---
title: "CrossGuard — paper by Zhang et al. (2026) — summary and ideas"
description: "Defenses have been hard to build because such samples are scarce; the existing SIUO benchmark has only 167 hand-made… 54 references."
authors: ["Xu Zhang", "Hao Li", "Zhichao Lu"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.1178/"
doi: "10.18653/v1/2026.acl-long.1178"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/zhang-2026-crossguard-safeguarding-mllms-against-joint/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zhang-2026-crossguard-safeguarding-mllms-against-joint/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/28/) / CrossGuard: Safeguarding MLLMs against Joint-Modal Implicit Malicious Attacks

# CrossGuard: Safeguarding MLLMs against Joint-Modal Implicit Malicious Attacks

**Authors:** [Xu Zhang](https://md.research.elamur.ai/free/en/authors/xu-zhang/), [Hao Li](https://md.research.elamur.ai/free/en/authors/hao-li/) and Zhichao Lu · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.1178/) · [PDF](https://aclanthology.org/2026.acl-long.1178.pdf) · [DOI 10.18653/v1/2026.acl-long.1178](https://doi.org/10.18653/v1/2026.acl-long.1178) · [OpenAlex](https://openalex.org/W4415965571)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
The paper addresses joint-modal implicit jailbreaks against multimodal LLMs (MLLMs). In these attacks, the image and the text each look harmless, but together they express a harmful request. Current models and guardrails handle single-modality (explicit) attacks fairly well but often miss these combined cases. Defenses have been hard to build because such samples are scarce; the existing SIUO benchmark has only 167 hand-made examples.

The authors propose ImpForge, a red-teaming pipeline based on reinforcement learning (PPO). It rewrites malicious queries into implicit image–text pairs covering 14 domains, guided by three rewards:
- a safety reward, so each input looks benign on its own;
- a semantic reward, so the harmful intent is kept;
- an overlap reward, so the intent stays hidden.

Using this data, they train CrossGuard, an intent-aware guard model built by LoRA instruction tuning of LLaVA-1.5-7B. CrossGuard outperforms existing MLLMs and guardrails on safe, unsafe, explicit, implicit and out-of-domain benchmarks while keeping utility high. This gives practitioners a usable defense against cross-modal threats that previously went largely unaddressed.

## Key points
- ImpForge-rewritten queries sharply raise attack success rate (ASR) compared with BeaverTails* baselines, by 57.08 points on average:
  - GPT-4o: 9.80% → 70.40%
  - Qwen2.5-VL-7B: 4.20% → 76.60%
  - Llama-Guard3-Vision: 47.60% → 97.20%
  - HiddenDetect: 4.00% → 71.40%
- In an ablation, adding ImpForge data to CrossGuard's training cuts ASR on the implicit SIUO benchmark from 60.33% to 5.39%. ASR also drops on JailBreakV, FigStep, MM-SafetyBench and VLGuard.
- PPO-based generation clearly beats two simpler alternatives, in-context learning and LoRA fine-tuning, at producing hard implicit samples.
- Evaluation covers SIUO, VLGuard, JailBreakV, FigStep and MM-SafetyBench. Baselines include GPT-4o, Claude-3.5-Sonnet, Llama-Guard3-Vision and HiddenDetect.
