Cross-Modal Safety Mechanism Transfer in Large Vision-Language Models

## Abstract

Abstract Vision-language alignment in Large Vision-Language Models (LVLMs) successfully enables LLMs to understand visual input. However, we find that existing vision-language alignment methods fail to transfer the existing safety mechanism for text in LLMs to vision, which leads to vulnerabilities in toxic image. To explore the cause of this problem, we give the insightful explanation of where and how the safety mechanism of LVLMs operates and conduct comparative analysis between text and vision. We find that the hidden states at the specific transformer layers play a crucial role in the successful
activation of safety mechanism, while the vision-language alignment at hidden states level in current methods is insufficient. This results in a semantic shift for input images compared
to text in hidden states, therefore misleads the safety mechanism. To address this, we propose a novel Text-Guided vision-language Alignment method ( TGA ) for LVLMs. TGA retrieves the texts related to input vision and uses them to guide the projection of vision into the hidden states space in LLMs. Experiments show that TGA not only successfully transfers the safety mechanism for text in basic LLMs to vision in vision-language alignment for LVLMs without any safety fine-tuning on the visual modality but also maintains the general performance on various vision tasks (Safe and Good).

## 1 Introduction

Vision-language alignment methods for Large Vision-Language Models (LVLMs) use a basic LLM, a lightweight vision encoder and projector to efficiently enable the LLM to understand visual input for various vision tasks with relatively low training costs (Liu et al., ; Dai et al., ; Zhu et al., ). Recent studies indicate the safety of LVLMs deserves attention (Liu et al., ; Wang et al., ; Gong et al., ). Given that vision and language are aligned into a common space in LVLMs, the safety mechanism should be shared by both of them. However, this is not the case.
We find that compared to toxic text input, LVLMs are more vulnerable to toxic vision input. Existing studies improve the safety of LVLMs by utilizing toxic vision data for safety fine-tuning (Zong et al., ; Wang et al., ). However, they do not provide an essential explanation for the question: “Why can’t the safety mechanism for text be shared by vision after vision-language alignment?”.

Figure: Figure 1: (a): Hidden states at the specific local transformer layers in LVLMs play a crucial role in the successful activation of safety mechanism. (b): Current vision-language alignment methods cannot effectively align vision with its semantics in text modality at hidden states level. (c): Insufficient alignment at hidden states level shifts the semantics of image and misleads the layers for safety.
Refer to caption: x1.png

Since the mainstream vision-language alignment methods for LVLMs (e.g., LLaVA (Liu et al., )) lack additional safety fine-tuning and the training data in this process contain few toxic samples (Wang et al., ), the safety mechanism of LVLMs is mostly inherited from the safety mechanism that have established for text in their basic LLMs. So an intuitive view to explain the dilemma of LVLMs’ safety on vision is that the vision-language alignment cannot effectively transfer the safety mechanism for text in LLMs to vision. Based on this, this paper proposes a novel perspective called Cross-Modal Safety Mechanism Transfer to rethink, explain and address the exacerbated vulnerability of LVLMs to toxic vision input compared to toxic text input. Cross-modal safety mechanism transfer means transferring the existing safety mechanism for text in LLMs to vision in vision-language alignment training without any additional safety fine-tuning on vision. Our experiments in § 3 reveal that current vision-language alignment methods fail to achieve an effective cross-modal safety mechanism transfer. LVLMs exhibit significantly different safety capabilities when handling toxicity with the same semantics but different modalities (as shown in Figure 1).

To analyze the cause of this issue, which also provides an essential explanation for the vulnerability of LVLMs to toxic vision input, we first offer an insightful understanding of where and how the safety mechanism of LVLMs operates in § 4.1. Specifically, we propose a novel method to locate the activation of safety mechanism in LVLMs and analysis the attention pattern on toxic tokens. We find that the hidden states at the specific local transformer layers play a crucial role in the successful activation of safety mechanism (Figure 1a). Then our comparative analysis between text and vision modalities in § 4.2 reveals that current vision-language alignment methods in training LVLMs cannot effectively align the vision with the language at hidden states level (Figure 1b). This misalignment causes that the hidden states of the vision shifts from the hidden states of the corresponding text with the same semantics. When the hidden states of toxic image are input to the specific transformer layers responsible for safety mechanism activation, this shift prevents these layers from correctly capturing the semantics of image as they do for text, thereby hindering their ability to accurately assess the toxicity in images (Figure 1c). This is the key reason why the safety mechanism for text in basic LLMs cannot be transferred to vision in vision-language alignment training for LVLMs.

To address the above problem, we propose a novel vision-language alignment training method called TGA, which uses retrieved texts related to the input vision to guide the projection of vision into the hidden states space in LLMs, thereby achieving alignment at hidden states level. Extensive experiments show that TGA successfully transfers the safety
mechanism for text in basic LLMs to vision during vision-language alignment training for LVLMs without any safety fine-tuning on the visual modality. Besides, our TGA maintains general performance across various vision tasks compared with existing state-of-the-art (SoTA) LVLMs, such as InstructBLip, LLaVA-1.5, Qwen-VL-Chat in VQA, SEED-Bench, MM-Vet, etc. This indicates our TGA is a safe and effective vision-language alignment method for training LVLMs. The contributions of this paper are as follows:

- •
We propose a novel perspective called Cross-Modal Safety Mechanism Transfer, which aims to transfer the safety mechanism for text in LLMs to vision in vision-language alignment without any safety fine-tuning on the vision data. This rethinks, explains, and addresses the exacerbated vulnerability of LVLMs to toxic vision compared to toxic text.
- •
We explain where and how safety mechanism in LVLMs operates, and reveal that current vision-language alignment methods fail to achieve effective cross-modal safety mechanism transfer because of insufficient alignment at hidden states level.
- •
We propose a novel vision-alignment method called TGA that can not only transfer the safety mechanism against toxic text in basic LLMs to vision but also maintain the general performance on various vision tasks compared with existing
SoTA LVLMs.

## 2 Related Work

Vision-Language Alignment in LVLMs. Vision-language alignment in LVLMs equips basic LLMs with the ability to understand and process visual input by pre-training and instruction-tuning on large-scale text-image pairs such as works in LLaVA (Liu et al., ), InstructBLip (Dai et al., ), Qwen-VL (Bai et al., ), MiniGPT-4 (Zhu et al., ), Flamingo (Awadalla et al., ), PaLM-E (Driess et al., ), etc. However, it remains unknown whether visual-language alignment can extend all the capabilities of LLM on text to vision. This paper unveils that the safety mechanism of LLMs on text cannot be transferred to vision in existing typical vision-language alignment methods. We give the essential explanation for the cause of this issue and the novel solution method.

