{"id":"https://openalex.org/W4415540082","doi":"https://doi.org/10.1145/3746027.3755236","title":"Secure Tug-of-War (SecTOW): Iterative Defense-Attack Training with Reinforcement Learning for Multimodal Model Security","display_name":"Secure Tug-of-War (SecTOW): Iterative Defense-Attack Training with Reinforcement Learning for Multimodal Model Security","publication_year":2025,"publication_date":"2025-10-25","ids":{"openalex":"https://openalex.org/W4415540082","doi":"https://doi.org/10.1145/3746027.3755236"},"language":null,"primary_location":{"id":"doi:10.1145/3746027.3755236","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3746027.3755236","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 33rd ACM International Conference on Multimedia","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5073609014","display_name":"Muzhi Dai","orcid":null},"institutions":[{"id":"https://openalex.org/I4210136246","display_name":"China Telecom (China)","ror":"https://ror.org/03jgnzt20","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210136246"]},{"id":"https://openalex.org/I4387153335","display_name":"China Telecom","ror":"https://ror.org/05p67dv18","country_code":null,"type":"company","lineage":["https://openalex.org/I4387153335"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Muzhi Dai","raw_affiliation_strings":["Institute of Artificial Intelligence (TeleAI), China Telecom, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0004-6070-8470","affiliations":[{"raw_affiliation_string":"Institute of Artificial Intelligence (TeleAI), China Telecom, Beijing, China","institution_ids":["https://openalex.org/I4210136246","https://openalex.org/I4387153335"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028871237","display_name":"Shixuan Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I4210136246","display_name":"China Telecom (China)","ror":"https://ror.org/03jgnzt20","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210136246"]},{"id":"https://openalex.org/I4387153335","display_name":"China Telecom","ror":"https://ror.org/05p67dv18","country_code":null,"type":"company","lineage":["https://openalex.org/I4387153335"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shixuan Liu","raw_affiliation_strings":["Institute of Artificial Intelligence (TeleAI), China Telecom, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0002-6458-5266","affiliations":[{"raw_affiliation_string":"Institute of Artificial Intelligence (TeleAI), China Telecom, Beijing, China","institution_ids":["https://openalex.org/I4210136246","https://openalex.org/I4387153335"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100693117","display_name":"Zhiyuan Zhao","orcid":"https://orcid.org/0000-0001-7666-4020"},"institutions":[{"id":"https://openalex.org/I4210136246","display_name":"China Telecom (China)","ror":"https://ror.org/03jgnzt20","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210136246"]},{"id":"https://openalex.org/I4387153335","display_name":"China Telecom","ror":"https://ror.org/05p67dv18","country_code":null,"type":"company","lineage":["https://openalex.org/I4387153335"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhiyuan Zhao","raw_affiliation_strings":["Institute of Artificial Intelligence (TeleAI), China Telecom, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-7666-4020","affiliations":[{"raw_affiliation_string":"Institute of Artificial Intelligence (TeleAI), China Telecom, Beijing, China","institution_ids":["https://openalex.org/I4210136246","https://openalex.org/I4387153335"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001848378","display_name":"Junyu Gao","orcid":"https://orcid.org/0000-0001-6000-8168"},"institutions":[{"id":"https://openalex.org/I17145004","display_name":"Northwestern Polytechnical University","ror":"https://ror.org/01y0j0j86","country_code":"CN","type":"education","lineage":["https://openalex.org/I17145004"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junyu Gao","raw_affiliation_strings":["Institute of Artificial Intelligence (TeleAI), China Telecom, Beijing, China and Northwestern Polytechnical University, Xi'an, China"],"raw_orcid":"https://orcid.org/0000-0001-6000-8168","affiliations":[{"raw_affiliation_string":"Institute of Artificial Intelligence (TeleAI), China Telecom, Beijing, China and Northwestern Polytechnical University, Xi'an, China","institution_ids":["https://openalex.org/I17145004"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063142903","display_name":"Hao