mlsanityData to 7 Oct 2026

Eyes Closed, Safety On: Protecting Multimodal LLMs via Image-to-Text Transformation

arXiv 2403.09572 ↗First posted 14 Mar 2024cs.CVcited by 114

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 1 more
Abstract (arXiv)

Multimodal large language models (MLLMs) have shown impressive reasoning abilities. However, they are also more vulnerable to jailbreak attacks than their LLM predecessors. Although still capable of detecting the unsafe responses, we observe that safety mechanisms of the pre-aligned LLMs in MLLMs can be easily bypassed with the introduction of image features. To construct robust MLLMs, we propose ECSO (Eyes Closed, Safety On), a novel training-free protecting approach that exploits the inherent safety awareness of MLLMs, and generates safer responses via adaptively transforming unsafe images into texts to activate the intrinsic safety mechanism of pre-aligned LLMs in MLLMs. Experiments on five state-of-the-art (SoTA) MLLMs demonstrate that ECSO enhances model safety significantly (e.g.,, 37.6% improvement on the MM-SafetyBench (SD+OCR) and 71.3% on VLSafe with LLaVA-1.5-7B), while consistently maintaining utility results on common MLLM benchmarks. Furthermore, we show that ECSO can be used as a data engine to generate supervised-finetuning (SFT) data for MLLM alignment without extra human intervention.

Key facts. Cited by 114 papers in the map (data through 7 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 55 of its 74 references that are in the map. First posted on arXiv 14 Mar 2024.

Builds on

55 of 74 references.

References · 55

  1. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  3. 2022Training language models to follow instructions with human feedbackcited by 15,712
  4. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  5. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  6. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  7. 2023Visual Instruction Tuningcited by 7,792
  8. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  9. 2023Improved Baselines with Visual Instruction Tuningcited by 4,362
  10. 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,337
  11. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,310
  12. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,855
38 more
  1. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,689
  2. 2023MMBench: Is Your Multi-modal Model an All-around Player?cited by 2,105
  3. 2022Learn to Explain: Multimodal Reasoning via Thought Chains for Science Question Answeringcited by 1,881
  4. 2024Mixtral of Expertscited by 1,785
  5. 2023MME: A Comprehensive Evaluation Benchmark for Multimodal Large Language Modelscited by 1,624
  6. 2023MM-Vet: Evaluating Large Multimodal Models for Integrated Capabilitiescited by 1,221
  7. 2023ShareGPT4V: Improving Large Multi-Modal Models with Better Captionscited by 1,000
  8. 2018VizWiz Grand Challenge: Answering Visual Questions from Blind Peoplecited by 852
  9. 2023Multimodal Chain-of-Thought Reasoning in Language Modelscited by 740
  10. 2023AlpacaFarm: A Simulation Framework for Methods that Learn from Human Feedbackcited by 738
  11. 2023Safe RLHF: Safe Reinforcement Learning from Human Feedbackcited by 630
  12. 2023mPLUG-Owl2: Revolutionizing Multi-modal Large Language Model with Modality Collaborationcited by 545
  13. 2023V*: Guided Visual Search as a Core Mechanism in Multimodal LLMscited by 459
  14. 2022Self-critiquing models for assisting human evaluatorscited by 372
  15. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Promptscited by 368
  16. 2022Is synthetic data from generative models ready for image recognition?cited by 320
  17. 2023InternLM-XComposer: A Vision-Language Large Model for Advanced Text-image Comprehension and Compositioncited by 297
  18. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  19. 2023MagicDrive: Street View Generation with Diverse 3D Geometry Controlcited by 250
  20. 2023StableRep: Synthetic Images from Text-to-Image Models Make Strong Visual Representation Learnerscited by 177
  21. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  22. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  23. 2024Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Modelscited by 160
  24. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  25. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMscited by 117
  26. 2024MLLM-Protector: Ensuring MLLM's Safety without Hurting Performancecited by 111
  27. 2023Mixture of Cluster-conditional LoRA Experts for Vision-language Instruction Tuningcited by 106
  28. 2023How Many Unicorns Are in This Image? A Safety Evaluation Benchmark for Vision LLMscited by 103
  29. 2022CODA: A Real-World Road Corner Case Dataset for Object Detection in Autonomous Drivingcited by 100
  30. 2023DRESS: Instructing Large Vision-Language Models to Align and Interact with Humans via Natural Language Feedbackcited by 99
  31. 2023Safety Assessment of Chinese Large Language Modelscited by 82
  32. 2024InferAligner: Inference-Time Alignment for Harmlessness through Cross-Model Guidancecited by 78
  33. 2024Safety of Multimodal Large Language Models on Images and Textscited by 70
  34. 2023Jailbreaking GPT-4V via Self-Adversarial Attacks with System Promptscited by 62
  35. 2024Red Teaming Visual Language Modelscited by 62
  36. 2023Can Language Models be Instructed to Protect Personal Information?cited by 46
  37. 2021MultiSiam: Self-supervised Multi-instance Siamese Representation Learning for Autonomous Drivingcited by 41
  38. 2023Misusing Tools in Large Language Models With Visual Adversarial Examplescited by 40

50 most cited of 55 All 55 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 21; 2025: 54; 2026: 39.

114 papers.

