (11 attacks) is a lower bound on attacker capability; excluded families (pixel-space, embedding-space, sequential, multilingual) would only raise ensemble ASR.
    Supports the scoping of the ceiling claim; the paper explicitly excludes these classes in §6 and Appendix K.
  • domain assumption Single greedy decoding runs are representative enough with paired within-run contrasts; run-to-run drift affects absolute levels, not within-run comparisons.
    Every claim rests on paired McNemar contrasts; Appendix P documents up to ±11 point drift between runs.

pith-pipeline@v1.3.0-daily-deepseek · 32571 in / 11318 out tokens · 109402 ms · 2026-08-01T13:01:41.889481+00:00 · methodology

0 comments
read the original abstract

Safety classifiers ("guards") are the dominant black-box defense for vision-language models, yet they judge an input's surface form, not its meaning: a harmful request re-encoded as set theory, formal logic, a rare language, code, or an image of text slips past a guard that would block it in plain language -- the decode gap. The natural fix is a guard-agnostic recover-and-decode amplifier that transcribes image content and restates encoded text into its plain payload before the guard, so any off-the-shelf classifier can screen the true request. We build this amplifier and evaluate it against the attacker's best case: an ensemble of eleven attacks, scoring a behavior as broken if any succeeds (best-of-suite, following AutoAttack) -- rarely reported for jailbreak defenses, yet ~3.5x the per-attack mean. This exposes our central finding: an empirical safety-utility ceiling for the non-iterative recovery defenses we evaluate, across five guards and two target VLMs. The amplifier only partly closes the gap -- the undefended ensemble breaks 89-91% of behaviors, and the best guard-plus-amplifier still leaves 63-65% -- and its gain over the guard alone is significant in only four of ten guard-target pairs. It is guard-agnostic at the interface, but not uniformly so in effect. A modular reguard layer closes much of the residual, yet drives benign over-refusal to 81-92% for well-calibrated guards; the one laxer guard that stays usable never reaches deployable safety (48% ensemble ASR). No configuration we evaluate reaches both low attack-success and low over-refusal, for the pipeline we study and for representation-shifting attacks -- encodings and cross-modal renders that leave a legible payload, not pixel- or embedding-space attacks. We contribute the amplifier, an ensemble evaluation that makes the trade-off visible, and a map of where recovery-based VLM defense works and where it does not.

Figures

Figures reproduced from arXiv: 2607.26574 by Haoyu Zhang, Mohammad Zandsalimy, Shanu Sushmita, Shibo Zheng, Xiangchen Guan, Zhuoxi Wang, Zijian Xiao.

Figure 1
Figure 1. Figure 1: The recover-and-decode amplifier as a modular stack. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: The safety–utility frontier (Qwen2.5-VL: [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Ensemble ASR (best-of-11) on Qwen2.5-VL across [PITH_FULL_IMAGE:figures/full_fig_p017_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Swept threshold curves: every reachable (over￾refusal, ensemble-ASR) pair for each guard, on Qwen2.5- VL. Markers are the as-shipped operating points. Dashed line = the undefended 89% ensemble; dotted line = the 26% benign floor; shaded band = the ≤35% over-refusal budget. Inside that band every curve is pinned at the undefended ASR except LlamaGuard-3, which is the one genuinely mis￾calibrated guard — and… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

67 extracted references · 4 canonical work pages

  1. [1]

    Proceedings of the 37th International Conference on Machine Learning , articleno =

    Croce, Francesco and Hein, Matthias , title =. Proceedings of the 37th International Conference on Machine Learning , articleno =. 2020 , publisher =

    2020

  2. [2]

    2019 , eprint=

    On Evaluating Adversarial Robustness , author=. 2019 , eprint=

    2019

  3. [3]

    Proceedings of the 35th International Conference on Machine Learning,

    Anish Athalye and Nicholas Carlini and David Wagner , title =. Proceedings of the 35th International Conference on Machine Learning,. 2018 , month = jul, url =

