Preprint demonstrates targeted removal of vision-language model safeguards

Researchers report a method that reduced compositional safety scores by up to 65 points on Qwen2.5-VL-7B and LLaVA-1.5-7B while keeping over 98% of outputs coherent. The preprint examines harmful requests formed by combining images and prompts that are benign separately. Called CMaG, the method uses internal model gradients from 80 examples to identify an activation direction that turns refusal into compliance. It requires no training and also weakened models hardened by defensive training. The researchers found that similar safety benchmark scores can conceal different robustness. The demonstrated intervention requires access to internal model activations; it does not establish the same result through ordinary user prompts.