% Use this file for citations not found in the ACL Anthology (contained in "anthology.bib").


@article{han2024wildguard,
  title={Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms},
  author={Han, Seungju and Rao, Kavel and Ettinger, Allyson and Jiang, Liwei and Lin, Bill Yuchen and Lambert, Nathan and Choi, Yejin and Dziri, Nouha},
  journal={arXiv preprint arXiv:2406.18495},
  year={2024}
}
@article{xie2024gradsafe,
  title={GradSafe: Detecting Jailbreak Prompts for LLMs via Safety-Critical Gradient Analysis},
  author={Xie, Yueqi and Fang, Minghong and Pi, Renjie and Gong, Neil},
  journal={arXiv preprint arXiv:2402.13494},
  year={2024}
}
@inproceedings{chen2024lion,
  title={Lion: Empowering multimodal large language model with dual-level visual knowledge},
  author={Chen, Gongwei and Shen, Leyang and Shao, Rui and Deng, Xiang and Nie, Liqiang},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition},
  pages={26540--26550},
  year={2024}
}
@article{chen2023large,
  title={Large language models are visual reasoning coordinators},
  author={Chen, Liangyu and Li, Bo and Shen, Sheng and Yang, Jingkang and Li, Chunyuan and Keutzer, Kurt and Darrell, Trevor and Liu, Ziwei},
  journal={Advances in Neural Information Processing Systems},
  volume={36},
  pages={70115--70140},
  year={2023}
}
@InProceedings{Lee_2025_CVPR,
    author    = {Lee, Taegyeong and Bang, Jinsik and Kwon, Soyeong and Kim, Taehwan},
    title     = {Multi-aspect Knowledge Distillation with Large Language Model},
    booktitle = {Proceedings of the Computer Vision and Pattern Recognition Conference (CVPR) Workshops},
    month     = {June},
    year      = {2025},
    pages     = {2121-2130}
}
@article{wu2024controlmllm,
  title={Controlmllm: Training-free visual prompt learning for multimodal large language models},
  author={Wu, Mingrui and Cai, Xinyue and Ji, Jiayi and Li, Jiale and Huang, Oucheng and Luo, Gen and Fei, Hao and Jiang, Guannan and Sun, Xiaoshuai and Ji, Rongrong},
  journal={Advances in Neural Information Processing Systems},
  volume={37},
  pages={45206--45234},
  year={2024}
}
@article{lee2024harmaug,
  title={HarmAug: Effective Data Augmentation for Knowledge Distillation of Safety Guard Models},
  author={Lee, Seanie and Seong, Haebin and Lee, Dong Bok and Kang, Minki and Chen, Xiaoyin and Wagner, Dominik and Bengio, Yoshua and Lee, Juho and Hwang, Sung Ju},
  journal={arXiv preprint arXiv:2410.01524},
  year={2024}
}
@inproceedings{chen2024internvl,
  title={Internvl: Scaling up vision foundation models and aligning for generic visual-linguistic tasks},
  author={Chen, Zhe and Wu, Jiannan and Wang, Wenhai and Su, Weijie and Chen, Guo and Xing, Sen and Zhong, Muyan and Zhang, Qinglong and Zhu, Xizhou and Lu, Lewei and others},
  booktitle={Proceedings of the IEEE/CVF conference on computer vision and pattern recognition},
  pages={24185--24198},
  year={2024}
}
@article{gu2025mllmguard,
  title={Mllmguard: A multi-dimensional safety evaluation suite for multimodal large language models},
  author={Gu, Tianle and Zhou, Zeyang and Huang, Kexin and Dandan, Liang and Wang, Yixu and Zhao, Haiquan and Yao, Yuanqi and Yang, Yujiu and Teng, Yan and Qiao, Yu and others},
  journal={Advances in Neural Information Processing Systems},
  volume={37},
  pages={7256--7295},
  year={2025}
}
@inproceedings{liu2024mm,
  title={Mm-safetybench: A benchmark for safety evaluation of multimodal large language models},
  author={Liu, Xin and Zhu, Yichen and Gu, Jindong and Lan, Yunshi and Yang, Chao and Qiao, Yu},
  booktitle={European Conference on Computer Vision},
  pages={386--403},
  year={2024},
  organization={Springer}
}
@article{liu2023query,
  title={Query-relevant images jailbreak large multi-modal models},
  author={Liu, Xin and Zhu, Yichen and Lan, Yunshi and Yang, Chao and Qiao, Yu},
  journal={arXiv preprint arXiv:2311.17600},
  volume={7},
  pages={14},
  year={2023}
}
@article{vidgen2020learning,
  title={Learning from the worst: Dynamically generated datasets to improve online hate detection},
  author={Vidgen, Bertie and Thrush, Tristan and Waseem, Zeerak and Kiela, Douwe},
  journal={arXiv preprint arXiv:2012.15761},
  year={2020}
}
@article{hada2021ruddit,
  title={Ruddit: Norms of offensiveness for English Reddit comments},
  author={Hada, Rishav and Sudhir, Sohi and Mishra, Pushkar and Yannakoudakis, Helen and Mohammad, Saif M and Shutova, Ekaterina},
  journal={arXiv preprint arXiv:2106.05664},
  year={2021}
}
@article{caselli2020hatebert,
  title={Hatebert: Retraining bert for abusive language detection in english},
  author={Caselli, Tommaso and Basile, Valerio and Mitrovi{\'c}, Jelena and Granitzer, Michael},
  journal={arXiv preprint arXiv:2010.12472},
  year={2020}
}
@article{liu2024mminstruct,
  title={MMInstruct: A High-Quality Multi-Modal Instruction Tuning Dataset with Extensive Diversity},
  author={Liu, Yangzhou and Cao, Yue and Gao, Zhangwei and Wang, Weiyun and Chen, Zhe and Wang, Wenhai and Tian, Hao and Lu, Lewei and Zhu, Xizhou and Lu, Tong and others},
  journal={arXiv preprint arXiv:2407.15838},
  year={2024}
}
@article{mazeika2024harmbench,
  title={Harmbench: A standardized evaluation framework for automated red teaming and robust refusal, 2024},
  author={Mazeika, Mantas and Phan, Long and Yin, Xuwang and Zou, Andy and Wang, Zifan and Mu, Norman and Sakhaee, Elham and Li, Nathaniel and Basart, Steven and Li, Bo and others},
  journal={URL https://arxiv. org/abs/2402.04249},
  year={2024}
}
@article{rottger2023xstest,
  title={Xstest: A test suite for identifying exaggerated safety behaviours in large language models},
  author={R{\"o}ttger, Paul and Kirk, Hannah Rose and Vidgen, Bertie and Attanasio, Giuseppe and Bianchi, Federico and Hovy, Dirk},
  journal={arXiv preprint arXiv:2308.01263},
  year={2023}
}
@book{APA:83,
    author  = {{American Psychological Association}},
    title   = {Publications Manual},
    year    = "1983",
    publisher = {American Psychological Association},
    address = {Washington, DC}
}
@article{lin2023toxicchat,
  title={Toxicchat: Unveiling hidden challenges of toxicity detection in real-world user-ai conversation},
  author={Lin, Zi and Wang, Zihan and Tong, Yongqi and Wang, Yangkun and Guo, Yuxin and Wang, Yujia and Shang, Jingbo},
  journal={arXiv preprint arXiv:2310.17389},
  year={2023}
}
@article{inan2312llama,
  title={Llama guard: Llm-based input-output safeguard for human-ai conversations, 2023},
  author={Inan, Hakan and Upasani, Kartikeya and Chi, Jianfeng and Rungta, Rashi and Iyer, Krithika and Mao, Yuning and Tontchev, Michael and Hu, Qing and Fuller, Brian and Testuggine, Davide and others},
  journal={URL https://arxiv. org/abs/2312.06674}
}
@inproceedings{markov2023holistic,
  title={A holistic approach to undesired content detection in the real world},
  author={Markov, Todor and Zhang, Chong and Agarwal, Sandhini and Nekoul, Florentine Eloundou and Lee, Theodore and Adler, Steven and Jiang, Angela and Weng, Lilian},
  booktitle={Proceedings of the AAAI Conference on Artificial Intelligence},
  volume={37},
  number={12},
  pages={15009--15018},
  year={2023}
}
@article{reimers2019sentence,
  title={Sentence-bert: Sentence embeddings using siamese bert-networks},
  author={Reimers, Nils and Gurevych, Iryna},
  journal={arXiv preprint arXiv:1908.10084},
  year={2019}
}

