---
title: 'MSCAV: Multi-modal Safety in LVLMs'
url: https://www.emergentmind.com/topics/multi-modal-safety-concept-activation-vectors-mscav
type: topic
---

# MSCAV: Multi-modal Safety in LVLMs

Multi-modal Safety Concept Activation Vectors (MSCAV) are layer-wise safety representations for Large Vision-Language Models (LVLMs) that map intermediate multimodal hidden states to a compact “safety profile,” enabling anomaly-based detection of jailbreak inputs. In "Learning to Detect Unknown Jailbreak Attacks in Large Vision-Language Models: A Unified and Accurate Approach," MSCAV is the representation bridge between raw LVLM activations and the Safety Pattern Auto-Encoder used in the LoD framework for unknown jailbreak detection [2508.09201]. Conceptually, MSCAV belongs to the broader family of Concept Activation Vectors (CAVs), which probe latent spaces with semantically meaningful directions; a multimodal precedent appears in emotion recognition, where CAVs were used to test whether hidden representations align with human-understandable concepts across video, audio, and text [2202.01072].

## 1. Definition and scope

MSCAV is introduced as an extension of SCAV (“Safety Concept Activation Vector”) from LLMs to the multimodal LVLM setting. Its purpose is not to recover arbitrary latent content, but to retain only safety-related information from internal representations. The LVLM input to the detector is the sequence of intermediate activations from a forward pass,
$$
\{\mathbf{e}^1, \dots, \mathbf{e}^L\},
$$
where each $\mathbf{e}^l \in \mathbf{R}^d$ is the hidden state at the output of the $l$-th transformer layer for a multimodal input $I$ [2508.09201].

For each layer $l$, MSCAV uses a linear classifier
$$
C_l(\mathbf{e}^l) = \mathrm{sigmoid}(\mathbf{w}^\top \mathbf{e}^l + b),
$$
with $\mathbf{w} \in \mathbf{R}^d$ and $b \in \mathbf{R}$, to estimate the probability that the model “considers the input unsafe” at that layer. The result is not a single latent vector from one layer, but a layer-wise vector of safety probabilities,
$$
\mathbf{S}_\text{o} = \big[ C_1(\mathbf{e}^1), C_2(\mathbf{e}^2), \dots, C_L(\mathbf{e}^L) \big]^\top,
$$
with $\mathbf{S}_\text{o} \in \mathbf{R}^L$.

A common misconception is that MSCAV is simply a compressed form of raw hidden states. The paper states the opposite: MSCAV is a compact representation containing only safety-related information, extracted layer-by-layer from multimodal activations. Another common misconception is that MSCAV is a supervised attack classifier. In LoD, it is instead a representation used for anomaly detection, with the downstream autoencoder trained solely on safe samples.

## 2. Construction from multimodal hidden states

The procedure begins by constructing two multimodal datasets: $\mathbf{I}^+$, consisting of safe multimodal inputs where both text and image are safe, and $\mathbf{I}^-$, consisting of harmful multimodal inputs where the text is naturally harmful and the image matches the harmful scene. For each input $I$, a forward pass through the LVLM $f$ yields the hidden states $\{\mathbf{e}^1, \dots, \mathbf{e}^L\}$ [2508.09201].

One linear classifier is then trained per layer using binary cross-entropy:
$$
\mathcal{L} = -\frac{1}{|N|} \sum \big[ y \log C(\mathbf{e}) + (1-y)\log(1-C(\mathbf{e})) \big],
$$
where $y \in \{0,1\}$ indicates safe $(0)$ or unsafe $(1)$. For a new multimodal input, the detector computes $C_l(\mathbf{e}^l)$ for every layer and stacks these layer-wise safety probabilities into the full MSCAV $\mathbf{S}_\text{o}$.

The paper also specifies the practical data allocation. There are **100 pairs** of harmful/safe inputs to train the layer classifiers, **320 safe inputs** to train the autoencoder, and **80 safe samples** reserved for validation. This training protocol makes the representation learning stage partially supervised at the concept-probe level, while the anomaly detector operating on MSCAV remains unsupervised with respect to attacks.

