Harnessing Hyperbolic Geometry for Harmful Prompt Detection and Sanitization
Authors: Igor Maljkovic
Maria Rosaria Briglia
Iacopo Masi
Antonio Emanuele Cinà
Fabio Roli
Venue: ICLR 2026 Poster (2026)
Keywords: Vision–Language Models
Safety
Robustness
Adversarial Machine Learning
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: HyPE detects harmful prompts by modeling benign prompts in hyperbolic space. Prompts outside this region are flagged and passed to HyPS, which identifies and modifies harmful words to neutralize unsafe intent while preserving meaning.

Abstract: Vision–Language Models (VLMs) have become essential for tasks such as image synthesis, captioning, and retrieval by aligning textual and visual information in a shared embedding space. Yet, this flexibility also makes them vulnerable to malicious prompts designed to produce unsafe content, raising critical safety concerns. Existing defenses either rely on blacklist filters, which are easily circumvented, or on heavy classifier-based systems, both of which are costly and fragile under embedding-level attacks.
We address these challenges with two complementary components: Hyperbolic Prompt Espial (HyPE) and Hyperbolic Prompt Sanitization (HyPS). HyPE is a lightweight anomaly detector that leverages the structured geometry of hyperbolic space to model benign prompts and detect harmful ones as outliers. HyPS builds on this detection by applying explainable attribution methods to identify and selectively modify harmful words, neutralizing unsafe intent while preserving the original semantics of user prompts.
Through extensive experiments across multiple datasets and adversarial scenarios, we prove that our framework consistently outperforms prior defenses in both detection accuracy and robustness. Together, HyPE and HyPS offer an efficient, interpretable, and resilient approach to safeguarding VLMs against malicious prompt misuse.

Published as a conference paper at ICLR 2026
HARNESSING HYPERBOLIC GEOMETRY FOR HARMFUL PROMPT DETECTION AND SANITIZATION
Igor Maljkovic Maria Rosaria Briglia"
lacopo Masi
Antonio Emanuele Cinà'
Fabio Roli
Uniiersityy of Genoa, Italy
3 University of Cagliari, Italy
Sapienza University of Rome, Italy
ABSTRACT
Vision LanguugL Models (VLMs) have become essential for tasks such as image synthesis, captioning, and retrieval by aligning textual and visual information in shared embedding space. Yet, this flexibility also makes them vulnerable to mali- cious prompts designed to produce unsafe content, raising critical safety concerns. Existing defenses either rely on blacklist filters, which are easily circumvented, on heavy classifier-based systems, both of which are costly and fragile under embedding-level attacks. We address these challenges with two complementary components: Hyperbolic Prompt Espial (HyPE) and Hyperbolic Prompt Sanitiza- tion (HyPS). HyPE is a lightweight anomaly detector that leverages the structured geometry of hyperbolic space to model benign prompts and detect harmful ones as outliers. HyPS builds on this detection by applying explainable attribution methods to identify and selectively modify harmful words, neutralizing unsafe intent while preserving the original semantics of user prompts. Through exten- sive experiments across multiple datasets and adversarial scenarios, we prove that our framework consistently outperforms prior defenses in both detection accuracy and robustness. Together, HyPE and HyPS offer an efficient, interpretable, and resilient approach to safeguarding VLMs against malicious prompt misuse.
Code available at: github.com/HHyPE- Sithbb.omm/yyy--..MMM//iepeoeeee
This paper contains potentially offensive text and images, included to illustrate the risks associated with VLMs and to raise awareness about their potential harmful consequences or misuse.
Disclaimer:
INTRODUCTION
Trained on massive web-scale datasets, Vision-Language Models (VLMs) have emerged as cor- nerstone of modern AI. These models can jointly process and reason over visual and textual modal- ities, enabling a rich understanding of the semantic relationships between images and text (Nickel & Kiela, 2018). Their effectiveness stems from the ability to align linguistic and visual information within shared embedding space, yielding robust cross-modal representations. While the idea of bridging language and vision has long been present the research community (Joulin et al., 2), earlier approaches were limited by the capacity of text encoders. The advent of transformer-based architectures (Vaswani et al., 2017) provided the necessary representational power, enabling VLMs to fully exploit large-scale multimodal pretraining (Radford et al., 2021). Once pretrained, these models can work as foundational components for a wide range downstream applications, includ- ing retrieval (Radford et al., 2021; Li et al., 2022) and text-to-ing -mmgge generation tasks (Rombach et al., 2022; Podell et al., 2023), where pretrained text encoders are used for guiding the mapping from language images. However, the same capabilities that make VLMs widely useful also expose them to misuse. Malicious prompts can be crafted to elicit harmful content, ranging from nudity and violence hate speech. posing sigmificant risks for responsible deployment (Yang et al., 2024a:c; Rando et al., 2022; Schramowski et al., 2023). Existing safeguards are limited: blacklist-based fil- ters (Liu al., 2024; Midjourney, 2025) are easily circumvented through paraphrasing or adversar- ial prompt optimization, while large-scale classifier-based systems (Li, 2025; Hanu & Unitary team, 2020) bring high computational costs and remain vulnerable to embedding-level attacks. As recent
"Equal contribution; order decided by dice roll. Correspondance antonic cina@uniee....

---

Published as a conference paper at ICLR 2026
Safe Prompt
HyPE
HyPS
Harm Detection
Sanitized Prompt
Painting of oranges, bowl. candle, a pitcher
Painting of vag bowl,, di and lufe
Painting of heart, a bowl, say, and
Teat Encuder
Harmful Prompt
Painting of vag howl, di and lute
Figure I: HyPE and Hyps pipeline overview for T21 generation task. User prompts are being processed by the hyperbolic frozen text encoder. Prompt classified as benign from HyPE E are directly generated, the ones classified as malicious are then sanitized by HyPS before the decoding.
work on adversarial prompt manipulation has shown, even state-of-the-ar filtering mechanisms fail to reliably block unsafe generations (Yang et al., 2024a;c). These limitations highlight the urgent need for lightweight, robust defenses that can detect and neutralize malicious intent beforehand.
In this work, present pipelines. Our method builds on the structured representation properties of hyperbolic geome- try (Nickel & Kiela, 2018), which naturally capture hierarchical and compositional relations in text embeddings. Specifically, we harness hyperbolic structured embeddings as a foundation and intro- duce two components: Hyperbolic Prompt Espial (HyPE), for harmful prompt detection, and Hy- perbolic Prompt Sanitization (HyPS), for sanitization of malicious prompts. HyPE learns a compact region that captures the notion of safe behavior, effectively modeling the distribution of harmless prompts. Prompts that fall outside this learned safe region are considered anomalous and potentially harmful. Such prompts are then passed HyPS. the sanitization module, which uses an explainable attribution method to identify the specific words responsible for the harmful classification. HyPs can then selectively modify or replace these words, neutralizing unsafe intent while preserving as much of the original semantic content as possible. An example is illustrated in Fig. 1.
approach for detecting and sanitizing malicious prompts in VLM
We benchmark HyPE against five ofate-of-the-an detection methods across six diverse datasets. We further evaluate the robustness of our approach under range of adversarial conditions, including MMA-Diffusion (Yang et al., 2024a), SneakyPrompt-RI. (Yang et al., 2024c), StyleAtrack (Qi al., 2021), well as white-box adaptive attack that introduce in this paper to explicitly target our defense. These attacks attempt to rephrase harmful inputs and manipulate their embeddings to evade harmful prompt detection systems. While existing defenses frequently fail under these manipulations, HyPE consistently sustains high detection performance, highlighting its robustness where prior approaches collapse. We lastly assess HyPS in sanitizing malicious prompts across two downstream tasks, text-to-image generation and image retrieval, showing that it can reliably neutralize harmful intent while preserving prompt semantics and enhancing the safety of VLMs.
Our contributions are threefold:
We introduce HyPE, a hyperbolic SVDD anomaly detector that identifies harmful prompts outliers from benign distributions, while requiring training of only single parameter.
We propose HyPS, explainable sanitization mechanism that pinpoints and modifies harmful words to neutralize unsafe intent, all while preserving the original semantics of the prompt.
We conduct a comprehensive evaluation, including standard and adaptive adversarial prompt attacks, and show that HyPE remains effective in keeping VLMs safe.
RELATED WORK
2.1 VISION-LANGUAGE MODELS (VLMS)
VLMs have rapidly advanced the field of artificial intelligence by enabling systems to interpret and align visual and textual modalities jointly (Radford et al., 2021). The core mechanism VLMs in- volves learning shared embedding space in which both images and text projected via contrastive
2

