面向视觉语言模型越狱防御的零空间投影原则性引导
Principled Steering via Null-space Projection for Jailbreak Defense in Vision-Language Models
把零空间投影引入激活引导：在良性子空间内保持零扰动、仅在潜在有害方向上诱导拒答，为视觉语言模型的推理期安全对齐提供了一个可复用、有理论保证的干预手段，可直接迁移到其他多模态模型的安全加固。
原文依据 it maintains zero perturbation within the benign subspace while dynamically inducing refusal along potentially harmful directions
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论随着视觉语言模型（VLM）在开放世界场景中日益广泛部署，它们很容易被视觉越狱攻击诱导生成有害内容，对模型安全与可信使用构成严重风险。近期的激活引导方法在推理阶段向模型激活中注入方向向量以诱发拒答行为，已被证明有效。然而，一个引导向量可能同时增强拒答能力并导致过度拒答，从而降低模型在良性输入上的表现。此外，由于缺乏理论可解释性，这些方法在鲁棒性和有效性上仍然有限。为更好地平衡安全性与可用性，我们提出 NullSteer，一种零空间投影的激活防御框架。该方法通过线性变换在模型激活中构造拒答方向：它在良性子空间内保持零扰动，同时沿潜在有害方向动态诱导拒答，从而在理论上实现安全性的增强而不损害模型的通用能力。大量实验表明，NullSteer 在多种越狱攻击下显著减少有害输出（在 MiniGPT-4 上平均 ASR 降低超过 15%），同时在通用基准上保持与原模型相当的性能。
英文原文摘要 1362 字符
As vision-language models (VLMs) are increasingly deployed in open-world scenarios, they can be easily induced by visual jailbreak attacks to generate harmful content, posing serious risks to model safety and trustworthy usage.Recent activation steering methods inject directional vectors into model activations during inference to induce refusal behaviors and have demonstrated effectiveness.However, a steering vector may both enhance refusal ability and cause over-refusal, thereby degrading model performance on benign inputs.Moreover, due to the lack of theoretical interpretability, these methods still suffer from limited robustness and effectiveness.To better balance safety and utility, we propose \texttt NullSteer , a null-space projected activation defense framework.Our method constructs refusal directions within model activations through a linear transformation: it maintains zero perturbation within the benign subspace while dynamically inducing refusal along potentially harmful directions, thereby theoretically achieving safety enhancement without impairing the model's general capabilities.Extensive experiments show that \texttt NullSteer significantly reduces harmful outputs under various jailbreak attacks (average ASR reduction over 15% on MiniGPT-4) while maintaining comparable performance to the original model on general benchmarks.