%% add %% 
@article{wei2023jailbroken,
  title={Jailbroken: How does llm safety training fail?},
  author={Wei, Alexander and Haghtalab, Nika and Steinhardt, Jacob},
  journal={Advances in Neural Information Processing Systems},
  volume={36},
  pages={80079--80110},
  year={2023}
}

@article{zou2023universal,
  title={Universal and transferable adversarial attacks on aligned language models},
  author={Zou, Andy and Wang, Zifan and Carlini, Nicholas and Nasr, Milad and Kolter, J Zico and Fredrikson, Matt},
  journal={arXiv preprint arXiv:2307.15043},
  year={2023}
}

@article{achiam2023gpt,
  title={Gpt-4 technical report},
  author={Achiam, Josh and Adler, Steven and Agarwal, Sandhini and Ahmad, Lama and Akkaya, Ilge and Aleman, Florencia Leoni and Almeida, Diogo and Altenschmidt, Janko and Altman, Sam and Anadkat, Shyamal and others},
  journal={arXiv preprint arXiv:2303.08774},
  year={2023}
}

@article{team2023gemini,
  title={Gemini: a family of highly capable multimodal models},
  author={Team, Gemini and Anil, Rohan and Borgeaud, Sebastian and Alayrac, Jean-Baptiste and Yu, Jiahui and Soricut, Radu and Schalkwyk, Johan and Dai, Andrew M and Hauth, Anja and Millican, Katie and others},
  journal={arXiv preprint arXiv:2312.11805},
  year={2023}
}

