🔒 LLM Safety

🎞️ ECCV2026 · 20 paper notes

📌 Same area in other venues: 📷 CVPR2026 (12) · 🔬 ICLR2026 (185) · 💬 ACL2026 (115) · 🤖 AAAI2026 (41) · 🧠 NeurIPS2025 (81) · 📹 ICCV2025 (10)

🔥 Top topics: Multimodal/VLM ×9 · Adversarial Robustness ×8 · LLM ×2

BBQ-V: Benchmarking Visual Stereotype Bias in Large Multimodal Models

BBQ-V evaluates unsupported group-based inferences using real multi-person images and under-informative open-ended questions: its 4,497 images support 14,144 image–question pairs, and an input ablation shows that seeing more does not necessarily produce more cautious judgments.

DualTAP: A Dual-Task Adversarial Protector for Mobile MLLM Agents

DualTAP perturbs mobile screenshots before upload, using contrastive attention to locate privacy-sensitive regions and a dual-task objective to preserve normal operations, reducing GPT-5 leakage on PrivScreen from 97.14% to 23.33% while retaining 91.00% task accuracy.

Towards Benign Memory Forgetting for Selective Multimodal Large Language Model Unlearning

This paper proposes a new paradigm of "benign memory forgetting" and the S-MLLMUn Bench evaluation benchmark, and designs the SMFA (Sculpted Memory Forgetting Adapter) framework. By utilizing parameter masks guided by retaining anchors, it precisely erases privacy-sensitive knowledge in MLLMs without compromising the models' foundational visual understanding capabilities.

Attention Misses Visual Risk: Risk-Adaptive Steering for Multimodal Safety Alignment

MoRAS improves multimodal risk assessment with a short image description, then uses the estimated risk to steer early response activations for the original query toward refusals, reducing LLaVA-1.5-7B's MM-Safety attack success rate from 40.1% to 2.6% while retaining its reported general-task aggregate scores.

SlowBA: An efficiency backdoor attack towards VLM-based GUI agents

SlowBA proposes the first efficiency backdoor attack against VLM-based GUI agents. Through a two-stage Reward-level Backdoor Injection (RBI), the agent is trained to generate ultra-long responses during SFT, and a trigger-aware reward function is then used in RL to distinguish between triggered and clean inputs. Consequently, the agent exhibits extremely high response latency when encountering pop-up triggers, while the task accuracy remains largely unaffected.

Rethinking Visual Privacy: A Compositional Privacy Risk Framework for Severity Assessment with VLMs

This paper turns visual privacy from a binary "private or not" label into a compositional, graded risk estimate: it introduces the four-level Compositional Privacy Risk Taxonomy (CPRT), ordered by standalone identifiability and compositional harm potential, together with a continuous severity scoring function with lexicographic dominance and a 6.7K-image / 22-attribute annotated dataset; benchmarking eight open-weight and frontier VLMs shows that frontier models align well with compositional severity once the taxonomy is supplied (Gemini 3 Flash ρ=0.872) yet systematically underestimate aggregation-driven intermediate risk, and that an 8B LoRA-tuned model distills this ability to a deployable scale.

Safe Responses Matter: Output-Aware Safety Guardrail Mitigate Over-Refusal in MLLMs

Instead of blocking a query merely because its input appears sensitive, OutGuard trains hidden-state classifiers on actual-response safety labels and combines multi-instance contrastive learning with cross-layer voting, reducing in-distribution ARSP to 0.0749 and 0.0634 on two MLLMs while retaining missed risks, distribution-shift degradation and substantial refusal rates on difficult benign queries.

GEO-Detective: Unveiling Location Privacy Risks in Images with LLM Agents

This paper introduces GEO-Detective, an autonomous agent that mimics human reasoning and tool-use behaviors for image geolocation inference; by combining adaptive difficulty assessment, experience-augmented prompting, visual segmentation, and visual reverse search, it systematically demonstrates that agentic LVLMs expose severe location privacy risks in everyday shared images.

Learning to Compose: Revisiting Proxy Task Design for Zero-Shot Composed Image Retrieval

FoCo (Focus-then-Complete) models vision-language composition in zero-shot composed image retrieval (ZS-CIR) as a learnable two-stage "focus-then-complete" process. By jointly training two proxy tasks—text-anchored visual aggregation and context-conditioned semantic completion—along with a cross-instance contrastive loss to prevent shortcut learning, it comprehensively outperforms existing methods across four ZS-CIR benchmarks, without relying on LLMs during inference.

