PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations

Mang Ye, Xuankun Rong, Wenke Huang, Bo Du, Nenghai Yu, Dacheng Tao

arXiv:2502.14881v1cs.CRcs.CV

TL;DR

LVLM safety research lacks a comprehensive view connecting attacks, defenses, and evaluations across multimodal vulnerabilities. This survey builds a lifecycle-based synthesis, evaluates Deepseek Janus-Pro, and identifies future research directions, finding that Janus-Pro’s safety performance remains a significant limitation across multiple benchmarks.

  • Problem

    LVLMs introduce unique multimodal vulnerabilities, while existing safety surveys do not comprehensively integrate attacks, defenses, and evaluations.

  • Method

    The survey unifies attacks, defenses, and evaluations through a lifecycle-based framework distinguishing inference-phase and training-phase methods, and synthesizes benchmarks and safety metrics.

  • Results

    Across multiple benchmarks, Janus-Pro’s safety performance remains a significant limitation and fails to meet the basic safety standards of most other models.

  • Takeaways & Limitations

    The survey provides future research directions and strategic recommendations for enhancing LVLM safety and robustness in reliable deployment.

Abstract

from arXiv · show

With the rapid advancement of Large Vision-Language Models (LVLMs), ensuring their safety has emerged as a crucial area of research. This survey provides a comprehensive analysis of LVLM safety, covering key aspects such as attacks, defenses, and evaluation methods. We introduce a unified framework that integrates these interrelated components, offering a holistic perspective on the vulnerabilities of LVLMs and the corresponding mitigation strategies. Through an analysis of the LVLM lifecycle, we introduce a classification framework that distinguishes between inference and training phases, with further subcategories to provide deeper insights. Furthermore, we highlight limitations in existing research and outline future directions aimed at strengthening the robustness of LVLMs. As part of our research, we conduct a set of safety evaluations on the latest LVLM, Deepseek Janus-Pro, and provide a theoretical analysis of the results. Our findings provide strategic recommendations for advancing LVLM safety and ensuring their secure and reliable deployment in high-stakes, real-world applications. This survey aims to serve as a cornerstone for future research, facilitating the development of models that not only push the boundaries of multimodal intelligence but also adhere to the highest standards of security and ethical integrity. Furthermore, to aid the growing research in this field, we have created a public repository to continuously compile and update the latest work on LVLM safety: https://github.com/XuankunRong/Awesome-LVLM-Safety .

1 INTRODUCTION

LVLM safety research must address multimodal vulnerabilities and the gaps in existing surveys. This survey integrates attacks, defenses, and evaluations through a lifecycle-based framework, evaluates Deepseek Janus-Pro, and identifies future directions.

  • Motivation: LVLMs introduce multimodal vulnerabilities because visual perturbations can cascade with deceptive text into unsafe or harmful outputs.Alignment difficulties and backdoor susceptibility further increase security concerns.
  • Research gap: Existing surveys often examine limited attack types or modalities rather than integrating the full spectrum of LVLM safety concerns.The cited surveys emphasize image manipulation or jailbreaking but do not sufficiently cover backdoors and cross-modal interactions.
  • Contributions: The survey systematically integrates attacks, defenses, and evaluations to provide a holistic analysis of LVLM vulnerabilities and mitigation strategies.It treats these components as interconnected rather than examining attacks or defenses in isolation.
  • Contributions: A lifecycle-based classification organizes security research by inference and training phases, with further subcategories for granular analysis.The framework is applied while exploring the methodologies and contributions of individual works.
  • Contributions: The paper evaluates Deepseek Janus-Pro and outlines future research trajectories and strategic recommendations for safer, more robust deployment.The survey covers attacks, defenses, and evaluations and discusses deployment in mission-critical applications.

2 BACKGROUND

LVLMs combine visual and textual processing but introduce additional safety vulnerabilities, including visual attack surfaces and weakened alignment. The section organizes LVLM safety interactions by access level and attacks by objectives and manipulation strategies.

  • Background: LVLMs combine visual features with language processing, enabling multimodal inputs but creating safety challenges involving toxic or misleading outputs.Visual integration expands attack surfaces and can weaken safety alignment during fine-tuning.
  • Model Access Capabilities: White-box, gray-box, and black-box capabilities classify attacks and defenses by the model knowledge accessible to the interacting entity.White-box access includes parameters, architecture, gradients, inputs, and outputs; gray-box access is partial; black-box access is limited to queries and outputs.
  • Model Access Capabilities: White-box access supports precise gradient computation, whereas gray-box settings can use surrogate models and black-box settings reflect real-world query-only interactions.These access levels determine how adversarial inputs and defensive strategies can be developed or tested.
  • Attack Objectives: LVLM safety attacks comprise targeted attacks that seek predefined incorrect outputs, untargeted attacks that produce any incorrect output, and jailbreak attacks that bypass safety constraints.Targeted and untargeted attacks can use input modifications or crafted queries, while jailbreaks exploit safety-alignment or prompt-handling flaws.
  • Attack Strategies: Attack strategies manipulate model inputs or training data, including perturbation-based attacks and poison-based attacks that inject malicious data during training.Poisoned data can introduce biases, cause misclassifications, or degrade generalization while remaining difficult for trainers to detect.