Safety of LVLMs. Recent studies have shown that LVLMs are still prone to generating toxic content when facing the toxic input (especially the toxic image), even when trained on carefully curated datasets containing few toxic samples (Wang et al., ; Liu et al., ; Gong et al., ). Some studies try to address this problem by safety instruction-tuning on supervised toxic vision data (Wang et al., ; Zong et al., ). The limitations of previous studies are: (1) lacking the essential explanation for the phenomenon that safety mechanism cannot be shared by both vision and language that has been aligned. (2) collecting the multi-modal data for safety instruction-tuning is much more challenging and requires more significant human effort than only text, especially for the modalities such as audio, speech and video (Chakraborty et al., ). This paper gives a novel perspective that views the safety issue in LVLMs as a problem of transferring the safety mechanism for text in base LLMs to vision to rethink, explain and address the vulnerability of LVLMs to toxic vision.

## 3 Safety Mechanism Cannot be Cross-Modal Transferred

In this part, we provide LVLM and its basic LLM with toxic inputs having the same semantics but in different modalities (text and vision) to evaluate the safety capabilities on different modalities, which is used as an assessment of cross-modal safety mechanism transfer. We find that safety mechanism for text is not effectively transferred to vision in visual-language alignment.

Data Construction. We collect real toxic images from open-source datasets. For each image, we use LLaVA-NEXT (Liu et al., ) to generate caption for it to get the toxic text-image pair. Text and image in this pair have the same semantics but are in different modalities. The specific datasets include HOD (Ha et al., ) that contains $10,631$ toxic images about alcohol, cigarette, gun, insulting gesture and knife, and ToViLaG (Wang et al., ) that contains $9,900$ toxic images about bloody and porn. After the caption generation, we get 20,31 toxic text-image pairs for experiments.

Metrics. We follow the regular safety testing method (Wang et al., ), which provides a toxic input and instructs the model to describe the toxic content of the input. We use Defence Success Rates (DSR), which indicates whether the model refuses to produce toxic responses when presented with toxic input, as the metric. Following (Chakraborty et al., ), we use LLaMA-2-7B to determine whether the responses generated by the model are toxic, thereby assessing the success of the defense.

Settings. The specific open-source LVLMs and LLMs used in experiments are: LLaVA-1.6-Mistral-7B (Liu et al., ) with its basic LLM Mistral-7B-Instruct-v0.2 (Jiang et al., ), InstructBlip (Dai et al., ) with its basic LLM Vicuna-7B-v1.5 (Zheng et al., ), Qwen-VL-Chat (Bai et al., ) with its basic LLM Qwen-7B-Chat (Bai et al., ). Some closed-source models, such as GPT-4-v, are not considered because we cannot acquire their specific checkpoints, training methods and data to provide further analysis. Given a LVLM ($\mathcal{M}$) and its basic LLM ($\mathcal{L}$),
the specific settings are (1) input toxic image to $\mathcal{M}$, (2) input toxic text to $\mathcal{M}$ and (3) input toxic text to $\mathcal{L}$.

Findings. The experimental results are shown in Table 1. Different LVLMs across different toxic scenes show the following common conclusions: (1) DSR of LVLM and its basic LLM is close on toxic text, it indicates that safety mechanism of basic LLMs on text is successfully preserved in visual-language alignment training of LVLMs. (2) For the toxic information with the same semantics in different modalities (text and vision), the safety capabilities of LVLMs vary significantly, and LVLMs can hardly defense toxicity in the visual modality. It indicates that safety mechanism for text is not effectively transferred to vision in visual-language alignment training of LVLMs.

**Table 1: Defence Success Rates of LVLMs and their basic LLMs for toxic input with the same semantic but in difference modalities (text and vision). “†” indicates the significant difference with p-value $\leq 0.05$ in T-test compared with the toxic text input.**
| Scenes | LLaVA-1.6-Mistral-7B | InstructBlip | Qwen-VL-Chat |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Basic LLM | LVLM | Basic LLM | LVLM | Basic LLM | LVLM |  |  |  |
|  | Toxic Text | Toxic Text | Toxic Image | Toxic Text | Toxic Text | Toxic Image | Toxic Text | Toxic Text | Toxic Image |
| Porn | 27.45 | 26.78 | 1.05^† | 17.98 | 15.46 | 1.28^† | 72.96 | 70.64 | 4.23^† |
| Bloody | 12.31 | 11.72 | 0.56^† | 8.46 | 7.11 | 0.12^† | 35.60 | 33.86 | 1.46^† |
| Insulting Gesture | 43.18 | 42.97 | 0.78^† | 30.75 | 30.22 | 0.57^† | 78.74 | 76.26 | 5.15^† |
| Alcohol | 32.52 | 32.03 | 0.25^† | 21.60 | 21.05 | 0.00^† | 85.05 | 83.25 | 5.48^† |
| Cigarette | 22.57 | 22.84 | 0.17^† | 15.81 | 15.76 | 0.00^† | 83.76 | 82.80 | 4.41^† |
| Gun | 52.46 | 51.94 | 1.95^† | 39.45 | 39.27 | 0.75^† | 86.42 | 86.90 | 5.72^† |
| Knife | 45.91 | 43.06 | 1.22^† | 30.77 | 30.60 | 0.23^† | 89.01 | 88.73 | 5.40^† |

## 4 Cause of Failure in Cross-Modal Transferring Safety

This section analyzes the cause of the failure in transferring the safety mechanism from text to vision. Firstly, in § 4.1, we find that hidden states at the specific transformer layers play a crucial role in the successful activation
of safety mechanism. Then, our comparative analysis between text and image in § 4.2 reveals that alignment between vision and language at hidden states level is insufficient. It makes the transformer layers responsible for safety mechanism activation cannot correctly capture the semantics of image as they perform on text, so they cannot correctly assess the toxicity in image and the safety mechanism on vision collapses.

