提出解码阶段的防御机制，让多模态大模型自动识别并纠正有害输出。
SafeSteer: A Decoding-level Defense Mechanism for Multimodal Large Language Models
- 在解码过程中通过轻量探针实时检测有害内容并修正输出。
- 无需微调即可提升模型安全性能最高33.40%，且不牺牲有用性。
- 适用于防范图像类隐蔽攻击，适合关注模型安全的开发者使用。
多模态大语言模型（MLLMs）受到广泛关注，但因其输入特征异质性强，面临严峻的越狱攻击防御挑战。现有方法依赖昂贵的微调或低效的事后干预，难以应对新型攻击且存在性能损失。本文探索了MLLM内在的安全能力，量化其在解码阶段辨别有害内容的能力。观察发现：1）MLLM可在解码过程中区分有害与无害输入；2）基于图像的攻击更具隐蔽性。据此提出SafeSteer，一种解码级防御机制，包含一个轻量级解码探针，可迭代引导解码过程向安全方向调整，并引入模态语义对齐向量，将文本端强大的安全对齐能力迁移至视觉模态。在多个MLLM上的实验表明，SafeSteer可实现高达33.40%的安全性提升，且无需微调，有效平衡了模型的有用性与安全性。
原文摘要 · Abstract (English)
Multimodal large language models (MLLMs) are gaining increasing attention. Due to the heterogeneity of their input features, they face significant challenges in terms of jailbreak defenses. Current defense methods rely on costly fine-tuning or inefficient post-hoc interventions, limiting their ability to address novel attacks and involving performance trade-offs. To address the above issues, we explore the inherent safety capabilities within MLLMs and quantify their intrinsic ability to discern harmfulness at decoding stage. We observe that 1) MLLMs can distinguish the harmful and harmless inputs during decoding process, 2) Image-based attacks are more stealthy. Based on these insights, we introduce SafeSteer, a decoding-level defense mechanism for MLLMs. Specifically, it includes a Decoding-Probe, a lightweight probe for detecting and correcting harmful output during decoding, which iteratively steers the decoding process toward safety. Furthermore, a modal semantic alignment vector is integrated to transfer the strong textual safety alignment to the vision modality. Experiments on multiple MLLMs demonstrate that SafeSterr can improve MLLMs' safety by up to 33.40\% without fine-tuning. Notably, it can maintain the effectiveness of MLLMs, ensuring a balance between their helpfulness and harmlessness.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。