Understanding and Mitigating Token-Pruning-Induced Vulnerabilities in VLMs
Abstract Overview
This paper investigates how visual token pruning affects the safety of vision-language models under multimodal jailbreak attacks. Across eight pruning strategies evaluated on three safety benchmarks, the authors observe that standard vision-centric and text-guided pruning methods increase attack success rates as pruning ratios rise, even while general utility remains stable. They attribute this vulnerability to Pruning-Induced Malicious Amplification, wherein discarding background tokens causes attention to collapse onto retained foreground tokens encoding harmful semantics. To resolve this issue, the authors introduce Safety-Aware Pruning (SAP), an inference-time, plug-and-play defense that identifies malicious anchors, restores dropped benign tokens, and reallocates attention away from harmful anchors.
Novelty
The paper provides a comprehensive safety evaluation of token-pruning paradigms in VLMs under multimodal jailbreak settings. It identifies and formalizes the Pruning-Induced Malicious Amplification mechanism and proposes SAP as a training-free, inference-time defense that restores benign-malicious attention equilibrium.
Results
Across five pruning baselines on MM-Safety, FigStep, and JailBreakV, SAP consistently reduces attack success rates (up to a 27.6% relative reduction on average in the visual setting and up to 62% in the text-extended variant) while maintaining utility across MMBench, MM-Vet, LLaVA-Bench, and ScienceQA. Efficiency benchmarks show SAP introduces negligible computational overhead, increasing TRIM latency only slightly from 55.90 ms to 57.19 ms on an RTX 4090 while keeping theoretical FLOPs identical at 2.22 T.
Key Points
- Standard vision-centric and text-guided token pruning increases VLM susceptibility to multimodal jailbreaks, whereas extreme query-based compression reduces vulnerability.
- Safety degradation is driven by attention collapse, where pruning away benign background tokens concentrates attention onto retained foreground tokens carrying malicious semantics.
- Safety-Aware Pruning (SAP) counteracts this effect by identifying malicious anchors, restoring benign background tokens, and redistributing attention to maintain safety without sacrificing acceleration or task utility.