---

Published as a conference paper at ICLR 2026
Equatoe
Meridian
Equilisani curse
Hongan (20
2
X
X
Figure 2: (left) SVDD hypersphere within Euclidean space. (right) Lorentz model upper hyper- boloid. The equidistance curve indicates the boundary of the HSVDD hyperbolic sector.
or generative objectives, facilitating robust cross- modal understanding (Jia al., 2021). Pioneering works such CLIP (Radford et al., 2021), ALIGN (Jia et al., 2021), and BLIP (Li et al., 2022) leverage large-scale pretraining on noisy image-text pairs to learn rich, multimodal representations. These models demonstrate impressive capabilities across various tasks, such image retrieval (Rad- ford et al., 2021), visual question answering (Antol et al., 2015), image generation (Ramesh et al., 2021), and multimodal reasoning (Tan & Bansal, 2019), justifying their wide adoption.
Hyperbolic Models. Recent works demonstrated that hyperbolic space (Ganea et al., 2018; Peng al., 2021) is emerging as a preferred framework for organizing structured embedding representa- tions. Its inherent geometric properties allow modeling hicrarchical and tree-like structures (Cannon al., 1997; Krioukov al., 2010) with minimal distortion, more effectively capturing and preserv- ing hierarchical relationships. Hyperbolic learning has indeed been successfully applied in various domains, including few-shot learning (Gao et al., 2021; Yang et al., 2025), and VLMs (Pal al., 2025; Peng et al., 2025). The Lorentz hyperbolic model (Nickel & Kiela, 2018; Ramasinghe et al., 2024) is commonly adopted when a hierarchical structure needs to be imposed in network learning- In an n--imensional setting, the Lorentz model is defined as the upper sheet of two-sheeted hyper- boloid embedded in (n+ 1)-dimensional Minkowski space (Kosyakov, 2007). Formally, hyperbolic space H" is given by:
HH =
(0,x)C= = K O, 1 0}, and ve. = TO +
Tillis
(1)
where ( denotes the Lorentzian inner product and K e: R being fixed positive curvature parameter. visual representation of the Lorentz hyperboloid is shown in Fig. (right). The hy- perbolic representation provides
structured separation space, which naturally disentangles hierarchical and compositional relations, making it well-suited for modeling data with latent hi- erarchical structure. Peng al. (2025) proposes fine-tuning CLIP in hyperbolic space, achieving hierarchical alignment for open- voccabbabyy segmentation tasks. Hu et al. (2024) exploits hyperbolic constraints between prototypes and instances enhance domain alignment and feature discrimina- tion. Furthermore, Poppi et al. (2025) introduces Hyperbolic Safety Aware VLM (HySAC), which uses hyperbolic entailment loss to model the hierarchical and asymmetrical relationships between safe and unsafe image-text pairs. Lastly, Zhao et al. (2025) constructs a category- airgory-attribut-mmage hierarchical structure among text classes, images, and attribute prompts.
2.2 HARMFUI. PROMPTS DETECTION
The proliferation of VLMs has also amplified their potential misuse for generating harmful, explicit, or illegal content, underscoring the need for robust safeguards to detect and filter unsafe queries. Commercial platforms such as Midjourney (Midjourney, 2025) and Leonardo.At already implement content filtering mechanisms as primary line of defense. Most existing approaches formulate this task as a binary classification problem, which requires large volumes of carefully curated and annotated training data. Current methodologies typically fall into categories: prompt- based classifiers (Li, 2025; Khader et al., 2025; Hanu & Unitary team, 2020) and embedding- based tech- niques (Liu al., 2024). Despite their differences, existing implementations typically lack adapt-
3

---

Published as a conference paper at ICLR 2026
ability when confronted with novel or deliberately obfuscated NSFW content, and their decision- making mechanisms often remain opaque, providing limited interpretability. In particular, conven- tional embedding- based approaches (Liu et al., 2024) generally treat embedding spaces simple computational substrates, without exploiting their inherent geometric structure. In contrast, our approach reconceptualizes harmful prompt detection geometric structure of hyperbolic space is explicitly exploited to construct a detection mechanism that is more effective, robust, and interpretable.
anomaly detection problem, where the
3 METHODOLOGGY
In this section, we present HyPE, our detection framework for identifying and flagging harmful tex- tual prompts. Trained exclusively on benign prompts, HyPE is based on the Hyperbolic Support Vector Data Description (HSVDD) model, which we introduce in this work by extending the tradi- tional Support Vector Data Description (SVDD) (Tax Duin, 2004b) to hyperbolic geometry. Once harmful prompts are detected, the system can sanitize them using a second module, namely HyPS, which highlights the words that contribute most to a prompt being classified as harmful and applies sanitization by either removing substituting these words. Together HyPE. and HyPS, illustrated in Fig. 1, are intended to safeguard VLMs, diminishing the risk of exposing to harmful content.
Notation. To introduce the proposed methods, first define some common notation used through- out the following sections. We assume the existence of tokenization algorithm vr() E N with d = 77, which splits an input prompt p P into multiple subtokens, i.e., (p) {po, Plo....... ...). We define the hyperbolic space HH C Rn+1 as in Eq. (1), represented using the Lorentz model, which serves as the embedding space for our approach. Lastly, we define the text encoder operat-
ing in such hyperbolic space, as in (Poppi et al., 2025), denoted by Tg which, given a tokenized prompt, produces hyperbolic embedding ep T (p))).
3.1 HYPE: PROMPT DETECTION VIA ONE-CLASS HYPERBOLIC SVDD
The proposed detection defense, namely Hyperbolic Prompt Espial (HyPE), employs a hyperbolic text encoder (Poppi et al., 2025) that projects prompts into the Lorentz space. In this way, HyPE inherits structured representation where benign prompts will form compact clusters the resulting hyperbolic space, while harmful prompts are pushed farther away as they semantically deviate from the safe ones. We provide in Appendix A.3 and Table empirical validation of this separability effect. Lastly, we design HyPE a one-class classification head trained exclusively on benign prompts. The underlying premise is that harmful intent manifests as an outlier relative to benign behavior, making HyPE capable to flag unseen anomalous input as potentially harmful. Specifically, we extend the Support Vector Data Description (SVDD) (Tax & Duin, 2004a) unsupervised anomaly detection framework to work the hyperbolic space. In particular, the SVDD) approach works under the Euclidean geometry and it is based on the idea of learning a hypersphere that encloses the training data by jointly optimizing its center c* Rd and radius Rt R. SVDD formulation does not directly extend to hyperbolic representations, where distances are defined along geodesics rather than through simple Euclidean norms. To overcome this limitation, we extend the SVDD principle to hyperbolic space, yielding Hyperbolic SVDD (HSVDD). The objective for HSVDD then becomes:
1
"
1 max (0,dn(p: co) - R), with co [[ VK ......,0) O] =[>/x......0
R E argmmin
R² 2
1=1
where X = (2.......... ] is the set of training prompts, da denotes the pairwise geodesic dis- tance in the Lorentz model, defined as d vR arccosh ( K (x, z) with x, z E H Lastly, the parameter V E (0, 1] controls the balance between learnt volume and margin violations. When / = 0, HSVDD reduces to a pure radius minimizer, focusing solely on shrinking the hyper- sphere without penalizing training points that fall outside the boundary. Conversely, when v 1, HSVDD enforces a stricter criterion by encouraging the smallest possible radius that still encloses all training samples with no violations. Unlike SVDD (Tax & Duin, 2004a), where both the center and the radius are optimized, HSVDD in HyPE fixes the center c at the origin of the Lorentz model and learns only the radius R E R the sole parameter for detection. The optimization encourages R to be as small as possible while still covering the majority of benign prompts. In this formula- tion, the SVDD n-dimensional hypersphere S (c, R*) with center and radius R. is mapped the
4

