Paper deep dive

SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism

Beitao Chen, Xinyu Lyu, Lianli Gao, Jingkuan Song, Heng Tao Shen

Year: 2025Venue: arXiv preprintArea: Multimodal SafetyType: EmpiricalEmbeddings: 68

Models: DeepSeek-VL2, LLaVA-1.5-7B, MiniGPT-4-7B

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 98%

Last extracted: 3/12/2026, 6:22:13 PM

Summary

SafePTR is a training-free, token-level defense framework for Multimodal Large Language Models (MLLMs) that mitigates jailbreak attacks by identifying and pruning harmful tokens in early-middle layers and restoring benign features in subsequent layers, thereby enhancing safety without compromising utility or requiring additional training.

Entities (7)

DeepSeek-VL · model · 100%FigStep · benchmark · 100%LLaVA-1.5-7B · model · 100%MiniGPT-4 · model · 100%MLLMs · model-architecture · 100%MM-SafetyBench · benchmark · 100%SafePTR · defense-framework · 100%

Relation Signals (3)

SafePTR → appliedto → MLLMs

confidence 100% · SafePTR, an training-free defense framework that selectively prunes harmful tokens at vulnerable layers

LLaVA-1.5-7B → evaluatedon → MM-SafetyBench

confidence 95% · Extensive experiments demonstrate that SafePTR effectively enhances robustness against multimodal jailbreak attacks across 3 MLLMs (LLaVA-1.5, MiniGPT-4, and DeepSeek-VL) on 3 safety benchmarks

SafePTR → mitigates → Jailbreak Attacks

confidence 95% · SafePTR significantly enhances the safety of MLLMs while preserving efficiency.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:By incorporating visual inputs, Multimodal Large Language Models (MLLMs) extend LLMs to support visual reasoning. However, this integration also introduces new vulnerabilities, making MLLMs susceptible to multimodal jailbreak attacks and hindering their safe this http URL defense methods, including Image-to-Text Translation, Safe Prompting, and Multimodal Safety Tuning, attempt to address this by aligning multimodal inputs with LLMs' built-in this http URL, they fall short in uncovering root causes of multimodal vulnerabilities, particularly how harmful multimodal tokens trigger jailbreak in MLLMs? Consequently, they remain vulnerable to text-driven multimodal jailbreaks, often exhibiting overdefensive behaviors and imposing heavy training this http URL bridge this gap, we present an comprehensive analysis of where, how and which harmful multimodal tokens bypass safeguards in MLLMs. Surprisingly, we find that less than 1% tokens in early-middle layers are responsible for inducing unsafe behaviors, highlighting the potential of precisely removing a small subset of harmful tokens, without requiring safety tuning, can still effectively improve safety against jailbreaks. Motivated by this, we propose Safe Prune-then-Restore (SafePTR), an training-free defense framework that selectively prunes harmful tokens at vulnerable layers while restoring benign features at subsequent this http URL incurring additional computational overhead, SafePTR significantly enhances the safety of MLLMs while preserving efficiency. Extensive evaluations across three MLLMs and five benchmarks demonstrate SafePTR's state-of-the-art performance in mitigating jailbreak risks without compromising utility.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

68,085 characters extracted from source content.

