Search papers, labs, and topics across Lattice.
This study investigates the neuron-level safety mechanisms in vision-language models (VLMs) to understand how visual inputs can compromise safety pathways that text inputs do not. By employing a two-stage detection pipeline with iterative ablation, the authors identify that text safety is localized to approximately 88 neurons, which are critical for refusal responses, while visual safety is distributed across a much larger number of neurons, highlighting a significant disparity in how these modalities handle harmful requests. The findings suggest that current alignment strategies are insufficient to address the complexities of visual safety, as the high-dimensional nature of visual safety pathways complicates effective intervention.
Text safety neurons in VLMs are localized and critical, while visual safety mechanisms are diffuse and complex, revealing a fundamental gap in current alignment strategies.
Vision-language models (VLMs) can comply with harmful requests delivered through images, even when their LLM backbones would refuse the same content in text. While prior work characterizes these jailbreaks empirically or at the representation level, how visual inputs perturb safety pathways at the neuron level remains uncharted. We close this gap with a causal, neuron-level analysis of safety mechanisms in 10 VLMs. We propose a two-stage detection pipeline with iterative ablation that accounts for self-repair, and introduce two modality-isolated benchmarks, ViSafe-Detect and ViSafe-Eval, which decouple visual and textual safety signals. Our analysis reveals: (i) Text safety in VLMs is localizable: $\sim$88 neurons ($<$0.01%) whose targeted ablation substantially reduces refusal. (ii) Text safety neurons constitute the dominant refusal pathway: ablating them is the only intervention that consistently and substantially reduces refusal across all models. (iii) Visual safety is high-dimensional and diffuse at the single-neuron level: text safety concentrates in $\sim$5 subspace directions while visual safety requires $\geq$50. This gap holds across architectures, explaining why current alignment has not closed the visual safety gap. Project page is at: https://jiaxuan-li.github.io/vlm-safety-neuron/ Warning: this paper may include examples of harmful content.