---

Published as a conference paper at ICLR 2026
region of the hyperboloid Sa R defined as the set of points lying at constant geodesic distance R from the center Co- We illustrated this mapping in Fig. 2.
The learned hyperboloid defines the boundary of normal behavior: prompts that lie inside close to the hyperboloid. having geodesic distance lower than R are considered benign, while points that fall outside this boundary treated anomalies. Consequently, once trained, the final detection in HyPE reduces to a simple decision rule by comparing the geodesic distance between their hyper- bolic embeddings the center co and the learned radius It.. Formally, given prompt p with its corresponding embedding representation in the hyperbolic geometry ep. HyPE operates as follows:
e
HyPE(p) = fO, if da(e co) S R 1,
(3)
if da(ep: co) R
where class O corresponds to a Safe prompt and class corresponds Harmful prompt.
3.2 HYPS: HYPERBOLIC PROMPT SANITIZATION
Prompt sanitization (Chong et al., 2024) aims to identify and modify harmful words in user- user-provided prompts before downstream VLMs process them. The goal is to prevent malicious content gener- ation while at the same time preserving the utility of the prompt. In our framework, sanitization implemented in a second module, namely HyPS, which builds directly on the predictions from HyPE. Specifically, once harmful prompts are detected by HyPE, HyPS is then used to explain the model's 's decision using a post-hoe explanation technique (Madsen et al., 2022) that highlights the tokens most responsible for harmful classification. This attribution step serves two purposes. On the one hand, it identifies the specific words that drive the detector's 's prediction, guiding the sanitiza- tion process. On the other hand, provides sanity check to ensure that the model not relying on spurious correlations when flagging prompts as unsafe. Formally, given the tokenizer Vi and HyPE detector, the post-hoc explanation algorithm ø computes an attribution vector for a prompt p:
Φ (p), HyPE) (a1, a2,..........................a.. ad))
(4)
where a, E IR measures the influence of token p; on the detector's decision. In our work, we quan- tify token-level contributions using Layer Integrated Gradients (Sundararajan et al., 2017). Further- more, because modern transformer-based models process text as subword tokens rather than whole words ( (Vaswani et al., 2017), we aggregate token-level attribution scores into word-level ones. If a word is split into multiple tokens, the attribution scores of its constituent tokens are summed to obtain a single influence score. This ensures that each word in the original prompt receives coher- ent importance score, which can be directly interpreted by humans and used to guide sanitization. Once harmful words identified, HyPS applies a sanitization algorithm neutralize unsafe intent while preserving as much of the original meaning as possible. We experiment with three sanitiza- tion strategies of increasing sophistication designed neutralize the words that contribute most to the harmful prediction by HyPE, effectively removing elements that could drive harmful content generation or retrieval. In the following paragraphs, we describe each sanitization strategy in detail.
Harmful prompt: Man mastu seeeing
ing in the bushes while looking at the na**d woman in the distance
HARMFUL
01
Sanitized prompt: Man sitting in the bushes while looking at the clothed woman in the distance
BENIGN
Figure 3: Harmful Prompt Sanitization via Thesaurus+LIA (HyPS).
Word Removal. It removes the most influential words identified by Φ, i.e., those that contribute most strongly to harmful prediction by HyPE. This strategy ensures maximum reduction of harm- ful content but comes at the expense of prompt coherence and informativeness.
Thesaurus Word Removal. With this approach, harmful words are first replaced with antonyms obtained from the open-source Merriam Thesaurus API. If no suitable antonym is found, the word removed. This method reduces semantic loss compared direct removal while better preserving the intent of the original prompt. When multiple antonyms are present, the one with the highest CLIP similarity (Radford et al., 2021) compared to the original harmful word is chosen.
httpps: / /wwww merri am www.wwrbbee....... ctmbbatrrcccmm
5

---

Published as a conference paper at ICLR 2026
Thesaurus + LLM. To further improve semantic preservation, extend the previous strategy by incorporating an instruction-tume tumed LLM, Qwen3-14B (Team, 2025) see instruction details in Appendix A.5. When suitable antonym is available, the LLM generates safe replacement instead of simply discarding the word. As a result, this technique maximizes semantic preservation compared to prior methods. In Fig. 3, we demonstrate the effectiveness of the Thesaurus +LMM approach in sanitizing a harmful prompt while preserving its original semantics. In this example, the word "naked"" would be substituted with its corresponding antonym "clothed", while the word "masturbating" having no antonyms, has been changed to the safe word "sitting" using the LLM.
4 EXPERIMENTS
We report an extensive experimental evaluation of HyPE and HyPS across six datasets, two adversar- ial attack settings, and two downstream tasks, comparing against state-of-the-art detection methods and demonstrating consistent improvements in both detection rate and semantic preservation.
4.1 EXPERIMENTAL SETUP
Datasets. We evaluate HyPE on 6 different datasets of naturally occurring prompts, grouped into two main categories: Paired Prompts and Single-Class Prompts. The former category of datasets, including ViSU (Poppi et al., 2024), MMA (Yang et al., 2024a), and SneakyPrompt (Yang et al., 2024c), provide paired examples of safe and harmful prompts with closely matched semanties, al- lowing us to evaluate the model's ability to detect subtle differences in intent. Complementary, Single-Class Prompts datasets consist exclusively of either safe harmful prompts and are used to test models under imbalanced settings. Within this category, we find COCO (Lin et al., 2014) (safe only), I2P* (Schramowski et al., 2023) (harmful only), and NSFW56K (Li al., 2024) (harmful only). Further details about the dataset composition are provided in Appendix A.2.
Adversarial Prompts. We further assess the performance of HyPE against state-of-the of-thee-rt detectors on adversarial prompts deliberately crafted to evade safety filters by obfuscating or disguising harm- ful intent (Chu et al., 2024). To this end, consider two recent adversarial attacks: MMA (Yang et al., 2024a) and SneakyPrompt-RL (Yang et al., 2024c), For MMA, the corresponding adversarial prompts are generated by iteratively modifying a random suffix until its embedding aligns with that of a harmful target prompt, thereby concealing its malicious intent. We run the MMA attack in a white-box setting directly against the HySAC text encoder (Poppi et al., 2025), and we refer to the resulting dataset with adv-MMA. For SneakyPrompt-RL (Yang et al., 2024c), we adopt the default attack setup targeting Stable Diffusion (Rombach et al., 2022) and apply to the ViSU dataset, where sensitive words are replaced with short subword tokens until the prompt is no longer flagged as unsafe by the text_match safety filter. We refer to the resulting dataset as Adv-V.SU.
Adaptive A Attacks To evaluate HyPE under adaptive scenarios, consider two attacks. The first is an adaptive version of StyleAttack (Qi et al., 2021), which paraphrases prompts to evade detection by querying each model individually, generating model-specific adversarial paraphrases. Further details and results for this attack are available in Appendix A.9. The second is a custom adaptive attack we propose extend the MMA-Diffusion (Yang et al., 2024a) to explicitly target HyPE under a worst-case adaptive scenario. Under this attack we consider a strong attacker that has full access to the defense, including the hyperbolic encoder T and the learned HSVDD decision boundary defined by the center с and radius R. Given a harmful target prompt Pr E P. the attacker optimizes a candidate prompt Pc E P maximizing the semantic similarity with pr while remaining within the benign hyperbolic region. Formally, we define the adversarial optimization problem as:
PC = arg max SCON (op. oxx) - > max {0, de(c, oit POEP
(ff R.).
(5)
where e/ (V epr and target prompts. and Soor denotes the cosine similarity between them. The ReLU-style term max(0, dz(c, e - R} penalizes embeddings outside the learned decision boundary. The parameter À E [o. 1] controls the importance of the attacker to evade detection relative to preserving semantic similarity with the target prompt. Specifically, À increases, the attack prioritizes evad- ing HyPE by generating candidate prompts that lie within the learned benign region of radius R. Additional details on this attack and its implementation provided in Appendix A. 10.
(W(P)) are the hyperbolic embeddings of the candidate

