Vision-language models (VLMs) have improved significantly in multi-modal tasks, but their more complex architecture makes their safety alignment more challenging than the alignment of large language models (LLMs). In this paper, we reveal an unfair distribution of safety across the layers of VLM's vision encoder, with earlier and middle layers being disproportionately vulnerable to malicious inputs compared to the more robust final layers. This 'cross-layer' vulnerability stems from the model's inability to generalize its safety training from the default architectural settings used during training to unseen or out-of-distribution scenarios, leaving certain layers exposed. We conduct a comprehensive analysis by projecting activations from various intermediate layers and demonstrate that these layers are more likely to generate harmful outputs when exposed to malicious inputs. Our experiments with LLaVA-1.5 and Llama 3.2 show discrepancies in attack success rates and toxicity scores across layers, indicating that current safety alignment strategies focused on a single default layer are insufficient.

View on arXiv

@article{bachu2025_2411.04291,
  title={ Layer-wise Alignment: Examining Safety Alignment Across Image Encoder Layers in Vision Language Models },
  author={ Saketh Bachu and Erfan Shayegani and Rohit Lal and Trishna Chakraborty and Arindam Dutta and Chengyu Song and Yue Dong and Nael Abu-Ghazaleh and Amit K. Roy-Chowdhury },
  journal={arXiv preprint arXiv:2411.04291},
  year={ 2025 }
}

Comments on this paper