CVPR2025 Safety AI paper notes paper summaries Adversarial Robustness Multimodal/VLM Federated Learning Continual Learning Face & Gaze 3D Gaussian Splatting

🔒 Safety¶

📷 CVPR2025 · 46 paper notes

📌 Same area in other venues: 🧠 NeurIPS2026 (35) · 🎞️ ECCV2026 (69) · 📷 CVPR2026 (162) · 🔬 ICLR2026 (329) · 💬 ACL2026 (120) · 🧪 ICML2026 (114)

🔥 Top topics: Adversarial Robustness ×14 · Multimodal/VLM ×6 · Federated Learning ×6 · Continual Learning ×3 · Face & Gaze ×3

Hyperbolic Safety-Aware Vision-Language Models: HySAC proposes constructing safety-aware vision-language models in hyperbolic space. By mapping safe and unsafe content to different regions of hyperbolic space via entailment cones (safe content near the origin, unsafe content far from the origin), the model is equipped with safe content classification and dynamic redirection capabilities, significantly outperforming existing unlearning methods in retrieval safety and NSFW detection.
MP-GUI: Modality Perception with MLLMs for GUI Understanding: MP-GUI designs three specialized perceivers to extract graphical, textual, and spatial modal information from GUIs. By combining these three modalities through a spatial structure refinement strategy and an adaptive fusion gate, it outperforms general MLLMs on various GUI understanding tasks under limited training data.
Protecting Your Video Content: Disrupting Automated Video-Based LLM Annotations: This paper proposes two types of adversarial video watermarking methods—Ramblings (which induce video LLMs to generate incorrect descriptions) and Mutes (which induce video LLMs to generate extremely short or empty descriptions)—to protect personal videos from unauthorized automated annotation via imperceptible adversarial perturbations. It also demonstrates that these low-quality annotations degrade the performance of downstream text-to-video generation models.
Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreaks: This paper proposes ASTRA, which locates jailbreak-related visual tokens in adversarial images via image attribution, constructs steering vectors representing harmful response directions, and performs adaptive activation steering during inference to steer the model away from harmful directions. It achieves SOTA defense performance, with a 12% lower toxicity score, 18% lower ASR, and 9x faster speed compared to JailGuard.
A Closed-Form Solution for Debiasing Vision-Language Models with Utility Guarantees Across Modalities and Tasks: Proposed a training-free, data-free debiasing method for VLMs. By deriving closed-form solutions in a cross-modal space, it achieves Pareto-optimal trade-offs between fairness and utility retention, consistently outperforming existing approaches across three downstream tasks: zero-shot classification, text-to-image retrieval, and text-to-image generation.
CleanSight: Test-Time Attention Purification for Backdoored Large Vision Language Models: CleanSight reveals that the backdoor attack mechanism in LVLMs lies not in the pixel space but in the attention map—the trigger activates the backdoor via "attention stealing" (where trigger tokens hijack the attention of text tokens). Based on this, a training-free, plug-and-play test-time defense method is proposed: identifying poisoned inputs by detecting anomalies in cross-modal attention ratios, and neutralizing the backdoor by pruning high-attention visual tokens. This reduces the ASR to near 0% with almost no impact on model performance.
Dual Consolidation for Pre-Trained Model-Based Domain-Incremental Learning: This paper proposes the Duct method, which addresses exemplar-free domain-incremental learning on pre-trained models. Duct employs representation consolidation (accumulating task vectors to build a unified embedding space) and classifier consolidation (utilizing category semantic information via optimal transport to estimate the weights of classifiers for old domains). It outperforms state-of-the-art methods by 1% to 7% across four benchmark datasets.
ForensicZip: More Tokens are Better but Not Necessary in Forensic Vision-Language Models: Having discovered that semantic-driven visual token pruning discards forensic evidence (as tampering traces reside in low-saliency regions), this work proposes ForensicZip. It utilizes Birth-Death optimal transport to quantify physical inter-frame discontinuities and incorporates a high-frequency prior to preserve forensic signals. ForensicZip achieves 2.97x acceleration and 90%+ FLOPs reduction at a 10% token retention rate with no performance degradation.
