Prefill-Time Interventions against Adversarial Attacks on Large Vision-Language Models

Conference: ECCV 2026
Paper: ECCV Official
PDF: Conference PDF
Area: LLM Safety
Keywords: Adversarial Detection, Multimodal Large Language Models, Prefill-Time Intervention, Masked Reconstruction, Trajectory Dynamics

TL;DR

Proposes PTI (Prefill-Time Intervention), the first lightweight defense framework that probes an LVLM's internal representations during the prefill stage—combining shallow visual masked reconstruction with layer-wise language trajectory inconsistency to halt adversarial attacks before generating any response tokens, achieving an average AUC of 0.98 with over 10x lower latency than prior defenses.

Background & Motivation

Large vision-language models (LVLMs) have rapidly emerged as foundational architectures powering multimodal reasoning and open-ended human-AI interaction across open-source systems and commercial deployments. However, recent studies uncover that LVLMs remain critically vulnerable to visual adversarial attacks: carefully optimized, imperceptible image perturbations or localized physical patches can hijack the autoregressive generation pipeline, forcing the model to produce attacker-specified target content rather than truthfully describing the underlying scene. Crucially, these attacks exhibit remarkable black-box transferability, easily misleading frontier closed-source commercial APIs such as GPT and Gemini.

Existing defense and detection methods tailored for LVLMs rely heavily on post-generation analysis or cumbersome auxiliary judging pipelines. For instance, PIP injects task-irrelevant text probes and examines full attention maps, whereas MirrorCheck generates a complete output response, reconstructs a mirror image, and invokes external vision encoders to evaluate cross-modal alignment. These offline pipelines incur immense inference latencies (often exceeding 1 to 1.6 seconds per sample) and redundant forward passes, preventing integration into real-time streaming services; extracting full attention maps also conflicts with hardware-aware kernels like FlashAttention. Meanwhile, recent streaming safeguards focus almost entirely on jailbreak prompts and textual toxicities, leaving multimodal visual adversarial threats completely unaddressed.

This paper tackles the challenge by formulating detection through a probabilistic decomposition of the joint negative log-likelihood under benign data distributions, isolating adversarial signatures into visual spatial anomalies and semantic trajectory inconsistencies. Core idea: probe internal states of the LVLM during the prefill stage using shallow masked visual reconstruction and layer-wise recurrent semantic trajectory tracking on salient tokens, triggering an immediate refusal via a lightweight decision gate before the first response token is decoded.

Method

Overall Architecture

PTI operates entirely within the prefill stage of the victim LVLM, requiring no external models, no auxiliary generative passes, and only benign samples for training.

When an image-text pair is received, the input image passes into the visual encoder; at an early layer, a lightweight convolutional reconstruction head evaluates spatial patch integrity via random masking to compute a visual anomaly score \(S_{\text{anom}}\). Concurrently, the top-5% visual tokens with the highest anomaly scores, alongside the summary token (</img>), are tracked as they propagate through the language model backbone. A shared projector maps their layer-wise hidden representations onto the unit hypersphere, where a lightweight gated recurrent unit (GRU) models normal semantic progression to output an inconsistency score \(S_{\text{inc}}\). A calibrated decision gate normalizes and fuses both scores, issuing an immediate refusal if the risk exceeds a threshold, or seamlessly handing off prefilled key-value states to begin standard token generation.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["Input Image + Text Prompt"] --> B["Vision Tower Layer 3 Feature Extraction"]
    B --> C["Visual Masked Reconstruction<br/>Compute token-wise spatial error"]
    C --> D["Filter Top-5% Salient Visual Tokens & Summary Token"]
    D --> E["Layer-wise State Geometric Projection<br/>Normalize to unit hypersphere"]
    E --> F["Recurrent Dynamics Trajectory Modeling<br/>Predict next-layer directional cosine distance"]
    C -->|Spatial anomaly score Sanom| G["Decision Gate Fusion<br/>Z-score normalization and thresholding"]
    F -->|Semantic inconsistency score Sinc| G
    G -->|Score > Threshold τ| H["Trigger Immediate Refusal"]
    G -->|Score ≤ Threshold τ| I["Permit Streaming Token Generation"]

Key Designs

1. Spatial Representation Anomaly Assessment: Shallow Masked Reconstruction

Adversarial perturbations, while crafted to deceive deep multimodal representations, inevitably disrupt local spatial smoothness and patch correlation priors inherent in natural images. To capture these low-level distortions, PTI extracts intermediate features \(V = (v_1, \dots, v_N) \in \mathbb{R}^{N \times d_v}\) from layer \(l = 3\) of the vision encoder. A random binary mask \(B \in \{0, 1\}^N\) with ratio \(\gamma = 0.4\) drops selected tokens, replacing them with a learnable mask embedding \(m\). A shallow CNN reconstruction head \(\phi\) predicts the original tokens from the unmasked context. The token-wise anomaly score \(a_i\) is computed as the expected reconstruction error under random masking:

\[a_i = \mathbb{E}_{B \sim \pi_\gamma} \left[ \| v_i - \mu_i \| \mid B_i = 1 \right]\]

The global anomaly score is the spatial average \(S_{\text{anom}} = \frac{1}{N} \sum_{i=1}^N a_i\). Both \(\phi\) and \(m\) are optimized exclusively on clean images by minimizing mean squared error. Shallow layers are specifically selected because advanced attacks (e.g., M-Attack) perform feature alignment that makes deep vision layers distributionally indistinguishable from benign samples, whereas shallow layers preserve conspicuous structural anomalies.

