Research map / Vision-language and multimodal / Multimodal LLMs

ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time

ICLR 2025 · Vision-language and multimodal › Multimodal LLMs · approach: VLM capability analysis · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes ETA, a training-free two-phase inference-time framework that evaluates image and response safety (CLIP-based pre-generation check and reward-model post-generation check) and then aligns flagged outputs via an interference prefix plus sentence-level best-of-N search guided by safety and CLIP utility scores.

Problem

VLMs are easily jailbroken through adversarial or harmful visual inputs, and existing defenses are either resource-intensive fine-tuning methods or inference-time methods that ignore visual safety checks and give generic refusals, hurting helpfulness.

Approach

Evaluate both the input image (CLIP similarity to unsafe-category prompts) and the output text (safety-formatted reward model score) before aligning; when both flag unsafe, prefill a safety prefix and run sentence-level best-of-N guided by a combined RM safety score and CLIP utility score.

Key results

• On LLaVA-1.5-13B under the cross-modality unconstrained attack, ETA reduces USR from 100.00 to 12.50 (87.5% reduction), versus ECSO at 95.00.
• ETA achieves a 96.6% win-tie rate against the vanilla LLaVA-1.5-7B in GPT-4-Turbo helpfulness evaluation on SPA-VL Help.
• ETA leaves general VQA/comprehensive benchmark scores essentially unchanged on LLaVA-1.5-7B (e.g., MME-P 1506.13 vs 1505.88; SQA-I 69.51 vs 69.51), while fine-tuned VLGuard LoRA baselines degrade performance.

Measured effects reported in the paper

Surprising findings

• Mapping continuous visual embeddings to their nearest discrete text embeddings reduces USR, supporting the hypothesis that visual embeddings act as outliers that bypass text-aligned safety mechanisms.
• ECSO's self-evaluation yields only a marginal USR reduction under adversarial attacks, suggesting it limits image influence rather than truly defending.

Limitations

• Relies on hand-set thresholds (tau_pre=0.16, tau_post=0.06) chosen empirically.
• Visual safety judged only through CLIP similarity to category prompts; the textual RM cannot process images directly.

Experimental setup

Datasets: SPA-VL COCO MM-SafetyBench

Benchmarks: SPA-VL Harm MM-SafetyBench FigStep Unconstrained adversarial image attack AdvBench MME MMBench ScienceQA-IMG VQAv2 TextVQA MMMU-Pro SPA-VL Help

Metrics: Unsafe Rate (USR) Attack Success Rate (ASR) win-tie rate helpful score inference time

Baselines: ECSO VLGuard Posthoc-LoRA VLGuard Mixed-LoRA

Builds on: ECSO best-of-N sampling CLIP ArmoRM

Closest papers by meaning

• Cross-Modal Safety Mechanism Transfer in Large Vision-Language Models (ICLR 2025 · similarity 0.93)
• Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models (ICML 2024 · similarity 0.93)
• DAVSP: Safety Alignment for Large Vision-Language Models via Deep Aligned Visual Safety Prompt (AAAI 2026 · similarity 0.92)
• SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Models (CVPR 2025 · similarity 0.92)
• VLSU: Mapping the Limits of Joint Multimodal Understanding for AI Safety (ICLR 2026 · similarity 0.92)
• Diagnosing and Repairing Unsafe Channels in Vision-Language Models via Causal Discovery and Dual-Modal Safety Subspace Projection (CVPR 2026 · similarity 0.91)