Activation Steering Meets Preference Optimization: Defense Against Jailbreaks in Vision Language Models

TL;DR

This paper introduces SPO-VLM, a two-stage defense framework combining activation steering and preference optimization to improve the robustness of vision language models against adversarial attacks while preserving their performance.

Contribution

It proposes a novel two-stage method that enhances VLM safety through adaptive activation steering and sequence-level preference optimization, addressing limitations of prior task-specific approaches.

Findings

Enhanced safety against adversarial attacks

Maintained strong performance on benign tasks

Effective balance of efficiency and robustness

Abstract

Vision Language Models (VLMs) have demonstrated impressive capabilities in integrating visual and textual information for understanding and reasoning, but remain highly vulnerable to adversarial attacks. While activation steering has emerged as a promising defence, existing approaches often rely on task-specific contrastive prompts to extract harmful directions, which exhibit suboptimal performance and can degrade visual grounding performance. To address these limitations, we propose \textit{Sequence-Level Preference Optimization} for VLM (\textit{SPO-VLM}), a novel two-stage defense framework that combines activation-level intervention with policy-level optimization to enhance model robustness. In \textit{Stage I}, we compute adaptive layer-specific steering vectors from diverse data sources, enabling generalized suppression of harmful behaviors during inference. In \textit{Stage II}, we refine these steering vectors through a sequence-level preference optimization process. This stage integrates automated toxicity assessment, as well as visual-consistency rewards based on caption-image alignment, to achieve safe and semantically grounded text generation. The two-stage structure of SPO-VLM balances efficiency and effectiveness by combining a lightweight mitigation foundation in Stage I with deeper policy refinement in Stage II. Extensive experiments shown SPO-VLM enhances safety against attacks via activation steering and preference optimization, while maintaining strong performance on benign tasks without compromising visual understanding capabilities. We will release our code, model weights, and evaluation toolkit to support reproducibility and future research. \textcolor{red}{Warning: This paper may contain examples of offensive or harmful text and images.}

Figures

Tables

Table 1. Table 1: Performance of different safety steering methods on safety and visual understanding benchmarks. The ↑ \uparrow or ↓ \downarrow symbols indicate whether a higher or lower score is preferable.

Base Model	Method	Toxicity Scores (%)	Jailbreak ASR (%)		Visual Understanding Scores
		RealToxicityPrompt  $\downarrow$	AdvBench  $\downarrow$	Anthropic_Harmful  $\downarrow$	MM-Vet  $\uparrow$	SQA  $\uparrow$	CogVLM  $\uparrow$	MME  $\uparrow$
MiniGPT-4-13B	Original Model	38.18	19.19	73.50	32.58	68.10	74.00	1742.0
	ASTRA	10.21	5.93	4.87	17.70	65.35	69.00	1086.0
	SPO-VLM	9.28	4.77	3.21	31.11	66.20	70.00	1370.0
Qwen2-VL-7B	Original Model	30.65	75.00	55.17	49.13	79.13	41.00	1630.0
	ASTRA	14.18	7.69	5.17	48.66	80.99	45.00	685.3
	SPO-VLM	11.54	6.38	4.48	49.80	81.82	51.00	1753.0
LLaVA-v1.5-13B	Original Model	85.74	36.80	74.00	28.60	74.38	59.00	1560.0
	ASTRA	81.44	5.76	24.13	14.90	56.03	56.00	1320.0
	SPO-VLM	50.37	4.39	12.18	20.19	60.37	55.00	1489.0

Table 2. Table 2: Ablation study on Qwen2-VL-7B evaluating the contributions of each stage in the SPO-VLM framework.

