Open-MMUnlearning 发布：统一多模态大模型遗忘方法与评测框架
提出统一框架评测多模态大模型的遗忘方法
- arXiv
- 2610.10358
- Published
- Setting
- Models and APIs
- Evaluated models
- LLaVA-1.5-7B
- DefensesModel hardening
- ComponentVision
All papers
Filter4
Attack type
Model risks
Impact
System type
Attack surface / entry point
Layer
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Another 240papers do not have category tags yet and are not included in filtered results.
OmniConfess：用 Token 级「忏悔」缓解全模态幻觉
提出 OmniConfess，冻结候选并按通道重打分以缓解全模态幻觉
- arXiv
- 2610.02999
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Qwen2.5-Omni-7B, Qwen3-Omni-30B-A3B, Nemotron-3-Nano-Omni-30B
- DefensesInference-time intervention
- RiskHallucination and fabrication
- ComponentVision
ThinkingGuard：通过逐步风险归因解码多模态大语言模型中的隐式危害
构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险
- arXiv
- 2609.36562
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- ThinkingGuard（Qwen3-VL-8B-Instruct）
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractTriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。
这篇工作研究多模态隐式风险检测：图文各自良性，风险只在关键元素与触发元素交互时出现。
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
- arXiv
- 2609.35912
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
IDUnlearn-Bench：面向视觉语言模型的个体级遗忘基准
提出 IDUnlearn-Bench，评测 VLM 个体级遗忘后的身份残留
- arXiv
- 2609.33481
- Published
- Setting
- Models and APIs
- Evaluated models
- Qwen3-VL-2B, Qwen3-VL-4B, Qwen3-VL-8B and others6
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentVision
AbstractIDUnlearn-Bench 用四族探针显示：压低直接属性访问后，身份仍常能被反向查出、绑定或重构。
IDUnlearn-Bench 评测 VLM 是否忘掉一个可跨模态识别的人，而不只是答不出某条监督事实。
Mandela-Bench: 36 multimodal models rely more on memory than on observing the image
构建 Mandela-Bench，评测多模态模型是否凭记忆接受篡改图像
- arXiv
- 2609.32763
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Gemini-3.8-Flash, GPT-5.6, GLM-5.3-Flash and others15
- RiskHallucination and fabrication
- ComponentVision
Abstract论文构建 Mandela-Bench 发现模型对经典图像存在记忆重构偏见，过度依赖先验导致无法有效利用知识核验事实篡改。
该研究系统评估了多模态大语言模型在面对无痕事实性编辑时，能否利用自身内在世界知识核验被识别出的经典图像。
ArGuard 共享任务：阿拉伯语模因与 LLM 提示词中的有害内容检测
组织 ArGuard 共享任务评测阿拉伯语表情包与提示词有害检测
- arXiv
- 2609.29349
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- Qwen3-VL, Qwen3-VL-8B-Instruct, MARBERTv2 and others9
- DefensesDetection and filtering
- ComponentGuardrails and judges
SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准
提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
- arXiv
- 2609.05843
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。
SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
MM-IFEval-Pro：面向视觉语言模型的多语言抗攻击指令遵循基准
提出抗攻击多语言视觉指令遵循基准 MM-IFEval-Pro
- arXiv
- 2609.04859
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- Qwen3-VL-8B-Instruct, InternVL3.5-8B, MiniCPM-V4.5 and others5
- AttacksPrompt injection
- ComponentVision
AbstractMM-IFEval-Pro 以规则验证评测中英指令遵循与视觉劫持，GRPO 提高两基座平均分。
MM-IFEval-Pro 是面向 VLM 的中英多模态指令遵循基准，并配有可用规则计算奖励的 GRPO 训练集。
Knowing What Not to Answer: Selective Non-Compliance in Vision-Language Models
Propose the KoNA benchmark to evaluate selective non-compliance in vision-language models
- arXiv
- 2609.04720
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- InternVL3-2B-Instruct, InternVL3-78B-Instruct, Qwen2.5-VL-3B-Instruct and others8
- RiskInappropriate refusal
- ComponentVision
AbstractKoNA evaluates selective noncompliance with five types of paired queries.
KoNA is used to evaluate whether vision-language models can selectively refuse mixed queries: only handle the components that should not be followed, while answering the remaining components.
