Learning to Detect Unseen Jailbreak Attacks in Large Vision-Language Models
Shuang Liang, Zhihao Xu, Jiaqi Weng, Jialing Tao, Hui Xue, Xiting Wang
cs.CR, cs.AI, cs.CV
2025-08-09
LoD learns safety probes and a one-class autoencoder from safe and vanilla harmful queries, then flags unseen jailbreaks by reconstruction error at ~0.98 AUROC on three LVLMs.
Aligned vision-language models still jailbreak. Prior attacks have already elicited answers to 96% of unsafe AdvBench questions. Detection sits on two bad poles. Classifiers trained on a named attack fail when the next attack looks different. Heuristic detectors that skip training are weaker in messy cases and often slower.
LoD, from Renmin University of China and Alibaba, trains parameters for the detection job, not for one attack recipe. Training sees only safe queries and vanilla harmful queries that state the unsafe request in the clear. Jailbreaks appear only at test time.
Two stages.
MSCAV classifiers first. At each LVLM layer, take the hidden state of the last input token and train a linear probe that outputs the probability the model treats the input as unsafe at that layer. Concatenate those probabilities into a safety vector. Drop layers whose validation accuracy is below P0=0.9. Training text comes from AdvBench (unsafe) and GQA (safe), with Pixart-Sigma images synthesized for both; 100 pairs train the probes, 100 validate. Linear probes already clear 90% accuracy by layer 4 in these LVLMs, earlier than the roughly 10th layer often reported for text-only LLMs.
Jailbreaks never enter probe training, yet their mean safety curves still sit between pure-safe and overtly unsafe inputs. The output layer can be fooled while intermediate layers keep a residue. Per dimension, though, safe and attacked vectors overlap more than 40% on average (44.14% on LLaVA, 40.76% on Qwen2.5-VL, 43.32% on CogVLM). A per-dimension threshold cannot separate them cleanly.
The Safety Pattern Auto-Encoder then compresses that vector. A three-layer fully connected encoder and a symmetric ReLU decoder train on 320 safe safety-vectors with mean-squared reconstruction. At test time, reconstruction error is the anomaly score. The decision threshold is the 90th percentile of held-out safe scores: 0.253 on LLaVA, 0.335 on Qwen2.5-VL, 0.207 on CogVLM.
The test set pairs 400 safe MM-Vet2 items with 400 unsafe MM-SafetyBench items. Unseen attacks: prompt-manipulation FC-Attack, JOOD, HADES, MML, plus adversarial VAJM and UMK. Models: LLaVA-1.6-Vicuna-7B, Qwen2.5-VL-7B-Instruct, CogVLM-chat-v1.1.
| Model | LoD mean AUROC | Best baseline | Relative gain | LoD worst attack |
| LLaVA | 0.9820 | HiddenDetect 0.8230 | +19.32% | 0.9645 |
| Qwen2.5-VL | 0.9838 | GradSafe 0.9414 | +4.50% | 0.9253 |
| CogVLM | 0.9705 | HiddenDetect 0.8287 | +17.11% | 0.8798 |
The paper's +170.4% worst-case relative gain on LLaVA compares LoD's 0.9645 minimum with MirrorCheck's 0.3567, the best of the baselines' own minima. HiddenDetect's own floor is 0.3271 on MML; GradSafe falls to 0.0349 on UMK. MML is the one attack LoD systematically loses: GradSafe wins on all three models, including 1.0000 versus 0.8798 on CogVLM.
Ablations: replacing MSCAV with raw concatenated activations hurts most. Swapping in HiddenDetect features yields about 0.811 mean AUROC against LoD's 0.982. Dropping the autoencoder and thresholding each dimension at the 95th percentile of safe scores falls to 0.857-0.875. Detection latency is 0.25 s on LLaVA, 62.7% under HiddenDetect's 0.67 s; 0.62 s on Qwen2.5-VL and 0.34 s on CogVLM. Probe fitting takes 12 seconds offline, the autoencoder 2 seconds. Average AUROC barely moves for P0 from 0.80 to 0.97.
In a white-box stack this can ship: no jailbreak corpus, no hand-written refusal tokens or gradient rules, and no relabeling when the attack recipe changes. The cost is access to hidden states, plus a detector bound to one model. A new architecture or a new alignment pass means a new fit.
A 0.98 mean AUROC looks strong. Production cares about recall at a low false-positive rate.
The authors flag two issues. The detector is tied to a specific LVLM. The eval cannot cover adaptive attacks that edit internal representations on purpose. MML hides the unsafe intent inside a cross-modal reconstruction puzzle (mirrored text plus a scrambled word list). In an appendix case, a benign MM-Vet2 "write Python to redraw this figure" prompt can score higher than an MML attack. At FPR=0.01, true-positive rate on MML is 0 on all three models. Because the autoencoder fits only the safe distribution, hard but harmless prompts inflate the anomaly score; that is a false-positive path, not a footnote. Training images are synthetic. Whether real photographs stay linearly separable is untested.