VLMShield: Efficient and Robust Defense of Vision-Language Models against Malicious Prompts

Peigui Qi; Kunsheng Tang; Yanpu Yu; Jialin Wu; Yide Song; Wenbo Zhou; Zhicong Huang; Cheng Hong

cs.LGApr 7, 2026

VLMShield: Efficient and Robust Defense of Vision-Language Models against Malicious Prompts

Authors: Peigui Qi, Kunsheng Tang, Yanpu Yu, Jialin Wu, Yide Song, Wenbo Zhou, Zhicong Huang, Cheng Hong,

Organizations: University of Science and Technology of China · Ant Group · University of Washington

Abstract

Vision-Language Models (VLMs) face significant safety vulnerabilities from malicious prompt attacks due to weakened alignment during visual integration. Existing defenses suffer from efficiency and robustness. To address these challenges, we first propose the Multimodal Aggregated Feature Extraction (MAFE) framework that enables CLIP to handle long text and fuse multimodal information into unified representations. Through empirical analysis of MAFE-extracted features, we discover distinct distributional patterns between benign and malicious prompts. Building upon this finding, we develop VLMShield, a lightweight safety detector that efficiently identifies multimodal malicious attacks as a plug-and-play solution. Extensive experiments demonstrate superior performance across multiple dimensions, including robustness, efficiency, and utility. Through our work, we hope to pave the way for more secure multimodal AI deployment. Code is available at this https URL.

Figures & tables

Figure 1: Prompt Examples of benign, direct malicious, and jailbreak attacks against VLMs.

Figure 2: Overview of the CLIP-based MAFE framework for processing multimodal prompts through progressive text aggregation and cross-modal feature fusion.

Figure 3: Distribution of MAFE -extracted features showing clear separation between benign prompts ( green ) and malicious attacks ( red , blue , and orange ) in t-SNE visualizations. The PCA visualization result in Appendix A.1 .

	Benign	Image Jailbreak	Text Jailbreak	Direct malicious
Benign	0.000	0.866	0.906	0.746
Image Jailbreak	0.866	0.000	1.000	0.870
Text-based Jailbreak	0.906	1.000	0.000	0.879
Direct malicious	0.746	0.870	0.879	0.000

Table 1: MMD values between feature distributions of different prompt categories extracted using the MAFE framework. Higher values indicate greater distributional separation.

Figure 4: (a) Defense workflow using VLMShield : multimodal inputs first undergo MAFE feature extraction, then VLMShield performs safety detection to either block malicious prompts or forward benign ones to VLMs, and (b) detailed architecture and training pipeline of VLMShield .

		ASR% $\downarrow$ (LLaVA-1.5-13B)
Method		Image-based Jailbreak			Text-based Jailbreak		Direct Malicious
		IND	OOD		IND	OOD	OOD
		JailbreakV_28K	FigStep	HADES	JailbreakV_28K	AdvBench-M	MM-SafetyBench	VLSafe
Internal Defense	VLMGuard	16.37	13.83	22.95	9.26	9.84	12.90	15.27
Internal Defense	ASTRA	5.21	7.33	14.86	3.88	13.48	8.62	8.03
External Defense	JailGuard	22.05	20.30	38.33	26.33	40.02	36.22	72.43

Table 2: [RQ1] ASR on in-domain (JailbreakV_28K) and out-of-domain test datasets using the LLaVA-1.5-13B model. Lower values indicate better defense performance. Best results are shown in bold .

		ACC% $\uparrow$
Method		LLaVA-1.5-13B				Qwen2.5-VL-7B-Instruct
		IOD		OOD		IOD		OOD
		GPT4V-Caption	CC3M	MM-Vet	MMBench	GPT4V-Caption	CC3M	MM-Vet	MMBench
Internal Defense	VLMGuard	95.24	96.00	95.00	96.92	97.33	98.20	96.08	98.00
Internal Defense	ASTRA	96.15	98.03	93.54	97.66	97.74	98.46	95.80	94.64
External Defense	JailGuard	95.09	96.14	89.45	91.25	97.36	98.80	94.38	95.00

Table 3: [RQ2] ACC on benign multimodal benchmarks. Higher values indicate better preservation of legitimate functionality. Best results are shown in bold .

