Research map / Vision-language and multimodal / Multimodal LLMs
VLMs can Aggregate Scattered Training Patches
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that VLMs can aggregate scattered image patches sharing the same text label ("visual stitching"), and that this lets adversaries evade data moderation by injecting harmful content as benign-looking patches labeled "safe".
Problem
Data moderation of VLM training sets can be bypassed by splitting harmful images into benign-looking patches scattered across samples; the question is whether VLMs can integrate these patches to recover harmful associations at inference.
Approach
Defines "visual stitching" as a VLM's ability to integrate visual information spread across training patches sharing the same text, measures it with image-based and reference-based mean rank on synthetic-ID datasets, and shows that this enables moderation-evading poisoning using patches from harmful images relabeled "safe"/"unsafe".
Key results
- Most open-source VLMs achieve image-based mean rank near zero (worst case below 3 vs random 9.5) after finetuning on patches.
- With 8x8 splits, only 9% of harmful-image patches are flagged by the OpenAI Moderation API, which flags all 20 full images.
- Finetuning on moderation-filtered patches labeled safe/unsafe still yields reference-based stitching well above chance, e.g. on Qwen2-VL-7B.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train on large patches (split factor f=2) instead of full images (f=1) | VLMs · Reference-based visual stitching | mean rank | Helped |
| Split images into very small patches (f=8) instead of larger patches | Most VLMs · Food and Animal, reference-based visual stitching | mean rank | Hurt |
| Add patch positions to the finetuning prompt (ablation) | VLMs · Food, Animal, and Landmark visual stitching | mean rank | Hurt |
| Use learning rates 1e-6 or 5e-6 instead of 1e-5 (ablation) | VLMs · Reference-based visual stitching | mean rank | Hurt |
| Filter unsafe patches with the OpenAI Moderation API before finetuning (ablation) | Qwen2-VL-7B and other evaluated VLMs · Safety visual stitching | mean rank | Hurt |
| Finetune on moderation-filtered patches rather than removing the patch-text training signal entirely | VLMs · Safety visual stitching | mean rank | Helped |
| Use the sex & violence (safe), animal (unsafe) label assignment | VLMs · Safety visual stitching | mean rank | Helped |
| Increase patch split factor while also applying moderation filtering | VLMs · Safety visual stitching | mean rank | No clear effect |
| Increase model size beyond medium-sized models | Qwen2-VL and InternVL3 · Reference-based visual stitching | mean rank | No clear effect |
| Finetune on ambiguous patches only by discarding unambiguous patches (ablation) | VLMs · Visual stitching | mean rank | Hurt |
Surprising findings
- Training on 2x2 patches gave better reference-based stitching than training on full images, suggesting patch splitting acts as visual augmentation.
- Adding positional location information to finetuning prompts hurt stitching performance.
Limitations
- Only open-source VLMs evaluated; proprietary models not tested.
- Attack is a proof of concept rather than a full attack framework.
- Stitching results are unstable across learning rates and training time, and non-zero ranks mean correct IDs are not reliably sampled.
Experimental setup
Datasets: ImageNet Food101 Pexels landmark images MultiTrust sex-related images horror film violence images
Benchmarks: visual stitching synthetic ID datasets (food, animal, landmark) harmful-image patch stitching (sex, violence)
Metrics: mean rank of correct ID/text (lower is better) patch evasion rate
Baselines: random baseline OpenAI Moderation API ShieldGemma-2
Builds on: out-of-context reasoning connecting the dots (inductive OCR) TRL SFTTrainer DeepSpeed
Closest papers by meaning
- ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time (ICLR 2025 · similarity 0.89)
- VLSU: Mapping the Limits of Joint Multimodal Understanding for AI Safety (ICLR 2026 · similarity 0.89)
- ELITE: Enhanced Language-Image Toxicity Evaluation for Safety (ICML 2025 · similarity 0.88)
- Do We Really Need Curated Malicious Data for Safety Alignment in Multi-modal Large Language Models? (CVPR 2025 · similarity 0.88)
- Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models (ICML 2024 · similarity 0.88)
- Risk Awareness Injection: Calibrating Vision-Language Models for Safety without Compromising Utility (ICML 2026 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.