LLM4SVG: Empowering LLMs to Understand and Generate Complex Vector Graphics: This paper proposes the LLM4SVG framework, which enables open-source LLMs (such as GPT-2, Phi-2, and Falcon) to understand and generate high-quality, complex vector graphics. This is achieved by defining 55 learnable SVG semantic tokens to replace raw XML tags and conducting a two-stage instruction fine-tuning process on the SVGX-SFT dataset, which contains 250K high-quality SVGs and 580K instruction-following pairs. The GPT-2 XL-based model achieves an FID of 64.11 and a CLIPScore of 0.3496, significantly outperforming GPT-4o (127.78 FID) and all existing SVG generation methods.
LoTUS: Large-Scale Machine Unlearning with a Taste of Uncertainty: This paper proposes LoTUS, which utilizes logit temperature adjustment and Gumbel-Softmax to smooth predictions of forgotten samples. By dynamically scheduling the temperature, it converges to the target where "forget set accuracy equals unseen set accuracy." This enables efficient unlearning on the large-scale ImageNet-1K benchmark (Avg Gap of 0.0150 on ViT). Furthermore, it introduces RF-JSD, a retraining-free evaluation metric (achieving a Pearson correlation of 0.92 with the true JSD).
Neural Gate: Mitigating Privacy Risks in LVLMs via Neuron-Level Gradient Gating: Neural Gate discovers that privacy-related neurons in LVLMs exhibit strong cross-sample inconsistency—only about 10% of neurons consistently encode privacy signals. Based on this finding, a neuron-level gradient gating editing method is proposed: applying gradient updates only to strongly consistent privacy neurons, which improves Safety EtA from 0.48 to 0.89 on MiniGPT while maintaining Utility.
TAPT: Test-Time Adversarial Prompt Tuning for Robust Inference in Vision-Language Models: The first test-time adversarial defense method for VLMs. By minimizing the entropy consistency of multi-view augmentations and aligning adversarial-clean embedding statistics, it learns a defensive prompt for each test sample. With only a single optimization step, it improves the robustness of CLIP against AutoAttack from 0.1% to 48.9%.
Towards All-in-One Medical Image Re-Identification: This paper proposes MaMI, the first all-in-one unified model for medical image re-identification. It dynamically generates modality-specific parameters via a Continuous-modality Parameter Adapter (ComPA) and transfers medical priors using difference feature alignment from medical foundation models. MaMI outperforms 25 foundation models and 8 large language models across 11 datasets.
A Simple Data Augmentation for Feature Distribution Skewed Federated Learning: Proposes FedRDN—an extremely simple data augmentation method for federated learning. During training, it randomly uses the channel-wise mean/standard deviation from other clients for data normalization (instead of relying fixedly on local statistics). Requiring only a few lines of code, it significantly mitigates the feature distribution skew problem and consistently improves performance across multiple FL methods.
Data-free Universal Adversarial Perturbation with Pseudo-Semantic Prior: This paper proposes PSP-UAP, a data-free generation method for universal adversarial perturbations. By extracting pseudo-semantic priors from the UAP itself, utilizing input transformation enhancement, and applying a sample reweighting strategy, it achieves an average white-box fooling rate of 89.95% and significantly outperforms existing methods in black-box scenarios without requiring any training data.
DEAL: Data-Efficient Adversarial Learning for High-Quality Infrared Imaging: This work proposes DEAL (Data-Efficient Adversarial Learning), an adversarial learning framework trained on only 50 clean infrared images. Through dynamic adversarial degradation synthesis and a dual-channel interaction network (Scale Transform + Spiking Neurons), it simultaneously addresses three types of infrared degradations (stripe noise, low resolution, and low contrast) with an ultra-lightweight parameter size of 0.96M.

DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders

Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspection: Proposes the AlignIns defense method, which identifies malicious model updates in federated learning through dual-granularity direction alignment detection (global direction + fine-grained sign analysis), outperforming existing defense methods under both IID and non-IID settings.
Detecting Out-of-Distribution through the Lens of Neural Collapse: Based on Neural Collapse theory, this paper discovers that centered in-distribution (ID) features cluster near the weight vectors of their predicted classes and far from the origin (forming a simplex ETF). Guided by this, the NCI detector is designed by combining the angular proximity (pScore) between features and weight vectors with a feature norm filter. NCI achieves the best overall OOD detection performance on CIFAR-10/100 and ImageNet across multiple architectures while maintaining inference latency on par with the softmax baseline.
Dynamic Integration of Task-Specific Adapters for Class Incremental Learning: Achieves class incremental learning through the dynamic integration of task-specific adapters, where a lightweight adapter is trained for each task, and relevant adapters are dynamically selected and combined during inference.
FedAWA: Adaptive Optimization of Aggregation Weights in Federated Learning Using Client Vectors: FedAWA is proposed, which is inspired by task arithmetic and uses client vectors (the difference between local parameters and global parameters) to adaptively optimize aggregation weights in federated learning. Clients whose updates align with the global optimization direction are assigned higher weights, consistently improving FedAvg by 1–4 percentage points in non-IID scenarios.
Forensics Adapter: Adapting CLIP for Generalizable Face Forgery Detection: This paper proposes Forensics Adapter, a lightweight adapter network with only 5.7M parameters that learns blending boundary features of face forged images in parallel with a frozen CLIP. Highly generalizable cross-dataset face forgery detection is achieved via a triple objective: masked boundary prediction, patch-level contrastive learning, and sample-level contrastive learning, achieving an AUC of 0.914 on CDF-v1.
Geometric Knowledge-Guided Localized Global Distribution Alignment for Federated Learning: Obtains the geometry of the global embedding distribution by accurately reconstructing the global covariance matrix from local covariance matrices in federated learning. It generates augmented samples along global principal directions to localize global distribution information, improving performance by 17 percentage points on CIFAR-100 under extreme heterogeneous scenarios (\(\beta=0.01\)).
Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning: This work demonstrates for the first time that adapter-based PEFT is not privacy-secure in federated learning. A malicious server can design the pre-trained model as an identity mapping, allowing patch embeddings to propagate to the adapter layer unchanged, and analytically reconstruct training images from the adapter gradients (CIFAR-100 SSIM 0.88).
H2ST: Hierarchical Two-Sample Tests for Continual Out-of-Distribution Detection: Proposes the H2ST method, which utilizes a hierarchical two-sample test framework to achieve OOD detection in continual learning. Each task corresponds to a feature-level source-target binary classifier layer that automatically determines ID/OOD through Clopper-Pearson confidence interval hypothesis testing (requiring no manual threshold), while providing task ID prediction capabilities. It outperforms MSP, Energy, and ODIN across 7 benchmarks and improves computational efficiency by \((T+1)/2\) times.
INACTIVE: Invisible Backdoor Attack against Self-supervised Learning: Proposes INACTIVE, the first invisible backdoor attack effective against self-supervised learning (SSL). By designing triggers in the HSV/HSL color space to escape the distribution space of SSL data augmentations, it achieves a 99.09% average attack success rate while maintaining high stealthiness with SSIM 0.9763 / PSNR 41.07dB, resisting 7 defense methods.
Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning: This paper is the first to study non-collaborative multi-label backdoor attacks (MBA) in federated learning. It reveals the inherent flaw of prior single-label backdoor attacks that leads to mutual exclusion among attackers when extended to multi-label scenarios due to constructing similar out-of-distribution (OOD) mappings. It proposes Mirage, which establishes in-distribution (ID) backdoor mappings to allow multiple attackers to inject backdoors independently and persistently, achieving an average attack success rate of over 97% that remains above 90% even after 900 rounds.
