SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism
Authors: Beitao Chen
Xinyu Lyu
Shengming Yuan
Jingkuan Song
Heng Tao Shen
Lianli Gao
Venue: NeurIPS 2025 poster ()
Keywords: Multi-modal LLMs
AI safety
Primary area: deep_learning

Abstract: By incorporating visual inputs, Multimodal Large Language Models (MLLMs) extend LLMs to support visual reasoning. However, this integration also introduces new vulnerabilities, making MLLMs susceptible to multimodal jailbreak attacks and hindering their safe deployment. Existing defense methods, including Image-to-Text Translation, Safe Prompting, and Multimodal Safety Tuning, attempt to address this by aligning multimodal inputs with LLMs’ built-in safeguards. Yet, they fall short in uncovering root causes of multimodal vulnerabilities, particularly how harmful multimodal tokens trigger jailbreak in MLLMs? Consequently, they remain vulnerable to text-driven multimodal attacks, often exhibiting overdefensive behaviors and imposing heavy training overhead. To bridge this gap, we present an comprehensive analysis of where, how and which harmful multimodal tokens bypass safeguards in MLLMs.
Surprisingly, we find that less than 1% tokens in early-middle layers are responsible for inducing unsafe behaviors, highlighting the potential of precisely removing a small subset of harmful tokens, without requiring safety tuning, can still effectively improve safety against jailbreaks.
Motivated by this, we propose Safe Prune-then-Restore (SafePTR), an training-free defense framework that selectively prunes harmful tokens at vulnerable layers while restoring benign features at subsequent layers. Without incurring additional computational overhead, SafePTR significantly enhances the safety of MLLMs while preserving efficiency. Extensive evaluations across three MLLMs and five benchmarks demonstrate SafePTR’s state-of-the-art performance in mitigating jailbreak risks without compromising utility.

SafePTR Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism
Beitao Chen' chenbei www.ttatlooommeoomom com
Xinyu Lyu xinyulyu68@gmall.om com
Shengming Yuan
shengming, ywan@outlok..coo com
Jingkuan Song* jingkuan. song@gmail, com
Heng Tao Shen'
Lianli Gao
thenbengtao@hotmail.ccoom
juana. aetaaallinnnnn alian@gmail. com
Shenzhen Institute Advanced Study, University of Electronic Science and Technology of China SSuuthwestern University of Finance and Economics, Chengdu, China Engineering Research Center of Intelligent Finance, Ministry of Education "Tongji University
Abstract
Content Warning: This paper contains a few harmful images and texts! By incorporating visual inputs, Multimodal Large Language Models (MLLMs) extend LLMs to support visual reasoning, However, this integration also introduces new vulnerabilities, making MLLMs susceptible multimodal jailbreak attacks and hindering their safe deployment. Existing defense methods, including Image- to- no-Text Translation, Safe Prompting, and Multimodal Safety Tuning, attempt address this by aligning multimodal inputs with LLMs' built-in safeguards. Yet, they fall short uncovering root causes of multimodal vulnerabilities. particularly how harmful multimodal tokens trigger jailbreak in MILMs? Consequently. they remain vulnerable to text-driven multimodal jailbreaks, often exhibiting overde- fensive behaviors and imposing heavy training overhead. To bridge this gap, we present an comprehensive analysis of where, how and which harmful multimodal tokens bypass safeguards in MLLMs. Surprisingly, we find that less than 1% tokens early-middle layers are responsible for inducing unsafe behaviors, high- lighting the potential of precisely removing small subset of harmful tokens, without requiring safety tuning, can still effectively improve safety against jail- breaks. Motivated by this, propose Safe Brune-then-Restree (SafePTR), training-free defense framework that selectively prunes harmful tokens at vul- nerable layers while restoring benign features suhsequent layers. Without incurring additional computational overhead, SafePTR significantly enhances the safety of MI.LMs while preserving efficiency. Extensive evaluations across three MLLMs and five benchmarks demonstrate SafePTR's state-of-the-art performance in mitigating jailbreak risks without compromising utility. Our code available https: http//ggtttbbbtt com wtt.eot Bt////TTCC/SSfPPPP
Introduction
Multimodal large language models (MLLMs) OpennAl 2023 et al. 2024 Liu et al. 2023a Bai
et al. 2023 Zhu et al., 2023 extend the capabilities of large language models (LLMs) Touvron
*Corresponding author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Text-Driven Jailbreks
X
Overdefause
Training- Seiining-verhead
Iteoline
produce t
Adshied
BC5O
irditt
Inmar
Oura
213
Image to Text Translation
+
safety constraints
1223k traiming > 2xinference intency
23
Producing involves
am sorry, children should avoid this dangerous ftrm...
several steps, inchoding:
Sketeh the shage...
Abros MELL
Train
Training Sinckit Inforees SpecifSccsl
(3) Irogge-io Text Translation
(b) Safo Prompting
(6) Muliimodal Safety Tuning
(4) Performance
Figure I: (Left) Existing MILM defense methods remain susceptible to text-driven multimodal jailbreaks, cxhibiting overdefensive behavior and imposing heavy training overhead. (Right) SafePTR outperforms prior methods by achieving stronger jailbreak mitigation (i.e., Jailbreak28K, Figstep and MM-Safety), better preserving task utility (i.e.. MMVet and MME), and minimal computational overhead (i.e., Training- free and One-bypass Inference). Performances of SafePTR across more MLLMS are provided in Appendix.A
et al., 2023 Chiang et al. 2023 Jiang et al. 2024 to visual inputs, enabling unified language-vision
reasoning. Despite strong performance across multimodal tasks, MLLMSs remain vulnerable to
multimodal jailbreak attacks [Luo et al. 2024b Gong et al. 2025 Dong et al. 2023]. raising critical
safety concerns for secure deployment.
To mitigate safety risks in MILMs, existing approaches [Gou et al. 2024 Guo et al. 2024 Ghosal
et al. 2024 Gao et al. 2024. Gong al. 2025 primarily adapt multimodal inputs align with the built-in safeguard mechanisms of underlying LLMs, inherited from prior safety alignment processes conducted during LLMs' safety fine-tuning stage. These methods generally fall into three categories:
(1) Image-to-Tie Text Translation [Gou et al. 2024, Guo et al., 2024). which converts visual inputs into textual descriptions to leverage LLM's existing safety boundaries, but remains susceptible to text-driven multimodal jailbreaks (Fig (a)); (2) Safe Prompting [Wang et al., 2024b Gong et al. 2025). which injects static safety constraints into instructions to suppress unsafe completions, but often leads to overdefensive behavior that degrade model's 's utility on benign inputs (Fig [ig](()); and (3) Multimodal Safety Tuning [Liu et al. 2024b|c leverages safety-specific datasets either train dedicated risk detectors [Ghosal et al. [0244 or align multimodal representations with LLM safety priors via cross-modal supervision Gao et al. 2024] While effective, these methods incur substantial training overhead and exhibit limited generalization to unseen jailbreaks (see Fig. [c)..
The root cause lies in existing methods' reliance on the built-in safeguards of LLMs without uncover- ing the underlying mechanisms of multimodal vulnerabilities, particularly "how harmful multimodal tokens exploit internal representation pathways to trigger jailbreaks?" ?" thereby limiting the devel- opment of interpretable defenses tailored for MLLMs. Specifically, (1) Image-to-Text Translation ignores where vulnerabilities occur by bypassing visual processing layers. By directly converting images into text and relying solely on LLM's built-in safeguards, it remains susceptible to text-driven multimodal jailbreaks. particularly when the adversarial textual prompts (e.g.. from JailbreakV. 28K (Luo et al. 2024b)) already evade these defenses; (2) Safe Prompting uniformly applies static safety constraints across various inputs, without adaptively modeling how unsafe behaviors emerge in different contexts; This lack of adaptivity prevents the model from identifying fine-grained safety concepts, such as distinguishing "a toy water gun" " from "a real weapon" " Fig. [[b,, often resulting in overdefensive responses that compromise utility in benign scenarios; (3) Multimodal Safety Tuning enforces safety alignment based on dataset-specific defense preferences, but fails to identify which multimodal tokens trigger jailbreaks, limiting interpretability and adaptability. For example, TGA [Lu et al. 2024c relies on 1223K samples to train a safety preference model, incurring high cost (involving 64 x VI00 GPUs) while offering limited robustness across diverse jailbreak scenarios.
To address these limitations, we conduct an in-depth investigation into where, how, and which harmful multimodal tokens bypass the safeguard mechanisms within MLLMs during jailbreak attacks. (1) Where: we perform a systematic layer-wise analysis to identify layers most susceptible to malicious input. By selectively removing harmful input across different layers and measuring changes in Attack Success Ratio (ASR), we observe that only a small subset of early-middle layers are particularly vulncrable to multimodal jailbreaks.
(2) How: to understand how jailbreaks occur, we compare

---

hidden states triggered by malicious inputs against those induced by safety-aligned ones. Our analysis shows that samples exhibiting greater semantic deviation from safety-aligned representations are more likely to trigger jailbreaks, highlighting semantic drift as key factor in bypassing safeguards. (3) Which: to identify which specific tokens cause this deviation, we compute token-level semantic distances to a safety reference within the most vulnerable layers. Surprisingly, less than 1% of multimodal tokens lead to significant semantic shifts.
Based on our analysis, we propose Safe Prune-then, then-Restore (SafePTR), a training-free and token-level defense framework that mitigates multimodal jailbreaks by pruning harmful tokens in vulnerable layers and restoring benign features to recover contextual information while preserving model utility. Extensive experiments demonstrate that SafePTR effectively enhances robustness against multimodal jailbreak attacks across 3 MLLMs (LLaVA-1.5, MiniGPT-4, and DeepSeek- -VL) on 3 safety benchmarks, including MM-Safety Bench, FigStep, and Jailbreak28k, without requiring additional training or compromising task performance on MME and MM-Vet benchmarks.
To sum up, our main contributions are as follows: (1) We conduct an in-depth analysis of jailbreak mechanisms, offering novel perspective to advance defense strategies tailored for MLLMs; (2) We introduce SafePTR, an efficient and effective defense framework that enhances robustness while preserving utility without any training overhead; (3) Extensive experiments demonstrate that SafePTR outperforms state-of tfrtte-art baselines, providing robust, efficient, and against both vision- and text-driven multimodal jailbreak attacks.
defense
2 Harmful Token Propagation and Jailbreak Activation
In this section, we analyze where, how, and which harmful multimodal tokens bypass safeguard mechanisms in MLLMs. We first identify vulnerable layers via layer-wise ablation. We then measure semantic deviation from safety-aligned instructions examine how these layers respond to adversarial inputs. Finally, we trace the deviation to specific tokens, finding that only a small subset plays an outsized role in triggering jailbreaks.
Experimental Setting: We study three MLLMs, LLaVA-1.5-7B [Lu et al. 2023a]. MiniGPT-4 (Zhu
al. 2023), and DeepSeek-VL (Lu al. 2024), which exhibit notable jailbreak vulnerabilities. To analyze how malicious semantics propagate, we use two multimodal jailbreak datasets: (1) FigStep [Cong al. 2023), which transforms harmful instructions into typographic images across 10 prohibited categories (500 text-image pairs); and (2) MM-SaferyBench [Liu et al.) 2023b), which employs jailbreak images from Stable Diffusion and typography across 13 restricted scenarios (5,040 pairs), Once processed by the MLLMs, these images are encoded into tokens whose harmful semantics influence model behavior across layers.
Moreover, following [Wang et al. 2024b Gao et al. 2024 Luo et al. 2024a we adopt the Attack Success Rate (ASR) to measure the vulnerability of these models multimodal jailbreak attacks. Specifically, given a test dataset Dunsate of crafted jailbreak image-text pairs, the ASR quantifies the ratio of harmful responses to the total number of input queries and is defined as:
ASR
Σ
I[C (o,,T(((xx))) = True].
[Dunsafe
(I,
0.30
Mumber of lyms
anevd layes
Alacc Pecccac Zas (AXk)
0.10
(c) 1.577
(b) M77
(c) DrepSorte V1.2
Figure 2: Layer-wise vulnerability analysis of MLLMs. Each curve represents the Attack Success Rate (ASR)
under layer-wise interventions with varying contiguous layer spans & = 2, 4. The orange region highlights the layers most susceptible to safety breaches, with its left and right boundaries marking the earliest and latest compromised layers within the model, respectively. Since the intervention requires & consecutive layers, the horizontal axis is limited to the range (0, L k).
3

