Research map / Vision-language and multimodal / Multimodal LLMs
Understanding and Rectifying Safety Perception Distortion in VLMs
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Identifies a modality-induced activation shift toward the "safe" side in VLMs and proposes ShiftDC, a training-free inference-time method that projects out the safety-relevant component of that shift to restore safety alignment.
Problem
VLMs are more vulnerable to harmful requests and jailbreaks than their text-only LLM backbones after integrating the vision modality; the mechanism behind this degradation is unclear.
Approach
Decomposes the image-induced activation shift (relative to a caption-based text-only counterpart) into a component along the text-derived safety direction and an orthogonal component; removes the safety-aligned projection at inference so the LLM backbone's inherent safety recognition is reactivated while visual semantics are preserved.
Key results
- ShiftDC lowers average ASR on MM-SafetyBench for LLaVA-1.5-7B from 45.4 (Direct) and 40.3 (ECSO) to 38.0 under SD images, and to 39.7 vs 69.3 for OCR images.
- On FigStep, ShiftDC reduces ASR for LLaVA-1.5-7B from 62.4 (Direct) to 8.5, compared with 9.7 (ECSO) and 12.4 (AdaShield).
- ShiftDC preserves utility: LLaVA-1.5-7B MME-P 1507.4 (Direct) vs 1507.4 (ShiftDC) and MM-Vet 30.5 vs 30.4.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply ShiftDC activation calibration instead of direct inference | LLaVA-1.5-7B · MM-SafetyBench SD (average) | ASR: 45.4 -> 38.0 | Helped |
| Apply ShiftDC activation calibration instead of direct inference | LLaVA-1.5-7B · MM-SafetyBench OCR (average) | ASR: 69.3 -> 39.7 | Helped |
| Apply ShiftDC activation calibration instead of direct inference | LLaVA-1.5-7B · MM-SafetyBench SD+OCR (average) | ASR: 70.5 -> 43.6 | Helped |
| Apply ShiftDC activation calibration instead of ECSO caption transformation | LLaVA-1.5-7B · FigStep | ASR: 9.7 -> 8.5 | Helped |
| Apply ShiftDC activation calibration | LLaVA-1.5-7B · MME-P | utility score: 1507.4 -> 1507.4 | No clear effect |
| Apply ShiftDC activation calibration | LLaVA-1.5-7B · MME-C | utility score: 355.7 -> 356.2 | No clear effect |
| Apply ShiftDC activation calibration | LLaVA-1.5-7B · MM-Vet | score: 30.5 -> 30.4 | No clear effect |
| Apply ShiftDC rather than ECSO | LLaVA-1.5-7B · MM-SafetyBench | inference time (second): 0.65 (+0.31) -> 0.60 (+0.26) | Helped |
Surprising findings
- Blank images paired with harmful text also produce a positive ASR and a safe-direction shift, suggesting the shift stems from the visual modality itself rather than image content.
- Defensive prompts (AdaShield) push activations toward the unsafe side for both safe and unsafe inputs, causing over-refusal of benign inputs.
Limitations
- Requires a small set of harmful and benign samples to extract the safety direction.
- Relies on the LLM backbone being well-aligned on text-only inputs; ineffective otherwise.
- Evaluation restricted to MM-SafetyBench scenarios 01-07 and 09 for the analysis, and ASR uses keyword matching.
Experimental setup
Datasets: MM-SafetyBench LLaVA-Instruct-80K FigStep
Benchmarks: MM-SafetyBench FigStep MME MM-Vet
Metrics: attack success rate (keyword-based) binary safety classification accuracy utility scores (MME perception/cognition, MM-Vet) misclassification rate on benign data inference time
Baselines: Direct (no defense) ECSO AdaShield
Builds on: ECSO AdaShield difference-in-mean activation directions
Closest papers by meaning
- Risk Awareness Injection: Calibrating Vision-Language Models for Safety without Compromising Utility (ICML 2026 · similarity 0.91)
- ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time (ICLR 2025 · similarity 0.90)
- Cross-Modal Safety Mechanism Transfer in Large Vision-Language Models (ICLR 2025 · similarity 0.90)
- Do We Really Need Curated Malicious Data for Safety Alignment in Multi-modal Large Language Models? (CVPR 2025 · similarity 0.89)
- Diagnosing and Repairing Unsafe Channels in Vision-Language Models via Causal Discovery and Dual-Modal Safety Subspace Projection (CVPR 2026 · similarity 0.89)
- Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models (ICML 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.