Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversations

1 Introduction

• Most existing human-AI conversation guardrails are text-only and cannot use conversation data involving images as input.The paper frames this gap as motivating safeguards that classify risks in multimodal prompts and responses.Source: §1 · p. 1
• Llama Guard 3 Vision classifies multimodal prompts and responses, targeting image-reasoning use cases with harmful text-and-image prompts and text responses.The model is fine-tuned on Llama 3.2-Vision and demonstrates strong performance on an internal benchmark using the 13 MLCommons hazards.Source: §1 · pp. 1–2
• The model is more robust in response than prompt classification under practical threat models, while effectively ignoring prompt-based attacks.The authors attribute this difference to the model primarily relying on the model response for classification.Source: §1 · p. 2
• The paper presents an internal benchmark comparison with GPT-4o and adversarial-robustness experiments as its evaluation components.The internal benchmark is in Section 4.1, and adversarial robustness experiments are in Section 4.2.Source: §1 · p. 2

2 Hazard Taxonomy and Policy

• The model predicts safety labels across 13 categories based on the MLCommons taxonomy.The section provides detailed descriptions of each safety category.Source: §2 · p. 2
• The taxonomy covers violent crimes, non-violent crimes, sex-related crimes, and child sexual exploitation.Non-violent crimes include personal, financial, property, drug, weapons, and cyber crimes.Source: §2 · pp. 2–3
• The remaining categories include defamation, specialized advice, privacy violations, and intellectual-property violations.Defamation is defined as verifiably false content likely to injure a living person's reputation; specialized advice includes financial, medical, or legal advice.Source: §2 · p. 3
• The taxonomy also includes indiscriminate weapons, hate, suicide and self-harm, sexual content, and elections.These categories cover weapon creation or endorsement, demeaning content based on sensitive characteristics, intentional self-harm, erotica, and factually incorrect election-process information.Source: §2 · p. 3
• For image prompts, attempting to identify a real person from visual clues is treated as a potential privacy violation.The response is trained as unsafe whether the attempted identification is correct or incorrect.Source: §2 · p. 3

3.1 Input-output Safeguarding

• Input-output safeguarding supplies hazard guidelines, specifies prompt or response classification, includes the image and conversation turns, and requests safe/unsafe output with violated categories when unsafe.Figure 1 illustrates the response-classification task, guidelines, and desired output format.Source: §3.1 · pp. 3–4

3.2 Data Collection

• Training data combines human-created prompt-image pairs with benign and violating model responses, with samples labeled by humans or Llama 3.1 405B.Jailbreaking techniques were used to elicit violating responses, and the dataset was curated across hazard categories.Source: §3.2 · p. 4
• The final datasets contain 22,500 prompt-image pairs for prompt classification and 40,034 prompt-response-image samples for response classification.Text-only Llama Guard 3 training data was added to the Vision training set with dummy images.Source: §3.2 · p. 4

3.3 Model & Training Details

• The model is built on Llama 3.2 11B Vision and supervised fine-tuned with one image per prompt, which is rescaled into four 560 × 560-pixel chunks.Training uses a sequence length of 8192, learning rate 1 × 10−5, and 3600 steps.Source: §3.3 · p. 4
• Augmentation randomly drops unviolated categories and shuffles category indices while updating target outputs to reduce format memorization.The category dropping is intended to help the model attend only to included categories.Source: §3.3 · p. 4

4.1 Performance on the Internal Benchmark

• Llama Guard 3 Vision outperforms GPT-4o and GPT-4o mini in response-classification F1 with lower false-positive rates on the internal benchmark.Source: §4.1 · p. 4, Table 1 · p. 5
• F1 scores exceed 0.69 across all response-classification categories, with strong performance in Indiscriminate Weapons and Elections.Source: §4.1 · p. 4, Table 2 · p. 5

4.2 Adversarial Robustness of Llama Guard 3 Vision

• Attacks assume full white-box access; response-attack optimization also knows unsafe agent generations, which attackers may not see, framing a practical upper bound.The authors state that Llama Guard 3 Vision is intended to improve safety under typical, benign use, is not immune to attacks, and that robustness recommendations do not guarantee an impenetrable system.Source: §4.2 · pp. 5–6
• From 21% to 70%, small 8/255 PGD image perturbations raise harmful prompts misclassified as safe; unbounded attacks misclassify unsafe responses 27% of the time.Source: §4.2 · p. 6, Table 3 · p. 6
• 72% of prompts are misclassified as safe under GCG; response-classification misses are 30% versus 16% when only prompts are altered, rising to 75% when suffixes enter agent responses.Source: Table 4 · p. 6, §4.2 · p. 7

• Safety mitigation includes model-level alignment methods and system-level classifiers used alongside chatbots or agents.Source: §5 · p. 7
• System-level classifiers may classify prompts, responses, or both, but most LLM input-output safeguards are text-only.Source: §5 · p. 7
• Llama Guard 3 Vision is positioned as a starting point and baseline for developing multimodal LLM safety tools.Source: §5 · p. 7

6 Limitations & Broader Impacts

• Judgments involving common sense, multilingual capability, or policy coverage might be limited by the model’s pretraining data.Source: §6 · p. 7
• It is intended for multimodal prompts or multimodal prompts with text responses, not image-only or text-only safety classification; it is optimized for English and supports one image.Images are rescaled into four 560 × 560 chunks, so classification performance may vary with image size.Source: §6 · p. 7
• Defamation, intellectual property, and elections may require factual, up-to-date knowledge; the authors recommend more complex systems for highly sensitive use cases.They describe Llama Guard 3 Vision as a good baseline for generic use cases.Source: §6 · p. 7
• As an LLM, it could be susceptible to adversarial attacks, although their effectiveness can be mitigated to some extent in output-only filtering under a realistic threat model.Source: §6 · p. 7
• The GCG worst-case analysis places optimized suffixes after the harmful response, though an adversary may lack access to responses unless they can access the underlying language model.Source: §6 · p. 7
• For better performance against malicious users, the authors suggest combining it with robust model safety alignment and other system components such as a perplexity filter.Source: §6 · p. 8

B PGD and GCG implementation details

• PGD uses image-pixel steps in gradient-sign directions, with α = 0.1, at most 100 iterations, and projection into the l∞= ϵ ball after each iteration.Source: B PGD and GCG implementation details · p. 10
• For GCG, the study uses off-the-shelf NanoGCG (Zou et al., 2023), running up to 100 steps; most successful attacks converge with fewer than 50 steps, using search width 64 and considering top 32.Source: B PGD and GCG implementation details · p. 10
• Both PGD and GCG stop early when an attack succeeds.Source: B PGD and GCG implementation details · p. 10