Dictionary-Aligned Concept Control for Safeguarding Multimodal LLMs

1. Problem Statement

Multimodal Large Language Models (MLLMs) are increasingly vulnerable to malicious queries (jailbreaks) involving adversarial text or images, leading to unsafe, toxic, or policy-violating outputs. Existing safety mechanisms face significant limitations:

• Prompt Engineering: Often brittle, easily bypassed by evolving attack patterns, and can lead to overly defensive or permissive behavior.
• Response Filtering: Requires re-running queries, adding computational overhead and latency.
• Fine-tuning: Expensive and requires retraining for every new task or safety requirement.
• Activation Steering Limitations: Current steering methods for MLLMs often suffer from:
  • Narrow Scope: Relying on a small set of hand-crafted concept vectors (e.g., <20 concepts), limiting coverage.
  • Calibration Difficulty: Struggling to balance safety suppression with the preservation of general-purpose utility.
  • Lack of Semantic Grounding: Sparse Autoencoders (SAEs) offer powerful control but lack automatic, interpretable semantic labeling of their latent atoms without costly manual probing.

2. Methodology: Dictionary-Aligned Concept Control (DACO)

DACO is a framework designed to provide granular, interpretable control over MLLM activations at inference time without retraining the base model. It integrates a curated concept dictionary with Sparse Autoencoders (SAEs).

A. Concept Dictionary Curation (DACO-400K)

• Source: The authors constructed a dataset named DACO-400K containing over 15,000 unique multimodal concepts derived from WordNet.
• Retrieval: For each concept, they retrieved over 400,000 caption-image pairs from the CC-3M dataset.
• Scoring: They used CLIP embeddings to compute a geometric aggregation of text-text and text-image similarities to select high-relevance positive stimuli and low-relevance negative stimuli.
• Vector Extraction: By running a frozen MLLM on these stimuli, they extracted residual stream activations and computed concept vectors via contrastive representation reading (difference between positive and negative stimulus activations).
• Partitioning: An expert MLLM rated these concepts as "Desirable" (harmless) or "Undesirable" (harmful) to partition the dictionary.

B. Two-Stage Control Mechanism

The framework operates in two modes:

1. Training-Free Sparse Coding (Multimodal Oblique Projection - MOP):

   • The curated dictionary is used to decompose the model's activation vector into a linear combination of concept vectors using an Elastic Net solver.
   • Undesirable concepts are identified and subtracted from the activation vector to steer the model toward safety.

2. SAE Training and Automatic Annotation:

   • Initialization: The authors initialize the decoder weights of a Sparse Autoencoder (SAE) using the normalized vectors from the curated concept dictionary. This guides the SAE to learn features aligned with human-interpretable concepts.
   • Training: The SAE is trained on MLLM activations to reconstruct inputs with sparse codes.
   • Automatic Annotation: Instead of manual probing, the authors annotate SAE atoms by measuring their distance to the centroids of the "Desirable" and "Undesirable" concept clusters in the dictionary. Atoms close to the "Undesirable" centroid are flagged for suppression; those close to "Desirable" are flagged for amplification.
   • Inference Steering: During generation, the SAE encodes the activation, and the coefficients of undesirable atoms are zeroed out (or suppressed), while desirable atoms are amplified.

3. Key Contributions

1. DACO-400K Dataset: A large-scale, curated dataset of 15,000 multimodal concepts and 400,000 associated stimuli, enabling broad coverage of safety-relevant concepts.
2. Dictionary-Aligned SAE Training: A novel method to initialize SAEs with a concept dictionary, significantly improving the interpretability and performance of the learned features without manual annotation.
3. Automatic Semantic Grounding: A mechanism to automatically label SAE atoms as safe or unsafe based on their proximity to curated concept clusters, solving the "black box" problem of SAEs.
4. Granular Control: A steering approach that allows for fine-grained manipulation of specific concepts (e.g., suppressing "violence" while preserving "aggression" in a non-harmful context) while maintaining model fluency.

4. Experimental Results

The framework was evaluated on three diverse MLLMs (Qwen2.5-VL, LLaVA, InternVL) across multiple safety benchmarks (MM-SafetyBench, JailBreakV-28K) and utility benchmarks (MMMU, Fluency, PPL).

• Safety Performance: DACO significantly outperformed baselines (No Steering, Prompting, ActAdd, MOP).
  • On JailBreakV-28K, DACO achieved a safety score of 0.903 (vs. 0.564 for No Steering on Qwen2.5-VL).
  • It demonstrated robustness against various attack types, including text-driven jailbreaks and visual triggers.
• Utility Preservation: Unlike many safety methods that degrade model performance, DACO maintained high general-purpose capabilities.
  • MMMU Accuracy: DACO preserved or slightly improved accuracy compared to the base model (e.g., 0.521 vs. 0.546 for Qwen2.5-VL, outperforming ActAdd which dropped to 0.441).
  • Fluency & PPL: DACO showed better perplexity and fluency scores than other steering methods, indicating less disruption to natural language generation.
• Over-Refusal: DACO exhibited low over-refusal rates on the MOSSBench benchmark, successfully answering benign queries that trigger safety guardrails in other models (e.g., queries about "smoking" in a travel brochure context).
• Efficiency: The intervention adds only ~14.6% overhead per token, which is significantly more efficient than Oblique Projection (MOP) and acceptable for real-time applications.

5. Significance

• Interpretability: DACO bridges the gap between abstract latent space manipulation and human-understandable concepts. By aligning SAE atoms with a curated dictionary, it provides a transparent view of what is being edited in the model's reasoning process.
• Scalability: The approach moves beyond small, hand-crafted concept sets to a scalable, data-driven dictionary, making it adaptable to new safety domains.
• Practicality: It offers a "plug-and-play" solution for safeguarding frozen MLLMs without the computational cost of fine-tuning, making it viable for deployment in resource-constrained or rapidly evolving safety environments.
• Future Direction: The paper suggests that this dictionary-aligned approach could be extended to other modalities and control tasks, potentially serving as a foundation for more transparent and controllable AI systems.

In conclusion, DACO represents a significant advancement in MLLM safety by combining the interpretability of concept dictionaries with the efficiency of sparse autoencoders, achieving state-of-the-art safety performance while preserving the model's general utility.