GuardAlign: Test-time Safety Alignment in Multimodal Large Language Models

🕒 Published (v1): 2026-01-01 · Source: ICLR · Venue: ICLR 2026 · link

Why this paper was selected

Test-time safety alignment for LVLMs; input detection plus output steering

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

GuardAlign is a training-free defense framework for large vision-language models (LVLMs) that combines optimal-transport-based unsafe patch detection with cross-modal attention calibration to suppress harmful outputs at test time. It addresses two failure modes of prior input-side defenses: imprecise CLIP-based detection on complex images and attention decay of safety prefixes during autoregressive generation. On SPA-VL, GuardAlign reduces Unsafe Response Rate (USR) by up to 39% relative to the strongest prior inference-time baseline while preserving or improving general multimodal utility.

Problem

Existing input-side LVLM defenses use a two-step paradigm: (1) CLIP similarity to flag unsafe images, then (2) prepend a safety prefix to the prompt. Two failure modes persist. First, CLIP global-image embeddings produce overlapping similarity score distributions for safe and unsafe inputs in complex real-world scenes (SPA-VL), allowing unsafe content to slip through. Second, attention weights assigned to safety-prefix tokens decay monotonically with layer depth during cross-modal fusion, so the model may begin with a refusal but then override it after transitional phrases like "However," generating harmful content.

Method

GuardAlign operates entirely at inference time with no parameter updates and combines two components:

OT-Enhanced Safety Detection. The input image is divided into \(M\) patches; each patch \(x^m\) and each of \(C\) unsafe-category text prompts (expanded to \(N\) variants) are encoded with CLIP. Patch importance weights \(a_m\) are set by entropy over category predictions (low-entropy → high confidence → high weight). The OT distance between the patch distribution \(P(x)\) and each unsafe-prompt distribution \(Q_i(z)\) is computed via the Sinkhorn algorithm with entropic regularization: $\(d_{\mathrm{OT}}(P, Q_i; C_i) = \min_{T_i \geq 0}\langle T_i, C_i\rangle - \epsilon h(T_i), \quad C_i(m,n)=1-\cos(x^m, z_i^n).\)$ An aggregated per-patch OT score \(d_{\mathrm{OT}}(m) = \sum_{i,n} T_i(m,n)C_i(m,n)\) identifies unsafe patches via threshold \(\tau=0.42\); those patches are zeroed out to produce a sanitized image \(\hat{x}\).

Cross-Modal Attentive Calibration. In the middle transformer layers (where visual–textual fusion is strongest), the pre-softmax attention scores are amplified for query–key pairs from instruction tokens \(T\) to safety-prefix tokens \(R\): $\(\hat{Z}_{l,h} = Z_{l,h} + \gamma M^{\mathrm{pref}}_{l,h} \circ Z_{l,h}, \quad M^{\mathrm{pref}}_{l,h}(i,j) = \mathbb{I}[i\in T, j\in R]\cdot\max(0, \langle Q_{l,h}(i,:), K_{l,h}(j,:)\rangle).\)$ This prevents the safety signal from decaying and blocks the refusal-override pattern.

Key Contributions

• Training-free, plug-in defense that requires no fine-tuning or auxiliary models beyond CLIP.
• OT-based patch-level unsafe detection with entropy-weighted importance, provably achieving lower or equal classification error than cosine-similarity baselines (\(P^{\mathrm{OT}}_{\mathrm{error}} \leq P^{\mathrm{cos}}_{\mathrm{error}}\)).
• Cross-modal attention calibration that pins safety-prefix influence throughout decoding by targeted amplification in middle layers only.
• Theoretical proof that OT yields higher standardized separation (\(d'_{\mathrm{OT}} \geq d'_{\mathrm{cos}}\)) between safe and unsafe patch distributions.
• Comprehensive evaluation across 7 LVLMs and 5 safety + 5 helpfulness benchmarks.

Results

• SPA-VL Harm (USR↓): GuardAlign achieves 10.31% vs. ETA's 16.98% and ECSO's 23.40% on LLaVA-1.5-7B; 8.26% on InternLM-XComposer-2.5-7B (vs. 13.96% ETA).
• MM-SafetyBench SD+TYPO (USR↓): 9.65% vs. 15.83% (ETA) on LLaVA-1.5-7B.
• FigStep Vanilla (USR↓): 3.40% vs. 7.80% (ETA) on LLaVA-1.5-7B.
• Adversarial Unconstrained Attack (USR↓): 15.00% vs. 22.50% (ETA) on LLaVA-1.5-7B.
• Llama3.2-11B-Vision-Instruct: USR reduced from 7.17% (vanilla) to 1.25%, a ~76% relative reduction.
• VQAv2 utility: 78.51% → 79.21% on LLaVA-1.5-7B (GuardAlign improves over vanilla); 79.99% → 80.25% on LLaVA-1.5-13B.
• Efficiency: GuardAlign takes ~42 min on SPA-VL vs. ETA's ~2h 30min, with strictly better USR.
• Ablation (LLaVA-1.5-7B, SPA-VL): OT detection alone reduces USR 46.04→32.12; both modules combined reach 10.31 with helpfulness score 8.63 vs. 7.64 baseline.

Limitations

• Relies on CLIP encoders; stronger encoders (ViT-L/14, SigLIP) yield better results, implying performance is CLIP-backbone-dependent.
• The masking threshold \(\tau\) requires per-dataset tuning and introduces a safety–utility tradeoff.
• Pure text adversarial inputs (AdvBench) are handled only by the prefix calibration component, as OT detection is vision-only.
• Evaluation confined to 7-13B parameter open-source LVLMs; behavior on proprietary or much larger models is untested.
• No formal guarantee that attention calibration prevents all refusal-override patterns; it is an additive heuristic on attention logits.

Relevance to Vision-Language Models

GuardAlign directly targets the fundamental tension in multimodal safety: visual token embeddings exist in a continuous space that bypasses discrete-text safety mechanisms trained into LLM backbones, making VLMs structurally more vulnerable than their text-only counterparts. The OT formulation addresses a core alignment problem—measuring fine-grained semantic similarity between image regions and text concepts—which is closely related to broader challenges in visual grounding and cross-modal representation alignment. The attention calibration component reveals an important dynamic in LVLM decoding: safety signals injected via prompt engineering degrade through cross-modal fusion layers, a finding that has implications for any prefix-based steering of VLMs (not just safety). This work sits at the intersection of multimodal robustness, interpretability of cross-modal attention, and efficient inference-time alignment, all active areas for researchers tracking VLM capabilities and limitations.