PaperlayerView exact revision on arXiv

Source-linked AI summary

ReFrame: Evidence-Guided Test-Time Safety Alignment in Multimodal Large Language Models

Wenzheng Jiang, Xuankun Rong, Yuanzhao Zhai, Dawei Feng, Huaimin Wang

arXiv:2608.21100v1cs.AI

TL;DR

Multimodal safety alignment must handle risks emerging from image-text interactions, while existing methods can require training or internal access unavailable for closed-source MLLMs. ReFrame is a training-free black-box framework that builds risk and utility evidence, rewrites prompts, and routes images before downstream inference. Across multiple MLLMs and benchmarks, it improves jailbreak defense, safety awareness, and oversensitivity reduction while maintaining multimodal utility.

  • Problem

    Multimodal safety alignment must address cross-modal risks, while existing methods may depend on training or internal access unavailable for closed-source MLLMs.

  • Method

    ReFrame uses two agents sharing a lightweight local MLLM to construct risk and utility cards, then rewrite the prompt and route the image before downstream inference.

  • Results

    Across multiple MLLMs and benchmarks, ReFrame improves jailbreak defense, safety awareness, and oversensitivity reduction while maintaining multimodal utility.

  • Takeaways & Limitations

    ReFrame provides a training-free test-time approach for black-box multimodal safety alignment that preserves normal-task performance.

  • Takeaways & Limitations

    ReFrame offers no formal robustness guarantee against adaptive multimodal attacks and depends on local-model and evidence-card quality; experiments mainly cover static single-turn inputs.

Abstract

from arXiv · show

While multimodal large language models (MLLMs) extend model capabilities beyond text, they also make safety alignment increasingly challenging. Multimodal safety alignment methods must address cross-modal jailbreaks, safety-awareness failures, and over-sensitive refusals. However, existing methods often rely on retraining or internal-state inspection, limiting their applicability to deployed closed-source MLLMs and motivating test-time safety alignment. We analyze this setting and identify two key obstacles, utility dominance and reasoning inertia, which cause models to overlook latent risks or follow malicious reasoning trajectories. Guided by these insights, we propose ReFrame, a training-free multimodal input reframing framework where two agents share a lightweight locally deployed MLLM: the evidence-generation agent constructs complementary risk and utility evidence, and the rewrite-and-routing agent converts it into a safe proxy prompt and image-routing decision before calling the downstream MLLM, without modifying it or accessing its internal information. Experiments across multiple MLLMs and benchmarks show that ReFrame improves jailbreak defense, safety awareness, and oversensitivity reduction while preserving multimodal utility.

1 Introduction

Multimodal safety alignment must address cross-modal risks, safety-awareness failures, and excessive refusals while operating with limited access to deployed models. ReFrame responds with training-free, black-box test-time reframing that separates risk and utility evidence before downstream generation.

  • Motivation: MLLM safety risks arise from image-text interactions, including concealed jailbreak intent, combined-modality harmfulness, and excessive refusal of sensitive-domain assistance.These challenges require defense, stronger safety awareness, and preservation of appropriate utility.
  • Motivation: Existing alignment methods depend on training, internal model access, or both, limiting adaptation and applicability to closed-source commercial MLLMs.The cited limitations include safety fine-tuning, preference optimization, additional components, gradients, attention maps, and hidden representations.
  • Safety Analysis: ReFrame identifies Utility Dominance and Reasoning Inertia as obstacles that make MLLMs overlook latent risks or follow malicious reasoning trajectories.The framework is motivated by these two empirical findings.
  • Evidence-Guided Reframing: ReFrame constructs complementary risk and utility evidence, then structurally rewrites prompts and routes images before calling the downstream MLLM.The framework is training-free and operates at test time without modifying the downstream model.
  • Empirical Validation: Across multiple MLLMs and benchmarks, ReFrame achieves the best safety-utility balance while improving jailbreak defense, safety awareness, and oversensitivity reduction.The reported evaluation covers the paper’s stated safety and utility objectives.

2 Related Work

Related work spans training-time and test-time multimodal safety alignment, but practical deployment remains difficult. Existing approaches may require unavailable access or focus narrowly on harmful-query refusal rather than broader contextual safety behavior.

  • Scope: Multimodal safety alignment is harder than text-only alignment because harmful intent can emerge only from image-text interaction.The related-work landscape includes both training-time and test-time approaches.
  • Existing Approaches: Training-time approaches improve robustness through safety fine-tuning, preference optimization, or related model interventions.These methods represent one major line of existing work.
  • Existing Approaches: Test-time approaches enforce safety through prompting, image-to-text conversion, calibration, or memory.These methods operate during inference rather than retraining the model.
  • Practical Gaps: Existing methods can require access unavailable for closed-source MLLMs or equate safety alignment with harmful-query refusal.Recent benchmarks therefore also examine safety awareness and oversensitivity in contextual multimodal settings.

