PaperlayerView exact revision on arXiv

Source-linked AI summary

SafeRI: Recognition and Intervention for Token-Level Safety Intervention in Large Vision Language Models

Caoyuan Ma, Tian Gu, Wenpu Liu, Weichu Xie, Shuai Dong, Yuqi Xu, Ji Zhao, Ziyue Wang, Wenzheng Chang, Taiqiang Wu, Yongfu Zhu, Wenqi Shao, Zheng Wang, Yinqiang Zheng

arXiv:2609.03544v1cs.CV

TL;DR

VLM safety risk can emerge during generation, while always-on alignment also modifies safe trajectories. SafeRI recognizes risk in partial responses and gates a safety LoRA for subsequent tokens; across four backbones it improves safety averages, and its conclusion reports a smaller alignment tax than always-on adaptation.

  • Problem

    VLM risk can emerge along an autoregressive response, so whether intervention is needed may depend on the evolving generation state rather than a one-shot prompt judgment.

    Source: Introduction · p. 1

  • Method

    SafeRI monitors prefix hidden states during decoding and activates a boundary-aligned LoRA on risky trajectories, leaving the frozen-backbone policy in place otherwise.

    Source: Introduction · p. 2, Streaming Risk Recognition · p. 4

  • Results

    SafeRI improves the safety average over the frozen Base model on all four backbones; on Qwen3.5-9B, safety rises from 86.56 to 88.88 while the general average changes from 67.85 to 67.64.

    Source: Safety–Utility Results · p. 5

  • Takeaways & Limitations

    Across model scales and families, SafeRI mitigates residual safety failures while incurring a smaller alignment tax than always-on adaptation.

    Source: Limitations and Conclusion · p. 7

    SafeRI relies on accurate detector calibration and fine-grained supervision of unsafe generation boundaries, and aggregate multimodal capability preservation does not imply uniform benchmark performance.

    Source: Limitations and Conclusion · p. 7

Abstract

from arXiv · show

Existing safety alignment methods for vision-language models usually modify the model behavior globally: once the safety parameters are trained or loaded, they participate in both unsafe and already-safe generations. This always-on intervention can unnecessarily perturb the model's original reasoning path and degrade general multimodal capabilities. We argue that safety alignment should be an on-demand intervention rather than a permanent modification to every decoding trajectory. To this end, we propose a streaming recognition and gated LoRA framework for intrinsic VLM safety. During autoregressive generation, a lightweight recognizer estimates whether the current pre-token generation state is safe or unsafe. Its output updates the LoRA gate for the following decoding step; otherwise, generation follows the frozen-backbone policy. The LoRA module is trained from unsafe prefixes, transition statements, and safe continuations, so that it learns to redirect unsafe generations back to safe responses after activation. Experiments across multiple safety and general-purpose benchmarks demonstrate the effectiveness of our method in post-alignment settings.

Introduction

VLM safety risk can emerge along generation trajectories, so prompt-only judgments may miss when intervention is needed. SafeRI monitors partial responses and gates a safety LoRA to redirect risky trajectories while preserving the frozen-backbone policy on safe ones.

Problem

  • Residual safety failures can be concentrated in a small subset of generation trajectories, making the evolving response—not only the prompt—relevant to deciding when to intervene.The same harmful-looking request may be refused safely or answered with actionable details, and an initially ambiguous request may reveal risk as the response unfolds.Source: Introduction · p. 1
  • Always-on safety alignment can perturb benign or already-refused trajectories, causing over-refusal, stylistic drift, or degraded multimodal utility when no correction is needed.The resulting safety-alignment tax reflects changes to hidden states and token probabilities.Source: Introduction · p. 1

SafeRI

  • SafeRI detects emerging risk from prefix hidden states during decoding and activates a LoRA behavior-correction module for subsequent tokens, while safe trajectories retain the frozen-backbone policy.Recognition decides when to intervene; the adapter redirects the future response toward a safe continuation.Source: Introduction · pp. 1–2

Training

  • The recognizer predicts whether the current prefix signals an unsafe next step, while LoRA learns from risky prefixes, transition statements, and safe continuations to redirect generation.Both components are supervised at the onset of unsafe generation, aligning the gate with the correction behavior.Source: Introduction · p. 2

Contributions

  • SafeRI frames post-alignment hardening as selective trajectory control, invoking safety parameters for risky responses while retaining the frozen policy for already-safe ones.The introduction also reports experiments across VLM families and ablations of gate thresholds, adapter placement, and activation causes.Source: Introduction · p. 2

Related Work

Prior VLM safety approaches intervene through fixed alignment, guardrails, or internal steering, but SafeRI focuses on deciding when an evolving response needs correction. It couples trajectory-level risk recognition with conditional activation of safety parameters.

