{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/safety-fine-tuning-at-almost-no-cost-a","title":"Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models","arxiv_id":"2402.02207","date":"2024-02-03","proceeding":null,"authors":["Yongshuo Zong","Ondrej Bohdal","Tingyang Yu","Yongxin Yang","Timothy Hospedales"],"abstract":"Current vision large language models (VLLMs) exhibit remarkable capabilities yet are prone to generate harmful content and are vulnerable to even the simplest jailbreaking attacks. Our initial analysis finds that this is due to the presence of harmful data during vision-language instruction fine-tuning, and that VLLM fine-tuning can cause forgetting of safety alignment previously learned by the underpinning LLM. To address this issue, we first curate a vision-language safe instruction-following dataset VLGuard covering various harmful categories. Our experiments demonstrate that integrating this dataset into standard vision-language fine-tuning or utilizing it for post-hoc fine-tuning effectively safety aligns VLLMs. This alignment is achieved with minimal impact on, or even enhancement of, the models' helpfulness. The versatility of our safety fine-tuning dataset makes it a valuable resource for safety-testing existing VLLMs, training new models or safeguarding pre-trained VLLMs. Empirical results demonstrate that fine-tuned VLLMs effectively reject unsafe instructions and substantially reduce the success rates of several black-box adversarial attacks, which approach zero in many cases. The code and dataset are available at https://github.com/ys-zong/VLGuard.","url_abs":"https://arxiv.org/abs/2402.02207v2","url_pdf":"https://arxiv.org/pdf/2402.02207v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"safety-fine-tuning-at-almost-no-cost-a","repo_url":"https://github.com/ys-zong/vlguard","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"instruction-following","task_name":"Instruction Following"},{"task_slug":"safety-alignment","task_name":"Safety Alignment"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2402.02207","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2402.02207"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/ys-zong/VLGuard","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ys-zong/vlguard","reach":{"status":"ok"}}],"summary":{"ran":4,"ran_draft_wrong":1,"unverified":2},"by_repo_kind":{"official":{"samples":7,"ran":5,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":7,"samples":[{"code_sha256_prefix":"96d7381525bbcb61","entry":"check_success_attack","repo":"ys-zong/vlguard","repo_kind":"official","path":"utils/utils.py","file_url":"https://github.com/ys-zong/vlguard/blob/HEAD/utils/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"96d7381525bbcb61"}},{"code_sha256_prefix":"d18629042893a7ec","entry":"encode_image","repo":"ys-zong/vlguard","repo_kind":"official","path":"gpt4_evaluator.py","file_url":"https://github.com/ys-zong/vlguard/blob/HEAD/gpt4_evaluator.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d18629042893a7ec"}},{"code_sha256_prefix":"57a7119c5f4d29e6","entry":"format_conversation","repo":"ys-zong/VLGuard","repo_kind":"official","path":"convert_to_llava_format.py","file_url":"https://github.com/ys-zong/VLGuard/blob/HEAD/convert_to_llava_format.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"57a7119c5f4d29e6"}},{"code_sha256_prefix":"2023b23694feac86","entry":"load_data","repo":"ys-zong/vlguard","repo_kind":"official","path":"utils/utils.py","file_url":"https://github.com/ys-zong/vlguard/blob/HEAD/utils/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2023b23694feac86"}},{"code_sha256_prefix":"bb00c4a25d41c6bf","entry":"load_image","repo":"ys-zong/vlguard","repo_kind":"official","path":"utils/utils.py","file_url":"https://github.com/ys-zong/vlguard/blob/HEAD/utils/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"bb00c4a25d41c6bf"}},{"code_sha256_prefix":"97f63c0705ddb3a8","entry":"generate_image","repo":"ys-zong/vlguard","repo_kind":"official","path":"gpt4_evaluator.py","file_url":"https://github.com/ys-zong/vlguard/blob/HEAD/gpt4_evaluator.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"97f63c0705ddb3a8"}},{"code_sha256_prefix":"2a330dfbb81232e4","entry":"process_data","repo":"ys-zong/vlguard","repo_kind":"official","path":"gpt4_evaluator.py","file_url":"https://github.com/ys-zong/vlguard/blob/HEAD/gpt4_evaluator.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2a330dfbb81232e4"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}