BlueSuffix: Reinforced Blue Teaming for Vision-Language Models Against Jailbreak Attacks

Authors: Yunhan Zhao, Xiang Zheng, Lin Luo, Yige Li, Xingjun Ma, Yu-Gang Jiang
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Jailbreak Defense, Blue-Teaming, Large Vision-Language Model

Abstract:
In this paper, we focus on black-box defense for VLMs against jailbreak attacks.
Existing black-box defense methods are either unimodal or bimodal. Unimodal methods enhance either the vision or language module of the VLM, while bimodal methods robustify the model through text-image representation realignment. 
However, these methods suffer from two limitations: 1) they fail to fully exploit the cross-modal information, or 2) they degrade the model performance on benign inputs.
To address these limitations, we propose a novel blue-team method BlueSuffix that defends target VLMs against jailbreak attacks without compromising its performance under black-box setting. BlueSuffix includes three key components: 1) a visual purifier against jailbreak images, 2) a textual purifier against jailbreak texts, and 3) a blue-team suffix generator using reinforcement fine-tuning for enhancing cross-modal robustness. We empirically show on four VLMs (LLaVA, MiniGPT-4, InstructionBLIP, and Gemini) and four safety benchmarks (Harmful Instruction, AdvBench, MM-SafetyBench, and RedTeam-2K) that BlueSuffix outperforms the baseline defenses by a significant margin. 
Our BlueSuffix opens up a promising direction for defending VLMs against jailbreak attacks. Code is available at https://github.com/Vinsonzyh/BlueSuffix.

Decision: accept (poster)
Reviewer scores: 5, 5, 6, 6

Reviews and discussion:
<thread>
creation date:
1730375514046

thread_type:
official_review

<thread_object>
creator: reviewer_vnas

<content>
summary:
This paper addresses jailbreak vulnerabilities in Vision-Language Models (VLMs) by proposing BlueSuffix, a novel black-box defense method that combines visual purification, textual purification, and a reinforcement learning-trained suffix generator. Unlike existing unimodal and bimodal defense approaches, BlueSuffix effectively leverages cross-modal information while maintaining model performance on benign inputs. The method's effectiveness is demonstrated through extensive empirical validation across multiple VLMs (LLaVA, MiniGPT-4, and Gemini) and safety benchmarks (MM-SafetyBench and RedTeam-2K), showing significant improvements over baseline defenses and strong transferability across different models, even under adaptive attack scenarios. This comprehensive approach suggests a practical path forward for deploying robust VLMs in real-world applications.

strengths:
1. The paper presents a well-structured and clearly articulated methodology for VLM defense.
2. The proposed black-box method demonstrates practical value with its low-cost implementation and easy deployment.
3. The experimental design is comprehensive, covering both open-source and commercial VLMs.

weaknesses:
1. The claim regarding semantic preservation in blue-team suffix generation requires more rigorous validation. The provided examples suggest potential semantic drift between original and processed prompts.

2. The model selection scope could be expanded. Notable omissions include InstructBLIP and other widely-used VLMs, which would strengthen the generalizability claims.

3. The evaluation methodology relies heavily on GPT-4 judgements. Including additional evaluation tools (e.g., Perspective API) would provide more comprehensive safety assessments.

questions:
1. Could the authors provide quantitative metrics or systematic evaluation results demonstrating semantic preservation between original and purified prompts with suffixes?

2. Would it be possible to extend the evaluation to include additional VLMs and alternative evaluation metrics to strengthen the robustness claims?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730556266131

thread_type:
official_review

<thread_object>
creator: reviewer_thml

<content>
summary:
This paper focuses on defending Vision-Language Models (VLMs) against jailbreak attacks. It proposes BlueSuffix, a novel blue-team method with three key components: a diffusion-based image purifier, an LLM-based text purifier, and an LLM-based blue-team suffix generator. The method is trained via reinforcement learning to optimize the safety score of the target VLM. Experiments on three VLMs and two safety benchmarks show that BlueSuffix outperforms baseline defenses, achieving significant reductions in Attack Success Rate (ASR). It also has high transferability and is robust against an adaptive attack. The contributions include introducing BlueSuffix, proposing a cross-modal optimization method, and demonstrating the effectiveness and transferability of the defense.

strengths:
The paper presents an approach to defending Vision-Language Models (VLMs) against jailbreak attacks, but the originality of the BlueSuffix method is somewhat limited. While it combines existing techniques, such as a diffusion-based image purifier and an LLM-based text purifier, the contributions do not significantly advance the current state of the art in VLM security. The method’s reliance on established concepts may not provide the innovative leap needed to warrant acceptance.