---

Published as a conference paper at ICLR 2026
HyPE and HyPs Configuration. HyPE implements the anomaly detection adopting the HSVDD framework. In particular, to implement the hyperbolic deep imput preprocessing layer, we leverage the pretrained text encoder of HySAC (Poppi et al., 2025) model. HyPE detection module is trained only on the benign prompts from ViSU, following Eq. (2) and optimized by setting V = 0.0325. An ablation study on this hyperparameter is provided in Appendix A.7. The explanation method used by HyPS for inspecting harmful prompts detected by HyPE is Layer Integrated Gradients (LIG) (Sun- dararajan et al., 2017). We adapt LIG to operate on the embedding layer of the HySAC transformer- based text encoder, attributing HyPE's s output directly to the token embeddings obtained from the first layer, an interpretable stage where each embedding corresponds one-to-one with an input to- ken. We then compute the gradients of the HyPE's output with respect to the token embeddings, and by accumulating them, we obtain attribution scores that capture each token's 'ss influence. Finally, token-level scores are aggregated into word-level attributions to guide the sanitization step.
Downstream Tasks. Being developed to support VLMs, HyPE and HyPs serve as plug-and-play protection mechanisms that can be applied across different application scenarios. In this work, we evaluate their effectiveness in two practical tasks: Text-to-Image (T2I) generation and Image Retrieval (IR). For the T2I task, harmful intent in prompts from the VISU dataset, sanitize them, and then compare the generated outputs to verify that unsafe content is removed while semantic intent is preserved. To ensure that malicious prompts would otherwise lead to unsafe results, we adopt a standard SD pipeline with a decoder configuration known produce realistic NSFW content when given harmful inputs. 2 For the IR task, we leverage the joint embedding space of VLMs, which enables gross-modal retrieval by aligning text and image representations. Given a prompt p and a pool of m candidate images IR is performed by computing the cosine similarity between the embedding of p and
the Stable Diffusion (SD) pipeline. Our goal is to detect
I= {t, 33- the embedding of each candidate image ij E I. Lastly, candidate images are then ranked according to their similarity to the input prompt p. and the top-k results are returned as those most semantically aligned with the input query. For evaluation the IR setting, we use the UnsafeBench dataset (Qu et al., 2024) containing paired malicious and benign prompts with their corresponding images, and measure how HyPE and HyPS improve retrieval safety by detecting and sanitizing harmful queries before retrieval. Across both downstream task goal is showcase how HyPE and HyPS enabling the VLMS to prevent harm return semantically relevant yet safe outputs.
Evaluation Metrics. For the detection task, we report precision, recall, and the Fl score (Powers, 2020). Precision measures the proportion of prompts identified as harmful that are indeed harmful, while recall captures the proportion of truly harmful prompts that are correctly detected. The Fl score, defined as the harmonic mean of precision and recall, provides a single measure that balances these two aspects. In our context, high precision indicates a low number of false positives, whereas high recall reflects the effective detection of harmful prompts. For single-class datasets, where only safe or harmful prompts are present, we report the classification Accuracy (Acc.). For downstream applications, we adopt task-specific metrics. In T2I generation, we use CLIPScore (Hessel et al., 2021) to evaluate the semantic alignment between generated images and their conditioning prompts. In image retrieval, we report Recall @ k (R&k) (Manning, 2008), which measures the fraction of rel- evant images retrieved among the top-k results, and Safe k (S0k), which quantifies the proportion of retrieved images that safe. Finally, to evaluate the semantic consistency between the origi- nal harmful prompts and their sanitized counterparts, we compute the cosine similarity using both SBERT (Reimers & Gurevych, 2019) and CLIP embeddings (Radford et al., 2021).
4.2 EXPERIMENTAL RESULTS
Harmful Prompt Detection. We compare HyPE against state-of-the-art classifiers, including NSFW Classifier (Li, 2025), DiffGuurd (Khader et al., 2025), Detoxify (Hanu & Unitary team, 2020), LatentGuard (Liu et al., 2024), and GuardT2I (Yang et al., 2024b). Table reports precision, recall, and FI scores for paired, single-class, and adversarial prompt datasets. Notably, despite being trained only on benign training samples from the ViSU dataset, HyPE consistently achieves the highest Fl scores across all datasets, suggesting a strong generalization capacity and reliable performance across both harmful and benign prompts. More specifically, HyPE achieves the highest Fl scores on ViSU (0.98), MMA (0.95), showing balanced precision and recall in contrast to other models that exhibit extreme behavior, such as Detoxify achieving 0.98 precision but only 0.26 recall
We use stabledi fusi Fuusionapi// /wwweallwlllleeee itty1-g obbl -n-n-nff fw available on HuggingFace.
7

