PaperlayerView exact revision on arXiv

Source-linked AI summary

UniGuard: Towards Universal Safety Guardrails for Jailbreak Attacks on Multimodal Large Language Models

Sejoon Oh, Yiqiao Jin, Megha Sharma, Donghyun Kim, Eric Ma, Gaurav Verma, Srijan Kumar

arXiv:2411.01703v2cs.CLcs.AIcs.LG

TL;DR

MLLMs remain vulnerable to jailbreaks, and holistic defenses across modalities, models, and attack types remain an open challenge. UniGuard optimizes image and text guardrails to reduce harmful responses. It improves robustness across attacks and transfers across models, with a small visual-question-answering trade-off.

  • Problem

    MLLMs remain vulnerable to adversarial jailbreaks, and holistic defenses spanning modalities, models, and diverse attack types remain an open challenge.

    Source: §1 · p. 1

  • Method

    UNIGUARD optimizes modality-specific image-noise and text-suffix guardrails on harmful-response examples while accounting for cross-modal signals.

    Source: §1 · pp. 1–2

  • Results

    UNIGUARD improves robustness across attacks and transfers across MLLMs; it reduces LLAVA attack success rate by nearly 55%, with a small visual-QA performance-safety trade-off.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The demonstrated transferability makes a guardrail developed for LLAVA applicable to additional open-source and proprietary MLLMs.

    Source: §1 · p. 2

    The current design safeguards image and text inputs; extending it to audio or video would broaden applicability, while model-specific tailoring costs additional computation.

    Source: D. Limitation · p. 11

Abstract

from arXiv · show

Multimodal large language models (MLLMs) have revolutionized vision-language understanding but remain vulnerable to multimodal jailbreak attacks, where adversarial inputs are meticulously crafted to elicit harmful or inappropriate responses. We propose UniGuard, a novel multimodal safety guardrail that jointly considers the unimodal and cross-modal harmful signals. UniGuard trains a multimodal guardrail to minimize the likelihood of generating harmful responses in a toxic corpus. The guardrail can be seamlessly applied to any input prompt during inference with minimal computational costs. Extensive experiments demonstrate the generalizability of UniGuard across multiple modalities, attack strategies, and multiple state-of-the-art MLLMs, including LLaVA, Gemini Pro, GPT-4o, MiniGPT-4, and InstructBLIP. Notably, this robust defense mechanism maintains the models' overall vision-language understanding capabilities.

1. Introduction

MLLMs face jailbreak attacks, while holistic defenses spanning modalities, models, and attack types remain an open challenge. UniGuard optimizes modality-specific guardrails and reports improved robustness across attacks and models, with a small visual-question-answering trade-off.

1. Introduction

  • MLLM jailbreaks exploit model weaknesses to elicit toxic outputs, while holistic defenses across modalities, models, and attack types remain an open challenge.Source: §1 · p. 1
  • UNIGUARD builds modality-specific image-noise and text-suffix guardrails, accounting for cross-modal interactions and minimizing harmful-response likelihood on a small toxic corpus.Source: §1 · pp. 1–2
  • Nearly 55% lower attack success rate on LLAVA; guardrails transfer to other MLLMs, with a small visual-QA performance-safety trade-off.The guardrails also transfer to proprietary Gemini Pro and GPT-4o without compromising overall vision-language abilities.Source: §1 · p. 2
  • The paper presents UNIGUARD as a multimodal defense mechanism for improving MLLM robustness against jailbreak attacks.Source: §1 · p. 2

2. Proposed Method: UNIGUARD

UNIGUARD optimizes image and text guardrails for prompts that may contain either or both modalities. Image noise is optimized against harmful outputs, while text guardrails use optimized suffixes or a fixed instruction.

2. Proposed Method: UNIGUARD

  • The conversational setup covers prompts containing images, text, or both, and optimizes modality-specific guardrails against jailbreak attacks.Source: §2 · p. 2

2.1. Image Safety Guardrail

  • Image guardrail v_sg is PGD-optimized additive noise against harmful-sentence likelihood over corpus C, under a noise bound and unconstrained adversarial-image setting.The resulting noise is added to adversarial images; the authors say its bounded magnitude does not significantly affect vision-language capabilities or image integrity.Source: §2.1 · pp. 2–3

2.2. Text Safety Guardrail

  • Text guardrails rank candidate tokens by their gradient-based reduction of harmful-content probability, replace suffix tokens, and append the resulting x_sg to the input prompt.Source: §2.2 · p. 3
  • The text method also allows a fixed human-written instruction; at inference, guardrails are applied without backward passes or gradient calculations.Source: §2.2 · p. 3

3. Evaluation

The evaluation tests UNIGUARD across visual and text attacks, models, and tasks. It reports lower jailbreak success alongside generally retained vision-language performance, with trade-offs depending on guardrail settings.

3.1. Overall Performances

  • 25% attack success ratio, a 55% and 12% improvement over the original model and best baseline, respectively; UNIGUARD outperforms unimodal defenses.Pre-defined and optimized text guardrails perform comparably, while the optimized safeguard has lower attack success and better threat and toxicity identification.Source: §3.1 · p. 4, Table 1 · p. 5, Table 2 · p. 5

3.4. Ablation Studies

  • Across tested MLLMs, UNIGUARD has the lowest attack success ratio among defenses; on MiniGPT-4, text guardrails reduce it from 37.20% to 25.88% or 24.98%.GPT-4o pre-filters about 30% of adversarial prompts, and 10% of those remaining lead to successful jailbreaks; UNIGUARD still enhances its robustness.Source: Figure 3 · p. 6, §3.4 · pp. 7–8