Although the research includes an experimental setup involving multiple VLMs and benchmark datasets, the execution lacks depth. The comparisons with baseline defenses like DiffPure and Safety Prompt are present, but the results do not convincingly demonstrate the effectiveness of BlueSuffix. Furthermore, the ablation studies, while included, do not provide sufficient insights into the importance of each component, leaving questions about the overall robustness and applicability of the proposed method.

weaknesses:
1.The suffix generator used by the blue team demonstrates effectiveness in certain scenarios; however, its adaptability to a broad range of jailbreak prompts appears limited. Currently, it is primarily trained on specific hard jailbreak prompts related to "financial advice." This focus may hinder its performance when faced with diverse topics or novel prompt structures, particularly if attackers employ innovative semantic or syntactic patterns that the generator is not equipped to handle.

2.The diffusion-based image purifier may struggle to completely eliminate all forms of adversarial perturbations. Some sophisticated adversarial attacks can introduce subtle perturbations that are challenging to detect and remove using the existing diffusion process. This limitation raises concerns about the potential for residual malicious information in the purified images, which could inadvertently provoke harmful responses from the VLM.

3.The evaluation of the proposed defense primarily concentrates on only two types of attacks—vanilla and BAP attacks. This narrow focus may not adequately reflect the variety of real-world jailbreak attacks. Without testing against a broader spectrum of attack strategies, the effectiveness of the defense in more complex scenarios remains uncertain.

4.Although the paper outlines the three components of BlueSuffix, it falls short in analyzing their interactions and how they may enhance one another. Exploring potential synergies could lead to significant improvements in both resource utilization and defense effectiveness, thereby optimizing the overall system performance.

5.There is room for further optimization in the reinforcement learning process aimed at fine-tuning the suffix generator. The current objective function and training methodology might not yield the most effective suffixes. A more systematic exploration of the reference policy and the hyperparameter β could enhance the generator's performance and stability.
6.The discussion surrounding baseline defenses, specifically DiffPure and Safety Prompt, lacks sufficient detail. A clearer explanation of the specific techniques and algorithms employed in these baselines would help readers better understand the distinctions between the proposed method and existing defenses.

7.When analyzing performance across different VLMs such as LLaVA, MiniGPT-4, and Gemini, the paper could benefit from a deeper examination of how each VLM's characteristics influence the defense method's effectiveness. Such insights would aid in assessing the applicability and limitations of the proposed defense across various VLM architectures.

questions:
No further questions. I've included all my questions within the **Weakness** section.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730701289660

thread_type:
official_review

<thread_object>
creator: reviewer_pwr2

<content>
summary:
This paper focuses on black-box defense for VLMs against jailbreak attacks. This paper proposes the BlueSuffix method to defend against jailbreak attacks. BlueSuffix consists of three main components: 1) a visual purifier against jailbreak images, 2) a textual purifier against jailbreak texts, and 3) a blue team suffix generator fine-tuned via reinforcement learning to improve cross-modal robustness. BlueSuffix adopts a black-box defense model where the defender does not have access to the internal structures nor parameters of the target VLM. BlueSuffix ultimately succeeds in assisting the target VLM to automatically identify the malicious query within the inputs and generate a positive response accordingly, rather than acting as a malicious query detector.

strengths:
* The paper is very well written and organized. The main points are well explained and easy to follow. The use of cleaners and generators is very interesting.
* The method shows a large reduction in the ASR of VLMs on two datasets. Moreover, the transferability analysis in this method also shows strong transferability across different targets.

weaknesses:
* The paper claims that it can enable the target VLM to identify harmful content without altering the original meaning, although the prompt used for the text purifier instructs the LLM not to alter the original meaning, but no relevant statistics support this claim. See question 1 for more details.
* This paper used GPT-4o as the judge for harmful response, the author should present the system prompt used for the GPT-4o.
* The result in Table 4 for Gemini is strange, why DiffPure + Safety Prompt will increase the ASR compared to each method by itself, please see question 3 for more details.

questions:
1. Could the author provide some additional experiments to show that the text cleaner and the suffix do not change the original meaning of the instructions?
2. Could the author show the detailed system prompt used for the GPT-4o?
3. Could the author explain why the DiffPure + Safety Prompt method increases ASR? Some sample answers from Gemini may help to explain.
4. Could the author provide more explanation for Figure 4? For the top 3 rows, the prompts do not seem harmful enough.
5. Could the author show the result of some other jailbreak method specified for VLM other than BAP attack?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730720323678

thread_type:
official_review

<thread_object>
creator: reviewer_kkk7

<content>
summary:
This paper proposes a defense method for jailbreak attacks on VLMs to protect VLMs from black-box jailbreak attacks. Specifically, the method utilizes a multimodal purifier and reinforcement learning-based text tuning suffixes to enhance the robustness of VLMs.