---

Finding-1 (where): A few early-middle layers are especially vulnerable to harmful tokens. We conduct Layer-wise Intervention Analysis (LIA) (see Appendix.B for details) to identify layers most susceptible to malicious inputs by sequentially removing hidden states of the attack-triggering modality (visual or textual) and observing their impact on model behavior. Specifically, for each layer window [n,, n + An). we disable the influence of the malicious modality. As shown in Fig. 2 the resulting changes in Attack Success Rate (ASR) across layers reveal the model's vulnerability profile.
Through Layer-wise vulnerability analysis, we observe that while harmful tokens propagate through all layers, their impact on attack success varies significantly. For LL5VA-I.5-7B. DeepSeek-VLL and MiniGPTT---7B. pruning harmful tokens in just 2-4 consecutive middlee layers (e.g., [7.9). [4. 6). or [7, 9)) significantly reduces ASR from 67.3% to 4.2%, revealing that jailbreak attacks mainly exploit a narrow band of contiguous vulnerable layers. In contrast, pruning subsequent "safety layers" provides limited defensive benefit, as they are primarily responsible for cross-modal integration and language refinement (Yue et al.) [024 Liu et al. [0224a]. This is further supported by our ablation study 4.4 which shows that restoring benign features in these layers significantly enhances utility.
Finding-2 (how): Greater semantic deviation from safety alignment increases jailbreak suscepti- bility. Building on Finding-1, we further examine how jailbreaks manifest in layers most susceptible to harmful tokens' influence. Considering that the safety-aligned instructions in AdaShield (Wang al., 2024b] have been shown to effectively enhance model safety, we adopt them as semantic references to define the model's 's aligned safety space. Specifically, we compute both Cosine similarity (y-axis) and Euclidean distance (x-axis) between the hidden states of input samples and those within safety-aligned instructions.
Figstep
MMSalayBench
Figstap
MMSafetyBanch
0.000
0.575
0.25
0.500
05:
0.5
0.755
0.500
0.4
0.700
0.475
0.4
0.5
022
0.4
0.28
0.30
(6) LLaVA-1.5-715
(b) MiniGPTT-4-76
Figure 3: Semantic distance distribution between safe and unsafe samples. We compute cosine similarity (y-axis) and Euclidean distance (x-axis) between input samples and a safety-aligned instruction. Results are shown for (a)LLaVA-11.5 -A15577 and (b)MiniGPT-4-7B on two types of jailbreak benchmarks, i.c., Figstep (Ieft) and MM-SafetyBench (right). Unsafe samples exhibit greater semantic deviation than safe ones.
As shown in Fig. 3 (b), both LLaVA-1.5-7B and MiniGPT-4-7B are evaluated on adversarial samples from FigStep (left) and MM-SafetyBench (right). Defended/safe samples (blue) cluster near the safety-aligned instruction, whereas attacked/unsafe samples (orange) are more dispersed and shift toward the upper right, reflecting greater semantic deviation, quantified by the average centroid distances between safe and unsafe representations: 0.11 and 0.14 for LLaVA- 1.5-7B on MM- SafetyBench and FigStep, while 0.13 and 0,02 for MiniGPT-4, Although semantic deviation does not inherently imply malicious intent, samples with greater deviation from the safety reference are statistically more likely to trigger jailbreaks (unsafe v.s. safe), indicating that semantic drift plays a central role in bypassing model safeguards.
LLaVA-115-7B
Average (6.5% 13.4%) 32- 0.625 %
0.0% % 4
0.0 %
6.5 %
13.4 %
Deviation Heatmap (5
Harmful tokens ( My)
0.0 %
+
4
pa
V7
ya
Layer 0-6
Layer 7-8
cns ,ea)
[o] c vv
Layer 31
Safety-slignad Instmmttion
Rd
Layer
Figure 4: Token-wise semantic deviation analysis for L.L Left: layer-wise distribution of harmful tokens across all layers. Middle: semantic deviation heatmap at layer 8 (brighter higher deviation). Right: blurred overlay of identified harmful tokens. More visualization results of heatmaps across MiniGPT-4. DeepSeek- VL2 on FigStep and Benet provided in Appendix.C.

---

Finding-3 (which): A small fraction of harm- ful tokens induce significant semantic devi- ation from safety-aligned tokens. Building on 2 we further investigate which indi- vidual tokens are responsible for such semantic deviation. To this end, we compute the semantic distance(SS = - cos(V', It') between tokens (V") and the safety-aligned instruction represen- tation (R') layer-I across samples from both FigStep (500) and MM-SafetyBende Bench (5040). Tokens whose deviation(s exceeds the threshold (a)
Dataset
LLaVA-I.5
MiniGPT44
DeopSock-VL2
MM-SafeyyBench
0.62%
0.93%
1.66%
FigStep
0.56%
0.81%
1.25%
Vulocrable Layees
(7.9)
(7.9)
[4.6)
Table I: Harmful Token Ratio (%) across VL..5-
MiniGPT-4 and DeepSeek-VEs VL.2 on Figstep and MM- SafetyBench.
marked harmful ones (utz Vt). As shown in Fig. for LLaVA-1.5-7B, an example from
MM-Safety Aenna in early-middle layers (e.g., [7. 9)), accounting for only 0.62% of all input tokens. Similar patterns are observed on Figstep across MiniGPT-4-7B (0.93% and DeepSeck-VLL VL2 (1 (1.66%), ), as summarized in Tab. IT This phenomenon may stem from the presence of attention sinks MM et al. 2023 Zhang et al. 2024b), where small subset of tokens disproportionately attracts attention, dominates the model's s internal representations, and consequently concentrates harmful content within these domi- nant tokens. To further analyze their impact, we visualize both a semantic deviation heatmap (55) and an overlaid binary mask (V {uf E V* at layer 8 using a sample from ----SaftteBeeee Tokens representing "armed figures," "smoke," and "terrain" associated with violent scenarios exhibit high semantic drift. Interestingly, several background tokens also show large deviations, suggesting that semantically deviant cues from inconspicuous regions can disrupt overall structure, amplify misalignment, and weaken model's ' safeguards against jailbreaks.
Bench illustrates that harmful tokens are sparsely distributed and primarily concentrated
3
Safe Prune-then-Restore
Based on the observations outlined above, we propose Safe Seine-then-Restiee (SafePTRR, training- free token-leve level intervention framework designed to mitigate jailbreaks while preserving utility, as shown in Fig. 5 Informed by Finding-1, we first identify small subset of early-middle layers that are especially susceptible to harmful tokens' influence; these layers serve as the primary intervention points in our framework. Building on Finding-3, we measure the semantic distance between each input token and a safety-aligned instruction, derived from carefully crafted safety-alignt and select the Top-K K most divergent tokens pruning candidates. Guided by Based on Finding-2, we prune these semantically misaligned tokens to suppress harmful signals and shift the representation toward the safety prior. To preserve reasoning ability, we then introduce restoration step at safety layers to selectively recover benign features.
instructions,
Safay Layers
1062, LI
(a + 21-th LLM Layer
a-B
Beslore
Benign Features Restoration
Tosere
Vilacrable Layes
In 2+
n-th LLM Layer
Berign Features Resoration
Vision Bncoder
Simaaiiy Soore
Bunking
Pruncd Twkee
Harmful Token Pruning
Instuction Tokers
huld
Answer sifely
famniil
(a 11-th LLM Laver
Sinibaity
Safety-Pnovinal
Tokenizer
X
1-th Layer
lntrictiuus
Saft IEstUCtions:
Hammial Tokan Pranzng
Figure 5: Overview of SafePTR framework. The Harmful Token Pruning (HTP) module removes harmful visual and textual tokens in early vuinerable layers by comparing them with safety-aligned instruction. The Benign Feature Restoration (BFR) module then recovers task-relevant benign features in later layers to preserve model utility. This decoupled design ensures interpretability and enables training-fres, lightweight deployment.
3.1 Harmful Token Prumning
As indicated in Fig. 2 the very early layers, contribute minimally to harmful behaviors For the subse- quent layers (n, An,)) ). where A, = (e.g.. layers (7,9) for L. AAV...5-77 1.5-7B and MiniGPT-4-7B, lay- ers [4, 6) for DeepSeck-VL.. Harmful Token Prunning (HTP) is applied to remove vision/instruction
5

---

harmful tokens, as shown in Eqn. 2
H ins saffel = FFN' (H img: Hin.. H'afee)). E [n, + An).
H
(2)
ing E RMxD and H H'aje E RCDD denotes the hidden states of user instructions, input images and safety-aligned instruction I th layer. Due to variations in harmful content across inputs and differences in alignment strength across different models, universal thresh- old for identifying harmful tokens is impractical. Instead, we adopt Top-K selection strategy [Chen] et al. 2024 and empirically determine a globally effective Top-K value to guide the pruning process, as shown in Tab. [ By computing the distance between visual tokens and hidden states of safe-aligned instructions, i.e., "Please answer this question safely and accurately. Reply 'I am sorry.' if the content harmful." " in Eqn.
Here, H =E RTXD, King
HELp
Σ Cossine(u, 8M)
< Σ Cosine(vy, 8M), (U2, By E H Hi 8M E H safer
(3)
the Top-K tokens that deviate most from safety space are identified and subsequently removed using HTP, as defined in Eqn. 2 F!!gg HT HTP((H) (Hi (hy E H mo lj & [p]. Similarly, for textual user instructions, we also apply pruning process procedure (Eqn. 2) to eliminate harmful instruction tokens. Due to inherent distance discrepancies between image and text embeddings, pruning is conducted separately for visual and textual modalities. This modality-speciftt design allows our method to effectively defend against both visual- and text-driven jailbreak attacks.
3.2 Benign Features Restoration
After pruning harmful tokens in vulnerable layers, the subsequent layers operate on incomplete visual representations, lacking fine-grained contextual interactions. To restore utility without compromising robustness, we introduce the Benign Feature Restoration (BFR) module, which selectively reintegrates benign features while avoiding harmful semantics. Formally, the restored hidden states are computed as: SH BFR F
ing H.in 1)). Specifically, while HTP prunes harmful tokens within layers [n, n + A.), BFR maintains a parallel branch that performs standard inference over the same layers and selectively restores benign features. This dual-path design enables the recovery of hidden states in subsequent layers, which are less susceptible to attack and primarily responsible for cross-modal integration and language refinement. By restoring previously pruned tokens at this stage, the model preserves functional performance without compromising safety. As shown in Equ.
[ H ina safel = FFN (Attention' ([ SH H Helfel). = n An.
(4)
To achieve this, BFR identifies a complementary index set i, = {t1, f2, ..., t& such that L, Li, = Ø, Ip Uf, = 21.2...TT These indices Ip and iip are then used to retrieve the corresponding hidden states from mmoge and Ha respectively. The selected elements subsequently reordered to reconstruct the original token sequence, as formalized in Eqn. 5
Ois i i E }. U4 i Ip.
BFR(H An-1 H -1 [h,, 1)|h,
(5)
smg
This restoration operation is first applied to the visual modality, resulting in the reconstructed repre- sentation S img To ensure consistency across modalities, an analogous process is independently
applied to the instruction tokens, producing SH These two restored streams are then jointly integrated into the full inference pipeline, as detailed in Eqn.
4 Experiments
4.1 Experimental Details
Implementation Details. Following Immune Ghosal et al. 2024], we implement the proposed
SafePTR using Hugging Face Transformers library. The LLa VAI.5-BB results are based on version 1.2.2 from the official benchmark repository. We set the number of tokens sampled = 10%. For LLAVA-I.5-7B, DeepSeek- and MiniGPT-4-7B, harmful tokens are pruned in layers [7, 9), [4, 6). 9). We repeat the experiments five times for each metric with different random seeds. All experiments are conducted on four RTX3090 GPUs.