Behavior	RealToxicityPrompt	AdvBench	Anthropic_Harmful
Original Model	30.65	75.00	55.17
Stage I	20.97	10.96	5.09
Stage I + Stage II	11.54	6.38	4.48

Equations

$${\mathcal{P}}_{\text{VLM}}(r_i\mid {\text{q}}_t,{\text{q}}_v,r_1,\dots ,r_{i-1})$$

$${\text{ActMean}}^{\ell }(\mathcal{D})=\frac{1}{|\mathcal{D}|}\left[\sum _{t\in \mathcal{D}}{\mathbf{x}}^{\ell }(t)\right].$$

$${\mathbf{v}}_{{\mathcal{D}}_2\to {\mathcal{D}}_1}^{\ell }={\text{ActMean}}^{\ell }({\mathcal{D}}_1)-{\text{ActMean}}^{\ell }({\mathcal{D}}_2).$$

$$v^{\ell }=\sum _{j\in \mathcal{A}}{\alpha }_j{v}_j^{\ell },$$

$$v_j^{\ell }={\text{ActMean}}^{\ell }(\mathcal{D}j,\text{pos})-{\text{ActMean}}^{\ell }(\mathcal{D}j,\text{neg}),$$

$$\text{ratio}=\frac{{\pi }_{L+1}(r_T\mid a_{\ell }({\text{q}}_t,{\text{q}}_v)+v)}{{\pi }_{L+1}(r_T\mid a_{\ell }({\text{q}}_t,{\text{q}}_v))}-\frac{{\pi }_{L+1}(r_O\mid a_{\ell }({\text{q}}_t,{\text{q}}_v)+v)}{{\pi }_{L+1}(r_O\mid a_{\ell }({\text{q}}_t,{\text{q}}_v))},$$

$$R=R_{\text{detoxify}}(r)+R_{\text{visual}}({\text{q}}_v).$$

$$\displaystyle L_{\pi}=\min_{v}\,-\mathbb{E}_{(\textbf{q}_{t},\textbf{q}_{v},r_{T},r_{O})\sim\mathcal{D}}\bigg{[}\min\big{(}\text{ratio}\cdot A,\ \text{clip}(\text{ratio},1-\epsilon,1+\epsilon)\cdot A\big{)}\bigg{]}$$

$$L_{\text{total}}=L_{\pi }+c_1{L}_{\text{critic}},$$

Full text

1 Introduction

The advancement of Vision Language Models (VLMs) (Chen et al., 2023; Dai et al., 2023) marks a major breakthrough in AI, enabling the seamless integration of visual and textual information to enhance reasoning and understanding across diverse tasks. Despite their success, VLMs remain highly vulnerable to adversarial attacks, which exploit both visual and textual modalities to induce harmful responses. These concerns have led to growing research interest in jailbreak attacks and the development of corresponding defense strategies (Gong et al., 2025; Schlarmann and Hein, 2023; Wang et al., 2024g).

Activation steering has emerged as a promising defense, modifying internal representations via injected steering vectors without altering model weights (Wang et al., 2024c, d; Han et al., 2025; Cao et al., 2024). For example, Wang et al. (2024c) introduce InferAligner, which aligns hidden states with predefined safe directions at inference time. Recent extensions to multimodal settings, such as ASTRA (Wang et al., 2024a) and ShiftDC (Zou et al., 2025), further adapt steering vectors based on image attribution or disentangle harmful signals while preserving visual grounding. However, existing methods face key limitations. Steering vectors derived from contrastive prompts often fail to generalize across semantic contexts and attack types (Cao et al., 2024).

To address these issues, we propose Sequence-Level Preference Optimization for VLM (SPO-VLM), a novel two-stage defense framework that learns robust, generalizable steering vectors via SPO. Unlike prior work that extracts harmful directions from fixed prompt pairs, SPO-VLM optimizes steering vectors from diverse, preference-labeled data to achieve semantically aligned and safe generation. In Stage I, we compute lightweight and layer-specific steering vectors from multiple datasets, supporting inference-time mitigation with broad generalization. In Stage II, these vectors are refined using SPO within the RLHF framework (Ouyang et al., 2022) based on PPO, guided by multi-objective rewards that incorporate toxicity suppression (Hanu and Unitary team, 2020), and visual-text consistency. This two-stage formulation enhances both flexibility and robustness. By keeping the base VLM frozen, it reduces computational overhead and supports modular deployment. The use of sequence-level preference optimization allows the model to align with broader behavioral objectives beyond token-level control. Furthermore, the learned steering vectors demonstrate strong generalization to out-of-distribution inputs while preserving helpfulness and factual grounding in benign scenarios.

