{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/hiddendetect-detecting-jailbreak-attacks","title":"HiddenDetect: Detecting Jailbreak Attacks against Large Vision-Language Models via Monitoring Hidden States","arxiv_id":"2502.14744","date":"2025-02-20","proceeding":null,"authors":["Yilei Jiang","Xinyan Gao","Tianshuo Peng","Yingshui Tan","Xiaoyong Zhu","Bo Zheng","Xiangyu Yue"],"abstract":"The integration of additional modalities increases the susceptibility of large vision-language models (LVLMs) to safety risks, such as jailbreak attacks, compared to their language-only counterparts. While existing research primarily focuses on post-hoc alignment techniques, the underlying safety mechanisms within LVLMs remain largely unexplored. In this work , we investigate whether LVLMs inherently encode safety-relevant signals within their internal activations during inference. Our findings reveal that LVLMs exhibit distinct activation patterns when processing unsafe prompts, which can be leveraged to detect and mitigate adversarial inputs without requiring extensive fine-tuning. Building on this insight, we introduce HiddenDetect, a novel tuning-free framework that harnesses internal model activations to enhance safety. Experimental results show that {HiddenDetect} surpasses state-of-the-art methods in detecting jailbreak attacks against LVLMs. By utilizing intrinsic safety-aware patterns, our method provides an efficient and scalable solution for strengthening LVLM robustness against multimodal threats. Our code will be released publicly at https://github.com/leigest519/HiddenDetect.","url_abs":"https://arxiv.org/abs/2502.14744v3","url_pdf":"https://arxiv.org/pdf/2502.14744v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"hiddendetect-detecting-jailbreak-attacks","repo_url":"https://github.com/leigest519/hiddendetect","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2502.14744","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2502.14744"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/leigest519/hiddendetect","reach":null}],"summary":{"ran_draft_wrong":3},"by_repo_kind":{"official":{"samples":3,"ran":3,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":3,"samples":[{"code_sha256_prefix":"517cc8b23eaa2596","entry":"load_XSTest","repo":"leigest519/hiddendetect","repo_kind":"official","path":"code/load_datasets.py","file_url":"https://github.com/leigest519/hiddendetect/blob/HEAD/code/load_datasets.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"517cc8b23eaa2596"}},{"code_sha256_prefix":"7de76bd070dd2b82","entry":"load_mm_safety_bench","repo":"leigest519/hiddendetect","repo_kind":"official","path":"code/load_datasets.py","file_url":"https://github.com/leigest519/hiddendetect/blob/HEAD/code/load_datasets.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7de76bd070dd2b82"}},{"code_sha256_prefix":"7edd29028d16d9d1","entry":"load_mm_vet","repo":"leigest519/hiddendetect","repo_kind":"official","path":"code/load_datasets.py","file_url":"https://github.com/leigest519/hiddendetect/blob/HEAD/code/load_datasets.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7edd29028d16d9d1"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}