Principled Steering via Null-space Projection for Jailbreak Defense in Vision-Language Models

Xingyu Zhu; Beier Zhu; Shuo Wang; Junfeng Fang; Kesen Zhao; Hanwang Zhang; Xiangnan He

cs.CVMar 23, 2026

Principled Steering via Null-space Projection for Jailbreak Defense in Vision-Language Models

Authors: Xingyu Zhu, Beier Zhu, Shuo Wang, Junfeng Fang, Kesen Zhao, Hanwang Zhang, Xiangnan He

Organizations: MoE Key Lab of BIPC, University of Science and Technology of China · National University of Singapore · Nanyang Technological University

Abstract

As vision-language models (VLMs) are increasingly deployed in open-world scenarios, they can be easily induced by visual jailbreak attacks to generate harmful content, posing serious risks to model safety and trustworthy usage. Recent activation steering methods inject directional vectors into model activations during inference to induce refusal behaviors and have demonstrated effectiveness. However, a steering vector may both enhance refusal ability and cause over-refusal, thereby degrading model performance on benign inputs. Moreover, due to the lack of theoretical interpretability, these methods still suffer from limited robustness and effectiveness. To better balance safety and utility, we propose NullSteer, a null-space projected activation defense framework. Our method constructs refusal directions within model activations through a linear transformation: it maintains zero perturbation within the benign subspace while dynamically inducing refusal along potentially harmful directions, thereby theoretically achieving safety enhancement without impairing the model's general capabilities. Extensive experiments show that NullSteer significantly reduces harmful outputs under various jailbreak attacks (average ASR reduction over 15 percent on MiniGPT-4) while maintaining comparable performance to the original model on general benchmarks.

Figures & tables

Figure 1: Illustration of activation steering. Injecting a refusal vector into hidden states steers the model toward rejection behaviors, which mitigates harmful responses but can also lead to over-refusal on benign queries.

Figure 2: Overview of the proposed NullSteer framework. Given multimodal inputs, image and text embeddings are encoded and fed into the large language model. During inference, NullSteer applies activation steering within the null space of benign representations, ensuring that harmful activations are redirected toward refusal semantics while preserving benign behaviors.

Method		Toxicity (Perturbation-based) – Toxicity Score (%) $~\downarrow$				Jailbreak (Perturbation-based) – ASR (%) $~\downarrow$
Method		$\epsilon={16}/{255}$	$\epsilon={32}/{255}$	$\epsilon={64}/{255}$	unconstrained	$\epsilon={16}/{255}$	$\epsilon={32}/{255}$	$\epsilon={64}/{255}$	unconstrained
MiniGPT-4	Benign image	30.65	30.65	30.65	30.65	24.55	24.55	24.55	24.55
	w/o defense	39.73	48.52	54.70	52.12	44.55	47.27	49.09	53.64
	Self-reminder [ 60 ]	38.97	48.71	45.15	50.12	35.45	36.36	41.82	43.64
	JailGuard [ 63 ]	16.51	18.93	20.93	21.23	30.00	32.73	27.27	28.18
	ECSO [ 19 ]	34.59	32.42	38.54	42.86	40.91	42.73	29.09	37.27

Table 1: Defense comparisons across different VLMs. Lower values (

\downarrow

) indicate stronger robustness. Steering vectors for each

\epsilon

are derived from adversarial examples generated under the same perturbation level. The best results are highlighted in bold .

Methods		Benign Scenarios – Utility Score $~\uparrow$			Adversarial Scenarios – Perplexity $~\downarrow$
Methods		MM-Vet [ 62 ]	MMBench [ 32 ]	XSTest [ 46 ]	Toxicity (Perturbation-based)	Jailbreak (Perturbation-based)	Jailbreak (Structured-based)
MiniGPT-4	Vanilla	19.40	35.90	87.60	51.42	3.95	2.62
	ASTRA [ 52 ]	20.62	35.82	87.60	10.14	5.82	4.29
	NullSteer	21.05	36.25	87.80	9.52	2.58	3.65
LLaVA-v1.5	Vanilla	32.62	72.94	98.00	63.68	3.68	3.82
	ASTRA [ 52 ]	30.55	73.23	98.80	59.28	8.59	4.61

Table 2: Utility performance in benign and adversarial scenarios.