Our main contributions are as follows: (i) We propose SPO-VLM, a novel framework that unifies activation-level intervention with sequence-level preference optimization via RLHF and multi-objective reward signals. (ii) SPO-VLM significantly improves safety against jailbreak attacks by combining activation steering with sequence-level preference optimization, outperforming prior defenses like ASTRA across multiple datasets. (iii) The model retains strong performance on benign tasks, demonstrating that safety enhancements do not come at the cost of helpfulness or visual-language understanding capabilities.

2 Related Work

2.1 Jailbreak Attack on VLM

Jailbreak attacks manipulate prompts to deceive the model into responding to restricted or prohibited queries. In addition to LLM-based textual jailbreak strategies (Guo et al., 2024; Liu et al., 2024a; Yu et al., 2024a; Zou et al., 2023), the inclusion of visual inputs introduces a new attack surface for VLM attacks. There are two main types of attacks: perturbation-based attacks and structured-based attacks (Wang et al., 2024f). Perturbation-based attacks generate adversarial images designed to evade VLM safeguards (Carlini et al., 2023; Qi et al., 2023; Niu et al., 2024). For example, imgJP (Niu et al., 2024) optimizes an universal perturbation across unseen prompts and images to generate a targeted response. In contrast to perturbation-based methods, structure-based attacks transform harmful content into images using typography (Gong et al., 2025) or generative models to elicit harmful responses from the model (Gong et al., 2025; Li et al., 2025b). Specifically, FigStep (Gong et al., 2025) leverages the ability of VLMs to interpret textual instructions embedded within images by encoding harmful content directly into the visual modality. By pairing these adversarially crafted images with benign textual prompts, FigStep effectively manipulates the VLM, eliciting detailed and potentially harmful responses.

Our work primarily addresses the challenge of defending against such jailbreak attacks on VLMs. Instead of modifying model weights or relying on static filtering, we propose to construct optimized steering activations that adaptively mitigate harmful behaviors by shifting internal representations in safer directions.

2.2 Activation Steering

Activation steering refers to a set of alignment techniques that guide a model’s behavior by freezing model weights and modifying activations (Wang et al., 2024c, d; Han et al., 2025; Cao et al., 2024). Several studies have focused on identifying steering vectors within the activation space of specific layers in the LLM transformer architecture. Specifically, Wang et al. (2024c) proposes InferAligner, a novel inference-time alignment method that effectively improves model safety without compromising downstream performance. To address various categories of hallucinations, Wang et al. (2024d) proposes Adaptive Activation Steering (ACT), which leverages a diverse set of truthfulness-related steering vectors and dynamically adjusts the steering intensity based on the truthfulness of the model’s activations. Moreover, SafeSwitch (Han et al., 2025) incorporates a safety prober that continuously monitors the model’s internal states and responds appropriately by dynamically activating a specialized refusal head. This head provides informative explanations, ensuring the model’s responses remain helpful while prioritizing safety. However, these steering vectors are directly extracted from LLM activations using preference data pairs, often leading to inaccurate representations of target behavior. Cao et al. (2024) proposes bi-directional preference optimization (BiPO) to generate more effective steering vectors for personalized control over diverse model behaviors. BiPO allows steering vectors to directly influence the generation probabilities of contrastive human preference data pairs, providing a more accurate and fine-grained representation of the target behavior. Inspired by recent advances in activation steering for LLMs, a growing body of research now focuses on guiding model behavior through the construction and application of steering vectors (Wang et al., 2024a; Li et al., 2025a; Zou et al., 2025). Wang et al. (2024a) introduces ASTRA, a defense mechanism that adaptively steers models away from adversarial feature directions using image attribution activations to counter VLM attacks. By considering the projection between steering vectors and calibrated activations, their adaptive steering approach effectively mitigates harmful outputs under adversarial input while maintaining minimal performance degradation on benign inputs. ShiftDC (Zou et al., 2025) preserves the VLM’s vision understanding ability by disentangling and calibrating VLM activations to restore safety alignment.

