Principled Steering via Null-space Projection for Jailbreak Defense in Vision-Language Models

TL;DR

NullSteer is a novel null-space projection method that enhances vision-language model safety against visual jailbreaks by selectively inducing refusal in harmful directions without degrading benign performance.

Contribution

The paper introduces NullSteer, a theoretically grounded null-space projection framework that improves model safety against jailbreak attacks while preserving utility.

Findings

Reduces harmful outputs by over 15% on MiniGPT-4

Maintains comparable performance on general benchmarks

Provides theoretical interpretability for safety enhancement

Abstract

As vision-language models (VLMs) are increasingly deployed in open-world scenarios, they can be easily induced by visual jailbreak attacks to generate harmful content, posing serious risks to model safety and trustworthy usage. Recent activation steering methods inject directional vectors into model activations during inference to induce refusal behaviors and have demonstrated effectiveness. However, a steering vector may both enhance refusal ability and cause over-refusal, thereby degrading model performance on benign inputs. Moreover, due to the lack of theoretical interpretability, these methods still suffer from limited robustness and effectiveness. To better balance safety and utility, we propose NullSteer, a null-space projected activation defense framework. Our method constructs refusal directions within model activations through a linear transformation: it maintains zero perturbation within the benign subspace while dynamically inducing refusal along potentially harmful directions, thereby theoretically achieving safety enhancement without impairing the model's general capabilities. Extensive experiments show that NullSteer significantly reduces harmful outputs under various jailbreak attacks (average ASR reduction over 15 percent on MiniGPT-4) while maintaining comparable performance to the original model on general benchmarks.