Can Vision-Language Models Stay Helpful When Facing Implicit Risks? Intent-Privilege OPSD for Efficient Safety-Helpfulness Alignment
cs.CL
Submitted: 2026-09-29
Updated: 2026-09-29
Code: https://github.com/Tunanzzz/Meerkat-VL
License: http://creativecommons.org/licenses/by/4.0/
The gist: Vision-Language Models (VLMs) remain vulnerable to cross-modal implicit risks: visual and textual inputs that appear benign in isolation can jointly elicit unsafe responses.
Terminology
Abstract
Vision-Language Models (VLMs) remain vulnerable to cross-modal implicit risks: visual and textual inputs that appear benign in isolation can jointly elicit unsafe responses. Existing safety methods often require large preference datasets, costly multi-rollout training, or additional safeguards at inference time. They may also sacrifice helpfulness by directly refusing requests that could be answered safely. In this paper, we propose Intent-Privilege On-Policy Self-Distillation (OPSD), which leverages evidence-grounded intent as privileged supervision during training to help VLMs recognize implicit risks and provide safe, useful responses instead of blanket refusals. OPSD distills a teacher's intent-conditioned preferences over responses into a student using a single rollout per prompt; the student then responds without intent annotations or an additional safety module. With only 1,447 safety-specific examples - 95% fewer than standard preference datasets - OPSD reduces training time by 5x relative to multi-rollout GRPO-style training and average inference length by 7%. It attains the highest ratio for joint safety-helpfulness success, which measures the proportion of responses that are both safe and helpful, across all five evaluation groups. Remarkably, on pooled SIUO+HoliSafe, this success ratio rises from 43.9% to 53.5%. These results show that training-time intent supervision can improve both safety and helpfulness while substantially reducing data, training, and inference costs.
Sources
- On-Policy Distillation of Language Models: Learning from Self-Generated Mistakes
- FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts
- Distilling the Knowledge in a Neural Network
- CASA: Classification Augmented with Safety Attention for Robust Multimodal Alignment
- SGuard-v1: Safety Guardrail for Large Language Models
- HoliSafe: Holistic Safety Benchmarking and Modeling for Vision-Language Model
- Safe responses matter: Output-aware safety guardrail mitigate over-refusal in MLLMs
- MOSSBench: Is Your Multimodal Language Model Oversensitive to Safe Queries?
- DREAM: Disentangling Risks to Enhance Safety Alignment in Multimodal Large Language Models
- MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models
- Safety Alignment for Vision Language Models
- SIA: Enhancing Safety via Intent Awareness for Vision-Language Models
- Qwen3 Technical Report
- SafeGRPO: Self-Rewarded Multimodal Safety Alignment via Rule-Governed Policy Optimization
- DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models
- Learning by Distilling Context
- MMAligner: Safeguarding Multimodal Large Language Models through Representation Calibration
- CrossGuard: Safeguarding MLLMs against Joint-Modal Implicit Malicious Attacks
- SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Model
- Self-Distilled Reasoner: On-Policy Self-Distillation for Large Language Models
Related papers
- Exploring Solution Divergence and Its Effect on Large Language Model Problem Solving
- Ishigaki-IDS-Bench: A Benchmark for Generating Information Delivery Specification from BIM Information Requirements
- Subliminal Steering: Stronger Encoding of Hidden Signals
- MedStruct-S: A Benchmark for Key Discovery, Key-Conditioned QA and Semi-Structured Extraction from OCR Clinical Reports
- The End of Transformers? On Challenging Attention and the Rise of Sub-Quadratic Architectures
- Untangling the Mechanisms of Misleading Context in Medical Question Answering