Why should multimodal safety evaluation measure controllability beyond classification?

Classification answers detection, not internal control

Most VLM safety guardrails are evaluated through input- or output-level classification: given an image-text input, does the model or a guardrail label it unsafe? The paper treats this as necessary for deployment but insufficient as a description of the model. A correct behavioral label does not show whether a safety state is recoverable from a stated internal representation, whether that signal is genuinely cross-modal, or whether editing a candidate internal handle changes the signal without degrading benign behavior.

The authors frame the gap with two complementary views. Output classification measures whether harmful behavior is detected. Controllability evaluation additionally asks whether candidate internal handles can be localized, intervened on, and validated without broad degradation on benign inputs. Their position is that these axes should be reported separately rather than treating detection as evidence of control.

Four separated axes of a controllability profile

The proposed profile separates four things that a single safety score would blur together. Representation-level detectability asks whether a safety state can be read out from an internal representation. Cross-modal specificity asks whether that signal depends on the image-text combination rather than a unimodal shortcut. Intervention sensitivity asks how a declared target changes as candidate handles are edited. Benign-preserving selectivity asks whether the same edit leaves benign behavior intact.

Keeping these axes apart matters because they can come apart empirically. A model can have a strong representation-level readout while lacking a selective-control regime, which is exactly the divergence the case study reports. The paper also notes that controllability is an evaluation axis, not a safety certificate: a model may expose handles for some harmful trajectories while still failing on others.

Implicit toxicity as a stress case

The case study uses implicit toxicity as a diagnostic stress case, not as the only VLM safety concern. The authors chose it because the failure depends on an image-text interaction: harm can arise from inputs that appear benign in isolation, which makes the gap between recognizing harm and controlling its internal signal especially visible.

The dataset work reorganizes MDIT-Bench into three explicit classes: explicit, implicit, and benign. A random split provides 178,682 training and 76,578 validation samples for in-domain experiments, while a group-holdout split provides 177,588 training and 77,672 validation samples for out-of-distribution sensitivity tests. For HoliSafe, SSS maps to benign and {SSU, USU, UUU, SUU} map to unsafe, with unsafe labels post-processed into explicit toxic ({SUU, USU, UUU}) and implicit toxic ({SSU}).

How internal handles were localized and tested

The method trains a TopK sparse autoencoder on mean-pooled layer-24 hidden states. With a 4096-dimensional hidden vector, the SAE uses 16,384 latent coordinates and retains 128 active coordinates. Layer 24 was chosen because the authors empirically found it to represent the multimodal integration point just before the output head, making it the optimal intervention site for preventing generated toxicity.

To isolate image-text interaction rather than unimodal cues, the authors compute an ANOVA-style scalar residual for each SAE feature: the feature's activation on the original multimodal input minus its activation on visual-only and text-only counterfactuals, plus the benign mean. They aggregate interaction strength over implicit toxicity samples, rank all latents, and retain 512 candidates. For latent intervention experiments they further restrict candidates to coordinates consumed by the SAE-latent classifier, calling this the classifier-aware interaction feature set.

Three internal metrics anchor the tests. The pooled-hidden MLP probability p_h(c) is used as a text-dominance diagnostic, the proxy-residual MLP probability p_r(c) as a hidden-space interaction diagnostic, and the SAE-latent classifier probability p_z(c) for latent intervention validation. Output-level safety is measured by ASR_SSU, the fraction of SSU cases judged unsafe after generation, and RR_SSS, the failure rate on SSS cases expected to be safe.

LlavaGuard exposes a narrow selective handle

LlavaGuard's interaction features are strongly separated. Its top-1 interaction score is 42.54 for feature #15926, the top-10 mean score is 32.53, and the bottom-128 mean score is effectively zero. Under deletion and insertion interventions measured by p_z, the baseline implicit probability of 87.3% drops to 0.0% once just 5% of features are modified, while insertion rises from a 9.4% baseline to 87.3% at 50%.