2. Cross-Layer Semantic Inconsistency Modeling: Spherical Trajectory Dynamics

Although the final output \(y\) is unavailable during prefilling, transformer hidden states gradually encode semantic intent across layers. Under adversarial attacks, the perturbed visual tokens induce erratic semantic shifts across layers. Rather than tracking all tokens, PTI evaluates only the most informative subset: the top-\(\rho\) (\(\rho = 0.05\), top 5%) tokens with the highest anomaly scores in \(\{a_i\}_{i=1}^N\) plus the summary token (</img>).

Because raw hidden states \(h_i^{(\ell)}\) across layers differ in geometric scale, a shared two-layer MLP projector \(\psi\) maps them onto a unit hypersphere: \(z^{(\ell)} = \psi(h^{(\ell)})\), with \(\|z^{(\ell)}\|_2 = 1\). A lightweight GRU \(\zeta\) conditioned on learnable layer embeddings \(e^{(\ell)}\) models the step-wise trajectory, predicting the next layer's normalized direction \((\hat{z}^{(\ell)}, s^{(\ell)}) = \zeta(s^{(\ell-1)}, [z^{(\ell)}; e^{(\ell)}])\). The inconsistency score \(c_i\) for a token is quantified by the average directional cosine distance:

\[c_i = \frac{1}{L-1} \sum_{\ell=1}^{L-1} \left( 1 - \hat{z}^{(\ell)\top} z^{(\ell+1)} \right)\]

The overall semantic score is aggregated as \(S_{\text{inc}} = \frac{1}{|\mathcal{I}_\rho|} \sum_{i \in \mathcal{I}_\rho} c_i\). To prevent representational collapse, \(\psi\) is warmed up via self-distillation against the final layer representation \(z^{(L)}\) alongside in-batch contrastive regularization.

3. Calibrated Fusion and Zero-Latency Prefill Gating

Because \(S_{\text{anom}}\) and \(S_{\text{inc}}\) originate from distinct feature domains and exhibit disparate statistical scales, PTI standardizes both using pre-calculated mean and standard deviation metrics from a held-out benign calibration split:

\[\mathcal{S}(\mathbf{x}, \mathcal{M}) = \hat{S}_{\text{anom}}(\mathbf{x}, \mathcal{M}) + \lambda \hat{S}_{\text{inc}}(\mathbf{x}, \mathcal{M})\]

With the fusion weight set to \(\lambda = 1.0\), the decision gate evaluates \(\mathcal{S}(\mathbf{x}, \mathcal{M}) > \tau\). If the score exceeds threshold \(\tau\), generation is aborted immediately; otherwise, decoding begins using the pre-computed key-value cache without redundant forward passes. The total detection overhead is approximately 0.09s per sample.

Key Experimental Results

Main Results

Evaluated on MS-COCO validation data across four representative LVLMs under five attack families: white-box Lp attacks (PGD, C&W), black-box transfer attacks (M-Attack), unrestricted diffusion attacks (AdvDiffVLM), and patch attacks (PandoraBox).

The table below summarizes average in-domain detection metrics and time overhead from Table 1 of the original paper:

Defense Method	Average AUC (↑)	Average TPR@5%FPR (%, ↑)	Inference Time Overhead (s/sample, ↓)	Attention Engine Compatibility
PIP (ACM MM 24)	0.762	33.65	1.6217	Requires disabling FlashAttention
MirrorCheck (2024)	0.900	62.03	1.1809	Requires full response generation
Perturbation Forgery (CVPR 25)	0.878	57.26	0.0483	Pixel-level fitting; collapses on OOD
PTI (Ours)	0.980	91.91	0.0931	Fully compatible with FlashAttention

Key findings across victim models from Table 1: - On LLaVA-OneVision-7B against PGD, PTI attains 0.998 AUC and 99.64% TPR@5% (vs. PIP's 0.957/67.04% and MirrorCheck's 0.951/82.63%). - Against the transfer attack M-Attack, PIP completely degrades (6.92% TPR@5% on Qwen2.5-VL-3B, 3.11% on InternVL2.5-8B), whereas PTI consistently achieves 96.72% ~ 99.23% TPR@5%.