Joint Out-of-Distribution Filtering and Data Discovery Active Learning: Proposes the Open-Set Discovery Active Learning (OSDAL) scenario and designs the Joda algorithm. Through a three-phase workflow of training, filtering, and selection, Joda utilizes a single model to simultaneously filter OOD data and discover new categories without requiring auxiliary models, consistently achieving state-of-the-art accuracy across 18 configurations.
Leveraging Perturbation Robustness to Enhance Out-of-Distribution Detection: The authors find that the detection scores of OOD samples are more vulnerable to adversarial perturbations than those of IND samples. They propose the PRO method, which searches for the minimum OOD score within the \(\epsilon\)-ball using gradient descent during inference to enhance IND/OOD separability, reducing FPR@95 on CIFAR-10 from 44.35% to 19.95%.
Low-Rank Adaptation in Multilinear Operator Networks for Security-Preserving Incremental Learning: To address the catastrophic forgetting problem of multilinear operator networks in Leveled Fully Homomorphic Encryption (Leveled FHE) scenarios, an incremental learning method combining Low-Rank Adaptation (LoRA) and Gradient Projection Memory (GPM) mechanisms is proposed to achieve continual learning while preserving data security.
Lyapunov Stable Graph Neural Flow: Integrates Lyapunov stability theory (integer-order and fractional-order) with graph neural flows. By utilizing a learnable Lyapunov function and a projection mechanism, it dynamically constrains GNN feature trajectories within a stable space. This provides the first provable adversarial robustness guarantee for graph neural flows and is orthogonally stackable with adversarial training.
Mind the Gap: Detecting Black-box Adversarial Attacks in the Making through Query Update Analysis: This paper proposes GWAD, a black-box adversarial attack detection framework based on query update patterns (rather than input patterns). By introducing the Delta Similarity metric, it captures the inherent patterns of zero-order optimization in query-based attacks, achieving near 100% detection rate with extremely low false positive rates across 8 SOTA attacks (including the adaptive attack OARS), significantly outperforming existing stateful defense methods.
MOS-Attack: A Scalable Multi-Objective Adversarial Attack Framework: This paper proposes the MOS-Attack framework, which models adversarial attacks as a multi-objective set-based optimization problem. By incorporating smooth max/min approximations, it enables the joint optimization of multiple loss functions and automatically discovers synergy patterns among them, outperforming existing state-of-the-art single-objective and ensemble attacks on CIFAR-10 and ImageNet.
NoT: Federated Unlearning via Weight Negation: This paper proposes the NoT algorithm, which achieves unlearning by multiplying the weights of specific layers of the global model by -1 (negating) to disrupt inter-layer co-adaptation, followed by fine-tuning with retained data to recover performance. It requires no extra storage or access to target data, and significantly outperforms seven baseline methods on CIFAR-10/100 and Caltech-101 with the lowest communication and computational overheads.
OODD: Test-time Out-of-Distribution Detection with Dynamic Dictionary: OODD is proposed to maintain a dynamic OOD dictionary via a priority queue to collect potential OOD sample features in real-time during test time for calibrating OOD scores. Compared to SOTA methods, it reduces FPR95 by 26.0% on CIFAR-100 Far OOD without requiring any fine-tuning.
PSBD: Prediction Shift Uncertainty Unlocks Backdoor Detection: This paper proposes PSBD, which discovers that during inference with dropout enabled, a backdoor-infected model shifts its predictions on clean data toward the target class while maintaining stable predictions on backdoored data (the Prediction Shift phenomenon). Based on this insight, the authors design the Prediction Shift Uncertainty (PSU) metric to achieve SOTA backdoor training data detection.
Split Adaptation for Pre-trained Vision Transformers: This paper proposes Split Adaptation (SA), which splits a pre-trained ViT into a front-end (quantized and sent to clients) and a back-end (retained on the server). It protects data privacy via bi-level noise injection, and mitigates noise degradation and overfitting through OOD augmentation and patch retrieval augmentation, achieving efficient few-shot downstream adaptation while securing both the model and the data.
