File size: 28,537 Bytes
946557f
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
---
language:
- en
- de
- fr
- it
- pt
- hi
- es
- th
library_name: transformers
pipeline_tag: image-text-to-text
tags:
- facebook
- meta
- pytorch
- llama
- llama-3
license: llama3.2
extra_gated_prompt: >-
  ### LLAMA 3.2 COMMUNITY LICENSE AGREEMENT


  Llama 3.2 Version Release Date: September 25, 2024

  
  “Agreement” means the terms and conditions for use, reproduction, distribution 
  and modification of the Llama Materials set forth herein.

  
  “Documentation” means the specifications, manuals and documentation accompanying Llama 3.2
  distributed by Meta at https://llama.meta.com/doc/overview.

  
  “Licensee” or “you” means you, or your employer or any other person or entity (if you are 
  entering into this Agreement on such person or entity’s behalf), of the age required under
  applicable laws, rules or regulations to provide legal consent and that has legal authority
  to bind your employer or such other person or entity if you are entering in this Agreement
  on their behalf.

  
  “Llama 3.2 means the foundational large language models and software and algorithms, including
  machine-learning model code, trained model weights, inference-enabling code, training-enabling code,
  fine-tuning enabling code and other elements of the foregoing distributed by Meta at 
  https://www.llama.com/llama-downloads.

  
  “Llama Materials” means, collectively, Meta’s proprietary Llama 3.2 and Documentation (and 
  any portion thereof) made available under this Agreement.

  
  “Meta” or “we” means Meta Platforms Ireland Limited (if you are located in or, 
  if you are an entity, your principal place of business is in the EEA or Switzerland) 
  and Meta Platforms, Inc. (if you are located outside of the EEA or Switzerland). 


  By clicking “I Accept” below or by using or distributing any portion or element of the Llama Materials,
  you agree to be bound by this Agreement.

  
  1. License Rights and Redistribution.
  
  a. Grant of Rights. You are granted a non-exclusive, worldwide, 
  non-transferable and royalty-free limited license under Meta’s intellectual property or other rights 
  owned by Meta embodied in the Llama Materials to use, reproduce, distribute, copy, create derivative works 
  of, and make modifications to the Llama Materials.  

  b. Redistribution and Use.  

  i. If you distribute or make available the Llama Materials (or any derivative works thereof), 
  or a product or service (including another AI model) that contains any of them, you shall (A) provide
  a copy of this Agreement with any such Llama Materials; and (B) prominently display “Built with Llama”
  on a related website, user interface, blogpost, about page, or product documentation. If you use the
  Llama Materials or any outputs or results of the Llama Materials to create, train, fine tune, or
  otherwise improve an AI model, which is distributed or made available, you shall also include “Llama”
  at the beginning of any such AI model name.

  ii. If you receive Llama Materials, or any derivative works thereof, from a Licensee as part
  of an integrated end user product, then Section 2 of this Agreement will not apply to you. 

  iii. You must retain in all copies of the Llama Materials that you distribute the 
  following attribution notice within a “Notice” text file distributed as a part of such copies: 
  “Llama 3.2 is licensed under the Llama 3.2 Community License, Copyright © Meta Platforms,
  Inc. All Rights Reserved.”

  iv. Your use of the Llama Materials must comply with applicable laws and regulations
  (including trade compliance laws and regulations) and adhere to the Acceptable Use Policy for
  the Llama Materials (available at https://www.llama.com/llama3_2/use-policy), which is hereby 
  incorporated by reference into this Agreement.
    
  2. Additional Commercial Terms. If, on the Llama 3.2 version release date, the monthly active users
  of the products or services made available by or for Licensee, or Licensee’s affiliates, 
  is greater than 700 million monthly active users in the preceding calendar month, you must request 
  a license from Meta, which Meta may grant to you in its sole discretion, and you are not authorized to
  exercise any of the rights under this Agreement unless or until Meta otherwise expressly grants you such rights.
  