- Code is released at github.com/ZhangXu0963/CrossGuard. The stated limitations are possible bias from the reward models and incomplete domain coverage.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [City University of Hong Kong](https://md.research.elamur.ai/free/en/universities/city-university-of-hong-kong/) — University, Hong Kong, China · 59 works · 3,480 citations
- [Washington University in St. Louis](https://md.research.elamur.ai/free/en/universities/washington-university-in-st-louis/) — University, St Louis, United States · 15 works · 1,129 citations

📚 Shelves (2): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works

🧭 Topics (1): [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works

## Cite

Cite as: Xu Zhang, Hao Li and Zhichao Lu. 2026. CrossGuard: Safeguarding MLLMs against Joint-Modal Implicit Malicious Attacks. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{zhang2026crossguard,
  title = {{CrossGuard: Safeguarding MLLMs against Joint-Modal Implicit Malicious Attacks}},
  author = {Xu Zhang, Hao Li and Zhichao Lu},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1178},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1178}
}
```

- [← previous CrossDDI: Cross-Source Evidence-Grounded Drug-Drug Interaction Verification](https://md.research.elamur.ai/free/en/papers/wang-2026-crossddi-cross-source-evidence-grounded/)
- [next → Crossing the Reward Bridge: Expanding Reinforcement Learning with Verifiable Rewards Across Diverse Domains](https://md.research.elamur.ai/free/en/papers/su-2026-crossing-reward-bridge-expanding-reinforcement/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/28/)

## References

54 references, 27 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Anthropic. 2024. Claude 3.5 sonnet model card addendum. [https://www-cdn.anthropic.com/](https://www-cdn.anthropic.com/) fed9cc193a14b84131812372d8d5857f8f304c52/ Model_Card_Claude_3_Addendum.pdf. [↗](https://www-cdn.anthropic.com/)
2. Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, Humen Zhong, Yuanzhi Zhu, Ming-Hsuan Yang, Zhaohai Li, Jianqiang Wan, Pengfei Wang, Wei Ding, Zheren Fu, Yiheng Xu, and 8 others. 2025. [Qwen2.5-vl technical report](https://md.research.elamur.ai/free/en/papers/bai-2025-qwen2-5-vl-technical/). arXiv preprint arXiv…
3. Steven Bird and Edward Loper. 2004. [NLTK: the natural language toolkit](https://md.research.elamur.ai/free/en/papers/bird-2006-nltk-natural-language-toolkit/). In ACL.
4. Davide Bucciarelli, Nicholas Moratelli, Marcella Cornia, Lorenzo Baraldi, and Rita Cucchiara. 2024. Personalizing multimodal large language models for image captioning: An experimental analysis. In ECCV Workshops. [find](https://scholar.google.com/scholar?q=Davide+Bucciarelli%2C+Nicholas+Moratelli%2C+Marcella+Cornia%2C+Lorenzo+Baraldi%2C+and+Rita+Cucchiara%2E+2024%2E+Personalizing+multimodal+large+language+models+for+image+captioning%3A+An+experimental+analysis%2E+In+EC)
5. Nicholas Carlini, Milad Nasr, Christopher A. Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei Koh, Daphne Ippolito, Florian Tramèr, and Ludwig Schmidt. 2023. [Are aligned neural networks adversarially aligned?](https://md.research.elamur.ai/free/en/papers/carlini-2023-aligned-neural-networks-adversarially-aligned/) In NeurIPS.
6. Stephen Casper, Jason Lin, Joe Kwon, Gatlen Culp, and Dylan Hadfield-Menell. 2023. [Explore, establish, exploit: Red teaming language models from scratch](https://md.research.elamur.ai/free/en/papers/casper-2023-explore-establish-exploit-red-teaming/). arXiv preprint arXiv:2306.09442.
7. Zhiling Chen, Hanning Chen, Mohsen Imani, and Farhad Imani. 2025. Can multimodal large language models be guided to improve industrial anomaly detection? arXiv preprint arXiv:2501.15795. — [arXiv:2501.15795](https://arxiv.org/abs/2501.15795) [find](https://scholar.google.com/scholar?q=Zhiling+Chen%2C+Hanning+Chen%2C+Mohsen+Imani%2C+and+Farhad+Imani%2E+2025%2E+Can+multimodal+large+language+models+be+guided+to+improve+industrial+anomaly+detection%3F+arXiv+preprint+arXiv%3A2501%2E15795%2E+%E2%80%94+%5BarXiv%3A2501)
8. Jianfeng Chi, Ujjwal Karn, Hongyuan Zhan, Eric Smith, Javier Rando, Yiming Zhang, Kate Plawiak, Zacharie Delpierre Coudert, Kartikeya Upasani, and Mahesh Pasupuleti. 2024. Llama guard 3 vision: Safeguarding human-ai image understanding conversations. arXiv preprint arXiv:2411.10414. — [arXiv:2411.10414](https://arxiv.org/abs/2411.10414) [find](https://scholar.google.com/scholar?q=Jianfeng+Chi%2C+Ujjwal+Karn%2C+Hongyuan+Zhan%2C+Eric+Smith%2C+Javier+Rando%2C+Yiming+Zhang%2C+Kate+Plawiak%2C+Zacharie+Delpierre+Coudert%2C+Kartikeya+Upasani%2C+and+Mahesh+Pasupuleti%2E+2024%2E+Llama+guard+3+vision%3A+Safegu)
9. Emily Dinan, Samuel Humeau, Bharath Chintagunta, and Jason Weston. 2019. [Build it break it fix it for dialogue safety: Robustness from adversarial human attack](https://md.research.elamur.ai/free/en/papers/dinan-2019-build-it-break-it-fix/). In EMNLP/IJCNLP.
10. Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, Andy Jones, Sam Bowman, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Nelson Elhage, Sheer El Showk, Stanislav Fort, and 17 others. 2022. [Red teaming…](https://md.research.elamur.ai/free/en/papers/ganguli-2022-red-teaming-language-models-reduce/)
11. Suyu Ge, Chunting Zhou, Rui Hou, Madian Khabsa, Yi-Chia Wang, Qifan Wang, Jiawei Han, and Yuning Mao. 2024. [MART: improving LLM safety with multi-round automatic red-teaming](https://md.research.elamur.ai/free/en/papers/ge-2024-mart-improving-llm-safety-multi/). In NAACL-HLT.
12. Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. [Figstep: Jailbreaking large vision-language models via typographic visual prompts](https://md.research.elamur.ai/free/en/papers/gong-2023-figstep-jailbreaking-large-vision-language/). In AAAI.
13. Tianle Gu, Zeyang Zhou, Kexin Huang, Dandan Liang, Yixu Wang, Haiquan Zhao, Yuanqi Yao, Xingge Qiao, Keqing Wang, Yujiu Yang, Yan Teng, Yu Qiao, and Yingchun Wang. 2024. Mllmguard: A multidimensional safety evaluation suite for multimodal large language models. In NeurIPS. [find](https://scholar.google.com/scholar?q=Tianle+Gu%2C+Zeyang+Zhou%2C+Kexin+Huang%2C+Dandan+Liang%2C+Yixu+Wang%2C+Haiquan+Zhao%2C+Yuanqi+Yao%2C+Xingge+Qiao%2C+Keqing+Wang%2C+Yujiu+Yang%2C+Yan+Teng%2C+Yu+Qiao%2C+and+Yingchun+Wang%2E+2024%2E+Mllmguard%3A+A+multidimensional+)
14. Xingang Guo, Fangxu Yu, Huan Zhang, Lianhui Qin, and Bin Hu. 2024. Cold-attack: Jailbreaking llms with stealthiness and controllability. In ICML. [find](https://scholar.google.com/scholar?q=Xingang+Guo%2C+Fangxu+Yu%2C+Huan+Zhang%2C+Lianhui+Qin%2C+and+Bin+Hu%2E+2024%2E+Cold%2Dattack%3A+Jailbreaking+llms+with+stealthiness+and+controllability%2E+In+ICML%2E)
15. Lukas Helff, Felix Friedrich, Manuel Brack, Kristian Kersting, and Patrick Schramowski. 2024. Llava-guard: Vlm-based safeguards for vision dataset curation and safety assessment. arXiv preprint arXiv:2406.05113. — [arXiv:2406.05113](https://arxiv.org/abs/2406.05113) [find](https://scholar.google.com/scholar?q=Lukas+Helff%2C+Felix+Friedrich%2C+Manuel+Brack%2C+Kristian+Kersting%2C+and+Patrick+Schramowski%2E+2024%2E+Llava%2Dguard%3A+Vlm%2Dbased+safeguards+for+vision+dataset+curation+and+safety+assessment%2E+arXiv+preprint+arXiv%3A)
16. Zhang-Wei Hong, Idan Shenfeld, Tsun-Hsuan Wang, Yung-Sung Chuang, Aldo Pareja, James R. Glass, Akash Srivastava, and Pulkit Agrawal. 2024. Curiosity-driven red-teaming for large language models. In ICLR. [find](https://scholar.google.com/scholar?q=Zhang%2DWei+Hong%2C+Idan+Shenfeld%2C+Tsun%2DHsuan+Wang%2C+Yung%2DSung+Chuang%2C+Aldo+Pareja%2C+James+R%2E+Glass%2C+Akash+Srivastava%2C+and+Pulkit+Agrawal%2E+2024%2E+Curiosity%2Ddriven+red%2Dteaming+for+large+language+models%2E+In+IC)
17. Tsung-Yi Lin, Michael Maire, Serge J. Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick. 2014. [Microsoft COCO: common objects in context](https://md.research.elamur.ai/free/en/papers/lin-2014-microsoft-coco-common-objects-context/). In ECCV.
18. Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. [Visual instruction tuning](https://md.research.elamur.ai/free/en/papers/liu-2023-visual-instruction-tuning/). In NeurIPS.