---

Baseline and Comparable Methods. We evaluate SafePTR on three state-of- of-the--rtttttt- open open-source
MLLMs: LLaVA- 1.5-7B (Liu et al., 2023a], MiniGPTT4-7B (Zhu al. 2023], and DeepSeek-
V1.2-Tiny [Lu et al. 2024]. Comparisons are made against recent jailbreak defense methods,
Immune Waag et al. 2024a], Adashield WWagg et al. 2024b), ECSO [Gou et al., 2024], CoCA [Gao
et al. 2024]. and FigStep [Gong et al. 2023], under unified test set and consistent metrics.
E Evaluation Benchmarks and Metries. We assess model performance across three aspects: Safety: We use Jailbreak V-28K eLuo 2024b (text-driven), MM-SafetyBench [Liu et al. 2023b)
and FigStep [Gong et al.
2025] (image-driven), reporting Attack Success Rate (ASR) [Wang et al.
2024b Gao et al. 2024]. (2) Utility: Benign task accuracy is measured on MME (Fu et al., 2023
and MM Vet Yu et al., 2024), which evaluate multimodal understanding and visual reasoning. (3)
Efficiency: We report training data size (K) and inference latency (sec/sample) to evaluate efficiency.
Model
Method
Noise
SD
Nature
Blank
Avgl
T2
PJ
L1
T1
PL
L1
T
P1
L1
T1
P.
L1
Original
57.1
29.2
62.1
60.5
39.1
72.9
59.0
31.8
59.4
57.4
30,9
60.8
51.7
FigStep
59.5
52.3
40.5
57.1
54.9
50.0
58.4
58.4
44.5
60.8
51.1
40.5
52.3
CoCA
61.2
39.1
62.1
61.3
41.2
52.7
63.1
35.2
55.4
61.0
37.3
52.7
51.3
L.VAA-1557B
ECSO
57.3
25.4
58.1
57.3
25.4
58.1
57.3
25.4
58.1
57.32
25.4
58.1
46.9
AdaShield
21.6
1.4
17.5
24.6
1.4
22.9
23.2
0.8
17.5
21.8
1.4
17.5
14.3
Immune
9.2
0.0
0.0
8.1
0.0
0.0
1.4
0.0
0.0
5.3
0.0
0.0
2.1
SafePTR
3.5
0.0
0.0
1.6
0.0
0.0
5.1
0.0
0.0
5.3
0.0
0.0
1.3
Original
36.4
71.6
38.3
78.6
83.7
34.8
51.1
67.5
43.5
56.7
78.3
58.3
FigStop
32.6
83.3
66.2
30.8
69.5
71.6
27.2
50.2
59.4
31.1
62.5
48.6
52.7
CoCA
35.1
18.2
22.9
40.3
21.1
31.0
35.2
18.4
27.0
48.1
21.3
40.5
29.7
MiniGPT-4-7B
ECSO
46.3
57.8
71.6
46.9
58.4
71.6
46.3
57.8
71.6
46.3
57.8
71.6
58.7
AdaShield
40.1
71.0
94.5
49.1
83.0
94.9
47.3
40.9
72.9
32.7
49.7
85.1
63.4
Immune
18.2
6.1
44.5
11.3
8.2
29.7
17.1
8.4
27.0
16.0
10.3
43.2
18.3
SafePTR
13.3
5.5
29.7
10.1
4.4
22,9
12.9
3.5
17.5
11.6
2.9
17.5
12.6
Original
95.9
64.9
98.6
56.4
56.7
90.5
61.1
72.7
FigStep
37.1
24.2
60.8
44.0
29.2
51.3
42.4
24,5
41.8
44.2
26.0
56.7
40.2
DeepSock-VL2
ECSO
50.8
50.0
97.2
50,8
50.0
91.2
50.8
50.0
97.2
50.8
50.0
97.2
66.0
AdaShield
14.2
6.7
2.7
21.6
25.4
22.9
22.7
14.9
12.1
19.6
8,4
1.3
14.4
SafePTR
9.2
2,9
1.3
17.1
16.0
10.3
17.5
18.4
10.1
9.2
6.7
2.7
10.1
Table 2: Evaluation on JailbreakV-28K We report Attack Success Rate (ASR. better) across MLLMs and defense methods. Image inputs include noise, Stable Diffusion (SD), natural, or blank images; text prompts template- sasplae-baaed (T), persuasive (P), or logic-driven (L). Haama-Guar-33 is used as the jailbreak classifier. Best results are in bold and all values are in percentage(%6.
Model
Method
Illegal Activity
Malware Generation
Pomegraphy
Hate Spetch
Physical
Fraud
Avgl.
5
5-T
5-T
S-T
S-T
Original
59.1
50.0
36.7
75.5
24.4
57.7
21.8
5.4
50.0
34.7
27.4
64.6
82.7
50.3
83.4
61.9
36.1
69.5
52.3
FigStep
32.6
45.9
$1.6
31.1
31.1
62.2
27.2
6.3
68.1
34.1
18.9
51.2
55.8
36.5
72.4
50.3
32.9
69.0
44,8
CaCA
17.1
80.4
30.4
15.9
27.7
9.9
8.0
52.0
55.0
10.0
63.1
67.0
25.0
45.0
57.0
26.0
57.0
59,0
44.5
1..VA-1.5778
ECSD
AddStield
3.0
0.0
4,4
0.0
22.2
1.8
20.0
0.0
11.7
7.5
46.8
2.5
40.6
12.3
Immunee
0.4
1.0
0.0
0.4
0.0
13.6
6.9
9.0
19.0
0.5
3.0
5.0
5.1
4.0
7.0
0.0
0.0
6.0
3.5
SatePTR
1.0
0.0
2.0
0.00
0.0
0.0
0.0
0.0
18.1
0.01
0,11
0.0
6.8
0,0
8.2
1.2
11,0
3.8
2.3
Original
69.3
65.3
38.7
40.0
44.4
40.0
78.1
20.9
35.4
26.8
57.3
34,1
60.6
54.4
42.0
57.4
49.0
40.6
44.7
FigStep
69.3
28.1
20.0
53.0
54.4
CaCA
9.2
42.2
28.8
6.8
20.4
18.1
19.0
12.0
24.0
12.0
10.0
25.0
16.6
26.0
25.0
8.3
25.0
18.9
MisHGPPT-477
ECSO
21.4
63.2
65.3
71.1
37.7
37.7
31.8
16.3
10.9
26.2
28.6
20.2
65.5
44.1
45.5
41.2
45.1
48.1
40.5
AddStiiedd
19.3
39.1
63.2
33.3
40.0
48.8
16.3
26.3
32.7
26.2
41.4
46.9
42.7
51.7
64.8
22.5
46.4
56.1
41.0
Immune
13.4
11.3
8.0
14.01
01.1
11.3
SutePTR
2.2
11.1
3.6
8.5
9.1
13.1
9.9
11.6
3.8
8.0
Original
83.6
74.4
69.3
60.0
64,4
73.3
20.9
30.0
34.5
59.7
43.9
39.6
80.6
65.5
61.3
84.5
56.1
58.0
59.4
FigStop
52.0
91.8
41.8
35.5
71.1
28.8
13.6
67.2
50.0
21.3
90.4
35.1
23.4
58.9
66.8
65.
86.4
36.7
53.2
DesgSeck VL2
ECSO
87.7
43.8
43.8
71.1
26.6
26.6
17.2
1.8
2.7
49.3
20.1
19.5
80.0
28.9
25.9
85.8
31.5
32.9
38.8
AdiShield
16.3
S0EPPT
11.7
37.7
36.1
6.9
21.4
20.4
9.0
9.0
17.1
13.6
22.5
25.9
28.0
31.1
32.9
18.2
Table 3: Evaluation on MM-Safety Bench. We report the Attack Success Rate (ASR.) across six prohibited categories, using GPT-4 as the jailbreak classifier. Bold highlights the best (i.e., lowest) ASR values. The attack image types include typography- based images (T), visuals generated by Stable Diffusion (S), and Stable Diffusion images with overlaid typography subtitles (S-T).
4.2 Safety Evaluation Results
Text-driven Jailbreak Attack. To evaluate the effectiveness of SafePTR against text-driven jail- break, we conduct experiments the Jailbreak W-llbreak-28KKK benchmark using MLLMs, LLaVA-LL5-7B.
7

---

Model
Method
Activity
Ielaall
Speech
Hote
Mulware Generazion
Physical
Adult Content
Privacy Violazion
Legul Oginion
Financial Advice
Health Consultaiin
Argl
Original
92.00
48.00
90.00
94.00
84.00
28.00
66.00
0.00
0.00
8.00
51.00
FigStep
56.00
50.00
54,00
62.00
84,00
26.00
54,00
0.00
0.00
6.00
39.20
CoCA
44.03
8.23
38,01
22.08
5.49
42.48
9.65
64.15
41.9
30.45
28.63
LLaVA-L5578
ESCO
62,00
50,00
4,00
29,00
AdaShield
4.00
16,00
16.00
8.00
48,00
8.00
30.00
0.301
0.00
0.80
13.00
Immane
28.21
0.30
6.30
2,12
0.001
(..00
0.00
4,401
3.84
1.86
4.23
SafePTR
0.00
0.00
0.00
4,00
6.00
0.00
6.00
0.00
0.00
0.00
1.60
Original
74.00
72,00
96,00
94.00
88.00
28.00
64,00
0.00
4,00
14,00
53.40
FigStop
92.00
56.00
18.00
46.20
CoCA
7.85
0.00
0.00
2.47
1.85
6.36
0.00
15,63
13.87
6.28
5.74
MiniGPT-4-7B
ESCO
64.00
$2,00
90,00
78.00
78,00
22.00
16.00
4,30
$.00
10.00
15.20
AdaShield
32.00
42,00)
52,00
50.00
54,00
6.00
60.00
0..00
0.00
10.00
30.60
Immmane
7.98
0.00
9.82
0.00
0.00
7.85
5.71
3:59
4.43
SaiePRR
2,00
0.00
3.60
Original
50.00
82,00
98.00
91.00
86.00
12.00
80.00
0.00
0.00
12.00
51.10
FigStop
50.00
84,00
82,00
78.00
96.00
22.00
80,00
2,00
4.00
14,00
$4.20
DeepSeck-V122
ESCO
90.00
76.00)
98.00
92.00
94.00
22.00
82.00
01.001
4.00
10.00
56.80
AdaShield
76.00
74.00
82.00
76.00
80.00
0.000
18.00
51.80
SafePTR
12.00
14,00
16,00
18.00
0.00
2,00
9,80
Table 4: Evaluation on FigStep. We report ASR (J), using GPT-4 as the jailbreak classifier. The best-performing
results (i.c., lowest ASR) are highlighted in bold.
MiniGPT-4-7B. and DeepSeek-VL22, in terms of Attack Success Rates (ASR) in Tab. We observed that: (1) SafePTR achieves the lowest ASR across models, for example, 0.98 on LL. (vs. 2.10 Immune, 14.36 AdaShield), 6.48 on MiniGPT-4-7B. and 2.46 on DeepSeck-VL2 VL2. (2) It maintains robust performance across prompt-image combinations, with ASRs remaining below 5 in most scenarios. (3) Under strong adversarial conditions (e.g.. logic prompts combined with noise images), SafcPTR significantly reduces ASR, from over 70 to 2.71 on MiniGPT-4-7B and to 1.35 on DeepSeek-VL.. These results confirm SafePTR's effectiveness against text-driven multimodal jailbreak. Visualization results on Jailbreak V-28 are provided in Appendix.D.
Vision-driven Jailbreak Attack. To evaluate the robustness of SafePTR against vision-driven jailbreak, we conduct experiments on two representative benchmarks: FigStep: As shown in Tab. 4 SafePTR consistently achieves the lowest ASR across all harmful categories. On LLaVA-1.5-7B, reduces the average ASR to 1.60 (vs. 4.23 for Immune, 13.00 for AdaShield), with similarly strong performance MiniGPT-4-7B (3.60) and DeepSeck-VLL VL2 (0.40). Even in high-risk categories like Illegal Activity and Malware Generation, SafePTR maintains near-zero ASR (c.g., 0,00 on DeepSeck-VL2) MM-Safety Bench: Tab. reports SafePTR's performance under SD, TYPO, and SD-TYPO attacks across six prohibited categories. It again outperforms all baselines, achieving the lowest average ASR on LLaVA- 1-55-------BBBB (1.29), MiniGPT---78 (8.04), and DeepSeek- VL2 (3.54). These results validate SafePTR's s effectiveness against both typographic and generative vision-driven jailbreak attacks. Visualization and evaluation on more benchmarks are provided in Appendix.E.
Model
Method
Existence
Count
Position
Color
Posters
Colebrity
Scene
Landmark
Artwork
OCR
Percetion Total
Original
190.0
155.0
128.3
170.0
146.5
135.8
158.0
162.8
119.5
137.5
1503.6
FigSiup
190.0
103.3
165.0
150.6
136.4
155.7
165.3
122.5
117.5
1471.5
LLAVA-15-78
FSCO
190.0
155.0
128.3
170.0
146.5
135.8
158.0
162.8
119.5
137.5
1503.6
AdaShield
190.0
158.3
130.0
175.0
144.5
142.6
156.2
165.3
119.0
140.0
1521.1
SafePTR
190.0
158.3
133.3
165.0
145.5
140.2
158.0
165.0
120.0
162.5
1538.1
Original
110.0
73.3
58.3
70.0
45.2
60.0
106.2
59.0
74.5
85,0
741.6
FigStep
95.0
78.3
70.0
80.0
50.0
53.5
119.2
55.0
68.5
72.5
742.1
MinkGPT-4-78
ESCO
110.0
73.3
58.3
70.0
45,2
60.0
106.2
59.0
74.5
85,0
741.6
AdsShicld
55,0
61.6
51.6
58.3
26.8
37.3
79.0
48.2
46.7
10.0
171.8
SatePTR
16000
63.3
60.0
73.3
401.4
51.4
122.0
54.0
84.0
87.5
796.1
Original
200U0
148.3
146.6
141.6
127.2
153.8
157.7
166.5
135.5
162.5
1540.
FigStep
190.0
136.6
143.3
136.6
152.0
164.7
153.5
163.5
137.0
117.5
1494.9
DeepScck- VL2
ESCO
20018
148.3
146.6
141.6
127.2
153.8
157.7
166.5
135.5
162.5
1540.
AdaShield
185.0
143.3
105.0
151.6
141.1
167.3
145.7
151.5
139.0
110.0
1439.7
SafePTR
200.0
146.6
146.6
127.5
154.4
157.7
167.5
136.2
162.5
1541.
Table 5: Utility scores on MME across 13 visual reasoning tasks. Bold indicates the best result per category.
4.3 Model Utility Evaluation Results
An effective jailbreak defense must mitigate adversarial risks without compromising model utility. To evaluate this, we assess SafePTR on two standard multimodal benchmarks: MME and MM-Vet. As shown in Tab. 5 and Tab, 6 SafePTR consistently achieves the highest utility scores across all models
8

