Robust Multimodal Safety via Conditional Decoding¶

🕒 Published (v1): 2026-03-31 23:19 UTC · Source: Arxiv · Venue: ACL 2026 · link

Why this paper was selected

ACL 2026; conditional decoding restores safety alignment in multimodal LLMs

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

CASA (Classification Augmented with Safety Attention) is a conditional decoding framework that forces a multimodal LLM to predict a binary safety token from its own hidden states before generating any response, conditioning the full output on that safety decision. This eliminates competition between safety and utility objectives in standard supervised safety fine-tuning (SSFT) and requires no external classifiers or modality-specific fine-tuning. On visual and audio jailbreak benchmarks, CASA reduces average attack success rate by over 97% while preserving or improving benign utility.

Problem¶

Supervised Safety Fine-Tuning (SSFT) creates a zero-sum tension between safety and utility objectives (Eq. 1), causing overblocking on benign queries. When LLMs are extended to additional modalities (vision, audio), cross-modal interactions degrade prior text-based alignment, and each new modality requires expensive, modality-specific safety datasets and hyperparameter tuning. Prefix/prefill jailbreak attacks trivially bypass SSFT because safety effects concentrate in the first few generated tokens.

Method¶

CASA augments the standard autoregressive generation objective by prepending a binary safety token $C \in \{c_\text{safe}, c_\text{unsafe}\}$ to every response during fine-tuning. The generation distribution becomes:

\[P(y) = P(y_0 = C \mid x;\theta) \prod_{i=1}^{t_y} P(y_i \mid y_{<i};\theta)\]

replacing the competing SSFT objective (Eq. 1) with a cooperative two-stage objective (Eq. 2) that conditions response generation on the predicted safety state. At inference, vocabulary logits at timestep $t_\text{safety}$ are masked to only the two safety tokens, eliminating any stochastic bypass.

A Safety Attention Module amplifies malicious signals. Given prompt hidden states $h_p$ and embeddings $E_s^q$ derived from passing a fixed "UNSAFE: There is a malicious query…" template through the frozen pretrained model:

\[K = \text{sg}(h_p)W_k,\quad Q = E_s^q W_q,\quad V = \text{sg}(h_p)W_v$$ $$v_s = \text{Aggregate}(\text{Attention}(K,Q,V))\]

The scalar $v_s$ scales the unsafe/safe logits via $g(v_s) = v_s$ for $l_\text{un}$ and $1 - v_s$ for $l_s$. Stop-gradient on $h_p$ decouples attention-module gradients from LLM gradients, letting each component specialize. Training uses LoRA/PEFT on Qwen 2.5 Omni (3B, 7B) with ~16k paired examples (6.2k harmful + 10k benign).

Key Contributions¶

Conditional decoding for safety: binary safety token prediction from internal hidden states before any response token, with masked logits to prevent bypass.
Safety Attention Module: cross-attention between prompt states and a fixed "UNSAFE" embedding to amplify malicious signals and scale safety logits.
Unified multimodal safety without modality-specific tuning: a single fine-tuning procedure covers text, vision, and audio attacks.
No external components: no separate classifier head, no external safety model, fully internal to the base MLLM.

Results¶

JailbreakV-28k (JBV-28k): CASA 3B achieves 0.0% ASR with safety prompt vs. 36.8% pretrained, 23.6% SSFT, 7.9% CB; CASA 7B achieves 0.7% vs. 37.9% pretrained.
MM-SafetyBench (MM-SB): CASA 3B achieves 1.2% ASR with safety prompt vs. 37.7% pretrained, 25.8% SSFT, 14.9% CB.
Audio (AIAH Spell): CASA 3B achieves 0.6% ASR with safety prompt vs. 81.3% pretrained, 67.6% SSFT, 58.0% CB — the largest absolute improvement.
Prefill attacks: CASA 3B achieves 0.0% ASR at all prefill lengths (2, 4, 9, 12 tokens) vs. SSFT peaking at 66.5% and CB at 50.6%.
MME utility (3B): CASA scores 1621.23 perception / 530.71 cognition vs. SSFT 1435.3 / 468.98 and pretrained 1097.02 / 381.07 — CASA outperforms all baselines on benign utility.
LLMaJ utility-text: CASA is preferred or equal to pretrained on 3/5 dimensions; human annotators (13 trained linguists) confirm equal or higher preference for CASA over pretrained on all 5 dimensions.
Overall: >97% average ASR reduction across modalities; 100% mitigation on prefill attacks.

Limitations¶

Evaluated exclusively on Qwen 2.5 Omni (3B/7B); generalization to other MLLM families (LLaVA, Gemini, GPT-4o-style architectures) is untested.
Training data is limited to ~16k examples, predominantly English; coverage of multilingual or non-English jailbreaks is unclear.
The fixed "UNSAFE" embedding used for safety attention is hand-crafted in English; its robustness to semantically equivalent but differently phrased malicious queries is not fully analyzed.
Audio evaluation covers only spelling-decomposition attacks (AIAH Spell); broader adversarial audio attack types are deferred to appendices.
The approach requires LoRA fine-tuning; it cannot be applied to black-box APIs or models where weights are inaccessible.

Relevance to Vision-Language Models¶

CASA directly addresses a core failure mode of VLMs: cross-modal jailbreaks that exploit the misalignment between a text-aligned LLM backbone and a vision (or audio) encoder. The finding that PCA on last-layer embeddings already separates safe from unsafe inputs — yet the model still gets jailbroken — motivates the shift from generation-time refusal to a pre-generation classification step, a paradigm shift relevant to any VLM safety stack. The unified treatment of vision and audio under one fine-tuning procedure (without modality-specific data) is practically significant as VLMs expand to more modalities. The strong utility results on MME (outperforming pretrained and SSFT baselines) challenge the prevailing assumption that safety fine-tuning necessarily degrades multimodal perception/cognition capabilities.