💻 computer science

SafeNexus: Discovering and Steering Modality-Universal Safety Neurons in MLLMs

The paper introduces SafeNexus, a cross-modal safety alignment framework that identifies and steers modality-universal safety neurons through targeted suppression and activation amplification to robustly defend multimodal large language models against diverse cross-modal threats while preserving utility.

Original authors: Jian Yu, Fei Shen, Cong Wang, Jian Wang, Lu Jin. Xiaoyu Du, Jinhui Tang, Tat-Seng Chua

Published 2026-08-03

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Jian Yu, Fei Shen, Cong Wang, Jian Wang, Lu Jin. Xiaoyu Du, Jinhui Tang, Tat-Seng Chua

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling library where books can talk back to you. For a long time, these talking books were just text, like a very smart chatbot. But recently, they've evolved into "Multimodal Large Language Models" (MLLMs). Think of these as super-librarians who can now read text, look at pictures, and listen to audio all at once. They are incredibly helpful, but this new superpower comes with a catch: it opens up new ways for troublemakers to trick them. Just as a security guard at a museum might know how to spot a fake painting but fail to notice a fake sound recording, these AI models often have safety guards that only work for one type of input. If you try to trick them with a picture instead of words, or a sound clip instead of a sentence, the guards might miss the danger entirely. The big question researchers are asking is: How do we build a safety system that works no matter how the troublemaker tries to sneak in?

This is where a new study called SafeNexus steps in. The researchers, a team from universities in China and Singapore, decided to stop looking at the AI's safety from the outside and instead went on a treasure hunt inside the AI's "brain." They discovered that the AI's ability to say "no" to bad requests isn't scattered randomly; it's actually controlled by a tiny, special group of internal switches called neurons.

Here's the fun part: The team found that while different types of inputs (like text, images, or audio) use different parts of the brain to process information, there is a secret, shared club of neurons that acts as the ultimate "danger detector" for all of them. They call these the US-Neurons (Modality-Universal Safety Neurons). It's like finding out that whether you are trying to sneak a knife, a bomb, or a fake ID past security, there is one specific, tiny security camera in the hallway that spots all of them. If you turn that camera off, the whole building becomes unsafe, no matter what the intruder is carrying.

The paper suggests that previous methods tried to patch safety holes by retraining the whole AI or adding external filters, which is like hiring a new security guard for every single door. SafeNexus takes a different approach: it finds those few critical "danger detector" neurons and gives them a superpower boost. The team tested two ways to do this:

The Amplifier: During the AI's thinking process, they simply turned up the volume on those specific neurons, making them shout "DANGER!" louder and faster.
The Calibrator: They gave those specific neurons a tiny, targeted tune-up (using a method called LoRA) so they became naturally better at spotting trouble, without needing to retrain the entire AI.

The results were impressive. When they tested this on models like Qwen and VITA, they found that boosting these few neurons made the AI much better at refusing harmful requests, whether the request came as text, a picture, or a sound. Crucially, they found that this didn't make the AI "dumb" or overly cautious. It didn't start refusing harmless questions (like "how do I bake a cake?"), and it didn't forget how to do its other jobs. In fact, in some tests, the new method was far better at stopping attacks than the current best methods, all while changing less than 0.05% of the AI's total brain power.

The researchers also showed that this trick works even on things they didn't explicitly train on, like video. Even though they never showed the AI video clips during their "tuning" phase, the boosted neurons were still good at spotting danger in video attacks. This suggests they really found a core, universal safety mechanism rather than just memorizing specific examples.

In short, SafeNexus suggests that we don't need to rebuild the AI's entire safety system to make it safe across all formats. Instead, we just need to find the few tiny, universal "brakes" inside the machine and make sure they are working at full strength. It's a bit like realizing that to stop a car from speeding, you don't need to replace the whole engine; you just need to make sure the brake pedal is connected firmly to the wheels.

Technical Summary: SafeNexus

Problem Statement

While Large Language Models (LLMs) have demonstrated robust safety performance, their evolution into Multimodal Large Language Models (MLLMs) has exposed a significant gap between expanded multimodal capabilities and existing safety mechanisms. Current defense strategies are predominantly confined to specific modal settings (e.g., image-only or text-only defenses), rendering them inadequate against sophisticated cross-modal attacks where adversaries exploit interactions between text, images, and audio to bypass safeguards. Furthermore, existing cross-modal defense approaches often treat the internal safety mechanisms as a "black box" or rely on computationally expensive training-based alignment that risks catastrophic forgetting of general capabilities. There is a critical lack of understanding regarding the intrinsic internal mechanisms governing safety behaviors across diverse modalities.

Methodology: SafeNexus

The paper proposes SafeNexus, a cross-modal safety alignment framework that adopts a neuron-level "locate-then-reinforce" intervention strategy. The methodology proceeds in three primary stages:

1. Neuron Localization and Identification

The authors formulate a paradigm to identify functionally specialized neurons by characterizing intermediate-layer activation patterns.