	Time (s) $\downarrow$
Method	LLaVA-1.5-13B		Qwen2.5-VL-7B-Instruct
	Detection	Total	Detection	Total
VLMGuard	2.33	10.35	1.95	5.81
ASTRA	2.07	10.09	1.62	5.58
JailGuard	291.48	299.50	208.05	211.91
CIDER	1.42	9.44	1.42	5.28

Table 4: [RQ3] Computational efficiency comparison showing detection time and total processing time. Total time includes VLM generation time, averaging 8.02s for LLaVA and 3.86s for Qwen.

Attack Type	$\lambda$	ASR% $\downarrow$	HGR% $\downarrow$	Effective ASR% $\downarrow$
Text-based	0.00	1.12	100.00	1.12
	0.50	2.82	50.20	1.41
	1.00	4.47	18.09	0.81
Image-based	0.00	0.98	100.00	0.98
	0.50	3.21	42.62	1.37
	1.00	5.04	13.17	0.66

Table 5: [RQ5] Optimization-based adaptive attacks targeting MAFE representations, where Effective ASR = ASR

\times

HGR.

Chunk Size	ASR% $\downarrow$	HGR% $\downarrow$	Effective ASR% $\downarrow$
5.00	0.48	100.00	0.48
10.00	0.83	94.20	0.78
20.00	1.12	80.72	0.90
50.00	4.97	62.70	3.12
100.00	8.73	43.80	3.82

Table 6: [RQ5] Dilution attacks exploiting MAFE ’s aggregation mechanism, where Effective ASR = ASR

\times

HGR.

Appendix figures & tables23 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Comprehensive distributional analysis of MAFE -extracted features showing clear separation between benign prompts ( green ) and malicious attacks ( red , blue , orange ) across PCA with density estimation (left) and t-SNE visualization (right).

Figure 6: Distributional analysis without long text processing showing poor separation between prompt categories due to information loss from text truncation.

Figure 7: Distributional analysis with text-only processing showing incomplete separation patterns due to missing visual information, particularly affecting detection of image-based attacks.

Figure 8: Distributional analysis with image-only processing showing inadequate separation due to missing textual information, particularly affecting detection of text-based jailbreak attacks.

Figure 9: Cross-category distributional analysis comparing three feature extraction approaches. Only MAFE (right) achieves clear separation between benign (green) and malicious categories (red, blue, orange) while maintaining distinct attack-type clustering. Traditional features (left) show complete category intermixing, while VLM representations (middle) achieve only partial separation.

Figure 10: Within-category analysis for image-based jailbreak datasets. MAFE (right) demonstrates semantic convergence where three datasets employing different visual attack techniques cluster together. Traditional features (left) scatter randomly while VLM representations (middle) show fragmented grouping, highlighting MAFE ’s superior ability to capture attack semantics beyond dataset artifacts.

Figure 11: Within-category analysis for text-based jailbreak datasets. MAFE (right) achieves unified clustering despite different manipulation strategies, demonstrating semantic understanding. Traditional and VLM-based features fail to recognize shared malicious intent across datasets.

Figure 12: Within-category analysis for direct malicious datasets. MAFE (right) demonstrates convergence across evaluation benchmarks with clear benign-malicious separation, while alternative approaches show inconsistent patterns.

		ASR% $\downarrow$ (Qwen2.5-VL-7B-Instruct)
Method		Image-based Jailbreak			Text-based Jailbreak		Direct Malicious
		IND	OOD		IND	OOD	OOD
		JailbreakV_28K	FigStep	HADES	JailbreakV_28K	AdvBench-M	MM-SafetyBench	VLSafe
Internal Defense	VLMGuard	11.82	9.46	13.96	5.72	8.66	9.05	10.32
Internal Defense	ASTRA	2.14	1.80	7.83	1.72	6.33	4.12	3.70
External Defense	JailGuard	14.00	13.82	21.04	16.18	27.49	24.35	31.35

Appendix

Table 7: ASR on in-domain (JailbreakV_28K) and out-of-domain test datasets using the Qwen2.5-VL-7B-Instruct model. Lower values indicate better defense performance. Best results are shown in bold .

		FNR% $\downarrow$ (JailbreakV_28K)
Method		LLaVA-1.5-13B		Qwen2.5-VL-7B-Instruct
		Image-based	Text-based	Image-based	Text-based
Internal Defense	VLMGuard	16.37	9.26	11.82	5.72
Internal Defense	ASTRA	5.21	3.88	2.14	1.72
External Defense	JailGuard	22.05	26.33	14.00	16.18
	CIDER	37.20	48.53	37.20	48.53

Appendix

Table 8: FNR on the JailbreakV_28K test dataset. Lower values indicate better defense performance. Best results are shown in bold .