strengths:
1. The authors analyze the limitations of existing VLM denial defenses from two perspectives: lack of cross-modal information and decreased performance on benign inputs.
2. The proposed method has been validated on both open-source and commercial models, and is easy to implement and deploy.

weaknesses:
1. Insufficient motivation for cross-modal information. The authors emphasize the series of problems caused by insufficient utilization of cross-modal information, but there is no detailed analysis or empirical evidence to prove this flaw. Therefore, the design of the Blue Team suffix generator, based on the above motivation, also lacks direct validation. Could the authors explain what specific manifestations are limited by the lack of cross-modal information and how this generator can alleviate the issue?
2. Limited experimental effects on clean samples. The method proposed by the authors, which is discussed in lines 445-451 of the paper, can improve the performance of benign inputs. However, the improvement is limited and does not surpass that of DiffPure. Therefore, I believe the claim about improving the performance of benign inputs is not effective.
3. Unclear technical contributions. The multimodal purifier proposed by the authors is more about a simple application of image purification technology and GPT-4o, and cannot be considered a significant technical contribution. The authors should elaborate more on the features of the proposed method and its relevance to overcoming limitations.
4. Insufficient ablation analysis. The authors proposed three modules, each designed to address different limitations, but simply stacking these modules and discussing performance changes does not constitute effective validation of the solution. The authors should conduct more detailed assessments of each component of the proposed method.

questions:
Please see Weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732612027300

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Summary of Contributions and Revisions in the Rebuttal Version

comment:
We appreciate the reviewers' valuable feedback and recognition of the significance of our contributions. Below, we summarize the core contributions of our work and outline the updates made in the rebuttal version of the paper:

---

**Summary of Our Contributions:**
Our main contribution is the proposal of a blue-teaming framework that leverages reinforcement learning (RL) to continuously optimize a suffix generator through a reward model, aimed at protecting VLMs in black-box settings (defending both white-box and black-box attacks).

While appending adversarial suffixes is commonly used to launch jailbreaking attacks against LLMs, our RL-based blue-teaming suffix generator is a novel approach for defending VLMs against multimodal jailbreaking attacks. It uniquely incorporates cross-modal gradient information to enhance robustness. Moreover, our approach has minimal impact on benign inputs, effectively balancing defense effectiveness and usability.

To summarize, our BlueSuffix provides a plug-and-play, model-agnostic, and generic solution for blue-teaming VLMs, enabling seamless integration and extension of existing techniques such as diffusion-based image purification and LLM-based prompt purification methods.

---

**Summary of Changes:**
- **Ablation Study:** We conducted an ablation study to independently evaluate the ‘Suffix Generator’ and analyzed the role and effectiveness of each module in **Ablation Studies**. The detailed ablation results of ‘Suffix Genertor’ are added to Table 8 Appendix G.

- **Semantic Preservation:** We added experiments to assess whether the ‘Text Purifier + Suffix Generator’ alters the original meaning of the instructions in Appendix H.

- **Judge Prompt:** We provided the detail of the judge prompt used in our experiments in Appendix D.

- **Evaluation of BlueSuffix on additional attacks:** We evaluated BlueSuffix against VAA and GCG attacks on three open-source models (MiniGPT-4, LLaVA-v1.5-7B, and InstructionBLIP) and a commercial model (Gemini), with results presented in Appendix J.

- **Baseline defense details:** We provided a comprehensive introduction to baseline defense methods in Appendix F.

- **Extension to an additional VLM:** We conducted experiments with an additional VLM, InstructionBLIP, on the MM-SafetyBench and RedTeam-2k datasets in Appendix I.

- **Additional baseline defenses compared with BlueSuffix:** We included comparisons with three white-box defense methods to further highlight the effectiveness of BlueSuffix in Appendix K.

---

Finally, we thank the reviewers for their constructive comments, which have significantly helped us improve the quality of our work. We hope to receive their further feedback before the rebuttal ends.
</content>
</thread_object>

</thread>
<thread>
creation date:
1733294341608

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Summary of Rebuttal

comment:
Dear PCs, SACs, ACs, Reviewers,

We sincerely appreciate the time, effort, and dedication you have devoted to reviewing our paper. We are also grateful for the valuable initial feedback provided by the four reviewers. In response to the concerns raised, we have carefully addressed all comments and have uploaded the revised version of our paper. We hope the following summary will assist the AC and future readers in better understanding our work and the rebuttal.

