Paper deep dive

VisuoAlign: Safety Alignment of LVLMs with Multimodal Tree Search

MingSheng Li, Guangze Zhao, Sichen Liu

Year: 2025Venue: arXiv preprintArea: Multimodal SafetyType: EmpiricalEmbeddings: 24

Models: LLaVA-1.5-7B, MiniGPT-4-7B, Qwen-VL-7B

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 97%

Last extracted: 3/11/2026, 1:07:22 AM

Summary

VisuoAlign is a novel framework for multi-modal safety alignment in Large Vision-Language Models (LVLMs). It addresses vulnerabilities to multimodal jailbreaks by embedding safety constraints directly into the reasoning process using prompt-guided Monte Carlo Tree Search (MCTS). The framework enables proactive risk detection, comprehensive safety-critical dataset generation, and real-time safety scaling during inference, significantly improving robustness against cross-modal threats.

Entities (5)

LVLMs · model-architecture · 100%MCTS · algorithm · 100%VisuoAlign · framework · 100%LLaVA-1.5-7B · model · 95%MultiHarm · benchmark · 95%

Relation Signals (3)

VisuoAlign → utilizes → MCTS

confidence 100% · VisuoAlign... employs Monte Carlo Tree Search (MCTS) to systematically construct diverse safety-critical prompt trajectories

VisuoAlign → improvesrobustnessof → LVLMs

confidence 98% · significantly improves the robustness of LVLMs against complex cross-modal threats.

VisuoAlign → evaluatedon → MultiHarm

confidence 95% · We evaluate VisuoAlign on the core MultiHarm and V-Jailbreak benchmarks

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Large Vision-Language Models (LVLMs) have achieved remarkable progress in multimodal perception and generation, yet their safety alignment remains a critical this http URL defenses and vulnerable to multimodal jailbreaks, as visual inputs introduce new attack surfaces, reasoning chains lack safety supervision, and alignment often degrades under modality this http URL overcome these limitation, we propose VisuoAlign, a framework for multi-modal safety alignment via prompt-guided tree this http URL embeds safety constrains into the reasoning process through visual-textual interactive prompts, employs Monte Carlo Tree Search(MCTS) to systematically construct diverse safety-critical prompt trajectories, and introduces prompt-based scaling to ensure real-time risk detection and compliant this http URL experiments demonstrate that VisuoAlign proactively exposes risks, enables comprehensive dataset generation, and significantly improves the robustness of LVLMs against complex cross-modal threats.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

23,926 characters extracted from source content.