The clamp sweep shows why rank alone is not enough. Clamping the single top feature collapses benign samples to the explicit class, with p_z(benign) at 0.0% and p_z(explicit) at 100.0%. Clamps of k=4 and k=8 give the cleanest operating range under the tested p_z metrics, with p_z(benign) at 99.4% and 100.0% respectively, while larger clamps again induce collapse.

Behavioral handle ablation identifies a validated single-feature handle. Zeroing feature #1519 suppresses the implicit signal by 0.873 while preserving p_z(benign) at 1.000 and producing no benign-to-implicit misfire. The global top-1 interaction feature #15926 is not read by the p_z classifier, and ablating it has no measurable effect. Geometry alone does not select the handle: the validated #1519 has a cosine overlap of 0.833 with the benign mean, while #8180 has a low overlap of 0.129 and collapses benign samples when ablated alone.

Qwen3.5 reads out but does not selectively control

Qwen3.5 shows a weaker but still real interaction structure. Its top-1 interaction score is 6.19 for feature #12827, the top-10 mean is 4.14, and the bottom-128 mean is below 0.001. Its deletion curve is also less complete: modifying 5% of features lowers p_z(implicit) to 12.3%, and the curve plateaus at 69.4% from 20% modification onward, rather than reaching zero.

The decisive difference is selectivity. In the clamp sweep, k=1 through k=4 keep p_z(benign) between 80.2% and 82.6%, but k=8 drops benign to 12.3% and raises implicit-on-benign to 58.6%. In behavioral ablation, no single-feature or small-set handle simultaneously suppresses p_z(implicit) and preserves p_z(benign). The SAE top-1 attribution changes the implicit signal by -0.001, the top-10 mean projection suppresses it by 0.514 but leaves p_z(benign) at 0.015 with a 0.985 benign-to-implicit misfire, and the raw mean-diff direction behaves similarly. The paper concludes that no validated handle was identified for Qwen3.5 under the tested operators.

Why readout and controllability can diverge

The empirical lesson the authors draw is that behavioral safety classification and representation-level detectability do not determine whether a signal is genuinely multimodal or selectively controllable. Both models support useful safety readouts, but they expose different profiles, and a benchmark reporting only behavioral accuracy or probe accuracy would miss that distinction.

The paper's explanation for the divergence is model-dependent operating ranges rather than a single global property of safety signals. LlavaGuard admits localized handles with a narrow benign-preserving intervention range and modest downstream safety gains. Qwen3.5 supports strong representation-level readout but no comparable selective-control regime under the tested operators. The authors also report that geometric overlap with the benign mean direction is not a reliable predictor of behavioral selectivity: low cosine overlap does not guarantee a safe handle, and high cosine overlap does not necessarily imply benign collapse.

What a benchmark should report instead

The paper recommends three measurements alongside standard output metrics. Modality counterfactuals should test whether a representation-level safety signal depends on the image-text combination rather than a unimodal shortcut. Intervention response curves should report how a declared target changes as candidate handles are edited, rather than presenting a single attribution or probe score. Benign-side response curves should be measured under the same edits so that intervention sensitivity is not mistaken for selective control. Generation-level safety metrics remain a separate downstream validation layer.

The profile in its current form primarily targets model developers, model providers, and auditors with authorized white-box access. It is not directly applicable to API-only systems unless providers expose standardized diagnostic hooks or equivalent internal interfaces. The intervention evidence is also operator-specific: a handle that responds to deletion, insertion, or projection is not a global causal certificate, and the result is conditioned on the tested model, layer, feature basis, operator, and data regime.

The practical priority this paper sets is therefore not to replace behavioral safety metrics but to stop treating them as evidence of internal control. The most decision-relevant comparison is between models like LlavaGuard and Qwen3.5: both can read out a safety-relevant signal, but only one exposes a handle that suppresses the implicit signal while preserving benign behavior within a validated operating range. For readers evaluating multimodal safety claims, the question to ask is whether a reported safety signal has been intervention-tested and controlled inside a validated range, not merely whether it was detected.

Sources used in this answer