Research map / Vision-language and multimodal / Multimodal LLMs
Layer-wise Alignment: Examining Safety Alignment Across Image Encoder Layers in Vision Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that early-exiting from intermediate image-encoder layers (ICET) of VLMs makes them produce harmful answers to harmful text with benign images, and proposes Layer-wise Clip-PPO (L-PPO) to reduce this vulnerability.
Problem
VLM safety alignment is tuned only on the default final image-encoder embeddings, so using intermediate image-encoder layer embeddings (early exit) at inference may bypass safety and produce harmful outputs.
Approach
Identifies an image-encoder early-exit vulnerability (ICET) where harmful text paired with a safe image yields harmful responses when intermediate encoder layers are used, and applies PPO-based RLHF in which the policy receives the intermediate-layer image embedding (L-PPO) to align the VLM for that layer.
Key results
- On LLaVA-1.5 with RedTeam-2k alignment and custom prompts, L-PPO reduces average ASR from 64.62% to 37.96% (early, middle, late layers averaged).
- Average toxicity score drops from 10.71 to 6.24 on the custom prompt set after L-PPO alignment.
- Abstract reports improvements of up to 48% in ASR and 33.64% in toxicity score across three datasets; VQA-v2 utility remains roughly unchanged (AAS 48.73 to 48.23).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply layer-wise PPO alignment | LLaVA-1.5 · Custom Prompts (CP) | AASR: 64.62 -> 37.96 | Helped |
| Apply layer-wise PPO alignment | LLaVA-1.5 · Custom Prompts (CP) | ATS: 10.71 -> 6.24 | Helped |
| Apply layer-wise PPO alignment | LLaVA-1.5 · Custom Prompts (CP) | ATR: -0.09 -> 0.66 | Helped |
| Apply layer-wise PPO alignment | LLaVA-1.5 · miniJailbreak-V28K redteam queries (MR) | AASR: 50.58 -> 10.50 | Helped |
| Apply layer-wise PPO alignment | LLaVA-1.5 · miniJailbreak-V28K redteam queries (MR) | ATS: 7.92 -> 5.19 | Helped |
| Apply layer-wise PPO alignment | LLaVA-1.5 · miniJailbreak-V28K redteam queries (MR) | ATR: -0.34 -> 0.31 | Helped |
| Apply layer-wise PPO alignment | LLaVA-1.5 · AdvBench-COCO (AC) | AASR: 62.68 -> 42.42 | Helped |
| Apply layer-wise PPO alignment | LLaVA-1.5 · AdvBench-COCO (AC) | ATS: 6.21 -> 4.92 | Helped |
| Apply layer-wise PPO alignment | LLaVA-1.5 · AdvBench-COCO (AC) | ATR: -0.20 -> 0.49 | Helped |
| Apply layer-wise PPO alignment | LLaVA-1.5 · VQA-v2 | AAS-UT: 48.73 -> 48.23 | No clear effect |
| Vary the value function coefficient across the tested grid (ablation) | L-PPO on LLaVA-1.5 · Safety alignment experiments | Overall results | No clear effect |
Surprising findings
- Harmful responses arise from intermediate image-encoder layers even with a benign image and no adversarial token, while the default layer yields safe refusals.
- Safety-tuned language backbones are still compromised by early exit, indicating the vulnerability stems from the image embedding distribution shift.
Limitations
- Reward model and Llama Guard judgments can disagree; Perspective API flags safe refusals containing harmful words.
- Alignment is layer-specific; a unified defense across all layers is not addressed.
- Experiments are limited to a small custom prompt set (100 prompts) and a few VLMs; L-PPO gains are smaller for early layers.
Experimental setup
Datasets: RedTeam 2K JailBreak-V28K AdvBench MS-COCO HH-RLHF VQA-v2 XSTest
Benchmarks: RedTeam 2K custom prompts AdvBench-COCO minijailbreak-V28K redteam queries VQA-v2 XSTest
Metrics: Attack Success Rate (Llama Guard) Total Rewards (reward model) Toxicity Score (Perspective API) VQA accuracy Average Total Rewards on utility
Baselines: Original inference (default final-layer embeddings) SFT-based safety alignment
Builds on: Clip-PPO RLHF LLaVA-1.5 GAE
Closest papers by meaning
- Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models (ICML 2024 · similarity 0.91)
- Cross-Modal Safety Mechanism Transfer in Large Vision-Language Models (ICLR 2025 · similarity 0.91)
- ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time (ICLR 2025 · similarity 0.91)
- SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Models (CVPR 2025 · similarity 0.90)
- DAVSP: Safety Alignment for Large Vision-Language Models via Deep Aligned Visual Safety Prompt (AAAI 2026 · similarity 0.89)
- Fine-Grained Verifiers: Preference Modeling as Next-token Prediction in Vision-Language Alignment (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.