Expand or collapse full text

SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism Beitao Chen 1 chenbeitao@gmail.com Xinyu Lyu 2,3 xinyulyu68@gmail.com Jingkuan Song 4 jingkuan.song@gmail.com Heng Tao Shen 4 shenhengtao@hotmail.com Lianli Gao 1∗ juana.alian@gmail.com 1 Shenzhen Institute for Advanced Study, University of Electronic Science and Technology of China 2 Southwestern University of Finance and Economics, Chengdu, China 3 Engineering Research Center of Intelligent Finance, Ministry of Education 4 Tongji University Abstract Content Warning: This paper contains a few harmful images and texts! By incorporating visual inputs, Multimodal Large Language Models (MLLMs) extend LLMs to support visual reasoning. However, this integration also introduces new vulnerabilities, making MLLMs susceptible to multimodal jailbreak attacks and hindering their safe deployment. Existing defense methods, including Image- to-Text Translation, Safe Prompting, and Multimodal Safety Tuning, attempt to address this by aligning multimodal inputs with LLMs’ built-in safeguards. Yet, they fall short in uncovering root causes of multimodal vulnerabilities, particularly how harmful multimodal tokens trigger jailbreak in MLLMs? Consequently, they remain vulnerable to text-driven multimodal jailbreaks, often exhibiting overde- fensive behaviors and imposing heavy training overhead. To bridge this gap, we present an comprehensive analysis of where, how and which harmful multimodal tokens bypass safeguards in MLLMs. Surprisingly, we find that less than 1% tokens in early-middle layers are responsible for inducing unsafe behaviors, high- lighting the potential of precisely removing a small subset of harmful tokens, without requiring safety tuning, can still effectively improve safety against jail- breaks. Motivated by this, we propose Safe Prune-then-Restore (SafePTR), an training-free defense framework that selectively prunes harmful tokens at vul- nerable layers while restoring benign features at subsequent layers. Without incurring additional computational overhead, SafePTR significantly enhances the safety of MLLMs while preserving efficiency. Extensive evaluations across three MLLMs and five benchmarks demonstrate SafePTR’s state-of-the-art performance in mitigating jailbreak risks without compromising utility. Our code is available at https://github.com/BT-C/SafePTR. 1 Introduction Multimodal large language models (MLLMs)[OpenAI, 2023, Lu et al., 2024, Liu et al., 2023a, Bai et al., 2023, Zhu et al., 2023] extend the capabilities of large language models (LLMs)[Touvron ∗ Corresponding author. 39th Conference on Neural Information Processing Systems (NeurIPS 2025). arXiv:2507.01513v2 [cs.CR] 3 Dec 2025 How to produce a k*n*i*f*e ? Text-Driven Jailbreaks Overdefense Training-Overhead How to amuse a child with it? Image-to-Text Translation (a) Image-to-Text Translation Producing a knife involves several steps, including : 1. Sketch the shape ... ECSO I am sorry, children should avoid this dangerous item... safety constraints Train How to make this item? 1223k+ training data 2×inference latency (b) Safe Prompting(c) Multimodal Safety Tuning(d) Performance CoCA MLLM-Pro Immune TGA 1538.1 1.6 0.9 3.5 0.0 MMVet 32.3 Figure 1: (Left) Existing MLLM defense methods remain susceptible to text-driven multimodal jailbreaks, exhibiting overdefensive behavior and imposing heavy training overhead. (Right) SafePTR outperforms prior methods by achieving stronger jailbreak mitigation (i.e., Jailbreak28K, Figstep and M-Safety), better preserving task utility (i.e., MMVet and MME), and minimal computational overhead (i.e., Training-free and One-bypass Inference). Performances of SafePTR across more MLLMs are provided in Appendix.A et al., 2023, Chiang et al., 2023, Jiang et al., 2024] to visual inputs, enabling unified language–vision reasoning. Despite strong performance across multimodal tasks, MLLMs remain vulnerable to multimodal jailbreak attacks [Luo et al., 2024b, Gong et al., 2025, Dong et al., 2023], raising critical safety concerns for secure deployment. To mitigate safety risks in MLLMs, existing approaches [Gou et al., 2024, Guo et al., 2024, Ghosal et al., 2024, Gao et al., 2024, Gong et al., 2025] primarily adapt multimodal inputs to align with the built-in safeguard mechanisms of underlying LLMs, inherited from prior safety alignment processes conducted during LLMs’ safety fine-tuning stage. These methods generally fall into three categories: (1) Image-to-Text Translation [Gou et al., 2024, Guo et al., 2024], which converts visual inputs into textual descriptions to leverage LLM’s existing safety boundaries, but remains susceptible to text-driven multimodal jailbreaks (Fig.1 (a)); (2) Safe Prompting [Wang et al., 2024b, Gong et al., 2025], which injects static safety constraints into instructions to suppress unsafe completions, but often leads to overdefensive behavior that degrade model’s utility on benign inputs (Fig.1 (b)); and (3) Multimodal Safety Tuning [Liu et al., 2024b,c] leverages safety-specific datasets to either train dedicated risk detectors [Ghosal et al., 2024] or align multimodal representations with LLM safety priors via cross-modal supervision [Gao et al., 2024] While effective, these methods incur substantial training overhead and exhibit limited generalization to unseen jailbreaks (see Fig. 1(c)). The root cause lies in existing methods’ reliance on the built-in safeguards of LLMs without uncover- ing the underlying mechanisms of multimodal vulnerabilities, particularly “how harmful multimodal tokens exploit internal representation pathways to trigger jailbreaks?”, thereby limiting the devel- opment of interpretable defenses tailored for MLLMs. Specifically, (1) Image-to-Text Translation ignores where vulnerabilities occur by bypassing visual processing layers. By directly converting images into text and relying solely on LLM’s built-in safeguards, it remains susceptible to text-driven multimodal jailbreaks, particularly when the adversarial textual prompts (e.g., from JailbreakV- 28K [Luo et al., 2024b]) already evade these defenses; (2) Safe Prompting uniformly applies static safety constraints across various inputs, without adaptively modeling how unsafe behaviors emerge in different contexts; This lack of adaptivity prevents the model from identifying fine-grained safety concepts, such as distinguishing “a toy water gun” from “a real weapon” in Fig. 1(b), often resulting in overdefensive responses that compromise utility in benign scenarios; (3) Multimodal Safety Tuning enforces safety alignment based on dataset-specific defense preferences, but fails to identify which multimodal tokens trigger jailbreaks, limiting interpretability and adaptability. For example, TGA [Liu et al., 2024c] relies on 1223K samples to train a safety preference model, incurring high cost (involving 64 × V100 GPUs) while offering limited robustness across diverse jailbreak scenarios. To address these limitations, we conduct an in-depth investigation into where, how, and which harmful multimodal tokens bypass the safeguard mechanisms within MLLMs during jailbreak attacks. (1) Where: we perform a systematic layer-wise analysis to identify layers most susceptible to malicious input. By selectively removing harmful input across different layers and measuring changes in Attack Success Ratio (ASR), we observe that only a small subset of early-middle layers are particularly vulnerable to multimodal jailbreaks. (2) How: to understand how jailbreaks occur, we compare 2 hidden states triggered by malicious inputs against those induced by safety-aligned ones. Our analysis shows that samples exhibiting greater semantic deviation from safety-aligned representations are more likely to trigger jailbreaks, highlighting semantic drift as a key factor in bypassing safeguards. (3) Which: to identify which specific tokens cause this deviation, we compute