Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoring

Summary

Representational Contrastive Scoring (RCS) detects jailbreak attempts against large vision-language models (LVLMs) by reading the model's own hidden activations. An LVLM answers questions about images and text, and a jailbreak is an input crafted to make it produce content its safety training should refuse. Detectors that model only benign inputs flag unfamiliar but harmless requests as attacks. RCS instead compares each input's distance to benign and to malicious examples in a learned, low-dimensional space, which reaches 98.6% AUROC on LLaVA at about 4 to 5.5% extra inference time.

Key numbers

• 98.6%AUROC of Mahalanobis Contrastive Detection (MCD) on LLaVA, on a benchmark with attack types held out of training
• 0.949 → 0.569Precision of the one-class JailDAM detector when unseen benign datasets are added, the over-rejection that RCS targets
• ≈4.0–5.5%Detection time added to the 0.6383 s LVLM forward pass by KCD (0.0260 s) and MCD (0.0355 s)

Method

LVLMs inherit text jailbreaks and add visual ones, such as adversarial images that push the model past its alignment ^[1]. Defenses that fine-tune the model or filter inputs tend to overfit known attacks, and defenses that run several inferences add heavy latency. A lightweight alternative is anomaly detection, which learns what benign inputs look like and flags the rest. JailDAM ^[2] follows that one-class design, and its weakness is that an unseen benign input, such as a medical image question, also lies outside the benign distribution.

RCS reads the hidden state at the last input token of a safety-relevant middle layer, before the model generates any output. A three-layer network projects the 4,096-dimensional state to 256 dimensions. It is trained with a dataset-clustering objective, which keeps samples from the same source together, and a separation objective, which pushes malicious sources away from benign ones, in the spirit of supervised contrastive learning ^[3]. The projection suppresses task-irrelevant variation, so unseen benign inputs stay geometrically distinct from malicious clusters.

The contrastive score is the distance to the nearest benign cluster minus the distance to the nearest malicious cluster, so a higher score means the input sits closer to attacks. Mahalanobis Contrastive Detection (MCD) models each dataset as a Gaussian and measures Mahalanobis distance, which accounts for the spread of each cluster. K-nearest Contrastive Detection (KCD) uses distances to the 50th nearest benign and malicious neighbors on the unit sphere and assumes no distribution. Both apply one threshold, calibrated on validation data held out from training.

Evaluation

The benchmark balances benign and malicious examples from text-only and multimodal sources and holds attack types out of training to test generalization. Hidden states come from LLaVA-v1.6-Vicuna-7B ^[4], Qwen2.5-VL-7B, and InternVL3-8B. A one-class detector degrades under distribution shift: when unseen benign datasets are added, JailDAM's AUROC falls from 0.913 to 0.706 and its precision from 0.949 to 0.569.

Adding a contrastive score to JailDAM raises its AUROC on LLaVA from 78.9% to 91.5%, which shows that modeling both distributions helps by itself. MCD reaches 98.6% AUROC on LLaVA, above the enhanced JailDAM, and KCD achieves lower false positive rates and higher F1. Results are means over 20 runs.

The cost is small. A standard LLaVA forward pass takes 0.6383 s. KCD adds 0.0260 s (about 4.0%), made of 0.0220 s for the projection and 0.0040 s for the nearest-neighbor search. MCD adds 0.0355 s (about 5.5%), made of 0.0278 s for the projection and 0.0077 s for the distance computation. These figures exclude autoregressive generation.

Limitations

RCS needs the protected model's internal representations. That is a deliberate choice for model serving, and it rules out detection of a model that is reachable only through an API. The projection network has about one million parameters and trains on 2,000 samples, and its results vary across random initializations. The authors expect more training data to reduce that variance but have not tested it. Hyperparameters such as k, the clustering strategy, and the projection settings also need some tuning.

The benchmark is a proof of concept with a balanced 1:1 split of benign and malicious inputs, whereas real traffic is mostly benign. A deployment would calibrate the threshold on validation data to hold the false positive rate below a target such as 1%. No detector removes false positives, and a flagged benign request costs a user a refusal. The paper does not benchmark streaming defense after decoding starts.

Citation

@inproceedings{hua2026rethinking,
    title = "Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoring",
    author = {Hua, Peichun and Li, Hao and Shi, Shanghao and Yu, Zhiyuan and Zhang, Ning},
    editor = {Liakata, Maria and Moreira, Viviane P. and Zhang, Jiajun and Jurgens, David},
    booktitle = "Proceedings of the 64th Annual Meeting of the {A}ssociation for {C}omputational {L}inguistics (Volume 1: Long Papers)",
    month = jul,
    year = "2026",
    address = "San Diego, California, United States",
    publisher = "Association for Computational Linguistics",
    url = "https://aclanthology.org/2026.acl-long.992/",
    pages = "21748--21785",
    ISBN = "979-8-89176-390-6",
}

References

1. Xiangyu Qi et al. Visual Adversarial Examples Jailbreak Aligned Large Language Models. AAAI, 2024. arxiv.org/abs/2306.13213
2. Yi Nian et al. JailDAM: Jailbreak Detection with Adaptive Memory for Vision-Language Model. arXiv, 2025. arxiv.org/abs/2504.03770
3. Prannay Khosla et al. Supervised Contrastive Learning. NeurIPS, 2020. arxiv.org/abs/2004.11362
4. Haotian Liu et al. Improved Baselines with Visual Instruction Tuning. CVPR, 2024. arxiv.org/abs/2310.03744