Importance Scoring: Neurons are defined as individual row vectors within the Feed-Forward Network (FFN) up-projection or gate-projection matrices. Their contribution is quantified by aggregating activation magnitudes over a probing corpus and integrating them with the down-projection direction to derive an output-aware importance score.
Modality-Bound Safety Neurons (BS-Neurons): Using contrastive datasets comprising harmful (jailbreak) and benign queries for specific modalities (Text, Image, Audio), the authors identify neurons that are highly active during harmful responses but not during benign ones. These are termed BS-Neurons ( $BS^c$ ).
Modality-Universal Safety Neurons (US-Neurons): By intersecting the BS-Neuron sets identified across different modalities ( $US = BS^T \cap BS^I \cap BS^A$ ), the authors isolate a compact shared subset of neurons. These US-Neurons are hypothesized to govern overarching multimodal safety regardless of the input modality.

2. Validation via Targeted Suppression

The authors validate the critical role of these neurons through targeted suppression (masking) experiments:

BS-Neuron Validation: Masking modality-specific BS-Neurons causes a significant degradation in safety performance (measured by Attack Success Rate, ASR) within that specific modality, while random neuron masking has negligible effects.
US-Neuron Validation: Masking the shared US-Neurons leads to a pronounced deterioration in defensive performance across all diverse multimodal input settings (e.g., text-only, text-image, text-audio), confirming their role as a core safety anchor. Crucially, this suppression does not substantially degrade the model's general utility.

3. Safety Alignment Strategies

Based on the discovery that reinforcing US-Neurons enhances safety, SafeNexus proposes two distinct intervention strategies:

Activation-Level Safety Amplifier: A training-free approach that directly scales the activation magnitudes of US-Neurons during inference by a manually specified coefficient $\alpha$ . This amplifies the safety signal without updating model parameters.
Safety Neuron Calibrator: A targeted fine-tuning approach using Low-Rank Adaptation (LoRA). Unlike standard LoRA which updates all parameters, this method constrains the trainable updates exclusively to the US-Neurons (approximately 0.05% of the backbone parameters). This selectively calibrates the neurons to enhance safety alignment while preserving general capabilities and avoiding catastrophic forgetting.

Key Contributions

Discovery of Safety Subspaces: The paper identifies and validates the existence of BS-Neurons (modality-bound) and US-Neurons (modality-universal), revealing that multimodal safety in MLLMs is predominantly governed by a highly compact, shared subset of neurons.
Efficient Alignment Strategies: The authors propose two efficient strategies—the Activation-Level Safety Amplifier and the Safety Neuron Calibrator—that significantly enhance model robustness against harmful multimodal inputs.
Empirical Superiority: Extensive experiments demonstrate that SafeNexus achieves state-of-the-art performance across diverse multimodal safety benchmarks (including Omni-Safe, HarmBench, and JALM) while effectively preserving general model utility and avoiding over-conservative refusal behaviors.

Experimental Results

The authors evaluated SafeNexus on three open-source MLLMs (Qwen2.5-Omni, VITA, and MiniCPM-o) across various modality combinations (Text, Image, Audio, and their combinations).

Safety Performance: SafeNexus outperforms prevailing state-of-the-art methods (including training-based approaches like SPA-VL and inference-time interventions like ECSO and Immune). For instance, on the MiniCPM model with Text+Image+Audio inputs, the calibrator strategy reduced the ASR by over 60%, significantly outperforming baselines.
Utility Preservation: The method maintains high accuracy on general capability benchmarks (OmniBench, AV-Odyssey), showing negligible degradation compared to the vanilla models.
Over-Refusal: The approach avoids the side effect of over-refusing benign requests, with refusal rate increases on benign prompts remaining below 3%, whereas other methods (e.g., SARSteer) showed increases of ~18%.
Zero-Shot Transfer: The method demonstrated zero-shot generalizability to the video modality without any video data being used during the probing or reinforcement stages, reducing ASR on video-related benchmarks.
Parameter Efficiency: The Safety Neuron Calibrator updates less than 0.05% of the model parameters, achieving superior safety alignment compared to full-parameter fine-tuning or random-neuron tuning.

Significance

The paper claims that SafeNexus addresses the critical limitation of current safety mechanisms being confined to fixed-modal settings. By revealing that cross-modal safety is governed by a shared, compact subset of neurons, the work provides a mechanistic understanding of how MLLMs process safety across heterogeneous inputs. The proposed "locate-then-reinforce" strategy offers a highly efficient, interpretable, and robust solution for aligning MLLMs, proving that targeted intervention at the neuron level can effectively neutralize cross-modal threats without compromising the model's general utility or requiring expensive retraining.