PaperlayerView exact revision on arXiv

Source-linked AI summary

Multimodal Safety Evaluation Should Measure Controllability Beyond Classification

Junhyeong Park, Hanwool Lee, DongGeon Lee, Dasol Choi, Yejin Son, Haon Park, Youngjae Yu

arXiv:2610.06452v1cs.AI

TL;DR

Behavioral safety classification is necessary, but it does not establish whether an internal safety signal is cross-modal or controllable. The paper evaluates controllability profiles with sparse feature decompositions, finding that internal readout and selective control can diverge across its two case studies. It argues for reporting these measurements alongside behavioral safety metrics.

  • Problem

    Input- and output-level classification does not establish whether an internal safety signal is recoverable, genuinely cross-modal, or editable without degrading benign behavior.

    Source: §1 · pp. 1–2

  • Method

    The paper evaluates four controllability-profile axes—detectability, cross-modal specificity, intervention sensitivity, and benign-preserving selectivity—using declared representations and interventions.

    Source: §3.1 · p. 3, §3.2 · p. 3

  • Results

    Across the case studies, behavioral safety classification and representation-level detectability do not determine whether a signal is genuinely multimodal or selectively controllable.

    Source: §5 · p. 7

  • Takeaways & Limitations

    Multimodal safety benchmarks should report modality counterfactuals, intervention response curves, and benign-side response curves alongside output metrics.

    Source: §5 · p. 7

    The profile requires white-box access, and intervention evidence is specific to the tested model, layer, feature basis, operator, and data regime.

    Source: Limitations · p. 7

Abstract

from arXiv · show

VLM safety is commonly evaluated through input- and output-level classification. Such classification is necessary, but it does not reveal whether a safety state is accessible or controllable inside the model. We argue that multimodal safety evaluation should therefore report a \emph{controllability profile} alongside behavioral classification, separating representation-level detectability, cross-modal specificity, intervention sensitivity, and benign-preserving selectivity. Using implicit toxicity as a stress case, we instantiate this profile on LlavaGuard and Qwen3.5 with sparse feature decompositions. LlavaGuard admits localized handles with a narrow benign-preserving intervention range and modest downstream safety gains, whereas Qwen3.5 supports strong representation-level readout but no comparable selective-control regime under the tested operators. These results show that internal readout and controllability can diverge. Future multimodal safety benchmarks should therefore report not only behavioral safety metrics, but also whether safety-relevant internal signals can be intervention-tested and controlled within a validated operating range.

1 Introduction

Multimodal safety failures can arise from interactions between inputs that seem benign in isolation, making implicit toxicity a diagnostic stress case. The paper argues that behavioral classification should be complemented by evaluating whether internal safety signals are detectable, multimodally specific, intervention-sensitive, and selectively controllable.

1 Introduction

  • Implicit toxicity stresses multimodal evaluation because harmful behavior can arise from interactions between inputs that appear benign in isolation.The paper presents it as a diagnostic case, not the only VLM safety concern.Source: §1 · p. 1
  • Input- and output-level classification is necessary, but a correct behavioral label does not establish that an internal safety state is recoverable, cross-modal, or editable without harming benign behavior.Figure 1 contrasts output classification with controllability evaluation, which also tests internal handles and benign-side effects.Source: §1 · pp. 1–2, Figure 1 · p. 1
  • The paper argues that intervention-validated control should be an evaluation target alongside classification, using declared representations to assess prediction, multimodal specificity, intervention response, and benign preservation.It does not propose replacing classification or treating a particular steering algorithm as the endpoint of VLM safety.Source: §1 · p. 2
  • The proposed controllability profile separates representation-level detectability, cross-modal specificity, intervention sensitivity, and benign-preserving selectivity.The paper presents case studies as illustrative rather than prescriptive, without assuming a universal latent safety structure.Source: §1 · p. 2

2 Why classification alone is incomplete

The paper distinguishes behavioral classification from questions about the internal signals that support safety decisions. It motivates testing whether those signals depend on image-text interactions, remain informative when observed patterns change, and can be evaluated separately from behavioral metrics.