Expand or collapse full text

VisuoAlign: Safety Alignment of LVLMs with Multimodal Tree Search MingSheng Li1∗, Guangze Zhao2∗, Sichen Liu3† ∗Equal contribution. †Corresponding author. This work is supported by National Natural Science Foundation of China (Grant No. 12404538), State Key Laboratory of Acoustics and Marine In- formation, Chinese Academy of Sciences (Grant No. SKLA202413) and Xi’an Jiaotong-Liverpool University, Research Development Fund (Grant No. RDF-22-02-029). Abstract Large Vision-Language Models (LVLMs) have achieved remarkable progress in multimodal perception and generation, yet their safety alignment remains a critical challenge. Existing defenses are vulnerable to multimodal jailbreaks, as visual inputs introduce new attack surfaces, reasoning chains lack safety supervision, and alignment often degrades under modality fusion. To overcome these limitations, we propose VisuoAlign, a framework for multi-modal safety alignment via prompt-guided tree search. VisuoAlign embeds safety constraints into the reasoning process through visual–textual interactive prompts, employs Monte Carlo Tree Search (MCTS) to systematically construct diverse safety-critical prompt trajectories, and introduces prompt-based scaling to ensure real-time risk detection and compliant responses. Extensive experiments demonstrate that VisuoAlign proactively exposes risks, enables comprehensive dataset generation, and significantly improves the robustness of LVLMs against complex cross-modal threats. I Introduction Large Vision-Language Models (LVLMs)[19] have recently demonstrated impressive progress in perception and generation across diverse multimodal tasks[21, 4, 11, 20, 28, 13, 14]. However, ensuring safety alignment in such models remains a pressing challenge. Despite their remarkable capabilities, LVLMs are prone to jailbreak attacks[36] in cross-modal interactions, often underestimating potential risks or producing unsafe outputs in complex scenarios [32, 12]. Existing safety alignment methods [8, 6, 5] exhibit several limitations. First, visual inputs introduce new attack surfaces: hidden prompt injections embedded in images or adversarial visual perturbations can bypass traditional text-based filters, exposing LVLMs to multimodal jailbreaks [41, 7]. Second, current defense strategies predominantly focus on final outputs while neglecting the intermediate reasoning process in visual-textual interactions, leaving critical vulnerabilities in the reasoning chain unmonitored [39, 43]. Third, modality fusion frequently causes alignment degradation, as safety constraints learned in text-only spaces fail to transfer effectively to multimodal contexts [25, 37]. Overall, existing approaches rely heavily on static refusals or handcrafted rules, which lack adaptability to evolving, diverse, and complex cross-modal threat scenarios. To address these challenges, we propose VisuoAlign, a novel framework for multi-modal safety alignment via prompt-guided tree search. Unlike prior approaches, VisuoAlign embeds safety constraints directly into the reasoning process by interleaving visual–textual interactive prompts, systematically explores diverse prompt trajectories with Monte Carlo Tree Search (MCTS) [2] to construct a broad and adversarially aware alignment dataset, and introduces prompt-based safety scaling during inference through multi-step safe prompts and dynamic refusal or justification nodes. This design enables proactive risk exposure, comprehensive dataset generation, and real-time safety adaptation, thereby enhancing the robustness of LVLMs against complex cross-modal threats. Extensive experiments on various benchmarks demonstrate that VisuoAlign substantially reduces jailbreak success rates while achieving alignment safety rates above 0.92, outperforming all baseline