According to a paper published on arxiv.org, researchers have identified a mechanism behind jailbreak attacks on large vision-language models (VLMs) and developed a defense strategy.
The research found that VLMs can distinguish between benign and harmful inputs in their representation space, and that jailbreak samples form a distinct internal state separate from refusal samples. According to the paper, “jailbreaks do not arise from a failure to recognize harmful intent. Instead, the visual modality shifts representations toward a specific jailbreak state, thereby leading to a failure to trigger refusal.”
The researchers quantified this phenomenon by identifying a “jailbreak direction” and defining the “jailbreak-related shift” as the component of image-induced representation changes along this direction. Their analysis showed this shift “reliably characterizes jailbreak behavior, providing a unified explanation for diverse jailbreak scenarios.”
Based on these findings, the team proposed a defense method called JRS-Rem (jailbreak-related shift removal) that operates at inference time. According to arxiv.org, experiments demonstrated that JRS-Rem “provides strong defense across multiple scenarios while preserving performance on benign tasks.” Code for the research is available online.