SALLIE：防范潜在语言与图像攻击
SALLIE: Generation-Free Hidden-State Detection of Jailbreaks and Prompt Injections Across Text and Vision
AI总结：
SALLIE是一种轻量级运行时检测框架，通过机制可解释性提取模型内部激活信号，有效应对文本和图像攻击，无需性能降级或架构修改。
摘要：
大型语言模型（LLMs）和视觉-语言模型（VLMs）仍然极易受到文本和视觉劫持攻击以及提示注入攻击的威胁（arXiv:2307.15043, Greshake et al., 2023, arXiv:2306.13213）。现有防御措施通常通过复杂的输入转换来降低性能，或把多模态威胁视为孤立问题（arXiv:2309.00614, arXiv:2310.03684, Zhang et al., 2025）。为了解决一个统一的、模态无关的防御方法，该方法能够同时减轻文本和视觉威胁，而不会降低性能或需要架构修改，我们引入了SALLIE（Safeguarding Against Latent Language & Image Exploits），一种轻量级的运行时检测框架，基于机制可解释性（Lindsey et al., 2025, Ameisen et al., 2025）。通过无缝集成到标准的令牌级融合管道（arXiv:2306.13549）中，SALLIE直接从模型的内部激活中提取稳健的信号。在推理过程中，SALLIE通过三阶段架构进行防御：（1）提取内部残差流激活；（2）使用K-近邻（k-NN）分类器计算层级恶意评分；（3）通过层级集合模块聚合这些预测。我们评估了SALLIE在紧凑型、开源架构上——Phi-3.5-vision-instruct（arXiv:2404.14219）、SmolVLM2-2.2B-Instruct（arXiv:2504.05299）和gemma-3-4b-it（arXiv:2503.19786）——这些架构优先考虑实际推理时间和现实世界部署成本。我们的全面评估流程覆盖了超过十个数据集和超过五种强大的基线方法，SALLIE在各种实验设置中始终优于这些基线方法。
英文摘要：
Large Language Models (LLMs) and Vision-Language Models (VLMs) are vulnerable to jailbreaks and prompt injections delivered through text or images. Existing defenses often narrow threat coverage or add inference cost through input transformations, repeated model queries, generated responses, or threat-specific detectors. We present SALLIE (Single-Pass Activation Lookup for Layerwise Input Evaluation), a white-box, generation-free detector with a common architecture for textual and visual jailbreaks and prompt injections. Using one backbone forward pass, SALLIE extracts last-token residual-stream representations, applies layer-wise k-nearest-neighbor probes, and averages their scores across a contiguous layer range, without modifying the backbone or generating a response. To distinguish reusable detector configurations from deployment-specific tuning, we compare shared, threshold-only, and fully calibrated regimes across backbones and modalities. We evaluate SALLIE on compact open-weight VLMs (Gemma-3-4b-it, Phi-3.5-vision-instruct, SmolVLM2-2.2B-Instruct) using heterogeneous held-out test data spanning both threat families and modalities. Fully calibrated SALLIE-Phi achieves an aggregate F1 of 0.87 and higher aggregate balanced accuracy than RCS-KCD on all three backbones under a matched-calibration protocol. On Phi-3.5 visual inputs, threshold-only calibration yields an F1 of 0.99 with zero observed false positives, versus 0.54 for zero-shot Gemini-2.5-Flash-Lite. On Gemma-4-E2B-it, a backbone held out from representation-hyperparameter selection, the same procedure raises F1 from 0.62 to 0.79 on text and 0.68 to 0.98 on visual inputs. Representation hyperparameters can thus transfer across some backbones, while operating points remain backbone-, modality-, and distribution-dependent. We further report FPR/FNR tradeoffs, latency, and representation ablations.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
