Title: SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism
Venue: NeurIPS 2025
Accepted: yes
Keywords: Multi-modal LLMs

AI safety
Abstract: By incorporating visual inputs, Multimodal Large Language Models (MLLMs) extend LLMs to support visual reasoning. However, this integration also introduces new vulnerabilities, making MLLMs susceptible to multimodal jailbreak attacks and hindering their safe deployment. Existing defense methods, including Image-to-Text Translation, Safe Prompting, and Multimodal Safety Tuning, attempt to address this by aligning multimodal inputs with LLMs’ built-in safeguards. Yet, they fall short in uncovering root causes of multimodal vulnerabilities, particularly how harmful multimodal tokens trigger jailbreak in MLLMs? Consequently, they remain vulnerable to text-driven multimodal attacks, often exhibiting overdefensive behaviors and imposing heavy training overhead. To bridge this gap, we present an comprehensive analysis of where, how and which harmful multimodal tokens bypass safeguards in MLLMs.
Surprisingly, we find that less than 1% tokens in early-middle layers are responsible for inducing unsafe behaviors, highlighting the potential of precisely removing a small subset of harmful tokens, without requiring safety tuning, can still effectively improve safety against jailbreaks.
Motivated by this, we propose Safe Prune-then-Restore (SafePTR), an training-free defense framework that selectively prunes harmful tokens at vulnerable layers while restoring benign features at subsequent layers. Without incurring additional computational overhead, SafePTR significantly enhances the safety of MLLMs while preserving efficiency. Extensive evaluations across three MLLMs and five benchmarks demonstrate SafePTR’s state-of-the-art performance in mitigating jailbreak risks without compromising utility.


Peer reviews:
comments: SUMMARY:
This paper conduct an in-depth investigation into where, how, and which harmful multimodal tokens bypass the safeguard mechanisms within MLLMs during jailbreak attacks. And then further provide a Safe Prune-then-Restore  method.

STRENGTHS AND WEAKNESSES:
strengths:

1. The paper is easy to follow.

2. The analysis is detailed.

3. The pruning and store operation is effective.

weakness:

1. The novelty is somewhat limited.  The similar pruning and store operation is similar to [1].

2. The obversation is not new and is already provided in some papers, e.g., pca analysis and the layer analysis in [2].

3. The applied MLLMs are too old. More new versions, e.g., Llava-Next (not in main experiments), InternVL-2, should be provided.

4. If I increase the size of image and the length of text,  can the method still be effective? It may be an open discussion but somewhat influence the limitation of this paper. 

[1] BlueSuffix: Reinforced Blue Teaming for Vision-Language Models Against Jailbreak Attacks.

[2] on prompt-driven safeguarding for large language models.