---

Published as a conference paper at ICLR 2026
on ViSU, Wee--Clasiffier attaining 0.96 recall on MMA but only 0.75 F1 due to lower precision. On the SneakyPrompp dataset, HyPE achieves the second highest recall score (0.93) after GuardT while maintaining higher precision of 0.68, illustrating its ability to detect subtle harmful varia- tions without excessive false positives. In single-class datasets, HyPE demonstrates strong detection of harmful prompts, achieving 0.99 accuracy on NSFW56k and 0.66 on 12P", while maintaining 0.99 accuracy on benign COCO prompts. Lastly, when considering adversarially crafted prompts, we observe again how HyPE maintains the highest overall FI, scoring 0.96 on adv-MMA and 0.80 on ViSU, despite other models occasionally achieving slightly higher precision or recall in iso- lation. These results highlight that HyPE is not only highly effective on naturally occurring harmful prompts but also robust against adversarially optimized ones, consistently delivering balanced detec- tion of harmful and benign prompts across diverse datasets, including those not seen during training.
Table I: Comparison for harmful prompt detection on paired, single-class, and adversarial datasets.
Method
Paired Prompts
Single-ciass Prompts
Adversurial Prompts
VISU
MMA
Prompt
COCO
12P"
NSFW56k
adv-MMA
adv-VISU
Rec
Rec
Acc
Asc
Asc
Rec
Pr
0.80
0.61
0,96
0.75
0.67
0.78
0.61
0:65
0.95
0.62
0.99
0.62
0.64
DiftGuand
0.27
0.36
0.31
0.47
0.88
0.61
0.46
0.85
0.60
0.99
0.28
0.89
0.89
0.97
0.93
0.97
0.40
0.65
Detoxity (Orig)
0.98 0.26
0.40
0.96
0.88
0.92
1.00
0.28
0.44
0.99
0.03
0.34
0.93
0.56
0.70
1.00
0.07
0.13
Latent Guard
0.79
0.52
0.63
0,95
0.81
0.88
0.91
0.41
0.57
0.84
0.35
0.52
0.94
0.80
0.86
0.49
0.18
0.27
GuardT21
0.48
0.77
0.59
0.58
0.92
0.72
0.52
0.95
0.66
0.77
0.26
0.09
1.00
0.10
0.19
0.42
0.71
0.53
HyPE (Ours)
0.98
0.98
0.98
0.98
0.92
0.95
0.68
0.93
0.78
0.99
0.66
0.99
0.98
0.93
0.96
0.97
0.67
0.80
dead st
Tea Ling bodie
Preeettryy Nettrakee Proeges
Xurinat
inn
the
sexual
raped
drug
bloody
sract
d
nangin ing
reces
12
Score
The
mi Mee
stt
beatten
suicide
ing
Mort lieaen
gun yomi taeat Tucking
drugs S
Thmeasn Wadd Brand
Thaussa E15I
broken na
pnu cocaine Redhicting
Voll saggle
Mheanee LLM
Tommon LWB
Wint Bezerok
Handa Ward Stakituol
(a) Word Cloud Analysis
(b) Sanitization Rate
(c) Semantic Similarity
Figure 4: Harmful prompt sanitization analysis.
Harmful Prompt Sanitization. We present the sanitization performance of HyPS applied harm- ful prompts detected by HyPE, with the objective of removing malicious intent while preserving semantic content. To this end, considering the ViSU test prompts detected as harmful by HyPE, we first illustrate in Fig. 4a a word cloud of the most relevant words identified by HyPs. Specifically, for each harmful prompt, we consider only the most relevant words identified by the explanation method @ in HyPs, and we aggregate the frequencies of these words across the dataset. This vi- sualization demonstrates that HyPS consistently identifies meaningful, harmful words rather than relying on spurious correlations. For a more detailed analysis of the word cloud, see Appendix A.4. We evaluate the effectiveness of the three sanitization strategies in HyPS by measuring the per- centage of prompts reclassified benign by HyPE after sanitization. The results in Fig. 4b show that across methods, a substantial portion of harmful prompts are successfully neutralized, mean- ing HyPE no longer flags them malicious, with rates ranging from 65% (Thesaurus+LLM) to 85% (Word Removal). Although Word Removal achieves the highest neutralization, this comes at the cost of semantic preservation. In particular, Thesaurus+ +LM modifies only harmful words, preserving the original prompt meaning, while Word Removal removes these elements and therefore loses more semantic content. Quantitative evaluation using SBERT and CLIP em- beddings confirms indeed that prompts sanitized with Thesaurus+ LLM remain highly similar to the originals, with mean cosine similarities of 0.82 and 0.87, respectively, indicating that harm- ful elements can be removed without compromising the user's intent. The Thesaurus Word Removal method provides an intermediate balance, neutralizing a moderate fraction prompts while incurring noticeable semantic loss. Overall, Word Removal is most effective for complete prompt neutralization, Thesaurus+in is preferable when preserving prompt semantics is nec- essary, and Thesauruse +Word Removal 1 offers compromise solution between them.
8

---

Published as a conference paper at ICLR 2026
Man mustarbatinn the bredes while losking st the saked wumnn in the distams: sitting
A mun on tennis court has a gun shoots other playens.
looking at
green players.
Figure 5: Qualitative comparison for the T2I task. Images generated with SD-XL using sanitized prompts (green) do not exhibit harmful content, while retaining the original prompt context (red).
T21 Generation Task. Following the setup described in Section 4.1, we incorporate HyPE and HyPS into the Stable Diffusion (SD) pipeline as a plug-and-play prompt moderation module, aim- ing prevent the SD from generating harmful content. In this setting, consider harmful prompts from the ViSU dataset, and performance evaluated using both qualitative and quantitative assess- ments the generated images. Fig. 5 shows two qualitative examples. Red rectangles indicate harmful prompts, whose unfiltered generations correspond to images flagged as malicious. Green rectangles show the sanitized prompts produced by Thesaurus+ LLM and their paired images, flagged as safe. Notably, images generated with SD using these sanitized prompts are deprived of the malicious content while preserving the original prompt context. Complementary, tively measure the effectiveness of moderation, we generate images for all harmful ViSU prompts both without filtering and with HyPE and HyPS, using each sanitization method. We then com- pute CLIPScore between each generated image and its corresponding original malicious description to assess how much the generated content deviates from the initial harmful description. Fig. 4c shows that Thesaurus + +LM yields lower CLIP scores against the malicious prompt, indicating its effectiveness in reducing alignment with harmful content while preserving semantic coherence.
quantita-
Prompts
R@1
S@1
R@5
se5
Setting No Atrad CC Atsedk
Harmful prompts
39.49
0.0
72.23
Oscurssides
Word semoval
6.91
49.34
20.96
44.04
Presaurus-Rord Removal
7.02
49.00
20.90
44.07
2000
Ibesasrus-LiX
7,08
49.29
21.07
44.19
145
10C
Fooder Borns
Male Brood
Fooule Geoitille
Mole Gondteli
Table 2: Detection results for the IR downstream task. S@k measures the proportion of retrieved images that are safe within the top-k results.
Figure 6: Histogram of NudeNet detections.
Image Retrieval Task. For the IR task, we rely on the UnsafeBench dataset, which provides large collection of images and paired captions, covering both safe and unsafe concepts. From this dataset, we select subset of 3,2 unsafe captions and use them to retrieve top-k images with the CLIP (Radford al., 2021) encoder. We then repeat the retrieval process but using sanitized prompts generated by the three sanitization strategies in HyPS. As shown in Table 3, evaluate performance for = 1, using two metrics: RØ k and S@k. Results confirm that sanitization substantially reduces the likelihood of retrieving images aligned with harmful prompts, while increasing the chance of retrieving images aligned with safe concepts. A qualitative example is depicted Fig. 7, where the retrieval results for harmful prompt (lefi) are compared with those for its sanitized counterpart, which contains no harmful content, generated by Thesaurus rus LLM (right).
exposing Salaa's
aFseossing Lnneeggounde
Figure Qualitative evaluation of the top-4 images retrieved when prompting: left, the Un- safeBench harmful prompt; right, the corresponding sanitized prompt by Thesaurus+LIM,