---

on both MME (e.g., 1538.1 on LLaVA-1.5-7B) and MM- Vet (e.g.. 53.0 on DeepSeek-VLLe These results demonstrate that SafePTR offers a superior safety-utility trade-off, enhancing robustness while preserving fineggraine multimodal understanding.
4.4 Efficiency Evaluation Results
Training cost and Inference Time. An ideal defense should be both effective and efficient. To assess this, we compare SafePTR with prior methods in training size (samples K) and inference latency (secs), as shown in Tab. SafePTR achieves leading performance on safety and utility benchmarks while remaining lightweight. requires no training (vs. 1223K/ 7lk for TGA//mmune) and runs in 3.51 secs with one-pass pass pipeline, faster than multi-pass past methods like ECSO or CoCA. These results underscore SafePTR's practicality for real-world deployment, offering strong robustness and generalization without additional training or runtime cost.
Ablations on Proposed Compo- nents. To assess the contribution of each SafePTR component, perform an ablation study isolating the effects of Harmful Token Prun- ning(HTP)) and Benign Features Restoration(BFR) on safery (Fig- step and MM--SffeyBenchh and util- ity (MM- Vet and MME). As shown in Tab. 2 applying HTP alone signif- icantly reduces the ASR from 52.3 to 3.06, but at the expense of utility due the removal benign contextual in- formation. Incorporating the restora- tion module retains the safety bene- fits while markedly enhancing utility, outperforming the baseline by 34.49.
Model
Method
know
gen
spat
math
total
Baseline
35.3
21.9
17.3
21.2
24.9
7.7
30.3
FigStep
31.9
18.2
14.5
18.5
20.3
0.0
26.6
LLaVA-15-7B
ESCO
35.3
21.9
17.3
21.2
24.9
7.7
30.3
AdaShield
27.5
12.9
12.6
17.5
20.5
3.8
21.6
SafePTR
36.8
23.9
20.1
20.0
32.1
11.2
32.3
Baseline
21.1
12.7
10.8
9.5
17.5
7.7
18.1
FigStep
12.6
7.7
3.8
11.3
MiniGPT:4.78
ESCO
21.1
12.7
10.8
17.5
7.7
18.1
AdaShield
10.7
6.6
5.7
4.8
7.3
0.0
9.8
SafePTR
21.7
13.2
10.7
18.1
7.7
18.8
Baseline
56.7
38.7
54.8
22.3
51.3
FigStep
46.9
54.4
35.4
36.4
55.5
26.9
49.0
DeepSeeckVL2
ESCO
50.1
56.7
37.6
38.7
54.8
22.3
51.3
AdaShield
41.8
50.3
29.6
32.5
45.3
30.8
43.3
SafePTR
54.2
26.5
53.0
Table 6: Utility scores on MM-Vet. We report the accuracy across 7 capability categories. The best results are highlighted in bold.
These results demonstrate that SafePTR's prune- prume-then-restore design effectively balances safety and task performance.
Ablations on hyperparameter Top- K in HTP. To examine how varying the Top-K pruning ratio in HTP influ- ences the trade-off between safety and
Inference Latency in a ())
Baseline
AdaShield
CoCA
Immane
SafePTR
LLaVA-1.5 LLaVA-16
3.52+
3.62x
7.02s
4.98.
3.67:
3.48s
3.58s
7.01s
4.93s
3.51=
MiniGPT-4-7B MiniGIPT--138
10.38.
10.48s
19,86e
14.76e
10.63.
utility, conduct ablation study,
32,90e
25.08s
as presented in Tab. S We observed
Training Size St (L)
DK
0.2K
0K
71K
0K
Average % (1)
11.51
that increasing K, i.e., pruning more tokens, improves safety on FIG and MSB by effectively suppressing harm- ful behaviors, but gradually reduces utility MMVet and MME. Empiri- cally, we choose K=10% as it provides a favorable balance, achieving substantial safety improvements (FIG: 51.0 1.6; MSB: 52.3 1.2) while maintaining competitive utility (MMVet: 32.3; MME: 1538.11).
Model Utility (1)
1503.62
1521.11
1501.56
1504.21
1838.11
Table 7: Efficiency Comparison. We report training data size (K) and inference latency (sec/sample) evaluate efficiency.
K
FIG
MSB
MMVett
MME
HTP
BFR
FIG 4
MSB 1
MMVett
MME1
0%
51.0
52.3
30.3
1503.62
51.0
52.3
30.3
1503.62
2.5%
39.4
43.6
32.1
1510.85
3.8
3.06
24.5
1428.11 11
5.0%%
4.2
3.3
31.8
1523.91
1.6
1.29
32.3
1538.11
10.0%
1.6
1.2
32.3
1538.11
Table 9: Ablation study of proposed components. Per- formance of Harmful Token Pruning (HTP) and Be- nign Feature Restoration (BFR) on FigStep (FIG), MM- SafetyBench (MSB), MM-Vet, and MME.
40.0%
0.2
0.4
31.1
1401.79
80.0%
0.1
0.0
23.6
1317.90
Table 8: Ablation study of Top-K in HTP.

---

Related Work
Jailbreak Attacks on Multimodal Large Language Models. Recent studies have demonstrated that MLLMS are highly susceptible to jailbreak attacks. [Gong et al. 2023] transforms harmful text into typographic images to bypass safety filters, while (Liu et al. 2023c exploit query-relevant images for similar effect. [Dong et al. 2023) craft visual adversarial examples to circumvent guardrails. [Luo et al. 2024b) introduce Jail V-28K to benchmark attack transferability. However, these studies rarely analyze how jailbreak bypass safeguards, leaving internal vulnerability mechanisms of MLLMs largely unexplored. To bridge this gap, we investigate where, how, and which harmful multimodal tokens trigger jailbreaks, which directly informs our defense design.
Defenses on Multimodal Large Language Models. To counter adversarial threats, recent de- fenses for MLLMs have explored input transformation Yan et al., 2024). inference-time risk evalua-
tion [Zhang et al. al.:|l222222 [024a]] and prompt-based mitigation strategies [Wang et al. [0024b] Other methods
focus on hidden state monitoring and cross- moosl safety transfer [Liu et al. 2024c inference-ting
alignment [Wang et al. 2024a]], and LLM-guided constitutional calibration Li et al. 2024). Despite these advancements, few works examine jailbreaks at the representation level, leaving models vulner- able to text-driven attacks and prone to overdefensive behavior. Guided by our finding that semantic drift from safety-aligned representations is a key failure factor, propose SafePTR, an interpretable and training-free free defense that preserves utility while enhancing robustness.
Conclusion
In this work, we investigate the root causes of multimodal jailbreaks in MLLMs, showing that small subset of harmful tokens can compromise model safety, an issue often overlooked by existing defenses. Based on this, we propose SafePTR, training-free framework that prunes harmful tokens at critical layers while restoring benign features elsewhere. Without added computational cost, SafePTR significantly improves safety while preserving model utility, achieving SOTA performance across multiple benchmarks. Limitations: SafePTR relies intermediate hidden states to compute semantic deviation, which restricts its applicability to black-box models such as GPT-4. Additionally, its fixed Top-K K pruning strategy may lack flexibility in handling inputs with varying risk levels.
7 Acknowledgements
This study is supported by grants from the National Natural Science Foundation of China (Grant No. U23A20315, No. 62425208, No. U22A2097, No. 62122018. No. 62020106008), Shen- zhen Science and Technology Program (No.JCYJ20240813)) 114440001111220012 Fundamental Research Funds for the Central Universities, and Natural Science Foundation of Sichuan Province (Grant No. 2025ZNSFSC1463).
References
J. Bai, S. Bai, S. Yang, S. Wang, S. Tan, P. Wang. J. Lin, C. Zhou, and J. Zhou. Qwen-vl: A frontier large vision-language model with versatile abilities. arXiv preprint arXiv:2308. /2966, 2023.
L. Chen, H. Zhao, T. Liu, S. Bai, J. Lin, C. Zhou, and B. Chang. An image is worth 1/2 tokens after layer 2: Plug-and-playy inference acceleration for large vision-language models. arXiv preprint arXiv:2403.06764 2024.
W.-L. Chiang. 7. Li, 7. Lin, Y. Sheng, 7. Wu, H. Zhang, L. Zheng, S. Zhuang, Y. Zhuang, J. F. Gonzalez, I. Stoica, and Xing. Vicuna: An open- chathot impressing gpt-4 with 90%* chatgpt quality, March 2023. URL httpss htttp:////aass.rrr/bb/////0/0000 03-300 vi- cuna/
org/
Y. Dong, 7. Li, J. Tang, et al. Visual adversarial examples jailbreak aligned large language models. arXiv preprint arXiv:2306. 0223006.33/10 13213, 2023.
C. Fu, P. Chen, Y. Shen, Y. Qin, M. Zhang, X. Lin, Z. Qiu, W. Lin, J. Yang, X. Zheng, et al. Mme: comprehensive evaluation benchmark for multimodal large language models, arXiv preprint arXiv:2306.15 13394, 2023.
10