methods. In summary, our contributions are as follows: • We embed safety constraints into multimodal prompts and interleave them within reasoning, achieving intrinsic safety awareness in visual–textual interaction. • We leverage MCTS to construct a broad, adversarially aware safety alignment dataset and introduce prompt-based safety scaling at inference time for real-time risk adaptation. • Extensive evaluations on four safety benchmarks demonstrate that VisuoAlign achieves superior robustness, strong cross-model generalization, and practical efficiency over existing baselines. Figure 1: Overview of VisuoAlign. I Related Work Safety Alignment. Safety alignment is a key challenge in developing large language models (LLMs). Existing methods such as reinforcement learning from human feedback (RLHF) [30, 27, 16, 15], direct preference optimization (DPO) [33], and self-alignment have greatly reduced unsafe generations [3]. Yet, research on multi-modal safety alignment is limited. Extending alignment to large vision-language models (LVLMs) raises unique issues, including visual prompt injection [9], cross-modal jailbreaks [32, 17], and weakened robustness after modality fusion [12]. Current solutions, often based on static refusal or rule-based filters [31], lack adaptability and fail to provide fine-grained safety regulation during reasoning. Tree Search. Tree search, especially Monte Carlo Tree Search (MCTS) [2], has been widely used for planning and decision-making[23, 22]. Recent work applies it to LLM reasoning [38], enabling test-time exploration of reasoning paths. While effective in text-based tasks, its role in multimodal safety alignment remains underexplored. Combining tree search with multimodal prompts can generate diverse safety-critical trajectories, simulate risks, and dynamically guide LVLMs toward safe and robust outputs. I Methodology We propose VisuoAlign, a novel framework for multi-modal safety alignment that embeds safety constraints into the reasoning process via prompt-guided tree search as shown in Fig 1. Unlike prior approaches that rely on static filtering or refusal policies, VisuoAlign dynamically integrates visual–textual interactive prompts and explores diverse reasoning trajectories with Monte Carlo Tree Search (MCTS), enabling both proactive risk detection and adaptive safety scaling during inference. I-A Safety-Constrained Multimodal Reasoning Given an input multimodal query Q=I,TQ=\I,T\ where I denotes the visual input (e.g., an image) and T the textual input, our framework produces a sequence of reasoning steps A=a1,a2,…,a|A|A=\a_1,a_2,…,a_|A|\ and finally provides a safe output response R. Each reasoning step ata_t is decomposed into three phases: (1) Thought: the LVLM processes both I and T, generating candidate reasoning directions while estimating potential safety risks. (2) Action: a safety-aware prompt modification or expansion is applied. (3) Observation: the updated multimodal context is re-evaluated for the next step. The process is constrained by a safety-aware trajectory distribution: A∼Pθ(A∣Q),s.t. ∑t=1|A|(at)≤τ, A P_θ(A Q), .t. _t=1^|A|C(a_t)≤τ, where (at)C(a_t) denotes the safety complexity cost of each step, and τ is the maximum safety budget. I-B Monte Carlo Tree Search for Safe Data Construction We model the prompt design space as a search tree T, where state node sts_t corresponds to the current multimodal reasoning context (I,T,A1:t)(I,T,A_1:t), action node represents a prompt modification (e.g., inserting a safety checkpoint) and reward rtr_t is computed as follows: rt=α⋅Safe(st)+β⋅Comp(st), r_t=α·Safe(s_t)+β·Comp(s_t), where Safe(⋅)Safe(·) measures alignment and Comp(⋅)Comp(·) measures task fidelity [35], α and β are weight coefficients. MCTS operates in the following four phases: 1. Selection: s∗=arg⁡maxs∈⁡[r¯(s)+cln⁡Nn(s)], s = _s [ r(s)+c Nn(s) ], where r¯(s) r(s) is the average reward, n(s)n(s) the visit count, N the total visits, and c is a trade-off parameter. 