3 ATTACK

The survey organizes LVLM attacks across inference and training phases, with inference attacks further distinguished by attacker knowledge and multimodal manipulation. These attacks exploit visual, textual, and cross-modal vulnerabilities to induce incorrect, harmful, or unsafe outputs.

  • Inference-Phase Attacks: Inference-phase attacks use malicious inputs without modifying model parameters or architecture and are categorized as white-box, gray-box, or black-box attacks.The categories reflect the attacker’s available model knowledge and capabilities.
  • White-Box Attacks: White-box attacks require complete internal access and iteratively optimize image perturbations using model gradients to produce targeted outputs.They include single-modality perturbations and multimodal attack strategies.
  • Cross-Modality Attacks: Multimodal attacks embed toxic semantics into adversarial images and combine them with adversarial text to increase harmful-response generation.BAP similarly perturbs images and rewrites text, while HADES uses typography, harmful generated images, and appended adversarial images.
  • Gray-Box Attacks: Gray-box attacks exploit partial architectural knowledge, including known vision encoders, to construct surrogate-based adversarial images.These attacks operate without complete access to model parameters or gradients.
  • Cross-Modality Attacks: JIP decomposes harmful prompts across modalities and achieves a high success rate across different LVLMs by bypassing textual-only safety alignment.Generic text and malicious visual or textual triggers are jointly embedded so their combination reaches dangerous regions.
  • Black-Box Attacks: Black-box attacks model real-world adversaries that rely only on queries and responses, using prompt engineering and malicious typography to bypass safety restrictions.Typography attacks introduce subtle textual perturbations into images to confuse model decision-making.

4 DEFENSE

The survey classifies LVLM defenses by lifecycle stage into inference-phase and training-phase strategies. This organization distinguishes deployment-time protection from mechanisms integrated during model development.

  • Defense Taxonomy: LVLM defenses are systematically divided into inference-phase and training-phase categories according to the model lifecycle.The same lifecycle distinction is used to organize attack methods.
  • Inference-Phase Defenses: Table 4 summarizes reviewed inference-phase defenses and distinguishes black-box from white-box capability.Its capability symbols encode the access assumptions of the defense methods.

4.1 Inference-Phase Defenses

Inference-phase defenses protect deployed LVLMs without retraining, offering lower overhead and flexibility against emerging threats. The survey groups them into input, internal, output, and multi-level strategies.

  • Overview: Inference-phase defenses are post-hoc deployment methods that avoid retraining while providing lower computational overhead, flexibility, and adaptability to new threats.They enhance the safety of pretrained models during inference.
  • Input Sanitization: Input sanitization analyzes, filters, or transforms prompts and images to neutralize malicious patterns and reduce susceptibility to attacks.CIDER iteratively removes adversarial image noise using semantic-distance differences relative to harmful queries.
  • Internal Optimization: Internal defenses correct visual-induced misalignment by modifying hidden representations at the model’s intermediate layers.CMRM applies PCA to activation differences between text-only and text-image inputs, then uses the principal direction to align multimodal representations closer to the text-only distribution.
  • Output-Level Defenses: Output-level defenses detect harmful responses and rewrite them into safe, constructive alternatives before delivery to users.MLLM-Protector separates harm detection from response detoxification to balance safety and utility.
  • Multi-Level Defenses: Multi-level defenses combine input, internal, and output strategies to provide comprehensive protection across the LVLM pipeline.ETA integrates input and output mechanisms and evaluates safety before generation.

4.2 Training-Phase Defenses

Training-phase defenses strengthen LVLM safety through data refinement and training strategies embedded in model development. The survey covers secure dataset construction, visual enhancement, and unlearning-oriented optimization.

  • Overview: Training-phase defenses integrate safety mechanisms into the model’s foundational training process, enabling autonomous mitigation of adversarial challenges.They are organized according to the data collection and processing pipeline.
  • Data-Driven Refinement: Secure training datasets support LVLM robustness and alignment by improving data quality, balance, and resilience against adversarial challenges.The survey reviews construction and refinement methods for safety-oriented datasets.
  • Data-Driven Refinement: Table 5 summarizes essential characteristics of reviewed training-phase defenses.The table provides an overview of methods within the training-phase defense taxonomy.
  • Data-Driven Refinement: 4,940 samples were produced after dataset balancing and adaptability improvements, with 599 reserved for testing.The dataset refinement result is reported as part of the survey’s discussion of secure dataset construction.
  • Training Strategies: Training strategies use optimization and fine-tuning paradigms to improve model safety, robustness, and alignment with safety objectives.The survey includes visual enhancement and selective removal of visual concepts among these strategies.
  • Training Strategies: SIU combines multifaceted fine-tuning datasets with Dual Masked KL-divergence Loss to unlearn targeted concepts while preserving LVLM utility.The approach uses a single representative image and targets four distinct unlearning objectives.

