Enhancing the Safety of Medical Vision-Language Models by Synthetic Demonstrations

1. Problem Statement

Generative Medical Vision-Language Models (Med-VLMs) are increasingly used for clinical decision support, image analysis, and report generation. However, they face two critical safety challenges:

• Vulnerability to Harmful Queries: Med-VLMs can be manipulated via jailbreak attacks (both visual and textual) to provide instructions for unethical or illegal activities, such as insurance fraud, faking illnesses, or misusing medical data.
• The Over-Defense Dilemma: Existing safety mechanisms often lead to over-defense, where the model excessively rejects benign, legitimate clinical queries to avoid potential risks. This degrades the model's utility in real-world medical settings.
• Data Scarcity: Creating high-quality, safety-aligned training datasets for Med-VLMs is difficult and expensive due to the need for specialized medical expertise, making traditional fine-tuning approaches impractical.

2. Methodology

The authors propose a novel inference-time defense strategy that leverages In-Context Learning (ICL) using Synthetic Demonstrations. This approach requires no model fine-tuning or parameter updates.

A. Synthetic Demonstration Generation

To overcome the lack of human-labeled safety data, the authors generate synthetic demonstrations using Large Language Models (LLMs):

• Benign-Affirmative (B-A) Demonstrations: Generated using a safety-aligned LLM (e.g., GPT-4o). These consist of benign clinical questions paired with helpful, medically accurate affirmative answers.
• Harmful-Refusal (H-R) Demonstrations: Generated by prompting an unaligned LLM (e.g., WizardLM-13B) to create harmful/unethical queries, which are then paired with refusal responses curated from aligned LLMs or safety templates.
• Scope: Demonstrations are synthesized across nine medical imaging modalities (e.g., CT, MRI, X-ray, Dermoscopy) and various anatomical regions.

B. Mixed Demonstration Strategy (In-Context Learning)

Instead of using only H-R demonstrations (which causes over-defense) or only B-A demonstrations (which offers weak safety), the authors introduce a Mixed Demonstration strategy.

• Construction: A context prompt $c_m$ is constructed by interleaving H-R and B-A demonstrations.
• Mixing Ratio ($\alpha$): The proportion of H-R demonstrations is controlled by a hyperparameter $\alpha = \frac{n_h}{n_h + n_b}$, where $n_h$ and $n_b$ are the counts of harmful and benign demonstrations, respectively.
• Mechanism: During inference, the Med-VLM receives the input query and image along with this mixed context. The model learns to mimic the refusal patterns for harmful inputs while maintaining affirmative capabilities for benign inputs.

C. Attack Evaluation

The method is evaluated against:

• Textual Jailbreaks: Greedy Coordinate Gradient (GCG) and template-based attacks (AIM, Refusal Suppression).
• Visual Jailbreaks: Projected Gradient Descent (PGD) adding imperceptible noise to medical images.

3. Key Contributions

1. Synthetic Data Pipeline: A scalable method to generate high-quality, multimodal safety alignment data without human medical experts, addressing the data scarcity bottleneck.
2. Inference-Time Defense: A lightweight, modular defense strategy using ICL that works on existing Med-VLMs (e.g., Llava-Med) without fine-tuning.
3. Mitigation of Over-Defense: The introduction of the Mixed Demonstration Strategy effectively balances safety and utility. The authors demonstrate that increasing the demonstration budget alleviates over-defense, and mixing B-A/H-R examples optimizes this trade-off under few-shot constraints.
4. Mechanism Analysis: The paper provides an ablation study showing that H-R demonstrations alter the loss landscape, making optimization-based jailbreak attacks (like PGD) significantly harder to succeed.

4. Experimental Results

Experiments were conducted on the O2M benchmark using Llava-Med-v1 and Llava-Med-v1.5.

• Defense Performance (ASR):
  • H-R demonstrations significantly reduced the Attack Success Rate (ASR). For Llava-Med-v1, ASR dropped from 72.58% (baseline) to 17.88% with just 2 demonstrations ($n=2$).
  • The mixed strategy maintained low ASR even under visual and textual jailbreak attacks.
• Over-Defense (RR):
  • Pure H-R demonstrations caused high Refusal Rates (RR) for benign queries (e.g., jumping from 2.12% to 30.56% at $n=2$ for Llava-Med-v1), confirming the over-defense issue.
  • Mixed Strategy: By tuning $\alpha$, the authors achieved a Pareto-optimal trade-off. For instance, a specific mix ratio reduced ASR while keeping RR close to baseline levels, effectively solving the over-defense problem in few-shot scenarios.
• Ablation on Mixing Order:
  • Random mixing (Mix 3) was found to be the most balanced strategy.
  • Placing B-A before H-R (Mix 2) minimized ASR but maximized over-defense (high RR).
  • Placing H-R before B-A (Mix 1) minimized over-defense but failed to block attacks (high ASR).
• Loss Landscape Analysis: The presence of H-R demonstrations increased the loss for PGD attacks, indicating that the model's internal representation becomes more robust against adversarial perturbations.

5. Significance and Conclusion

This paper addresses a critical gap in the safety of generative AI for healthcare. By proving that synthetic demonstrations can effectively steer Med-VLMs toward safe behavior without expensive fine-tuning, the authors provide a practical solution for deploying these models in clinical settings.

The Mixed Demonstration Strategy is particularly significant as it resolves the tension between security (rejecting harmful queries) and utility (answering benign queries), a common failure point in current safety alignment methods. The work suggests that future medical AI safety can rely on dynamic, context-aware prompting rather than static model retraining, offering a path toward more robust and reliable clinical decision support systems.