## 3. Safety concept separability and refined MSCAV

MSCAV is motivated by the claim that LVLM internal activations encode a safety concept that becomes linearly readable at various layers. In the paper’s formulation, safe and harmful inputs become linearly separable in representation space, and a linear probe can interpret the model’s safety mechanism. The multimodal setting is central: the method assumes that cross-modal hidden states contain safety-relevant structure that can be isolated from topic or general semantics [2508.09201].

To retain only layers that are empirically linearly separable with respect to safety, the method evaluates each layer-specific classifier and keeps only layers whose test accuracy exceeds a threshold. If $\mathcal{P}_l$ is the test accuracy at layer $l$ and $P_0$ is a threshold, then
$$
\mathcal{L}_s = \{ l \mid \mathcal{P}_l \geq P_0 \}.
$$
The refined MSCAV is
$$
\mathbf{S}_\text{r} = \big[ C_l(\mathbf{e}^l) \big]_{l \in \mathcal{L}_s}^\top.
$$

This layer selection step distinguishes the full MSCAV from the refined MSCAV. The full form preserves all layer-wise safety probabilities; the refined form keeps only layers that reliably encode the safety concept. The paper emphasizes that this filtering removes safety-irrelevant content while preserving safety-related information.

A notable empirical finding is that linear separability appears very early in LVLMs: classifier accuracy exceeds **90% as early as the 4th layer**, earlier than the $\sim$10th layer commonly reported for LLMs. This is presented as evidence that MSCAV is a faithful safety concept representation in LVLMs. A plausible implication is that multimodal alignment may make safety-related structure accessible at shallower depths than in unimodal language models, although the paper presents this as an empirical observation rather than a mechanistic proof.

## 4. Role in the LoD anomaly-detection framework

MSCAV is the input representation for the Safety Pattern Auto-Encoder (AE), the second core component of LoD. The AE is trained not on raw activations but on the refined MSCAV $\mathbf{S}_\text{r}$. Its architecture consists of a **three-layer encoder**, a **symmetric decoder**, **fully connected + ReLU** hidden layers, and a **2-dimensional** latent bottleneck [2508.09201].

The reconstruction is
$$
\hat{\mathbf{S}}_\text{r} = f_{\text{dec}}(f_{\text{enc}}(\mathbf{S}_\text{r})),
$$
and training uses only safe inputs with mean squared error:
$$
\text{Loss}_{\text{rec}} = \frac{1}{N} \sum_{i=1}^{N} \left\| \hat{\mathbf{S}}_\text{r}^{(i)} - \mathbf{S}_\text{r}^{(i)} \right\|_2^2.
$$

The paper’s intuition is that the AE learns the compact manifold of safe safety-patterns. At inference time, the anomaly score is the squared reconstruction error,
$$
\delta = \left\| \hat{\mathbf{S}}_\text{r} - \mathbf{S}_\text{r} \right\|_2^2.
$$
If $\delta > \tau$, the input is classified as malicious or a jailbreak attack; if $\delta \le \tau$, it is classified as safe.

The inference pipeline is explicit: run the multimodal input through the LVLM, collect $\{\mathbf{e}^1,\dots,\mathbf{e}^L\}$, apply the layer classifiers to obtain MSCAV values, keep only the selected layers $\mathcal{L}_s$ to form $\mathbf{S}_\text{r}$, feed $\mathbf{S}_\text{r}$ into the AE, compute $\delta$, and compare it to $\tau$. The system is framed as unknown jailbreak detection because it learns only the safe manifold and flags deviations as anomalies, rather than relying on known attack types.

## 5. Empirical behavior, ablations, and operating characteristics

The empirical case for MSCAV is built around several observations. First, the paper reports that classifiers distinguishing safe and harmful inputs achieve high accuracy across layers, with over **90% accuracy by layer 4**. Second, for unseen jailbreak attacks, the layer-wise MSCAV curves lie **below harmful inputs** but remain **well above safe inputs**. The authors interpret this as showing that attacks lower the safety probability across layers without collapsing the representation into the safe region [2508.09201].

Third, the ablation study argues that MSCAV is necessary because raw activations are much worse. Removing MSCAV and using raw activations causes AUROC to drop to **0.545** on LLaVA and **0.126** on CogVLM, while Qwen-VL stays higher at **0.851**. This is used to support the claim that raw hidden states contain too much irrelevant variation, whereas MSCAV isolates safety-relevant structure.

