Research map / Vision-language and multimodal / Multimodal LLMs

Understanding and Mitigating Token-Pruning-Induced Vulnerabilities in VLMs

ICML 2026 · Vision-language and multimodal › Multimodal LLMs · approach: Attention-based visual token pruning

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that most token-pruning methods degrade VLM jailbreak safety while query-based compression improves it, and proposes Safety-Aware Pruning (SAP), a training-free plug-and-play defense that restores benign background tokens and reallocates attention away from malicious anchors on LLaVA-1.5-7B.

Problem

Token pruning accelerates vision-language models, but its safety implications under multimodal jailbreak attacks are unexplored; most pruning methods appear to increase attack success rates.

Approach

Identifies Pruning-Induced Malicious Amplification: discarding background tokens concentrates attention on retained malicious foreground anchors. SAP identifies malicious anchors (attention times deviation from a safety vector), restores pruned background tokens, and shifts attention mass from anchors to restored tokens at inference.

Key results

• SAP reduces average ASR for TRIM from 62.33% to 50.19% and for PruMerge from 61.88% to 44.78% across three safety benchmarks, with utility change within about 0.6 points for TRIM.
• LLaVA-Mini at 99.8% pruning reduces average ASR to 31.98% versus 54.01% for the unpruned LLaVA-1.5-7B baseline.
• On LLaVA-1.5-7B with TRIM, SAP runs at 57.19 ms latency versus 55.90 ms for TRIM alone, compared with 160.09 ms for LLaVAGuard.

Surprising findings

• Query-based compression at extreme pruning ratios (99.8%) lowers ASR below the unpruned model, contrary to the expectation that pruning worsens safety.
• Random pruning keeps ASR roughly stable up to 80% pruning, indicating that the safety degradation comes from biased token selection rather than token loss.

Limitations

• Experiments are limited to LLaVA-1.5-7B with a single 75% pruning ratio for main results, and the defense requires white-box access to attention weights.
• Adaptive attacks against SAP are not evaluated; the discussion only argues they would be costly.
• ASR is judged by GPT-4o-mini and Llama-Guard rather than human evaluation.

Experimental setup

Datasets: MM-SafetyBench FigStep JailBreakV-28K MMBench MM-Vet LLaVA-Bench ScienceQA

Benchmarks: MM-SafetyBench FigStep JailBreakV-28K MMBench MM-Vet LLaVA-Bench ScienceQA

Metrics: attack success rate accuracy latency FLOPs attention entropy

Baselines: TRIM HiPrune PruMerge FasterVLM FitPrune SparseVLM Random pruning LLaVAGuard

Builds on: SparseVLM TRIM FasterVLM LLaVA-Mini SafePTR

Closest papers by meaning

• SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism (NeurIPS 2025 · similarity 0.90)
• Safe + Safe = Unsafe? Exploring How Safe Images Can Be Exploited to Jailbreak Large Vision-Language Models (NeurIPS 2025 · similarity 0.88)
• When Token Pruning is Worse than Random: Understanding Visual Token Information in VLLMs (CVPR 2026 · similarity 0.88)
• Risk Awareness Injection: Calibrating Vision-Language Models for Safety without Compromising Utility (ICML 2026 · similarity 0.88)
• When and What to Prune? Stage-Aware Visual Token Pruning for Efficient VLA (NeurIPS 2026 · similarity 0.88)
• The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense (NeurIPS 2025 · similarity 0.88)