### 4.1 Safety Mechanism is Activated at Specific Layers by Hidden States

This part gives an insightful explanation of where and how the safety mechanism activated in LVLMs on textual, which is fundamental to understand the safety mechanism collapse on vision. Previous studies (Tenney, ; Dai et al., ; Meng et al., ) have shown that transformers in different layers of language model have different functions such as lexical, semantic, knowledge, etc., this paper proposes a novel method to identify the transformer layers responsible for activating safety mechanism in LVLMs and analyzes the attention patterns on toxic tokens within these layers to give the explanation of where and how the safety mechanism is activated.

Where: Locating the Activation of Safety Mechanism. When facing a toxic input, if the safety mechanism is activated, the language model will refuse to follow the instruction and apologize to the user, such as "Sorry but I cannot …", otherwise, the language model will follow the instruction and generate the corresponding response (Bianchi et al., ). Therefore, a reply with an apology is an important signal for the activation of the safety mechanism. This paper proposes a novel method to locate where the safety mechanism is activated by detecting the word distribution mutation on sorry semantics among layers. Specifically, given a toxic text $t$ and instruction $s$ to LVLMs, the next token prediction for $x$ can be formalized as:

$$ $\textrm{P}(x|t,s)=\textrm{softmax}(\textrm{{W}}\textrm{{H}}^{\prime}),x\in \mathcal{X},$ (1) $$

in which $\textrm{{W}}\in\mathbb{R}^{h\times v}$ is the vocabulary head that maps the output hidden states $\textrm{{H}}^{\prime}$ to the word distribution in vocabulary $\mathcal{X}$ with size $v$. Since previous studies (Chuang et al., ; Xu et al., ) prove that due to the residual connections, the combination of any intermediate layer in a language model with the vocabulary head W can represent its distribution of semantics, we apply W to each intermediate layer to obtain its distribution of semantics as:

$$ $\textrm{P}_{j}(x|t,s)=\textrm{softmax}(\textrm{{W}}\textrm{{H}}_{j}),x\in \mathcal{X},$ (2) $$

in which $j$ is the $j\mbox{-}th$ transformer layer of LVLMs, $\textrm{{H}}_{j}$ is the hidden states of the last token in $j\mbox{-}th$ layer. We calculate the word distribution change in $j\mbox{-}th$ layer by contrasting the $(j-1)\mbox{-}th$ layer as:

$$ $\textrm{D}_{j}(x|t,s)=\textrm{log}\frac{\textrm{P}_{j}(x|t,s)}{\textrm{P}_{j-1 }(x|t,s)},j>1.$ (3) $$

Figure: Algorithm 1 Find the layer where safety mechanism is activated.

We collect the tokens with sorry semantics such as “sorry”, “apologize" from vocabulary $\mathcal{X}$ and denote them as set $\mathcal{K}$. We add prompt that instructs LVLMs to response as "Sorry but I cannot…" if the input contains toxicity. Then, we propose Algorithm 1 to locate the layer where safety mechanism is activated by finding the layer where sorry tokens start to rank Top-1 in word distribution change.

Sorry tokens start to show the most significant growth among the whole vocabulary means that the transformer layer realizes that the current input is toxic, so it tries to update the word distribution to refuse following the instruction, which is actually the safety mechanism activation. So our method makes sense. Safety mechanism perturbation experiments in Figure 3 also show that our method can accurately determine the activation location of the safety mechanism of LVLMs.

Figure: (a) LLaVA-1.6-Mistral-7B
Refer to caption: x2.png

Figure: (a) LLaVA-1.6-Mistral-7B
Refer to caption: x5.png

How: Analysing the Attention Patterns on Toxic Tokens. For each toxic text in Data Construction of § 3, we use gpt-4o-2024-05-13 API to extract the specific toxic words in the text and mark them as the toxic tokens (denoted as the set $\mathcal{C}$) for LVLM’s input. In the word distribution prediction of $\textrm{P}_{j}(x|t,s)$ in the $j\mbox{-}th$ layer with toxic text $t$ and instruction $s$ as the input, we obtain the attention map $\mathcal{A}_{j}$ of the last token to tokens in $t$, and calculate the proportion $R$ of attention score from the last token to the toxic token set $\mathcal{C}$ over the entire attention map $\mathcal{A}_{j}$ as:

$$ $\displaystyle\mathcal{A}_{j}=\text{softmax}\left(\frac{Q_{j}K_{j}^{\top}}{ \sqrt{d_{k}}}\right),R=\sum_{i\in\mathcal{C}}\mathcal{A}_{j}^{i},$ (4) $$

in which $Q_{j}\in\mathbb{R}^{1\times d_{k}}$ is the query vector of the last token, $K_{j}\in\mathbb{R}^{n\times d_{k}}$ is the key vector for the input text $t$, where $n$ denotes the number of tokens in the input text $t$.

Practical Explanation of Safety Mechanism Activation. Based on the methods in above two parts about identifying where and how the safety mechanism is activated in LVLMs, we select samples that LVLMs successfully execute safety mechanism on the toxic text input from the dataset of § 3 and analyze the activation location and attention patterns to provide a practical explanation for the activation of safety mechanism. The average statistical results of the above two points on the entire sample set are shown in Figure 2. They indicate that the activation of the safety mechanism coincides with peaks in attention to the hidden states of toxic tokens. Therefore, a conclusion can be obtained that the safety mechanism is activated by the information from the hidden states of toxic tokens at the specific transformer layers. Following Safety Mechanism Perturbation experiments support this.

Safety Mechanism Perturbation. To support above conclusion, we conduct corresponding safety mechanism perturbation experiments in which the information from toxic tokens is masked at different layers, and test the changes in the safety capabilities of LVLMs under these conditions. We achieve this by adding mask to toxic tokens in attention map in specific layers. The datasets are also the same as Table 1 and we use the average DSR on seven scenes as the metric. Experimental results in Figure 3 show that truncating at the layers where safety mechanism is activated determined by our method causes the most significant disruption to the safety mechanism of LVLMs compared to other layers. This further demonstrates the effectiveness of our method and the validity of our conclusion.

### 4.2 Insufficient Alignment at Hidden States Misleads Safety Mechanism

This section gives our analysis about the cause of the failure in transferring the safety mechanism from text to vision in LVLMs. As our findings in § 4.1, the hidden states of input tokens at specific transformer layers play a crucial role in the successful activation of safety mechanism. We conduct the comparative analysis between hidden states of input text and image with the same semantics, which helps us find the essential explanation for the failure of cross-modal safety mechanism transfer.