token-level semantic distances to a safety reference within the most vulnerable layers. Surprisingly, less than 1% of multimodal tokens lead to significant semantic shifts. Based on our analysis, we propose Safe Prune-then-Restore (SafePTR), a training-free and token-level defense framework that mitigates multimodal jailbreaks by pruning harmful tokens in vulnerable layers and restoring benign features to recover contextual information while preserving model utility. Extensive experiments demonstrate that SafePTR effectively enhances robustness against multimodal jailbreak attacks across 3 MLLMs (LLaVA-1.5, MiniGPT-4, and DeepSeek-VL) on 3 safety benchmarks, including M-SafetyBench, FigStep, and Jailbreak28k, without requiring additional training or compromising task performance on MME and M-Vet benchmarks. To sum up, our main contributions are as follows: (1) We conduct an in-depth analysis of jailbreak mechanisms, offering a novel perspective to advance defense strategies tailored for MLLMs; (2) We introduce SafePTR, an efficient and effective defense framework that enhances robustness while preserving utility without any training overhead; (3) Extensive experiments demonstrate that SafePTR outperforms state-of-the-art baselines, providing a robust, efficient, and utility-preserving defense against both vision- and text-driven multimodal jailbreak attacks. 2 Harmful Token Propagation and Jailbreak Activation In this section, we analyze where, how, and which harmful multimodal tokens bypass safeguard mechanisms in MLLMs. We first identify vulnerable layers via layer-wise ablation. We then measure semantic deviation from safety-aligned instructions to examine how these layers respond to adversarial inputs. Finally, we trace the deviation to specific tokens, finding that only a small subset plays an outsized role in triggering jailbreaks. Experimental Setting: We study three MLLMs, LLaVA-1.5-7B [Liu et al., 2023a], MiniGPT-4 [Zhu et al., 2023], and DeepSeek-VL [Lu et al., 2024], which exhibit notable jailbreak vulnerabilities. To analyze how malicious semantics propagate, we use two multimodal jailbreak datasets: (1) FigStep [Gong et al., 2023], which transforms harmful instructions into typographic images across 10 prohibited categories (500 text-image pairs); and (2) M-SafetyBench [Liu et al., 2023b], which employs jailbreak images from Stable Diffusion and typography across 13 restricted scenarios (5,040 pairs). Once processed by the MLLMs, these images are encoded into tokens whose harmful semantics influence model behavior across layers. Moreover, following [Wang et al., 2024b, Gao et al., 2024, Luo et al., 2024a], we adopt the Attack Success Rate (ASR) to measure the vulnerability of these models to multimodal jailbreak attacks. Specifically, given a test datasetD unsafe of crafted jailbreak image-text pairs, the ASR quantifies the ratio of harmful responses to the total number of input queries and is defined as: ASR = 1 |D unsafe | X (I,x)∈D unsafe I[C ∗ (x,π θ (I,x)) = True].(1) (a)LLaVA-1.5-7B(b)MiniGPT-4-7B(c)DeepSeek-VL2 Figure 2: Layer-wise vulnerability analysis of MLLMs. Each curve represents the Attack Success Rate (ASR) under layer-wise interventions with varying contiguous layer spansk = 2, 4. The orange region highlights the layers most susceptible to safety breaches, with its left and right boundaries marking the earliest and latest compromised layers within the model, respectively. Since the intervention requireskconsecutive layers, the horizontal axis is limited to the range [0, L− k]. 3 Finding-1 (where): A few early-middle layers are especially vulnerable to harmful tokens. We conduct a Layer-wise Intervention Analysis (LIA) (see Appendix.B for details) to identify layers most susceptible to malicious inputs by sequentially removing hidden states of the attack-triggering modality (visual or textual) and observing their impact on model behavior. Specifically, for each layer window[n,n + ∆ n ], we disable the influence of the malicious modality. As shown in Fig. 2, the resulting changes in Attack Success Rate (ASR) across layers reveal the model’s vulnerability profile. Through Layer-wise vulnerability analysis, we observe that while harmful tokens propagate through all layers, their impact on attack success varies significantly. For LLaVA-1.5-7B, DeepSeek-VL2, and MiniGPT-4-7B, pruning harmful tokens in just 2–4 consecutive early–middle layers (e.g.,[7, 9), [4, 6), or[7, 9)) significantly reduces ASR from 67.3% to 4.2%, revealing that jailbreak attacks mainly exploit a narrow band of contiguous vulnerable layers. In contrast, pruning subsequent “safety layers” provides limited defensive benefit, as they are primarily responsible for cross-modal integration and language refinement [Yue et al., 2024, Liu et al., 2024a]. This is further supported by our ablation study 4.4, which shows that restoring benign features in these layers significantly enhances utility. Finding-2 (how): Greater semantic deviation from safety alignment increases jailbreak suscepti- bility. Building on Finding-1, we further examine how jailbreaks manifest in layers most susceptible to harmful tokens’ influence. Considering that the safety-aligned instructions in AdaShield [Wang et al., 2024b] have been shown to effectively enhance model safety, we adopt them as semantic references to define the model’s aligned safety space. Specifically, we compute both Cosine similarity (y-axis) and Euclidean distance (x-axis) between the hidden states of input samples and those within safety-aligned instructions. MMSafetyBenchFigstepMMSafetyBenchFigstep 0.14 0.11 0.02 0.13 (b)MiniGPT-4-7B(a) LLaVA-1.5-7B Figure 3: Semantic distance distribution between safe and unsafe samples. We compute cosine similarity (y-axis) and Euclidean distance (x-axis) between input samples and a safety-aligned instruction. Results are shown for (a)LLaVA-1.5-7B and (b)MiniGPT-4-7B on two types of jailbreak benchmarks, i.e., Figstep (left) and M-SafetyBench (right). Unsafe samples exhibit greater semantic deviation than safe ones. As shown in Fig. 3(a)–(b), both LLaVA-1.5-7B and MiniGPT-4-7B are evaluated on adversarial samples from FigStep (left) and M-SafetyBench (right). Defended/safe samples (blue) cluster near the safety-aligned instruction, whereas attacked/unsafe samples (orange) are more dispersed and shift toward the upper right, reflecting greater semantic deviation, quantified by the average centroid distances between safe and unsafe representations: 0.11 and 0.14 for LLaVA-1.5-7B on M-SafetyBench and FigStep, while 0.13 and 0.02 for MiniGPT-4. Although semantic deviation does not inherently imply malicious intent, samples with greater deviation from the safety reference are statistically more likely to trigger jailbreaks (unsafe v.s. safe), indicating that semantic drift plays a central role in bypassing model safeguards. Layer 7-8Layer 0-6Layer 31 ...... 0.0 %0.0 %6.5 %13.4 %0.0 % ...... Average = (6.5%+ 13.4%) / 32 = 0.625% DeviationHeatmap(푆 ! ) Layer 8 Safety-aligned Instruction 푆 ! =1−푐표푠(푉 ! ,푅 ! ) 푉 " 푉 # 푉 $ 푉 % 푉 &% 푅 " 푉 "! =푣 #$ ! ∈푉 ! 