		FNR% $\downarrow$ (LLaVA-1.5-13B)
Method		Image-based Jailbreak		Text-based Jailbreak	Direct Malicious
		FigStep	HADES	AdvBench-M	MM-SafetyBench	VLSafe
Internal Defense	VLMGuard	13.83	22.95	9.84	12.90	15.27
Internal Defense	ASTRA	7.33	14.86	13.48	8.62	8.03
External Defense	JailGuard	20.30	38.33	40.02	36.22	72.43
	CIDER	40.03	51.86	61.30	46.91	50.00

Appendix

Table 9: FNR on out-of-domain datasets using the LLaVA-1.5-13B model.

		FNR% $\downarrow$ (Qwen2.5-VL-7B-Instruct)
Method		Image-based Jailbreak		Text-based Jailbreak	Direct Malicious
		FigStep	HADES	AdvBench-M	MM-SafetyBench	VLSafe
Internal Defense	VLMGuard	9.46	13.96	8.66	9.05	10.32
Internal Defense	ASTRA	1.80	7.83	6.33	4.12	3.70
External Defense	JailGuard	13.82	21.04	27.49	24.35	31.35
	CIDER	40.03	51.86	61.30	46.91	50.00

Appendix

Table 10: FNR on out-of-domain datasets using the Qwen2.5-VL-7B-Instruct model.

		FPR% $\downarrow$
Method		LLaVA-1.5-13B				Qwen2.5-VL-7B-Instruct
		IOD		OOD		IOD		OOD
		GPT4V -Caption	CC3M	MM-Vet	MMBench	GPT4V -Caption	CC3M	MM-Vet	MMBench
Internal Defense	VLMGuard	4.76	4.00	5.00	3.08	2.67	1.80	3.92	2.00
Internal Defense	ASTRA	3.85	1.97	6.46	2.34	2.26	1.54	4.20	5.36
External Defense	JailGuard	4.91	3.86	10.55	8.75	2.64	1.20	5.62	5.00

Appendix

Table 11: FPR on benign multimodal benchmarks. Higher values indicate better preservation of legitimate functionality. Best results are shown in bold .

Chunk Size	Overlap	Benign ACC(%) $\uparrow$	Malicious ASR(%) $\downarrow$	Detection Time(s) $\downarrow$
50.00	10.00	96.33	0.00	0.37
75.00	10.00	96.33	0.00	0.34

Appendix

Table 12: Chunk size ablation results on MM-Vet and text_based_jailbreak_28K datasets. The 75-token configuration achieves optimal efficiency while maintaining identical detection performance.

Chunk Size	Overlap	Benign ACC(%) $\uparrow$	Malicious ASR(%) $\downarrow$	Detection Time(s) $\downarrow$
75.00	0.00	96.28	0.47	0.30
75.00	5.00	96.30	0.36	0.33
75.00	10.00	96.33	0.00	0.34
75.00	20.00	96.36	0.00	0.47

Appendix

Table 13: Overlap size ablation results. The 10-token overlap provides optimal balance between semantic continuity and computational efficiency.

Aggregation Method	Benign ACC(%) $\uparrow$	Malicious ASR(%) $\downarrow$	MMD $\uparrow$
Simple Average	96.30	1.46	0.692
MAX-Pooling	94.29	5.39	0.507
Similarity-weighted (Ours)	96.33	0.00	0.835

Appendix

Table 14: Text aggregation method comparison. Similarity-weighted aggregation achieves superior performance with highest feature separability (MMD).

CLIP Backbone	Benign ACC(%) $\uparrow$	Malicious ASR(%) $\downarrow$	Detection Time(s) $\downarrow$
ViT-L/14	96.33	0.00	0.34
ViT-H/14	97.04	0.00	0.57
SigLIP-L	95.17	3.05	0.35

Appendix

Table 15: CLIP backbone comparison across different architectures. ViT-L/14 provides the best efficiency-performance trade-off for practical deployment.

Threshold	Benign ACC(%) $\uparrow$	Malicious ASR(%) $\downarrow$
0.3	100.00	10.04
0.4	99.34	5.27
0.5	96.33	0.00
0.6	90.46	0.00
0.7	83.84	0.00

Appendix

Table 16: Detection threshold analysis on MM-Vet (benign) and MM-SafetyBench (malicious) datasets. Threshold 0.5 achieves optimal balance between benign utility and attack defense.