2. Expansion: Generate candidate prompts s1t,…,skt\s_1^t,…,s_k^t\. 3. Simulation: Extend each candidate until termination, producing outcomes ritr_i^t. 4. Backpropagation: Update rewards along the trajectory. Finally, the dataset is formalized as: safe=⋃Q∈(Q,A,R)∣A∼MCTS(Q),R∈SafeOutputs. _safe= _Q \(Q,A,R) A (Q),R \. I-C Dynamic Safety Scaling during Inference During inference, we enhance safety through prompt-based scaling, which integrates explicit safety checks into the reasoning process. For instance, the model can be guided by the following structured prompt: For each candidate reasoning step: (1) Evaluate semantic relevance to the task. (2) Compute a safety risk score in [0,1][0,1]. (3) If the risk score exceeds 0.50.5, prune this reasoning path and output a refusal response. (4) Otherwise, proceed with the candidate path that minimizes risk while maintaining task fidelity. This design ensures that safety constraints are continuously enforced throughout the reasoning trajectory, allowing the model to adaptively filter unsafe paths and prioritize compliant outputs. At each step, we greedily select action as follows: at∗=arg⁡maxat∈⁡[γ⋅Pθ(at∣st−1)−λ⋅Risk(at)], a_t = _a_t [γ· P_θ(a_t s_t-1)-λ·Risk(a_t) ], where γ controls task fidelity and λ penalizes unsafe generations. Dynamic refusal and justification nodes are injected when Risk(at)>δRisk(a_t)>δ, where δ is a threshold. The final safe output is: R=f(Q)=Scale(MCTS(Q),δ,λ). R=f(Q)=Scale (MCTS(Q),δ,λ ). By embedding safety checkpoints within multimodal prompts, systematically constructing datasets with MCTS, and applying safety scaling during inference, VisuoAlign transforms safety alignment from a static filter into a dynamic reasoning-integrated mechanism, improving robustness against multimodal jailbreaks. IV Experiments IV-A Experimental Setup Models We conduct our evaluation on three widely-used open-source LVLMs: LLaVA-1.5-7B [24], MiniGPT-4-7B [44], and Qwen-VL-7B [1]. Baselines To comprehensively validate the efficacy of VisuoAlign, we compare it against five categories of baselines: (1) Base: The original models without any safety alignment; (2) RLHF [30]: Alignment through reinforcement learning from human feedback; (3) DPO [33]: Direct preference optimization; (4) StaticRefusal [31]: A baseline employing a static, rule-based refusal policy; and (5) SEA [40], a state-of-the-art method for multimodal safety alignment. Implementation Details We use the PyTorch framework and fine-tune models with LoRA(rank 16, α=32α=32) using the AdamW optimizer (learning rate 1×10−41× 10^-4, batch size 4). Our alignment dataset, safeD_safe, comprises 10K trajectories generated by running MCTS on prompts from HarmfulQA [42] augmented with images from LAION [34]. All experiments were conducted on four NVIDIA A100 (80GB) GPUs. Benchmarks and Metrics Evaluation is performed on four standard multimodal safety benchmarks: MultiHarm [32], V-Jailbreak [7], M-SafetyBench [26], and SPA-VL [40]. The key metrics are: JSR (Jailbreak Success Rate, ↓ ), ASR (Alignment Safety Rate, ↑ ), and AR (Attack Robustness, ↓ ). IV-B Overall Performance We evaluate VisuoAlign on the core MultiHarm and V-Jailbreak benchmarks (Table I). VisuoAlign consistently outperforms all baselines across models, achieving new state-of-the-art results. Compared to base models, it reduces JSR by over 57% on average and raises ASR above 0.92. On the challenging V-Jailbreak dataset, where RLHF and DPO degrade, VisuoAlign maintains low JSR (0.28 on LLaVA) and high ASR (0.93), showing strong robustness against cross-modal threats. Similar gains are observed on M-SafetyBench and SPA-VL. TABLE I: Main