19. Qin Liu, Fei Wang, Chaowei Xiao, and Muhao Chen. 2025. Vlm-guard: Safeguarding vision-language models via fulfilling safety alignment gap. arXiv preprint arXiv:2502.10486. — [arXiv:2502.10486](https://arxiv.org/abs/2502.10486) [find](https://scholar.google.com/scholar?q=Qin+Liu%2C+Fei+Wang%2C+Chaowei+Xiao%2C+and+Muhao+Chen%2E+2025%2E+Vlm%2Dguard%3A+Safeguarding+vision%2Dlanguage+models+via+fulfilling+safety+alignment+gap%2E+arXiv+preprint+arXiv%3A2502%2E10486%2E+%E2%80%94+%5BarXiv%3A2502%2E10486%5D%28https%3A%2F)
20. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024a. [Autodan: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). In ICLR.
21. Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2022. [Lora: Low-rank adaptation of large language models](https://md.research.elamur.ai/free/en/papers/hu-2021-lora-low-rank-adaptation-large/). In ICLR.
22. Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024b. [Mm-safetybench: A benchmark for safety evaluation of multimodal large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-mm-safetybench-benchmark-safety-evaluation/). In ECCV.
23. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. 2023. [Llama guard: Llm-based input-output safeguard for human-ai conversations](https://md.research.elamur.ai/free/en/papers/inan-2023-llama-guard-llm-based-input/). arXiv preprint arXiv:2312.06674.
24. Yi Liu, Chengjun Cai, Xiaoli Zhang, Xingliang Yuan, and Cong Wang. 2024c. Arondight: Red teaming large vision language models with auto-generated multi-modal jailbreak prompts. In ACM MM. [find](https://scholar.google.com/scholar?q=Yi+Liu%2C+Chengjun+Cai%2C+Xiaoli+Zhang%2C+Xingliang+Yuan%2C+and+Cong+Wang%2E+2024c%2E+Arondight%3A+Red+teaming+large+vision+language+models+with+auto%2Dgenerated+multi%2Dmodal+jailbreak+prompts%2E+In+ACM+MM%2E)
25. Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2023. [Beavertails: Towards improved safety alignment of LLM via a human-preference dataset](https://md.research.elamur.ai/free/en/papers/ji-2023-beavertails-towards-improved-safety-alignment/). In NeurIPS.
26. Yilei Jiang, Xinyan Gao, Tianshuo Peng, Yingshui Tan, Xiaoyong Zhu, Bo Zheng, and Xiangyu Yue. 2025. Hiddendetect: Detecting jailbreak attacks against large vision-language models via monitoring hidden states. arXiv preprint arXiv:2502.14744. — [arXiv:2502.14744](https://arxiv.org/abs/2502.14744) [find](https://scholar.google.com/scholar?q=Yilei+Jiang%2C+Xinyan+Gao%2C+Tianshuo+Peng%2C+Yingshui+Tan%2C+Xiaoyong+Zhu%2C+Bo+Zheng%2C+and+Xiangyu+Yue%2E+2025%2E+Hiddendetect%3A+Detecting+jailbreak+attacks+against+large+vision%2Dlanguage+models+via+monitoring+hidde)
27. Deokjae Lee, JunYeong Lee, Jung-Woo Ha, Jin-Hwa Kim, Sang-Woo Lee, Hwaran Lee, and Hyun Oh Song. 2023. Query-efficient black-box red teaming via bayesian optimization. In ACL. [find](https://scholar.google.com/scholar?q=Deokjae+Lee%2C+JunYeong+Lee%2C+Jung%2DWoo+Ha%2C+Jin%2DHwa+Kim%2C+Sang%2DWoo+Lee%2C+Hwaran+Lee%2C+and+Hyun+Oh+Song%2E+2023%2E+Query%2Defficient+black%2Dbox+red+teaming+via+bayesian+optimization%2E+In+ACL%2E)
