ReFrame is a training‑free framework that enhances safety alignment for multimodal large language models at test time. It uses two lightweight agents: one generates risk and utility evidence, and the other rewrites prompts and routes images to create a safe proxy before invoking the deployed MLLM. Experiments show that ReFrame improves jailbreak defense, safety awareness, and reduces over‑sensitivity while maintaining multimodal utility.
arXiv:2609.20850v1 Announce Type: new Abstract: While Multimodal Large Language Models (MLLMs) show remarkable advancements, their cross-modal capabilities introduce complex vulnerabilities that easi...
arXiv:2608. 07535v1 Announce Type: cross Abstract: Multi-modal large language models (MLLMs) integrate heterogeneous modalities through modality alignment and fusion, enabling stronger understanding and reasoning.
arXiv:2606. 31876v1 Announce Type: new Abstract: To improve safety in Large Language Models (LLMs) we can either perform post-training alignment or exploit refusal directions in the activation space.
The paper introduces TA-SPA, a black‑box jailbreak method for multimodal large language models that generates transferable perturbations in a text‑anchored semantic space. It combines Text‑Anchored Semantic Factorization (TASF) to separate cross‑modal semantic factors from modality‑specific residuals with Semantic‑Preserving Augmentation (SPA) to diversify harmful target anchors while maintaining semantic consistency. Experiments demonstrate strong attack effectiveness and transferability to commercial MLLMs, with competitive performance against representative defenses.
Multimodal Large Language Models (MLLMs) have achieved remarkable progress in vision-language interaction, yet their safety alignment remains vulnerable to jailbreak attacks. A key challenge is that s...
The paper introduces COMIC, a reference‑aware safety gate designed for multimodal large language models (MLLMs). COMIC detects the operation requested by a user, identifies visual targets through OCR and open‑vocabulary proposals, and evaluates safety on explicit operation‑target pairs, using max‑risk aggregation and quality‑aware routing to decide whether to allow or block a request. Experiments on several open‑source MLLMs and jailbreak benchmarks show that COMIC improves robustness while maintaining benign utility and efficiency.
arXiv:2604. 00310v2 Announce Type: replace-cross Abstract: Multimodal large-language models (MLLMs) often experience degraded safety alignment when harmful queries exploit cross-modal interactions.
The paper investigates cross‑modal safety drift in multimodal large language models, where a harmless text query paired with a visual image can trigger harmful responses. Empirical analysis identifies unsafe response patterns and shows that visual cues receive limited attention, weakening refusal mechanisms. The authors introduce Safety‑Awareness Representation Transfer (SRT), a lightweight method that transfers safety signals from text processing to mitigate cross‑modal drift while maintaining model utility.
UnifiedAttack introduces a benchmark for testing the safety of large multimodal models (LMMs) in tasks that combine text and image to produce harmful content. The benchmark focuses on the additional harm that arises from cross‑modal synergy and includes filtered multimodal samples and synthesized disinformation queries. A synergistic hijacking framework—comprising In‑Context Reskinning (ICR) and Cognitive Planning Injection (CPI)—is proposed to expose vulnerabilities, and extensive evaluations show that UnifiedAttack consistently bypasses current alignment defenses in state‑of‑the‑art architectures.
arXiv:2606. 02111v1 Announce Type: cross Abstract: As multimodal large language models (MLLMs) have advanced to process video inputs, concerns have emerged about their potential for malicious misuse.
The paper introduces a posterior reweighting framework to explain and counter in-context learning jailbreaks in multimodal large language models. It models the model as switching between safe and harmful behavioral modes, interpreting prompt demonstrations as evidence that shifts the posterior. Using this view, the authors derive scaling laws for jailbreak effectiveness and propose a defense that injects benign counter‑evidence to suppress harmful drift while maintaining utility.
The paper introduces SAFE-PRO, a method for enhancing safety in multimodal large language models by proactively asking clarifying questions when cross‑modal ambiguity poses intent‑level risks. SAFE‑PRO employs a Risk‑Conditioned Uncertainty signal that blends predictive entropy with a learned cross‑modal risk score to guide both question‑asking and path optimization, prioritizing safety while reducing over‑refusal. The authors also present the SSUI‑Dialog dataset and demonstrate that SAFE‑PRO outperforms existing approaches, including GPT‑4o and Claude‑3.5‑Sonnet, across multiple benchmarks.