Reproduce “SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Beitao Chen, Xinyu Lyu, Lianli Gao, Jingkuan Song, Heng Tao Shen
Researchers at Shenzhen Institute for Advanced Study and Tongji University developed SafePTR, a training-free defense for Multimodal Large Language Models (MLLMs) that identifies and prunes harmful tokens in early-middle layers while restoring benign features. The framework reduced attack success rates to as low as 1.3% while maintaining or improving model utility and incurring minimal inference latency.
Key insights
- Jailbreak attacks primarily exploit a narrow band of 2-4 consecutive early-middle layers within MLLMs, where malicious content propagates most effectively.
- Malicious inputs leading to jailbreaks induce significant semantic deviation in the hidden states from safety-aligned representations.
- Less than 1% of multimodal tokens in these vulnerable early-middle layers are responsible for inducing the critical semantic shifts that cause unsafe behaviors.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.