通过模型差分发现并控制多模态大模型的特征,提升可解释性与安全性。
Multimodal Model Diffing for Feature Discovery and Control

- 用多模态稀疏自编码器对比基线与多模态适配模型,定位训练引入的新特征。
- 移除特定特征使空间理解与OCR性能平均下降12%和17%,安全攻击成功率降24%。
- 可定向调控特征方向,提升空间与OCR准确率,适合安全审计与可控生成场景。
多模态大语言模型(MLLMs)具备强大的视觉理解能力,但其内部驱动行为的特征仍难以识别、审计或控制。尽管可通过稀疏自编码器(SAEs)分解隐藏状态为可解释特征方向,但这些特征无法直接揭示多模态训练带来的变化,也难用于精准控制。本文提出MMDiff框架,训练多模态SAEs并将其转化为特征级接口,实现多模态行为的发现与控制。MMDiff支持三类应用:(i) 特征隔离,通过对比基础语言模型与多模态适配版本的SAE,识别多模态训练引入的变化特征;(ii) 任务特异性特征检测,基于逐令牌对比激活分析,定位因果特征;(iii) 特征级控制,通过因果移除或引导已发现特征方向。我们在LLaVA-MORE、PaliGemma 2和InternVL3.5三类模型上训练多模态SAEs,评估在视觉空间理解、多模态安全性和OCR任务上的表现。结果显示,所发现特征稀疏且具因果性,移除后空间任务性能平均下降12%,OCR下降17%,多模态安全攻击成功率降低24%,而对VQA无影响。特征引导使空间与OCR准确率分别较单层引导基准提升+3.6%和+1.8%。结果表明,多模态SAEs不仅可用于可解释性分析,还可作为审计、调节与控制MLLM行为的工具,推动更安全、更强健的生成。
原文摘要 · Abstract (English)
Multimodal Large Language Models (MLLMs) exhibit strong visual understanding, yet the internal features that cause these behaviors remain difficult to identify, audit, or control. While applicable to post-hoc inspection, hidden states that are decomposed into interpretable feature directions using sparse autoencoders (SAEs) neither readily isolate which features are changed by multimodal training, nor are they directly useful for targeted control. We introduce MMDiff, a multimodal model-diffing framework that trains multimodal SAEs and turns them into feature-level interfaces for discovering and controlling multimodal behavior. MMDiff supports three uses: (i) feature isolation, by diffing a base-LM SAE against its multimodal-adapted counterpart to identify features altered by multimodal training; (ii) task-specific feature detection, via per-token contrastive firing analysis that isolates causal features; and (iii) feature-level control, by causally removing or steering the discovered feature directions. We train multimodal SAEs for three MLLM families, LLaVA-MORE, PaliGemma 2, and InternVL3.5, and evaluate on visual-spatial understanding, multimodal safety, and OCR. MMDiff discovers sparse, causally specific features whose removal selectively degrades target behaviors by an average of 12% on spatial tasks and 17% on OCR, and reduces attack success rate by 24% on multimodal safety attacks, with no impact on VQA performance. Steering these features improves spatial and OCR accuracy by +3.6% and +1.8% on average over a standard single-layer steering baseline. These results show that multimodal SAEs can serve not only as interpretability tools, but as mechanisms for auditing, steering, and controlling MLLMs behavior toward safer and more capable generations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。