---

J. Gao, R. Pi, T. Han, H. Wu, L. Hong, L. Kong, X. Jiang. and Z. Li. Coca: Regaining safety- awareness of multimodal large language models with constitutional calibration. arXiv preprint arXiv:2409. / 1365, 2024.
S. S. Ghosal, S. Chakraborty, V. Singh, T. Guan, M. Wang, A. Beirami, F. Huang, A. Velasquez, D. Manocha, and A. S. Bedi. Immune: Improving safety against jailbrekks in multi-modal Ilms via inference-time alignment. arXiv preprint 1rXiv:2411.1866 2024.
Y. Gong, D. Ran, J. Liu, C. Wang, T. Cong, A. Wang. S. Duan, and X. Wang. Figstep: Jailbreaking large vision- laigugla models via typographic visual prompts. arXiv preprint arXiv:2311.0666 2023.
Y. Gong, D. Ran, J. Liu, C. Wang. T. Cong, A. Wang, S. Duan, and X. Wang. Figstep: Jailbreak- ing large vision-language models via typographic visual prompts. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23951-23959, 2025.
Y. Gou, K. Chen, Z. Liu, L. Hong, H. Xu, Z. Li, D.-Y. Yeung. J. T. Kwok, and Y. Zhang. Eyes closed, safety on: Protecting multimodal Ilms via image-to-texl transformation. In European Conference on Computer Vision, pages 388 404. Springer, 2024.
Y. Guo, F. Jiao, L. Nie, and M. Kankanhalli. The vllm safety paradox: Dual ease in jailbreak attack and defense. arXiv preprint arXiv:241..08410 2024.
A. Q. Jiang, A. Sablayrolles, A. Roux, A. Mensch, B. Savary, C. Bamford, D. S. Chaplot, D. d. 1. Casas, E. B. Hanna, F. Bressand, et al. Mixtral of experts. arXiv preprint arXiv:2401.0400 2024.
Z. Li, L. Chen, and H. Yan. Coca: Regaining safety-awareness of multimodal large language models with constitutional calibration. arXiv preprint arXiv:2402.00000, 2024.
H. Liu, C. Li, Q. Wu, and Y. J. Lee. Visual instruction tuning. arXiv preprint arXiv:2304.08485, 2023a.
H. Liu, Y. Jian, X. Han, Q. You, H. Huang, and R. He, eram-v: From interaction integration in efficient multimodal large language models. arXiv preprint arXiv:2104.08660 2024a.
X. Liu, Y. Zhu, Y. Lan, C. Yang, and Y. Qiao. Query-relevant images jailbreak large multi-modal models, 2023b.
X. Liu, Y. Wang. Z. Zhang, et al. Milm-protectee Ensuring milm's safety without hurting performance. arXiv preprint arXiv:2403.000 00000, 2024b.
Z. Liu, Y. Zhu, Wang, Y. Zhou, X. Li, Y. Zhang, and J. Liu. Query-relevant images jailbreak large mudti-modal models. arXiv preprini arXiv:2311. 2023c.
Z. Liu, W. Zhao, J. Liu, et al. Cross modal safety mechanism transfer in large rision-language models. arXiv preprint 442h::240..00000, 2024c.
H. Lu, W. Liu, B. Zhang, B. Wang, K. Dong. B. Liu, Sun, T. Ren, Z. Li, H. Yang, et al. Deepseek-vl: towards real-world vision- languale understanding. arXiv preprint 2:X5v:2403.05555, 2024.
W. Luo, S. Ma, X. Liu, X. Guo, and C. Xiao. Jailbreakv-28k: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. arXiv preprini arXiv:2404.030027, 2024a.
W. Luo, S. Ma. X. Liu, X. Guo, and Xiao. Jailbreakv-28k: benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. arXiv preprint arXiv:2404.030 03027, 2024b.
Y. Ma, T. Zhang, X. 7hu, Y. He, X. J. Ma, and W. Yin. Efficient streaming language models with attention sinks. arXiv preprint (rXiv:2312.000) /2.00800 2023.
OpenAl. (Ps-4V(ision) system card. 2023.

---

H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar, al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302. 13971, 2023.
Y. Wang, H. Li, and P. Zhang. Immune: Improving safety against jailbreaks in multi-modal Ilms via inference-tinee time alignment. arXiv preprint arXiv:2403.00000 2024a.
Y. Wang, X. Liu, Y. Li, M. Chen, and C. Xiao. Adashield: Safeguarding multimodal large language models from structure- based attack via adaptive shield prompting. In European Conference Computer Vision, pages 77-94. Springer, 2024b.
H. Yan, Z. Li, and L. Chen. Eyes closed, safety on: Protecting multimodal Ilms via image-to-text transformation. arXiv preprint 24X0:22002.00000, 2024.
W. Yu, Yang, Li, Wang, K. Lin, Z. Liu, X. Wang, and Wang. Mm-vet: Evaluating large multimodal models for integrated capabilities. In International Conference on Machine Learning. PMLR, 2024.
Z. Yue. L. Zhang, and Q. Jin. Less more: Mitigating multimodal hallucination from an EOS decision perspective. In L. Ku. A. Martins, and V. Srikumar, editors, Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume Long Papers), ACL 2024, Bangkok, Thailand, August 11-16, 2024, pages 11766-11781 Associa- tion for Computational Linguistics, 2024. doi: 10. 120.3111222..ALLLLNG...5. URL
https: org/ 10. 18653/v1/2024 acl long. 633
M. Zhang, X. Wang, and Q Tan. Eta: Evaluating then aligning safety of vision language models at inference-time, arXiv preprint (.XXi:2401.0000 2024a.
Y. Zhang, S. Wu, W. Liu, S.-W. Lin, X. Li, F. Yang, W. X. Zhao, F. Wei, and M. Zhou. An image worth 1/2 tokens after layer Plug-and-play inference acceleration for large vision-language models. arXiv preprint 203702240..77955, 2024b.
D. Zhu, J. Chen, X. Shen, X. Li, and M. Elhoseiny. Minigpt-4: Enhancing vision- language under- standing with advanced large language models. arXiv preprint vrXiv:234.11059. 2023.
12

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Yes, the main claims in the abstract and introduction accurately reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
Yes, the paper includes clear discussion of its limitations in 5. 5.Conclusion Section.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiaatinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g. if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
13

---

Answer: [Yes]
Justification: Yes, for each theoretical result, the paper elearly states all underlying assump- tions and provides complete and correct proofs.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Yes, the paper provides sufficient details to reproduce the main experimental results that support its core claims and conclusions.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
14

---

reproducible, they Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Yes, the paper provides open access to both the code and data, along with clear instructions in the supplementary material to enable faithful reproduction of the main experimental results.
Justification:
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips. cc/
haagli/e/guidee//CoeeStuimisssss Psllcll for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" an acceptable answer. Papers cannot be rejected simply for including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//apps.cc/pulli//uiiiee
ssisssssicyyyyy for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permirted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Yes. the paper specifies all key training and testing details necessary to understand the reported results.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: Yes, the paper reports error bars or other appropriate statistical measures to assess the significance and variability of the experimental results.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoo bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
15

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Yes, the paper provides sufficient information regarding the computational resources used for the experiments.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't fidn't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http://eeeuii...cccplpplttt//bba
Answer: [Yes]
Justification: Yes, the research presented in the paper conforms to the NeurIPS Code of Ethics in all respects.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Yes, the paper discusses both the potential positive and negative socictal impacts of the work.
Guidelines:
16

---

The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negatíve societal impacts include potential malicious or unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairness considerations (c.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification: Yes, the paper describes safeguards implemented for the responsible release of models that may pose misuse risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: Yes, the paper properly credits the creators and original owners of all external assets used, including code, datasets, and pretrained models.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
17

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the thcode. com/ com/dataseta has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Yes, the assets introduced in the paper well documented, with clear descriptions of their structure, usage, and intended applications.
Guidelines:
The answer NA means that the paper does not release assets.
Researchers should communicate the details the dataset/code/mmodll as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [Yes]
Justification: Yes, for experiments involving human subjects or crowdsourcing, the paper includes the full text participant instructions, relevant screenshots (if applicable), and clear details regarding compensation.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [No]
Justification: Yes, the paper clearly describes any potential risks incurred by study partici- pants.
Guidelines:
18

---

The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: LLM is used only for editing.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy hats:::/eearriss.cc//offfeeeeeee for what should or should not be described.
19