Training-Time Safety Alignment

  • Training-time alignment methods encode safety in a fixed deployed parameter set, whereas SafeRI keeps the backbone frozen and activates learned safety parameters when generation indicates risk.Examples of prior work include targeted safety fine-tuning [Zong et al. 2024] and multimodal preference data [Zhang et al. 2024].Source: Related Work · p. 2

Inference-Time Guardrails

  • Inference-time guardrails include prompt-based defenses, multimodal input detectors, protection pipelines, and guard models, while SafeRI monitors the partial answer before activating safety parameters.Related conditional approaches include Safety Reminder and CASA [Tang et al. 2025; Kumar et al. 2026].Source: Related Work · p. 2

Internal Intervention and Conditional Adaptation

  • Internal steering and conditional adapters can modify inference behavior, but SafeRI connects them through hidden-state risk recognition that activates LoRA only on risky trajectories.The passage cites LoRA-Guard and Activated LoRA as related adapter approaches [Elesedy et al. 2024; Greenewald et al. 2025].Source: Related Work · p. 2

SafeRI Inference

  • At inference, a threshold crossing activates safety LoRA beginning with the next token, and renewed crossings reset a K-step window until risk remains stable long enough for the gate to close.Figure 2 depicts the uncorrected harmful trajectory above the corrected trajectory.Source: Figure 2 · p. 3

Method

SafeRI couples streaming recognition of pre-token risk with gated LoRA intervention, keeping the frozen-backbone policy when the gate is closed. Its training separates boundary detection from learning safe local corrections.

Problem Formulation

  • The gate carried from the previous step selects the current forward pass; the recognizer updates it for the following step, leaving already-computed logits unchanged.The gate is intended to remain closed unless a preceding recognition result indicates intervention is needed.Source: Problem Formulation · p. 3

Streaming Risk Recognition

  • A final-layer linear head scores the last prefix state for unsafe risk, and a threshold crossing renews a sticky activation window for subsequent forward passes.The gate closes after the K-step horizon expires without another threshold crossing, allowing return to the frozen-backbone path when the trajectory remains stable.Source: Streaming Risk Recognition · pp. 3–4

Gated LoRA Intervention

  • When enabled, gated LoRA updates selected projections to redirect generation; when disabled, those projections follow the frozen-backbone policy.The design expects the gate to remain inactive for benign tasks and harmful prompts the base model already refuses, and to open when the pre-token state is judged risky.Source: Gated LoRA Intervention · p. 4

Training Data Construction

  • Training examples pair a pre-risk prefix with a transition statement and safe continuation, teaching LoRA a local correction rather than a complete refusal template.The original risky suffix is discarded, and the recognizer is supervised at the boundary state so its score can update the next forward pass.Source: Training Data Construction · p. 4

Two-Stage Training Objective

  • Two-stage training first fits a boundary classifier and then trains LoRA to generate transition and safe-continuation tokens while the base VLM remains frozen.The manually chosen boundary can be ambiguous or tokenization-sensitive: an early boundary may cause unnecessary intervention, while a late one may allow unsafe content before activation.Source: Two-Stage Training Objective · pp. 4–5

Experiments

Experiments test SafeRI’s safety–utility behavior across backbones, verify whether its gate tracks answer state, and ablate LoRA placement, threshold, and intervention-window size. Safety averages rise across all four backbones, while aggregate general capability changes little on Qwen3.5-9B.

Experimental Setup

  • Experiments use Qwen3.5-9B and three transfer backbones, SPA-VL-relabeled supervision, five safety and three general benchmarks, and matched settings for reproduced or adapted baselines.The controlled baselines are SafeProbing, DTR, and IMMUNE.Source: Experimental Setup · p. 5

Safety–Utility Results

  • SafeRI raises Safety Avg. over Base on all four backbones; on Qwen3.5-9B it rises from 86.56 to 88.88 while General Avg. shifts from 67.85 to 67.64.Tables 1 and 2 report safety and general multimodal capability; Figure 3(a) summarizes their trade-off.Source: Safety–Utility Results · p. 5, Table 1 · p. 6, Table 2 · p. 7
  • On Qwen3.5-9B, SafeRI’s 88.88 Safety Avg. and 67.64 General Avg. compare with Always-on LoRA’s 89.41 and 60.44 and DPO’s 88.85 and 44.95; both global methods reduce general scores more on every backbone.SafeWork-R1 scores highest in safety (90.11), but its different backbone and non-public training data preclude a controlled comparison.Source: Safety–Utility Results · p. 6, Table 1 · p. 6, Table 2 · p. 7

