Internal Activation Revision: Safeguarding Vision Language Models Without Parameter Update

TL;DR

This work investigates why vision-language models (VLMs) are more susceptible to unsafe outputs than text-only LLMs by showing that image inputs significantly shift internal activations. It introduces internal activation revision, an inference-time method that revises activations at the layer or head level using contrastive revision vectors extracted from a small set of positive/negative samples, without updating model parameters. Across multiple VLMs and safety benchmarks, head-level revision with Multi-Response samples and MMS achieves the strongest safety gains, reducing attack success rates by an average of 48.94% to 52.98% while preserving helpfulness with minimal accuracy loss on select tasks. The method demonstrates data efficiency, transferability of revision vectors, and favorable computational characteristics, offering a flexible defense against multimodal jailbreaks without retraining.

Abstract

Vision-language models (VLMs) demonstrate strong multimodal capabilities but have been found to be more susceptible to generating harmful content compared to their backbone large language models (LLMs). Our investigation reveals that the integration of images significantly shifts the model's internal activations during the forward pass, diverging from those triggered by textual input. Moreover, the safety alignments of LLMs embedded within VLMs are not sufficiently robust to handle the activations discrepancies, making the models vulnerable to even the simplest jailbreaking attacks. To address this issue, we propose an \textbf{internal activation revision} approach that efficiently revises activations during generation, steering the model toward safer outputs. Our framework incorporates revisions at both the layer and head levels, offering control over the model's generation at varying levels of granularity. In addition, we explore three strategies for constructing positive and negative samples and two approaches for extracting revision vectors, resulting in different variants of our method. Comprehensive experiments demonstrate that the internal activation revision method significantly improves the safety of widely used VLMs, reducing attack success rates by an average of 48.94\%, 34.34\%, 43.92\%, and 52.98\% on SafeBench, Safe-Unsafe, Unsafe, and MM-SafetyBench, respectively, while minimally impacting model helpfulness.

Figures (12)

• Figure 1: Computation flow at the transformer layer $l$, with head-level revision after head attention ($\text{Att}^{h}_{l}$) and before concatenation (Concat), and layer-level revision after the multilayer perceptron (MLP).
• Figure 2: 2D t-SNE visualization of internal activations from the 5th, 15th, and 31st layers. The red, yellow, and blue dots represent $\text{TextSet}_{\text{A}}$, $\text{TextSet}_{\text{B}}$, and MultiSet, respectively.
• Figure 3: Accuracies across each head and layer for $\text{TextSet}_{\text{A}}$, $\text{TextSet}_{\text{B}}$ and $\text{MultiSet}$. Classifiers used in the upper row are trained on the training set of $\text{TextSet}_{\text{A}}$, while those in the lower row are trained on $\text{TextSet}_{\text{B}}$.
• Figure 4: Revision vectors extraction methods: probe weight direction (PWD) and mass mean shift (MMS).
• Figure 5: An example of Multi-Response.