Understanding and Mitigating Token-Pruning-Induced Vulnerabilities in VLMs
The paper studies how visual token pruning affects the safety of vision-language models, showing that common pruning methods can make jailbreaks worse as pruning gets more aggressive, while query-based compression surprisingly improves safety even at extreme pruning ratios. Its key insight is the “pruning-induced malicious amplification” mechanism—pruning away benign/background tokens can concentrate attention on a few malicious foreground anchors—and it proposes a plug-and-play inference-time fix, Safety-Aware Pruning, though the claims seem limited to the evaluated pruning schemes, benchmarks, and threat settings rather than proving a general safety guarantee.
Abstract
Token-Pruning accelerates Vision-Language Models by removing redundant visual tokens, yet its safety implications remain underexplored. In this work, we present the first comprehensive safety evaluation of Token-Pruning mechanisms and find that: most pruning strategies significantly degrade safety as pruning ratios increase, whereas Query-based Compression shows the opposite, with extreme pruning (up to 99.8%), unexpectedly improves model safety. This sharp contrast prompts a key question: How do different Token-Pruning strategies reshape model safety behavior, and is it possible to enhance safety without sacrificing acceleration? To answer this, we identify an unrecognized mechanism, termed Pruning-Induced Malicious Amplification, where removal of background tokens triggers a side effect: forcing the model's attention to collapse onto a few retained malicious anchors within the foreground, inadvertently amplifying their toxic semantics under jailbreak. To address that, we propose an inference-time and plug-and-play Safety-Aware Pruning (SAP) mechanism that counteracts such dominance via three steps: (1) identifying malicious anchors, (2) restoring pruned benign tokens, and (3) reallocating excessive attention from malicious anchors to benign tokens. Extensive experiments across three safety and four utility benchmarks demonstrate that SAP mitigates pruning-induced vulnerabilities, i.e., reducing ASR by up to 62%, without compromising efficiency or utility.