VSFA asks whether fine-tuning vision-language models on synthetic threat images with ostensibly neutral questions reduces compliance with multimodal jailbreaks. The pipeline retrieves up to five papers for each of ten AI-safety arXiv search terms; GPT-4o-mini extracts concepts and writes prompts with safety themes, ominous atmospheres and elements such as warning indicators; Doubao Seedream generates 700 images; and GPT-4o-mini produces six answers per image from the image-generation prompt, yielding 4,200 VQA pairs. Training freezes the visual encoder and updates the language component with rank-128 LoRA. On Qwen3-VL-8B, Qwen2.5-VL-7B and two 7B LLaVA variants, GPT-4o-judged mean ASR falls from 38.77–68.71% without defense to 14.18–23.76% with VSFA. The method also receives the highest Constructive Score and benign refusal rates of 1.82–3.45%, although AdaShield or VLGuard has lower ASR in many cells and VLGuard preserves several capabilities slightly better.
The paper interprets this result as a safety-oriented persona learned through visual exposure. For Qwen2.5-VL-7B, it compares original and fine-tuned MMSafetyBench response activations through a sparse autoencoder, considers the 1,000 most increased latents and selects eight with bidirectional effects. Adding latent 12 to the original model lowers ASR by 18 points and removing it from VSFA raises ASR by 14; the authors call it a safety-oriented persona latent. The appendix also reports a twelve-style ablation with ASR from 11.2% to 13.7%, sub-half-point MMLU/MMMU losses for one checkpoint, and 60-image FigStep tests on Gemma 3 IT and Llama 3.2 Vision. These are suggestive behavioral results, but the design does not prove that pixels alone cause the effect or that the latent is a monosemantic personality.
The 'without explicit labels' claim requires an important qualification. The abstracts, prompts and modifiers provide explicit safety and threat semantics; several of the ten released images contain hazard signs and visible text such as 'AI SAFETY' or 'AI Control'; and the teacher writes answers from the image prompt rather than documented pixel inspection. There are no matched controls for the same images without threat atmosphere, visible text, random images, shuffled pairs or genuinely pixel-grounded answers. Teacher selection uses FigStep and FigStep then reappears in the main evaluation. The SAE discovers and validates latents on MMSafetyBench without a held-out set, seeds, correction for screening 1,000 candidates or sufficient SAE details. Every outcome depends on one GPT-4o judge without human or second-judge validation. The repository releases only ten images, one JSON example and generic code: it omits the full dataset, adapters, outputs, judge, Constructive Score, other benchmarks and SAE artifacts; its evaluator also ignores question and instruction columns and applies one prompt to every image. The defensible conclusion is a promising threat-imagery-conditioned fine-tuning effect under specific benchmarks and one judge, not demonstrated label-free visual alignment or a discovered safety personality.