Comparative Analysis Between Text and Image. Figure 4 is the cosine similarity between the mean pooled vectors of hidden states of texts and images with the same semantics. At the layers where safety mechanism is activated, compared with the Clip Score that indicates the semantic similarity between text and image, the cosine similarity between hidden states of text and image in LVLMs is significantly lower, suggesting that the alignment between text and image at the hidden states level is insufficient. The transformer layers for safety mechanism activation cannot correctly capture the semantics of image as they perform on text, so they cannot correctly assess the toxicity in image.

Figure: (a) LLaVA-1.6-Mistral-7B
Refer to caption: x8.png

Figure: (a) LLaVA-1.6-Mistral-7B
Refer to caption: x11.png

Safety Mechanism Reconstruction. The above analysis suggests that the insufficient alignment of hidden states between vision and language in the layers where safety mechanism activation is a potential reason for the safety mechanism collapse on vision. We perform safety mechanism reconstruction experiments to demonstrate this. Specifically, for the input image $I$, its hidden states sequence for image tokens at the $j\mbox{-}th$ transformer layer in LVLMs is denoted as $\displaystyle{\mathbb{I}}_{j}=\{\textrm{{I}}^{1}_{j},\textrm{{I}}^{2}_{j},...,
\textrm{{I}}^{n}_{j}\}$, in which $\textrm{{I}}^{k}_{j}$ is the hidden state for the $k\mbox{-}th$ image token, $n$ is the number of image tokens. Similarly, for the text $T$ having the same semantics with image $I$, its hidden states sequence for text tokens at the $j\mbox{-}th$ layer is $\displaystyle{\mathbb{T}}_{j}=\{\textrm{{T}}^{1}_{j},\textrm{{T}}^{2}_{j},...,
\textrm{{T}}^{m}_{j}\}$. We adjust $\displaystyle{\mathbb{I}}_{j}$ as:

$$ $\displaystyle{\mathbb{I}}_{j}=\{\textrm{{I}}^{k}_{j}+\textrm{mean}( \displaystyle{\mathbb{T}}_{j})\mid\textrm{{I}}^{k}_{j}\in\displaystyle{\mathbb {I}}_{j}\},\textrm{mean}(\cdot)\textrm{ is mean pooling.}$ (5) $$

By adding the mean pooled hidden states of text $T_{j}$ to $I_{j}$ as the input for the $(j+1)\mbox{-}th$ layer, the hidden states of image $I$ are forcibly aligned with the corresponding text $T$. This operation is performed on different transformer layers and the corresponding safety capabilities on toxic image input are shown in Figure 5. Directly adding hidden states of text to hidden states of image can significantly improve the safety capabilities of LVLMs on toxic image, especially operating on safety mechanism activation layers determined by our method, this further indicates that the alignment between vision and language at hidden states level plays a critical role in the successful transfer of the safety mechanism from text to vision in LVLMs.

Explanation of Safety Mechanism Collapse in Transfer from Text to Vision. Based on § 4.1 and § 4.2, the following conclusions can be obtained to explain why the safety mechanism existing in basic LLMs for text cannot be cross-modal transferred to vision in vision-language alignment:

- •
(1) Safety Mechanism is activated at the specific transformer layers.
- •
(2) Hidden states at the specific transformer layers play a crucial role in the successful activation of safety mechanism.
- •
(3) Existing vision-language alignment methods for LVLMs fail to align the hidden states of vision with its corresponding hidden states of text, especially in the transformer layers that responsible for activating safety mechanism.
- •
(4) This misalignment makes the transformer layers responsible for safety mechanism activation cannot correctly capture the semantics of image as they perform on text, so they cannot correctly assess the toxicity in image and the safety mechanism on vision collapses.

## 5 Text Guided Alignment at Hidden States Level

Our analysis in § 4 indicates that insufficient alignment of hidden states between vision and language in the layers where safety mechanism activation is a critical reason for the safety mechanism collapse in transfer from text to vision. To address this, this section proposes a novel text-guided vision-language alignment method that can effectively align vision and language at hidden states level.

### 5.1 Motivation and Overview

As shown in Figure 6 (a), previous vision alignment methods in LVLMs construct image-instruction-output triples as training data, and use cross-entropy in language modeling as the loss fuction to optimize the output generated by basic LLMs to make LLM understand the input vision, thereby achieving visual-language alignment. We name these methods input-to-output alignment, i.e. align the text output to the visual input, which is actually asymmetrical. The natural flaw of these method is that they black-box basic LLMs and only focus on output, while neglecting whether the internal representation of the visual input in LLMs, i.e., the hidden states, aligns with the hidden states in text modality. To address this problem, we propose the Text-Guided input-to-input Alignment (TGA) at hidden states level, as shown in Figure 6 (b). For the input image, TGA retrieves the semantically relevant text as the template to guide the alignment of vision to language at hidden states level.

Figure: Figure 6: Comparison between previous methods and our TGA.
Refer to caption: x14.png

### 5.2 Detailed Method

#### 5.2.1 Data Construction

The original training data is collected from LLaVA (Liu et al., ) that consists of $558$K images for pre-training and $665$K images for instruction-tuning. Each data sample is in multi-turn conversation template like this: ($\textbf{X}_{\textrm{image}}$, $\textbf{X}_{\textrm{inst}}^{1}$- $\textbf{X}_{\textrm{r}}^{1}$, $\textbf{X}_{\textrm{inst}}^{2}$-$\textbf{X}_{\textrm{r}}^{2}$, …, $\textbf{X}_{\textrm{inst}}^{q}$-$\textbf{X}_{\textrm{r}}^{q}$). $\textbf{X}_{\textrm{image}}$ is the input image, $\textbf{X}_{\textrm{inst}}$-$\textbf{X}_{\textrm{r}}$ pair is one conversation turn consisting of an instruction $\textbf{X}_{\textrm{inst}}$ and its response $\textbf{X}_{\textrm{r}}$. For each image $\textbf{X}_{\textrm{image}}$ in the training set, our method uses a image-to-text retrieval model BEIT-3 (Wang et al., ) to retrieve a relevant text $\textbf{X}_{\textrm{retrieval}}$ from a large-scale corpus that consists of $1,153$K textual captions for images in LAION/CC/SBU (Schuhmann et al., ; Changpinyo et al., ) dataset with little toxicity, and uses LLaVA-1.5-13B to generate a textual caption $\textbf{X}_{\textrm{caption}}$ for $\textbf{X}_{\textrm{image}}$, which can be seen as the description of image semantics in text modality.

