Risk-adaptive Activation Steering for Safe Multimodal Large Language Models

TL;DR

This work addresses safety in multimodal LLMs when harmful intent is embedded in images, a scenario where traditional training-based alignment and inference-time prompts struggle. The authors introduce Risk-adaptive Activation Steering (RAS), a three-stage, inference-time defense: vision-aware query reformulation to strengthen cross-modal attention, exponentially weighted risk evaluation to produce continuous risk scores, and risk-adaptive activation steering that scales refusals to the assessed risk. By steering model activations toward refusal vectors only for high-risk queries, RAS achieves substantial reductions in attack success rates while preserving utility on benign tasks and delivering faster inference than iterative refinement baselines. Across multiple models and safety/utility benchmarks, RAS demonstrates effective, efficient safety improvements suitable for practical deployment.

Abstract

One of the key challenges of modern AI models is ensuring that they provide helpful responses to benign queries while refusing malicious ones. But often, the models are vulnerable to multimodal queries with harmful intent embedded in images. One approach for safety alignment is training with extensive safety datasets at the significant costs in both dataset curation and training. Inference-time alignment mitigates these costs, but introduces two drawbacks: excessive refusals from misclassified benign queries and slower inference speed due to iterative output adjustments. To overcome these limitations, we propose to reformulate queries to strengthen cross-modal attention to safety-critical image regions, enabling accurate risk assessment at the query level. Using the assessed risk, it adaptively steers activations to generate responses that are safe and helpful without overhead from iterative output adjustments. We call this Risk-adaptive Activation Steering (RAS). Extensive experiments across multiple benchmarks on multimodal safety and utility demonstrate that the RAS significantly reduces attack success rates, preserves general task performance, and improves inference speed over prior inference-time defenses.

Figures (16)

• Figure 1: Lack of attention to safety-critical image regions. (a) For unsafe multimodal instructions, the model fails to allocate sufficient attention to safety-critical image regions (i.e., the bomb, highlighted in red), leading to unsafe responses. (b) In contrast, when the same instruction is given in text only, the model sufficiently attends to harmful text tokens (i.e., the text token "bomb") and generates a refusal. This highlights a key limitation: insufficient attention to harmful visual tokens in multimodal queries. See Section \ref{['sec:stage1']} for a more comprehensive analysis of this issue. We employ LLaVA-1.5-7B for attention weight extraction.
• Figure 2: Overview of RAS. RAS consists of three stages: (i) Query Reformulation, which augments input queries with concise visual contexts and safety prompts to strengthen cross-modal attention to safety-critical image regions; (ii) Risk Evaluation, where MLLM output activations are compared with unsafe prototypes to produce similarity-based risk scores; and (iii) Risk-adaptive Activation Steering, where activations are steered toward refusal behavior according to the risk score.
• Figure 3: Attention maps for unsafe (top) and safe (bottom) objects under various query formulations. SP. denotes safety prompt. VC. denotes visual context. (a) Example of unsafe vs. safe instructions under the same text query. (b–e) Cross-modal attention maps from text to visual tokens. (b) With only the original query, attention weights to the objects are small, indicating weak visual grounding. (c) Safety prompts fail to enhance attention to the objects, whereas (d–e) visual contexts significantly improves it. We employ LLaVA-1.5-7B for attention weight extraction.
• Figure 4: FDR values across layers for various query formulations. SP. denotes safety prompt. VC. denotes visual context. Lower FDR indicates less separable representations. We employ LLaVA-1.5-7B to compute FDR.
• Figure 5: Similarity score ($S_i$) distributions of (a) safe (b) unsafe objects under various query formulations. SP. denotes safety prompt. VC. denotes visual context. Higher similarity scores indicate output distributions similar to refusals. We employ LLaVA-1.5-7B to extract $S_i$ scores.