2.1 Multimodal shortcuts obscure interaction-specific safety signals

  • Output accuracy alone does not establish that an internal safety signal depends on the image-text interaction rather than a unimodal shortcut.The paper therefore calls for direct modality-specificity tests.Source: §2.1 · p. 2

2.2 Distribution shift exposes boundary dependence

  • Post-hoc classifiers learn boundaries over observed failures, while attack variations motivate testing whether a declared internal representation remains readable and responds to intervention.Examples include typographic visual prompts, image perturbations, and attacks targeting internal safety boundaries.Source: §2.2 · p. 2
  • The paper distinguishes its evaluative aim from prior mechanistic-control methods: benchmarks should separately measure detectability, cross-modal specificity, intervention sensitivity, and benign preservation.Table 1 positions controllability as a reporting target distinct from behavioral safety-failure evaluation and intervention methods.Source: §2.2 · p. 2, Table 1 · p. 3
  • Context-flip evaluation in text-only safety and this work probe different axes of the gap between recognizing a safety condition and demonstrating reliable control.This paper focuses on the mechanistic axis in multimodal models.Source: §2.2 · p. 3

2 Why classification alone is incomplete

  • Behavioral classification and controllability profiles answer different safety questions and should be reported separately.The paper frames its concern as what remains unmeasured about internal signals that may be entangled, shortcut-driven, or difficult to edit.Source: §2 · p. 2, §2.2 · p. 3

3 Controllability profiles

The paper defines controllability profiles as separate measurements of internal signal readout and intervention, rather than as a safety certificate or a single score. Its protocol conditions claims on declared representations, handles, operators, targets, and benign-side effects.

3.1 Four axes of the profile

  • A controllability profile reports four distinct properties: representation-level detectability, cross-modal specificity, intervention sensitivity, and benign-preserving selectivity.The profile is not a safety certificate, and input/output classification remains a separate behavioral metric.Source: §3.1 · p. 3
  • A candidate handle can be any explicitly editable internal unit, direction, subspace, sparse coordinate, or learned representation; localization alone does not establish control.A handle becomes informative only after its intervention response and benign side effects are measured.Source: §3.1 · p. 3
  • Comparisons require reporting the representation, probe, modality counterfactual, handle basis, operator, proximal target, benign-side metric, downstream metric, and validated operating range.The paper treats controllability as protocol-conditioned rather than an intrinsic scalar attribute.Source: §3.1 · p. 3

3.2 From readout to interventional evidence

  • Probing establishes predictiveness, whereas editing a candidate handle and measuring its response tests directional leverage over a declared target.An intervention effect is local evidence conditioned on model, layer, feature basis, operator, and target; it does not certify global safety.Source: §3.2 · pp. 3–4
  • Robustness under distribution shift must be measured rather than assumed, and profiles should record both successful and failed control regimes.The intervention effect of a stable pathway may persist under some shifts, but persistence is not presumed.Source: §3.2 · p. 4

3.3 Cross-modal specificity under entangled representations

  • A direct modality-counterfactual test compares an original image-text pair with image-only and text-only variants to assess whether a readout depends on their interaction.The empirical section uses sparse feature decompositions to test whether profile axes separate across models.Source: §3.3 · p. 4
  • Sparse dictionaries can expose localized coordinates, but the paper does not assume harmful behavior always admits a compact or monosemantic handle.Safety states may instead be distributed, text-dominant, or nonselective.Source: §3.3 · p. 4

4 Empirical stress tests for controllability profiles

The empirical stress tests apply an SAE-based controllability profile to two VLMs using implicit toxicity as a diagnostic case. Their results show that strong readout and intervention sensitivity do not guarantee cross-modal specificity or selective control.

4.1 Experimental setup

  • The shared protocol evaluates LlavaGuard-v1.2-7B-OV and Qwen3.5-9B on implicit toxicity, using MDIT-Bench for signal identification and HoliSafe for generation-level validation.The models differ in training objective and intended role, so their profile differences are not attributed to a single architectural or training factor; pooled hidden states at layer 24 and a TopK-SAE support the probes and candidate-handle ranking.Source: §4.1 · p. 4, §4 · p. 4

4.3 Intervention sensitivity does not imply selective control

  • Only LlavaGuard has a clean top-k range (k = 4–8) that suppresses the implicit signal while preserving benign behavior; Qwen3.5 has no comparable range under the tested operator.Qwen3.5’s small edits can suppress the signal but larger edits rebound or enter collapse; LlavaGuard’s deletion and insertion tests also move the proximal signal in complementary directions. Candidate-handle rank alone does not establish selectivity.Source: Figure 2 · p. 5, §4.3 · p. 6

4.2 Representation-level detectability does not imply cross-modal specificity

  • LlavaGuard’s proxy-residual probe reaches 98.3% and 98.4% on random and holdout splits, with R_xmod at 88.9% versus 12.5% for pooled-hidden readout.The residual readout’s mean implicit-class probability falls from 0.862 on the original pair to 0.017 when the image is removed.Source: §4.2 · p. 5, Table 2 · p. 6
  • Qwen3.5’s hidden MLP reaches 87.7% and 88.2% on random and holdout splits, yet its R_xmod is 3.7%; residualization raises R_xmod to 21.0%.Its text-only implicit-class probability (0.824) slightly exceeds the original-pair score (0.812), and the signal remains less interaction-specific than LlavaGuard’s.Source: §4.2 · pp. 5–6

4.4 Downstream validation is a separate test

  • LlavaGuard’s selected projection clamp decreases ASRSSU by 3.5 points under GPT-5.2 and 7.5 points under Claude Sonnet 4.5 at α = 1.0, while RRSSS remains 0.0%.The gain is described as modest but consistent across judges; downstream generation is a separate validation because residual-stream projection and decoding differ from proximal SAE-latent edits.Source: §4.4 · pp. 6–7, Table 3 · p. 7

5 Discussion and Call to action

Behavioral classification and representation-level detectability do not establish whether safety signals are genuinely multimodal or selectively controllable. The discussion recommends additional measurements and frames their scope around white-box evaluation and local, auditable results.