3.3. Sensitivity Analysis

  • Increasing image noise constraint ϵ generally lowers attack success but can reduce benign-task accuracy; ϵ = 32/255 and text-guardrail length L = 16 are preferred balances.Shorter text guardrails may protect less, while longer ones can produce low-quality responses.Source: §3.3 · p. 6

3.4. Ablation Studies

  • Multimodal guardrails achieve lower attack success than unimodal variants, image guardrails contribute more than text guardrails, and optimized text guardrails lower attack success but increase perplexity.On MM-Vet, UNIGUARD also yields performance comparable to the original LLaVA models at ϵ = 32/255.Source: §3.4 · p. 7, Figure 6 · p. 7

3.2. Effects on General Vision-Language Capabilities

  • On 1,000 A-OKVQA pairs, robustness gain (+50∼+55%) outweighed accuracy loss (0.2% and 5.9%); MM-Vet accuracy impact was minimal at ϵ = 16/255 or 32/255.The reported A-OKVQA drop may reflect image-detail obscuring and optimized text guardrails confusing Q&A instructions.Source: §3.2 · pp. 5–6, Figure 4 · p. 6, Table 3 · p. 7

3.5. Qualitative Analysis on Sample Answers

  • In two examples, UNIGUARD replaces inflammatory or personally attacking language with more neutral phrasing.The examples describe softened wording and a shift from accusatory to neutral tone.Source: §3.5 · p. 8

4. Related Work

The related work introduces MLLMs as language models extended with visual encoders. It reviews jailbreak risks and defenses, including image purification and text-prompt perturbation.

4.1. Multimodal Large Language Models (MLLMs)

  • MLLMs integrate visual encoders into LLMs for general-purpose visual and language understanding, with both open-source and proprietary examples.The paper primarily focuses on open-source models because accessible fine-tuning data and weights support protocol development and evaluation.Source: §4.1 · p. 8

4.2. Adversarial Attacks and Defenses on LLMs

  • Jailbreaks can bypass safety guardrails and elicit toxicity or bias; reviewed defenses include diffusion purification and randomized perturbation with prediction aggregation.DiffPure’s time requirements and sensitivity to image colors limit its applicability in real-time settings and against color-related corruptions.Source: §4.2 · p. 8

5. Conclusion

The conclusion presents UNIGUARD as a multimodal defense framework for improving MLLM robustness against jailbreak attacks.

5. Conclusion

  • UNIGUARD optimizes multimodal safety guardrails to address adversarial input features and reduce the likelihood of harmful content generation.Source: §5 · p. 8

Impact Statement

The impact statement discusses UNIGUARD’s possible role in safety-sensitive MLLM applications. It frames safer outputs and further secure-model research as potential broader effects.

Impact Statement

  • The statement identifies social media, clinical diagnosis, education, content moderation, and customer service as applications where MLLM safety matters.Source: Impact Statement · p. 8
  • The authors suggest robust defenses could support safer online environments by minimizing harmful content generation and potentially reducing misinformation, hate speech, and other malicious outputs.Source: Impact Statement · pp. 8–9
  • The authors aim to inspire further research on secure and reliable MLLMs for diverse applications.Source: Impact Statement · p. 9

A. Results on MiniGPT-4 and InstructBLIP

Across MiniGPT-4 and InstructBLIP, UniGuard lowers attack success ratios more than the defense baselines across the evaluated visual and text attacks, supporting transferability across models.

A. Results on MiniGPT-4 and InstructBLIP

B. Attack Effectiveness with Random Noise

The experiments omit random-noise attacks as relatively trivial and focus on optimization-based adversarial samples, which are described as more challenging to defend against.

B. Attack Effectiveness with Random Noise

C. Results on Additional Attack Types

The additional evaluation uses two subsets of attacks proposed by Zong et al. (2024), and reports lower attack success ratios than VLGuard in most cases across text and vision modalities.

C. Results on Additional Attack Types

D. Limitation

The authors identify model-specific tailoring, additional modalities, safety-performance balance, and text-guardrail fluency as areas for further improvement.

D. Limitation

  • Model-specific guardrails could improve defenses but require additional computational resources, leaving developers to balance them against universal guardrails.Source: D. Limitation · p. 11
  • UniGuard currently covers image and text inputs; extending it to audio and video is identified as future work.Source: D. Limitation · p. 11
  • The authors identify a trade-off between reducing output toxicity and maintaining model performance.Source: D. Limitation · p. 11
  • The authors note that training and prompt engineering could be improved to increase fluency and performance with optimized and predefined text guardrails.Source: D. Limitation · p. 11

E. Ethical Considerations

The ethical discussion identifies risks from harmful training data, evolving attacks, and safety filters that may suppress benign or creative content. It also warns that filtering bias could disproportionately affect marginalized communities.

E. Ethical Considerations

  • A small harmful-content corpus creates risks of misuse and toxic-information leakage.The authors call for safeguards against unintended exploitation or exposure.Source: E. Ethical Considerations · p. 11
  • No defense strategy can guarantee complete coverage as attack techniques evolve, particularly across social and cultural contexts.The authors say relying solely on one system risks exposure to novel attacks and calls for continuous refinement.Source: E. Ethical Considerations · p. 11
  • Overly restrictive filters may suppress legitimate or creative outputs by misclassifying benign inputs as harmful.The discussion names satire and artistic expression among the applications that may be affected.Source: E. Ethical Considerations · pp. 11–12
  • Safety guardrails may embed bias through their training data and optimization, disproportionately affecting marginalized communities whose language is more often flagged as harmful.The authors connect this risk to models’ cultural or linguistic understandings.Source: E. Ethical Considerations · pp. 12–13
Loading 2411.01703v2…