    2018

  4. [4]

    C ode A ttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion

    Ren, Qibing and Gao, Chang and Shao, Jing and Yan, Junchi and Tan, Xin and Lam, Wai and Ma, Lizhuang. C ode A ttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion. Findings of the Association for Computational Linguistics: ACL 2024. 2024. doi:10.18653/v1/2024.findings-acl.679

    doi:10.18653/v1/2024.findings-acl.679 2024

  5. [5]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , month =

    Yang, Zuopeng and Fan, Jiluan and Yan, Anli and Gao, Erdun and Lin, Xin and Li, Tao and Mo, Kanghua and Dong, Changyu , title =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , month =. 2025 , pages =

    2025

  6. [6]

    Proceedings of the AAAI Conference on Artificial Intelligence , author=

    FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts , volume=. Proceedings of the AAAI Conference on Artificial Intelligence , author=. 2025 , month=. doi:10.1609/aaai.v39i22.34568 , abstractNote=

    doi:10.1609/aaai.v39i22.34568 2025

  7. [7]

    S emantic C amo: Jailbreaking Large Language Models through Semantic Camouflage

    Yan, Jihui and Yang, Xiaocui and Wang, Daling and Feng, Shi and Zhang, Yifei and Zhao, Yinzhi. S emantic C amo: Jailbreaking Large Language Models through Semantic Camouflage. Findings of the Association for Computational Linguistics: ACL 2025. 2025. doi:10.18653/v1/2025.findings-acl.745

    doi:10.18653/v1/2025.findings-acl.745 2025

  8. [8]

    WildGuard: Open One-stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs , url =

    Han, Seungju and Rao, Kavel and Ettinger, Allyson and Jiang, Liwei and Lin, Bill Yuchen and Lambert, Nathan and Choi, Yejin and Dziri, Nouha , booktitle =. WildGuard: Open One-stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs , url =. doi:10.52202/079017-0261 , editor =

    doi:10.52202/079017-0261

  9. [9]

    2023 , eprint=

    Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations , author=. 2023 , eprint=

    2023

  10. [10]

    2024 , eprint=

    Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversations , author=. 2024 , eprint=

    2024

  11. [11]

    2025 , eprint=

    Qwen3Guard Technical Report , author=. 2025 , eprint=

    2025

  12. [12]

    2025 , eprint=

    GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning , author=. 2025 , eprint=

    2025

  13. [13]

    T hink G uard: Deliberative Slow Thinking Leads to Cautious Guardrails

    Wen, Xiaofei and Zhou, Wenxuan and Mo, Wenjie Jacky and Chen, Muhao. T hink G uard: Deliberative Slow Thinking Leads to Cautious Guardrails. Findings of the Association for Computational Linguistics: ACL 2025. 2025. doi:10.18653/v1/2025.findings-acl.704

    doi:10.18653/v1/2025.findings-acl.704 2025

  14. [14]

    and Hassani, Hamed and Zhang, Yang and Wong, Eric and Chang, Shiyu

    Ji, Jiabao and Hou, Bairu and Robey, Alexander and Pappas, George J. and Hassani, Hamed and Zhang, Yang and Wong, Eric and Chang, Shiyu. Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing. Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter o...

    doi:10.18653/v1/2025.ijcnlp-short.2 2025

  15. [15]

    Pappas , journal=

    Alexander Robey and Eric Wong and Hamed Hassani and George J. Pappas , journal=. Smooth. 2025 , url=

    2025

  16. [16]

    2026 , eprint=

    DoubtProbe: Black-Box Jailbreak Defense via Structural Verification and Semantic Auditing , author=. 2026 , eprint=

    2026

  17. [17]

    Proceedings of the 41st International Conference on Machine Learning , articleno =