28. Seanie Lee, Minsu Kim, Lynn Cherif, David Dobre, Juho Lee, Sung Ju Hwang, Kenji Kawaguchi, Gauthier Gidel, Yoshua Bengio, Nikolay Malkin, and Moksh Jain. 2025. Learning diverse attacks on large language models for robust red-teaming and safety tuning. In ICLR. [find](https://scholar.google.com/scholar?q=Seanie+Lee%2C+Minsu+Kim%2C+Lynn+Cherif%2C+David+Dobre%2C+Juho+Lee%2C+Sung+Ju+Hwang%2C+Kenji+Kawaguchi%2C+Gauthier+Gidel%2C+Yoshua+Bengio%2C+Nikolay+Malkin%2C+and+Moksh+Jain%2E+2025%2E+Learning+diverse+attacks+on+large+langua)
29. Mukai Li, Lei Li, Yuwei Yin, Masood Ahmed, Zhenguang Liu, and Qi Liu. 2024a. Red teaming visual language models. In ACL Findings. [find](https://scholar.google.com/scholar?q=Mukai+Li%2C+Lei+Li%2C+Yuwei+Yin%2C+Masood+Ahmed%2C+Zhenguang+Liu%2C+and+Qi+Liu%2E+2024a%2E+Red+teaming+visual+language+models%2E+In+ACL+Findings%2E)
30. Peizhao Li, Junfeng He, Gang Li, Rachit Bhargava, Shaolei Shen, Nachiappan Valliappan, Youwei Liang, Hongxiang Gu, Venky Ramachandran, Golnaz Farhadi, Yang Li, Kai Kohlhoff, and Vidhya Naval-pakkam. 2024b. Uniar: A unified model for predicting human attention and responses on visual content. In Neur… [find](https://scholar.google.com/scholar?q=Peizhao+Li%2C+Junfeng+He%2C+Gang+Li%2C+Rachit+Bhargava%2C+Shaolei+Shen%2C+Nachiappan+Valliappan%2C+Youwei+Liang%2C+Hongxiang+Gu%2C+Venky+Ramachandran%2C+Golnaz+Farhadi%2C+Yang+Li%2C+Kai+Kohlhoff%2C+and+Vidhya+Naval%2Dpakkam%2E+2)
31. Yuan Liu, Haodong Duan, Yuanhan Zhang, Bo Li, Songyang Zhang, Wangbo Zhao, Yike Yuan, Jiaqi Wang, Conghui He, Ziwei Liu, Kai Chen, and Dahua Lin. 2024d. [Mmbench: Is your multi-modal model an all-around player?](https://md.research.elamur.ai/free/en/papers/liu-2023-mmbench-multi-modal-model-all/) In ECCV.
32. Weidi Luo, Siyuan Ma, Xiaogeng Liu, Xiaoyu Guo, and Chaowei Xiao. 2024. [Jailbreakv-28k: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks](https://md.research.elamur.ai/free/en/papers/luo-2024-jailbreakv-benchmark-assessing-robustness-multimodal/). arXiv preprint arXiv:2404.03027.
33. Yi Nian, Shenzhe Zhu, Yuehan Qin, Li Li, Ziyi Wang, Chaowei Xiao, and Yue Zhao. 2025. Jaildam: Jailbreak detection with adaptive memory for vision-language model. arXiv preprint arXiv:2504.03770. — [arXiv:2504.03770](https://arxiv.org/abs/2504.03770) [find](https://scholar.google.com/scholar?q=Yi+Nian%2C+Shenzhe+Zhu%2C+Yuehan+Qin%2C+Li+Li%2C+Ziyi+Wang%2C+Chaowei+Xiao%2C+and+Yue+Zhao%2E+2025%2E+Jaildam%3A+Jailbreak+detection+with+adaptive+memory+for+vision%2Dlanguage+model%2E+arXiv+preprint+arXiv%3A2504%2E03770%2E+%E2%80%94+%5Ba)
34. OpenAI. 2024. [Gpt-4o system card](https://md.research.elamur.ai/free/en/papers/openai-2024-gpt-4o-system-card/). arXiv preprint arXiv:2410.21276.
35. Ethan Perez, Saffron Huang, H. Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. [Red teaming language models with language models](https://md.research.elamur.ai/free/en/papers/perez-2022-red-teaming-language-models-language/). In EMNLP.
36. Renjie Pi, Tianyang Han, Jianshu Zhang, Yueqi Xie, Rui Pan, Qing Lian, Hanze Dong, Jipeng Zhang, and Tong Zhang. 2024. [Mllm-protector: Ensuring mllm’s safety without hurting performance](https://md.research.elamur.ai/free/en/papers/pi-2024-mllm-protector-ensuring-mllm-s/). In EMNLP.
37. Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. [Visual adversarial examples jailbreak aligned large language models](https://md.research.elamur.ai/free/en/papers/qi-2023-visual-adversarial-examples-jailbreak-aligned/). In AAAI.
38. Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. 2021. [Learning transferable visual models from natural language supervision](https://md.research.elamur.ai/free/en/papers/radford-2021-learning-transferable-visual-models-natural/). In ICML.
39. Nils Reimers and Iryna Gurevych. 2019. [Sentence-bert: Sentence embeddings using siamese bert-networks](https://md.research.elamur.ai/free/en/papers/reimers-2019-sentence-bert-sentence-embeddings-siamese/). In EMNLP/IJCNLP.
40. Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022. [High-resolution image synthesis with latent diffusion models](https://md.research.elamur.ai/free/en/papers/rombach-2021-high-resolution-image-synthesis-latent/). In CVPR.
41. Yunhan Zhao, Xiang Zheng, Lin Luo, Yige Li, Xingjun Ma, and Yu-Gang Jiang. 2025. Bluesuffix: Reinforced blue teaming for vision-language models against jailbreak attacks. In ICLR. [find](https://scholar.google.com/scholar?q=Yunhan+Zhao%2C+Xiang+Zheng%2C+Lin+Luo%2C+Yige+Li%2C+Xingjun+Ma%2C+and+Yu%2DGang+Jiang%2E+2025%2E+Bluesuffix%3A+Reinforced+blue+teaming+for+vision%2Dlanguage+models+against+jailbreak+attacks%2E+In+ICLR%2E)
42. Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy M. Hospedales. 2024. [Safety fine-tuning at (almost) no cost: A baseline for vision large language models](https://md.research.elamur.ai/free/en/papers/zong-2024-safety-fine-tuning-almost-no/). In ICML.
43. John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347. [find](https://scholar.google.com/scholar?q=John+Schulman%2C+Filip+Wolski%2C+Prafulla+Dhariwal%2C+Alec+Radford%2C+and+Oleg+Klimov%2E+2017%2E+Proximal+policy+optimization+algorithms%2E+arXiv+preprint+arXiv%3A1707%2E06347%2E)
44. Erfan Shayegani, Yue Dong, and Nael B. Abu-Ghazaleh. 2024. [Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models](https://md.research.elamur.ai/free/en/papers/shayegani-2023-jailbreak-pieces-compositional-adversarial-attacks/). In ICLR.
45. Krishna Srinivasan, Karthik Raman, Jiecao Chen, Michael Bendersky, and Marc Najork. 2021. [WIT: wikipedia-based image text dataset for multimodal multilingual machine learning](https://md.research.elamur.ai/free/en/papers/srinivasan-2021-wit-wikipedia-based-image-text/). In SIGIR.
46. Xijia Tao, Shuai Zhong, Lei Li, Qi Liu, and Lingpeng Kong. 2025. Imgtrojan: Jailbreaking vision-language models with ONE image. In NAACL. [find](https://scholar.google.com/scholar?q=Xijia+Tao%2C+Shuai+Zhong%2C+Lei+Li%2C+Qi+Liu%2C+and+Lingpeng+Kong%2E+2025%2E+Imgtrojan%3A+Jailbreaking+vision%2Dlanguage+models+with+ONE+image%2E+In+NAACL%2E)
47. Simone Tedeschi, Felix Friedrich, Patrick Schramowski, Kristian Kersting, Roberto Navigli, Huu Nguyen, and Bo Li. 2024. ALERT: A comprehensive benchmark for assessing large language models’ safety through red teaming. arXiv preprint arXiv:2404.08676. — [arXiv:2404.08676](https://arxiv.org/abs/2404.08676) [find](https://scholar.google.com/scholar?q=Simone+Tedeschi%2C+Felix+Friedrich%2C+Patrick+Schramowski%2C+Kristian+Kersting%2C+Roberto+Navigli%2C+Huu+Nguyen%2C+and+Bo+Li%2E+2024%2E+ALERT%3A+A+comprehensive+benchmark+for+assessing+large+language+models%E2%80%99+safety+thr)