Sun","orcid":"https://orcid.org/0009-0007-7917-1628"},"institutions":[{"id":"https://openalex.org/I4210136246","display_name":"China Telecom (China)","ror":"https://ror.org/03jgnzt20","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210136246"]},{"id":"https://openalex.org/I4387153335","display_name":"China Telecom","ror":"https://ror.org/05p67dv18","country_code":null,"type":"company","lineage":["https://openalex.org/I4387153335"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Sun","raw_affiliation_strings":["Institute of Artificial Intelligence (TeleAI), China Telecom, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0007-7917-1628","affiliations":[{"raw_affiliation_string":"Institute of Artificial Intelligence (TeleAI), China Telecom, Beijing, China","institution_ids":["https://openalex.org/I4210136246","https://openalex.org/I4387153335"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100740143","display_name":"Xuelong Li","orcid":"https://orcid.org/0000-0002-0019-4197"},"institutions":[{"id":"https://openalex.org/I4210100255","display_name":"Beijing Academy of Artificial Intelligence","ror":"https://ror.org/016a74861","country_code":"CN","type":"other","lineage":["https://openalex.org/I4210100255"]},{"id":"https://openalex.org/I4210136246","display_name":"China Telecom (China)","ror":"https://ror.org/03jgnzt20","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210136246"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xuelong Li","raw_affiliation_strings":["Institute of Artificial Intelligence (TeleAI), China Telecom, China, China"],"raw_orcid":"https://orcid.org/0000-0002-0019-4197","affiliations":[{"raw_affiliation_string":"Institute of Artificial Intelligence (TeleAI), China Telecom, China, China","institution_ids":["https://openalex.org/I4210100255","https://openalex.org/I4210136246"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.36888047,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"11414","last_page":"11423"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9915000200271606,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9915000200271606,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9850000143051147,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9835000038146973,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.631600022315979},{"id":"https://openalex.org/keywords/quality","display_name":"Quality (philosophy)","score":0.4081999957561493},{"id":"https://openalex.org/keywords/training","display_name":"Training (meteorology)","score":0.3865000009536743},{"id":"https://openalex.org/keywords/computer-security-model","display_name":"Computer security model","score":0.3718999922275543},{"id":"https://openalex.org/keywords/safer","display_name":"SAFER","score":0.34200000762939453},{"id":"https://openalex.org/keywords/discriminative-model","display_name":"Discriminative model","score":0.3409000039100647},{"id":"https://openalex.org/keywords/offensive","display_name":"Offensive","score":0.32089999318122864},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.3199000060558319}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7599999904632568},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.631600022315979},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4449000060558319},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.4081999957561493},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.40299999713897705},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.39259999990463257},{"id":"https://openalex.org/C2777211547","wikidata":"https://www.wikidata.org/wiki/Q17141490","display_name":"Training (meteorology)","level":2,"score":0.3865000009536743},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.3718999922275543},{"id":"https://openalex.org/C2776654903","wikidata":"https://www.wikidata.org/wiki/Q2601463","display_name":"SAFER","level":2,"score":0.34200000762939453},{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.3409000039100647},{"id":"https://openalex.org/C176856949","wikidata":"https://www.wikidata.org/wiki/Q2001676","display_name":"Offensive","level":2,"score":0.32089999318122864},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.3199000060558319},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.3100999891757965},{"id":"https://openalex.org/C167966045","wikidata":"https://www.wikidata.org/wiki/Q5532625","display_name":"Generative model","level":3,"score":0.3028999865055084},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.29660001397132874},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.27810001373291016},{"id":"https://openalex.org/C2776889888","wikidata":"https://www.wikidata.org/wiki/Q1135789","display_name":"Unintended