Research map / Vision-language and multimodal / Multimodal LLMs

Risk Awareness Injection: Calibrating Vision-Language Models for Safety without Compromising Utility

ICML 2026 · Vision-language and multimodal › Multimodal LLMs · approach: VLM capability analysis · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Risk Awareness Injection (RAI), a training-free method that localizes high-risk visual tokens via cosine similarity to an unsafe prototype subspace built from LLM token embeddings and adds weighted risk prototype vectors to them at layer 0 to improve VLM jailbreak defense without hurting utility.

Problem

VLMs are highly vulnerable to multimodal jailbreak attacks because visual inputs dilute risk signals, while existing defenses either require costly safety fine-tuning or aggressive token manipulation that degrades utility.

Approach

Build an Unsafe Prototype Subspace from the LLM's own token embeddings of risk keywords, select only the visual tokens whose cosine similarity to these prototypes exceeds a threshold, and additively inject weighted normalized prototype vectors into them once at the first LLM layer during prefill.

Key results

• On MM-SafetyBench with LLaVA-1.6-7B, RAI reduces average ASR to 3.62% versus 14.83% for ShiftDC and 49.42% for the original model.
• On Video-SafetyBench with Qwen3-VL-8B, RAI achieves 0.00% average harmful ASR versus 1.53% for ShiftDC.
• On MM-Vet, RAI keeps Qwen3-VL-8B at 59.9 versus 60.1 original, and adds 13.2% latency versus 54.0% for ShiftDC.

Surprising findings

• Adding risk-prototype signals reduces ASR to 0.00% on several Qwen3-VL settings, which the authors present as near-perfect defense.
• Injecting at deeper layers progressively degrades perception scores, so the authors choose layer 0 despite the motivation analysis showing similarity drops in later layers.

Limitations

• The unsafe prototype subspace relies on hand-picked risk keywords, and K and the threshold tau are tuned on the evaluated benchmarks.
• The LLM judge (Qwen3) plus keyword filter is the only safety assessment; no human evaluation is reported.
• Some reported results (e.g., 0.00% ASR) and inconsistent model naming across tables (Qwen2-VL vs Qwen2.5-VL) raise concerns about evaluation consistency.

Experimental setup

Datasets: MM-SafetyBench JailBreakV-28K Video-SafetyBench MME MM-Vet FigStep

Benchmarks: MM-SafetyBench JailBreakV-28K Video-SafetyBench MME MM-Vet

Metrics: attack success rate MME perception and cognition score MM-Vet score inference latency

Baselines: AdaShield ECSO CoCA ShiftDC

Builds on: ShiftDC AdaShield ECSO CoCA

Closest papers by meaning

• Jailbreaking Vision-Language Models Through the Visual Modality (ICML 2026 · similarity 0.91)
• GuardAlign: Robust Safety Alignment in Multimodal Large Language Models (ICLR 2026 · similarity 0.91)
• Understanding and Rectifying Safety Perception Distortion in VLMs (NeurIPS 2025 · similarity 0.91)
• ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time (ICLR 2025 · similarity 0.91)
• JailBound: Jailbreaking Internal Safety Boundaries of Vision-Language Models (NeurIPS 2025 · similarity 0.91)
• Diagnosing and Repairing Unsafe Channels in Vision-Language Models via Causal Discovery and Dual-Modal Safety Subspace Projection (CVPR 2026 · similarity 0.90)