---

Addressing the Concerns Raised by **Reviewer KkK7**:
- **Cross-modal information**: We have provided detailed explanations for our motivation. Additionally, we have conducted a quantitative analysis using Mutual Information (MI) to demonstrate our BlueSuffix genuinely exploits cross-modal information.
- **Technical contributions and exploration of more purifiers**: We have conducted additional experiments to confirm that our method is versatile and applicable to different image purification techniques and text purifiers.
- **Effect on clean samples**: We have clarified the misunderstanding of the reviewer and provided further explanations demonstrating that our method provides robust defense with minimal impact on benign inputs. 
- **Ablation analysis**: We have included more detailed ablation studies and explained the role and effectiveness of each component in BlueSuffix.

`We are looking forward to the further feedback of Reviewer KkK7.`

---

Addressing the Concerns Raised by **Reviewer pWr2**:
- **Semantic similarity**: We employed GPT-4o to evaluate the semantic similarity between the original prompts and those processed by our "Text Purifier + Suffix Generator". The evaluation results indicate strong semantic consistency.
- **The judge prompt**: We have added the judge prompt used in our experiments in Appendix D.
- ‘DiffPure + Safety Prompt’: We have provided a detailed explanation and an example to explain why it increases ASR on Gemini, i.e., one weakness of textual-only defense.
- **Harmfulness of the examples**: We have clarified the selection of the example prompts shown in Figure 4, i.e., to be reader-friendly.
- **Evaluating more jailbreak methods**: We have expanded our experiments to include evaluations against four additional jailbreak methods (imgJP, VAA, GCG, AutoDAN). The additional experiments confirmed the effectiveness of BlueSuffix and demonstrated its strong generalizability in defending against different types of jailbreak attacks across various datasets and models. 

`We are still looking forward to the feedback of Reviewer pWr2.`

---

Addressing the Concerns Raised by **Reviewer ThML**:

- **Diffusion-based image purifiers**: We have clarified the relationship of our method to pre-trained image purifiers. As a flexible framework, our BlueSuffix cannot only incorporate more advanced purifiers but also effectively address their weaknesses through RL-based optimization.
- **Evaluation on other jailbreak methods**: We have expanded our experiments to include evaluations against four additional jailbreak methods (img JP, VAA, GCG, AutoDAN). The additional experiments confirmed the effectiveness of BlueSuffix and demonstrated its strong generalizability in defending against different types of jailbreak attacks across various datasets and models. 
- **Components interactions**: We have provided detailed explanations and ran additional experiments with a new variant of BlueSuffix to show how different components of BlueSuffix enhance each other.
- **Baseline details**: We have added the technical details of  the baseline methods in Appendix F.

`We would like to thank the Reviewer ThML for timely and constructive feedback.`

---

Addressing the Concerns Raised by **Reviewer vnas**:

- **Semantic similarity**: We employed GPT-4o to evaluate the semantic similarity between the original prompts and the prompts processed by our "Text Purifier + Suffix Generator". The evaluation results indicate strong semantic consistency.
- **Additional VLMs and evaluation metrics**: We have added a new set of experiments covering  an additional VLM (InstructionBLIP), four more VLM jailbreak attacks (imgJP, VAA, GCG, and AutoDAN), and three recent defense methods published at ICML 2024 and NeurIPS 2024 (R2D2, CAT, and VLGuard). We have also evaluated the use of the Perspective API as an alternative to GPT-4o for computing the toxicity score.

`We are still looking forward to the further feedback of Reviewer vnas.`

---

Once again, we sincerely appreciate your time and valuable feedback. We hope that the revisions and clarifications we have provided effectively address the concerns and contribute to strengthening our submission.

Best,

The Authors
</content>
</thread_object>

</thread>


Metareview:
metareview:
The recommendation is based on the reviewers' comments, the area chair's evaluation, and the author-reviewer discussion. 

This paper proposes a blue-team method (BlueSuffix) for vision language models, through purification techniques for different modalities. All reviewers find the studied setting novel and the results provide new insights. In the original reviews, the concerns were concentrated on (1) Clarification of the technical contributions; (2) Further empirical evidence to support the claim of cross-modal robustness. 

In the post-rebuttal phase, the authors did a great job of providing additional results and justification. However, this paper is borderline, because no reviewers would strongly champion this paper. Nonetheless, I found that the authors’ rebuttal has successfully addressed the major concerns of reviewers. 

Given the timeliness of the topic (VLM safety), and the practicality of the proposed method, I am leaning toward recommending acceptance of this submission if there is room. I also expect the authors to include the new results and suggested changes during the rebuttal phase to the final version.