Our work builds on these insights by framing the construction of steering vectors as a sequence-level optimization problem. Specifically, we adopt a reinforcement learning with preference supervision framework to learn behavior-aligned steering vectors, while incorporating textual modality consistency as part of the reward signal. This allows our approach to generate more robust and interpretable steering vectors that align with both safety objectives and multimodal grounding.

2.3 Preference Optimization

Reinforcement Learning from Human Feedback (RLHF) has become a widely adopted approach for aligning models with human preferences (Ouyang et al., 2022; Ziegler et al., 2020; Stiennon et al., 2022). The standard RLHF pipeline typically begins by training a reward model, often structured using frameworks like the Bradley-Terry model (Bradley and Terry, 1952), to reflect human preferences. This reward model guides reinforcement learning algorithms such as Proximal Policy Optimization (PPO) (Schulman et al., 2017), which are then used to fine-tune the language model to generate responses that maximize the learned reward. In the context of LLMs, RLHF is particularly instrumental in shaping models that are helpful, honest, and harmless, thereby aligning them with human values (Ouyang et al., 2022; Bai et al., 2022; Thoppilan et al., 2022). For example, LaMDA (Thoppilan et al., 2022) fine-tunes LLMs to engage in natural language dialogue that is engaging, informative, factually grounded, and safe, often incorporating external information to ensure accuracy and relevance. InstructGPT (Ouyang et al., 2022) fine-tunes GPT-3-style models (Brown et al., 2020) to enhance helpfulness, using reinforcement learning from human preferences expressed through pairwise comparisons. Askell et al. (2021) follow the pre-training and fine-tuning paradigm to train a preference model for human alignment, demonstrating that ranked preference modeling is a highly effective objective for distinguishing between “good” and “bad” behaviors. This approach is further enhanced through an iterative online training regime, in which preference models and reinforcement learning policies are updated weekly using fresh human feedback data. PPO is incorporated to stabilize the RL training process (Bai et al., 2022).

Building on this foundation, our work explores a novel application of preference optimization: instead of optimizing full model parameters, we use PPO-based preference signals to directly learn steering vectors in the model’s activation space. This approach enables more precise and interpretable alignment with desired behaviors, while preserving model generalization and avoiding catastrophic forgetting.

3 Preliminary

3.1 Vision Language Models

Let $\mathcal{P}_{\text{VLM}}$ denotes an autoregressive Vision Language Model, which defines a probability distribution over sequences of tokens drawn from a vocabulary $\mathcal{V}$. This model is designed to process and reason on both textual and visual modalities in a unified framework. Specifically, we consider a VLM that takes as input a sequence of $n$ textual tokens $\textbf{q}_{t}=\{q_{t_{1}},q_{t_{2}},\ldots,q_{t_{n}}\}$ and a sequence of $m$ visual tokens $\textbf{q}_{v}=\{q_{v_{1}},q_{v_{2}},\ldots,q_{v_{m}}\}$. These tokens are typically derived from natural language inputs and visual features, respectively, where the visual tokens are obtained through the discretization of image embeddings from a vision encoder.

Given the multimodal input $\{\textbf{q}_{t},\textbf{q}_{v}\}$, the model generates a response sequence $r=\{r_{1},r_{2},\ldots,r_{o}\}$, consisting of $o$ output tokens. The generation process is autoregressive, meaning that each token $r_{i}$ in the response is sampled sequentially, conditioned on all previous tokens in the input and the already generated part of the output. Formally, the probability of generating the $i^{\text{th}}$ token $r_{i}$ is given by:

[TABLE]

This formulation enables the model to incorporate both linguistic context and visual grounding when predicting each subsequent token. The response generation continues iteratively until a special end-of-sequence token is produced or a maximum sequence length is reached. Through this design, $\mathcal{P}_{\text{VLM}}$ enables coherent and contextually grounded text generation in response to complex multimodal inputs.

