VLMs Can Aggregate Scattered Training Patches
One way to mitigate risks in vision-language models (VLMs) is to remove
dangerous samples in their training data. However, such data moderation can be
easily bypassed when harmful images are split into small, benign-looking
patches, scattered across many training samples. VLMs may then learn to piece
these fragments together during training and generate harmful responses at
inference, either from full images or text references. For instance, if trained
on image patches from a bloody scene paired with the descriptions "safe," VLMs
may later describe, the full image or a text reference to the scene, as "safe."
We define the core ability of VLMs enabling this attack as visual
stitching -- the ability to integrate visual information spread across
multiple training samples that share the same textual descriptions. In our
work, we first demonstrate visual stitching abilities in common open-source
VLMs on three datasets where each image is labeled with a unique synthetic ID:
we split each (image, ID) pair into {(patch,
ID)} pairs at different granularity for finetuning, and we find that
tuned models can verbalize the correct IDs from full images or text reference.
Building on this, we simulate the adversarial data poisoning scenario mentioned
above by using patches from dangerous images and replacing IDs with text
descriptions like ``safe'' or ``unsafe'', demonstrating how harmful content can
evade moderation in patches and later be reconstructed through visual
stitching, posing serious VLM safety risks. Code is available at
https://github.com/ZHZisZZ/visual-stitching.
684134ca20ff8abcccb11302
Zhanhui Zhou
admin_assigned
2025-06-05T13:01:32.367Z
642e5a7ba0b65dce1f87a7a2
/avatars/3ae01c9330a47e98fac9f1eb0ba94073.svg
Zhanhui Zhou
user
ZHZisZZ
684134ca20ff8abcccb11303
Lingjie Chen
684134ca20ff8abcccb11304
Chao Yang
684134ca20ff8abcccb11305
Chaochao Lu
VLMs Can Aggregate Scattered Training Patches
One way to mitigate risks in vision-language models (VLMs) is to remove
dangerous samples in their training data. However, such data moderation can be
easily bypassed when harmful images are split into small, benign-looking
patches, scattered across many training samples. VLMs may then learn to piece
these fragments together during training and generate harmful responses at
inference, either from full images or text references. For instance, if trained
on image patches from a bloody scene paired with the descriptions "safe," VLMs
may later describe, the full image or a text reference to the scene, as "safe."
We define the core ability of VLMs enabling this attack as visual
stitching -- the ability to integrate visual information spread across
multiple training samples that share the same textual descriptions. In our
work, we first demonstrate visual stitching abilities in common open-source
VLMs on three datasets where each image is labeled with a unique synthetic ID:
we split each (image, ID) pair into {(patch,
ID)} pairs at different granularity for finetuning, and we find that
tuned models can verbalize the correct IDs from full images or text reference.
Building on this, we simulate the adversarial data poisoning scenario mentioned
above by using patches from dangerous images and replacing IDs with text
descriptions like ``safe'' or ``unsafe'', demonstrating how harmful content can
evade moderation in patches and later be reconstructed through visual
stitching, posing serious VLM safety risks. Code is available at
https://github.com/ZHZisZZ/visual-stitching.
VLMs exhibit visual stitching, an ability to integrate fragmented visual information, which enables harmful content to evade data moderation and be reconstructed during inference.
vision-language models VLMs visual stitching data moderation adversarial data poisoning image patches textual descriptions inference