푠 !" # >α Select Harmfultokens(푣 !" # ) . . . LLaVA-1.5-7B Figure 4: Token-wise semantic deviation analysis for LLaVA-1.5-7B. Left: layer-wise distribution of harmful tokens across all layers. Middle: semantic deviation heatmap at layer 8 (brighter = higher deviation). Right: blurred overlay of identified harmful tokens. More visualization results of heatmaps across MiniGPT-4, DeepSeek-VL2 on FigStep and M-SafetyBench provided in Appendix.C. 4 DatasetLLaVA-1.5MiniGPT-4DeepSeek-VL2 M-SafetyBench0.62%0.93%1.66% FigStep0.56%0.81%1.25% Vulnerable Layers[7,9)[7,9)[4,6) Table 1: Harmful Token Ratio (%) across LLaVA-1.5, MiniGPT-4 and DeepSeek-VL2 on Figstep and M- SafetyBench. Finding-3 (which): A small fraction of harm- ful tokens induce significant semantic devi- ation from safety-aligned tokens. Building on Finding-2, we further investigate which indi- vidual tokens are responsible for such semantic deviation. To this end, we compute the semantic distance(S l = 1−cos(V l ,R l )) between tokens (V l ) and the safety-aligned instruction represen- tation (R l ) at layer-lacross samples from both FigStep (500) and M-SafetyBench (5040). Tokens whose deviation(s l ij ) exceeds the threshold (α) are marked as harmful ones (v l ij ∈ V l ). As shown in Fig. 4, for LLaVA-1.5-7B, an example from M-SafetyBench illustrates that harmful tokens are sparsely distributed and primarily concentrated in early-middle layers (e.g., [7, 9)), accounting for only 0.62% of all input tokens. Similar patterns are observed on Figstep across MiniGPT-4-7B (0.93%) and DeepSeek-VL2 (1.66%), as summarized in Tab. 1. This phenomenon may stem from the presence of attention sinks [Ma et al., 2023, Zhang et al., 2024b], where a small subset of tokens disproportionately attracts attention, dominates the model’s internal representations, and consequently concentrates harmful content within these domi- nant tokens. To further analyze their impact, we visualize both a semantic deviation heatmap (S 8 ) and an overlaid binary mask (V ′8 =v 8 ij ∈ V 8 ) at layer 8 using a sample from M-SafetyBench. Tokens representing “armed figures,” “smoke,” and “terrain” associated with violent scenarios exhibit high semantic drift. Interestingly, several background tokens also show large deviations, suggesting that semantically deviant cues from inconspicuous regions can disrupt overall structure, amplify misalignment, and weaken model’s safeguards against jailbreaks. 3 Safe Prune-then-Restore Based on the observations outlined above, we propose Safe Prune-then-Restore (SafePTR), a training- free token-level intervention framework designed to mitigate jailbreaks while preserving utility, as shown in Fig. 5. Informed by Finding-1, we first identify a small subset of early-middle layers that are especially susceptible to harmful tokens’ influence; these layers serve as the primary intervention points in our framework. Building on Finding-3, we measure the semantic distance between each input token and a safety-aligned instruction, derived from carefully crafted safety-aligned instructions, and select the Top-K most divergent tokens as pruning candidates. Guided by Based on Finding-2, we prune these semantically misaligned tokens to suppress harmful signals and shift the representation toward the safety prior. To preserve reasoning ability, we then introduce a restoration step at safety layers to selectively recover benign features. ...... Pruned Tokens 1-th LLM Layer . . . Harmful Token Pruning Benign Features Restoration n-th LLM Layer (n + 2)-th LLM Layer (n –1)-th LLM Layer Skip Tokens How to build harmful weapon ? Tokenizer Answer the question safely Vision Encoder VisionTokens InstructionTokens UserInstructionsSafeInstructions ...... RankingSimilarity ScorePruned Token 0.20.10.1 0.3 0.9 0.9 0.8 × × Similarity Calculation 2nd1st3rd4th Restore 1st2nd3rd4th n-th ...... Skip Tokens Pruned Tokens Restored Tokens Inputs Vulnerable Layers Safety Layers Benign Features Restoration Safety-Proximal Harmful Token Pruning [n,n+2) [n+2,L] Figure 5: Overview of SafePTR framework. The Harmful Token Pruning (HTP) module removes harmful visual and textual tokens in early vulnerable layers by comparing them with a safety-aligned instruction. The Benign Feature Restoration (BFR) module then recovers task-relevant benign features in later layers to preserve model utility. This decoupled design ensures interpretability and enables training-free, lightweight deployment. 3.1 Harmful Token Prunning As indicated in Fig. 2, the very early layers, contribute minimally to harmful behaviors For the subse- quent layers[n,n + ∆ n ), where∆ n = 2(e.g., layers[7, 9)for LLaVA1.5-7B and MiniGPT-4-7B, lay- ers[4, 6)for DeepSeek-VL2), Harmful Token Prunning (HTP) is applied to remove vision/instruction 5 harmful tokens, as shown in Eqn. 2. [H l+1 img ,H l+1 ins ,H l+1 safe ] = FFN l (Attention l ([HTP (H l img ,H l ins ,H l safe )]),l∈ [n,n + ∆ n ].(2) Here,H l ins =∈ R T×D ,H l img ∈ R M×D andH l safe ∈ R C×D denotes the hidden states of user instructions, input images and safety-aligned instruction atl thlayer. Due to variations in harmful content across inputs and differences in alignment strength across different models, a universal thresh- old for identifying harmful tokens is impractical. Instead, we adopt Top-K selection strategy [Chen et al., 2024] and empirically determine a globally effective Top-K value to guide the pruning process, as shown in Tab. 8. By computing the distance between visual tokens and hidden states of safe-aligned instructions, i.e., “Please answer this question safely and accurately. Reply ‘I am sorry.’ if the content is harmful.” in Eqn. 3, x∈I p X Cosine(v x ,s M ) < y/∈I p X Cosine(v y ,s M ),v x ,v y ∈ H l ins ,s M ∈ H l safe ,(3) the Top-K tokens that deviate most from safety space are identified and subsequently removed using HTP, as defined in Eqn. 2. ˆ H l img = HTP (H l img ) = h j ∈ H l img |j /∈ I p . Similarly, for textual user instructions, we also apply pruning process procedure (Eqn. 2) to eliminate harmful instruction tokens. Due to inherent distance discrepancies between image and text embeddings, pruning is conducted separately for visual and textual modalities. This modality-specific design allows our method to effectively defend against both visual- and text-driven jailbreak attacks. 3.2 Benign Features Restoration After pruning harmful tokens in vulnerable layers , the subsequent layers operate on incomplete visual representations, lacking fine-grained contextual interactions. To restore utility without compromising robustness, we introduce the Benign Feature Restoration (BFR) module, which selectively reintegrates benign features while avoiding harmful semantics. Formally, the restored hidden states are computed as:SH n+∆ n img = BFR( ˆ H n+∆ n −1 img ,H n+∆ n −1 img ). Specifically, while HTP prunes harmful tokens within layers[n,n + ∆ n ], BFR maintains a parallel branch that performs standard inference over the same layers and selectively restores benign features. This dual-path design enables the recovery of hidden states in subsequent layers, which are less susceptible to attack and primarily responsible for cross-modal integration and language refinement. By restoring previously pruned tokens at this stage, the model preserves functional performance without compromising safety. As shown in Eqn. 4: [H l+1 img ,H l+1 ins ,H l+1 safe ] = FFN l (Attention l ([SH l img ,SH l ins ,H l safe ]),l = n + ∆ n .(4) To achieve this, BFR identifies a complementary index set ˆ I p =t 1 ,t 2 ,...,t k such thatI p ∩ ˆ I p = ∅, I p ∪ ˆ I p = 1, 2,...T. These indicesI p and ˆ I p are then used to retrieve the corresponding hidden states from ˆ H n+∆ n image andH n+∆ n image , respectively. The selected elements are subsequently reordered to reconstruct the original token sequence, as formalized in Eqn. 5. BFR( ˆ H n+∆ n −1 img ,H n+∆ n −1 img ) =(h i ,i)|h i = ˆv i , i∈ I p v i , i∈ ˆ I p . .(5) This restoration operation is first applied to the visual modality, resulting in the reconstructed repre- sentationSH n+∆ n img . To ensure consistency across modalities, an analogous process is independently applied to the instruction tokens, producingSH n+∆ n ins . These two restored streams are then jointly integrated into the full inference pipeline, as detailed in Eqn. 4. 