Stacking Brick by Brick: Aligned Feature Isolation for Incremental Face Forgery Detection: Introduces the SUR-LID method to address the catastrophic forgetting problem in Incremental Face Forgery Detection (IFFD). It retains the global feature distribution of old tasks through Sparse Uniform Replay (SUR), and "stacks" the distributions of new and old tasks "brick by brick" in the latent space through feature isolation and decision alignment strategies in the Latent Incremental Detector (LID), rather than overwriting each other.
Towards General Visual-Linguistic Face Forgery Detection: VLFFD proposes a vision-language paradigm for deepfake detection. It automatically generates blended forgery images with fine-grained text descriptions using a Prompt Forgery Image Generator (PFIG), and then jointly trains on coarse- and fine-grained data using a Coarse-and-Fine Co-training (C2F) framework, significantly enhancing both the generalizability and interpretability of the detection model.
Towards Source-Free Machine Unlearning: This paper proposes a source-free machine unlearning algorithm. In the absence of original training data, it approximates the Hessian matrix of the remaining data using only the forget data and the trained model, achieving efficient unlearning for linear and mixed linear classifiers with rigorous theoretical upper-bound guarantees.
Where the Devil Hides: Deepfake Detectors Can No Longer Be Trusted: Reveals a severe security risk in Deepfake detectors, where third-party data providers can inject backdoors by introducing password-controlled, adaptive, and invisible triggers. These poisoned detectors make incorrect predictions when encountering samples with specific triggers, while maintaining normal performance on clean samples. This supports both dirty-label and clean-label attack scenarios.
3D-GSW: 3D Gaussian Splatting for Robust Watermarking: This paper proposes 3D-GSW, the first robust digital watermarking method designed specifically for 3D Gaussian Splatting. It enhances watermark robustness by removing redundant Gaussians and splitting Gaussians in high-frequency regions via Frequency-Guided Densification (FGD). Combined with a gradient mask and wavelet sub-band loss to maintain rendering quality, 3D-GSW achieves superior watermark robustness and rendering quality across the Blender, LLFF, and Mip-NeRF 360 datasets.
GuardSplat: Efficient and Robust Watermarking for 3D Gaussian Splatting: This paper proposes GuardSplat, which achieves high-capacity, high-fidelity, and robust copyright protection for 3DGS assets with a total optimization time of only 15 minutes. This is accomplished via CLIP-guided message decoupling optimization (training the decoder in only 5 minutes) and SH-aware watermark embedding (modifying only spherical harmonics offsets).
NoPain: No-box Point Cloud Attack via Optimal Transport Singular Boundary: NoPain proposes the first no-box adversarial attack method for point clouds. By leveraging semi-discrete optimal transport (OT) to calculate the mapping from noise to feature space, it samples adversarial perturbations at the singular boundaries (non-differentiable points) of the mapping. This approach requires no target classifier or surrogate model, achieving 100% ASR on PointNet and maintaining a generation speed of only 28ms/sample.
Spectral Defense Against Resource-Targeting Attack in 3D Gaussian Splatting: Against resource-targeting attacks on 3DGS (which trigger Gaussian overgrowth via poisoned training images to deplete resources), this paper proposes a spectral defense: a 3D frequency filter achieves frequency-aware pruning by relating Gaussian covariance to spectral response, and 2D spectral regularization suppresses attack noise by penalizing the angular energy anisotropy of rendered images with entropy. This achieves a 5.92× compression in Gaussian count, a 3.66× reduction in memory, and a 4.34× speedup.
Targeted Forgetting of Image Subgroups in CLIP Models: A three-stage CLIP subgroup image forgetting framework (forgetting → reminding → restoring) is proposed. It selects key layers for LoRA fine-tuning using relative Fisher Information, aligns the retain data distribution utilizing BatchNorm statistics, and restores zero-shot capability via model souping, achieving precise subgroup forgetting (target ↓ to 0%) on ImageNet-1K and CIFAR-10 while maintaining 85-93% of the overall score.