Research map / Vision-language and multimodal / Multimodal LLMs
Cross-Modal Safety Mechanism Transfer in Large Vision-Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes TGA, a text-guided vision-language alignment that aligns image hidden states with caption hidden states per layer (using retrieved text as template) to transfer LLM text safety to vision in LVLMs without visual safety fine-tuning.
Problem
LVLMs are far more vulnerable to toxic images than to toxic text with the same semantics, because the text safety mechanism of the base LLM is not transferred to the visual modality during vision-language alignment.
Approach
Locates safety-activating layers via sorry-token logit-lens shifts and attributes failure to insufficient hidden-state alignment between image and text; TGA adds a layer-wise pairwise cosine loss that pulls image hidden states toward caption hidden states, using a BEIT-3-retrieved text as a negative-like template, so the frozen-text safety mechanism transfers to vision.
Key results
- TGA-7B achieves average DSR on toxic images of roughly 20.65 (porn) to 30.83 (gun) per scene, versus 1.05–5.72 for LLaVA-1.6, InstructBlip, and Qwen-VL-Chat, and above Unlearn-FigS (8.76–21.42).
- TGA-7B reaches 34.6 on MM-Vet and 71.7 on ScienceQA-IMG, comparable to or above LLaVA-1.5-7B (Mistral) at 32.9 and 67.9.
- On jailbreak attacks, TGA-7B obtains DSR of 21.08 (Role-Play), 15.43 (ICA), and 17.44 (FigStep), exceeding Unlearn-FigS and other baselines.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use TGA instead of mainstream vision-language alignment | Mistral-7B LVLM · Toxic images across seven scenes | DSR: 20.65 vs 8.76 (Porn); 9.48 vs 4.27 (Bloody); 22.73 vs 16.98 (Insulting); 17.92 vs 14.31 (Alcohol); 17.29 vs 10.10 (Cigar | Helped |
| Use TGA instead of LLaVA-1.5-7B (Mistral) | Mistral-7B LVLM · ScienceQA image subset | accuracy: 67.9 -> 71.7 | Helped |
| Use TGA instead of LLaVA-1.5-7B (Mistral) | Mistral-7B LVLM · SEED-Bench all | accuracy: 58.8 -> 58.7 | Hurt |
| Use TGA instead of LLaVA-1.5-7B (Mistral) | Mistral-7B LVLM · MM-Vet ocr | GPT-4 evaluation score: 22.5 -> 28.9 | Helped |
| Use TGA instead of LLaVA-1.5-7B (Mistral) | Mistral-7B LVLM · POPE rand | F1: 87.3 -> 87.6 | Hurt |
| Use TGA instead of LLaVA-1.5-7B on the same training data | 7B LVLM · SIUO unsafe compositional inputs | Safe Rate: 21.56 -> 30.77 | Helped |
| Use TGA instead of LLaVA-v1.5 | 7B LVLM · Role-Play jailbreak attack | DSR: 0.67 -> 21.08 | Helped |
| Use TGA instead of LLaVA-v1.5 | 7B LVLM · ICA jailbreak attack | DSR: 0.00 -> 15.43 | Helped |
| Use TGA instead of LLaVA-v1.5 | 7B LVLM · FigStep jailbreak attack | DSR: 0.58 -> 17.44 | Helped |
| Add retrieved text at inference to baseline LLaVA-1.5 (ablation) | LLaVA-1.5 · Toxic image safety | DSR | No clear effect |
| Remove retrieved text from TGA (ablation) | TGA · Toxic image safety | DSR | Hurt |
| Use retrieved text with the guide loss during training (ablation) | TGA · Toxic image safety and vision-task performance | DSR | Helped |
Surprising findings
- A safety-aligned LLM converted to an LVLM with LLaVA-1.5 data still fails to transfer its safety to vision (DSR 6.32–10.85), indicating alignment alone does not transfer safety.
- Directly adding retrieved text in inference does not significantly improve LLaVA-1.5 safety, while TGA without retrieval still outperforms it.
Limitations
- Relies on captions from LLaVA-1.5-13B; caption errors reduce DSR modestly (18.57 to 17.03 at 0–20% noise on a 100K subset).
- Absolute DSR on toxic images remains low (roughly 10–31%) even for the proposed method, and failures occur on subtle harmful objects and bloody domain images.
- Safety judged by LLaMA-2-7B classifier, and the comparison to fine-tuning-based defenses is limited because they were excluded from main comparison.
Experimental setup
Datasets: LLaVA-1.5 training data (558K pretraining, 665K instruction tuning) LAION/CC/SBU captions HOD ToViLaG SIUO ScienceQA POPE SEED-Bench MM-Vet
Benchmarks: HOD ToViLaG ScienceQA POPE SEED-Bench MM-Vet SIUO
Metrics: Defence Success Rate (DSR) accuracy F1 safe rate
Baselines: BLIP-2 InstructBlip LLaVA-1.5 LLaVA-1.6 Qwen-VL-Chat Unlearn-FigS ToViLaG ECSO
Builds on: LLaVA-1.5 Unlearn-FigS BEIT-3
Closest papers by meaning
- ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time (ICLR 2025 · similarity 0.93)
- Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models (ICML 2024 · similarity 0.92)
- DAVSP: Safety Alignment for Large Vision-Language Models via Deep Aligned Visual Safety Prompt (AAAI 2026 · similarity 0.91)
- SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Models (CVPR 2025 · similarity 0.91)
- Do We Really Need Curated Malicious Data for Safety Alignment in Multi-modal Large Language Models? (CVPR 2025 · similarity 0.91)
- Layer-wise Alignment: Examining Safety Alignment Across Image Encoder Layers in Vision Language Models (ICML 2025 · similarity 0.91)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.