Understanding and Mitigating Token-Pruning-Induced Vulnerabilities in VLMs
Token pruning can amplify jailbreak semantics in VLMs; Safety-Aware Pruning cuts attack success by up to 62%.
A safety evaluation of token pruning in vision-language models finds most strategies degrade safety as pruning ratios increase, while query-based compression can improve safety even at 99.8% pruning. The authors describe Pruning-Induced Malicious Amplification, where removing background tokens collapses attention onto retained malicious foreground anchors and amplifies jailbreak semantics. Their inference-time Safety-Aware Pruning method identifies those anchors, restores benign tokens, and reallocates attention, cutting attack success by up to 62% on three safety and four utility benchmarks without sacrificing efficiency.
- Most token-pruning strategies degrade safety as the ratio rises.
- Query-based compression can improve safety even at 99.8% pruning.
- Background removal focuses attention on malicious foreground anchors.
- Safety-Aware Pruning cuts attack success by up to 62%.
From the original article
1 min read at arxiv.orgToken-Pruning accelerates Vision-Language Models by removing redundant visual tokens, yet its safety implications remain underexplored. In this work, we present the first comprehensive safety evaluation of Token-Pruning mechanisms and find that: most pruning strategies significantly degrade safety as pruning ratios increase, whereas Query-based Compression shows the opposite, with extreme pruning (up to 99.
By Shuailong Wang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.