@article{singer2022make,
  title={Make-a-video: Text-to-video generation without text-video data},
  author={Singer, Uriel and Polyak, Adam and Hayes, Thomas and Yin, Xi and An, Jie and Zhang, Songyang and Hu, Qiyuan and Yang, Harry and Ashual, Oron and Gafni, Oran and others},
  journal={arXiv preprint arXiv:2209.14792},
  year={2022}
}

@article{ye2025survey,
  title={A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations},
  author={Ye, Mang and Rong, Xuankun and Huang, Wenke and Du, Bo and Yu, Nenghai and Tao, Dacheng},
  journal={arXiv preprint arXiv:2502.14881},
  year={2025}
}

@article{liu2024survey,
  title={A survey of attacks on large vision-language models: Resources, advances, and future trends},
  author={Liu, Daizong and Yang, Mingyu and Qu, Xiaoye and Zhou, Pan and Cheng, Yu and Hu, Wei},
  journal={arXiv preprint arXiv:2407.07403},
  year={2024}
}

@inproceedings{rottger-etal-2021-hatecheck,
 title={HateCheck: Functional Tests for Hate Speech Detection Models},
 author={R{\"o}ttger, Paul and Vidgen, Bertie and Nguyen, Dong and Waseem, Zeerak and Margetts, Helen and Pierrehumbert, Janet},
 booktitle={Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers)},
 pages={41--58},
 year={2021},
 publisher={Association for Computational Linguistics},
 url={https://aclanthology.org/2021.acl-long.4/},
 doi={10.18653/v1/2021.acl-long.4}
}

@article{huang2024harmful,
  title={Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Survey},
  author={Huang, Lianmin and Liu, Haotian and Chen, Xiangning and Zhang, Tianle and Lin, Ke and Yu, Weiting and Choi, Yejin and Zhou, Ailin and Wu, Jindong and Yu, Dacheng},
  journal={arXiv preprint arXiv:2409.18169},
  year={2024}
}

@article{halawi2024covert,
  title={Covert Malicious Finetuning: Challenges in Safeguarding LLM Adaptation},
  author={Halawi, Yoad and Wolf, Lior and Globerson, Amir and Belinkov, Yonatan},
  journal={arXiv preprint arXiv:2406.20053},
  year={2024}
}

@inproceedings{HarmfulPromptClassification,
author = {Gupta, Ojasvi and de la Cuadra Lozano, Marta and Busalim, Abdelsalam and R Jaiswal, Rajesh and Quille, Keith},
title = {Harmful Prompt Classification for Large Language Models},
year = {2024},
isbn = {9798400711596},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
booktitle = {Proceedings of the 2024 Conference on Human Centred Artificial Intelligence - Education and Practice}
}
@misc{efficientdetectiontoxicprompts,
      title={Efficient Detection of Toxic Prompts in Large Language Models}, 
      author={Yi Liu and Junzhe Yu and Huijia Sun and Ling Shi and Gelei Deng and Yuqi Chen and Yang Liu},
      year={2024},
      eprint={2408.11727},
      archivePrefix={arXiv},
      primaryClass={cs.CR},
      url={https://arxiv.org/abs/2408.11727}, 
}
@misc{YouOnlyPromptOnce,
      title={You Only Prompt Once: On the Capabilities of Prompt Learning on Large Language Models to Tackle Toxic Content}, 
      author={Xinlei He and Savvas Zannettou and Yun Shen and Yang Zhang},
      year={2023},
      eprint={2308.05596},
      archivePrefix={arXiv},
      primaryClass={cs.CL},
      url={https://arxiv.org/abs/2308.05596}, 
}
@misc{crossmodal,
      title={Cross-modality Information Check for Detecting Jailbreaking in Multimodal Large Language Models}, 
      author={Yue Xu and Xiuyuan Qi and Zhan Qin and Wenjie Wang},
      year={2024},
      eprint={2407.21659},
      archivePrefix={arXiv},
      primaryClass={cs.CL},
      url={https://arxiv.org/abs/2407.21659}, 
}
@misc{SafetyofMultimodal,
      title={Safety of Multimodal Large Language Models on Images and Texts}, 
      author={Xin Liu and Yichen Zhu and Yunshi Lan and Chao Yang and Yu Qiao},
      year={2024},
      eprint={2402.00357},
      archivePrefix={arXiv},
      primaryClass={cs.CV},
      url={https://arxiv.org/abs/2402.00357}, 
}
@misc{UniGuard,
      title={UniGuard: Towards Universal Safety Guardrails for Jailbreak Attacks on Multimodal Large Language Models}, 
      author={Sejoon Oh and Yiqiao Jin and Megha Sharma and Donghyun Kim and Eric Ma and Gaurav Verma and Srijan Kumar},
      year={2025},
      eprint={2411.01703},
      archivePrefix={arXiv},
      primaryClass={cs.CL},
      url={https://arxiv.org/abs/2411.01703}, 
}





