language:
- en
tags: - vlmguard
- vision-language
- safety
VLMGuard JailBreakV/GPT4V detector
The VLMGuard detector trained with Qwen2.5-VL-7B-Instruct features for the JailBreakV/GPT4V evaluation. See the paper and VLMGuard code repository. The detector weights do not include the Qwen backbone or datasets.
The checkpoint uses Qwen2.5-VL-7B-Instruct revision cc594898137f460bfe9f0759e9844b3ce807cfb5, final-token head-wise features with shape (N, 28, 3584), selected layer 8 and subspace rank 1. The classifier has hidden width 256 and two output logits.
| Metric | Value |
|---|---|
| Held-out AUROC | 0.9817013616071427 |
| Held-out AUPR | 0.9788129385786769 |
| Held-out examples | 9600 |
classifier.pt contains a PyTorch state dict, subspace.npz contains the selected projection, and metrics.json records the configuration. SHA256SUMS.json records their checksums. These files were converted from the verified training run and tested with the repository's verify_model.py and infer.py; CPU inference on the held-out feature array reproduced AUROC 0.9817013616071427.
Download the four files into one directory, then run:
python verify_model.py --run-dir /path/to/model
python infer.py --run-dir /path/to/model --features /path/to/features.npy --output scores.npy --device cpu
The feature array must use the same backbone revision, token selection, layer indexing and hidden dimension. The output is a maliciousness probability for each input row.
Citation
@article{fang2026vlmguard,
title={VLMGuard: Bootstrapping Malicious Prompt Detectors from Unlabeled Vision-Language Prompts in the Wild},
author={Fang, Junlin and Chen, Wenyu and Ghosh, Reshmi and Sim, Robert and Salem, Ahmed and Carvalho, Vitor R. and Lawton, Emily and Li, Sharon and Stokes, Jack W. and Du, Sean},
journal={Transactions on Machine Learning Research},
year={2026},
url={https://openreview.net/forum?id=z7gczmhmmo}
}