  3. Disclaimer of Warranty. UNLESS REQUIRED BY APPLICABLE LAW, THE LLAMA MATERIALS AND ANY OUTPUT AND 
  RESULTS THEREFROM ARE PROVIDED ON AN “AS IS” BASIS, WITHOUT WARRANTIES OF ANY KIND, AND META DISCLAIMS
  ALL WARRANTIES OF ANY KIND, BOTH EXPRESS AND IMPLIED, INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES
  OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE. YOU ARE SOLELY RESPONSIBLE
  FOR DETERMINING THE APPROPRIATENESS OF USING OR REDISTRIBUTING THE LLAMA MATERIALS AND ASSUME ANY RISKS ASSOCIATED
  WITH YOUR USE OF THE LLAMA MATERIALS AND ANY OUTPUT AND RESULTS.
  
  4. Limitation of Liability. IN NO EVENT WILL META OR ITS AFFILIATES BE LIABLE UNDER ANY THEORY OF LIABILITY, 
  WHETHER IN CONTRACT, TORT, NEGLIGENCE, PRODUCTS LIABILITY, OR OTHERWISE, ARISING OUT OF THIS AGREEMENT, 
  FOR ANY LOST PROFITS OR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, INCIDENTAL, EXEMPLARY OR PUNITIVE DAMAGES, EVEN 
  IF META OR ITS AFFILIATES HAVE BEEN ADVISED OF THE POSSIBILITY OF ANY OF THE FOREGOING.
  
  5. Intellectual Property.
  
  a. No trademark licenses are granted under this Agreement, and in connection with the Llama Materials, 
  neither Meta nor Licensee may use any name or mark owned by or associated with the other or any of its affiliates, 
  except as required for reasonable and customary use in describing and redistributing the Llama Materials or as 
  set forth in this Section 5(a). Meta hereby grants you a license to use “Llama” (the “Mark”) solely as required 
  to comply with the last sentence of Section 1.b.i. You will comply with Meta’s brand guidelines (currently accessible 
  at https://about.meta.com/brand/resources/meta/company-brand/). All goodwill arising out of your use of the Mark 
  will inure to the benefit of Meta.
  
  b. Subject to Meta’s ownership of Llama Materials and derivatives made by or for Meta, with respect to any
  derivative works and modifications of the Llama Materials that are made by you, as between you and Meta,
  you are and will be the owner of such derivative works and modifications.

  c. If you institute litigation or other proceedings against Meta or any entity (including a cross-claim or
  counterclaim in a lawsuit) alleging that the Llama Materials or Llama 3.2 outputs or results, or any portion
  of any of the foregoing, constitutes infringement of intellectual property or other rights owned or licensable
  by you, then any licenses granted to you under this Agreement shall terminate as of the date such litigation or
  claim is filed or instituted. You will indemnify and hold harmless Meta from and against any claim by any third
  party arising out of or related to your use or distribution of the Llama Materials.
  
  6. Term and Termination. The term of this Agreement will commence upon your acceptance of this Agreement or access
  to the Llama Materials and will continue in full force and effect until terminated in accordance with the terms
  and conditions herein. Meta may terminate this Agreement if you are in breach of any term or condition of this
  Agreement. Upon termination of this Agreement, you shall delete and cease use of the Llama Materials. Sections 3,
  4 and 7 shall survive the termination of this Agreement. 
  
  7. Governing Law and Jurisdiction. This Agreement will be governed and construed under the laws of the State of 
  California without regard to choice of law principles, and the UN Convention on Contracts for the International
  Sale of Goods does not apply to this Agreement. The courts of California shall have exclusive jurisdiction of
  any dispute arising out of this Agreement. 
  
  ### Llama 3.2 Acceptable Use Policy
  
  Meta is committed to promoting safe and fair use of its tools and features, including Llama 3.2. 
  If you access or use Llama 3.2, you agree to this Acceptable Use Policy (“**Policy**”). 
  The most recent copy of this policy can be found at
  [https://www.llama.com/llama3_2/use-policy](https://www.llama.com/llama3_2/use-policy).
  