#### 5.2.2 Training

At each training step, TGA firstly inputs $\textbf{X}_{\textrm{caption}}$ to LVLMs to get the hidden states of $\textbf{X}_{\textrm{caption}}$ at each transformer layer under the condition of disabling gradient calculation:

$$ $\displaystyle{\mathbb{C}}_{j}=\{\textrm{{C}}^{1}_{j},\textrm{{C}}^{2}_{j},..., \textrm{{C}}^{m}_{j}\},j=1,2,3,...,N,$ (6) $$

in which $\displaystyle{\mathbb{C}}_{j}$ is the sequence of hidden states of tokens in $\textbf{X}_{\textrm{caption}}$ at the $j$-$th$ transformer layer, $m$ is the number of tokens in $\textbf{X}_{\textrm{caption}}$, $N$ is the number of transformer layers of basic LLMs. Then, TGA enables the gradient calculation with retrieved text $\textbf{X}_{\textrm{retrieval}}$, image X${}_{\textrm{image}}$ and language instruction $\textbf{X}_{\textrm{inst}}$ as the input for visual instruction tuning (Liu et al., ), in this process, TGA obtains the hidden states of $\textbf{X}_{\textrm{retrieval}}$ and X${}_{\textrm{image}}$ at each layer, denoted as $\displaystyle{\mathbb{R}}$ and $\displaystyle{\mathbb{I}}$ respectively. Since the input is ($\textbf{X}_{\textrm{retrieval}}$, X${}_{\textrm{image}}$, $\textbf{X}_{\textrm{inst}}$), the hidden states $\displaystyle{\mathbb{I}}$ are actually the fusion of X${}_{\textrm{image}}$ and $\textbf{X}_{\textrm{retrieval}}$ because of the self-attention among tokens (Vaswani, ). The retrieved text $\textbf{X}_{\textrm{retrieval}}$ guides the basic LLMs to align the hidden states of $\textbf{X}_{\textrm{image}}$ (vision) with the hidden states of $\textbf{X}_{\textrm{caption}}$ (language) at each transformer layer, this is achieved by a pair-wise loss function:

$$ $\mathcal{L}_{\textrm{guide}}=\sum_{j=1}^{N}-\textrm{cos}(\displaystyle \overline{{\mathbb{I}}_{j}},\displaystyle\overline{{\mathbb{C}}_{j}})+\log \left[1+\underbrace{\exp\left[-(\textrm{cos}(\displaystyle\overline{{\mathbb{I }}_{j}},\displaystyle\overline{{\mathbb{C}}_{j}})-\textrm{cos}(\displaystyle \overline{{\mathbb{R}}_{j}},\displaystyle\overline{{\mathbb{C}}_{j}}))\right]} _{\textbf{Pair-wise}}\right],$ (7) $$

in which $\displaystyle\overline{{\mathbb{I}}_{j}}$, $\displaystyle\overline{{\mathbb{C}}_{j}}$ and $\displaystyle\overline{{\mathbb{R}}_{j}}$ are mean pooled vectors of hidden states of $\textbf{X}_{\textrm{image}}$, $\textbf{X}_{\textrm{caption}}$ and $\textbf{X}_{\textrm{retrieval}}$ in the $j$-$th$ transformer layer respectively. The intuition of this pair-wise loss is to ensure that $\textbf{X}_{\textrm{image}}$ does not directly replicate the semantics of $\textbf{X}_{\textrm{retrieval}}$, but rather uses $\textbf{X}_{\textrm{retrieval}}$ as a template for partially similar semantics in the text modality to prompt the alignment of $\displaystyle{\mathbb{I}}_{j}$ with its text modality hidden states $\displaystyle{\mathbb{C}}_{j}$. The successful alignment should achieve that $\displaystyle{\mathbb{I}}_{j}$ is closer to $\displaystyle{\mathbb{C}}_{j}$ than $\displaystyle{\mathbb{R}}_{j}$, because in this condition, $\displaystyle{\mathbb{I}}_{j}$, $\displaystyle{\mathbb{C}}_{j}$ and $\displaystyle{\mathbb{R}}_{j}$ are aligned into a common space and $\displaystyle{\mathbb{C}}_{j}$ and $\displaystyle{\mathbb{I}}_{j}$ have consistent semantics. $\textrm{cos}(\displaystyle\overline{{\mathbb{R}}_{j}},\displaystyle\overline{{
\mathbb{C}}_{j}})$ is used as the lower bound supervision for alignment between vision $\displaystyle\overline{{\mathbb{I}}_{j}}$ and language $\displaystyle\overline{{\mathbb{C}}_{j}}$. The total loss function $\mathcal{L}$ is the combination of $\mathcal{L}_{\textrm{guide}}$ and cross-entropy loss for language modeling:

$$ $\displaystyle\mathcal{L}$ $\displaystyle=\mathcal{L}_{\textrm{guide}}-\frac{1}{N}\sum_{i=1}^{N}\log \textrm{P}(\textbf{X}_{\textrm{a},i}|\textbf{X}_{\textrm{retrieval}},\textbf{X }_{\textrm{image}},\textbf{X}_{\textrm{inst}},\textbf{X}_{\textrm{a},<i}), \textbf{X}_{\textrm{a}}\textrm{ is the answer for }\textbf{X}_{\textrm{inst}}.$ (8) $$

### 5.3 Experiments

#### 5.3.1 Experimental Details

Experimental Setting. Our method aims to transfer the safety mechanism of LLMs on text to vision during the vision-language alignment in LVLMs, so the main setting in this experiment is assessing the safety capabilities of LVLMs on toxic image without any safety fine-tuning on visual modality. We follow the regular safety testing method (Wang et al., ) that gives a toxic image and instructs the model to describe the toxic information of the image. We use Defence Success Rates (DSR) that indicates the whether a model refuse to produces toxic responses when presented with the toxic image as the metric. We follow (Chakraborty et al., ) to use LLaMA-2-7B to determine whether the responses generated by the model are toxic, that is, whether the defense is successful.

