mlsanityData to 7 Oct 2026

Layer-wise Alignment: Examining Safety Alignment Across Image Encoder Layers in Vision Language Models

arXiv 2411.04291 ↗First posted 6 Nov 2024cs.CL cs.CVcited by 3

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 3 more
Abstract (arXiv)

Vision-language models (VLMs) have improved significantly in their capabilities, but their complex architecture makes their safety alignment challenging. In this paper, we reveal an uneven distribution of harmful information across the intermediate layers of the image encoder and show that skipping a certain set of layers and exiting early can increase the chance of the VLM generating harmful responses. We call it as "Image enCoder Early-exiT" based vulnerability (ICET). Our experiments across three VLMs: LLaVA-1.5, LLaVA-NeXT, and Llama 3.2, show that performing early exits from the image encoder significantly increases the likelihood of generating harmful outputs. To tackle this, we propose a simple yet effective modification of the Clipped-Proximal Policy Optimization (Clip-PPO) algorithm for performing layer-wise multi-modal RLHF for VLMs. We term this as Layer-Wise PPO (L-PPO). We evaluate our L-PPO algorithm across three multimodal datasets and show that it consistently reduces the harmfulness caused by early exits.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 48 of its 65 references that are in the map. First posted on arXiv 6 Nov 2024.

Builds on

48 of 65 references.

Closest ancestors · 5

Same direction, newest first

  1. 2024Safety Alignment for Vision Language Models22 May
  2. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks3 Apr
  3. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  4. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  5. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun

Other references · 43

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  4. 2022Training language models to follow instructions with human feedbackcited by 15,712
  5. 2017Proximal Policy Optimization Algorithmscited by 14,441
  6. 2024The Llama 3 Herd of Modelscited by 14,192
  7. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  8. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  9. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  10. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,310
  11. 2017Deep reinforcement learning from human preferencescited by 3,846
  12. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
31 more
  1. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  3. 2015Trust Region Policy Optimizationcited by 2,503
  4. 2016Making the V in VQA Matter: Elevating the Role of Image Understanding in Visual Question Answeringcited by 2,498
  5. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  6. 2021DeBERTaV3: Improving DeBERTa using ELECTRA-Style Pre-Training with Gradient-Disentangled Embedding Sharingcited by 1,219
  7. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  8. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  9. 2017Constrained Policy Optimizationcited by 928
  10. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 828
  11. 2023RLHF-V: Towards Trustworthy MLLMs via Behavior Alignment from Fine-grained Correctional Human Feedbackcited by 404
  12. 2023Large Language Model Unlearningcited by 288
  13. 2024RLHF Workflow: From Reward Modeling to Online RLHFcited by 265
  14. 2024Aligning Modalities in Vision Large Language Models via Preference Fine-tuningcited by 197
  15. 2023OneLLM: One Framework to Align All Modalities with Languagecited by 185
  16. 2022A New Generation of Perspective API: Efficient Multilingual Character-level Transformerscited by 181
  17. 2024Rewards-in-Context: Multi-objective Alignment of Foundation Models with Dynamic Preference Adjustmentcited by 171
  18. 2024Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Modelscited by 160
  19. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  20. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 128
  21. 2024Strengthening Multimodal Large Language Model with Bootstrapped Preference Optimizationcited by 75
  22. 2024SelfIE: Self-Interpretation of Large Language Model Embeddingscited by 63
  23. 2024Building Guardrails for Large Language Modelscited by 61
  24. 2024VLFeedback: A Large-Scale AI Feedback Dataset for Large Vision-Language Models Alignmentcited by 56
  25. 2024Dense Connector for MLLMscited by 48
  26. 2024Online DPO: Online Direct Preference Optimization with Fast-Slow Chasingcited by 38
  27. 2024Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Samplingcited by 33
  28. 2023LGViT: Dynamic Early Exiting for Accelerating Vision Transformercited by 30
  29. 2021Multi-Exit Vision Transformer for Dynamic Inferencecited by 28
  30. 2024Intrinsic Test of Unlearning Using Parametric Knowledge Tracescited by 28
  31. 2023Causality Analysis for Evaluating the Security of Large Language Modelscited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 2; 2026: 1.

3 papers.

  1. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
  2. 2025Understanding Language Prior of LVLMs by Contrasting Chain-of-Embeddingcited by 13
  3. 2026New Wide-Net-Casting Jailbreak Attacks Risk Large Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024PSA-VLM: Enhancing Vision-Language Model Safety through Progressive Concept-Bottleneck-Driven Alignment
  2. 2024Unraveling and Mitigating Safety Alignment Degradation of Vision-Language Models
  3. 2024ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time
  4. 2024Cross-Modal Safety Mechanism Transfer in Large Vision-Language Models
  5. 2026SafeRI: Recognition and Intervention for Token-Level Safety Intervention in Large Vision Language Models
  6. 2025VLM-Guard: Safeguarding Vision-Language Models via Fulfilling Safety Alignment Gap
  7. 2025DAVSP: Safety Alignment for Large Vision-Language Models via Deep Aligned Visual Safety Prompt
  8. 2024SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Model