  #### Prohibited Uses
  
  We want everyone to use Llama 3.2 safely and responsibly. You agree you will not use, or allow others to use, Llama 3.2 to:
  
  1. Violate the law or others’ rights, including to:
      1. Engage in, promote, generate, contribute to, encourage, plan, incite, or further illegal or unlawful activity or content, such as:
          1. Violence or terrorism
          2. Exploitation or harm to children, including the solicitation, creation, acquisition, or dissemination of child exploitative content or failure to report Child Sexual Abuse Material
          3. Human trafficking, exploitation, and sexual violence
          4. The illegal distribution of information or materials to minors, including obscene materials, or failure to employ legally required age-gating in connection with such information or materials.
          5. Sexual solicitation
          6. Any other criminal activity
      1. Engage in, promote, incite, or facilitate the harassment, abuse, threatening, or bullying of individuals or groups of individuals
      2. Engage in, promote, incite, or facilitate discrimination or other unlawful or harmful conduct in the provision of employment, employment benefits, credit, housing, other economic benefits, or other essential goods and services
      3. Engage in the unauthorized or unlicensed practice of any profession including, but not limited to, financial, legal, medical/health, or related professional practices
      4. Collect, process, disclose, generate, or infer private or sensitive information about individuals, including information about individuals’ identity, health, or demographic information, unless you have obtained the right to do so in accordance with applicable law
      5. Engage in or facilitate any action or generate any content that infringes, misappropriates, or otherwise violates any third-party rights, including the outputs or results of any products or services using the Llama Materials
      6. Create, generate, or facilitate the creation of malicious code, malware, computer viruses or do anything else that could disable, overburden, interfere with or impair the proper working, integrity, operation or appearance of a website or computer system
      7. Engage in any action, or facilitate any action, to intentionally circumvent or remove usage restrictions or other safety measures, or to enable functionality disabled by Meta 
  2. Engage in, promote, incite, facilitate, or assist in the planning or development of activities that present a risk of death or bodily harm to individuals, including use of Llama 3.2 related to the following:
      8. Military, warfare, nuclear industries or applications, espionage, use for materials or activities that are subject to the International Traffic Arms Regulations (ITAR) maintained by the United States Department of State or to the U.S. Biological Weapons Anti-Terrorism Act of 1989 or the Chemical Weapons Convention Implementation Act of 1997
      9. Guns and illegal weapons (including weapon development)
      10. Illegal drugs and regulated/controlled substances
      11. Operation of critical infrastructure, transportation technologies, or heavy machinery
      12. Self-harm or harm to others, including suicide, cutting, and eating disorders
      13. Any content intended to incite or promote violence, abuse, or any infliction of bodily harm to an individual
  3. Intentionally deceive or mislead others, including use of Llama 3.2 related to the following:
      14. Generating, promoting, or furthering fraud or the creation or promotion of disinformation
      15. Generating, promoting, or furthering defamatory content, including the creation of defamatory statements, images, or other content
      16. Generating, promoting, or further distributing spam
      17. Impersonating another individual without consent, authorization, or legal right
      18. Representing that the use of Llama 3.2 or outputs are human-generated
      19. Generating or facilitating false online engagement, including fake reviews and other means of fake online engagement 
  4. Fail to appropriately disclose to end users any known dangers of your AI system
  5. Interact with third party tools, models, or software designed to generate unlawful content or engage in unlawful or harmful conduct and/or represent that the outputs of such tools, models, or software are associated with Meta or Llama 3.2


  With respect to any multimodal models included in Llama 3.2, the rights granted under Section 1(a) of the Llama 3.2 Community License Agreement are not being granted to you if you are an individual domiciled in, or a company with a principal place of business in, the European Union. This restriction does not apply to end users of a product or service that incorporates any such multimodal models.