Neural Gate: Mitigating Privacy Risks in LVLMs via Neuron-Level Gradient Gating

This paper proposes Neural Gate, a neuron-level gradient gating method for mitigating privacy risks in LVLMs. The core mechanism is to first measure the consistency of each neuron's contribution to privacy targets on privacy subject features using a learnable vector, classifying neurons into three categories: strongly active, weakly active, and inactive. Then, during model editing, parameter updates are applied only to the gradients of strongly active privacy neurons, while gradients of other neurons are truncated. On MiniGPT and LLaVA, Neural Gate achieves a rejection rate of over 94% on sensitive queries with almost no loss in general task performance, while displaying robust generalization on out-of-distribution privacy categories.

ReShift: Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision-Language Models

ReShift proposes a reasoning-level backdoor attack method for vision-language models. By leveraging the reinforcement learning-stimulated cognitive behavior of the "aha moment," it induces a controllable shift in the reasoning trajectory. This redirects the final prediction to a preset target answer while maintaining the logical consistency of reasoning, making it significantly harder to detect than traditional output-layer backdoor attacks.

TrustCLIP: Learning Private Visual Features via Adversarial Reconstruction

Addressing the severe privacy threat where generative diffusion models faithfully reconstruct sensitive raw images from frozen CLIP embeddings, TrustCLIP introduces an identity-initialized lightweight residual projection layer between the vision encoder and downstream heads, jointly optimizing downstream task utility against negative generative reconstruction loss to selectively eliminate reconstructible instance-level details while preserving high-level task semantics.

Bridging Theory and Practice in Source-Free Domain Adaptation via Adversarial Proxy Perturbation

Addressing the intractable joint-error term and rigid classifier constraints in Source-Free Domain Adaptation (SFDA), this paper introduces a target error generalization bound under finite realizability and develops Adversarial Proxy Perturbation (APP) alongside vision-language mutual distillation, achieving state-of-the-art accuracy and stable convergence across standard benchmarks.

CogniCred: A Dataset and Benchmark for Cognitive Credential Forgery Detection

Addressing the emerging paradigm where generative AI produces visually flawless document credentials that conceal high-level semantic and logical contradictions, this paper presents CogniCred, the first large-scale dataset (16,000+ samples) and benchmark (CogniCredBench) spanning five cognitive reasoning capabilities, demonstrating that current state-of-the-art MLLMs suffer from severe textual overriding bias and visual reasoning collapse.

COVERT: Privacy-Preserving Covariant Obfuscation for VLMaaS via Exact Reparameterization and Tailored Tuning

To defend against visual prompt privacy leakages in Vision-Language Model-as-a-Service (VLMaaS), COVERT introduces the first multimodal covariant obfuscation framework, combining null-space perturbed convolutional patchification, dimensional-augmented bias absorption, and tailored tuning of shallow ViT attention to fully neutralize inversion attacks while keeping accuracy degradation below 3% and throughput overhead below 6%.

Do Multimodal LLMs Understand Intraoral Dental Data? Dataset, Platform, and Baselines

To tackle the lack of 3D geometric reasoning and clinical faithfulness in general-purpose multimodal LLMs for dentistry, this work introduces a multi-center dataset of 1,000 patients with 2,000 registered upper/lower intraoral scans, 5,000 standardized intraoral photos, and 2,403 clinician reports, releases the open-source privacy-first YGGDRASIL platform, and proposes IOS-Qwen fusing PointTransformer with Qwen3-VL.

Open Your Eyes: Benchmarking the Detection of Fabricated Realities and Weaponized Ethics in VLMs

This paper introduces the M-IPI Benchmark comprising 2,600 high-fidelity visual artifacts to evaluate multimodal indirect prompt injection across technically-framed and ethics-framed attack families, revealing that visual rendering systematically suppresses critical evaluation ("visual authority" effect) and demonstrating that adversaries can weaponize fairness alignment priors to achieve over 80% attack success in agentic workflows.

PACO: Stabilizing Vision Embeddings along Local Paths for Robust Vision-Language Models

To resolve semantic drift and weak robustness generalization in vision-language models caused by vulnerable visual encoders, PACO introduces an unsupervised two-stage adversarial fine-tuning framework that anchors adversarial endpoints to a clean frozen reference and progressively regularizes representations along continuous local perturbation paths via linear interpolation, achieving superior multi-scale adversarial robustness with minimal clean degradation.

Prefill-Time Interventions against Adversarial Attacks on Large Vision-Language Models

Proposes PTI (Prefill-Time Intervention), the first lightweight defense framework that probes an LVLM's internal representations during the prefill stage—combining shallow visual masked reconstruction with layer-wise language trajectory inconsistency to halt adversarial attacks before generating any response tokens, achieving an average AUC of 0.98 with over 10x lower latency than prior defenses.

VLMSysTrojan: Stealthy System-Aware Backdoor Attacks Against Vision-Language Models

Exploiting floating-point operation reordering discrepancies between cloud training and edge deployment kernels, VLMSysTrojan introduces the first system-aware backdoor attack against vision-language models, remaining perfectly dormant during cloud security auditing while achieving a ~99% attack success rate upon deployment on target inference kernels.