Ablation Study

The table below reports module ablation results on Qwen2.5-VL-3B averaged across five attacks from Table 4 of the paper:

Configuration	In-domain AUC / TPR@5%	OOD (ImageNet) AUC / FPR@95%	Stress Test AUC / FPR@95%	Note
\(S_{\text{anom}}\) only	0.971 / 87.64%	0.918 / 30.12%	0.912 / 30.34%	Strong in-domain, but more prone to false alarms under OOD
\(S_{\text{inc}}\) w/o warm-up	0.914 / 65.83%	0.891 / 33.21%	0.889 / 26.96%	Suffers from representation collapse across layers
\(S_{\text{inc}}\) only	0.924 / 70.19%	0.911 / 29.08%	0.920 / 22.14%	Semantic trajectories offer higher resilience to distribution shifts
Full PTI (\(S_{\text{anom}} + S_{\text{inc}}\))	0.979 / 91.30%	0.936 / 25.18%	0.939 / 20.62%	Dual complementary signals achieve best accuracy and lowest false alarms

Key Findings

• Shallow vs. Deep Feature Distortions: Layer analysis (Figure 3 in the paper) shows that layers 1–8 in the vision tower yield robust detection for \(S_{\text{anom}}\). In deeper layers, transfer attacks like M-Attack align representations with benign targets, collapsing detection to random chance. This confirms that advanced attacks perform deep feature forgery, necessitating shallow-stage intervention.
• Robustness Against Benign High-Frequency Noise: Stress tests with Gaussian and uniform noise exhibit high-frequency pixel artifacts mimicking PGD, yet their feature-space reconstruction error remains minimal and trajectory divergence stays low, yielding an FPR@95% of only 20.55% (substantially lower than Perturbation Forgery's 80.04%).
• Resilience Against Adaptive Attacks: In an evading attack where white-box adversaries optimize to minimize PTI's detection score, attack success rate (ASR) drops precipitously from 64.43% to 5.17%, proving that evading PTI inherently neutralizes adversarial perturbation efficacy.

Highlights & Insights

• In-Pipeline Prefill Intervention: Shifts adversarial defense from post-generation inspection to pre-generation truncation, enabling streaming-compatible security with only 0.09s overhead.
• Benign-Only Self-Supervised Dual Probing: Operates without adversarial training data, decomposing detection into spatial anomaly and semantic trajectory inconsistency to generalize across unknown threat models.
• Salient Token Pruning: Filtering the top 5% anomalous tokens maintains high signal-to-noise ratio in semantic trajectory tracking while dramatically curbing computational overhead.

Limitations & Future Work

• Tight Architectural Coupling: Probing internal hidden states requires white-box hook access to model weights, making PTI suitable for model providers and self-hosted deployments rather than closed-box third-party API proxies.
• Sensitivity to Multimodal Interface Variations: Adapting PTI across disparate vision architectures (e.g., dynamic multi-crop vs. native high-res ViTs) may require tuning probe layer indices and sampling ratios.
• Multi-Turn Context Drift: Evaluated primarily on single-turn visual question answering; extending trajectory modeling to multi-turn dialogue contexts warrants further exploration.

Related Work & Insights

• vs. PIP (ACM MM 24): PIP relies on extra text prompts and full attention extraction, degrading under hardware optimizations like FlashAttention and failing entirely against early-stage visual forgery (M-Attack). PTI operates in-situ, running 17x faster with >40% higher AUC on transfer attacks.
• vs. MirrorCheck (2024): MirrorCheck requires full text generation followed by external image reconstruction and CLIP comparison; PTI eliminates the auxiliary generation loop entirely.
• vs. Kelp / ShieldVLM: While prior streaming safeguards focus on jailbreak text policies, PTI pioneers prefill-time defense against multimodal visual adversarial attacks.

Rating

• Novelty: ⭐⭐⭐⭐⭐ [Pioneers prefill-stage adversarial intervention for LVLMs using elegant probabilistic decomposition]
• Experimental Thoroughness: ⭐⭐⭐⭐⭐ [Evaluates 4 victim LVLMs across 5 diverse attack paradigms with rigorous OOD and adaptive attack validation]
• Writing Quality: ⭐⭐⭐⭐⭐ [Clear structural formulation, intuitive visualizations, and thorough ablation insights]
• Value: ⭐⭐⭐⭐⭐ [Incurs minimal 0.09s latency while preserving FlashAttention compatibility, highly practical for real-world deployment]

Related Papers

• [ECCV 2026] VLMSysTrojan: Stealthy System-Aware Backdoor Attacks Against Vision-Language Models
• [ICLR 2026] Sampling-aware Adversarial Attacks against Large Language Models
• [ICLR 2026] Transferable and Stealthy Adversarial Attacks on Large Vision-Language Models
• [ICLR 2026] Time-To-Inconsistency: A Survival Analysis of Large Language Model Robustness to Adversarial Attacks
• [ACL 2026] ATAAT: Adaptive Threat-Aware Adversarial Tuning Framework against Backdoor Attacks on Vision-Language-Action Models