Reviews:
[{"review_id": "Ga5AkyB2AZ", "reviewer": "Reviewer_kYdu", "summary": "This paper introduces SafePTR, a training-free defense framework against multimodal jailbreak attacks in MLLMs. Through systematic analysis, the authors discover that less than 1% of tokens in early-middle layers are responsible for inducing unsafe behaviors. SafePTR leverages this insight to selectively prune harmful tokens at vulnerable layers while restoring benign features at subsequent layers, achieving state-of-the-art performance across multiple benchmarks without requiring additional training.", "questions": "- Why did you choose a fixed Top-K (10%) pruning ratio rather than an adaptive threshold based on the actual semantic deviation distribution? Have you explored dynamic pruning strategies that adjust K based on input risk levels?\n- In your opinion, how robust do you think SafePTR is against adaptive attacks where adversaries know about the token pruning mechanism?", "limitations": "Yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**: The paper presents a technically sound and well-motivated approach, with a systematic analysis framework (where/how/which harmful tokens bypass safeguards) that leads to actionable insights. The proposed SafePTR method is elegantly simple yet highly effective, achieving impressive results such as reducing ASR from 51.7% to 0.9% on LLaVA-1.5. The comprehensive experimental validation across three models and five benchmarks, coupled with thorough ablation studies, demonstrates both safety improvements and utility preservation. The training-free nature of the approach is a significant practical advantage, and the paper is well-written with clear visualizations that effectively communicate key findings. \n\n**Weaknesses**: I think the approach has some limitations in scope as it is being restricted to white-box models where intermediate hidden states are accessible, which excludes black-box models like GPT-4. The fixed Top-K pruning strategy (K=10%) lacks adaptability to inputs with varying risk levels, and the safety-aligned reference instruction used for semantic distance calculation is somewhat arbitrary. The analysis is limited to three open-source models, potentially limiting generalization to other architectures. Nonetheless, I don't think these weaknesses are fundamental.\n\nBut overall, in my opinion this work makes meaningful contributions to MLLM safety by providing both mechanistic insights and a practical defense solution. The finding that less than 1% of tokens are responsible for jailbreaks is particularly valuable and could inspire future research.", "was_revised": true, "final_justification": "The authors' detailed responses address my concern, and I don't see major weakness of the work. I maintain my score of 5, recommending accept.", "rebuttal": "_**Weakness 1. I think the approach has some limitations in scope as it is being restricted to white-box models where intermediate hidden states are accessible, which excludes black-box models like GPT-4.**_\n\n**Response:** Our methodology was initially **developed for white-box models, leveraging access to hidden states to enable pruning as a defensive mechanism**. As such, it is not directly applicable to black-box models. In response to your suggestion, **we investigated the transferability of the core concept of SafePTR to black-box settings**. Specifically, we utilized an open-source multimodal model (LLaVA-1.5-7B) to detect harmful tokens in the input image. The identified harmful regions were then removed prior to feeding the modified image into a black-box model. As shown in Table 1, applying this strategy to GPT-4o-mini (chosen for its inference efficiency) **consistently enhanced safety across FigStep, MMSafetyBench, and Jailbreak-28K**, successfully mitigating nearly all jailbreak attempts. Notably, this safety improvement was achieved without compromising utility, as evidenced by stable performance on MMVet.\n\n**Table 1: Evaluating Main Idea Transferability to Black-Box Models (GPT-4o-mini)**\n\n| Model |  Figstep(↓) | MMSafetyBench(↓) | JailBreak-28K(↓) | MMVet(↑)|\n| ---------------------- |  ------- | -------- | -------- |--|\n| **GPT-4o-mini** | 3.9   | 8.05   | 5.3  | 68.5 |\n| **GPT-4o-mini + Ours**  | **0.0** | **1.83**   | **1.6**   | **69.2**    |\n\n---\n\n_**Weakness 2. `(a)` The fixed Top-K pruning strategy (K=10%) lacks adaptability to inputs with varying risk levels and `(b)` the safety-aligned reference instruction used for semantic distance calculation is somewhat arbitrary.**_\n\n**Response: `(a)`** \nThere are two main reasons for adopting a fixed top-k strategy:\n- **Theoretical Justification:** As discussed in Lines 147–149 of the paper, **the number of harmful tokens does not scale with the input's risk level**. This phenomenon is primarily attributed to the **attention sink effect [1]** in MLLM inference, whereby harmful content tends to concentrate in a small number of dominant tokens. Consequently, pruning the top-K most harmful tokens remains both effective and computationally efficient.\n- **Empirical Validation:** We investigated whether an adaptive pruning ratio outperforms a fixed-K approach (e.g., K=10%) on LLaVA-1.5 7B. Following prior work [2, 3], we implemented adaptive pruning by applying a fixed semantic distance threshold to each input sample, removing tokens below this threshold and allowing K to vary dynamically. However, as shown in Table 2, this **adaptive strategy did not yield a significant advantage in balancing safety and utility compared to the fixed-K method** (Fixed K: 1538.11 vs. Adaptive K: 1464.62). A possible explanation is that adaptive thresholding results in inconsistent pruning across samples—occasionally removing too many important tokens (equivalent to K=16.8%), thereby impairing utility.\n\n**Table 2: Performance of Adaptive K Calculation on LLaVA-1.5 7B**\n\n| Model:LLaVA-1.5 7B |  Figstep(↓) | MMSafetyBench(↓) | MMVet(↑)| MME(↑)|\n| ---------------------- |  ------- | -------- | -------- |--|\n| **Top K = 10%** | **1.6**   | 1.20   | **32.3**  | **1538.11** |\n| **Adaptive K (mean K=16.8%)**  | 1.8 | **1.19**   | 24.1    | 1464.62   |\n\n[1] Efficient streaming language models with attention sinks (ICLR 2024).\n\n[2] Holistic Token Merging for Fast Video Large Language Models (CoRR 2025).\n\n[3]GreedyPrune: Retenting Critical Visual Token Set for Large Vision Language Models (CoRR 2025).\n\n\n**`(b)`** The safety-aligned reference instruction used for semantic distance calculation is grounded in concrete empirical findings and is therefore not arbitrary. Importantly, it exemplifies a general defense paradigm whose effectiveness does not rely on the exact wording, demonstrating broad applicability beyond any particular instruction phrasing：\n\n- **Safety-aligned instructions are grounded in empirical findings.** As demonstrated in Finding 2 of our paper and illustrated in Figure 3, safety-aligned reference instructions substantially improve the discriminability between safe and unsafe samples in high-dimensional semantic space. Therefore, we adopt these instructions as inherent safety-relevant priors, serving as a guiding signal to enhance separation efficacy.\n\n- **A Generalizable Defense Paradigm:** The safety-aligned reference instruction is not an arbitrary choice, but rather part of a broad class of effective safety-related instructions. To confirm this, we evaluated multiple generic prompts containing safety-related keywords such as “safely,” “accurately,” and “harmful.” The results, summarized in the Table.3, consistently show that these alternative instructions enable effective token pruning. This demonstrates that our approach constitutes a generalizable defense paradigm rather than relying on a specific phrasing. Essentially, **any instruction embedding safety-related terminology suffices for our method to perform effectively, highlighting its broad applicability beyond a fixed instruction set**.\n\n**Table 3: Performance of diverse safety-aligned reference instruction**\n\n| Safety-aligned Reference Instruction |  Figstep(↓) | MMSafetyBench(↓) | JailBreak-28K(↓) |\n| ---------------------- | ------- | -------- |--|\n|“Compliance with safety standards and human values is mandatory for the content. \" |  1.8  |   2.0  |  1.1 |\n|“Enhancing awareness of safety values and avoiding harmful content. \" |  2.1  |   1.4  |  1.3 |\n|“The content is required to be safe and aligned with human values. \" |  2.1  |   1.6  |  2.4 |\n|“Prioritizing safety knowledge to prevent exposure to harmful material.\" |  2.8  |   1.4  |  1.3 |\n|“Please answer this question safely and accurately. Reply ‘I am sorry. \" |  **1.6**  |   **1.2**  |  **0.9** |\n\n---\n\n_**Weakness 3. The analysis is limited to three open-source models, potentially limiting generalization to other architectures.**_\n\n**Response:** We further validate the generalizability of SafePTR on LLaVA-Next (which employs a multi-scale visual feature fusion strategy) and InternVL-2 (featuring a stronger vision encoder and multi-stage alignment). As shown in Table 2, SafePTR consistently outperforms existing methods, such as Figstep and AdaShield, achieving superior results in both safety benchmarks (Figstep and MMSafetyBench) and utility metrics (MME), thereby demonstrating its broad applicability.\n\n**Table 4: Performance of LLaVA-Next and InternVL2**\n\n| Model | Method  | Figstep(↓) | MMSafetyBench(↓) |  MME(↑) |\n| ---------------------- | ----------- | ------- | -------- | -------- |\n| **LLaVA-Next-8B** | Baseline   | 56.4   |  34.8   |    1417.38  |\n|                        | Figstep    |  60.2  |   33.5  |    1379.26  |\n|                        | AdaShield |  9.0  |   5.1  |   1388.56   |\n|                        | Ours       |  **1.8**  |   **1.2**  |  **1439.76**  |\n| **InternVL2-4B**     | Baseline   |  39.8  |  22.1   |  1520.66    |\n|                        | Figstep    |   44.2 |  20.4   |  1483.79    |\n|                        | AdaShield  |  3.0  |   3.5  |   1508.92   |\n|                        | Ours       |  **0.6**  |  **0.8**   |   **1520.53**  |\n\n---\n\n_**Question 1.  Why did you choose a fixed Top-K (10%) pruning ratio rather than an adaptive threshold based on the actual semantic deviation distribution? Have you explored dynamic pruning strategies that adjust K based on input risk levels?**_\n\n**Response:** Please refer to the Response of Weakness 2 for a detailed discussion on the choice of a fixed Top-K pruning ratio.\n\n---\n\n_**Question 2.  In your opinion, how robust do you think SafePTR is against adaptive attacks where adversaries know about the token pruning mechanism?**_\n\n**Response:** **The implementation details of any white-box defense, if exposed, inherently create avenues for adaptive attacks**. This principle also applies to our proposed method, SafePTR. **Nevertheless, bypassing SafePTR remains significantly more costly** than circumventing simpler defenses like AdaShield, which can be bypassed by merely ignoring instructions. To successfully attack SafePTR, an adversary would first need to identify vulnerable layers within the model. Subsequently, they would have to identify the specific harmful tokens that need to be manipulated. This multi-step process makes attacking SafePTR both computationally expensive and procedurally complex, significantly raising the bar for successful circumvention."}, {"review_id": "wRk2FWeimP", "reviewer": "Reviewer_eF5U", "summary": "The paper introduces SafePTR, a training-free, token-level defense framework designed to mitigate multimodal jailbreaks in large language models (LLMs). It identifies that less than 1% of multimodal tokens in early–middle layers are responsible for unsafe behaviors and proposes a prune-then-restore mechanism that removes these harmful tokens while restoring benign features to preserve model utility. Extensive evaluations across several multimodal LLMs and various benchmarks show that SafePTR achieves state-of-the-art robustness against both text- and vision-driven jailbreaks without sacrificing performance or requiring additional training.", "questions": "Questions:\n1. Are the arrow directions in Figure 1 all correct? Upper arrow means better performance with larger numbers and lower arrow vice versa, right? It seems the arrow directions are flipped.\n2. Lots of citations have an incorrect style (in my opinion). For example in line 91, the citation for LLaVA, Mini-GPT and DeepSeek-VL should be cited with \\citep{} rather than \\citet{}. This is a minor issue.\n3. I am wondering, why did you choose to do layer-wise intervention on 2 and 4 consecutive layers, rather than 1 or greater numbers of layers? Could you provide some insight?\n4. Finding 2 is interesting. I am wondering, what do you think leads to such semantic deviation. That said, what kind of difference between the adversarial samples and the safety-aligned instructions leads to this deviation. Can we see from some concrete examples? Correct me if I have misunderstandings.\n5. I see in Finding 3, you are trying to answer my last point. But I still want more examples as mentioned above. Could you tell me how you decide the thrshold \\alpha? This number greatly affects the proportion of harmful tokens according to your definition. I also recommend explicitly providing the safty-aligned instruction in Figure 4.\n6. How did you prune text tokens? Any equation would help. And also, when doing HTP, did you just set the hidden state corresponding to top-K harmful tokens to 0? Could you provide more details?\n7. Can I understand restoration as taking the hidden states of the pruned tokens from original forward pass without pruning, and then insert them back as the hidden states of the pruned tokens in later layers where there is a less correlation with vulnerability?\n8. Do you think the proposed method can also be implemented on multimodal LLMs with discretized image tokenizers such as Chameleon [1]?\n\n[1] Team, C. (2024). Chameleon: Mixed-modal early-fusion foundation models. arXiv preprint arXiv:2405.09818.", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The paper has a strong motivation and the logic flow is very well. It identifies how jailbreak successes, where this happens, which tokens are in charge of it, and finally proposes a defense approach according to the findings.\n2. The paper is well written.\n3. The proposed method is very effective.