Datasets. The training datasets for TGA are consistent wiht LLaVA (Liu et al., ) that collects 558K images for pre-traing and 665K images for instruction-tuning. The pre-training dataset is a filtered subset of CC3M and the instruction-tuning dataset is LLaVA-1.5-mix665k. Datasets to evaluate the safety capabilities on vision are consistent with Section 3, which include $20,531$ toxic images about alcohol, cigarette, gun, insulting gesture, knife, bloody and pornography.

Baselines. Baselines in this experiments can be categorized into two types. The first type is exiting mainstream state-of-the-art vision-language alignment training method such as LLaVA (Liu et al., ), InstructBlip (Dai et al., ) and Qwen-VL (Bai et al., ). The second type is Unlearn-FigS (Chakraborty et al., ), a method that performs textual unlearning on VLMs to enhance the cross-modal safety capabilities. Since our paper introduces a pioneering concept of transferring safety mechanism for text to vision without safety fine-tuning on vision, while existing methods for the safety of LVLMs, such as (Zong et al., ), rely on supervised toxic vision data for safety fine-tuning. Therefore, these methods are unfair in our setting and are not considered.

Implementation Details. We use Mistral-7B-Instruct-v0.2 (Jiang et al., ) as basic LLM, clip-vit-large-patch14-336 (Radford et al., ) as the vision tower and two-layer MLP as projector. Our model is training on 64 × V100 GPUs with Deepspeed Zero-Stage 3 as acceleration framework in float32. Most hyperparameters follow LLaVA (Liu et al., ). In pre-training, we freeze basic LLMs and only train projector for 1 epoch with a learning rate of 2e-3. In instruction-tuning, we make all parameters trainable with a learning rate of 2e-6 for 1 epoch. As for the image-to-text retrieval, our retrieval database consisting of $1,158$K texts, in which $1,153$K texts are captions for images in LAION/CC/SBU dataset with little
toxicity, filtered with a more balanced concept coverage distribution, and 5K texts are toxic texts across various harmful domains generated by Vicuna-13B. We use BEIT-3 (Wang et al., ) to index these texts and retrieve the top-1 text for each image.

#### 5.3.2 Experimental Results

**Table 2: Defence Success Rates on toxic image across seven scenes in different vision-language alignment training method in LVLMs. Safety of LLM is referred to Table 1.**
| Method | Basic LLM | Safety of LLM | Defence Success Rates on Toxic Scenes |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Porn | Bloody | Insulting | Alcohol | Cigarette | Gun | Knife |  |  |  |
| BLIP-2 | Vicuna-13B | Weak | 1.17 | 0.00 | 0.00 | 0.00 | 0.00 | 0.98 | 0.06 |
| InstructBlip | Vicuna-7B | Weak | 1.28 | 0.12 | 0.57 | 0.00 | 0.00 | 0.75 | 0.23 |
| LLaVA-1.5 | Vicuna-7B | Weak | 1.20 | 0.37 | 0.57 | 0.19 | 0.76 | 1.22 | 0.35 |
| LLaVA-1.6 | Mistral-7B | Medium | 1.05 | 0.56 | 0.78 | 0.25 | 0.17 | 1.95 | 1.22 |
| Qwen-VL-chat | Qwen-7B | Srong | 4.23 | 1.46 | 5.15 | 5.48 | 4.41 | 5.72 | 5.40 |
| Unlearn-FigS | Mistral-7B | Medium | 8.76 | 4.27 | 16.98 | 14.31 | 10.10 | 21.42 | 18.55 |
| TGA (Ours) | Mistral-7B | Medium | 20.65 | 9.48 | 22.73 | 17.92 | 17.29 | 30.83 | 29.42 |

Main Results. The defence success rates on toxic image across seven scenes in different vision-language
alignment training method in LVLMs are shown in Table 2. Our TGA significantly improve the safety capabilities of LVLMs on toxic image than mainstream vision-language alignment method, without any additional safety fine-tuning on vision. It is because that our TGA successfully transfers the safety mechanism present in basic LLMs for text to vision by improving the vision-language alignment at hidden states level. Besides, our TGA outperforms Unlearn-FigS, a method that works by transferring text unlearning from LLMs to LVLMs to avoid harmful context toward toxic regions, which shows that directly transferring safety mechanism in our TGA is a more effective method.

General Capabilities of LVLMs on Vision Tasks. Table 3 shows that our TGA shows comparable performance on various vision tasks. Combined with Table 2, our TGA is a safe and good vision-language alignment method for training LVLMs, it not only successfully transfers the safety mechanism from text to vision but also maintains the general performance on various vision tasks. The training data of LLaVa-1.6 has not been open but is more effective than the data in LLaVA-1.5 used by our method, therefore, to keep the fair comparison, we reproduce LLaVA-1.5 on Mistral to replace it. The specific details about benchmarks and metrics in Table 3 can be found in Appendix A.1.

**Table 3: Comparison with SoTA methods on benchmarks evaluating LVLMs on various vision tasks.**
| Method | SciQA | POPE | SEED-Bench | MM-Vet |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| img-acc | rand | pop | adv | all | img | vid | rec | ocr | know | gen | spat | math | all |  |
| BLIP-2-13B | 61.0 | 89.6 | 85.5 | 80.9 | 46.4 | 49.7 | 36.7 | - | - | - | - | - | - | 22.4 |
| InstructBlip-7B | 60.5 | - | - | - | 53.4 | 58.8 | 38.1 | - | - | - | - | - | - | 26.2 |
| InstructBLIP-13B | 63.1 | 87.7 | 77 | 72 | - | - | - | - | - | - | - | - | - | 25.6 |
| Qwen-VL-chat-7B | 68.2 | - | - | - | 58.2 | 65.4 | 37.8 | 36.8 | 21.9 | 16.3 | 19.7 | 23.5 | 6.3 | 30.2 |
| LLaVA-1.5-7B | 66.8 | 87.3 | 86.1 | 84.2 | 58.6 | 66.1 | 37.3 | 37.0 | 21.0 | 17.6 | 20.4 | 24.9 | 7.7 | 31.1 |
| LLaVA-1.5-7B (Mistral) | 67.9 | 87.3 | 86.2 | 84.0 | 58.8 | 66.5 | 37.4 | 37.2 | 22.5 | 20.1 | 22.3 | 28.6 | 7.7 | 32.9 |
| TGA-7B (Ours) | 71.7 | 87.6 | 86.2 | 83.7 | 58.7 | 66.3 | 37.4 | 37.7 | 28.9 | 23.0 | 25.6 | 37.6 | 7.7 | 34.6 |

Figure: (a) Safety mechanism transfer rates from language to vision.
Refer to caption: x15.png

Safety Mechanism Transfer. Figure 7(a) shows that compared with vision-language alignment methods in baselines, our TGA effectively transfer the safety mechanism from language to vision. In this experiment, we evaluate the DSR of basic LLMs on toxic text and the DSR of aligned LVLMs on toxic image. The ratio between the two serves as the safety transfer rate from language to vision.

