SALLIE: Safeguarding Against Latent Language & Image Exploits

1. Problem Statement

Large Language Models (LLMs) and Vision-Language Models (VLMs) are increasingly vulnerable to adversarial inputs, specifically Jailbreak (JB) attacks (bypassing safety alignment) and Prompt Injection (PI) attacks (commandeering models via untrusted data). While text-based defenses exist, they face critical limitations in the multimodal era:

• Modality Blindness: Text-focused detectors (e.g., PIShield, EEG-Defender) fail to detect malicious intents embedded within images.
• Performance Degradation: Existing multimodal defenses often rely on computationally expensive input transformations (e.g., paraphrasing, mutation) or require multiple model queries, leading to high latency and reduced utility.
• The "Visual Gap": Current state-of-the-art defenses, including proprietary judges (e.g., Gemini-2.5-Flash-Lite), show a significant drop in performance when moving from text to visual inputs. For instance, HiddenDetect achieves an F1 score of only 0.11 on visual prompt injections.
• Need for Efficiency: There is a lack of a unified, lightweight defense that handles both text and visual threats in a single forward pass without architectural modifications.

2. Methodology: SALLIE Framework

The authors propose SALLIE (Safeguarding Against Latent Language & Image Exploits), a lightweight runtime detection framework grounded in mechanistic interpretability. Instead of analyzing outputs or mutating inputs, SALLIE probes the model's internal residual stream activations during inference.

Core Architecture

SALLIE operates as a plug-in layer on top of any pre-trained VLM ($M$) with $L$ transformer layers. It consists of three stages:

1. Hidden State Extraction:

   • During a single forward pass, SALLIE extracts the residual stream activations ($h^{(l)}$) of the last token at each layer $l$.
   • It treats these activations as a "compressed fingerprint" of the model's internal safety state.

2. Layer-wise Classification (k-NN):

   • Dimensionality Reduction: Optionally applies PCA to reduce noise ($c_m$ components).
   • Classifier: Trains a k-Nearest Neighbors (k-NN) classifier for each layer using cosine similarity as the distance metric.
   • Hypothesis: The authors posit that malicious inputs form distinct local neighborhoods in the hidden-state space, separable from benign inputs.

3. Layer Ensemble & Decision:

   • Scoring: Calculates a maliciousness score $p^{(l)}$ for each layer based on the fraction of malicious neighbors.
   • Aggregation: Aggregates scores across a specific range of layers ($L_m$) to produce a final score $\bar{p}$.
   • Thresholding: Applies a modality-specific threshold ($\tau_m$) to classify the input as Benign or Malicious.

Key Design Features

• Unified Pipeline: The same architecture handles text-only and multimodal (image + text) inputs without structural changes.
• Modality-Specific Tuning: Hyperparameters ($k$, $c$, $L$, $\tau$) are tuned independently for text and visual modalities to account for distinct activation patterns.
• Efficiency: Requires only one forward pass, no autoregressive decoding, no input mutation, and no external API calls.

3. Experimental Setup

• Models: Evaluated on three open-weight, aligned VLMs:
  • Gemma-3-4b-it (4B params)
  • Phi-3.5-vision-instruct (4.2B params)
  • SmolVLM2-2.2B-Instruct (2.2B params)
• Datasets: A heterogeneous collection spanning >10 datasets, covering four threat categories:
  • Textual/Visual Jailbreaks
  • Textual/Visual Prompt Injections
  • Benign samples from diverse instruction-following and VQA benchmarks.
• Baselines: Compared against surface-level defenses (Perplexity Filter, JailGuard), internal-state text defenses (EEG-Defender, PIShield), multimodal defenses (HiddenDetect, OMNIGUARD), and proprietary judges (Gemini-2.5-Flash-Lite, GPT-4.1 Mini).

4. Key Results

SALLIE demonstrates state-of-the-art performance among open-weight methods, often surpassing closed-source proprietary judges.

• Overall Performance:
  • SALLIE (Gemma-3-4b-it) achieved an F1 of 0.90, outperforming all open baselines and surpassing Gemini-2.5-Flash-Lite (F1 = 0.82).
  • SALLIE (Phi-3.5-vision-instruct) achieved an F1 of 0.96 on visual inputs, significantly outperforming GPT-4.1 Mini (F1 = 0.85) and all other baselines.
• Bridging the Visual Gap:
  • While text-only baselines (e.g., Perplexity Filter) failed entirely on visual inputs, and multimodal baselines like HiddenDetect struggled (F1 = 0.11 on visual PI), SALLIE maintained high precision (>94%) and recall across both modalities.
• Geometric Insights:
  • PCA projections of hidden states revealed that visual attacks form more separable clusters from benign inputs than textual attacks do. This suggests that internal-state probing is particularly effective for multimodal threats because visual adversarial signals are geometrically distinct in the residual stream.
• Efficiency:
  • Unlike JailGuard, which incurs an 8× computational overhead due to input mutation and multiple queries, SALLIE operates in a single forward pass with negligible latency.

5. Significance and Contributions

1. Unified Defense: SALLIE is the first framework to effectively handle both jailbreaks and prompt injections across text and vision in a single, unified pipeline without architectural changes.
2. Mechanistic Interpretability in Practice: It operationalizes the theory that safety-relevant behaviors are encoded in specific geometric directions within hidden states, proving that lightweight classifiers (k-NN) can detect these perturbations effectively.
3. Solving the Visual Prompt Injection Gap: By achieving an F1 of 0.96 on visual inputs, SALLIE addresses a critical vulnerability where existing defenses (including proprietary models) fail.
4. Deployment Viability: The framework is lightweight, requires no retraining of the base model, and avoids the high latency of mutation-based defenses, making it suitable for real-world, low-latency deployment.

6. Limitations & Future Work

• Model Dependency: Performance varies by model architecture; smaller models with less extensive safety alignment (e.g., SmolVLM2) showed lower recall, suggesting a correlation between safety training depth and geometric separability.
• Context Length: Currently handles inputs up to ~1000 words; future work is needed for streaming or sliding-window approaches for longer contexts.
• Generalization: While robust, the threshold-based nature means performance depends on calibration against specific benign distributions; generalization to truly novel, unseen attack distributions remains a challenge.

In conclusion, SALLIE represents a paradigm shift from surface-level input filtering to internal-state monitoring, offering a highly efficient, accurate, and unified solution for securing multimodal AI systems against evolving adversarial threats.