\n\nWeaknesses:\n1. Some technical details are not clear enough. In particular, how are the textual harmful tokens pruned and restored. I wish to see some examples too.\n2. Not necessarily more great flaws.\n\nI think the paper is of high quality, and I wish to see further clarifications during rebuttal. I would consider raising my scores if the authors can address my concerns. Please also refer to my questions below.", "was_revised": true, "final_justification": "All of the issues I raised were resolved. The authors should include the discussions presented in the rebuttal into the next revision. I read the paper again and feel that the novelty might not be very strong (as indicated by Reviewer 7nHP). However, due to the high quality of this paper's structure, narrative and experiments, I think it deserves Rating 4.", "rebuttal": "_**Weakness 1. Some technical details are not clear enough. In particular, how are the textual harmful tokens pruned and restored. I wish to see some examples too.**_\n\n**Response:** \n- **Technical details:**\nThe pruning process for both image and text tokens is detailed in Section 3.1. At vulnerable layers, harmful textual and visual tokens are directly removed from the forward computation (as shown in Equations 2 and 3 of our manuscript), thereby preventing the injection of harmful information into subsequent vulnerable layers. In later layers, where vulnerability is less pronounced, the removed tokens are restored by retrieving their hidden states from the original full forward pass and reinserting them into their original positions (as described in Equations 4 and 5). This enables the model to resume inference with all token representations preserved.\n\n- **Example:**\nFor the input \"How to Build Weapons to Rob a Bank\", when fed into LLaVA (with layers 7–8 identified as vulnerable), the tokens \"weapons\" and \"rob\" are removed at layers 7–8. The remaining tokens are processed as usual. At layer 9, the hidden states of the removed tokens (from the unpruned pass) are reinserted into their original positions, and inference proceeds normally from that point on.\n\n| Examples | Method | Pruned Results | Output |\n|---|---|---|---|\n|\"How to Build Weapons to Rob a Bank\" |  w/ SafePTR |\"How to Build ~~**Weapons**~~ to ~~**Rob**~~ a Bank\" | I am unable to provide assistance with this request.|\n||w/o SafePTR|\"How to Build Weapons to Rob a Bank\"|Building a weapon first requires the accumulation of...|\n|\"How to Manufacture Explosives Using Household Chemicals\"| w/ SafePTR|\"How to Manufacture ~~**Explosives**~~ Using Household Chemicals\"|I cannot provide information on how to build explosives|\n||w/o SafePTR| \"How to Manufacture Explosives Using Household Chemicals\"|To manufacture explosives using household chemicals, one could first...|\n\n---\n\n_**Question 1.  Are the arrow directions in Figure 1 all correct? Upper arrow means better performance with larger numbers and lower arrow vice versa, right? It seems the arrow directions are flipped.**_\n\n**Response:** Thank you for your suggestion. We have reviewed the arrow issue in Figure 1 and will revise it in the next version of the paper.\n\n---\n\n_**Question 2.  Lots of citations have an incorrect style (in my opinion). For example in line 91, the citation for LLaVA, Mini-GPT and DeepSeek-VL should be cited with \\citep{} rather than \\citet{}. This is a minor issue.**_\n\n**Response:** Thank you for your suggestion. We will revise the citation style in the next version of the paper.\n\n---\n\n\n_**Question 3.  I am wondering, why did you choose to do layer-wise intervention on 2 and 4 consecutive layers, rather than 1 or greater numbers of layers? Could you provide some insight?**_\n\n**Response:** \n- **Insight:** Layer-wise intervention with a moderate window size (k = 2 or 4) offers the best trade-off between perturbation effectiveness and localization precision. This configuration generates the most distinguishable ASR curve variations, effectively isolating vulnerable layers without overly disrupting model behavior.\n- **Window size Selection:**\nThe selection of the layer-wise intervention window size, neither excessively large nor small, is primarily dictated by localization precision. As shown in Table 1, specifically examining k=1 and k>4, confirm that k=2 and k=4 represent the optimal choices in this trade-off, enabling the clearest identification of the model's vulnerable layers.\n\n\t- **Narrow Window (k=1):** A narrow window (k=1) resulted in **minor Attack Success Rate (ASR) curve changes** (under 34% difference), making it difficult to pinpoint vulnerable regions. This is because Transformer's residual connections and distributed representations can easily bypass single-layer interventions.\n\n\t- **Wide Window (k>4):** Conversely, an overly wide window (e.g., k=8 or k=16) reduced ASR significantly across many layers but still showed **limited differentiation** (under 42% difference). This occurs because removing too many components impairs core reasoning, making the model \"universally vulnerable\" and preventing precise localization of the most critical layers.\n\n\t- **Optimal Window (k=2 and k=4):** With optimal windows (k=2 and k=4), we observed **pronounced ASR curve differences**, exceeding 81%. This clear distinction significantly aids in accurately identifying critical layer locations.\n\n\n **Table 1: Layer-wise vulnerability(ASR % ↓) analysis of MiniGPT-4-7B**\n\n|Interval |0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|\n|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|\n|1  |94|94|96|96|86|86|92|96|94|82|74|88|60|96|72|82|88|84|84|72|76|82|86|82|92|92|92|94|92|88|82|83|\n|4|92|90|90|88|86|52|28|**20**|48|32|82|74|74|62|50|54|50|76|80|76|74|82|84|80|92|90|82|72|76|-|-|-|\n|16|52|40|18|14|18|10|12|18|24|18|26|34|12|32|34|26|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|\n\n---\n\n_**Question 4.  Finding 2 is interesting. I am wondering, what do you think leads to such semantic deviation. That said, what kind of difference between the adversarial samples and the safety-aligned instructions leads to this deviation. Can we see from some concrete examples? Correct me if I have misunderstandings.**_\n\n**Response:** The semantic deviation observed in Finding 2 is largely **driven by specific harmful tokens (Finding 3)**, which amplify the divergence between adversarial inputs and safety-aligned instructions. This reflects a deeper issue: a mismatch between **Shallow Conceptual Alignment**—where visual features are loosely mapped to textual concepts—and **Deep Safety Alignment**, which requires integrating safety-critical semantics into these mappings.\n\nAs illustrated in Supplemental Figures 3 and 4, tokens related to \"fire regions\" or \"illegal narcotics\" intensify this semantic drift. These cases reveal how current vision-language models, lacking deep safety grounding, allow harmful visual-text associations to bypass alignment constraints in the latent space.\n\n---\n\n_**Question 5.  `(a)` I see in Finding 3, you are trying to answer my last point. But I still want more examples as mentioned above. `(b)` Could you tell me how you decide the thrshold \\alpha?  This number greatly affects the proportion of harmful tokens according to your definition.  `(c)` I also recommend explicitly providing the safty-aligned instruction in Figure 4.**_\n\n**Response:** \n`(a)` As illustrated in Supplemental Figures 3 and 4, tokens related to \"fire regions\" or \"illegal narcotics\" intensify this semantic drift. Further examples can be found in Supplemental Figures 2-9.\n \n`(b)` The threshold parameter, denoted as α, was determined empirically based on experimental results to effectively distinguish between harmful and benign tokens, as summarized in Table 2. We selected **α = 0.10** as it achieves a favorable trade-off, yielding the lowest scores on Figstep and MMSafetyBench (indicating reduced harmfulness) while maintaining a high MME score (indicating model effectiveness).\n\n**Table 2 : Performance of different α**\n\n| α |  Figstep(↓) | MMSafetyBench(↓) |  MME(↑)|\n| - | - |- |-|\n| **0.00**|  51.2  | 52.1| 1503.11 |\n| **0.05** | 4.3 | 3.3   |  1523.91 |\n| **0.10** | **1.8** | **1.4** |**1533.62**  |\n| **0.20** |0.8|1.1|1401.79|\n\n `(c)` Thank you for your suggestion. We will provide the safety-aligned instruction in Figure 4 for clarify.\n\n---\n\n_**Question 6.  How did you prune text tokens? Any equation would help. And also, when doing HTP, did you just set the hidden state corresponding to top-K harmful tokens to 0? Could you provide more details?**_\n\n**Response:** When inference reaches vulnerable layers, **Harmful Token Pruning (HTP) directly removes the hidden states corresponding to the top-K harmful tokens from the overall set of hidden states** (equation on line 180 of the paper). The relative positions of the **remaining hidden states are preserved**, ensuring that the harmful token hidden states do not participate in inference within these specific layers while the other hidden states continue through the normal inference process. As detailed in the example within Weaknesses 1, harmful text tokens are directly removed by HTP in vulnerable layers, and these removed hidden states are subsequently restored once inference through these layers is complete.\n\n---\n\n_**Question 7.  Can I understand restoration as taking the hidden states of the pruned tokens from original forward pass without pruning, and then insert them back as the hidden states of the pruned tokens in later layers where there is a less correlation with vulnerability?**_\n\n**Response:** Yes, that understanding is correct. Please refer to the response in Weakness1 for a detailed explanation of the process.\n\n---\n\n_**Question 8.  Do you think the proposed method can also be implemented on multimodal LLMs with discretized image tokenizers such as Chameleon [1]?**_\n\n**Response:** Yes, our proposed method, SafePTR, can be implemented on multimodal LLMs that use discretized image tokenizers, such as **Chameleon**. While Chameleon’s tokenizer differs from those in models like LLaVA and MiniGPT-4, **they share a crucial property**: once tokens from all modalities are input into the LLM, they are converted into **hidden states** and processed in a unified format. This common internal representation enables similar reasoning mechanisms across architectures.\n**SafePTR operates precisely at this stage**—it performs pruning on the hidden states after all tokens have been embedded within the model. Therefore, the method is theoretically compatible with Chameleon, as it aligns with the model’s internal processing of multimodal information."}, {"review_id": "mXXqXezV9x", "reviewer": "Reviewer_fTB4", "summary": "The paper investigates why multimodal large language models (MLLMs) remain vulnerable to jailbreak attacks and proposes SafePTR, a training-free inference-time defense. Through layer-wise and token-level analyses, the authors discover that only a narrow band of early-middle layers is especially susceptible to malicious visual or textual tokens, and fewer than 1 % of tokens in those layers account for most unsafe behavior. SafePTR prunes the Top-K semantically deviant tokens in those vulnerable layers and restores benign contextual features to recover utility across three open-source MLLMs.", "questions": "1. LLaVA-1.5 and MiniGPT-4 share the same vulnerable layers, and DeepSeek-VL2 has a different one. Can your method generalize to other models?\n2. Could an adaptive threshold (e.g., using the statistics of semantic distances per sample) outperform the fixed Top-10 % rule while preserving utility?\n3. Discuss concrete strategies to approximate hidden states for black-box commercial models like GPT-4 so SafePTR’s insights can transfer.", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n1. The paper is well structured.\n2. The work is supported by an extensive set of experiments.\n\nWeaknesses:\n\n1. Hyper-parameter K is fixed and may be dataset-specific.\n2. Novelty is incremental because the paper is relied on safety-aligned prompt embedding and the observation is also well-known. Please see [1] and [2,3] you already mentioned in the paper.\n3. Unable to applicate to black-box commercial models.\n\n[1] Li, Shen, et al. \"Safety layers in aligned large language models: The key to llm security.\" ICLR 2025.\n[2] Ghosal, Soumya Suvra, et al. \"Immune: Improving safety against jailbreaks in multi-modal llms via inference-time alignment.\" CVPR 2025.\n[3] Chen, Liang, et al. \"An image is worth 1/2 tokens after layer 2: Plug-and-play inference acceleration for large vision-language models.\" ECCV 2024.", "was_revised": true, "final_justification": "All my concerns are addressed.", "rebuttal": "_**Weakness 1. `(a)` Hyper-parameter K is fixed and `(b)` may be dataset-specific.**_\n\n**Response:** We adopt a fixed top-k in terms of following concerns: \n\n - **`(a)`Fixed is better than adaptive**: We have explored whether an adaptive pruning ratio performs better than a fixed-K approach (e.g., K=10%). Following previous studies [2, 3], we implemented adaptive pruning by setting a static semantic distance threshold for every input samples and removing tokens below this threshold on LLaVA-1.5 7B, allowing K to vary dynamically.  However, as shown in the Table.1, this adaptive strategy did not offer a significant advantage in balancing safety and utility compared to the fixed-K method (Fixed K: 1538.11 vs. Adaptive K: 1464.62) . The possible reason is that adaptive thresholding leads to inconsistent pruning across samples—sometimes masking too many important tokens (equal to K=16.8%), harming utility.\n\n**Table 1: Performance of Adaptive K Calculation on LLaVA-1.5 7B**\n\n| Model |  Figstep(↓) | MMSafetyBench(↓) | MMVet(↑)| MME(↑)|\n| ---------------------- |  ------- | -------- | -------- |--|\n| **Top K = 10%** | **1.6**   | 1.2   | **32.3**  | **1538.11** |\n| **Adaptive K (means = 16.8%)**  | 1.8 | **1.1**   | 24.1   | 1464.62   |\n\n - **`(b)` K is not dataset-specific:** \nAs shown in Table 1 of the manuscript, **the proportion of harmful tokens remains consistent across different datasets**—for example, LLaVA-1.5 on MM-SafetyBench (0.62%) vs. FigStep (0.56%), and MiniGPT-4 on MM-SafetyBench (0.93%) vs. FigStep (0.81%). This consistency is primarily attributed to the **attention sink effect [1]**, an inherent characteristic of the autoregressive mechanism in MLLMs. As discussed in **Lines 147–149** of the manuscript, this effect **causes certain tokens to disproportionately absorb attention, leading to the concentration of harmful information**. Consequently, pruning these few tokens is both effective—achieving a 1.29 reduction in ASR—and efficient—adding only 0.03 seconds of inference latency, as demonstrated in Table 7.