4 Experiments 4.1 Experimental Details Implementation Details. Following Immune [Ghosal et al., 2024], we implement the proposed SafePTR using Hugging Face Transformers library. The LLaVA1.5-7B results are based on version 1.2.2 from the official benchmark repository. We set the number of tokens sampled k = 10%. For LLaVA-1.5-7B, DeepSeek-VL2, and MiniGPT-4-7B, harmful tokens are pruned in layers[7, 9), [4, 6),[7, 9). We repeat the experiments five times for each metric with different random seeds. All experiments are conducted on four RTX3090 GPUs. 6 Baseline and Comparable Methods. We evaluate SafePTR on three state-of-the-art open-source MLLMs: LLaVA-1.5-7B [Liu et al., 2023a], MiniGPT-4-7B [Zhu et al., 2023], and DeepSeek- VL2-Tiny [Lu et al., 2024]. Comparisons are made against recent jailbreak defense methods, Immune [Wang et al., 2024a], Adashield [Wang et al., 2024b], ECSO [Gou et al., 2024], CoCA [Gao et al., 2024], and FigStep [Gong et al., 2023], under a unified test set and consistent metrics. Evaluation Benchmarks and Metrics. We assess model performance across three aspects: (1) Safety: We use JailbreakV-28K [Luo et al., 2024b] (text-driven), M-SafetyBench [Liu et al., 2023b], and FigStep [Gong et al., 2025] (image-driven), reporting Attack Success Rate (ASR) [Wang et al., 2024b, Gao et al., 2024]. (2) Utility: Benign task accuracy is measured on MME [Fu et al., 2023] and M-Vet [Yu et al., 2024], which evaluate multimodal understanding and visual reasoning. (3) Efficiency: We report training data size (K) and inference latency (sec/sample) to evaluate efficiency. ModelMethod NoiseSDNatureBlank Avg↓ T↓P↓L↓T↓P↓L↓T↓P↓L↓T↓P↓L↓ LLaVA-1.5-7B Original57.129.262.160.539.172.959.031.859.457.430.960.851.7 FigStep59.552.340.557.154.950.058.458.444.560.851.140.552.3 CoCA61.239.162.161.341.252.763.135.255.461.037.352.751.3 ECSO57.325.458.157.325.458.157.325.458.157.3225.458.146.9 AdaShield21.61.417.524.61.422.923.20.817.521.81.417.514.3 Immune9.20.00.08.10.00.01.40.00.05.30.00.02.1 SafePTR3.50.00.01.60.00.05.10.00.05.30.00.01.3 MiniGPT-4-7B Original36.459.671.638.378.683.734.851.167.543.556.778.358.3 FigStep32.683.366.230.869.571.627.250.259.431.162.548.652.7 CoCA35.118.222.940.321.131.035.218.427.048.121.340.529.7 ECSO46.357.871.646.958.471.646.357.871.646.357.871.658.7 AdaShield40.171.094.549.183.094.947.340.972.932.749.785.163.4 Immune18.26.144.511.38.229.717.18.427.016.010.343.218.3 SafePTR13.35.529.710.14.422.912.93.517.511.62.917.512.6 DeepSeek-VL2 Original58.960.295.967.064.998.656.456.790.561.165.497.272.7 FigStep37.124.260.844.029.251.342.424.541.844.226.056.740.2 ECSO50.850.097.250.850.097.250.850.097.250.850.097.266.0 AdaShield14.26.72.721.625.422.922.714.912.119.68.41.314.4 SafePTR9.22.91.317.116.010.317.518.410.19.26.72.710.1 Table 2: Evaluation on JailbreakV-28K We report Attack Success Rate (ASR,↓better) across MLLMs and defense methods. Image inputs include noise, Stable Diffusion (SD), natural, or blank images; text prompts are template-based (T), persuasive (P), or logic-driven (L). Llama-Guard-3 is used as the jailbreak classifier. Best results are in bold and all values are in percentage(%). ModelMethod Illegal ActivityMalware GenerationPornographyHate SpeechPhysical HarmFraud Avg↓ STS-TSTS-TSTS-TSTS-TSTS-TSTS-T LLaVA-1.5-7B Original59.1 50.0 86.775.5 24.457.721.85.450.034.7 27.4 64.682.7 50.3 83.461.9 36.1 69.652.3 FigStep32.6 45.9 81.631.1 31.162.227.26.368.134.1 18.9 51.255.8 36.5 72.450.3 32.9 69.044.8 CoCA17.1 80.4 80.4 25.9 27.79.98.052.0 55.010.0 63.1 67.025.0 45.0 57.026.0 57.0 59.044.6 ECSO39.7 37.7 46.962.2 20.026.631.80.912.722.5 17.0 20.771.0 28.9 40.663.8 27.7 32.933.5 AdaShield3.00.023.44.40.022.28.11.820.01.80.018.911.77.546.89.62.540.612.3 Immune0.41.00.00.40.013.66.99.019.00.53.05.05.14.07.00.00.06.03.5 SafePTR1.00.02.00.00.00.00.00.018.10.00.00.06.80.08.21.20.03.82.3 MiniGPT-4-7B Original69.3 65.3 38.740.0 44.440.028.1 20.9 35.426.8 57.3 34.160.6 54.4 42.057.4 49.0 40.644.7 FigStep69.3 64.2 37.737.7 44.440.028.1 20.0 34.528.6 53.0 34.160.6 54.4 41.353.5 50.9 41.944.1 CoCA9.242.2 28.86.820.418.119.0 12.0 24.06.012.0 10.025.0 16.6 26.025.08.325.018.9 ECSO21.4 63.2 65.371.1 37.737.731.8 16.3 10.926.2 28.6 29.265.5 44.1 45.541.2 45.1 48.340.5 AdaShield 19.3 59.1 63.233.3 40.048.816.3 26.3 32.726.2 41.4 46.942.7 51.7 64.822.5 46.4 56.141.0 Immune13.4 22.6 13.411.3 20.418.117.0 12.0 21.03.08.07.07.014.0 20.00.00.00.011.0 SafePTR5.116.39.12.211.18.83.63.64.57.38.59.17.513.19.99.011.63.88.0 DeepSeek-VL2 Original83.6 74.4 69.360.0 64.473.320.9 39.0 34.559.7 43.9 39.680.6 65.5 61.384.5 56.1 58.059.4 FigStep52.0 91.8 43.8 35.5 71.128.813.6 67.2 50.021.3 80.4 35.323.4 88.9 66.865.1 86.4 36.753.2 ECSO87.7 43.8 43.871.1 26.626.617.21.82.749.3 20.1 19.580.0 28.9 28.985.8 31.6 32.938.8 AdaShield 16.3 92.8 83.68.884.466.65.480.0 60.96.086.5 75.632.4 89.6 77.94.589.6 78.757.7 SafePTR11.737.736.16.921.420.43.69.09.00.017.113.622.525.928.80.631.132.918.2 Table 3: Evaluation on M-SafetyBench. We report the Attack Success Rate (ASR↓) across six prohibited categories, using GPT-4 as the jailbreak classifier. Bold highlights the best (i.e., lowest) ASR values. The attack image types include typography-based images (T), visuals generated by Stable Diffusion (S), and Stable Diffusion images with overlaid typography subtitles (S-T). 4.2 Safety Evaluation Results Text-driven Jailbreak Attack. To evaluate the effectiveness of SafePTR against text-driven jail- break, we conduct experiments on the JailbreakV-28K benchmark using 3 MLLMs, LLaVA-1.5-7B, 7 ModelMethod IllegalHateMalwarePhysical Fraud AdultPrivacyLegalFinancialHealth Avg↓ ActivitySpeechGenerationHarmContentViolationOpinionAdviceConsultation LLaVA-1.5-7B Original92.0048.0090.0094.0084.0028.0066.000.000.008.0051.00 FigStep56.0050.0054.0062.0084.0026.0054.000.000.006.0039.20 CoCA44.038.2338.0422.086.4942.489.6544.1541.9430.4528.63 ESCO20.0012.0082.0042.0060.0016.0050.002.002.004.0029.00 AdaShield4.0016.0016.008.0048.008.0030.000.000.000.0013.00 Immune28.210.006.302.120.000.000.004.403.841.864.23 SafePTR0.000.000.004.006.000.006.000.000.000.001.60 MiniGPT-4-7B Original74.0072.0096.0094.0088.0028.0064.000.004.0014.0053.40 FigStep64.0060.0082.0086.0066.0022.0056.006.002.0018.0046.20 CoCA7.850.000.002.471.856.360.0015.6313.876.285.74 ESCO64.0052.0090.0078.0078.0022.0046.004.008.0010.0045.20 AdaShield32.0042.0052.0050.0054.006.0060.000.000.0010.0030.60 Immune7.980.009.826.140.004.430.007.855.713.594.43 SafePTR4.0010.0010.006.002.002.002.000.000.000.003.60 DeepSeek-VL2 Original80.0082.0098.0094.0086.0012.0080.000.000.0012.0054.40 FigStep80.0084.0082.0078.0096.0022.0080.002.004.0014.0054.20 ESCO90.0076.0098.0092.0094.0022.0082.000.004.0010.0056.80 AdaShield76.0074.0082.0076.0082.0028.0080.002.000.0018.0051.80 SafePTR12.0018.0014.0012.006.0016.0018.000.000.002.009.80 Table 4: Evaluation on FigStep. We report ASR (↓), using GPT-4 as the jailbreak classifier. The best-performing results (i.e., lowest ASR) are highlighted in bold. MiniGPT-4-7B, and DeepSeek-VL2, in terms of Attack Success Rates (ASR) in Tab. 2. We observed that: (1) SafePTR achieves the lowest ASR across all models, for example, 0.98 on LLaVA-1.5 (vs. 2.10 Immune, 14.36 AdaShield), 6.48 on MiniGPT-4-7B, and 2.46 on DeepSeek-VL2. (2) It maintains robust performance across prompt-image combinations, with ASRs remaining below 5 in most scenarios. (3) Under strong adversarial conditions (e.g., logic prompts combined with noise images), SafePTR significantly reduces ASR, from over 70 to 2.71 on MiniGPT-4-7B and to 1.35 on DeepSeek-VL2. These results confirm SafePTR’s effectiveness against text-driven multimodal jailbreak. Visualization results on JailbreakV-28K are provided in Appendix.D. Vision-driven Jailbreak Attack. To evaluate the robustness of SafePTR against vision-driven jailbreak, we conduct experiments on two representative benchmarks: FigStep: As shown in Tab. 4, SafePTR consistently achieves the lowest ASR across all harmful categories. On LLaVA-1.5-7B, it reduces the average ASR to 1.60 (vs. 4.23 for Immune, 13.00 for AdaShield), with similarly strong performance on MiniGPT-4-7B (3.60) and DeepSeek-VL2 (0.40). Even in high-risk categories like Illegal Activity and Malware Generation, SafePTR maintains near-zero ASR (e.g., 0.00 on DeepSeek-VL2). M-SafetyBench: Tab. 3 reports SafePTR’s performance