  Please report any violation of this Policy, software “bug,” or other problems that could lead to a violation of this Policy through one of the following means:


  * Reporting issues with the model: [https://github.com/meta-llama/llama-models/issues](https://l.workplace.com/l.php?u=https%3A%2F%2Fgithub.com%2Fmeta-llama%2Fllama-models%2Fissues&h=AT0qV8W9BFT6NwihiOHRuKYQM_UnkzN_NmHMy91OT55gkLpgi4kQupHUl0ssR4dQsIQ8n3tfd0vtkobvsEvt1l4Ic6GXI2EeuHV8N08OG2WnbAmm0FL4ObkazC6G_256vN0lN9DsykCvCqGZ)
  
  * Reporting risky content generated by the model: [developers.facebook.com/llama_output_feedback](http://developers.facebook.com/llama_output_feedback)
  
  * Reporting bugs and security concerns: [facebook.com/whitehat/info](http://facebook.com/whitehat/info)
  
  * Reporting violations of the Acceptable Use Policy or unlicensed uses of Llama 3.2: [email protected]
extra_gated_fields:
  First Name: text
  Last Name: text
  Date of birth: date_picker
  Country: country
  Affiliation: text
  Job title:
    type: select
    options:
    - Student
    - Research Graduate
    - AI researcher
    - AI developer/engineer
    - Reporter
    - Other
  geo: ip_location
  By clicking Submit below I accept the terms of the license and acknowledge that the information I provide will be collected stored processed and shared in accordance with the Meta Privacy Policy: checkbox
extra_gated_description: >-
  The information you provide will be collected, stored, processed and shared in
  accordance with the [Meta Privacy
  Policy](https://www.facebook.com/privacy/policy/).
extra_gated_button_content: Submit
extra_gated_eu_disallowed: true
---

## Model Information

Llama Guard 3 Vision is a Llama-3.2-11B pretrained model, fine-tuned for content safety classification. Similar to previous versions \[1-3\], it can be used to safeguard content for both LLM inputs (prompt classification) and LLM responses (response classification).

Llama Guard 3 Vision was specifically designed to support image reasoning use cases and was optimized to detect harmful multimodal (text and image) prompts and text responses to these prompts. 

Llama Guard 3 Vision acts as an LLM – it generates text in its output that indicates whether a given prompt or response is safe or unsafe, and if unsafe, it also lists the content categories violated. Below is a response classification example input and output for Llama Guard 3 Vision.

<p align="center">
  <img src="llama_guard_3_11B_vision_figure.png" width="800"/>
</p>

## Get started

Once you have access to the model weights, please refer to our [documentation](https://www.llama.com/docs/model-cards-and-prompt-formats/llama-guard-3/) to get started.

## Using with transformers

```python
from transformers import AutoModelForVision2Seq, AutoProcessor
import torch
from PIL import Image as PIL_Image

model_id = "meta-llama/Llama-Guard-3-11B-Vision"

processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForVision2Seq.from_pretrained(
    model_id,
    torch_dtype=torch.bfloat16,
    device_map="auto",
)

image = PIL_Image.open("<path/to/image>").convert("RGB")

conversation = [
    {
        "role": "user",
        "content": [
            {
                "type": "text", 
                "text": "What is the recipe for mayonnaise?"
            },
            {
                "type": "image",
            },
        ],
    }
]

input_prompt = processor.apply_chat_template(
    conversation, return_tensors="pt"
)

inputs = processor(text=input_prompt, images=image, return_tensors="pt").to(model.device)

prompt_len = len(inputs['input_ids'][0])
output = model.generate(
    **inputs,
    max_new_tokens=20,
    pad_token_id=0,
)

generated_tokens = output[:, prompt_len:]

print(input_prompt)
print(processor.decode(generated_tokens[0]))
```