QUESTIONS:
See the weakness

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 2
DATE: 2025-06-28

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper investigates why multimodal large language models (MLLMs) remain vulnerable to jailbreak attacks and proposes SafePTR, a training-free inference-time defense. Through layer-wise and token-level analyses, the authors discover that only a narrow band of early-middle layers is especially susceptible to malicious visual or textual tokens, and fewer than 1 % of tokens in those layers account for most unsafe behavior. SafePTR prunes the Top-K semantically deviant tokens in those vulnerable layers and restores benign contextual features to recover utility across three open-source MLLMs.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1. The paper is well structured.\n2. The work is supported by an extensive set of experiments.\n\nWeaknesses:\n\n1. Hyper-parameter K is fixed and may be dataset-specific.\n2. Novelty is incremental because the paper is relied on safety-aligned prompt embedding and the observation is also well-known. Please see [1] and [2,3] you already mentioned in the paper.\n3. Unable to applicate to black-box commercial models.\n\n[1] Li, Shen, et al. \"Safety layers in aligned large language models: The key to llm security.\" ICLR 2025.\n[2] Ghosal, Soumya Suvra, et al. \"Immune: Improving safety against jailbreaks in multi-modal llms via inference-time alignment.\" CVPR 2025.\n[3] Chen, Liang, et al. \"An image is worth 1/2 tokens after layer 2: Plug-and-play inference acceleration for large vision-language models.\" ECCV 2024.\n\nQUESTIONS:\n1. LLaVA-1.5 and MiniGPT-4 share the same vulnerable layers, and DeepSeek-VL2 has a different one. Can your method generalize to other models?\n2. Could an adaptive threshold (e.g., using the statistics of semantic distances per sample) outperform the fixed Top-10 % rule while preserving utility?\n3. Discuss concrete strategies to approximate hidden states for black-box commercial models like GPT-4 so SafePTR’s insights can transfer.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces SafePTR, a training-free, token-level defense framework designed to mitigate multimodal jailbreaks in large language models (LLMs). It identifies that less than 1% of multimodal tokens in early–middle layers are responsible for unsafe behaviors and proposes a prune-then-restore mechanism that removes these harmful tokens while restoring benign features to preserve model utility. Extensive evaluations across several multimodal LLMs and various benchmarks show that SafePTR achieves state-of-the-art robustness against both text- and vision-driven jailbreaks without sacrificing performance or requiring additional training.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. The paper has a strong motivation and the logic flow is very well. It identifies how jailbreak successes, where this happens, which tokens are in charge of it, and finally proposes a defense approach according to the findings.\n2. The paper is well written.\n3. The proposed method is very effective.\n\nWeaknesses:\n1. Some technical details are not clear enough. In particular, how are the textual harmful tokens pruned and restored. I wish to see some examples too.\n2. Not necessarily more great flaws.\n\nI think the paper is of high quality, and I wish to see further clarifications during rebuttal. I would consider raising my scores if the authors can address my concerns. Please also refer to my questions below.\n\nQUESTIONS:\nQuestions:\n1. Are the arrow directions in Figure 1 all correct? Upper arrow means better performance with larger numbers and lower arrow vice versa, right? It seems the arrow directions are flipped.\n2. Lots of citations have an incorrect style (in my opinion). For example in line 91, the citation for LLaVA, Mini-GPT and DeepSeek-VL should be cited with \\citep{} rather than \\citet{}. This is a minor issue.\n3. I am wondering, why did you choose to do layer-wise intervention on 2 and 4 consecutive layers, rather than 1 or greater numbers of layers? Could you provide some insight?\n4. Finding 2 is interesting. I am wondering, what do you think leads to such semantic deviation. That said, what kind of difference between the adversarial samples and the safety-aligned instructions leads to this deviation. Can we see from some concrete examples? Correct me if I have misunderstandings.\n5. I see in Finding 3, you are trying to answer my last point. But I still want more examples as mentioned above. Could you tell me how you decide the thrshold \\alpha? This number greatly affects the proportion of harmful tokens according to your definition. I also recommend explicitly providing the safty-aligned instruction in Figure 4.\n6. How did you prune text tokens? Any equation would help. And also, when doing HTP, did you just set the hidden state corresponding to top-K harmful tokens to 0? Could you provide more details?\n7. Can I understand restoration as taking the hidden states of the pruned tokens from original forward pass without pruning, and then insert them back as the hidden states of the pruned tokens in later layers where there is a less correlation with vulnerability?\n8. Do you think the proposed method can also be implemented on multimodal LLMs with discretized image tokenizers such as Chameleon [1]?\n\n[1] Team, C. (2024). Chameleon: Mixed-modal early-fusion foundation models. arXiv preprint arXiv:2405.09818.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces SafePTR, a training-free defense framework against multimodal jailbreak attacks in MLLMs. Through systematic analysis, the authors discover that less than 1% of tokens in early-middle layers are responsible for inducing unsafe behaviors. SafePTR leverages this insight to selectively prune harmful tokens at vulnerable layers while restoring benign features at subsequent layers, achieving state-of-the-art performance across multiple benchmarks without requiring additional training.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**: The paper presents a technically sound and well-motivated approach, with a systematic analysis framework (where/how/which harmful tokens bypass safeguards) that leads to actionable insights. The proposed SafePTR method is elegantly simple yet highly effective, achieving impressive results such as reducing ASR from 51.7% to 0.9% on LLaVA-1.5. The comprehensive experimental validation across three models and five benchmarks, coupled with thorough ablation studies, demonstrates both safety improvements and utility preservation. The training-free nature of the approach is a significant practical advantage, and the paper is well-written with clear visualizations that effectively communicate key findings. \n\n**Weaknesses**: I think the approach has some limitations in scope as it is being restricted to white-box models where intermediate hidden states are accessible, which excludes black-box models like GPT-4. The fixed Top-K pruning strategy (K=10%) lacks adaptability to inputs with varying risk levels, and the safety-aligned reference instruction used for semantic distance calculation is somewhat arbitrary. The analysis is limited to three open-source models, potentially limiting generalization to other architectures. Nonetheless, I don't think these weaknesses are fundamental.\n\nBut overall, in my opinion this work makes meaningful contributions to MLLM safety by providing both mechanistic insights and a practical defense solution. The finding that less than 1% of tokens are responsible for jailbreaks is particularly valuable and could inspire future research.\n\nQUESTIONS:\n- Why did you choose a fixed Top-K (10%) pruning ratio rather than an adaptive threshold based on the actual semantic deviation distribution? Have you explored dynamic pruning strategies that adjust K based on input risk levels?\n- In your opinion, how robust do you think SafePTR is against adaptive attacks where adversaries know about the token pruning mechanism?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}