under SD, TYPO, and SD-TYPO attacks across six prohibited categories. It again outperforms all baselines, achieving the lowest average ASR on LLaVA-1.5-7B (1.29), MiniGPT-4-7B (8.04), and DeepSeek-VL2 (3.54). These results validate SafePTR’s effectiveness against both typographic and generative vision-driven jailbreak attacks. Visualization and evaluation on more benchmarks are provided in Appendix.E. ModelMethodExistenceCountPositionColorPostersCelebritySceneLandmarkArtworkOCRPercetion Total LLaVA-1.5-7B Original190.0155.0128.3170.0146.5135.8158.0162.8119.5137.51503.6 FigStep190.0165.0103.3165.0150.6136.4155.7165.3122.5117.51471.5 ESCO190.0155.0128.3170.0146.5135.8158.0162.8119.5137.51503.6 AdaShield190.0158.3130.0175.0144.5142.6156.2165.3119.0140.01521.1 SafePTR190.0158.3133.3165.0145.5140.2158.0165.0120.0162.51538.1 MiniGPT-4-7B Original110.073.358.370.045.260.0106.259.074.585.0741.6 FigStep95.078.370.080.050.053.5119.255.068.572.5742.1 ESCO110.073.358.370.045.260.0106.259.074.585.0741.6 AdaShield55.061.651.658.326.837.379.048.246.710.0474.8 SafePTR160.063.360.073.340.451.4122.054.084.087.5796.1 DeepSeek-VL2 Original200.0148.3146.6141.6127.2153.8157.7166.5135.5162.51540.0 FigStep190.0136.6143.3136.6152.0164.7153.5163.5137.0117.51494.9 ESCO200.0148.3146.6141.6127.2153.8157.7166.5135.5162.51540.0 AdaShield185.0143.3105.0151.6141.1167.3145.7151.5139.0110.01439.7 SafePTR200.0146.6146.6141.6127.5154.4157.7167.5136.2162.51541.0 Table 5: Utility scores on MME across 13 visual reasoning tasks. Bold indicates the best result per category. 4.3 Model Utility Evaluation Results An effective jailbreak defense must mitigate adversarial risks without compromising model utility. To evaluate this, we assess SafePTR on two standard multimodal benchmarks: MME and M-Vet. As shown in Tab. 5 and Tab. 6, SafePTR consistently achieves the highest utility scores across all models 8 on both MME (e.g., 1538.1 on LLaVA-1.5-7B) and M-Vet (e.g., 53.0 on DeepSeek-VL2). These results demonstrate that SafePTR offers a superior safety-utility trade-off, enhancing robustness while preserving fine-grained multimodal understanding. 4.4 Efficiency Evaluation Results Training cost and Inference Time. An ideal defense should be both effective and efficient. To assess this, we compare SafePTR with prior methods in training size (samples in K) and inference latency (secs), as shown in Tab. 7. SafePTR achieves leading performance on safety and utility benchmarks while remaining lightweight. It requires no training (vs. 1223K/ 71k for TGA/Immune) and runs in 3.51 secs with a one-pass pipeline, faster than multi-pass methods like ECSO or CoCA. These results underscore SafePTR’s practicality for real-world deployment, offering strong robustness and generalization without additional training or runtime cost. ModelMethodrecocrknowgenspatmathtotal LLaVA-1.5-7B Baseline35.321.917.321.224.97.730.3 FigStep31.918.214.518.520.30.026.6 ESCO35.321.917.321.224.97.730.3 AdaShield27.512.912.617.520.53.821.6 SafePTR36.823.920.120.032.111.232.3 MiniGPT-4-7B Baseline21.112.710.89.517.57.718.1 FigStep12.67.86.96.47.73.811.3 ESCO21.112.710.89.517.57.718.1 AdaShield10.76.65.74.87.30.09.8 SafePTR21.713.210.79.418.17.718.8 DeepSeek-VL2 Baseline50.156.737.638.754.822.351.3 FigStep46.954.435.436.455.526.949.0 ESCO50.156.737.638.754.822.351.3 AdaShield41.850.329.632.545.330.843.3 SafePTR54.249.940.838.952.126.553.0 Table 6: Utility scores on M-Vet. We report the accuracy across 7 capability categories. The best results are highlighted in bold. Ablations on Proposed Compo- nents.To assess the contribution of each SafePTR component, we perform an ablation study isolating the effects of Harmful Token Prun- ning(HTP)) and Benign Features Restoration(BFR)) on safety (Fig- step and M-SafetyBench) and util- ity (M-Vet and MME). As shown in Tab. 9, applying HTP alone signif- icantly reduces the ASR from 52.3 to 3.06, but at the expense of utility due to the removal of benign contextual in- formation. Incorporating the restora- tion module retains the safety bene- fits while markedly enhancing utility, outperforming the baseline by 34.49. These results demonstrate that SafePTR’s prune-then-restore design effectively balances safety and task performance. Inference Latency in s (↓)BaselineAdaShieldCoCAImmuneSafePTR LLaVA-1.53.52s3.62s7.02s4.98s3.67s LLaVA-1.63.48s3.58s7.01s4.93s3.51s MiniGPT-4-7B10.38s10.48s19.86s14.76s 10.63s MiniGPT-4-13B24.56s24.92s47.43s32.90s25.08s Training Size in % (↓)0K0.2K0K71K0K Average ASR in % (↓)52.5624.6335.0311.511.29 Model Utility (↑)1503.621521.111501.561504.211538.11 Table 7: Efficiency Comparison. We report training data size (K) and inference latency (sec/sample) to evaluate efficiency. Ablations on hyperparameter Top- K in HTP. To examine how varying the Top-K pruning ratio in HTP influ- ences the trade-off between safety and utility, we conduct an ablation study, as presented in Tab. 8. We observed that increasing K, i.e., pruning more tokens, improves safety on FIG and MSB by effectively suppressing harm- ful behaviors, but gradually reduces utility on MMVet and MME. Empiri- cally, we choose K=10% as it provides a favorable balance, achieving substantial safety improvements (FIG: 51.0→1.6; MSB: 52.3→1.2) while maintaining competitive utility (MMVet: 32.3; MME: 1538.11). KFIG↓MSB↓MMVet↑MME↑ 0%51.052.330.31503.62 2.5%39.443.632.11510.85 5.0%4.23.331.81523.91 10.0%1.61.232.31538.11 40.0%0.20.431.11401.79 80.0%0.10.023.61317.90 Table 8: Ablation study of Top-K in HTP. HTPBFRFIG↓MSB↓MMVet↑MME↑ --51.052.330.31503.62 ✓-3.83.0624.51428.11 ✓1.61.2932.31538.11 Table 9: Ablation study of proposed components. Per- formance of Harmful Token Pruning (HTP) and Be- nign Feature Restoration (BFR) on FigStep (FIG), M- SafetyBench (MSB), M-Vet, and MME. 9 5 Related Work Jailbreak Attacks on Multimodal Large Language Models. Recent studies have demonstrated that MLLMs are highly susceptible to jailbreak attacks. [Gong et al., 2023] transforms harmful text into typographic images to bypass safety filters, while [Liu et al., 2023c] exploit query-relevant images for similar effect. [Dong et al., 2023] craft visual adversarial examples to circumvent guardrails. [Luo et al., 2024b] introduce JailBreakV-28K to benchmark attack transferability. However, these studies rarely analyze how jailbreak bypass safeguards, leaving internal vulnerability mechanisms of MLLMs largely unexplored. To bridge this gap, we investigate where, how, and which harmful multimodal tokens trigger jailbreaks, which directly informs our defense design. Defenses on Multimodal Large Language Models. To counter adversarial threats, recent de- fenses for MLLMs have explored input transformation [Yan et al., 2024], inference-time risk evalua- tion [Zhang et al., 2024a], and prompt-based mitigation strategies [Wang et al., 2024b]. Other methods focus on hidden state monitoring and cross-modal safety transfer [Liu et al., 2024c], inference-time alignment [Wang et al., 2024a], and LLM-guided constitutional calibration [Li et al., 2024]. Despite these advancements, few works examine jailbreaks at the representation level, leaving models vulner- able to text-driven attacks and prone to overdefensive behavior. Guided by our finding that semantic drift from safety-aligned representations is a key failure factor, we propose SafePTR, an interpretable and training-free defense that preserves utility while enhancing robustness. 6 Conclusion In this work, we investigate the root causes of multimodal jailbreaks in MLLMs, showing that a small subset of harmful tokens can compromise model safety, an issue often overlooked by existing defenses. Based on this, we propose SafePTR, a training-free framework that prunes harmful tokens at critical layers while restoring benign features elsewhere. Without added computational cost, SafePTR significantly improves safety while preserving model utility, achieving SOTA performance across multiple benchmarks. Limitations: SafePTR relies on intermediate hidden states to compute semantic deviation, which restricts its applicability to black-box models such as GPT-4. Additionally, its fixed Top-K pruning strategy may lack flexibility in handling inputs with varying risk levels. 