Answer-State Validation

  • 0.885 precision, 0.920 recall, and 0.902 F1 at τ=0.8 separate safe and unsafe prefixes for identical XSTest prompts.The paired responses differ in answer trajectory while holding the prompt fixed.Source: Answer-State Validation · p. 6

Ablation Study

  • Middle- and last-five-layer LoRA each add 2.32 safety-average points, with general-average changes of −0.21 and −0.12; the main experiments use the middle-five layers.The first-five-layer configuration changes the safety average by +1.71 points and the general average by +0.37 points relative to Base.Source: Ablation Study · p. 6, Table 3 · p. 7
  • τ=0.8 gives the largest five-benchmark safety gain (+1.46 points); τ=0.0, 0.5, and 0.7 reduce the average by 1.17, 0.48, and 0.45 points.The sweep is non-monotonic: τ=0.9 gains 0.89 points; the authors use τ=0.8 as the best overall operating point.Source: Ablation Study · pp. 6–7, Figure 3 · p. 7
  • K=8 gives the highest aggregate safety and general scores; K=4 lowers General Avg. from 67.64 to 65.00, while K=12 yields Safety Avg. 86.54.The authors select K=8 as the best safety–utility trade-off.Source: Ablation Study · p. 7, Table 4 · p. 7

Limitations and Conclusion

SafeRI mitigates residual safety failures across model scales and families with less alignment tax than always-on adaptation. Its effectiveness depends on detector calibration and fine-grained boundary supervision, and capability preservation may vary by benchmark.

Limitations

  • SafeRI relies on accurate detector calibration and fine-grained supervision of unsafe generation boundaries.Aggregate multimodal capability preservation does not guarantee uniform performance across individual benchmarks; the safety–utility trade-off remains task-dependent.Source: Limitations and Conclusion · p. 7
  • The current off-policy training paradigm uses fixed trajectories to optimize recognition and intervention.The authors suggest on-policy or reinforcement-learning settings as a possible way for both components to adapt jointly to evolving-model trajectories.Source: Limitations and Conclusion · p. 7

Conclusion

  • Across model scales and families, SafeRI mitigates residual safety failures with a smaller alignment tax than always-on adaptation.The conclusion describes SafeRI as a transferable approach to hardening already aligned VLMs.Source: Limitations and Conclusion · p. 7
  • The insertion layer, gate threshold, and intervention window provide practical controls over the safety–utility trade-off.Source: Limitations and Conclusion · p. 7

A. Benchmark Details

The benchmark suite measures multimodal safety across harmful requests, adversarial images, and superficially unsafe-looking prompts, alongside general multimodal understanding and reasoning. Safety scores are reported so higher values indicate safer behavior.

Safety benchmarks

  • SPA-VL-test harm measures the percentage of responses judged harmless to safety-sensitive image–text requests, while AdvBench reports the safe-response rate against harmful instructions.HADES reports 100 −ASR for responses remaining safe under attacks using crafted visual inputs.Source: A. Benchmark Details · p. 10
  • XSTest penalizes both unsafe compliance and unnecessary refusal, while MSSBench Chat Task mean accuracy requires appropriate responses across safe and unsafe visual contexts.Safety benchmark values are percentages, with higher values indicating safer behavior; ASR-based benchmarks use 100 −ASR.Source: A. Benchmark Details · p. 10

General multimodal benchmarks

  • BLINK measures overall accuracy on visual-perception questions, MMBench reports English multiple-choice accuracy, and MM-Vet reports an aggregate open-ended reasoning score.MM-Vet’s unified evaluator covers six vision–language capabilities and their combinations.Source: A. Benchmark Details · p. 10

B. Multi-Agent Data Construction

The construction pipeline relabels SPA-VL examples around unsafe trajectory boundaries, then supplies a safe transition and continuation for intervention training. The case study illustrates closed-gate safe generation and gated correction after unsafe drift.

