Models reveal where safety decisions emerge combining images and words
From Local Evidence to Safety Verdicts: Causal Tracing in Vision-Language Models
Artificial Intelligence
Summary
Sometimes a computer needs to look at a picture and text together to decide if something might be unsafe. The authors made a special dataset to test how vision-language models make these safety decisions inside their 'brains.' They found that different parts of the model become important at different times depending on whether the change is in the image or the words. Also, a simple part of the model’s final decision can predict what safety judgment it will make, even if that judgment isn’t correct. This helps us understand how and where these AI models combine info to decide if something is safe or unsafe.
What this means in practice
- •For ai safety engineers: Locate specific model layers and inputs to monitor or intervene in safety decisions combining images and text.
- •For multimodal system developers: Use insights on where safety-relevant information forms to improve debugging and design of vision-language models.
Authors
Faezeh Dehghan Tarzjani, Mevan Wijewardena, Alexander Romanus, Sampad Mohanty
Abstract
A vision-language model may need to combine an image with a prompt to recognize a safety risk that neither reveals alone. Where does this joint safety judgment become accessible inside the model? We introduce SSU-Bench, a dataset of matched safe and unsafe image-text combinations constructed using single-item prompt edits or image edits with annotated intended regions. Using three vision-language models, we transfer internal states between paired inputs and measure the resulting change in the safety verdict. Across models and both types of counterfactual, interventions at the changed input positions are effective in earlier decoder layers, while interventions at the final input token become effective later. Directions estimated from other examples produce similar late-layer effects. A linear readout of the final-token state also predicts the model's own verdict, including incorrect judgments, and cross-model comparisons reveal similarities in the patterns of counterfactual change. These findings identify a recurring transition in where interventions can influence a joint safety verdict and distinguish a readable model decision from a correct safety judgment.