Figure 13: Representative false positive cases.

Figure 14: Attention evolution of the EOS token across CLIP text encoder layers. The EOS token progressively concentrates attention from uniform distribution (early layers) to semantically salient tokens like “bigger,” “garage,” and “living room” (deep layers), while the SOS token maintains self-attention throughout. This demonstrates EOS token’s semantic aggregation property.

Dataset	Type	Top-1 aggregator Ratio(%) $\uparrow$
MM-Vet	[EOS] token	100.00
Jailbreak_28K	[EOS] token	100.00

Appendix

Table 17: Top-1 aggregator ratio for [EOS] token.

Figure 15: Attention evolution of the CLS token across CLIP vision encoder layers. The CLS token shifts from uniform spatial attention (early layers) to focused attention on discriminative regions corresponding to the garage and living room (deep layers). Image patches are grouped into 4×4 spatial regions for visualization clarity, with one representative patch per region shown.

Dataset	Type	Top-1 aggregator Ratio(%) $\uparrow$
MM-Vet	[CLS] token	100.00
Jailbreak_28K	[CLS] token	100.00

Appendix

Table 18: Top-1 aggregator ratio for [CLS] token.

VLM Safety

See all 29 papers

VLMGuard: Bootstrapping Malicious Prompt Detectors from Unlabeled Vision-Language Prompts in the Wild
Oct 1, 2024Junlin Fang, Wenyu Chen, Reshmi Ghosh +7VLM Robustness Vision-Language Models
College of Computing and Data Science Nanyang Technological University · School of Physical and Mathematical Sciences Nanyang Technological University · Microsoft Corp. +1
GuardAlign: Test-time Safety Alignment in Multimodal Large Language Models
Feb 27, 2026Xingyu Zhu, Beier Zhu, Junfeng Fang +4VLM Safety Alignment VLM Safety
MoE Key Lab of BIPC, University of Science and Technology of China · Nanyang Technological University · National University of Singapore +1
Breaking the weakest link to evade vision language models
Aug 19, 2026Ilan Zini, Boussad Addad, Katarzyna KapustaVLM Robustness Adversarial Attacks on VLMs
ESILV student and Thales intern · Thales, Thales cortAIx Labs, France

Oct 1, 2024J/K move · Enter open · S save

VLMGuard: Bootstrapping Malicious Prompt Detectors from Unlabeled Vision-Language Prompts in the Wild

Junlin Fang, Wenyu Chen, Reshmi Ghosh, Robert Sim+6

College of Computing and Data Science Nanyang Technological University · School of Physical and Mathematical Sciences Nanyang Technological University · Microsoft Corp.+1

VLM Robustness Vision-Language Models

Open paper AskPDF arXiv

Vision-language Models (VLMs) are essential for contextual understanding of both visual and textual information. However, their vulnerability to adversarially manipulated inputs presents significant risks, leading to compromised outputs and raising concerns about the reliability in VLM-integrated applications. Detecting these malicious prompts is thus crucial for maintaining trust in VLM generations. A major challenge in developing a safeguarding prompt classifier is the lack of a large amount of labeled benign and malicious data. To address the issue, we introduce VLMGuard, a novel learning framework that leverages the unlabeled user prompts in the wild for malicious prompt detection. These unlabeled prompts, which naturally arise when VLMs are deployed in the open world, consist of both benign and malicious information. To harness the unlabeled data, we present an automated maliciousness estimation score for distinguishing between benign and malicious samples within this unlabeled mixture, thereby enabling the training of a binary prompt classifier on top. Notably, our framework does not require extra human annotations and is robust to realistic prompt variations, offering strong flexibility and practicality for real-world applications. Extensive experiments show that VLMGuard achieves superior detection results, improving AUROC by 5.39% on average over the state-of-the-art method. Disclaimer: This paper may contain offensive examples; reader discretion is advised. Code is available at: https://github.com/radiolab-ntu/vlmguard.

Abstract

VLM Safety

Explore similar work

VLMGuard: Bootstrapping Malicious Prompt Detectors from Unlabeled Vision-Language Prompts in the Wild

GuardAlign: Test-time Safety Alignment in Multimodal Large Language Models

Breaking the weakest link to evade vision language models