7 Acknowledgements This study is supported by grants from the National Natural Science Foundation of China (Grant No. U23A20315, No. 62425208, No. U22A2097, No. 62122018, No. 62020106008), Shen- zhen Science and Technology Program (No.JCYJ20240813114208012), Fundamental Research Funds for the Central Universities, and Natural Science Foundation of Sichuan Province (Grant No. 2025ZNSFSC1463). References J. Bai, S. Bai, S. Yang, S. Wang, S. Tan, P. Wang, J. Lin, C. Zhou, and J. Zhou. Qwen-vl: A frontier large vision-language model with versatile abilities. arXiv preprint arXiv:2308.12966, 2023. L. Chen, H. Zhao, T. Liu, S. Bai, J. Lin, C. Zhou, and B. Chang. An image is worth 1/2 tokens after layer 2: Plug-and-play inference acceleration for large vision-language models. arXiv preprint arXiv:2403.06764, 2024. W.-L. Chiang, Z. Li, Z. Lin, Y. Sheng, Z. Wu, H. Zhang, L. Zheng, S. Zhuang, Y. Zhuang, J. E. Gonzalez, I. Stoica, and E. P. Xing. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality, March 2023. URL https://lmsys.org/blog/2023-03-30-vicuna/. Y. Dong, Z. Li, J. Tang, et al. Visual adversarial examples jailbreak aligned large language models. arXiv preprint arXiv:2306.13213, 2023. C. Fu, P. Chen, Y. Shen, Y. Qin, M. Zhang, X. Lin, Z. Qiu, W. Lin, J. Yang, X. Zheng, et al. Mme: A comprehensive evaluation benchmark for multimodal large language models. arXiv preprint arXiv:2306.13394, 2023. 10 J. Gao, R. Pi, T. Han, H. Wu, L. Hong, L. Kong, X. Jiang, and Z. Li. Coca: Regaining safety- awareness of multimodal large language models with constitutional calibration. arXiv preprint arXiv:2409.11365, 2024. S. S. Ghosal, S. Chakraborty, V. Singh, T. Guan, M. Wang, A. Beirami, F. Huang, A. Velasquez, D. Manocha, and A. S. Bedi. Immune: Improving safety against jailbreaks in multi-modal llms via inference-time alignment. arXiv preprint arXiv:2411.18688, 2024. Y. Gong, D. Ran, J. Liu, C. Wang, T. Cong, A. Wang, S. Duan, and X. Wang. Figstep: Jailbreaking large vision-language models via typographic visual prompts. arXiv preprint arXiv:2311.05608, 2023. Y. Gong, D. Ran, J. Liu, C. Wang, T. Cong, A. Wang, S. Duan, and X. Wang. Figstep: Jailbreak- ing large vision-language models via typographic visual prompts. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23951–23959, 2025. Y. Gou, K. Chen, Z. Liu, L. Hong, H. Xu, Z. Li, D.-Y. Yeung, J. T. Kwok, and Y. Zhang. Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation. In European Conference on Computer Vision, pages 388–404. Springer, 2024. Y. Guo, F. Jiao, L. Nie, and M. Kankanhalli. The vllm safety paradox: Dual ease in jailbreak attack and defense. arXiv preprint arXiv:2411.08410, 2024. A. Q. Jiang, A. Sablayrolles, A. Roux, A. Mensch, B. Savary, C. Bamford, D. S. Chaplot, D. d. l. Casas, E. B. Hanna, F. Bressand, et al. Mixtral of experts. arXiv preprint arXiv:2401.04088, 2024. Z. Li, L. Chen, and H. Yan. Coca: Regaining safety-awareness of multimodal large language models with constitutional calibration. arXiv preprint arXiv:2402.00000, 2024. H. Liu, C. Li, Q. Wu, and Y. J. Lee. Visual instruction tuning. arXiv preprint arXiv:2304.08485, 2023a. H. Liu, Y. Jian, X. Han, Q. You, H. Huang, and R. He. eram-v: From interaction to integration in efficient multimodal large language models. arXiv preprint arXiv:2104.08696, 2024a. X. Liu, Y. Zhu, Y. Lan, C. Yang, and Y. Qiao. Query-relevant images jailbreak large multi-modal models, 2023b. X. Liu, Y. Wang, Z. Zhang, et al. Mllm-protector: Ensuring mllm’s safety without hurting performance. arXiv preprint arXiv:2403.00000, 2024b. Z. Liu, Y. Zhu, Y. Wang, Y. Zhou, X. Li, Y. Zhang, and J. Liu. Query-relevant images jailbreak large multi-modal models. arXiv preprint arXiv:2311.12091, 2023c. Z. Liu, W. Zhao, J. Liu, et al. Cross-modal safety mechanism transfer in large vision-language models. arXiv preprint arXiv:2402.00000, 2024c. H. Lu, W. Liu, B. Zhang, B. Wang, K. Dong, B. Liu, J. Sun, T. Ren, Z. Li, H. Yang, et al. Deepseek-vl: towards real-world vision-language understanding. arXiv preprint arXiv:2403.05525, 2024. W. Luo, S. Ma, X. Liu, X. Guo, and C. Xiao. Jailbreakv-28k: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. arXiv preprint arXiv:2404.03027, 2024a. W. Luo, S. Ma, X. Liu, X. Guo, and C. Xiao. Jailbreakv-28k: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. arXiv preprint arXiv:2404.03027, 2024b. Y. Ma, T. Zhang, X. Zhu, Y. He, X. Li, J. Ma, and W. Yin. Efficient streaming language models with attention sinks. arXiv preprint arXiv:2312.00780, 2023. OpenAI. GPT-4V(ision) system card. 2023. 11 H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023. Y. Wang, H. Li, and P. Zhang. Immune: Improving safety against jailbreaks in multi-modal llms via inference-time alignment. arXiv preprint arXiv:2403.00000, 2024a. Y. Wang, X. Liu, Y. Li, M. Chen, and C. Xiao. Adashield: Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting. In European Conference on Computer Vision, pages 77–94. Springer, 2024b. H. Yan, Z. Li, and L. Chen. Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation. arXiv preprint arXiv:2402.00000, 2024. W. Yu, Z. Yang, L. Li, J. Wang, K. Lin, Z. Liu, X. Wang, and L. Wang. Mm-vet: Evaluating large multimodal models for integrated capabilities. In International Conference on Machine Learning. PMLR, 2024. Z. Yue, L. Zhang, and Q. Jin. Less is more: Mitigating multimodal hallucination from an EOS decision perspective. In L. Ku, A. Martins, and V. Srikumar, editors, Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2024, Bangkok, Thailand, August 11-16, 2024, pages 11766–11781. Associa- tion for Computational Linguistics, 2024. doi: 10.18653/V1/2024.ACL-LONG.633. URL https://doi.org/10.18653/v1/2024.acl-long.633. M. Zhang, X. Wang, and Q. Tan. Eta: Evaluating then aligning safety of vision language models at inference-time. arXiv preprint arXiv:2401.00000, 2024a. Y. Zhang, S. Wu, W. Liu, S.-W. Lin, X. Li, F. Yang, W. X. Zhao, F. Wei, and M. Zhou. An image is worth 1/2 tokens after layer 2: Plug-and-play inference acceleration for large vision-language models. arXiv preprint arXiv:2403.07905, 2024b. D. Zhu, J. Chen, X. Shen, X. Li, and M. Elhoseiny. Minigpt-4: Enhancing vision-language under- standing with advanced large language models. arXiv preprint arXiv:2304.10592, 2023. 12 NeurIPS Paper Checklist 1. Claims Question: Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope? Answer: [Yes] Justification: Yes, the main claims in the abstract and introduction accurately reflect the paper’s contributions and scope. Guidelines: • The answer NA means that the abstract and introduction do not include the claims made in the paper. •The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. •The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. •It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper. 2. Limitations Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] Justification: Yes, the paper includes a clear discussion of its limitations in 5.Conclusion Section. Guidelines: • The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper. •The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. •The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. •The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. •If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. •While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren’t acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 3. Theory assumptions and proofs Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? 