3.2 Steering Activations

Let $\mathbf{x}^{\ell}(t)$ denote the residual stream activation of the last token at layer $\ell\in L$ of a VLM, capturing the information processed from the input $t$ up to layer $\ell$. We define the function ActMean to compute the mean last-token activation at layer $\ell$ for a given dataset $\mathcal{D}$:

[TABLE]

Numerous studies (Arditi et al., 2024; Park et al., 2024) have demonstrated that high-level concepts are encoded as linear directions in the activation space of LLMs. These directions can be uncovered by computing the difference between the mean activations of a model when processing two sets of contrastive instructions, $\mathcal{D}_{1}$ and $\mathcal{D}_{2}$, which elicit distinct behaviors:

[TABLE]

The resulting vector, $\mathbf{v}^{\ell}_{\mathcal{D}_{2}\rightarrow\mathcal{D}_{1}}$, referred to as the difference-in-mean vector, captures both the direction and magnitude of the layer-$\ell$ activation shift from $\mathcal{D}_{2}$ to $\mathcal{D}_{1}$. This vector effectively isolates the critical features that drive the model’s behavioral differences between the two instruction sets.

4 Methodology

Our hybrid defense framework, SPO-VLM, consists of two complementary stages designed to enhance the safety of VLMs against adversarial prompts while preserving their utility. Specifically, the two stages are: (1) adaptive activation steering to suppress harmful internal activations, and (2) sequence-level preference optimization via reinforcement learning to reinforce safe and grounded generation.

Figure 1 illustrates the overall architecture of our proposed framework. Upon receiving an image-text input pair, the frozen VLM processes the input and produces intermediate activation representations. A steering vector, learned through sequence-level preference optimization, is subsequently applied to these activations to bias the model’s output toward safe and contextually appropriate responses. Notably, this intervention operates exclusively on the internal representations, leaving all model parameters unchanged throughout the process.

4.1 Stage I: Initialization of Steering Activation

Activation steering (Li et al., 2024; Subramani et al., 2022) aims to locate specific directions in the model’s activation space that align with factually accurate statements, and then adjusts the activations along those directions during inference to guide the model’s output. Expanding on this idea, our approach derives diverse steering vectors directly from raw data to effectively target a range of attack types. Moreover, we introduce adaptive steering construction based on the toxic content of the activations. Rather than relying on a single global direction, we propose an adaptive steering mechanism that constructs the final steering vector $v^{\ell}$ as a linear combination of multiple attribute-specific difference-in-mean vectors. The final steering vector $v^{\ell}$ at layer $\ell$ is formulated as a weighted combination of attribute-specific components:

[TABLE]

where $\mathcal{A}={1,2,\ldots,|\mathcal{A}|}$ denotes the set of attribute indices, $\alpha_{j}\in\mathbb{R}$ represents the weight coefficient for the $j$-th attribute, and each attribute-specific vector $v^{\ell}_{j}$ is computed as:

[TABLE]

where $\mathcal{D}{j,\text{pos}}$ and $\mathcal{D}{j,\text{neg}}$ represent the positive and negative instruction sets for attribute $j$, respectively. This formulation allows the steering mechanism to adaptively combine multiple behavioral dimensions, with each $v^{\ell}_{j}$ capturing the activation difference for a specific attribute at layer $\ell$.

4.2 Stage II: Sequence-level Preference Optimization

Inspired by preference-based model optimization techniques such as RLHF (Ouyang et al., 2022), we incorporate the activation steering obtained from Stage I into the rollout policy to guide the generation of safe and contextually grounded responses. The objective is to enable the model to effectively suppress harmful outputs in the presence of adversarial prompts, while maintaining strong visual understanding capabilities under benign conditions.

We introduce a method that learns effective steering vectors in activation space through sequence-level reinforcement learning with preference-based supervision. Our algorithm adopts a sequence-level variant of Proximal Policy Optimization (PPO) to fine-tune model behavior. Unlike traditional RLHF methods that operate at the token level, we directly optimize the log-probability of the full generated sequence, named Sequence-Level Preference Optimization for VLMs (SPO-VLM). This allows the model to favor outputs aligned with desired multi-objective behavior and reduce the probability of generating undesired or adversarial responses. The target behavior is defined via a multi-objective reward function, incorporating both safety and visual understanding capabilities. This reward guides learning in a way that balances safety with alignment to visual content.