consequences","level":2,"score":0.2766999900341034},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.27129998803138733},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2639000117778778},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.25769999623298645},{"id":"https://openalex.org/C2779982483","wikidata":"https://www.wikidata.org/wiki/Q6094420","display_name":"Iterative refinement","level":2,"score":0.2563000023365021},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.2556000053882599},{"id":"https://openalex.org/C143587482","wikidata":"https://www.wikidata.org/wiki/Q1543216","display_name":"Iterative and incremental development","level":2,"score":0.2508000135421753}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3746027.3755236","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3746027.3755236","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 33rd ACM International Conference on Multimedia","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":6,"referenced_works":["https://openalex.org/W2760217853","https://openalex.org/W2962955856","https://openalex.org/W4214621929","https://openalex.org/W4398249615","https://openalex.org/W4402672014","https://openalex.org/W4402716477"],"related_works":[],"abstract_inverted_index":{"The":[0,159],"rapid":[1],"advancement":[2],"of":[3,60,122,126,188,202,217,224],"multimodal":[4,46],"large":[5],"language":[6],"models":[7],"(MLLMs)":[8],"has":[9],"led":[10],"to":[11,33,44,77,83,118,165,171,184,212],"breakthroughs":[12],"in":[13,151],"various":[14],"applications,":[15],"yet":[16],"their":[17],"security":[18,35,79,121,149,174,244],"remains":[19],"a":[20,129,206],"critical":[21],"challenge.":[22],"One":[23],"pressing":[24],"issue":[25],"involves":[26],"unsafe":[27,49,255],"image-query":[28],"pairs-jailbreak":[29],"inputs":[30,50,219],"specifically":[31],"designed":[32],"bypass":[34],"constraints":[36,80],"and":[37,58,131,155,197,220,236,254],"elicit":[38],"unintended":[39],"responses":[40],"from":[41],"MLLMs.":[42,88,123],"Compared":[43],"general":[45,102,237,247],"data,":[47],"such":[48],"are":[51,162],"relatively":[52],"sparse,":[53],"which":[54],"limits":[55],"the":[56,94,120,143,146,152,167,186,199,214,222,225,230],"diversity":[57,223],"richness":[59],"training":[61,116],"samples":[62],"available":[63],"for":[64,182],"developing":[65],"robust":[66],"defense":[67,153],"models.":[68],"Meanwhile,":[69],"existing":[70],"guardrail-type":[71],"methods":[72],"rely":[73],"on":[74,93,193,234],"external":[75],"modules":[76],"enforce":[78],"but":[81],"fail":[82],"address":[84,172],"intrinsic":[85],"vulnerabilities":[86,150],"within":[87],"Traditional":[89],"supervised":[90],"fine-tuning":[91],"(SFT),":[92],"other":[95],"hand,":[96],"often":[97],"over-refuses":[98],"harmless":[99,218],"inputs,":[100],"compromising":[101],"performance.":[103,248],"Given":[104],"these":[105],"challenges,":[106],"we":[107],"propose":[108],"Secure":[109],"Tug-of-War":[110],"(SecTOW),":[111],"an":[112,132],"innovative":[113],"iterative":[114,144],"defense-attack":[115],"method":[117],"enhance":[119],"SecTOW":[124,241],"consists":[125],"two":[127],"modules:":[128],"defender":[130],"auxiliary":[133],"attacker,":[134],"both":[135],"trained":[136],"iteratively":[137],"using":[138],"reinforcement":[139],"learning":[140],"(GRPO).":[141],"During":[142],"process,":[145],"attacker":[147],"identifies":[148],"model":[154],"expands":[156],"jailbreak":[157,226],"data.":[158,204],"expanded":[160],"data":[161,227],"then":[163],"used":[164,181,211],"train":[166],"defender,":[168],"enabling":[169,198],"it":[170],"identified":[173],"vulnerabilities.":[175],"We":[176],"also":[177],"design":[178],"reward":[179],"mechanisms":[180],"GRPO":[183],"simplify":[185],"use":[187,201],"response":[189],"labels,":[190],"reducing":[191],"dependence":[192],"complex":[194],"generative":[195],"labels":[196],"efficient":[200],"synthetic":[203],"Additionally,":[205],"quality":[207],"monitoring":[208],"mechanism":[209],"is":[210],"mitigate":[213],"defender's":[215],"over-refusal":[216],"ensure":[221],"generated":[228],"by":[229],"attacker.":[231],"Experimental":[232],"results":[233],"safety-specific":[235],"benchmarks":[238],"demonstrate":[239],"that":[240],"significantly":[242],"improves":[243],"while":[245],"preserving":[246],"Warning:":[249],"This":[250],"paper":[251],"contains":[252],"offensive":[253],"content.":[256]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-25T00:00:00"}