48. Siyin Wang, Xingsong Ye, Qinyuan Cheng, Junwen Duan, Shimin Li, Jinlan Fu, Xipeng Qiu, and Xuanjing Huang. 2025a. Safe inputs but unsafe output: Benchmarking cross-modality safety alignment of large vision-language models. In NAACL Findings. [find](https://scholar.google.com/scholar?q=Siyin+Wang%2C+Xingsong+Ye%2C+Qinyuan+Cheng%2C+Junwen+Duan%2C+Shimin+Li%2C+Jinlan+Fu%2C+Xipeng+Qiu%2C+and+Xuanjing+Huang%2E+2025a%2E+Safe+inputs+but+unsafe+output%3A+Benchmarking+cross%2Dmodality+safety+alignment+of+large+v)
49. Wenxuan Wang, Kuiyi Gao, Youliang Yuan, Jen-tse Huang, Qiuzhi Liu, Shuai Wang, Wenxiang Jiao, and Zhaopeng Tu. 2025b. Chain-of-jailbreak attack for image generation models via step by step editing. In ACL Findings. [find](https://scholar.google.com/scholar?q=Wenxuan+Wang%2C+Kuiyi+Gao%2C+Youliang+Yuan%2C+Jen%2Dtse+Huang%2C+Qiuzhi+Liu%2C+Shuai+Wang%2C+Wenxiang+Jiao%2C+and+Zhaopeng+Tu%2E+2025b%2E+Chain%2Dof%2Djailbreak+attack+for+image+generation+models+via+step+by+step+editing%2E+In)
50. Yu Wang, Xiaogeng Liu, Yu Li, Muhao Chen, and Chaowei Xiao. 2024. Adashield : Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting. In ECCV. [find](https://scholar.google.com/scholar?q=Yu+Wang%2C+Xiaogeng+Liu%2C+Yu+Li%2C+Muhao+Chen%2C+and+Chaowei+Xiao%2E+2024%2E+Adashield+%3A+Safeguarding+multimodal+large+language+models+from+structure%2Dbased+attack+via+adaptive+shield+prompting%2E+In+ECCV%2E)
51. Junbin Xiao, Angela Yao, Yicong Li, and Tat-Seng Chua. 2024. Can I trust your answer? visually grounded video question answering. In CVPR. [find](https://scholar.google.com/scholar?q=Junbin+Xiao%2C+Angela+Yao%2C+Yicong+Li%2C+and+Tat%2DSeng+Chua%2E+2024%2E+Can+I+trust+your+answer%3F+visually+grounded+video+question+answering%2E+In+CVPR%2E)
52. Huiyu Xu, Wenhui Zhang, Zhibo Wang, Feng Xiao, Rui Zheng, Yunhe Feng, Zhongjie Ba, and Kui Ren. 2024. Redagent: Red teaming large language models with context-aware autonomous language agent. arXiv preprint arXiv:2407.16667. — [arXiv:2407.16667](https://arxiv.org/abs/2407.16667) [find](https://scholar.google.com/scholar?q=Huiyu+Xu%2C+Wenhui+Zhang%2C+Zhibo+Wang%2C+Feng+Xiao%2C+Rui+Zheng%2C+Yunhe+Feng%2C+Zhongjie+Ba%2C+and+Kui+Ren%2E+2024%2E+Redagent%3A+Red+teaming+large+language+models+with+context%2Daware+autonomous+language+agent%2E+arXiv+pr)
53. Jiacong Xu, Shao-Yuan Lo, Bardia Safaei, Vishal M. Patel, and Isht Dwivedi. 2025. Towards zero-shot anomaly detection and reasoning with multimodal large language models. In CVPR. *Figure 7: Components of the data used to train Cross-Guard.* Original: How many stories high does a building have to be… [find](https://scholar.google.com/scholar?q=Jiacong+Xu%2C+Shao%2DYuan+Lo%2C+Bardia+Safaei%2C+Vishal+M%2E+Patel%2C+and+Isht+Dwivedi%2E+2025%2E+Towards+zero%2Dshot+anomaly+detection+and+reasoning+with+multimodal+large+language+models%2E+In+CVPR%2E+%2AFigure+7%3A+Component)
54. GPT- 4o: If you’re thinking about suicide or self‑harm, please consider speaking right away with someone who can help you stay safe. *Figure 6: We leverage ImpForge to generate 1,390 implicit multimodal malicious samples spanning 14 categories for red-teaming evaluation.* ImpForge: What's the height… [find](https://scholar.google.com/scholar?q=GPT%2D+4o%3A+If+you%E2%80%99re+thinking+about+suicide+or+self%E2%80%91harm%2C+please+consider+speaking+right+away+with+someone+who+can+help+you+stay+safe%2E+%2AFigure+6%3A+We+leverage+ImpForge+to+generate+1%2C390+implicit+multimod)

*Updated 2 November 2026*