多模态大语言模型免训练不确定性估计的系统研究
比较多模态大模型上三类免训练不确定性估计
- arXiv
- 2609.22206
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- InternVL2-2B, InternVL2-8B, InternVL3.5-2B and others8
- RiskHallucination and fabrication
- ComponentVision
Abstract回答长度决定免训练 UE 族。
这是一项对 MLLM 免训练不确定性估计的分组比较：幻觉检测被作者视为弃答、转交或路由的一种用途，而不是唯一目标。
Study audits 9 vision-language models: national stance rewriting rate under Chinese prompts is about three times that under English
审计视觉语言模型在敏感图像上从拒答转向国家立场重构的行为
- arXiv
- 2608.11816
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Qwen2-VL-7B, Qwen2.5-VL-7B, Qwen3-VL-8B and others9
- RiskBias and discrimination
- ComponentVision
Abstract论文系统审计了 VLM 多模态审查，发现审查正从显式拒答转向隐蔽重构，且中文提示与文本先验会放大重构倾向。
论文系统研究了中外开源视觉语言模型在政治敏感图像上的审查行为，主要内容如下。
Gut-VLM 基准：九种幻觉检测方法在胃肠道内镜 VLM 上的评测
在 Gut-VLM 上评测内镜 VLM 的幻觉检测方法
- arXiv
- 2606.24115
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- MedGemma-4B, MedGemma-27B, LLaVA-Med-7B and others5
- RiskHallucination and fabrication
- ComponentVision
Abstract九种检测方法在 Gut-VLM 五模型上的比较中，ReXTrust 的 AUC 均为最高。
这是一个胃肠道内镜 VQA 幻觉检测的比较基准，不是新检测器结构的提出。
MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models
Propose MLingualFC, evaluating vision-language model jailbreak vulnerabilities with multilingual flowchart images
- arXiv
- 2606.07706
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- Qwen2.5-VL-3B-Instruct, Gemma-4-E4B-it, Pangea-7B
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
研究者提出 MM-Plan 多模态越狱框架
提出 MM-Plan 多模态越狱框架，自动规划多轮图像编辑以越狱视觉独占目标
- arXiv
- 2603.20198
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- Llama-3.2-11B, InternVL3-8B, Qwen3-VL-8B and others8
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentVision
Abstract作者称全局规划能攻破对单轮攻击更稳的前沿 MLLM。
MM-Plan 是面向 Visual Exclusivity 的 black-box 多模态红队方法，并配有人工基准 VE-Safety。
Are images more persuasive than text? Exploring the impact of textual misinformation on VLMs
提出 CONTEXT-VQA，评测 VLM 被冲突误导文本说服后是否放弃视觉答案
- arXiv
- 2601.19202
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- QwenVL-2.5-3B, QwenVL-2.5-7B, InternVL-3-1B and others11
- ComponentVision
Do VLMs have a moral backbone? A study on the moral fragility of vision-language models
在 Moralise 上评测 VLM 道德判断的扰动鲁棒性
- arXiv
- 2601.17082
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- Qwen2.5-VL-3B-Instruct, Qwen2.5-VL-7B-Instruct, Qwen2.5-VL-32B-Instruct and others20
- ComponentVision
ChartAttack：测试大语言模型在图表生成中对恶意提示的脆弱性
提出 ChartAttack，用恶意提示驱动代码模型生成误导图表
- arXiv
- 2601.12983
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- Claude-4.6-Sonnet, GPT-4o, Gemini-2.5-Flash and others20
- AttacksMalicious use
- ComponentVision
AbstractChartAttack 生成不改数据的误导图，降低 MLLM 与人类的图表问答准确率。
ChartAttack 研究恶意提示能否让 MLLM 在不改数据的情况下生成误导图表，并量化这些图对其他 MLLM 和人类图表问答的影响。
BackdoorVLM：面向视觉语言模型后门攻击与防御的基准
提出 BackdoorVLM 基准，评测视觉语言模型微调中的后门攻击与防御
- arXiv
- 2511.18921
- Published
- Setting
- Models and APIs
- Evaluated models
- LLaVA-1.5-7B, Qwen2.5-VL-7B
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
AbstractBackdoorVLM 统一评测 VLM 后门与防御：含文本触发在低投毒率下更易激活，现有防御跨类型不稳定。
BackdoorVLM 是作者提出的 VLM 后门攻击与防御评测基准，作者称它是首个此类综合基准。
ChartHal：评估大型视觉语言模型图表理解幻觉的细粒度基准
提出基准 CHART HAL，细粒度评测图表理解中的幻觉
- arXiv
- 2509.17481
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Gemini-2.5-Pro, GPT-5, GPT-5-mini and others15
- RiskHallucination and fabrication
- ComponentVision
You have reached the end