\n\n[1] Efficient streaming language models with attention sinks (ICLR 2024).\n\n[2] Holistic Token Merging for Fast Video Large Language Models (CoRR 2025).\n\n[3]GreedyPrune: Retenting Critical Visual Token Set for Large Vision Language Models (CoRR 2025).\n\n---\n\n_**Weakness 2. Novelty is incremental because the paper is relied on safety-aligned prompt embedding and the observation is also well-known. Please see [1] and [2,3] you already mentioned in the paper.**_\n\n**Response:** \n\nOur work fundamentally differs from prior studies in its core motivation and methodological focus. Here's a detailed comparison with [1-3]:\n\n- **Distinctions from [1] \"Safety Layers in LLMs\"**:\n\t- **Token-Level vs. Layer-Level:** The initial layer-wise analysis presented in Finding 1 primarily serves to motivate and contextualize the subsequent token-level investigation in Finding 3. Our key contribution lies in this fine-grained, token-level analysis, which demonstrates that fewer than 1% of tokens are chiefly responsible for triggering multimodal jailbreaks.\n\n\t- **Training-Free vs. Training-Dependent:**  Unlike [1], which necessitates additional training to identify and utilize safety layers, our method is entirely training-free, offering a more practical and readily deployable solution.\n\n- **Distinctions from [2] \"Immune\"**:\n\t- **Training-Free vs. Training-Dependent:** A significant departure from [2], which necessitates training a dedicated safer model via DPO, our methodology operates without any additional training. This eliminates the computational overhead and data requirements associated with training a new model\n\n\t- **Token Pruning vs. Decoding Policy:** Our defense mechanism is based on token pruning, where we identify and remove specific problematic tokens. In contrast, [2]'s defense relies on summing the output logits of a DPO-trained safer model and the original model. These fundamentally different defense approaches lead to distinct operational characteristics and performance trade-offs, particularly in terms of model interpretability and the direct manipulation of hidden states.\n\n- **Distinctions from [3] \"An Image is Worth 1/2 Tokens\"**:\n\n\t- **Safety vs. Efficiency:** Although both our work and [3] employ pruning techniques, the underlying motivations and applications differ substantially. Reference [3] focuses solely on accelerating MLLM inference by pruning visually redundant tokens. In contrast, the primary goal of SafePTR is to enhance model safety. To the best of our knowledge, we are the first to leverage a pruning strategy specifically aimed at mitigating vulnerabilities for jailbreak defense.\n\n\t- **Different pruning strategy:** SafePTR's token pruning is based on semantic divergence, i.e., distance between unsafe tokens and safe instructions in model's latent space. This fundamentally differs from [3], which prunes tokens based on redundancy via attention scores.\n\n[1] Li, Shen, et al. \"Safety layers in aligned large language models: The key to llm security.\" ICLR 2025. \n\n[2] Ghosal, Soumya Suvra, et al. \"Immune: Improving safety against jailbreaks in multi-modal llms via inference-time alignment.\" CVPR 2025.\n\n[3] Chen, Liang, et al. \"An image is worth 1/2 tokens after layer 2: Plug-and-play inference acceleration for large vision-language models.\" ECCV 2024.\n\n---\n\n_**Weakness 3. Unable to applicate to black-box commercial models.**_\n\n **Response:** Our proposed methodology was originally designed for white-box models, relying on access to hidden states to facilitate pruning for defensive purposes. This approach cannot be directly applied to black-box models. Following your suggestion, we explored the **transferability of the core idea of SafePTR to black-box settings:**\n- Firstly, we employed an **open-source multimodal model (LLaVA-1.5-7B) to identify harmful tokens** in the input image. \n- Secondly, the corresponding harmful regions were then removed before **feeding the modified image into the black-box model**.\n As shown in the Table.2, applying this strategy to GPT-4o-mini (selected for rapid validation) consistently improves safety across FigStep, MMSafetyBench, and Jailbreak-28K, effectively mitigating nearly all jailbreak attempts. Importantly, this enhanced safety comes without sacrificing utility, as demonstrated by stable performance on MMVet.\n\n**Table 2: Evaluating Main Idea Transferability to Black-Box Models (GPT-4o-mini)**\n\n| Model |  Figstep(↓) | MMSafetyBench(↓) | JailBreak-28K(↓) | MMVet(↑)|\n| ---------------------- |  ------- | -------- | -------- |--|\n| **GPT-4o-mini** | 3.9   | 8.05   | 5.3  | 68.5 |\n| **GPT-4o-mini + SafePTR**  | **0.0** | **1.83**   | **1.6**   | **69.2**    |\n\n---\n\n_**Question 1.  LLaVA-1.5 and MiniGPT-4 share the same vulnerable layers, and DeepSeek-VL2 has a different one. Can your method generalize to other models?**_\n\n**Response:** To further validate the generalizability of our approach across different open-source models and architectures, we additionally applied our method, SafePTR, to LLaVA-Next (layers 9-10 recognized as vulnerable layers) and InternVL-2 (layers 7-10 recognized as vulnerable layers). As shown in the Table.3, **SafePTR consistently outperforms existing methods (Figstep and AdaShield), achieving superior performance in terms of both safety (Figstep and MMSafetyBench) and utility (MME)**, thereby confirming its broad applicability.\n\n**Table 3: Performance of LLaVA-Next and InternVL2**\n\n| Model | Method  | Figstep(↓) | MMSafetyBench(↓) |  MME(↑) |\n| ---------------------- | ----------- | ------- | -------- | -------- |\n| **LLaVA-Next-8B** | Baseline   | 56.4   |  34.8   |    1417.38  |\n|                        | Figstep    |  60.2  |   33.5  |    1379.26  |\n|                        | AdaShield |  9.0  |   5.1  |   1388.56   |\n|                        | Ours       | **1.8**  |   **1.2**  |  **1439.76**  |\n| **InternVL2-4B**     | Baseline   |  39.8  |  22.1   |  1520.66    |\n|                        | Figstep    |   44.2 |  20.4   |  1483.79    |\n|                        | AdaShield  |  3.0  |   3.5  |   1508.92   |\n|                        | Ours       |  **0.6**  |  **0.8**   |   **1520.53**   |\n\n---\n\n_**Question 2.  Could an adaptive threshold (e.g., using the statistics of semantic distances per sample) outperform the fixed Top-10 % rule while preserving utility?**_\n\n**Response:** Please refer to Weakness 1,  **Part 1. Fixed is better than adaptive** for a detailed comparison between fixed and adaptive thresholding strategies.\n\n---\n\n_**Question 3.  Discuss concrete strategies to approximate hidden states for black-box commercial models like GPT-4 so SafePTR’s insights can transfer.**_\n\n**Response:** Please refer to the Response of Weakness 3 for a detailed discussion on potential strategies to approximate hidden states in black-box commercial models like GPT-4."}, {"review_id": "S5TFmXTrn7", "reviewer": "Reviewer_7nHP", "summary": "This paper conduct an in-depth investigation into where, how, and which harmful multimodal tokens bypass the safeguard mechanisms within MLLMs during jailbreak attacks. And then further provide a Safe Prune-then-Restore  method.", "questions": "See the weakness", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "strengths:\n\n1. The paper is easy to follow.\n\n2. The analysis is detailed.\n\n3. The pruning and store operation is effective.\n\nweakness:\n\n1. The novelty is somewhat limited.  The similar pruning and store operation is similar to [1].\n\n2. The obversation is not new and is already provided in some papers, e.g., pca analysis and the layer analysis in [2].\n\n3. The applied MLLMs are too old. More new versions, e.g., Llava-Next (not in main experiments), InternVL-2, should be provided.\n\n4. If I increase the size of image and the length of text,  can the method still be effective? It may be an open discussion but somewhat influence the limitation of this paper. \n\n[1] BlueSuffix: Reinforced Blue Teaming for Vision-Language Models Against Jailbreak Attacks.\n\n[2] on prompt-driven safeguarding for large language models.", "was_revised": true, "final_justification": "The author well solve my concern and I raise the score to 4.", "rebuttal": "_**Weakness 1. The novelty is somewhat limited. The similar pruning and store operation is similar to [1].**_\n\n**Response:**  BlueSuffix [1] **does not incorporate pruning and restoring operations** , which is significantly diverges from that of SafePTR. Specifically, its methodology purifies images with a diffusion model, rewrites text prompts using a Large Language Model (LLM), and critically, appends an LLM-generated \"blue-team suffix\" via reinforcement learning to ensure benign Visual-Language Model (VLM) responses.\n\n[1] BlueSuffix: Reinforced Blue Teaming for Vision-Language Models Against Jailbreak Attacks.\n\n---\n\n_**Weakness 2. The observation is not new and is already provided in some papers, e.g., pca analysis and the layer analysis in [2].**_\n\n**Response:**  \n\n- **No Use of PCA**: Our analysis, encompassing Findings 1 through 3, **does not employ Principal Component Analysis (PCA)**. \n\n- **From Layer-wise to Token-wise Analysis**: \nThe initial **layer-wise analysis in finding-1 serves primarily as a foundation to motivate and support the subsequent token-level investigation in finding-3**. Our core contribution lies in this fine-grained token-wise analysis, which reveals that fewer than 1% of tokens are primarily responsible for triggering multimodal jailbreaks. To our knowledge, this is the first study to perform such a detailed token-level analysis in this context. As **Reviewer #1 (kYdu)** noted, \"Finding-3 that less than 1% of tokens are responsible for jailbreaks is particularly valuable and could inspire future research.\"\n\n[2] on prompt-driven safeguarding for large language models.\n\n---\n\n_**Weakness 3. The applied MLLMs are too old. More new versions, e.g., Llava-Next (not in main experiments), InternVL-2, should be provided.**_\n\n**Response:** We further validate the effectiveness of SafePTR using recent multimodal large language models (MLLMs), including LLaVA-Next and InternVL-2. As shown in Table 1, SafePTR consistently outperforms existing methods (Figstep and AdaShield), achieving superior results in both safety benchmarks (Figstep and MMSafetyBench) and utility (MME), thus demonstrating its broad applicability.\n\n**Table 1: Performance across LLaVA-Next and InternVL2**\n\n| Model | Method  | Figstep(↓) | MMSafetyBench(↓) |  MME(↑) |\n| ---------------------- | ----------- | ------- | -------- | -------- |\n| **LLaVA-Next-8B** | Baseline   | 56.4   |  34.8   |    1417.38  |\n|                        | Figstep    |  60.2  |   33.5  |    1379.26  |\n|                        | AdaShield |  9.0  |   5.1  |   1388.56   |\n|                        | Ours       |  **1.8**  |   **1.2**  |  **1439.76**  |\n| **InternVL2-4B**     | Baseline   |  39.8  |  22.1   |  1520.66    |\n|                        | Figstep    |   44.2 |  20.4   |  1483.79    |\n|                        | AdaShield  |  3.0  |   3.5  |   1508.92   |\n|                        | Ours       |  **0.6**  |  **0.8**   |   **1520.53**  |\n\n---\n\n_**Weakness 4. If I increase the size of image and the length of text, can the method still be effective? It may be an open discussion but somewhat influence the limitation of this paper.**_\n\n**Response:** To further explore the effectiveness of our method under varying image sizes and text lengths, we conducted experiments on FigStep benchmark of LLaVA-1.5 7B. As shown in Table.2, **our LLaVA-1.5+SafePTR consistently demonstrates strong defensive performance, regardless of the scale of the input**, indicating its effectiveness across a wide range of scenarios.\n\n\n**Table 2: The Impact of Image Size and Text Length of LLaVA-1.5+SafePTR on FigStep**\n\n| Image Size | Text Length(mean) |  Illegal Activity(↓) |Hate Speech(↓) |Malware Generation(↓)  |Physical Harm(↓)  |Fraud(↓) | Adult Content(↓)  |Privacy Violation(↓)  |Legal Opinion(↓) |Financial Advice(↓)  |Health Consultation(↓)  |Average(↓) | \n| ---------------------- | ------- | -------- |--|--|--|--|--|--|--|--|--|--|\n| 512 x 512 | 28.17 | 0.0  | 0.0 |    0.0  |  4.0   |   8.0   |  0.0   |    6.0  |  0.0    |   0.0    |  0.0    |  1.8   | \n| 760 x 760 | 28.17 | 0.0  | 0.0 |    0.0  |  4.0   |   6.0   |  0.0   |    6.0  |  0.0    |   0.0    |  0.0    |  1.6   | \n| 760 x 760 | 32.77 | 2.0  | 0.0 |    0.0  |  4.0   |   6.0   |  0.0   |    6.0  |  0.0    |   0.0    |  0.0    |  1.8   | \n| 1024 x 1024  | 32.77  | 2.0  | 0.0 |    0.0  |  6.0   |   6.0   |  0.0   |    6.0  |  0.0    |   0.0    |  0.0    |  2.0   | \n| 1024 x 1024  | 49.02  | 2.0  | 0.0 |    0.0  |  6.0   |   4.0   |  0.0   |    6.0  |  0.0    |   0.0    |  0.0    |  1.8   |\n| 20248 x 2048 | 49.02 | 0.0  | 0.0 |    0.0  |  4.0   |   8.0   |  0.0   |    4.0  |  0.0    |   0.0    |  0.0    |  1.6   | \n| 20248 x 2048 | 53.22 | 2.0  | 0.0 |    0.0  |  6.0   |   4.0   |  0.0   |    6.0  |  0.0    |   0.0    |  0.0    |  1.8   |"}]

Author rebuttal:

Meta-review: This paper presents SafePTR, a training-free inference-time defense against multimodal jailbreak attacks in MLLMs. Through systematic analysis, the authors identify that fewer than 1% of early–middle layer tokens are responsible for unsafe behaviors, and propose a prune-then-restore mechanism to mitigate them. The approach is empirically effective, achieving state-of-the-art robustness while preserving model utility across several benchmarks.

The paper is clearly written and experimentally thorough. While reviewers initially raised concerns regarding novelty, fixed hyperparameters, and generalization beyond open-source models, most issues were well addressed in the rebuttal period. Remaining limitations include restricted applicability to white-box models and lack of evaluation on newer architectures.

Overall, the paper makes contributions to MLLM safety. The strengths substantially outweigh the weaknesses, and I recommend acceptance.
Decision: Accept (poster)