To enable preference learning, we construct labeled quadruplets $(\textbf{q}_{t},\textbf{q}_{v},r_{T},r_{O})$, where $\textbf{q}_{t}$ is a texture prompt, $\textbf{q}_{v}$ is a visual prompt, $r_{T}$ is a response exhibiting the target behavior, and $r_{O}$ is a response reflecting the undesired behavior. Let $v$ denote the learnable steering vector, and $\pi_{L+1}$ represent the later layers of the model (from layer $L+1$ onward). For each prompt pair $(\textbf{q}_{t},\textbf{q}_{v})$, we generate responses using the current policy $\pi_{\theta}$. We compute the following policy ratios to assess the influence of the steering vector on the model’s preference between $r_{T}$ and $r_{O}$:

[TABLE]

The term $\pi_{L+1}(\cdot\mid a_{\ell}(\textbf{q}_{t},\textbf{q}_{v})+v)$ represents the policy induced by modifying the model’s activations with the steering vector $v$ at layer $\ell$. This difference quantifies the differential impact of the steering vector on preferred and dispreferred responses.

We employ a composite reward function that encourages both safety and visual grounding. Given a query and the model’s response $r$, the total reward is:

[TABLE]

The detoxification reward component penalizes toxic content using an exponential decay function: $R_{\text{detoxify}}(r)=2\cdot\left[\exp(-\beta\cdot\text{toxicity}(r))-0.5\right]$, where $\text{toxicity}(r)\in[0,1]$ is computed using a pre-trained toxicity classifier, and $\beta>0$ controls the penalty strength. This formulation yields rewards in the range $[-1,1]$, with non-toxic responses receiving positive rewards. The component of visual understanding reward measures alignment between visual content and captioning content: $R_{\text{visual}}(\textbf{q}_{v})=-\cos\left(\overline{\mathbb{I}},\overline{\mathbb{C}}\right)$, where $\overline{\mathbb{I}}$, $\overline{\mathbb{C}}$ are the mean-pooled hidden states of image and caption tokens respectively.

We adopt a sequence-level variant of Proximal Policy Optimization (PPO) (Schulman et al., 2017) to optimize the steering vector while maintaining training stability. The objective function is:

[TABLE]

where $A=R(r,\textbf{q}_{t},\textbf{q}_{v})-V_{\phi}(\textbf{q}_{t},\textbf{q}_{v})$ is the advantage function computed from the total reward and a learned value baseline $V_{\phi}(\textbf{q}_{t},\textbf{q}_{v})$. The clipping range $[1-\epsilon,1+\epsilon]$ ensures stable policy updates by preventing excessive deviations.

The final optimization objective combines PPO with critic function learning:

[TABLE]

where $L_{\text{critic}}$ denotes the critic loss, which is computed by a lightweight critic module integrated into the model. This critic is implemented as a simple two-layer multilayer perceptron that operates on the final-layer hidden states produced by the base model. By processing these high-level representations, the critic estimates a scalar value for each input, representing its expected utility or alignment with the target objective. The value predictions are then used to compute $L_{\text{critic}}$, guiding the optimization of the model’s preference-aware behavior in a sample-efficient manner. Unlike conventional RLHF, which requires training a new policy and a separate reference model, our method optimizes only the steering vector $v$, keeping the base model architecture and parameters fixed. As a result, the method is highly efficient and minimally invasive. When applied during inference, the learned vector reliably steers the model toward safer and more helpful behavior by modifying a narrow subset of internal representations.

5 Experiments

In this section, we evaluate SPO-VLM across three dimensions: its effectiveness in mitigating adversarial prompts while preserving visual understanding, its ability to transfer across diverse attack domains, and the contribution of each stage through ablation studies.

