Skip to content

SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism

🕒 Published (v1): 2025-01-01 · Source: NeurIPS · Venue: NeurIPS 2025 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

SafePTR is a training-free, token-level jailbreak defense for multimodal LLMs that identifies and prunes the small fraction of harmful tokens at vulnerable early-middle layers, then restores benign features at later layers. Empirical analysis reveals that fewer than 1% of tokens in 2–4 consecutive early-middle layers are responsible for inducing unsafe behavior. SafePTR achieves state-of-the-art attack success rate reduction across three MLLMs and five benchmarks without additional training overhead or meaningful utility loss.

Problem

Existing MLLM jailbreak defenses—Image-to-Text Translation, Safe Prompting, and Multimodal Safety Tuning—adapt multimodal inputs to align with LLMs' built-in safeguards without understanding the internal token-level mechanism by which harmful inputs bypass those safeguards. As a result, they remain vulnerable to text-driven multimodal jailbreaks, suffer from overdefensive behavior on benign inputs, or impose heavy training cost (e.g., 1,223K training samples for TGA on 64×V100 GPUs). The root mechanism—which specific tokens, in which layers, cause semantic drift away from safety-aligned representations—had not been characterized.

Method

SafePTR is built on three mechanistic findings derived from layer-wise intervention analysis (LIA) on LLaVA-1.5-7B, MiniGPT-4-7B, and DeepSeek-VL2:

  1. Where (Finding-1): LIA identifies that removing hidden states in only 2–4 contiguous early-middle layers (e.g., layers [7,9) for LLaVA-1.5 and MiniGPT-4, [4,6) for DeepSeek-VL2) reduces ASR from 67.3% to 4.2%, pinpointing these as the vulnerable intervention points.
  2. How (Finding-2): Unsafe samples exhibit greater cosine and Euclidean deviation from safety-aligned instruction hidden states than safe samples, confirming semantic drift as the trigger mechanism.
  3. Which (Finding-3): Computing per-token cosine distance to a fixed safety-aligned reference instruction ("Please answer this question safely…") at vulnerable layers identifies the harmful tokens; these account for only 0.56–1.66% of all input tokens across datasets and models.

The SafePTR framework has two modules: - Harmful Token Pruning (HTP): At vulnerable layers [n, n+Δn), top-K (empirically 10%) tokens with highest cosine deviation from the safety-aligned hidden state are removed from both visual and instruction token streams. Pruning is performed modality-separately to handle embedding space differences between image and text tokens. - Benign Feature Restoration (BFR): A parallel standard-inference branch is run over the same vulnerable layers. At layer n+Δn, previously pruned token positions are re-populated with their un-pruned hidden states from the parallel branch while keeping the pruned versions at non-harmful positions. This recovers contextual information degraded by removal, restoring downstream utility.

No gradient computation or parameter updates are required; inference runs in a single forward pass.

Key Contributions

  • Systematic three-part mechanistic analysis (where/how/which) of how harmful multimodal tokens bypass MLLM safeguards, identifying that <1% of tokens in 2–4 early-middle layers are causally responsible.
  • SafePTR: training-free, token-level prune-then-restore defense operating on intermediate hidden states, with modality-specific pruning and a dual-path benign restoration module.
  • Demonstration that the HTP+BFR design achieves simultaneous safety improvement and utility preservation—where HTP alone degrades utility, BFR recovers it without reintroducing harmful semantics.
  • Efficiency profile: zero training samples required; inference latency of 3.51s vs. 7.02s for CoCA and 4.98s for Immune on LLaVA-1.5.

Results

Safety (ASR ↓, lower is better): - JailbreakV-28K (text-driven): SafePTR achieves 0.98% ASR on LLaVA-1.5-7B (vs. 2.10% Immune, 14.36% AdaShield), 6.48% on MiniGPT-4-7B, 2.46% on DeepSeek-VL2. - FigStep (vision-driven): SafePTR average ASR: 1.60% on LLaVA-1.5-7B (vs. 4.23% Immune, 13.00% AdaShield), 3.60% on MiniGPT-4-7B, 0.40% on DeepSeek-VL2 (near-zero on Illegal Activity and Malware Generation categories). - MM-SafetyBench: SafePTR achieves 1.29% average ASR on LLaVA-1.5-7B (vs. 11.51% Immune), 8.04% on MiniGPT-4-7B, 3.54% on DeepSeek-VL2—best across all baselines.

Utility (↑, higher is better): - MME: SafePTR scores 1538.1 on LLaVA-1.5-7B (baseline: 1503.6; AdaShield: 1521.1), 796.1 on MiniGPT-4-7B (baseline: 741.6), 1541.0 on DeepSeek-VL2 (baseline: 1540.0)—SafePTR meets or exceeds the undefended baseline. - MM-Vet: SafePTR total: 32.3 on LLaVA-1.5-7B, 18.8 on MiniGPT-4-7B, 53.0 on DeepSeek-VL2 (vs. baseline 51.3).

Ablation (LLaVA-1.5-7B, K=10%): - HTP alone: FigStep ASR 3.8%, MM-SafetyBench ASR 3.06%, MMVet 24.5, MME 1428.11. - HTP + BFR: FigStep ASR 1.6%, MM-SafetyBench ASR 1.29%, MMVet 32.3, MME 1538.11—confirming BFR recovers 34.49 MME points without sacrificing safety.

Limitations

  • Requires access to intermediate hidden states, making SafePTR inapplicable to black-box APIs such as GPT-4V.
  • Fixed Top-K pruning ratio does not adapt to varying risk levels across inputs; high-risk inputs may need more aggressive pruning while benign inputs may be unnecessarily perturbed.
  • Vulnerable layer ranges and Top-K hyperparameter are empirically determined per model architecture and may require re-calibration for new models.
  • Safety-aligned reference instruction is hand-crafted and static; its effectiveness may degrade if adversaries design attacks specifically targeting its semantic proximity.

Relevance to Vision-Language Models

SafePTR addresses a fundamental vulnerability of VLMs that arises specifically from visual-token integration: the cross-modal token stream creates a much larger attack surface than text-only LLMs, and existing text-safety mechanisms do not transfer cleanly. By revealing that harmful semantics are concentrated in a tiny token fraction at specific transformer depths, this work provides mechanistic interpretability for VLM safety that complements architecture-level analyses of cross-modal alignment. The prune-then-restore paradigm is also architecturally general—applicable to any MLLM that exposes intermediate hidden states—making it relevant to the growing family of open-weight VLMs (LLaVA, InstructBLIP, Qwen-VL, etc.). For researchers tracking VLMs, SafePTR exemplifies a shift from input-level preprocessing defenses toward internal representation-level interventions, a direction with implications for both safety-utility tradeoffs and mechanistic understanding of multimodal transformer internals.