Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Principled Steering via Null-space Projection for Jailbreak Defense in Vision-Language Models

Xingyu Zhu, Beier Zhu, Shuo Wang, Junfeng Fang, Kesen Zhao, Hanwang Zhang, Xiangnan He

Abstract

As vision-language models (VLMs) are increasingly deployed in open-world scenarios, they can be easily induced by visual jailbreak attacks to generate harmful content, posing serious risks to model safety and trustworthy usage. Recent activation steering methods inject directional vectors into model activations during inference to induce refusal behaviors and have demonstrated effectiveness. However, a steering vector may both enhance refusal ability and cause over-refusal, thereby degrading model performance on benign inputs. Moreover, due to the lack of theoretical interpretability, these methods still suffer from limited robustness and effectiveness. To better balance safety and utility, we propose NullSteer, a null-space projected activation defense framework. Our method constructs refusal directions within model activations through a linear transformation: it maintains zero perturbation within the benign subspace while dynamically inducing refusal along potentially harmful directions, thereby theoretically achieving safety enhancement without impairing the model's general capabilities. Extensive experiments show that NullSteer significantly reduces harmful outputs under various jailbreak attacks (average ASR reduction over 15 percent on MiniGPT-4) while maintaining comparable performance to the original model on general benchmarks.

Principled Steering via Null-space Projection for Jailbreak Defense in Vision-Language Models

Abstract

As vision-language models (VLMs) are increasingly deployed in open-world scenarios, they can be easily induced by visual jailbreak attacks to generate harmful content, posing serious risks to model safety and trustworthy usage. Recent activation steering methods inject directional vectors into model activations during inference to induce refusal behaviors and have demonstrated effectiveness. However, a steering vector may both enhance refusal ability and cause over-refusal, thereby degrading model performance on benign inputs. Moreover, due to the lack of theoretical interpretability, these methods still suffer from limited robustness and effectiveness. To better balance safety and utility, we propose NullSteer, a null-space projected activation defense framework. Our method constructs refusal directions within model activations through a linear transformation: it maintains zero perturbation within the benign subspace while dynamically inducing refusal along potentially harmful directions, thereby theoretically achieving safety enhancement without impairing the model's general capabilities. Extensive experiments show that NullSteer significantly reduces harmful outputs under various jailbreak attacks (average ASR reduction over 15 percent on MiniGPT-4) while maintaining comparable performance to the original model on general benchmarks.
Paper Structure (16 sections, 32 equations, 9 figures, 5 tables)

This paper contains 16 sections, 32 equations, 9 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Methodology
  4. Preliminaries
  5. Null-space projection
  6. Activation steering via null-space projection
  7. Experiments
  8. Setup
  9. Main results
  10. Ablation study
  11. Conclusion
  12. Derivation of Eq. \ref{['eq:cov_mat']} and Eq. \ref{['eq:solution']}
  13. Eq. \ref{['eq:cov_mat']}: Null-space equivalence
  14. Closed-form Solution of Eq. \ref{['eq:solution']}
  15. Implementation Details
  16. ...and 1 more sections

Figures (9)

  • Figure 1: Illustration of activation steering. Injecting a refusal vector into hidden states steers the model toward rejection behaviors, which mitigates harmful responses but can also lead to over-refusal on benign queries.
  • Figure 2: Overview of the proposed NullSteer framework. Given multimodal inputs, image and text embeddings are encoded and fed into the large language model. During inference, NullSteer applies activation steering within the null space of benign representations, ensuring that harmful activations are redirected toward refusal semantics while preserving benign behaviors.
  • Figure 3: Transferability performance under ID conditions.
  • Figure 4: Adaptive attack performance on MiniGPT-4.
  • Figure 5: Utility with varying numbers of benign activations $N_b$. Evaluation is conducted on MM-VET and MMBench with MiniGPT-4 and LLaVA-v1.5 under theunconstrained.
  • ...and 4 more figures