风险感知注入：为安全校准视觉-语言模型而不牺牲实用性
Risk Awareness Injection: Calibrating Vision-Language Models for Safety without Compromising Utility
AI总结：
本文提出RAI框架，通过增强不安全信号恢复视觉-语言模型的安全识别能力，同时保持语义完整性，实验显示有效降低攻击成功率。
摘要：
视觉语言模型（VLMs）扩展了大型语言模型（LLMs）的推理能力至跨模态设置，但仍然高度易受多模态劫持攻击。现有防御主要依赖安全微调或激进的token操纵，导致训练成本高或显著降低实用性。最近研究表明，LLMs本质上能识别不安全内容，而在VLMs中引入视觉输入经常稀释风险信号。受此启发，我们提出风险感知注入（RAI），一种轻量且无需训练的框架，通过放大VLM中的不安全信号恢复LLM-like的风险识别能力。具体而言，RAI从语言嵌入中构建不安全原型子空间，并对选定的高风险视觉token进行针对性调节，明确激活跨模态特征空间中的安全关键信号。这种调节恢复了模型从视觉输入检测不安全内容的LLM-like能力，同时保持原始token的语义完整性以进行跨模态推理。在多个劫持和实用性基准上的广泛实验表明，RAI显著降低了攻击成功率，而不会影响任务性能。
英文摘要：
Vision language models (VLMs) extend the reasoning capabilities of large language models (LLMs) to cross-modal settings, yet remain highly vulnerable to multimodal jailbreak attacks. Existing defenses predominantly rely on safety fine-tuning or aggressive token manipulations, incurring substantial training costs or significantly degrading utility. Recent research shows that LLMs inherently recognize unsafe content in text, and the incorporation of visual inputs in VLMs frequently dilutes risk-related signals. Motivated by this, we propose Risk Awareness Injection (RAI), a lightweight and training-free framework for safety calibration that restores LLM-like risk recognition by amplifying unsafe signals in VLMs. Specifically, RAI constructs an Unsafe Prototype Subspace from language embeddings and performs targeted modulation on selected high-risk visual tokens, explicitly activating safety-critical signals within the cross-modal feature space. This modulation restores the model's LLM-like ability to detect unsafe content from visual inputs, while preserving the semantic integrity of original tokens for cross-modal reasoning. Extensive experiments across multiple jailbreak and utility benchmarks demonstrate that RAI substantially reduces attack success rate without compromising task performance.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