Alignment at Hidden States Level. Figure 7(b) shows that comapred with the baseline, our TGA effectively aligns vision and language at hidden states level. Since the training data and hyperparameter in our TGA is consistent with LLaVA-1.5, so we use LLaVA-1.5 based on Mistral-7B as the baseline. Our TGA achieves the greater cosine similarity between hidden states of texts and images with the same semantics than the baseline.

Ablation Study on Retrieved Text. The main ablation study of our TGA is about the introduction of retrieved text. As shown in Figure 7(c), we explore the effect of retrieved text when used in training and inference. For baseline LLaVA-1.5, the usage of retrieved text in inference cannot significantly improve its safety capabilities. For our TGA, even if without retrieved text, our method can still outperforms LLaVA-1.5 in safety. The usage of retrieved text with loss $\mathcal{L}_{\textrm{guide}}$ in Equ. 7 can further improve the safety capabilities and general performance on vision tasks.

Case Study. We show the case study about baselines and our methods facing toxic input in different scenes. It can be found in Appendix A.2.

## 6 Conclusion and Discussion

This paper proposes a novel perspective called Cross-Modal Safety Mechanism Transfer to rethink, explain and address the exacerbated vulnerability of LVLMs to toxic vision compared to toxic text. Extensive analysis shows that current vision-language alignment methods fail to achieve effective cross-modal safety mechanism transfer and the reason is the insufficient alignment between vision and language at hidden states level. To address this, we propose a novel vision-language alignment method that can not only transfer the
safety mechanism against toxic text in basic LLMs to vision but also maintain the general performance on various vision tasks compared with existing SoTA LVLMs.

## Appendix A More Detailed Experiments

### A.1 General Capabilities of LVLMs on Vision Tasks

Datasets, Benchmarks and Metrics.

(1) ScienceQA (Lu et al., ): A benchmark that consists of  21k multimodal multiple choice questions with a diverse set of science topics and annotations of their answers with corresponding lectures and explanations. We follow LLaVA (Liu et al., ) to evaluate the zero-shot generalization of LVLMS on scientific question answering in image subset and use accuracy as the metric.

(2) POPE (Li et al., ): POPE evaluates model’s degree of hallucination on three sampled subsets of COCO (Lin et al., ): random, common, and adversarial and we report the F1 score as the metric on all three splits.

(3) SEED-Bench (Li et al., ): SEED-Bench consists of 19K multiple choice questions with accurate human annotations (x 6 larger than existing benchmarks), which spans 12 evaluation dimensions including the comprehension of both the image and video modality. We report the accuracy on image, video and all as the metric.

(4) MM-Vet (Yu et al., ): MM-Vet evaluate model’s capabilities in engaging in visual conversations on a diverse range of tasks, and evaluates the correctness and the helpfulness of the response with GPT-4 evaluation.

### A.2 Case Study

Case study about response of different LVLMs for toxic image is shown in Figure 8 to 14.

Figure: Figure 8: Case study on toxic input image about alcohol.
Refer to caption: x18.png

Figure: Figure 9: Case study on toxic input image about bloody.
Refer to caption: x19.png

Figure: Figure 10: Case study on toxic input image about cigarette.
Refer to caption: x20.png

Figure: Figure 11: Case study on toxic input image about gun.
Refer to caption: x21.png

Figure: Figure 12: Case study on toxic input image about porn.
Refer to caption: x22.png

Figure: Figure 13: Case study on toxic input image about insulting gesture.
Refer to caption: x23.png

Figure: Figure 14: Case study on toxic input image about knife.
Refer to caption: x24.png

## Peer Reviews

confidence: 4
contribution: 3
initial_rating: 6
presentation: 3
questions: Same as weakness.
soundness: 3
strengths: 1. The authors first analyze cause of failure in cross-modal safety transfer. Based on the analysis, they propose Text-Guided Alignment (TGA) to transfer safety mechanisms from text to vision, addressing key safety issues in LVLMs. The analysis is thorough and the proposed method is novel in general.
2. The paper is well-structured, with clear motivations and systematic explanations of the issues with current vision-language alignment methods.
3. The proposed approach contributes to improving the robustness of LVLMs. This advancement could be important in bridging safety gaps in multimodal AI.
summary: This paper introduces the concept of Cross-Modal Safety Mechanism Transfer for Large Vision-Language Models (LVLMs), aiming to transfer the safety mechanism from text to vision without additional visual safety fine-tuning. The current vision-language alignment fails to align vision with text at the hidden states level, leading to unsafe responses for harmful images. The proposed Text-Guided vision-language Alignment (TGA) retrieves relevant texts to guide the alignment of vision input to hidden states in LVLMs. TGA effectively transfers safety mechanisms from text to vision, maintaining safety without compromising general performance in vision tasks, outperforming existing vision-language alignment methods.
weaknesses: 1. TGA relies on captions generated by LLaVA-1.5-13B for effective alignment. Inaccurate captions can lead to misalignment between vision and language representations, reducing safety performance. Evaluating the impact of captioning errors and exploring mitigation strategies could add robustness to the approach.
2. The paper does not adequately show how the model handles unsafe compositional inputs. For instance, an image of a wine bottle combined with text like "teach a kid to buy this" represents a harmful query, even though the image and text are safe individually. Evaluating compositional risks more deeply could strengthen safety measures.
3. The paper does not show the model's robustness against red-teaming methods such as jailbreak attacks. Evaluating how effective the proposed approach is in defending against these attacks would provide more confidence in the model’s safety capabilities in adversarial settings.

---

confidence: 4
contribution: 3
initial_rating: 6
presentation: 2
questions: Please see weakness.

1. In Figure 1, the presentation is somewhat confusing. Specifically, in Figure 1c, could you clarify whether the blue arrows represent "safe" or "unsafe"?

2. In Section 4, could you specify which layers you are analyzing? For example, are you focusing on the qkv (query, key, value) layers or the projection layers?

3. Can you include any discussion of failure scenarios or bad cases where the method may not perform as expected?
soundness: 3
strengths: This paper is well-motivated and provides a thorough analysis of layer activations to explain the safety misalignment between vision and language. The work has potential value across multiple related fields, particularly in the design of vision-language models and their safety challenges.

The method for identifying the layers where the safety mechanism is activated is both reasonable and straightforward, showing effectiveness with a simple approach.

The proposed TGA alignment method effectively defends against toxic images, with strong evidence presented in Figure 7 to substantiate this claim.
summary: The paper identifies a vulnerability in current vision-language alignment methods for Large Vision-Language Models (LVLMs), where the safety mechanisms effective for text fail to transfer to visual input, leaving toxic images unchecked. The authors find that misalignment at the specific hidden state layers cause a semantic shift, undermining the safety mechanism for visual input. To address this, they propose a Text-Guided Alignment (TGA) method, which uses related text to guide the projection of visual inputs into hidden states. Experiments demonstrate that TGA successfully transfers text safety mechanisms to vision without additional fine-tuning and maintains overall performance on vision tasks.
weaknesses: The paper lacks comparisons with other defense methods. Aside from the comparison with the unlearn-FigS defense, the current experimental results are mainly contrasted with the original model. Including comparisons with existing safety defense methods, such as [1-2], would provide stronger evidence of the proposed approach's superiority.

The presentation is somewhat redundant. For instance, the content in Figures 2 and 4, as well as Figures 3 and 5, could be combined to avoid repetition. Similarly, the writing in Section 4 could be more concise and streamlined for better clarity and flow.

[1] Tovilag: Your Visual-Language Generative Model is Also an Evildoer. EMNLP2023.

[2] Eyes Closed, Safety On: Protecting Multimodal LLMs via Image-to-Text Transformation. ECCV2024.

---

confidence: 3
contribution: 3
initial_rating: 8
presentation: 3
questions: Q1. Confused about the number of toxic image-text pairs, in L134 it notes 2031 but in L454, it notes 20531.
soundness: 3
strengths: Pros:

1. The paper tackles an interesting problem which (to best of my knowledge) isn't very well known in the community. As such, it highlights a potential gap and suggests how to fix new VLMs. 

2. The motivation is a bit subtle and it is important to note is mostly relevant for open-source models. In a closed sourced model, one could simply have a nsfw classifier on the image-input. However, for open-source model, such an additional component can be easily turned off. As such, a method to have open-source models which are safe is very important. In that sense, the problem is very well motivated.

3. As part of the experiments, the authors collect new dataset which is always appreciated. The authors further provide qualitative visualizations in appendix.

4. The idea of aligning the hidden states is quite clever in my opinion. 

5. The authors compare against multiple baseilnes.
summary: Brief Summary: The paper proposes an interesting observation that the safety mechanism of LLMs in filtering out inappropriate content while answering questions is lost when transferring to VLMs naively. As a result, the VLM might answer about things given the image context even though the corresponding LLM wouldn't have. 

The authors identify that specific hidden layers in Transformers are responsible for this behavior and propose a method called TGA to transfer this mechanism from LLMs to VLMs. 

Experiments on multiple benchmarks (like POPE, MMVet) show that the proposed method maintains performance while filtering our inappropriate content.
weaknesses: Cons:

1. One thing that isn't clear to me is if it is possible to reverse the trained safety filter by doing an instruction tuning on a sample of toxic dataset by an end user. In that case, it would be easy to "jailbreak" the safe model with relative ease. 

2. The authors should include a baseline which works as a direct filter on the image itself to get an upper bound estimate.

---

confidence: 3
contribution: 3
initial_rating: 6
presentation: 3
questions: - For point 1 in weaknesses, if the alignment method change, or, the key words change, not "sorry"/"apologize", will the activation layers in  Figure 2 change?

- For point 1 in weaknesses, how about the change of activation layers if we do not fully fine-tune all parameters of the model? For example, use PEFT for the pre-trained LLMs or just frozen the pre-trained LLMs. In such cases, will the trained LVLMs still suffer from toxic visual content?
    - If so, will the activation layers remain the same?
    - If not, the reviewer thinks the conclusion only holds for the fully fine-tuning case.

- In Table 2, how about the performance of a safety-aligned LVLMs like that in [1]?


- Point 2 in weaknesses, the reviewer thinks analysis about the extra cost is needed.

[1] Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Rottger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. Safety-tuned LLaMAs: Lessons from improving the safety of large language models that follow instructions. 2024.
soundness: 3
strengths: - Clear evidence for the safety activation mechanism.

- Straightforward and well-motivated methods. 

- TGA performs relatively well without any post-alignment steps.
summary: This paper aims to find why LVLMs suffer from toxic visual content when converting LLMs to LVLMs. They observe and analyze the safety activation mechanism in the transformers and develop specific methods, TGA, to alleviate the issue of LVLMS without any post alignment.
weaknesses: - 1. The analysis seems only work with the model developed by [1]. If the aligned models change, will the conclusion remain consistent?

- 2. Lack of analysis about the extra cost.


[1] Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Rottger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. Safety-tuned LLaMAs: Lessons from improving the safety of large language models that follow instructions. 2024.

Meta-review: The paper explores to transferring the safety mechanism in existing LLM to vision without additional visual safety fine-tuning. The authors first find that the existing vision-language alignment struggles to work at the hidden states level, which results in misleading the safety mechanism in LLM. They proposed the Text-Guided vision-language Alignment method (TGA) for VLMs, which retrieves the texts related to input vision and uses them to guide the projection of vision into the hidden states space in LLMs. Experiments show that the TGA approach not only successfully transfers the safety mechanism in LLM to vision, but also maintains the general performance on several vision tasks.

The reviewers raised weaknesses about insufficient experiments and analysis. 
The rebuttal from the authors well addressed the concerns. 
The reviewers keep the initial positive scores after rebuttal.

Overall, the paper has a clear motivation, and presents an effective method, advancing the techniques in building safe LVM.
I recommend to accept.

Decision: Accept (Poster)