New detection method protects vision-language models from jailbreak attacks without training data

Despite significant work to align Large Vision-Language Models (LVLMs) with safety standards, these systems remain susceptible to jailbreak attacks that bypass their safeguards. Detecting these threats presents a difficult trade-off: existing methods either fail to catch novel attacks or rely on manual rules that compromise both accuracy and computational efficiency.

The Problem with Current Approaches#

Current detection strategies fall into two camps, neither wholly satisfactory. Learning-based methods trained on specific attack types often break down when encountering new, unseen attacks. Meanwhile, detection systems built on hand-crafted heuristics struggle with accuracy while consuming more computational resources than ideal.

A New Framework: Learning to Detect#

To overcome these limitations, researchers have introduced Learning to Detect (LoD), a framework that dispenses with both attack training data and hand-crafted rules. The system works by examining the model's internal activity patterns—specifically, layer-wise safety representations extracted from model activations.

The approach uses two key components:

• Multi-modal Safety Concept Activation Vectors classifiers to pull safety-relevant signals directly from the model's internal states across different layers
• A Safety Pattern Auto-Encoder that compresses these high-dimensional signals into a single anomaly score for making detection decisions

Results Across Multiple Models#

Testing shows that LoD achieves state-of-the-art detection performance (measured by AUROC) across a variety of unseen jailbreak attacks and multiple LVLM architectures. The method also delivers meaningful improvements in computational efficiency compared to earlier approaches.

The code and implementation are available online for the research community.