This snippet will use the categories described in this model card. You can provide your own categories instead:

```python
input_prompt = processor.apply_chat_template(
    conversation,
    return_tensors="pt",
    categories = {
        "S1": "My custom category",
    },
)
```

Or you can exclude categories from the default list by specifying an array of category keys to exclude:

```python
input_prompt = processor.apply_chat_template(
    conversation,
    return_tensors="pt",
    excluded_category_keys=["S1"],
)
```

## Hazard Taxonomy and Policy

The model is trained to predict safety labels on the 13 categories shown below, based on the [MLCommons taxonomy](https://mlcommons.org/2024/04/mlc-aisafety-v0-5-poc/) of 13 hazards.

<table align="center">
<thead>
  <tr>
    <th colspan="2"><center><b>Hazard categories</b></center></th>
  </tr>
</thead>
<tbody>
  <tr>
    <td>S1: Violent Crimes</td>
    <td>S2: Non-Violent Crimes</td>
  </tr>
  <tr>
    <td>S3: Sex-Related Crimes</td>
    <td>S4: Child Sexual Exploitation</td>
  </tr>
  <tr>
    <td>S5: Defamation</td>
    <td>S6: Specialized Advice</td>
  </tr>
  <tr>
    <td>S7: Privacy</td>
    <td>S8: Intellectual Property</td>
  </tr>
  <tr>
    <td>S9: Indiscriminate Weapons</td>
    <td>S10: Hate</td>
  </tr>
  <tr>
    <td>S11: Suicide &amp; Self-Harm</td>
    <td>S12: Sexual Content</td>
  </tr>
  <tr>
    <td>S13: Elections</td>
    <td></td>
  </tr>
</tbody>
</table>

**S1 - Violent Crimes**

Responses that enable, encourage, or endorse the commission of violent crimes, including: (1) unlawful violence toward people (ex: terrorism, genocide, murder, hate-motivated violent crimes, child abuse, assault, battery, kidnapping) and (2) unlawful violence toward animals (ex: animal abuse)

**S2 - Non-Violent Crimes**

Responses that enable, encourage, or endorse the commission of non-violent crimes, including: (1) personal crimes (ex: labor trafficking, threats, intimidation, hate-motivated non-violent crimes), (2) financial crimes (ex: fraud, scams, money laundering), (3) property crimes (ex: theft, arson, vandalism), (4) drug crimes (ex: creating or using regulated substances), (5) weapons crimes (ex: producing unlicensed firearms), and (6) cyber crimes (ex: hacking)

**S3 - Sex-Related Crimes**

Responses that enable, encourage, or endorse the commission of sex-related crimes, including: (1) sex trafficking, (2) sexual assault (ex: rape), (3) sexual harassment (physical, verbal, or visual), and (4) prostitution

**S4 - Child Sexual Exploitation**

Responses that contain, describe, enable, encourage, or endorse the sexual abuse of children

**S5 - Defamation**

Responses that are both verifiably false and likely to injure a living person’s reputation

**S6 - Specialized Advice**

Responses that contain specialized financial, medical, or legal advice, or that indicate dangerous activities or objects are safe

**S7 - Privacy**

Responses that contain sensitive, nonpublic personal information that could undermine someone’s physical, digital, or financial security

**S8 - Intellectual Property**

Responses that may violate the intellectual property rights of any third party

**S9 - Indiscriminate Weapons**

Responses that enable, encourage, or endorse the creation of indiscriminate weapons, including: (1) chemical weapons (ex: nerve gas), (2) biological weapons (ex: anthrax), (3) radiological weapons (ex: cobalt bombs), (4) nuclear weapons (ex: fission bombs), and (5) high-yield explosive weapons (ex: cluster munitions)

**S10 - Hate**

Responses that demean or dehumanize people on the basis of their sensitive, personal characteristics (i.e., race, color, ethnicity, national origin, disability, religious affiliation, caste, sexual orientation, sex, gender identity, and/or serious disease)

**S11 - Suicide & Self-Harm**

Responses that enable, encourage, or endorse acts of intentional self-harm, including: (1) suicide, (2) self-injury (ex: cutting), and (3) disordered eating

**S12 - Sexual Content**

Responses that contain erotica

**S13 - Elections**

Responses that contain factually incorrect information about electoral systems and processes, including in the time, place, or manner of voting in civic elections

**Note on violation for image understanding.** Compared to text-only Llama Guards, specific attention was paid to risks emerging from potential prompts to identify people in images (e.g., recognizing a real world person from the image through any visual clue). Llama Guard 3 Vision was trained to classify the response as unsafe.

## Training data

To train the Llama Guard 3 Vision, we employed a hybrid dataset comprising both human-generated and synthetically generated data. Our approach involved collecting human-created prompts paired with corresponding images, as well as generating benign and violating model responses using our in-house Llama models. We utilized jailbreaking techniques to elicit violating responses from these models. The resulting dataset includes samples labeled either by humans or the Llama 3.1 405B model. To ensure comprehensive coverage, we carefully curated the dataset to encompass a diverse range of prompt-image pairs, spanning all hazard categories listed above. For the image data we use, our vision encoder will rescale it into 4 chunks, each of 560x560.

## Evaluation

We evaluate the performance of Llama Guard 3 vision on our internal test following MLCommons hazard taxonomy. To the best of our knowledge, Llama Guard 3 Vision is the first safety classifier for the LLM image understanding task. In this regard, we use GPT-4o and GPT-4o mini with zero-shot prompting using MLCommons hazard taxonomy as a baseline.

<table align="center">
<small><center>Table 1: Comparison of performance of various models measured on our internal test set for MLCommons hazard taxonomy.</center></small>
<tbody>
<tr>
    <td><b>Model</b></td>
    <td><b>Task</b></td>
    <td><b>Precision</b></td>
    <td><b>Recall</b></td>
    <td><b>F1</b></td>
    <td><b>FPR</b></td>
</tr>
<tr>
    <td>Llama Guard 3 Vision</td>
    <td rowspan="3">Prompt Classification</td>
    <td>0.891</td>
    <td>0.623</td>
    <td>0.733</td>
    <td>0.052</td>
</tr>
<tr>
    <td>GPT-4o</td>
    <td>0.544</td>
    <td>0.843</td>
    <td>0.661</td>
    <td>0.485</td>
</tr>
<tr>
    <td>GPT-4o mini</td>
    <td>0.488</td>
    <td>0.943</td>
    <td>0.643</td>
    <td>0.681</td>
</tr>
<tr>
    <td>Llama Guard 3 Vision</td>
    <td rowspan="3">Response Classification</td>
    <td>0.961</td>
    <td>0.916</td>
    <td>0.938</td>
    <td>0.016</td>
</tr>
<tr>
    <td>GPT-4o</td>
    <td>0.579</td>
    <td>0.788</td>
    <td>0.667</td>
    <td>0.243</td>
</tr>
<tr>
    <td>GPT-4o mini</td>
    <td>0.526</td>
    <td>0.820</td>
    <td>0.641</td>
    <td>0.313</td>
</tr>
</tbody>
</table>

<table align="center">
<small><center>Table 2: Category-wise breakdown of F1 for Llama Guard 3 Vision on our internal test set for response classification with safety labels from the ML Commons taxonomy.</center></small>
<tbody>
<tr>
    <td><b>Category</b></td>
    <td><b>F1</b></td>
</tr>
<tr>
    <td>Violent Crimes</td>
    <td>0.839</td>
</tr>
<tr>
    <td>Non-Violent Crimes</td>
    <td>0.917</td>
</tr>
<tr>
    <td>Sex Crimes</td>
    <td>0.797</td>
</tr>
<tr>
    <td>Child Exploitation</td>
    <td>0.698</td>
</tr>
<tr>
    <td>Defamation</td>
    <td>0.967</td>
</tr>
<tr>
    <td>Specialized Advice</td>
    <td>0.764</td>
</tr>
<tr>
    <td>Privacy</td>
    <td>0.847</td>
</tr>
<tr>
    <td>Intellectual Property</td>
    <td>0.849</td>
</tr>
<tr>
    <td>Indiscriminate Weapons</td>
    <td>0.995</td>
</tr>
<tr>
    <td>Hate</td>
    <td>0.894</td>
</tr>
<tr>
    <td>Self-Harm</td>
    <td>0.911</td>
</tr>
<tr>
    <td>Sexual Content</td>
    <td>0.947</td>
</tr>
<tr>
    <td>Elections</td>
    <td>0.957</td>
</tr>
</tbody>
</table>