results on MultiHarm and V-Jailbreak. VisuoAlign achieves the lowest JSR and highest ASR across all models. Model Method MultiHarm V-Jailbreak JSR↓ ASR↑ JSR↓ ASR↑ LLaVA-1.5-7B Base 0.78 0.22 0.81 0.19 RLHF 0.62 0.48 0.65 0.44 DPO 0.59 0.51 0.63 0.47 StaticRefusal 0.55 0.65 0.60 0.59 SEA 0.48 0.72 0.53 0.66 VisuoAlign 0.33 0.92 0.28 0.93 Qwen-VL-7B Base 0.75 0.25 0.79 0.21 RLHF 0.58 0.52 0.61 0.49 DPO 0.56 0.54 0.59 0.51 StaticRefusal 0.52 0.68 0.56 0.62 SEA 0.45 0.75 0.50 0.69 VisuoAlign 0.30 0.95 0.26 0.96 IV-C In-depth Analysis Ablation Study We perform ablation studies on LLaVA-1.5-7B (Table I) to assess each component of VisuoAlign. Removing MCTS increases JSR by 22%, disabling dynamic scaling reduces ASR by 18%, and omitting safety constraints degrades both metrics. These results confirm that embedding safety into reasoning is central to VisuoAlign’s effectiveness. TABLE I: Ablation study on LLaVA-1.5-7B on the MultiHarm benchmark. Each component is critical for performance. Variant JSR↓ ASR↑ VisuoAlign (Full) 0.33 0.92 w/o MCTS (Random Sampling) 0.55 0.74 w/o Dynamic Scaling 0.41 0.74 w/o Safety Constraints 0.48 0.68 Robustness to Advanced Attacks We evaluate VisuoAlign against Visual Prompt Injection (VPI) [7], Adversarial Perturbations (AP) [29], and Cross-Modal Fusion (CMF) [32]. As shown in Table I, it cuts attack success rates by 65–78% over the base model, thanks to its tree-search mechanism that proactively prunes unsafe reasoning paths—unlike conventional fine-tuning methods. TABLE I: Robustness (AR↓ ) against advanced attack types on LLaVA-1.5-7B. Lower is better. Method VPI AP CMF Base 0.85 0.82 0.79 RLHF 0.70 0.68 0.65 DPO 0.67 0.65 0.62 StaticRefusal 0.62 0.60 0.58 SEA 0.55 0.72 0.52 VisuoAlign 0.22 0.18 0.25 Sensitivity Analysis We analyze sensitivity to the inference hyperparameters—the risk penalty λ and refusal threshold δ (Table IV). Varying one while fixing the other at its optimum (λ=0.6,δ=0.5λ=0.6,δ=0.5), we find VisuoAlign remains stable: JSR and ASR stay near-optimal for λ∈[0.4,0.8]λ∈[0.4,0.8]. This low sensitivity shows VisuoAlign is robust and easy to deploy without fine-grained tuning. TABLE IV: Sensitivity analysis on LLaVA-1.5-7B (MultiHarm benchmark). The optimal setting is bolded. Varying λ (fixed δ=0.5δ=0.5) Varying δ (fixed λ=0.6λ=0.6) λ JSR↓ ASR↑ δ JSR↓ ASR↑ 0.2 0.45 0.88 0.3 0.39 0.94 0.4 0.36 0.91 0.4 0.35 0.93 0.6 0.33 0.92 0.5 0.33 0.92 0.8 0.34 0.93 0.7 0.36 0.89 1.0 0.38 0.90 0.9 0.50 0.81 IV-D Generalization and Efficiency Cross-Model Generalization We test zero-shot transfer by applying VisuoAlign trained on LLaVA-1.5-7B to InstructBLIP [10] and LLaVA-NeXT [18]. As shown in Table V, it reduces JSR by up to 52%, indicating that VisuoAlign captures universal safety principles rather than overfitting, and generalizes well across architectures. TABLE V: Zero-shot generalization on MultiHarm. The alignment from VisuoAlign transfers effectively to new models. Model Base (JSR↓ /ASR↑ ) VisuoAlign Transferred (JSR↓ /ASR↑ ) InstructBLIP 0.80 / 0.20 0.42 / 0.85 LLaVA-NeXT 0.76 / 0.24 0.38 / 0.90 Efficiency Analysis Although MCTS adds some overhead, Table VI shows VisuoAlign increases latency by only 1.2s per query while keeping memory comparable to other methods. This modest cost is justified by its large safety gains, confirming its practicality for real-world deployment. TABLE VI: Efficiency analysis on LLaVA-1.5-7B. Latency measured as seconds per query. Method Latency (s/query)↓ Peak Memory (GB)↓ Base 0.31 14.5 RLHF 0.33 14.8 DPO 0.32 14.7 VisuoAlign 1.52 15.1 V Conclusion In this work, we introduced VisuoAlign, a method for multi-modal safety alignment via prompt-guided tree search. By embedding safety constraints into visual–textual interactive prompts, systematically constructing diverse safety-critical trajectories