B. Multi-Agent Data Construction

  • The construction pipeline retains responses with meaningful unsafe trajectories, identifies the first safe-to-unsafe boundary, and preserves the preceding context as the pre-risk prefix.A stronger model then generates a brief transition statement followed by a complete safe continuation conditioned on that prefix.Source: B. Multi-Agent Data Construction · p. 10
  • Stage 1 trains the recognizer on boundary-aligned labels, while Stage 2 trains the intervention module on the transition and safe continuation.The source remains the original SPA-VL data; Stage 1 trains only the classifier head, and Stage 2 freezes it while training middle-five-layer LoRA parameters.Source: B. Multi-Agent Data Construction · p. 10, Table 5 · p. 11

C. Hyperparameter Settings

D. Case Study

  • In the case study, safe generation keeps the gate closed, while detected unsafe drift activates correction for subsequent tokens and the gate closes after risk subsides.The intervention redirects the continuation toward a safe refusal before generation returns to the frozen-backbone path.Source: D. Case Study · p. 11

E. Trainable Parameter Overhead

The classifier and middle-five-layer LoRA add a small trainable parameter budget relative to the frozen backbone. A separate case study depicts selective gating for safe and drifting trajectories.

E. Trainable Parameter Overhead

  • Figure 4 contrasts a safe trajectory that keeps the gate closed with unsafe drift that triggers correction before the gate closes after stabilization.Source: Figure 4 · p. 11
  • 4.1K–8.2K classifier parameters span evaluated backbones, and combined classifier-plus-LoRA overhead remains below 6.57M parameters.The LoRA adapters account for nearly all of the trainable parameter budget; Table 6 covers the classifier and middle-five-layer LoRA for each backbone.Source: E. Trainable Parameter Overhead · p. 11, Table 6 · p. 12

F. Inference Efficiency

Inference efficiency varies with both the intervention and the response length: Always-on has lower measured latency than the base model, while SafeRI incurs recognition overhead. On the harmful subset, SafeRI has higher throughput than Always-on but lower throughput than the base model.

F. Inference Efficiency

  • 7.525 to 5.023 seconds per sample: Always-on improves latency 33.2% over base; SafeRI reaches 8.929 seconds, 77.8% above Always-on and 18.7% above base.These measurements use the same 20 SPA-VL harmful examples, batch size 1, and a 1,024-token generation limit.Source: Table 7 · p. 12, F. Inference Efficiency · p. 12
  • 32.692 tokens/s for base, 13.627 tokens/s for Always-on, and 20.543 tokens/s for SafeRI; SafeRI throughput is 50.8% higher than Always-on.Base throughput benefits from fixed input-encoding and setup costs being amortized over its longer completions; higher throughput does not mean lower user-perceived latency.Source: Table 7 · p. 12, F. Inference Efficiency · p. 12
  • SafeRI produces fewer tokens than base but more than Always-on on this harmful subset; this length pattern does not indicate a universal reduction on arbitrary inputs.Recognizer evaluation and selective intervention add end-to-end latency despite SafeRI producing fewer tokens than base.Source: F. Inference Efficiency · p. 12

G. Activation Pattern Analysis

Most first activations are input-induced on benchmarks with risky-by-construction requests, but the detector also activates as risk emerges in partial answers and sometimes on benign states.

G. Activation Pattern Analysis

  • Most first activations are input-induced because the evaluated safety benchmarks predominantly contain requests that are risky by construction.The trigger mix should be read in light of the benchmark distribution, not as evidence that the detector relies only on prompts.Source: G. Activation Pattern Analysis · p. 12
  • Drift-based activations also occur when risk emerges in the partial answer, supporting monitoring of the evolving generation state.Source: G. Activation Pattern Analysis · p. 12
  • 3.87% to 7.95% of activations are safe false activations across the reported settings, showing that benign response states can occasionally trigger the detector.The authors identify these errors as one possible explanation for small utility regressions and motivate evaluating safe-versus-unsafe assistant positions under the same request.Source: G. Activation Pattern Analysis · p. 12

H. HarmBench PAIR Evaluation

The supplied results describe a PAIR robustness evaluation, a three-seed stability evaluation, and a manual audit of automatic judgments. The audit reports complete agreement for its sampled responses.

H. HarmBench PAIR Evaluation

I. Three-Seed Stability

  • Training stability is assessed for Qwen3.5-9B and Qwen3.5-2B across three random seeds, with aggregate safety and general multimodal scores reported as mean ± standard deviation.Source: §I · p. 13, Table 11 · p. 13

J. Human Review of Automatic Judgments

  • 100% of the 100 stratified responses audited had human labels matching the automatic judgments.Reviewers assessed outputs, automatic labels, and benchmark criteria, including whether safety responses contained concrete or actionable harmful assistance.Source: J. Human Review of Automatic Judgments · p. 13
Loading 2609.03544v1…