The full MSCAV + AE system achieves the following results.

| Model | Average AUROC | Minimum AUROC |
|---|---:|---:|
| LLaVA | **0.9969** | **0.9919** |
| Qwen-VL | **0.9951** | **0.9773** |
| CogVLM | **0.9943** | **0.9814** |

Compared to the strongest baseline, the paper reports up to **18.21%** relative improvement in average AUROC and up to **38.89%** improvement in minimum AUROC. It also reports that performance remains high across different $P_0$ values, indicating that MSCAV layer selection is not fragile. In efficiency terms, inference time per input is **0.13–0.18s**, faster than HiddenDetect and much faster than JailGuard.

These results support the paper’s central claim that MSCAV-based anomaly modeling is robust across diverse jailbreak attack types. At the same time, the reported attack-curve behavior indicates that the method is not claiming that jailbreak inputs become internally identical to harmful training inputs; rather, they occupy an intermediate region in MSCAV space that remains anomalous with respect to the safe manifold.

## 6. Relation to concept-based interpretability in multimodal models

MSCAV is closely related to the broader CAV framework, but its objective differs from classical multimodal interpretability. In "Interpretability for Multimodal Emotion Recognition using Concept Activation Vectors," CAVs are trained at multiple layers of a Bi-directional Contextual LSTM (BC-LSTM) to test whether hidden representations align with human-understandable concepts such as **Variations in Physiognomy (VP)**, **Voice Pitch (PT)**, and **Utterance Polarity (UP)** across video, audio, and text [2202.01072].

That earlier multimodal work follows the TCAV methodology: construct positive and negative concept sets, extract activations at selected layers, train a linear binary classifier whose separating hyperplane is the Concept Activation Vector $v_C^l$, and evaluate concept influence using a directional derivative and a TCAV score. It also performs **two-tailed $t$-tests** against random concepts, with a significance level $\alpha = 0.05$, to determine whether observed concept influence is statistically meaningful.

The comparison clarifies what is specific to MSCAV. Classical CAVs identify a direction in activation space corresponding to a semantic concept and are used to interpret class predictions. MSCAV instead maps each layer’s activation to a scalar safety probability and aggregates those values into a layer-wise safety profile. This suggests that MSCAV can be understood as a safety-specialized, layer-indexed adaptation of concept-based probing for anomaly detection rather than for post hoc explanation of class decisions.

The multimodal emotion-recognition literature also highlights limitations that are relevant by analogy. CAV methods rely on linear separability in a chosen latent space, and concept definitions can be approximate or dataset-dependent. A plausible implication for MSCAV is that its fidelity depends on the extent to which safety concepts are linearly recoverable and stably expressed across layers and datasets. The LoD paper’s early-separability findings and threshold-stability analysis support that assumption in the evaluated LVLMs, but they do not by themselves eliminate the broader caveat that concept-based probes can miss nonlinear interactions.

## 7. Significance for unknown jailbreak detection

MSCAV is useful for unknown jailbreak detection because it projects raw internal states into a safety-specific coordinate system, preserves only the information relevant to the model’s safety mechanism, makes safe/harmful separability explicit at the layer level, and yields a compact distribution that can be learned from safe data alone [2508.09201].

In this formulation, the crucial innovation is not merely the use of internal representations, which prior detection work had already adopted, but the replacement of heuristic rules with a principled anomaly-detection objective over a safety-specific representation. MSCAV supplies the representation; the Safety Pattern Auto-Encoder supplies the density-modeling mechanism through reconstruction error.

This division of labor explains why MSCAV occupies a central place in LoD. Without MSCAV, the detector must model raw multimodal hidden states containing substantial safety-irrelevant variation. With MSCAV, the detector sees only the layer-wise safety trajectory. The paper’s results therefore position MSCAV not as an auxiliary interpretability device, but as the core abstraction that makes unified and accurate unknown jailbreak detection feasible in LVLMs.

Source: https://www.emergentmind.com/topics/multi-modal-safety-concept-activation-vectors-mscav