5.1 Experiment Setup

Steering Activation Construction. We initialize the steering vectors using the Stage I method applied to the RealToxicityPrompt, AdvBench, and Anthropic$\_$Harmful datasets. This approach extracts activation shifts across multiple toxicity dimensions and constructs an initial vector through a linear combination of these shifts. Specifically, we adopt the steering vector formulation from Wang et al. (2024a), expressed as $v^{\ell}=\sum_{j\in\mathcal{A}}\alpha_{j}v^{\ell}_{j}$, where $\alpha_{1}=0.5$, $\alpha_{2}=0.4$, and $\alpha_{3}=0.4$ denote the weights for each attribute-specific direction. The resulting vectors are further refined during Stage II via the SPO-VLM framework.

Evaluation Datasets. We evaluate our approach under three experimental settings: (1) Toxicity assessment, using the RealToxicityPrompts benchmark (Gehman et al., 2020); (2) Jailbreak detection, evaluating on two datasets: AdvBench (Zou et al., 2023) and Anthropic$\_$Harmful(Ganguli et al., 2022); and (3) Visual comprehension, using four benchmarks: MM-Vet(Yu et al., 2024b), SQA (Iyyer et al., 2017), CogVLM (Wang et al., 2024e), and MME (Fu et al., 2023).

Evaluation Metrics. For toxicity assessment, we employ the Detoxify classifier (Hanu and Unitary team, 2020) to compute toxicity scores on a scale from 0 (non-toxic) to 1 (highly toxic). For jailbreak detection, we quantify robustness using the attack success rate (ASR), defined as the proportion of successful jailbreaks among total attack attempts. This metric is computed using the classifier from HarmBench (Mazeika et al., 2024). For visual understanding evaluation, we employ task-specific utility metrics. MM-Vet uses GPT-4 with few-shot prompts to generate utility scores ranging from 0 to 1, while SQA calculates overall accuracy for its single-choice questions. For CogVLM, we compute the arithmetic mean of three metrics: BLEU-2, CIDEr, and METEOR. MME evaluates both perception and cognition capabilities across 14 subtasks.

Baselines. This study compare SPO-VLM against two baseline methods. The Original Model serves as the unmodified visual language model without additional safety mechanisms, providing a baseline for standard post-training alignment. ASTRA (Wang et al., 2024a) employs steering vectors generated from contrastive visual prompt pairs, representing a prominent activation-based steering approach. This comparative framework enables a comprehensive evaluation of SPO-VLM’s ability to enhance safety while maintaining helpfulness across different safety paradigms.

Models & Implementations details. This study conducts all experiments on three widely used open-source VLMs: Qwen2-VL-7B (Wang et al., 2024b), MiniGPT-4-13B (Zhu et al., 2023), and LLaVA-v1.5-13B (Liu et al., 2023). These models, post-trained to follow instructions and align with human values, represent some of the most widely adopted and capable open-source model families. We set the steering layer $l$ is 20 for 13B models and 14 for 7B models. The chat configurations use a temperature of 0.2 and $\alpha$ = 10 for LLaVA-v1.5-13B, a temperature of 0.2 and $\alpha$ = 7 for Qwen2-VL, and a temperature of 1.2 and $\alpha$ = 7 for MiniGPT-4-13B.

5.2 SPO-VLM Effectively Balances Safety and Visual Understanding

Table 1 summarizes the performance of our proposed SPO-VLM method with respect to both safety and visual understanding capability, evaluated across a diverse set of benchmarks. The results demonstrate that SPO-VLM consistently improves the model’s ability to resist harmful prompts while preserving or even enhancing its utility on some benign tasks. From these comprehensive evaluations, we draw several key conclusions as below.

SPO-VLM demonstrates enhanced safety performance. As shown in Table 1, SPO-VLM achieves superior safety performance. In the RealToxicityPrompt dataset, SPO-VLM achieves the lowest toxicity score, reducing it by more than 27.79% compared to the original model. Compared to ASTRA, SPO-VLM achieves an additional 11.55% reduction among all different models. It confirms that SPO-VLM provides more effective and consistent toxicity mitigation. Compared to ASTRA, SPO-VLM reduces the average ASR on AdvBench by approximately 1.28%, and cuts the average ASR on Anthropic$\_$Harmful nearly in half, achieving an additional reduction of around 4.77%. This demonstrates SPO-VLM’s superior generalization and effectiveness in mitigating jailbreak risks across diverse models.