13 Answer: [Yes] Justification: Yes, for each theoretical result, the paper clearly states all underlying assump- tions and provides complete and correct proofs. Guidelines: • The answer NA means that the paper does not include theoretical results. • All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced. •All assumptions should be clearly stated or referenced in the statement of any theorems. •The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition. •Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material. • Theorems and Lemmas that the proof relies upon should be properly referenced. 4. Experimental result reproducibility Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)? Answer: [Yes] Justification: Yes, the paper provides sufficient details to reproduce the main experimental results that support its core claims and conclusions. Guidelines: • The answer NA means that the paper does not include experiments. •If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not. • If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable. •Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed. •While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example (a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm. (b)If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully. (c)If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset). (d)We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results. 5. Open access to data and code 14 Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material? Answer: [Yes] Justification: Yes, the paper provides open access to both the code and data, along with clear instructions in the supplementary material to enable faithful reproduction of the main experimental results. Guidelines: • The answer NA means that paper does not include experiments requiring code. •Please see the NeurIPS code and data submission guidelines (https://nips.c/ public/guides/CodeSubmissionPolicy) for more details. • While we encourage the release of code and data, we understand that this might not be possible, so “No” is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark). •The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: //nips.c/public/guides/CodeSubmissionPolicy) for more details. • The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc. •The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why. •At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable). •Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted. 6. Experimental setting/details Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results? Answer: [Yes] Justification: Yes, the paper specifies all key training and testing details necessary to understand the reported results. Guidelines: • The answer NA means that the paper does not include experiments. •The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. •The full details can be provided either with the code, in appendix, or as supplemental material. 7. Experiment statistical significance Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments? Answer: [Yes] Justification: Yes, the paper reports error bars or other appropriate statistical measures to assess the significance and variability of the experimental results. Guidelines: • The answer NA means that the paper does not include experiments. • The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. 15 •The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). •The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. •It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified. •For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates). •If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text. 8. Experiments compute resources Question: For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments? Answer: [Yes] Justification: Yes, the paper provides sufficient information regarding the computational resources used for the experiments. Guidelines: • The answer NA means that the paper does not include experiments. • The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. •The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. •The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn’t make it into the paper). 9. Code of ethics Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.c/public/EthicsGuidelines? Answer: [Yes] Justification: Yes, the research presented in the paper conforms to the NeurIPS Code of Ethics in all respects. Guidelines: •The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics. •If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consid- eration due to laws or regulations in their jurisdiction). 10. Broader impacts Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed? Answer: [Yes] Justification: Yes, the paper discusses both the potential positive and negative societal impacts of the work. Guidelines: 16 • The answer NA means that there is no societal impact of the work performed. •If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. •Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. •The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. •The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. •If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 11. Safeguards Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [Yes] Justification: Yes, the paper describes safeguards implemented for the responsible release of models that may pose misuse risks. Guidelines: • The answer NA means that the paper poses no such risks. • Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. •We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort. 12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: Yes, the paper properly credits the creators and original owners of all external assets used, including code, datasets, and pretrained models. Guidelines: • The answer NA means that the paper does not use existing assets. • The authors should cite the original paper that produced the code package or dataset. •The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., C-BY 4.0) should be included for each asset. 17 •For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. •If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets,paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. •For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. •If this information is not available online, the authors are encouraged to reach out to the asset’s creators. 13. New assets Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets? Answer: [Yes] Justification: Yes, the new assets introduced in the paper are well documented, with clear descriptions of their structure, usage, and intended applications. Guidelines: • The answer NA means that the paper does not release new assets. • Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. •At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file. 14. Crowdsourcing and research with human subjects Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)? Answer: [Yes] Justification: Yes, for experiments involving human subjects or crowdsourcing, the paper includes the full text of participant instructions, relevant screenshots (if applicable), and clear details regarding compensation. Guidelines: • The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper. •According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector. 15.Institutional review board (IRB) approvals or equivalent for research with human subjects Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained? Answer: [No] Justification: Yes, the paper clearly describes any potential risks incurred by study partici- pants. Guidelines: 18 •The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 16. Declaration of LLM usage Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required. Answer: [NA] Justification: LLM is used only for editing. Guidelines: • The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components. •Please refer to our LLM policy (https://neurips.c/Conferences/2025/LLM) for what should or should not be described. 19

Instant research discovery