The Safety Reminder: A Soft Prompt to Reactivate Delayed Safety Awareness in Vision-Language Models

TL;DR

This paper introduces 'The Safety Reminder', a soft prompt tuning method that reactivates delayed safety awareness in vision-language models, effectively reducing harmful content generation without affecting normal performance.

Contribution

It reveals the phenomenon of delayed safety awareness in VLMs and proposes a prompt-based technique to proactively enhance safety during model deployment.

Findings

Significantly reduces attack success rates on safety benchmarks.

Maintains model utility and normal conversation quality.

Effectively activates safety awareness only when needed.

Abstract

As Vision-Language Models (VLMs) demonstrate increasing capabilities across real-world applications such as code generation and chatbot assistance, ensuring their safety has become paramount. Unlike traditional Large Language Models (LLMs), VLMs face unique vulnerabilities due to their multimodal nature, allowing adversaries to modify visual or textual inputs to bypass safety guardrails and trigger the generation of harmful content. Through systematic analysis of VLM behavior under attack, we identify a novel phenomenon termed ``delayed safety awareness''. Specifically, we observe that safety-aligned VLMs may initially be compromised to produce harmful content, but eventually recognize the associated risks and attempt to self-correct. This pattern suggests that VLMs retain their underlying safety awareness but experience a temporal delay in their activation. Building on this insight, we hypothesize that VLMs' safety awareness can be proactively reactivated through carefully designed prompts. To this end, we introduce ``The Safety Reminder'', a soft prompt tuning approach that optimizes learnable prompt tokens, which are periodically injected during the text generation process to enhance safety awareness, effectively preventing harmful content generation. Additionally, our safety reminder only activates when harmful content is detected, leaving normal conversations unaffected and preserving the model's performance on benign tasks. Through comprehensive evaluation across three established safety benchmarks and one adversarial attacks, we demonstrate that our approach significantly reduces attack success rates while maintaining model utility, offering a practical solution for deploying safer VLMs in real-world applications.