5 Discussion and Call to action

  • Behavioral classification and representation-level detectability do not determine whether a signal is genuinely multimodal or selectively controllable.Reporting only behavioral or probe accuracy would miss that distinction.Source: §5 · p. 7
  • Benchmarks should add modality counterfactuals, intervention response curves, and benign-side response curves alongside standard output metrics.Generation-level safety metrics remain a separate downstream validation layer.Source: §5 · p. 7
  • The profile primarily targets developers, providers, and auditors with authorized white-box access; API-only use requires standardized diagnostic hooks or equivalent interfaces.White-box access is part of the evaluation setting, not an assumption about every downstream user.Source: §5 · p. 7
  • The evaluation is intentionally local: a failed test identifies a signal that is not selectively controllable under the declared regime, rather than certifying a universal safety mechanism.The goal is to make such successes and failures comparable and auditable.Source: §5 · p. 7

6 Conclusion

Behavioral classification performance is not a proxy for internal controllability. Across two case studies, the profile axes separate, motivating complementary reporting alongside output-level performance.

6 Conclusion

  • Across two case studies, LlavaGuard shows a narrow selective operating range while Qwen3.5 lacks comparable selective control under the tested operators.The paper argues for reporting declared representations, intervention protocols, and benign-side effects alongside output-level performance.Source: §6 · p. 7

Limitations

The study is a case study, not a complete safety solution: its findings depend on white-box access and tested models, operators, and data regimes. The appendix also defines the safety-class categories used there.

Limitations

  • The profile requires white-box access, and intervention results are operator-specific rather than global causal certificates.Results are conditioned on the tested model, layer, feature basis, operator, and data regime; clean selective handles are model-dependent.Source: Limitations · p. 7

A Extended Experimental Results

A.1 Feature Analysis

The appendix ranks SAE latents by an interaction score and reports feature statistics and intervention data. Benign-side clamping results show that LlavaGuard has a limited tested operating range rather than a rank-only selection rule.

A.1 Feature Analysis

  • LlavaGuard and Qwen3.5 feature statistics and ranked interaction features are reported in Tables 4–7, with top-20 ranks used consistently across intervention tests.The default SAE has 16,384 latent coordinates, with 512 interaction candidates retained.Source: §A.1 · p. 11, Table 4 · p. 11, Table 5 · p. 11
  • Tables 8 and 9 report the deletion and insertion values underlying the plotted curves for LlavaGuard and Qwen3.5-9B, respectively.Source: §A.1 · p. 11, Table 8 · p. 12, Table 9 · p. 12

A.2 Utility Preservation Details

  • For LlavaGuard, clamping one feature collapses benign samples to the explicit class, while k = 4 and k = 8 provide the cleanest tested operating range; larger clamps again induce collapse.The response is measured by the SAE-latent internal classifier pz; Tables 10 and 11 are captioned as benign-sample clamping side effects for LlavaGuard and Qwen3.5-9B.Source: §A.2 · p. 13, Table 10 · p. 13, Table 11 · p. 13

A.3 Geometric Analysis of Feature Entanglement

Geometric overlap alone does not identify behaviorally selective handles, so candidate features require behavioral validation. Across the reported case studies and implementation discussion, control is model-dependent, incurs an up-front discovery cost, and offers limited rather than complete prevention.

A.3 Geometric Analysis of Feature Entanglement

  • LlavaGuard’s validated handle #1519 has high benign overlap yet selectively suppresses pz(implicit) while preserving pz(benign), so geometric overlap alone is not a reliable selector.The geometric diagnostics generate candidates; behavioral ablation determines selectivity.Source: §A.3 · p. 13, Table 13 · p. 14

A.4 Behavioral Handle Ablation

  • Qwen3.5 has no single-feature or small-set handle that suppresses pz(implicit) while preserving pz(benign); strong suppressors collapse benign samples.In LlavaGuard, restricted rank-1 feature #8180 also collapses benign samples, while behaviorally selected feature #1519 is validated as selective.Source: Table 15 · p. 14, §A.4 · p. 14, Table 14 · p. 14

B Alternative Views

  • The authors position white-box control as a complement to output-level testing, red-teaming, and deployment governance, not a replacement for them.They describe controllability as an evaluation axis rather than a safety certificate.Source: B Alternative Views · p. 14

B.1 “Is Inference-time Intervention Too Slow?”