$\\|\tilde{\mathbf{\Delta}}\mathbf{P}\\|_{F}^{2}$	$\\|\tilde{\mathbf{\Delta}}\mathbf{P}\mathbf{H}_{m}-\mathbf{R}\\|_{F}^{2}$	$\\|\tilde{\mathbf{\Delta}}\mathbf{P}\mathbf{H}_{m}-\mathbf{V}\\|_{F}^{2}$	Toxicity Score $\downarrow$	Jailbreak (ASR) $\downarrow$	Utility Score $\uparrow$
✗	✗	✗	30.65	34.55	35.90
✓	✓	✗	3.58	8.36	36.00
✓	✗	✓	4.02	8.57	36.00
✓	✓	✓	2.89	7.32	36.25

Table 3: Ablation study of different objective components on Minigpt-4.

Panel of Figure 5 — Figure 5: Utility with varying numbers of benign activations $N_{b}$ . Evaluation is conducted on MM-VET and MMBench with MiniGPT-4 and LLaVA-v1.5 under theunconstrained.

Panel of Figure 6 — Figure 6: Safety with varying numbers of malicious activations $N_{m}$ . Evaluation is conducted on MiniGPT-4 under multiple perturbation levels.

Panel of Figure 7 — Figure 7: Effect of steering strength on MiniGPT-4. We vary $\lambda$ when applying activation steering under the $\epsilon\!=\!16/255$ perturbation setting and report Toxicity Score on the Toxicity attack, Jailbreak ASR on the Jailbreak attack, and utility on MM-Vet.

	MiniGPT-4	LLaVA-v1.5	Qwen2-VL	Avg.
w/o defense	173.19	40.68	27.43	63.67
Self-reminder [ 60 ]	173.36	41.09	27.94	53.38
JailGuard [ 3 ]	1557.98	366.02	245.42	40.92
ECSO [ 19 ]	457.55	116.44	70.22	53.75
ASTRA [ 52 ]	173.77	40.69	27.98	9.88
NullSteer	173.57	40.68	27.66	8.43

Table 4: Inference time per token (ms). Average decoding latency is computed and normalized by the number of generated tokens. Reporting time per token enables a fair comparison of inference efficiency across models with varying output lengths. Lower values indicate faster decoding.

Figure 8: Visualization of activation distributions.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Methods		Structured-based Attack			Perturbation-based Attack						Text-only Attack
		SD	SD_TYPO	TYPO	PGD [ 34 ]		Auto-PGD [ 7 ]		MI-FGSM [ 11 ]		GCG [ 72 ]
		SD	SD_TYPO	TYPO	$\epsilon=\tfrac{16}{255}$	$\epsilon=\tfrac{32}{255}$	$\epsilon=\tfrac{16}{255}$	$\epsilon=\tfrac{32}{255}$	$\epsilon=\tfrac{16}{255}$	$\epsilon=\tfrac{32}{255}$	GCG [ 72 ]
MiniGPT-4	w/o defense	13.75	43.25	43.75	70.91	78.18	74.55	76.36	78.18	79.09	58.18
	ASTRA	3.75	8.75	11.25	5.45	12.73	5.45	10.91	16.37	13.64	9.09
	NullSteer	2.35	6.28	11.57	3.28	9.43	4.65	9.42	14.21	12.71	8.24
Qwen2-VL	w/o defense	20.00	61.25	38.75	74.55	80.00	76.37	77.57	80.00	78.18	81.82

Appendix

Table E: Transferability performance under OOD conditions. Steering vectors are obtained from Jailbreak adversarial samples generated with

\epsilon=\tfrac{16}{255}

, using the same

\alpha

value determined on the Jailbreak validation split. Their generalization is assessed across unseen attack types, including structure-based attacks from MM-SafetyBench [ 31 ] , perturbation-based variants of PGD, and text-only attacks. The ASR is computed using the HarmBench [ 36 ] classifier.

