VLMs Can Aggregate Scattered Training Patches
Authors: name: Zhanhui Zhou, name: Lingjie Chen, name: Chao Yang, name: Chaochao Lu

One way to mitigate risks in vision-language models (VLMs) is to remove
dangerous samples in their training data. However, such data moderation can be
easily bypassed when harmful images are split into small, benign-looking
patches, scattered across many training samples. VLMs may then learn to piece
these fragments together during training and generate harmful responses at
inference, either from full images or text references. For instance, if trained
on image patches from a bloody scene paired with the descriptions "safe," VLMs
may later describe, the full image or a text reference to the scene, as "safe."
We define the core ability of VLMs enabling this attack as visual
stitching -- the ability to integrate visual information spread across
multiple training samples that share the same textual descriptions. In our
work, we first demonstrate visual stitching abilities in common open-source
VLMs on three datasets where each image is labeled with a unique synthetic ID:
we split each (image, ID) pair into {(patch,
ID)} pairs at different granularity for finetuning, and we find that
tuned models can verbalize the correct IDs from full images or text reference.
Building on this, we simulate the adversarial data poisoning scenario mentioned
above by using patches from dangerous images and replacing IDs with text
descriptions like ``safe'' or ``unsafe'', demonstrating how harmful content can
evade moderation in patches and later be reconstructed through visual
stitching, posing serious VLM safety risks. Code is available at
https://github.com/ZHZisZZ/visual-stitching.