---

Published as a conference paper at ICLR 2026
Table 3: HyPE performance under
the adaptive attack at increasing A.
A
Pr
Rec
F1
0
0.98
0.99
0.98
0.1
0.98
0.97
0.98
0.3
0.98
0.80
0.88
0.5
0.95
0.35
0.51
Figure 8: The left image illustrates sample generated by an adaptive attack with X = 0.1, while the right image shows the result of the same attack with À increased
0.7
0.91
0.18
0.31
1
0.87
0.12
0.22
Concept Combination Attack. We lastly evaluate the detection capabilitiess of HyPE against the Concept Combination Attack (CCA) (Petsiuk & Saenko, 2024), an embedding-level attack that adapt from Euclidean to hyperbolic space. Full details of its implementation are provided in Appendix A.6. Our goal is to show that while the hyperbolic encoder is vulnerable to these attacks, HyPE can successfully protect it. We test CCA on the HySAC encoder within the SD pipeline and confirm, through embedding alignment with the CLIP text encoder in Appendix A.3, that HySAC is suitable for this generative pipeline. We then let SD generate images from ViSU safe prompts under three conditions:
unattacked, filtered by HyPE, and attacked via CCA. Following the CCA setting, injected concepts include "text reading nudity f**k n ** n**e p**n bl**d" and removed concepts include "text, written". Finally, to identify any exposed body parts in the generated images, NudeNet (Mandic et al., 2024). Fig. 6 shows a histogram of detected occurrences for each setting. Results reveal that the HySAC is highly vulnerable to CCA, with sharp increase in unsafe image outputs. Conversely, HyPE provides strong defense, effectively reducing unsafe content to zero.
use
Adaptive Attack. We evaluate HyPE under custom adaptive attack following the formulation in Eq. (5) on the ViSU dataset, using 1,000 randomly-chosen prompts. The attack is controlled by a parameter that balances the attacker's objective of evading detection with preserving the harm- ful intent of the prompt. We gradually increase À from 0 to 1 and observe from Table 3 two main trends: (i) for small X, HyPE successfully detects adversarial prompts; (ii) as approaches 1, the attack can evade detection more effectively. However, it is important to note that higher values of also lead to substantial changes in the prompts, significantly removing or severely reducing their malicious intent (see examples in Table 11). Furthermore, these findings are reinforced by addi- tional qualitative analyses shown in Fig. 8, with Appendix A. providing a richer set of examples. Using the T2I pipeline, we generate images from adaptive prompts to assess the effects of the at- tack on generative task. The analysis shows that as decreases, the harmfulness of the generated images increases, which is counterbalanced by improved model performance provided in Table 3. These results reveal a fundamental trade-off in adaptive attacks: evading HyPE requires sacrificing the harmfulness intent in the prompts. Overall, the results indicate that HyPE reliably detects ad- versarial prompts as long as they retain their malicious intent, evidencing its robustness even when considering worst-case adaptive scenarios.
5 CONCLUSION
We introduced HyPE and HyPS, two complementary modules for detecting and sanitizing harm- ful prompts. HyPE, trained on benign data only, leverages hyperbolic SVDD to identify malicious prompts as outliers, while HyPS uses explainable attributions to select and neutralize harmful words without sacrificing semantic consistency. Our extensive evaluation, across four datasets, four adver- sarial scenarios, and two downstream tasks, shows that HyPE consistently outperforms sfate-of-the- art detectors, achieving balanced precision, recall, and F1 scores. Furthermore, CCA experiments confirm that HyPE provides robust protection even against embedding-level attacks. We also ob- serve key trade-off in adaptive attacks, where attempts to evade the defense typically succeed only when the malicious intent in the prompts is removed or severely reduced. Lastly, we demonstrate that HyPS effectively sanitizes harmful inputs, preserving the original semantic intent while pre- venting unsafe outputs. Collectively, our results indicate that HyPE and HyPS together offer an effective, generalizable, and explainable solution for improving the safety of VLMS..
10

---

Published as a conference paper at ICLR 2026
Acknowledgments. This work has been partially supported by project FISA- funded by the MUR program "Fondo italiano per le scienze applicate"; the European Union's 's Horizon Europe research and innovation program under the project ELSA, grant agreement No 101070617; by EU NGHU National Sustainable Mobility Center (CN00000023) Italian Ministry of University and Research Decree 1033-17/000 100_11770622222 (Spoke 10); by projects SERICS (PE00000014) and FAIR (PE0000013) under the NRRP MUR program funded by the EU - NGEU; by PRIN 2022 project 20227YET9B "AdVVent" CUP code B53D23012830006, and project BEAT (Better dEep leArning securiTy),, a Sapienza University project. Lastly, we acknowledge the EuroHPC Joint Undertaking for awarding this project access the EuroHPC supercomputer LEONARDO, hosted by CINECA (Italy) and the LEONARDO consortium through EuroHPC Development Access call.
Ethics Statement. Based on our comprehensive analysis, we assert that this work does not raise identifiable ethical concerns or foreseeable negative societal consequences within the scope of our study. On the contrary, our contributions aim to enhance the safety of vision-language models by improving the detection and sanitization of harmful prompts.
Reproducibillity. To ensure reproducibility, we provide a detailed description of our experimental setup in Section 4.1, including datasets, models, and adversarial attacks, along with their sources. Furthermore, our source code has been included as part of the supplementary material and is avail- able at https://gitthbb.co httpps//githubb.oo///HPe http://wwwww..o./oye.E.e////tt/e PLM/HHyprrooiic-Pooppp-- Propp--eettttttttion--------- Detection-ande
LLM Usage. Large language models were used exclusively for text polishing and minor exposi- tion refinements. All substantive research content, methodology, and scientific conclusions were developed entirely by the authors.
REFERENCES
Stanislaw Antol, Aishwarya Agrawal, Jiasen Lu, Margaret Mitchell, Dhruv Batra, C Lawrence Zit- nick, and Devi Parikh. Vqa: Visual question answering. In Proceedings of the IEEE international conference on computer vision, pp. 2425-2433, 2015.
James W Cannon, William J Floyd, Richard Kenyon, Walter Parry, et al. Hyperbolic geometry. Flavors of geomelry, 31 (155-1155)2. 1997. 3
Chun Jie Chong, Chenxi Hou, Zhihao Yao, and Seyed Mohammadjavad Seyed Talebi. Casper: Prompt sanitization for protecting user privacy in web-based large language models. arXiv preprint XXXv:24408.07004 2024.
Junjie Chu, Yugeng Liu, Ziqing Yang, Xinyue Shen, Michael Backes, and Yang Zhang. Compre- hensive assessment of jailbreak attacks against 1lms. arXiv e-prints, pp. arXiv-2402, 2024.
Octavian Ganea, Gary Bécigneul, and Thomas Hofmann. Hyperbolic neural networks. Advances in neural information processing systems, 31, 2018. 3
Zhi Gao, Yuwei Wu, Yunde Jia, and Mehrtash Harandi. Curvature generation in curved spaces for few-shot learning. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 8691-8700, 2021.
Laura Hanu and Unitary team. Detoxify, Github. http://giimbb.ccmmuuaaaara/ee/r. 2020. 1,
Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: A reference-free evaluation metric for image captioning. arXiv preprini arXiv:2104.08711, 2021.
Chengyang Hu, Ke- Yue Zhang, Taiping Yao, Shouhong Ding, and Lizhuang Ma. Rethinking gener- alizable face anti-spoofing via hierarchical prototype-gune guided distribution refinement in hyperbolic space. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pp. 1032-1041, 2024.
Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Ludwig Schmidt, Hannanch Hajishirzi, and Ali Farhadi. Editing models with task arithmetic. In The Eleventh International Conference Learning Representations, 2023. 20
11