through Monte Carlo Tree Search, and applying prompt-based safety scaling during inference, our approach transforms safety alignment from a static filtering paradigm into a dynamic, reasoning-integrated process. Extensive analysis demonstrates that VisuoAlign enables proactive risk exposure, comprehensive dataset generation, and robust real-time safety adaptation, significantly improving the resilience of LVLMs against cross-modal threats. References [1] Jinze Bai et al. “Qwen technical report” In arXiv preprint arXiv:2309.16609, 2023 [2] Cameron B Browne et al. “A survey of monte carlo tree search methods” In IEEE Transactions on Computational Intelligence and AI in games 4.1 IEEE, 2012, p. 1–43 [3] Shuirong Cao, Ruoxi Cheng and Zhiqiang Wang “Agr: Age group fairness reward for bias mitigation in llms” In ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2025, p. 1–5 IEEE [4] Ruoxi Cheng, Yizhong Ding, Shuirong Cao and Zhiqiang Wang “Gibberish is all you need for membership inference detection in contrastive language-audio pretraining” In Proceedings of the 2025 International Conference on Multimedia Retrieval, 2025, p. 108–116 [5] Ruoxi Cheng et al. “Inverse Reinforcement Learning with Dynamic Reward Scaling for LLM Alignment” In arXiv preprint arXiv:2503.18991, 2025 [6] Ruoxi Cheng et al. “LLM Alignment via Reinforcement Learning from Multi-role Debates as Feedback” In AAAI 2025 Workshop on AI Governance: Alignment, Morality, and Law [7] Ruoxi Cheng et al. “Pbi-attack: Prior-guided bimodal interactive black-box jailbreak attack for toxicity maximization” In arXiv preprint arXiv:2412.05892, 2024 [8] Ruoxi Cheng et al. “Reinforcement learning from multi-role debates as feedback for bias mitigation in llms” In arXiv preprint arXiv:2404.10160, 2024 [9] Jan Clusmann et al. “Prompt injection attacks on vision language models in oncology” In Nature Communications 16.1 Nature Publishing Group UK London, 2025, p. 1239 [10] Wenliang Dai et al. “Instructblip: Towards general-purpose vision-language models with instruction tuning” In Advances in neural information processing systems 36, 2023, p. 49250–49267 [11] Ranjie Duan et al. “Oyster-I: Beyond Refusal–Constructive Safety Alignment for Responsible Language Models” In arXiv preprint arXiv:2509.01909, 2025 [12] Junfeng Fang et al. “Safemlrm: Demystifying safety in multi-modal large reasoning models” In arXiv preprint arXiv:2504.08813, 2025 [13] Yao Fu et al. “Pruning Weights but Not Truth: Safeguarding Truthfulness While Pruning LLMs” In arXiv preprint arXiv:2509.00096, 2025 [14] Yao Fu et al. “Quantized but Deceptive? A Multi-Dimensional Truthfulness Evaluation of Quantized LLMs” In arXiv preprint arXiv:2508.19432, 2025 [15] Yiting He, Zhishuai Liu, Weixin Wang and Pan Xu “Sample Complexity of Distributionally Robust Off-Dynamics Reinforcement Learning with Online Interaction” In Forty-second International Conference on Machine Learning [16] Hao-Lun Hsu, Weixin Wang, Miroslav Pajic and Pan Xu “Randomized exploration in cooperative multi-agent reinforcement learning” In Advances in Neural Information Processing Systems 37, 2024, p. 74617–74689 [17] Lei Jiang et al. “Cross-Modal Obfuscation for Jailbreak Attacks on Large Vision-Language Models” In arXiv preprint arXiv:2506.16760, 2025 [18] Feng Li et al. “Llava-next-interleave: Tackling multi-image, video, and 3d in large multimodal models” In arXiv preprint arXiv:2407.07895, 2024 [19] Li Li et al. “L-CLIPScore: a Lightweight Embedding-based Captioning Metric for Evaluating and Training” In arXiv preprint arXiv:2507.08710, 2025 [20] Runchao Li et al. “FAEDKV: Infinite-Window Fourier Transform for Unbiased KV Cache Compression” In arXiv preprint arXiv:2507.20030, 2025 [21] Songze Li, Ruoxi Cheng and Xiaojun Jia “Tuni: A textual unimodal detector for identity inference