VLMs Can Aggregate Scattered Training Patches

2025/06/04 by Zhongmin Zhou, Zhou, Zhanhui, Lingjie Chen +5
Computer Science · Social Sciences · #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Computation and Language (cs.CL) #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #Ethics and Social Impacts of AI #FOS: Computer and information sciences #Generative Adversarial Networks and Image Synthesis

paper · pdf · doi:10.48550/arxiv.2506.03614

openalex publication_date 2025/06/04 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

One way to mitigate risks in vision-language models (VLMs) is to remove dangerous samples in their training data. However, such data moderation can be easily bypassed when harmful images are split into small, benign-looking patches, scattered across many training samples. VLMs may then learn to piece these fragments together during training and generate harmful responses at inference, either from full images or text references. For instance, if trained on image patches from a bloody scene paired with the descriptions "safe," VLMs may later describe, the full image or a text reference to the scene, as "safe." We define the core ability of VLMs enabling this attack as visual stitching -- the ability to integrate visual information spread across multiple training samples that share the same textual descriptions. In our work, we first demonstrate visual stitching abilities in common open-source VLMs on three datasets where each image is labeled with a unique synthetic ID: we split each (image, ID) pair into \(patch, ID)\ pairs at different granularity for finetuning, and we find that tuned models can verbalize the correct IDs from full images or text reference. Building on this, we simulate the adversarial data poisoning scenario mentioned above by using patches from dangerous images and replacing IDs with text descriptions like ``safe'' or ``unsafe'', demonstrating how harmful content can evade moderation in patches and later be reconstructed through visual stitching, posing serious VLM safety risks. Code is available at https://github.com/ZHZisZZ/visual-stitching.

Citations

• InternVL3: Exploring Advanced Training and Test-Time Recipes for Open-Source Multimodal Models
• Is the Reversal Curse a Binding Problem? Uncovering Limitations of Transformers from a Basic Generalization Failure
• ShieldGemma 2: Robust and Tractable Image Content Moderation
• Gemma 3 Technical Report
• MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks
• Tell me about yourself: LLMs are aware of their learned behaviors
• Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency
• Qwen2.5 Technical Report
• Concept-ROT: Poisoning Concepts in Large Language Models with Model Editing
• Extractive Structures Learned in Pretraining Enable Generalization on Finetuned Facts
• Reverse Thinking Makes LLMs Stronger Reasoners
• Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversations
• From Imitation to Introspection: Probing Self-Consciousness in Language Models
• The Llama 3 Herd of Models
• Qwen2 Technical Report
• Me, Myself, and AI: The Situational Awareness Dataset (SAD) for LLMs
• Large Language Models are Limited in Out-of-Context Knowledge Reasoning
• Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters
• Towards a Theoretical Understanding of the 'Reversal Curse' via Training Dynamics
• Mixed Preference Optimization: Reinforcement Learning with Data Selection and Better Reference Model
• Reverse Training to Nurse the Reversal Curse
• Mitigating Reversal Curse in Large Language Models via Semantic-aware Permutation Training
• Composite Backdoor Attacks Against Large Language Models
• Improved Baselines with Visual Instruction Tuning
• Physics of Language Models: Part 3.2, Knowledge Manipulation
• The Reversal Curse: LLMs trained on "A is B" fail to learn "B is A"
• Taken out of context: On measuring situational awareness in LLMs
• Instruction Tuning with GPT-4
• Sigmoid Loss for Language Image Pre-Training
• RoFormer: Enhanced Transformer with Rotary Position Embedding
• Learning Transferable Visual Models From Natural Language Supervision
• An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
• ZeRO: Memory Optimizations Toward Training Trillion Parameter Models
• ImageNet Large Scale Visual Recognition Challenge
• ImageNet Large Scale Visual Recognition Challenge
• ImageNet classification with deep convolutional neural networks
• Sugar-Coated Poison: Benign Generation Unlocks LLM Jailbreaking
• MultiTrust: A Comprehensive Benchmark Towards Trustworthy Multimodal Large Language Models

Related

• Safeguarding Vision-Language Models Against Patched Visual Prompt Injectors
• Safety Mirage: How Spurious Correlations Undermine VLM Safety Fine-Tuning and Can Be Mitigated by Machine Unlearning
• Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-based Attacks
• VLM-Guard: Safeguarding Vision-Language Models via Fulfilling Safety Alignment Gap
• Image Corruption-Inspired Membership Inference Attacks against Large Vision-Language Models