---

Published as a conference paper at ICLR 2026
Chao Jia, Yinfei Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hieu Pham, Quoc Le, Yun-Hsuan Sung, Zhen Li, and Tom Duerig. Scaling up visual and Sainu-la representation learning with noisy text supervision. In International conference machine learning, pp. 4904-4916. PMLR, 2021. 3
Armand Joulin, Laurens Van Der Maaten, Allan Jabri, and Nicolas Vasilache. Learning visual features from large weakly supervised data. In European conference computer vision, pp- 67-84. Springer, 2016.
Massine El Khader, Elias Al Bouzidi, Abdellah Oumida, Mohammed Sbaihi, Eliott Binard, Jean- Philippe Poli, Wassila Ouerdane, Boussad Addad, and Katarzyna Kapusta. Diffguard: Text-based safety checker for diffusion models, 2025. URL https: wtwpiv.iivvv.////a///.////aaa wtwp://w..rrgabb///eeeeeee 00064. 3,7
Boris Pavlovich Kosyakov. Geometry of minkowski space. In Introduction the Classical Theory of Particles and Fields, pp. 1-50. Springer, 2007. 3
Dmitri Krioukov, Fragkiskos Papadopoulos, Maksim Kitsak, Amin Vahdat, and Marián Boguná. Hyperbolic geometry of complex networks. Physical Review E E-Stutistical,, Nonlinear, and Soft
Matter Physics, 82(3):036106, 2010. 3
Leonardo.Ai Stttp:://eeonee /we/eeennnrroooo/eee a1// 2024. Accessed: September 2025.
Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-image pre- training for unified vision-language understanding and generation. In International conference on machine learning. pp. 12888 12900. PMLR, 2022. 1,3
Michelle Li. michellejiell/NSFFF wexteclssiitttllsiiiiiiieee Hugging Face huggingface.co. https: / hugg i ingfacc....... cttcco///ii///c 09-2025]. 1,3,7
fier, 2025. [Accessed 24-
Xinfeng Li, Yuchen Yang, Jiangyi Deng, Chen Yan, Yanjiao Chen, Xiaoyu Ji, and Wenyuan Xu. Safegen: Mitigating sexually explicit content generation in text-to-image models. In Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security, pp. 4807- 4821, 2024. 6, 15
Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European conference on computer vision, pp. 740-755. Springer, 2014. 6, 15
Runtao Liu, Ashkan Khakzar, Jindong Gu, Qifeng Chen, Philip Torr, and Fabio Pizzati. Latent guard: safety framework for text-to-image generation. arXiv preprint arXiv:2404.0880. 2024. 3, 7
Andreas Madsen. Siva Reddy, and Sarath Chandar. Post-hoc interpretability for neural nlp: survey.
ACM Computing Surveys, 58) 1-22, 2022. 5
Vladimir Mandic et al. Nudenet: Nsfw object detection for tfjs and nodejs. https: htttp:://githbbl
wwweeettddeeeeeeeeeeee 2024. GitHub repository (archived). 10
Christopher Manning. Introduction to information retrieval. Syngress Publishing, 2008. 7, 16
Midjournyy. Midjourney, 2025. URL 2025-09-24. 3,3
www.coomeeeeeeeeeeee Accessed:
Maximillian Nickel and Douwe Kiela. Learning continuous hierarchies in the lorentz model of hyperbolic geometry. In International conference on machine learning, pp. 3779-3788. PMLR, 2018. 1,
OpenAl. Gpt-4 technical report, 2024. URL
08774. 15
Avik Pal, Max van Spengler, Guido Maria D' A'mely di Melendugno, Alessandro Flaborea, Fabio Galasso, and Pascal Mettes. Compositional entailment learning for hyperbolic vision- vision-language models. In The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025, 2025. 3
12

---

Published as a conference paper at ICLR 2026
Wei Peng, Tuomas Varanka, Abdelrahman Mostafa, Henglin Shi, and Guoying Zhao. Hyperbolic deep neural networks: A survey. IEEE Transactions on pattern analysis and machine intelligence, (0013):10022-10044, 2021.
Zelin Peng, Zhenggin Xu, Zhilin Zeng, Changsong Wen, Yu Huang. Menglin Yang, Feilong Tang, and Wei Shen. Understanding fine-tuning clip for open- open-vocabulary semantic segmentation in hyperbolic space. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 4562 4572, 2025.
Vitali Petsiuk and Kate Saenko. Concept arithmetics for cireumventing concept inhibition in diffu- sion models. European Conference on Computer Vision, pp. 309-325, 2024. 10, 20
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXivv2307.01952, 2023. 1
Samuele Poppi, Tobia Poppi, Federico Cocchi, Marcella Cornia, Lorenzo Baraldi, and Rita Cuc- chiara. Safe-CLIP: Removing NSFW Concepts from Vision-and- Langguugd- Models. In Proceed- ings of the European Conference Computer Vision 2024. 6, 15, 16, 17,21
Tobia Poppi, Tejaswi Kasarla, Pascal Mettes, Lorenzo Baraldi, and Rita Cucchiara. Hyperbolic safety-aware Laigunla models. Proceedings of the Computer Vision and Pattern Recog- nition Conference, pp. 4222-4232, 2025. 3, 4, 6, 7, 16, 17
David MW Powers. Evaluation: from precision, recall and f-measure to roc, informedness, marked- ness and correlation. arXiv preprint arXiv:2010.16006 2020. 7
Fanchao Qi, Yangyi Chen, Xurui Zhang, Mukai Li, Zhiyuan Liu, and Maosong Sun. Mind the style of text! adversarial and backdoor attacks based on text style transfer. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, EMNLP, pp. 4569-4580. Association for Computational Linguistics, 2021. 2, 6, 22
Yiting Qu, Xinyue Shen, Yixin Wu, Michael Backes, Savvas Zannettou, and Yang Zhang. Un- safebench: Benchmarking image safety classifiers on real-world and ai-generated images, 2024.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 8748-8763. PmLR, 2021. 2. 5, 16, 17
Sameera Ramasinghe, Violetta Shevchenko, Gil Avraham, and Ajanthan Thalaiyasingam. Accept the modality gap: An exploration in the hyperbolic space. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 27263-27272, 2024.
Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In International conference on machine learning, pp. 8821-8833 Pmlr, 2021. 3
Javier Rando, Daniel Paleka, David Lindner, Lennart Heim, and Florian Tramèr. Red-teaming the stable diffusion safety filter. arXiv preprint arXiv:2210.04610 2022. 1
Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese bert- networks. arXiv preprini arXiv: 1908. 10084, 2019.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and putlern recognition, pp. 10684-10695, 2022. 1, 6
Peter Rousseeuw, Silhouettes: a graphical aid to the interpretation and validation of cluster analy-
sis. Journal of computational and applied mathematics, 20:53-65, 1987. 16
13

---

Published as a conference paper at ICLR 2026
Patrick Schramowski, Manuel Brack, Bjöm Deiseroth, and Kristian Kersting. Safe latent diffusion:
Mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12522-22533 2023. 1, 6, 15
Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic autribution for deep networks. In International conference on machine learning, pp. 3319-3328, PMLR, 2017. 5,
Hao Tan and Mohit Bansal. Lxmert: Learning mross-modality encoder representations from trans- formers. arXiv preprint N0div:/908.074999 2019. 3
David MJ Tax and Robert PW Duin. Support vector data description. Machine learning, 54(1): 45-66, 2004a. 4
David MJ Tax and Robert PW Duin. 55-66, 2004b. 4
Support vector data description. Machine learning, 54(1):
Qwen Team. Qwen3 technical report, 2025. URL /Bt.///ppp///aarrrrr////////0.00 6,
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural informa- tion processing systems, 30, 2017. 1,5
Sitao Wu and Tommy WS Chow. Clustering of the self-organizing map using clustering validity index based on inter-cluster and intra-cluster density. Pattern Recognition, 37(2):175-188, 2004. 16
Xi Yang, Dechen Kong, Nannan Wang, and Xinbo Gao. Hyperbolic insights with knowledge distil- lation for cross-domain few-shot learning. IEEE Transactions on Image Processing, 2025. 3
Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung- Yi Ho, Nan Xu, and Qiang Xu. AMA-Diffusiine MultiModal Attack Diffusion Models. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2024a. 1,2, 6, 15, 23
Yijun Yang, Ruiyuan Gao, Xiao Yang, Jianyuan Zhong, and Qiang Xu. Guardt2i: Defending text- to-image models from adversarial prompts. Advances neural information processing systems, 37:76380-76403, 2024b. 7
Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. Sneakyprompt: Jailbreaking text- to-image generative models. In Proceedings of the IEEE Symposium on Security and Privucy, 2024c. 1,2, 6, 15
Yumiao Zhao, Bo Jiang, Yuhe Ding, Xiao Wang, Jin Tang, and Bin Luo. Fine-grained vlm fine- tuning via latent hierarchical adapter learning. arXiv preprint arXiv:2508. / //76, 2025.
14