    Mazeika, Mantas and Phan, Long and Yin, Xuwang and Zou, Andy and Wang, Zifan and Mu, Norman and others , title =. Proceedings of the 41st International Conference on Machine Learning , articleno =. 2024 , publisher =

    2024

  18. [18]

    2025 , url=

    Justin Cui and Wei-Lin Chiang and Ion Stoica and Cho-Jui Hsieh , booktitle=. 2025 , url=

    2025

  19. [19]

    JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models , url =

    Chao, Patrick and Debenedetti, Edoardo and Robey, Alexander and Andriushchenko, Maksym and Croce, Francesco and Sehwag, Vikash and others , booktitle =. JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models , url =. doi:10.52202/079017-1745 , editor =

    doi:10.52202/079017-1745

  20. [20]

    and Zhang, Yu , title =

    Gou, Yunhao and Chen, Kai and Liu, Zhili and Hong, Lanqing and Xu, Hang and Li, Zhenguo and Yeung, Dit-Yan and Kwok, James T. and Zhang, Yu , title =. Computer Vision – ECCV 2024: 18th European Conference, Milan, Italy, September 29–October 4, 2024, Proceedings, Part XVII , pages =. 2024 , publisher =. doi:10.1007/978-3-031-72643-9_23 , abstract =

    work page doi:10.1007/978-3-031-72643-9_23 2024

  21. [21]

    MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models

    Liu, Xin and Zhu, Yichen and Gu, Jindong and Lan, Yunshi and Yang, Chao and Qiao, Yu. MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models. Computer Vision -- ECCV 2024. 2025

    2024

  22. [22]

    arXiv preprint arXiv:2502.00653 , year=

    Towards Robust Multimodal Large Language Models Against Jailbreak Attacks , author=. arXiv preprint arXiv:2502.00653 , year=

    Pith/arXiv arXiv

  23. [23]

    Findings of the Association for Computational Linguistics: EMNLP 2025 , year=

    How Jailbreak Defenses Work and Ensemble? A Mechanistic Investigation , author=. Findings of the Association for Computational Linguistics: EMNLP 2025 , year=

    2025

  24. [24]

    Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , year=

    Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-based Attacks , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , year=

  25. [25]

    Findings of the Association for Computational Linguistics: EMNLP 2025 , year=

    Attack as Defense: Safeguarding Large Vision-Language Models from Jailbreaking by Adversarial Attacks , author=. Findings of the Association for Computational Linguistics: EMNLP 2025 , year=

    2025

  26. [26]

    Pattern Recognition , volume=

    Defense-to-Attack: Bypassing Weak Defenses Enables Stronger Jailbreaks in Vision-Language Models , author=. Pattern Recognition , volume=

  27. [27]

    Advances in Neural Information Processing Systems (NeurIPS) , year=

    The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense , author=. Advances in Neural Information Processing Systems (NeurIPS) , year=

  28. [28]

    arXiv preprint arXiv:2601.03594 , year=

    Jailbreaking LLMs and VLMs: Mechanisms, Evaluation, and Unified Defenses , author=. arXiv preprint arXiv:2601.03594 , year=

    arXiv

  29. [29]

    arXiv preprint arXiv:2411.09259 , year=

    Jailbreak Attacks and Defenses against Multimodal Generative Models: A Survey , author=. arXiv preprint arXiv:2411.09259 , year=

    Pith/arXiv arXiv

  30. [30]

    Findings of the Association for Computational Linguistics: EACL 2026 , year=

    Crafting Adversarial Inputs for Large Vision-Language Models Using Black-Box Optimization , author=. Findings of the Association for Computational Linguistics: EACL 2026 , year=

    2026

  31. [31]

    Proceedings of the AAAI Conference on Artificial Intelligence , year=

    Multi-Faceted Attack: Exposing Cross-Model Vulnerabilities in Defense-Equipped Vision-Language Models , author=. Proceedings of the AAAI Conference on Artificial Intelligence , year=

  32. [32]