5 EVALUATION

The evaluation framework combines response-safety assessment methods, quantitative metrics, and benchmarks for strategy effectiveness and inherent safety capabilities. It highlights trade-offs among evaluation approaches and reports that attack effectiveness varies across LVLMs without uniform robustness.

  • Response Safety Evaluation: Safety assessment methods range from efficient rule matching to human, fine-tuned model-based, and GPT proxy-based evaluation, each with distinct coverage, scalability, or bias limitations.Rule matching lacks contextual understanding; human evaluation is resource-intensive and subjective; model-based assessment depends on training data and base-model capability; GPT proxy assessment is affected by bias and hallucination.
  • Safety Metrics: ASR measures the proportion of image-text queries eliciting unsafe responses, while SRI captures response severity and normalizes risk to a 0–100 scale.Lower ASR indicates greater attack safety, whereas higher SRI values indicate higher safety performance according to the survey’s definitions.
  • Safety Metrics: ASD scores unsafe-response severity from 0 to 3, while PAR measures score-0 responses and RR measures appropriate refusal of malicious queries.Lower ASD and higher PAR or RR indicate stronger safety performance.
  • Safety Benchmarks: Benchmarks distinguish strategy effectiveness from safety capability, covering attack and defense strategies alongside models’ inherent security capabilities.This division provides a framework for assessing both intervention effectiveness and model-level safety behavior.
  • Strategy Effectivity: MMJ-Bench standardizes jailbreak evaluation with multiple attacks and defenses, revealing that attack effectiveness varies across LVLMs and no model is uniformly robust.The benchmark combines three generation-based attacks, three optimization-based attacks, one proactive defense, and three reactive defenses.
  • Safety Capability: MM-SafetyBench evaluates image-based adversarial safety using 5,040 text-image pairs across 13 scenarios and reports ASR and RR for model vulnerability.The benchmark finds that many safety-aligned LVLMs remain highly susceptible to adversarial manipulation.

6 SAFETY EVALUATION ON JANUS-PRO

The survey evaluates Janus-Pro-7B on SIUO and MM-SafetyBench, finding uneven safety performance across task formats and safety-critical scenarios. Overall, the results identify substantial safety limitations despite the model’s multimodal capabilities.

  • Evaluation setup: Janus-Pro-7B uses SIUO and MM-SafetyBench to evaluate cross-modality alignment and safety-sensitive behavior.SIUO contains 167 samples across nine safety domains, while MM-SafetyBench evaluates scenarios including illegal activities, hate speech, and malware generation.
  • SIUO results: 84.43% ASR on SIUO OpenQA exceeds LLaVA-1.5-7B’s 78.44%, while Qwen-VL-7B-Chat and MiniGPT4-v2 report 58.68% and 58.08%.The survey describes Janus-Pro-7B as underperforming in open-ended question answering relative to comparable models.
  • SIUO results: 73.06% ASR on SIUO MCQA is competitive with Qwen-VL-7B-Chat’s 79.04% and MiniGPT4-v2’s 72.46%.The survey associates this stronger result with Janus-Pro’s performance on structured tasks.
  • MM-SafetyBench results: 36.08% ASR in MM-SafetyBench’s Illegal Activity scenario exceeds LLaVA-1.5-7B’s 25.77%, indicating weaker performance on several safety-critical scenarios.Janus-Pro consistently underperforms relative to the LLaVA series in the first six scenarios described by the survey.
  • Conclusion: Across multiple benchmarks, Janus-Pro fails to meet the basic safety standards of most other models.The survey links this limitation speculatively to its unified understanding-and-generation architecture and possible lack of safety-focused training.

7 OUTLOOK

The outlook emphasizes black-box attacks, cross-modality alignment, and broader safety fine-tuning as priorities for improving LVLM robustness. It also presents the survey as a systematic synthesis of more than 100 methods organized across the model lifecycle.

  • The Shift Towards Black-box Attacks: Black-box attacks are a future priority because they exploit LVLM capabilities without direct architectural access, improving transferability and resource efficiency.The survey highlights OCR, logical reasoning, associative memory, and multimodal integration as attack mechanisms, while noting that prompt-based defenses can mitigate current approaches.
  • Enhancing Safety through Cross-Modality Alignment: Future work should strengthen cross-modality alignment and contextual understanding to improve LVLM robustness and reliability in dynamic environments.The supplied outlook identifies joint visual-textual processing as a key area for future improvement.
  • Diversifying Safety Fine-Tuning Techniques: Safety fine-tuning should diversify through RLHF, adversarial training, multi-objective optimization, curriculum learning, and hybrid strategies.These approaches are proposed to improve safety while reducing the risk that traditional fine-tuning compromises general capabilities.
  • Survey scope: The survey analyzes more than 100 methods across LVLM attacks, defenses, and evaluations.It positions this synthesis as a comprehensive review of the field’s recent advances.
  • Survey framework: Attack and defense strategies are classified by lifecycle phase, distinguishing inference-phase from training-phase methods and adding detailed sub-classifications.The evaluation section also synthesizes relevant benchmarks and identifies open challenges.
Loading 2502.14881v1…