Sort:

By area:

  1. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 103
  2. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  3. 2024Automated Evaluation of Large Vision-Language Models on Self-driving Corner Casescited by 75
  4. 2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Modelscited by 67
  5. 2024VLSBench: Unveiling Visual Leakage in Multimodal Safetycited by 59
  6. 2024ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Timecited by 57
  7. 2024EMOVA: Empowering Language Models to See, Hear and Speak with Vivid Emotionscited by 44
  8. 2024Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreakscited by 44
  9. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 34
  10. 2025HiddenDetect: Detecting Jailbreak Attacks against Large Vision-Language Models via Monitoring Hidden Statescited by 29
  11. 2025Safe RLHF-V: Safe Reinforcement Learning from Multi-modal Human Feedbackcited by 27
  12. 2024Unraveling and Mitigating Safety Alignment Degradation of Vision-Language Modelscited by 23
38 more
  1. 2024From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreakingcited by 22
  2. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  3. 2025Rethinking Bottlenecks in Safety Fine-Tuning of Vision Language Modelscited by 21
  4. 2024The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defensecited by 20
  5. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Securitycited by 18
  6. 2024Cross-Modal Safety Mechanism Transfer in Large Vision-Language Modelscited by 18
  7. 2024UniGuard: Towards Universal Safety Guardrails for Jailbreak Attacks on Multimodal Large Language Modelscited by 18
  8. 2025Think in Safety: Unveiling and Mitigating Safety Alignment Collapse in Multimodal Large Reasoning Modelcited by 18
  9. 2024VLMGuard: Bootstrapping Malicious Prompt Detectors from Unlabeled Vision-Language Prompts in the Wildcited by 17
  10. 2025Understanding and Rectifying Safety Perception Distortion in VLMscited by 17
  11. 2025Safe Delta: Consistently Preserving Safety when Fine-Tuning LLMs on Diverse Datasetscited by 17
  12. 2025Automating Steering for Safe Multimodal Large Language Modelscited by 17
  13. 2025VLM-Guard: Safeguarding Vision-Language Models via Fulfilling Safety Alignment Gapcited by 16
  14. 2025Safety Mirage: How Spurious Correlations Undermine VLM Safety Fine-Tuning and Can Be Mitigated by Machine Unlearningcited by 16
  15. 2025Analyzing Finetuning Representation Shift for Multimodal LLMs Steeringcited by 15
  16. 2024The Synergy between Data and Multi-Modal Large Language Models: A Survey from Co-Development Perspectivecited by 14
  17. 2025On Almost Surely Safe Alignment of Large Language Models at Inference-Timecited by 13
  18. 2025Omni-SafetyBench: A Benchmark for Safety Evaluation of Audio-Visual Large Language Modelscited by 13
  19. 2025Learning to Steer: Input-dependent Steering for Multimodal LLMscited by 13
  20. 2025Adversary-Aware DPO: Enhancing Safety Alignment in Vision Language Models via Adversarial Trainingcited by 12
  21. 2025SafeGRPO: Self-Rewarded Multimodal Safety Alignment via Rule-Governed Policy Optimizationcited by 11
  22. 2024Mixture of insighTful Experts (MoTE): The Synergy of Thought Chains and Expert Mixtures in Self-Alignmentcited by 10
  23. 2025JPS: Jailbreak Multimodal Large Language Models with Collaborative Visual Perturbation and Textual Steeringcited by 10
  24. 2025OmniSafeBench-MM: A Unified Benchmark and Toolbox for Multimodal Jailbreak Attack-Defense Evaluationcited by 10
  25. 2025Do We Really Need Curated Malicious Data for Safety Alignment in Multi-modal Large Language Models?cited by 9
  26. 2025SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanismcited by 9
  27. 2025V-Attack: Targeting Disentangled Value Features for Controllable Adversarial Attacks on LVLMscited by 9
  28. 2025SaFeR-VLM: Toward Safety-aware Fine-grained Reasoning in Multimodal Modelscited by 8
  29. 2026TraceRouter: Robust Safety for Large Foundation Models via Path-Level Interventioncited by 8
  30. 2026Image-based Prompt Injection: Hijacking Multimodal LLMs through Visually Embedded Adversarial Instructionscited by 8
  31. 2024Unified Triplet-Level Hallucination Evaluation for Large Vision-Language Modelscited by 7
  32. 2024Defending LVLMs Against Vision Attacks through Partial-Perception Supervisioncited by 7
  33. 2025Reasoning-Aligned Perception Decoupling for Scalable Multi-modal Reasoningcited by 7
  34. 2025DAVSP: Safety Alignment for Large Vision-Language Models via Deep Aligned Visual Safety Promptcited by 7
  35. 2025Hidden in the Noise: Unveiling Backdoors in Audio LLMs Alignment through Latent Acoustic Pattern Triggerscited by 7
  36. 2024GLOV: Guided Large Language Models as Implicit Optimizers for Vision Language Modelscited by 6
  37. 2025Zero-Shot Defense Against Toxic Images via Inherent Multimodal Alignment in LVLMscited by 6
  38. 2025Panoptic Captioning: An Equivalence Bridge for Image and Textcited by 6

50 most cited of 114 All 114 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models
  2. 2026SafeSteer: A Decoding-level Defense Mechanism for Multimodal Large Language Models
  3. 2025Can't See the Forest for the Trees: Benchmarking Multimodal Safety Awareness for Multimodal LLMs
  4. 2024CoCA: Regaining Safety-awareness of Multimodal Large Language Models with Constitutional Calibration
  5. 2024MLLMGuard: A Multi-dimensional Safety Evaluation Suite for Multimodal Large Language Models
  6. 2025PolyJailbreak: Cross-Modal Jailbreaking Attacks on Black-Box Multimodal LLMs
  7. 2025Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy
  8. 2026Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputs