Research map / Vision-language and multimodal / Multimodal LLMs
Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Immune, an inference-time jailbreak defense for MLLMs that applies controlled decoding guided by a safety reward model (URM-LLaMa-3.1-8B), with a theoretical suboptimality bound, and reports large ASR reductions over FigStep, AdaShield, and CoCA.
Problem
Multimodal LLMs remain vulnerable to jailbreak attacks (text-based, typographic, and adversarial-image) even after safety alignment via RLHF/fine-tuning, and existing inference-time defenses often lack theory and cause overly cautious responses that hurt utility.
Approach
Reframe jailbreak defense as inference-time alignment: at each decoding step, sample top-k candidate tokens from the base MLLM and reweight them by a safety reward's action-value (KL-regularized controlled decoding), with a theorem bounding the suboptimality gap under adversarial prompt distributions.
Key results
- On LLaVA-1.6, Immune reduces text-jailbreak ASR by 57.82% vs the base MLLM and 16.78% vs the best defense (per abstract).
- Average ASR on the visual adversarial attack benchmark for LLaVA-1.6 drops to 16.02% (unconstrained) with Immune versus 40.21% for AdaShield.
- Model utility on MM-Vet drops only 0.93% (34.07 to 33.75) while AdaShield drops to 27.25.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply inference-time controlled decoding with a safety reward model | LLaVA-1.6 · JailbreakV-28K text attacks (average) | ASR (%): 60.27 -> 2.45 | Helped |
| Apply inference-time controlled decoding with a safety reward model | LLaVA-1.6 · MM-SafetyBench (6 categories, average) | ASR (%): 47.94 -> 3.94 | Helped |
| Apply inference-time controlled decoding with a safety reward model | LLaVA-1.6 · FigStep (average) | ASR (%): 14.68 -> 1.21 | Helped |
| Apply inference-time controlled decoding with a safety reward model | LLaVA-1.6 · Visual adversarial attacks (unconstrained) | ASR (%): 64.80 -> 16.02 | Helped |
| Apply Immune instead of AdaShield | LLaVA-1.6 · MM-Vet | Model utility: 27.25 -> 33.75 | Helped |
| Use inference-time alignment with the DPO model's implicit reward | Qwen-VL + DPO · JailbreakV-28K text attacks (average) | ASR (%): 18.07 -> 12.10 | Helped |
| Use external safety reward for Immune rather than the DPO model's implicit reward | Qwen-VL · JailbreakV-28K text attacks (average) | ASR (%): 12.10 -> 8.58 | Helped |
| Use k=10 sampled tokens and α=1.0 (ablation) | Immune on LLaVA-1.5 · Hyperparameter evaluation | ASR and MM-Vet utility | Helped |
| Use logic-based text jailbreak prompts with noise images | Immune on MiniGPT-4-7B · JailbreakV-28K text attacks (noise, logic prompts) | ASR (%): 44.59 | Hurt |
Surprising findings
- On MiniGPT-4-7B, logic-based attacks with noise images yield a higher ASR under Immune (44.59%) than under CoCA (22.97%) and AdaShield (32.24%).
Limitations
- Evaluated only on static jailbreak datasets, not dynamic or iterative attacks.
- Not evaluated against defense-aware attacks.
- Reward model itself may be subject to adversarial attack.
Experimental setup
Datasets: JailbreakV-28K MM-SafetyBench FigStep Visual adversarial attacks MM-Vet HelpSteer2 OffsetBias WildGuard Magpie
Benchmarks: JailbreakV-28K MM-SafetyBench FigStep Visual adversarial attacks MM-Vet
Metrics: attack success rate MM-Vet score inference time KL divergence
Baselines: FigStep AdaShield CoCA Original decoding Qwen-VL + DPO
Builds on: controlled decoding KL-regularized RLHF FigStep AdaShield CoCA
Closest papers by meaning
- Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (CVPR 2025 · similarity 0.93)
- SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism (NeurIPS 2025 · similarity 0.93)
- Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models (ICLR 2025 · similarity 0.91)
- JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.91)
- JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (NeurIPS 2024 · similarity 0.91)
- Weak-to-Strong Jailbreaking on Large Language Models (ICML 2025 · similarity 0.91)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.