  • Inference-time intervention uses element-wise operations on intermediate activations without additional forward passes or gradient computations, and the reported measurement found no meaningful latency increase.The interventions use a sparse feature subset and a single projection at layer 24.Source: §B.1 · p. 15

B.2 Does White-box Control Cost More?

  • Activation extraction dominates the one-time analysis cost, while runtime projection adds no measurable latency at the tested scale; model or distribution changes may require re-identification and revalidation.The authors do not claim white-box control is universally cheaper than black-box filtering.Source: §B.2 · p. 15

B.3 “Can’t Strong LLM-as-a-Judge Solve This?”

  • The authors identify black-box judges’ potential blind spots, expense, and post-hoc timing as limitations; their intervention acts before final-response judging but reduces unsafe generations conservatively rather than eliminating harm.The judge’s post-hoc role detects harm after generation, whereas the intervention is preventative in the limited sense of occurring earlier.Source: §B.3 · p. 15

B.4 “Does This Break Utility (Benign Capability)?”

Within the evaluated settings, behaviorally validated operating ranges show limited utility loss, but the selected handles are not globally disentangled from benign capabilities. Controllability therefore does not certify safety or replace other evaluation and governance measures.

B.4 “Does This Break Utility (Benign Capability)?”

  • In proximal SAE-latent tests, clamp sizes k = 4–8 suppress pz(implicit) while preserving pz(benign), and HoliSafe shows no increase in RRSSS.The authors report limited utility loss under the evaluated settings when the operating range is behaviorally validated.Source: §B.4 · p. 15
  • Selected handles are associated with implicit-toxicity interactions under the diagnostics, but are not established as globally disentangled from all benign capabilities.The empirical operating range does not guarantee transfer to other models, datasets, or decoding settings.Source: §B.4 · pp. 15–16

B.5 “Does controllability certify safety?”

  • Controllability is an evaluation axis, not a safety certificate, and remains complementary to output-level testing, red-teaming, and deployment governance.A model may expose handles for some harmful trajectories while failing on others, and interventions may be misconfigured or used outside validated regimes.Source: §B.5 · p. 16

C.1 Extended Experimental Setup

The extended setup documents the dataset splits, metrics, probes, feature selection, intervention operators, and judge protocol used in the case study. These details define how internal signals and generated behavior were measured and how candidate features were tested.

C.1 Extended Experimental Setup

  • MDIT-Bench was reorganized into benign, explicit, and implicit classes, with random and group-holdout splits for in-domain experiments and OOD sensitivity tests, respectively.The random split used 178,682 training and 76,578 validation samples; the group-holdout split used 177,588 training and 77,672 validation samples.Source: §C.1 · p. 16

C.2 SAE Training Details

  • The TopK-SAE was trained on mean-pooled layer-24 MDIT-Bench training states; its sparse representation uses 16,384 latent coordinates with 128 active coordinates, and activation extraction took about 15 hours on four A6000 GPUs.The SAE training took about 28 minutes on one NVIDIA A6000 GPU; the projection intervention averaged 3.09 s/sample versus 3.13 s/sample without intervention in a 50-sample benchmark.Source: §C.2 · p. 17

C.3 Baseline Implementation

  • The pooled MLP probe predicts benign, explicit, and implicit safety classes from mean-pooled layer-24 hidden states, while the proxy-residual probe uses residualized unimodal contributions with the same architecture and training protocol.The pooled-hidden MLP has dimensions 4096 → 1024 → 256 → 3; the proxy residual is defined in Section 4.Source: §C.3 · p. 17

C.4 Interaction Feature Selection

  • Feature interaction strength is computed per SAE feature using an ANOVA-style scalar residual to isolate image-text interaction, then aggregated over implicit-toxicity samples to rank candidates.The study retains 512 unrestricted candidates and restricts pz-based interventions to classifier-consumed coordinates.Source: §C.4 · p. 17

C.5 Intervention Implementation Details

  • Latent-space deletion, insertion, and clamping modify ranked classifier-aware SAE coordinates, while runtime mitigation projects the layer-24 residual-stream vector.The intervention set is a selected subset of SAE interaction candidates; clamp size k counts the coordinates clamped to zero.Source: §C.5 · pp. 17–18

C.6 LLM Judge Prompts and Decision Rules

  • The HoliSafe judge assesses adherence using the image, query, safety label, and model response, mapping safe labels to helpful non-harmful responses and unsafe labels to clear refusals.The protocol maps SSS to safe and SSU, USU, UUU, and SUU to unsafe.Source: §C.6 · p. 18
Loading 2610.06452v1…