Research map / Vision-language and multimodal / Multimodal LLMs

Internal Activation Revision: Safeguarding Vision Language Models Without Parameter Update

AAAI 2025 · Vision-language and multimodal › Multimodal LLMs · approach: VLM capability analysis · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes internal activation revision, which shifts layer- or head-level activations of VLMs at inference using safety revision vectors (MMS or PWD) extracted from a few hundred contrastive samples, to reduce jailbreak attack success rates without parameter updates.

Problem

VLMs are more vulnerable to harmful content than their backbone LLMs because images shift internal activations away from text-only distributions, where the embedded safety alignment does not generalize.

Approach

Extract safety revision vectors from contrastive positive/negative activation samples (via mass mean shift or probe weight direction) and add them to layer or attention-head activations during generation, steering outputs toward safe responses without any weight update.

Key results

• Head-level revision with Multi-Response and MMS reduces ASR on average by 48.94% (SafeBench), 34.34% (Safe-Unsafe), 43.92% (Unsafe), and 52.98% (MM-SafetyBench) across three VLMs, with ScienceQA and GQA accuracy dropping only 7.72% and 1.17%.
• On LLaVA-V1.5-7B, the best head-level variant reaches a composite score of 34.35, versus 30.81 for Qwen2-VL-7B-Instruct and 29.98 for LLaVA-V1.5-13B.
• Head-level vectors extracted from LLaVA-V1.5-7B transfer to MiniGPT-V2 and InternVL2-8B, with composite scores up to 28.12 on InternVL2-8B.

Measured effects reported in the paper

Surprising findings

• Revision vectors extracted from text-only samples (Text-Response) perform worse than those from multimodal samples, despite text data being more plentiful.
• Vectors extracted from LLaVA-V1.5-7B transfer to other VLMs (MiniGPT-V2, InternVL2-8B) without retuning.

Limitations

• Performance depends on hyperparameter search over layer, head ratio, and strength alpha, which may be costly per model.
• Strong interventions make the model overly defensive, refusing even benign questions.
• Evaluation uses Perspective API for safety judgments and sampled subsets of existing datasets.

Experimental setup

Datasets: Alpaca XSTest Refusal SafeBench VLGuard MM-SafetyBench ScienceQA GQA

Benchmarks: SafeBench Safe-Unsafe Unsafe MM-SafetyBench ScienceQA GQA

Metrics: attack success rate accuracy composite score

Baselines: AdaShield MLLM-Protector Fine-tuning Vanilla

Builds on: Inference-Time Intervention Activation Addition Contrastive Activation Addition AdaShield MLLM-Protector

Closest papers by meaning

• ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time (ICLR 2025 · similarity 0.91)
• Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models (ICML 2024 · similarity 0.90)
• Cross-Modal Safety Mechanism Transfer in Large Vision-Language Models (ICLR 2025 · similarity 0.90)
• FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts (AAAI 2025 · similarity 0.89)
• Do We Really Need Curated Malicious Data for Safety Alignment in Multi-modal Large Language Models? (CVPR 2025 · similarity 0.89)
• GuardAlign: Robust Safety Alignment in Multimodal Large Language Models (ICLR 2026 · similarity 0.88)