Reviews:
[{"review_id": "GQRSYN73eS", "reviewer": "Reviewer_qMAf", "summary": "This paper proposes a hyperbolic geometry–based framework to detect and neutralize harmful prompts in VLMs. It introduces two modules: HyPE, a hyperbolic anomaly detector that models benign prompts in hyperbolic space and flags harmful ones as outliers, and HyPS, a post-hoc sanitization system that identifies harmful words and replaces or modifies them using lookups or LLM-based substitution. Experiments across six datasets and two adversarial attacks show that HyPE outperforms prior detectors in accuracy and robustness, while HyPS effectively sanitizes malicious prompts without distorting their meaning.", "questions": "1. If the classifier were not based on a hyperbolic model, would HePS still function effectively? Does this module have to depend on hyperbolic modeling?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. HyPE demonstrates the SOTA detection performance on six datasets and two adversarial scenarios\n2. HyPS performs well on two downstream tasks", "weaknesses": "Main concern\n1. The contribution is relatively incremental. This paper mainly applies hyperbolic models to harmful prompt detection in VLMs. Apart from the empirical gains shown in the experiments, more analysis of why we need to use the hyperbolic models in this task is needed (e.g., some theoretical insights or some empirical comparison between the SVDD and hyperbolic SVDD, etc).\n\nOther concerns\n1. The authors do not consider the adaptive attack scenario, in which the attackers have white-box access to both the detectors and the text encoder.\n2. The authors only evaluate the effectiveness of one text encoder, HySAC. More evaluations on other encoders would show the robustness of this approach.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "4OpXTZRpmP", "reviewer": "Reviewer_9tyq", "summary": "The paper proposes HyPE (Hyperbolic Prompt Espial) and HyPS (Hyperbolic Prompt Sanitization), two complementary modules for detecting and sanitizing harmful prompts in Vision–Language Models (VLMs). HyPE employs a hyperbolic SVDD anomaly detector trained solely on benign prompts to identify harmful inputs as outliers in Lorentz space, while HyPS applies explainable attribution (Layer Integrated Gradients) to localize harmful words and neutralize them through replacement or removal, preserving semantics. Experiments across six datasets, multiple adversarial attacks, and two downstream tasks (text-to-image generation and image retrieval) demonstrate superior detection accuracy, interpretability, and robustness over prior methods .", "questions": "Could the authors provide additional experiments or discussion on multilingual settings and other categories of safety violations to support the broader applicability of their framework?", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper extends classical SVDD to hyperbolic space (Eq. 2) using the Lorentz distance and curvature parameter K. This geometric formulation enhances interpretability and robustness, which are often lacking in prior NSFW classifiers.\n- The one-class setup removes the need for harmful data training, improving safety and scalability, an important property since unsafe content may not always be known or accessible to defenders.\n- The method is evaluated on six datasets spanning paired and single-class prompts as well as adversarial attack settings. Results show consistent improvements over multiple baselines, demonstrating strong practical effectiveness.", "weaknesses": "- The proposed approach appears to be a direct adaptation of SVDD into Lorentz space, with limited new theoretical insights. For instance, the Eq. (2) largely represents a straightforward geometric reformulation rather than a fundamentally new concept.\n- HyPE relies on embeddings from HySAC, which may introduce bias and limit the generality of reported performance.\n- All evaluated datasets focus on English NSFW and violent content, with no assessment of multilingual or socio-cultural harmful expressions, potentially constraining generalization.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "e4GdjVjBok", "reviewer": "Reviewer_kTKY", "summary": "This paper proposes HyPE (Hyperbolic Prompt Espial) and HyPS (Hyperbolic Prompt Sanitization) to detect and mitigate harmful prompts for VLMs. HyPE models benign prompt embeddings with a hyperbolic one-class SVDD objective, leveraging hyperbolic geometry to better capture hierarchical semantic structures. HyPS then uses token-level attribution to locate malicious prompt components and sanitizes them while preserving intended meaning. Experiments on harmful prompt benchmarks show improved harmful-prompt detection and higher safety-preserving sanitization quality compared to Euclidean baselines and existing safety filters. Results cover multiple VLMs and attack settings.", "questions": "1. Can HyPE generalize to vision-triggered or multimodal jailbreak scenarios, beyond text-only attacks?\n2. What is the runtime/memory overhead of hyperbolic SVDD compared to Euclidean baselines?\n3. How robust is the method to paraphrased or iterative jailbreak prompts where harmful intent is spread across multiple tokens?", "limitations": "", "rating": 4, "confidence": 2, "soundness": 3, "presentation": 4, "contribution": 2, "strengths": "1. Novel use of hyperbolic geometry for prompt safety detection; motivation around hierarchical semantics is clearly presented.\n2. Covers both detection and sanitization, producing a more practical defense pipeline rather than only binary classification.\n3. Experiments across multiple VLMs and datasets show consistent gains over Euclidean one-class and prompt-filtering baselines.", "weaknesses": "1. Evaluation focuses mainly on text-based harmful prompts; applying the method to multimodal triggers or image triggers would strengthen generality claims.\n2. The robustness against paraphrased, or style-trigger [1] is unclear. Since harmful intent can be distributed across multiple tokens or advanced style rephrase, it is uncertain whether the method can consistently detect or sanitize such stealthy, paraphrased attacks. Evaluating these attack strategies would strengthen the claim of general robustness.\n\nRef:\n[1] Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CiArXlqsMW", "reviewer": "Reviewer_WR4w", "summary": "The paper introduces the HyPE and HyPS, a system for malicious prompt detection and sanitization based on constructing prompt embeddings in a hyperbolic space that naturally separates malicious from benign prompts. Sanitization is performed by selectively replacing harmful words in the prompt using an explainable attribution method. The approach is benchmarked against a range of SOTA approaches and stress-tested against some adversarial attacks.", "questions": "Explain in more detail the reasoning behind the choice of a hyperbolic space. You say it \"naturally disentangles  hierarchical and compositional relations, making it well-suited for modeling data with latent hierarchical structure\". What is the latent hierarchical structure in text-to-image prompts? Is the expectation that the malicious/benign label represents the top level of the hierarchy?  \n\nThe underlying assumption appears to be that malicious prompts will be outliers in this learned space- have you stress-tested your approach using OOD benign images?\n\nMinor notation issue in Eq 1: if x is n+1 dimensional then the Lorentzian inner product should only sum up to n (the elements of x are indexed 0 to n, comprising n+1 elements).\n\nFor HyPS: How do you make the decision about what words to replace (is it a hard threshold or more adaptive method)?\n\nSuggest blurring the offensive image in Fig 1- readers will trust your claim that it is offensive.\n\nDetection is trained using HySAC embeddings but attribution appears to be applied using CLIP embeddings and I'm curious to better understand the implications. Aside from empirical validation, can you support the claim that the two embedding spaces can be distinct? Is it difficult to implement LIG against the HySAC encoder?\n\nPresentation: Table 1 misrepresents HyPE as the winning method in the Precision column for adv-MMA (should be GuardT2I). There are some ties that should also be marked- eg SneakyPrompt recall and COCO accuracy.  Ideally you would also indicate statistically significant wins. \n\nFor HyPS experiments, do you also validate that the rewritten prompts fall inside R?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* Notwithstanding my questions below, the hyperbolic approach is well-suited to single-class training, reducing a dependency on labeled malicious examples.\n* The method includes a sanitization step, enabling end-to-end workflows where refusal is undesirable.\n* Empirical experimental results are relatively thorough and demonstrate strong performance of the method compared to several baselines.", "weaknesses": "* Section 3.1 appears to leave out important details of how the mapping from token sequence to hyperbolic space is learned, instead focusing on how R is tuned. It appears that the experiments leverage a pretrained encoder for this step (HySAC).\n* A different encoder is selected for HyPS and this should be justified.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)