    2025 , publisher =

    Weng, Fenghua and Xu, Yue and Fu, Chengyan and Wang, Wenjie , title =. 2025 , publisher =. doi:10.1609/aaai.v39i26.34983 , booktitle =

    work page doi:10.1609/aaai.v39i26.34983 2025

  33. [33]

    The Thirteenth International Conference on Learning Representations , year=

    BlueSuffix: Reinforced Blue Teaming for Vision-Language Models Against Jailbreak Attacks , author=. The Thirteenth International Conference on Learning Representations , year=

  34. [34]

    2026 , eprint=

    Understanding and Defending VLM Jailbreaks via Jailbreak-Related Representation Shift , author=. 2026 , eprint=

    2026

  35. [35]

    Forty-third International Conference on Machine Learning , year=

    Jailbreaking Vision-Language Models Through the Visual Modality , author=. Forty-third International Conference on Machine Learning , year=

  36. [36]

    2025 , publisher =

    Jiang, Yilei and Gao, Xinyan and Peng, Tianshuo and Tan, Yingshui and Zhu, Xiaoyong and Zheng, Bo and Yue, Xiangyu , booktitle =. 2025 , publisher =. doi:10.18653/v1/2025.acl-long.724 , url =

    doi:10.18653/v1/2025.acl-long.724 2025

  37. [37]

    Computer Vision -- ECCV 2024 , pages=

    AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting , author=. Computer Vision -- ECCV 2024 , pages=. 2024 , publisher=

    2024

  38. [38]

    First Conference on Language Modeling (COLM) , year=

    JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks , author=. First Conference on Language Modeling (COLM) , year=

  39. [39]

    Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , year=

    Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , year=

  40. [40]

    2025 , publisher=

    Hu, Xuhao and Liu, Dongrui and Li, Hao and Huang, Xuanjing and Shao, Jing , booktitle=. 2025 , publisher=

    2025

  41. [41]

    2026 , eprint=

    Leave My Images Alone: Preventing Multi-Modal Large Language Models from Analyzing Images via Visual Prompt Injection , author=. 2026 , eprint=

    2026

  42. [42]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , year =

    Piao, Caiyong and Yan, Zhiyuan and Xu, Haoming and Zhao, Yunzhen and Lin, Kaiqing and Xu, Feiyang and Zhou, Shuigeng , title =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , year =

  43. [43]

    2026 , eprint=

    Prompt-Induced Score Variance in Zero-Shot Binary Vision-Language Safety Classification , author=. 2026 , eprint=

    2026

  44. [44]

    Proceedings of the Fortieth AAAI Conference on Artificial Intelligence , publisher =

    Wang, Hanqing and Tian, Yuan and Liu, Mingyu and Zhang, Zhenhao and Zhu, Xiangyang , title =. Proceedings of the Fortieth AAAI Conference on Artificial Intelligence , publisher =. 2026 , doi =

    2026

  45. [45]

    2025 , eprint =

    Agentic Moderation: Multi-Agent Design for Safer Vision-Language Models , author =. 2025 , eprint =

    2025

  46. [46]

    International Conference on Learning Representations (ICLR) , year =

    Toward Universal and Transferable Jailbreak Attacks on Vision-Language Models , author =. International Conference on Learning Representations (ICLR) , year =

  47. [47]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Visual Adversarial Examples Jailbreak Aligned Large Language Models , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=. 2024 , doi=

    2024

  48. [48]

    2025 , note=

    Chen, Beitao and Lyu, Xinyu and Gao, Lianli and Song, Jingkuan and Shen, Heng Tao , booktitle=. 2025 , note=

    2025

  49. [49]

    Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (ACL) , pages=

    Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoring , author=. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (ACL) , pages=

  50. [50]

    2025 , eprint=

    Implicit Jailbreak Attacks via Cross-Modal Information Concealment on Vision-Language Models , author=. 2025 , eprint=

    2025

  51. [51]

