SAEgis: Sparse Autoencoders as Plug-and-Play Firewalls for VLM Safety
Sparse Autoencoders as Plug-and-Play Firewalls for Adversarial Attack Detection in VLMs
This paper introduces SAEgis, a lightweight, plug-and-play framework for detecting adversarial attacks in Vision-Language Models (VLMs) using Sparse Autoencoders (SAEs). By interpreting sparse latent features as indicators of visual anomalies, SAEgis achieves state-of-the-art detection performance across diverse datasets and unseen attack methods without requiring adversarial training.
TL;DR
As Vision-Language Models (VLMs) like Qwen2.5-VL and Gemini become central to AI agents, their susceptibility to adversarial image attacks poses a critical security risk. SAEgis is a novel detection framework that uses Sparse Autoencoders (SAEs) to identify these attacks. Unlike previous methods, it requires no adversarial training, works as a plug-and-play module, and demonstrates exceptional generalization across different image domains and attack types.
Background: The Visual Vulnerability of VLMs
While LLMs are primarily attacked via text prompts, VLMs introduce a "visual backdoor." A few pixels or a specific noise pattern in an image can force a VLM to ignore actual visual content and output malicious instructions. Current defenses are often brittle: they work on the dataset they were trained on but fail when the user provides a different type of image (Domain Shift) or when a new attack method is invented (Attack Shift).
The Insight: Why Sparse Features?
The core intuition of SAEgis is that Sparse Autoencoders, when trained to reconstruct "clean" features of a pretrained VLM, learn a dictionary of "normal" visual concepts. When an adversarial image is processed:
- It deviates from the manifold of clean data.
- It triggers a specific set of "latent features" that are rarely active during normal operation.
- By monitoring these attack-relevant features, we can create a high-precision firewall.
Methodology: Building the Aegis
The SAEgis workflow consists of three main steps:
- SAE Insertion: An SAE is placed at a specific layer (e.g., the Vision Encoder or the Projection MLP).
- Feature Selection: Using a small set of adversarial examples, the system identifies features that show a high difference in activation strength and frequency compared to clean images.
- Threshold Calibration: A threshold is set based on the (1-α) quantile of activations on a small clean development set, ensuring a controlled False Positive Rate (FPR).
The authors specifically highlight the Multi-Layer Ensemble strategy. By aggregating signals from early vision layers (which capture low-level textures) and the projection layer (which captures global semantics), SAEgis covers the blind spots of individual layers.
Experimental Performance
The researchers tested SAEgis against strong attacks like M-Attack and FOA-Attack across three datasets: NIPS17 (Standard), LLaVA (Instructional), and Medical (Domain-specific).
Cross-Domain Robustness
This is where SAEgis truly shines. Standard "dense" baselines (using raw hidden states) often collapse when moving from natural images to medical images, with precision dropping significantly. SAEgis maintains stability because sparse features are better at disentangling domain-specific content from the universal "signature" of an adversarial attack.
Cross-Attack Generalization
In the "SSA-CWA → M-Attack" transfer test, individual layers often lose recall. However, the Ensemble variant of SAEgis recovers nearly all performance, proving that adversarial signals "leak" into different layers depending on the attack's nature.
Critical Analysis & Insights
- Low Data Requirement: One of the most impressive findings is that SAEgis reaches ~80% F1-score with as few as 10 adversarial samples. This makes it highly practical for emerging threats where data is scarce.
- Layer Sensitivity: Early vision layers (Vision-block0) are more robust for detecting low-level perturbations, while the Projection layer is better for semantic-level attacks. The ensemble is thus non-negotiable for a production-grade firewall.
- Limitations: The framework still struggles when the distribution of clean images shifts so drastically that they begin to look like adversarial noise to the SAE (e.g., highly textured or out-of-distribution medical scans), leading to false positives.
Conclusion
SAEgis demonstrates that the "interpretability" of Sparse Autoencoders isn't just for academic curiosity—it has immediate, practical value in AI safety. By using SAEs as a plug-and-play detection layer, developers can significantly harden VLM-based agents against visual adversarial threats with minimal computational overhead.
Figure: Venn diagrams showing that attack-relevant features are surprisingly consistent across different image domains.