Panel of Figure 13 — Figure I : Comparison of benign and malicious activation distributions across two VLMs.

Explore similar work

Apr 11, 2026

Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion

Large language models remain vulnerable to jailbreak attacks -- inputs designed to bypass safety mechanisms and elicit harmful responses -- despite advances in alignment and instruction tuning. We propose Head-Masked Nullspace Steering (HMNS), a circuit-level intervention that (i) identifies attention heads most causally responsible for a model's default behavior, (ii) suppresses their write paths via targeted column masking, and (iii) injects a perturbation constrained to the orthogonal complement of the muted subspace. HMNS operates in a closed-loop detection-intervention cycle, re-identifying causal heads and reapplying interventions across multiple decoding attempts. Across multiple jailbreak benchmarks, strong safety defenses, and widely used language models, HMNS attains state-of-the-art attack success rates with fewer queries than prior methods. Ablations confirm that nullspace-constrained injection, residual norm scaling, and iterative re-identification are key to its effectiveness. To our knowledge, this is the first jailbreak method to leverage geometry-aware, interpretability-informed interventions, highlighting a new paradigm for controlled model steering and adversarial safety circumvention.

Vishal Pramanik, Maisha Maliha, Susmit Jha +1

Department of Computer & Information Science & Engineering, University of Florida, Gainesville, FL 32611, USA · School of Computer Science, University of Oklahoma, Norman, OK 73019, USA · Computer Science Laboratory, SRI International, Menlo Park, CA 94025, USA

Adversarial Attacks on LLMs LLM Jailbreak Attacks LLM Safety Activation Steering Circuits in Language Models

Ask PDF

Mar 16, 2026

Directional Embedding Smoothing for Robust Vision Language Models

The safety and reliability of vision-language models (VLMs) are a crucial part of deploying trustworthy agentic AI systems. However, VLMs remain vulnerable to jailbreaking attacks that undermine their safety alignment to yield harmful outputs. In this work, we extend the Randomized Embedding Smoothing and Token Aggregation (RESTA) defense to VLMs and evaluate its performance against the JailBreakV-28K benchmark of multi-modal jailbreaking attacks. We find that RESTA is effective in reducing attack success rate over this diverse corpus of attacks, in particular, when employing directional embedding noise, where the injected noise is aligned with the original token embedding vectors. Our results demonstrate that RESTA can contribute to securing VLMs within agentic systems, as a lightweight, inference-time defense layer of an overall security framework.

Ye Wang, Jing Liu, Toshiaki Koike-Akino

Mitsubishi Electric Research Laboratories, Cambridge, MA 02139, USA

VLM Robustness Randomized Smoothing Adversarial Attacks on VLMs

Ask PDF

Mar 18, 2026

Understanding and Defending VLM Jailbreaks via Jailbreak-Related Representation Shift

Large vision-language models (VLMs) often exhibit weakened safety alignment with the integration of the visual modality. Even when text prompts contain explicit harmful intent, adding an image can substantially increase jailbreak success rates. In this paper, we observe that VLMs can clearly distinguish benign inputs from harmful ones in their representation space. Moreover, even among harmful inputs, jailbreak samples form a distinct internal state that is separable from refusal samples. These observations suggest that jailbreaks do not arise from a failure to recognize harmful intent. Instead, the visual modality shifts representations toward a specific jailbreak state, thereby leading to a failure to trigger refusal. To quantify this transition, we identify a jailbreak direction and define the jailbreak-related shift as the component of the image-induced representation shift along this direction. Our analysis shows that the jailbreak-related shift reliably characterizes jailbreak behavior, providing a unified explanation for diverse jailbreak scenarios. Finally, we propose a defense method that enhances VLM safety by removing the jailbreak-related shift (JRS-Rem) at inference time. Experiments show that JRS-Rem provides strong defense across multiple scenarios while preserving performance on benign tasks.

Zhihua Wei, Qiang Li, Jian Ruan +4

School of Computer Science and Technology, Tongji University · Shanghai Artificial Intelligence Laboratory

Adversarial Attacks on VLMs VLM Robustness Representation Engineering

Ask PDF