CNRF: A Selective Safety Defense Framework for VLMs
Start here
On October 15, 2026, arXiv published a study proposing the Counterfactual Neighborhood Risk Field (CNRF) framework for selective safety defense of vision-language models. The method constructs context-matched harmful and benign counterfactual pairs, uses representation differences as capability-related risk directions, and estimates neighborhood support and risk separately to avoid misclassifying unfamiliarity as harmfulness. The framework adopts selective intervention rather than blanket refusal, and through a victim-adaptive interface, forwards selected requests to the same victim model for response review, either passing acceptable candidates or generating restricted alternatives with lower harmful capability. The researchers achieve 86.06-89.30% macro defense success rates across three VLMs and five categories of multimodal jailbreak attacks.
Generated by AI from reports · Updated 28 days ago
Attention and developments
Attention, hourly
Now 26, 0% in 24 hours·Peak 26 (Nov 6 03:00)
Related research
This event's paper
- Counterfactual Neighborhood Risk Fields: Evidence-Grounded Selective Safety for Vision-Language Models
arXiv · 2026-10-14 · Deep reading
Progress timeline
- arXiv: Jailbreaks, Prompt Injection, Poisoning & DefensesCounterfactual Neighborhood Risk Field: Evidence-Driven Selective Safety for Vision-Language Models
The researchers propose the Counterfactual Neighborhood Risk Field (CNRF) framework for selective safety defense in vision-language models, achieving 86.06-89.30% macro defense success rates across three VLMs and five categories of multimodal jailbreak attacks. The method constructs context-matched harmful and benign counterfactual pairs, uses their representation differences as capability-related risk directions, and estimates neighborhood support and risk separately to avoid mistaking unfamiliarity for harmfulness. The framework employs selective intervention rather than blanket refusal, and through a victim-adaptive interface, forwards selected requests to the same victim model's response review, either passing acceptable candidates or generating restricted alternatives with lower harmful capability. Controlled experiments show that query-matched references and retained context direction correspondences significantly improve risk ranking in the low false-positive region, while the framework maintains considerable benign task utility.