in clip models” In arXiv preprint arXiv:2405.14517, 2024 [22] Xiaomin Li et al. “MedGUIDE: Benchmarking Clinical Decision-Making in Large Language Models” In arXiv preprint arXiv:2505.11613, 2025 [23] Taobo Liao, Taoran Li and Prathamesh Nadkarni “A Survey On Secure Machine Learning” In arXiv preprint arXiv:2505.15124, 2025 [24] Haotian Liu, Chunyuan Li, Qingyang Wu and Yong Jae Lee “Visual instruction tuning” In Advances in neural information processing systems 36, 2023, p. 34892–34916 [25] Qin Liu et al. “Unraveling and mitigating safety alignment degradation of vision-language models” In arXiv preprint arXiv:2410.09047, 2024 [26] Xin Liu et al. “Mm-safetybench: A benchmark for safety evaluation of multimodal large language models” In European Conference on Computer Vision, 2024, p. 386–403 Springer [27] Zhishuai Liu, Weixin Wang and Pan Xu “Upper and lower bounds for distributionally robust off-dynamics reinforcement learning” In arXiv preprint arXiv:2409.20521, 2024 [28] Xianxuan Long et al. “When Truthful Representations Flip Under Deceptive Instructions?” In arXiv preprint arXiv:2507.22149, 2025 [29] Aleksander Madry et al. “Towards deep learning models resistant to adversarial attacks” In arXiv preprint arXiv:1706.06083, 2017 [30] Long Ouyang et al. “Training language models to follow instructions with human feedback” In Proceedings of the 36th International Conference on neural information processing systems 35, 2022, p. 27730–27744 [31] Stephen Pollock “A rule-based message filtering system” In ACM Transactions on Information Systems (TOIS) 6.3 ACM New York, NY, USA, 1988, p. 232–254 [32] Xiangyu Qi et al. “Visual adversarial examples jailbreak aligned large language models” In Proceedings of the AAAI conference on artificial intelligence 38.19, 2024, p. 21527–21536 [33] Rafael Rafailov et al. “Direct preference optimization: Your language model is secretly a reward model” In Advances in neural information processing systems 36, 2023, p. 53728–53741 [34] Christoph Schuhmann et al. “Laion-5b: An open large-scale dataset for training next generation image-text models” In Advances in neural information processing systems 35, 2022, p. 25278–25294 [35] Nicholas W Simon et al. “Balancing risk and reward: a rat model of risky decision making” In Neuropsychopharmacology 34.10 Nature Publishing Group, 2009, p. 2208–2217 [36] Ma Teng et al. “Heuristic-induced multimodal risk distribution jailbreak attack for multimodal large language models” In arXiv preprint arXiv:2412.05934, 2024 [37] Cheng Wang et al. “Safety in large reasoning models: A survey” In arXiv preprint arXiv:2504.17704, 2025 [38] Shunyu Yao et al. “Tree of thoughts: Deliberate problem solving with large language models” In Advances in neural information processing systems 36, 2023, p. 11809–11822 [39] Yahsin Yeh, Yilun Wu, Bokai Ruan and Honghan Shuai “Adversarial Attacks on VQA-NLE: Exposing and Alleviating Inconsistencies in Visual Question Answering Explanations” In arXiv preprint arXiv:2508.12430, 2025 [40] Yongting Zhang et al. “SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Models” In Proceedings of the Computer Vision and Pattern Recognition Conference, 2025, p. 19867–19878 [41] Shiji Zhao et al. “Strata-Sword: A Hierarchical Safety Evaluation towards LLMs based on Reasoning Complexity of Jailbreak Instructions” In arXiv preprint arXiv:2509.01444, 2025 [42] Xin Zhou et al. “Making harmful behaviors unlearnable for large language models” In arXiv preprint arXiv:2311.02105, 2023 [43] Zhenhong Zhou et al. “On the Role of Attention Heads in Large Language Model Safety” In arXiv preprint arXiv:2410.13708, 2024 [44] Deyao Zhu et al. “Minigpt-4: Enhancing vision-language understanding with advanced large language models” In arXiv preprint arXiv:2304.10592, 2023

Instant research discovery