Model Safety, Alignment & Jailbreaks
Evaluating the Cross-Modal Robustness of Text-Centric LLM Safety and Jailbreak Defenses
Generated automatically from the limitations stated in 6 papers (ACL, NeurIPS, EMNLP), listed under Evidence. It is not a paper, and it does not come from papers submitted to CSPaper.
The problem
Safety filters, alignment mechanisms, and jailbreak detectors are predominantly developed and validated on text-only language models. When these models are extended to multimodal settings—such as processing visual text, image-text queries, or non-textual inputs—it remains unknown whether text-derived guardrails maintain their defensive efficacy. Deploying multimodal systems without evaluating these defenses risks catastrophic safety failures through visual or cross-modal bypasses that text-based benchmarks never expose.
Why it matters
Provides the first empirical map of how text-only safety guardrails degrade when applied to multimodal models, enabling practitioners to determine where text defenses suffice and where modality-specific guardrails are strictly required.
Ways to approach it
Prior-work checks are free with an account. Results someone already ran are shown to everyone.
- 1
Benchmark transferability: Take existing open-source text-based guardrails (e.g., Llama-Guard, input perplexity filters, representation-engineering defenses) and evaluate their detection accuracy and false positive rates on paired text and visual-text/multimodal jailbreak benchmarks across open-weight vision-language models.
- 2
Cross-modal perturbation testing: Evaluate how defense efficacy degrades as malicious prompts are transitioned from plain text to typographed images, base64 visual encodings, and interleaved multi-image/text prompts across diverse model scales.
- 3
Comparative robustness evaluation: Measure safety intervention performance across standard text-only LLMs versus their direct multimodal extensions (e.g., Llama vs. Llama-Vision) under identical attack intents to quantify the specific robustness drop introduced by multimodal inputs.
Have a different approach?
Describe how you would tackle this problem and we'll look for papers that already do it. Free; your text stays private.
Why it might fail
Rapid concurrent community adoption of natively multimodal guardrails could render pure transfer studies of text-only defenses obsolete if the community completely abandons applying text-centric filters to multimodal inputs.
Evidence
Each paper's own statement of the limitation, verbatim.
- OASIS: Mitigating Harmful Fine-tuning Attacks on LLMs via Orthogonal and Adaptive Safety Alignment StrategyACL 2026
Evaluation restricted to textual LLMs; multimodal (e.g., vision-language) settings not covered
- CTRAP: Embedding Collapse Trap to Safeguard Large Language Models from Harmful Fine-TuningACL 2026
Only evaluated on pure text LLMs; multimodal models not covered
- Safe RLHF-V: Safe Reinforcement Learning from Multi-modal Human FeedbackNeurIPS 2025
Only image-text modality is covered; generalization to other modalities is explicitly not addressed
- MULTIGUARD: An Efficient Approach for AI Safety Moderation Across Languages and ModalitiesEMNLP 2025
Performance depends on the underlying model understanding the language/modality; if the base LLM cannot parse the input (e.g., cipher languages), detection fails — accuracy is much lower on cipher languages (73.06%) than natural languages (86.22%), and it scores only 0.40% on MML Base64 typographed images
- SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware DecodingACL 2024
Evaluated only on 7B text-only LLMs; validity for multimodal LLMs is untested
- ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMsACL 2024
Only tested on text-only models; effectiveness against multimodal LLMs is hypothesized but unverified
Nearest existing work
- Breaking Multimodal LLM Safety via Video-Driven PromptingCVPR 2026
- Jailbreaking Vision-Language Models Through the Visual ModalityICML 2026
- Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language ModelsICCV 2025
- From LLMs to MLLMs: Exploring the Landscape of Multimodal JailbreakingEMNLP 2024
- DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image InputsACL 2026
- Distraction is All You Need for Multimodal Large Language Model JailbreakingCVPR 2025
- SURE: Safety Understanding and Reasoning Enhancement for Multimodal Large Language ModelsEMNLP 2025
- Dynamic Token Reweighting for Robust Vision-Language ModelsCVPR 2026
- Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time AlignmentCVPR 2025
- Jailbreaking Vision-Language Models via Dissonance-Guided Suffix Optimization and Image-Phrase InjectionCVPR 2026
- Do We Really Need Curated Malicious Data for Safety Alignment in Multi-modal Large Language Models?CVPR 2025
- Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution StrategyCVPR 2025
- IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using ThemselvesICCV 2025
- FORCE: Transferable Visual Jailbreaking Attacks via Feature Over-Reliance CorrEctionCVPR 2026
- Jailbreaking Multimodal Large Language Models via Shuffle InconsistencyICCV 2025
Related open problems
Model Safety, Alignment & Jailbreaks
A Framework for Deploying Activation- and Logit-Based Methods Against Closed-Source LLM APIs via Instrumented Proxy Models
A very large body of techniques — safety defenses, interpretability probes, evaluation metrics, decoding controls — requires hidden states, attention maps, gradients, or token-level probabilities, and is therefore silently restricted to open-weight models. As a result, published methods are never validated on, and cannot protect or audit, the models most people actually use (GPT-4, Claude, Gemini). This is the single most common self-reported scope limitation in the literature, yet each paper treats it as an isolated footnote rather than a solvable engineering and inference problem.
Model Safety, Alignment & Jailbreaks
Decision-Only and Logit-Free Safety Auditing and Alignment Evaluation for Black-Box Models
Current safety auditing, jailbreak discovery, and representation-based alignment diagnostics overwhelmingly rely on white-box preconditions such as gradient access, intermediate activations, or output token logit distributions. When models are deployed behind production APIs that return only generated text, practitioners cannot run these diagnostic and red-teaming pipelines directly. Relying on surrogate transfer from open-source models produces high false-negative rates due to incomplete transferability across distinct architectures and tokenizers. Consequently, safety assessments for proprietary, API-governed models remain structurally disconnected from the methods developed in the literature.
Model Safety, Alignment & Jailbreaks
Recovering Internal Attention and Activation Signals from API-Visible Model Behavior
The shared wall is a dependence on inference-time extraction of layer-wise internal states — attention weights, hidden activations, per-layer execution — which are unavailable outside open-weight deployments and costly and per-model-fragile even where weights are open. Every technique built on those signals stops working the moment the model is served through an API; the sanctioned fallbacks, transferring from an open proxy or degrading to logit-only features, demonstrably forfeit most of the signal (one published detector drops from its white-box ceiling to 0.66 AUROC). Even with open weights, each release re-breaks the tooling: layer indices must be re-selected per model and multi-pass decoding adds latency. The result is a method family whose reach shrinks exactly as the most capable models become less open, and whose findings nobody without weight access can verify or use.
Model Safety, Alignment & Jailbreaks
Robust Evaluation of Non-Binary and Phrasing-Agnostic Refusal in Safety-Aligned Language Models
Current safety benchmarks and verifiable reward mechanisms evaluate model refusals primarily through binary keyword matching, hand-crafted refusal templates, or uncalibrated model-based autoraters (which show inter-annotator agreement as low as $\alpha = 0.378$). This creates a blind spot where models that partially comply, use non-standard refusal vocabulary, or alter their stance under multi-turn pushback are misclassified as either fully compliant or safely refusing. Consequently, alignment interventions optimized against these brittle metrics suffer from artificial over-refusal on benign queries while leaking safety risks through stylistic variation and conversational pressure. Without a rigorous, non-binary evaluation standard across diverse phrasing distributions, researchers cannot reliably assess whether safety alignment generalizes beyond rigid heuristic templates.