SPO-VLM shows an optimal trade-off between safety and visual capability. While ASTRA improves safety, it leads to a notable decline in visual understanding performance. For instance, in MiniGPT, MM-Vet drops significantly from 32.58 to 17.70, and MME decreases by approximately 656 points. Similarly, in LLaVA, MM-Vet falls from 28.60 to 14.90. In contrast, SPO-VLM preserves visual capabilities far more effectively. For MiniGPT-4, the MM-Vet score remains high at 31.11, indicating only a modest reduction of approximately 1.5 points compared to the original model. In the case of Qwen2-VL-7B, SPO-VLM not only maintains but enhances visual understanding. For LLaVA, SPO-VLM consistently outperforms ASTRA across all visual benchmarks, notably raising the MM-Vet score from 14.90 to 20.19.

To highlight the superiority of SPO-VLM, we visualize the safety and visual understanding performance of different safety enhancement methods. Safety is measured as the mean of $(1-\mathrm{ASR})$ across AdvBench and Anthropic_Harmful, and visual understanding by average normalized scores on MM-Vet, SQA, CogVLM, and MME. As shown in Figure 2, ASTRA exhibits a clear trade-off between safety and accuracy. Although it significantly improves safety scores compared to the baseline models, this comes at the cost of a statistically significant decline—exceeding 10%—in visual grounding performance. In contrast, SPO-VLM occupies the upper-right region of the plot, indicating simultaneous improvements in both safety and visual understanding, and thus achieving a more balanced and optimal overall performance.

5.3 SPO-VLM’s Transfer Capabilities

To evaluate the transfer capabilities of SPO-VLM, we assess whether steering vectors derived from SPO-VLM can generalize across different types of attacks. Specifically, we evaluate the transferability of the defense against structure-based attacks from MM-SafetyBench (Liu et al., 2024b). As shown in Figure 3, SPO-VLM demonstrates consistently lower attack success rates compared to both the original model and the ASTRA defense across all evaluated models. Notably, SPO-VLM achieves substantial reductions in success rates for challenging combined attacks such as SD + OCR, indicating its robustness even under complex adversarial compositions. For example, on MiniGPT-4, SPO-VLM reduces the ASR by over 30% compared to the original model. These improvements highlight SPO-VLM’s ability to generalize beyond the specific attack types it was trained on, effectively mitigating threats in structure-based attack scenarios. This cross-attack resilience indicates that SPO-VLM is well-suited for deployment in dynamic, real-world environments, where encountering unseen adversarial strategies is common.

5.4 Ablation Study

We conduct an ablation study on Qwen2-VL-7B using the benchmark datasets summarized to assess the individual contributions of each stage in the SPO-VLM framework. Specifically, we evaluate the performance of Stage I, which applies activation steering alone, and compare it against the full implementation that incorporates Stage II, sequence-level preference optimization. As shown in Table 2, the results underscore the importance of sequence-level preference optimization in reinforcing safe behavior beyond the initial activation steering. While Stage I serves as a lightweight mitigation mechanism, the addition of Stage II yields substantial performance improvements by leveraging rich, reward-driven alignment signals during policy refinement.

6 Conclusion

In this paper, we propose SPO-VLM, a novel two-stage defense framework that enhances the safety of VLMs against adversarial attacks. The approach integrates lightweight steering vectors derived from diverse datasets in Stage I. In Stage II, these vectors are refined through sequence-level preference optimization using multi-objective rewards. Extensive evaluations across various VLMs show that SPO-VLM offers improved safety by reducing toxicity and jailbreak success rates, while generally maintaining visual understanding. We believe this work lays the foundation for future research on activation-space intervention and preference-driven alignment to ensure the trustworthy deployment of LLMs and VLMs.