    Resolution Thresholds in

    Hua, Yikai and West, Peter , journal=. Resolution Thresholds in

  52. [52]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL) , pages=

    Jailbreak Large Vision-Language Models Through Multi-Modal Linkage , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL) , pages=. 2025 , doi=

    2025

  53. [53]

    Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (ACL) , pages=

    Seeing No Evil: Blinding Large Vision-Language Models to Safety Instructions via Adversarial Attention Hijacking , author=. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (ACL) , pages=

  54. [54]

    Proceedings of the 42nd International Conference on Machine Learning (ICML) , year=

    Defending LVLMs Against Vision Attacks through Partial-Perception Supervision , author=. Proceedings of the 42nd International Conference on Machine Learning (ICML) , year=

  55. [55]

    Proceedings of the AAAI Conference on Artificial Intelligence (AAAI) , year=

    Retention Score: Quantifying Jailbreak Risks for Vision Language Models , author=. Proceedings of the AAAI Conference on Artificial Intelligence (AAAI) , year=

  56. [56]

    The Twelfth International Conference on Learning Representations , year=

    Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models , author=. The Twelfth International Conference on Learning Representations , year=

  57. [57]

    2025 , eprint=

    DefenSee: Dissecting Threat from Sight and Text -- A Multi-View Defensive Pipeline for Multi-modal Jailbreaks , author=. 2025 , eprint=

    2025

  58. [58]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , year=

    Jailbreaking Vision-Language Models via Dissonance-Guided Suffix Optimization and Image-Phrase Injection , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , year=

  59. [59]

    Proceedings of the 41st International Conference on Machine Learning (ICML) , year =

    Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models , author =. Proceedings of the 41st International Conference on Machine Learning (ICML) , year =

  60. [60]

    2026 , eprint =

    When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness? , author =. 2026 , eprint =

    2026

  61. [61]

    2025 , eprint =

    Why does weak-OOD help? A Further Step Towards Understanding Jailbreaking VLMs , author =. 2025 , eprint =

    2025

  62. [62]

    Findings of the Association for Computational Linguistics: EMNLP 2025 , year =

    Zhang, Ziyi and Sun, Zhen and Zhang, Zongmin and Guo, Jihui and He, Xinlei , title =. Findings of the Association for Computational Linguistics: EMNLP 2025 , year =

    2025

  63. [63]

    Reference Attack: A New Cross-Modal Jailbreaking Attack against Multimodal Large Language Models

    Wang, Yulong and Fu, Yifei and Gao, Jiayi. Reference Attack: A New Cross-Modal Jailbreaking Attack against Multimodal Large Language Models. Proceedings of the 64th Annual Meeting of the A ssociation for C omputational L inguistics (Volume 1: Long Papers). 2026. doi:10.18653/v1/2026.acl-long.812

    work page doi:10.18653/v1/2026.acl-long.812 2026

  64. [64]

    Cross-modality Information Check for Detecting Jailbreaking in Multimodal Large Language Models

    Xu, Yue and Qi, Xiuyuan and Qin, Zhan and Wang, Wenjie. Cross-modality Information Check for Detecting Jailbreaking in Multimodal Large Language Models. Findings of the Association for Computational Linguistics: EMNLP 2024. 2024. doi:10.18653/v1/2024.findings-emnlp.803

    work page doi:10.18653/v1/2024.findings-emnlp.803 2024

  65. [65]

    2025 , eprint =

    VRSA: Jailbreaking Multimodal Large Language Models through Visual Reasoning Sequential Attack , author =. 2025 , eprint =

    2025

  66. [66]

    2024 , eprint =

    Jailbreaking Attack against Multimodal Large Language Model , author =. 2024 , eprint =

    2024

  67. [67]

    Yi Nian and Shenzhe Zhu and Yuehan Qin and Li Li and Ziyi Wang and Chaowei Xiao and Yue Zhao , booktitle=. Jail. 2025 , url=

    2025