**Result Analysis.** Table 1 shows that Llama Guard 3 Vision outperforms GPT-4o and GPT-4o mini in terms of F1, specifically in response classification. Noteworthily,  Llama Guard 3 Vision achieves better performance with much lower false positive rates. We also observe that the recall (false positive rates) of prompt classification are much lower (higher) than in general, this is because of the ambiguity of prompt (text+image) in the image understanding tasks making prompt classification more challenging than response classification. For example, given a text prompt “how do I buy this” with an image of multiple objects, whether the prompt is safe or not depends on which objects the user is referring to, and it is hard to decide in some cases. In such cases, we recommend using Llama Guard 3 Vision in the response classification task. Table 2 also shows the category breakdown in our internal test set. We observe that Llama Guard 3 Vision performs well in Indiscriminate Weapon and Elections categories, while showing > 0.69 F1 scores across all categories.

## Limitations

There are some limitations associated with Llama Guard 3 Vision. First, Llama Guard 3 Vision itself is an LLM fine-tuned on Llama 3.2-vision. Thus, its performance (e.g., judgments that need common sense knowledge, multilingual capability, and policy coverage) might be limited by its (pre-)training data.

Llama Guard 3 Vision is not meant to be used as an image safety classifier nor a text-only safety classifier. Its task is to classify the multimodal prompt or the multimodal prompt along with the text response. It was optimized for English language and only supports one image at the moment. Images will be rescaled into 4 chunks each of 560x560, so the classification performance may vary depending on the actual image size. For text-only mitigation, we recommend using other safeguards in the Llama Guard family of models, such as Llama Guard 3-8B or Llama Guard 3-1B depending on your use case.

Some hazard categories may require factual, up-to-date knowledge to be evaluated (for example, S5: Defamation, S8: Intellectual Property, and S13: Elections) . We believe more complex systems should be deployed to accurately moderate these categories for use cases highly sensitive to these types of hazards, but Llama Guard 3 Vision provides a good baseline for generic use cases.

Lastly, as an LLM, Llama Guard 3 Vision may be susceptible to adversarial attacks [4, 5] that could bypass or alter its intended use. Please [report](https://github.com/meta-llama/PurpleLlama) vulnerabilities and we will look to incorporate improvements in future versions of Llama Guard.

## References

[1] [Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations](https://arxiv.org/abs/2312.06674)

[2] [Llama Guard 2 Model Card](https://github.com/meta-llama/PurpleLlama/blob/main/Llama-Guard2/MODEL_CARD.md)

[3] [Llama Guard 3-8B Model Card](https://github.com/meta-llama/PurpleLlama/blob/main/Llama-Guard3/8B/MODEL_CARD.md)

[4] [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://arxiv.org/abs/2307.15043)

[5] [Are aligned neural networks adversarially aligned?](https://arxiv.org/abs/2306.15447)

## Citation
```
@misc{metallamaguard3vision,
  author =       {Llama Team},
  title =        {Meta Llama Guard 3 Vision},
  howpublished = {\url{https://github.com/meta-llama/PurpleLlama/blob/main/Llama-Guard3/11B-vision/MODEL_CARD.md}},
  year =         {2024}
}
```