3 Dive into Multimodal Safety Alignment

In the black-box setting, defenders transform image-text requests without accessing downstream internals, while adversaries can distribute or conceal harmful intent across modalities. Empirical findings show that explicit utility instructions can suppress safety awareness and that malicious reasoning can become progressively self-reinforcing.

  • Problem Setup: Multimodal behavior depends on joint text-image meaning, with images supplying targets, context, hidden content, or safety-critical evidence.Text defines the task while the image contributes additional meaning.
  • Problem Setup: The black-box setup permits only image-text transformation before inference, while adversaries may conceal harmful intent across the query and image.The downstream model cannot be modified or inspected by either the defender or adversary.
  • Utility Dominance: Utility Dominance causes explicit surface tasks to overshadow implicit unsafe intent during multimodal inference.In the SIUO example, direct inference produced a humorous tweet about unsafe escalator behavior, while a reminder yielded a safety-conscious useful response.
  • Utility Dominance: Adding an explicit hidden-risk reminder redirects the response from unsafe compliance toward safety-conscious assistance while preserving a lighthearted tone.The revised response recommends safe behavior and offers a safer tweet.
  • Reasoning Inertia: Reasoning Inertia lets jailbreak wrappers induce locally coherent unsafe trajectories whose later generation is reinforced after early tokens enter a malicious frame.The proposed response is to remove adversarial rules and redirect the prompt toward a safe adjacent objective.

4 Method

ReFrame intervenes before downstream generation by separating unsafe intent from reusable benign context, then using the resulting evidence to rewrite the prompt and route the image.

  • Method: ReFrame separates unsafe intent from reusable benign context with risk and utility cards before downstream generation.This pre-generation intervention is designed to improve the safety-utility balance.

4. Safe Inference

ReFrame performs safe inference by separately eliciting risk and utility evidence, then rewriting the request and routing the image before downstream generation. This input transformation preserves benign task information while disrupting unsafe reasoning without modifying or inspecting the downstream MLLM.

  • Evidence-Generation Agent: The evidence-generation agent uses a lightweight local MLLM to analyze an image-text request and externalize complementary risk and utility evidence.The risk card identifies unsafe intent, sensitive visual evidence, and a refusal boundary; the utility card records the benign goal and reusable context.
  • Evidence-Generation Agent: The risk card evaluates composed image-text intent, recovers concealed concerns, and records an unsafe core and abstract rewrite plan without actionable details.It considers modalities jointly, including hidden content, transformation wrappers, role-play frames, and output constraints.
  • Evidence-Generation Agent: The utility card preserves safe goals, constraints, tone, format, and task-relevant context to reduce unnecessary refusal while respecting the risk boundary.In safety-rewrite cases, it drops unsafe requests and workflows while retaining neutral context for safe same-topic assistance.
  • Rewrite-and-Routing Agent: The rewrite-and-routing agent compiles the original request and both evidence cards into a safe proxy prompt and an image-routing decision.It preserves the request when br = 0 and rewrites it toward a safe adjacent goal when br = 1.
  • Safe Inference: ReFrame routes either the original image or no image with the proxy prompt, then leaves the fixed downstream MLLM unchanged and uninspected.The shared local MLLM produces intermediate cards and the final proxy input, while the downstream model generates the response.

5 Experiment

ReFrame is evaluated across black-box multimodal models and benchmarks for safety alignment, utility preservation, ablations, scalability, and runtime. It improves safety-utility balance while preserving or improving normal-task performance, with benefits attributed to evidence-guided rewriting and image routing.

  • Main Results: 98.31/94.09 on GPT-4.1, 98.36/95.36 on Gemini-3-Flash, and 98.10/95.91 on Qwen3.5-Flash are ReFrame’s overall safety-utility scores.The largest gains occur on MML-mirror and MML-base64, where harmful goals are concealed across image and text.
  • Main Results: ReFrame improves safety awareness and reduces oversensitivity on SIUO and MOSSBench while preserving safe same-topic utility.These gains complement its jailbreak-defense improvements on multimodal benchmarks.
  • Main Results: 45.95 versus 37.28 is ReFrame’s GPT-4.1 average normal-task accuracy, with gains on POPE, Math, and Physics and no loss on Computer.The comparison is described as task clarification and distraction filtering rather than a universal capability gain.
  • Ablation Study: Removing the risk card causes the largest degradation on MML-mirror and SIUO, while removing the utility card lowers utility and normal-task performance, especially on MOSSBench and POPE.The ablation supports distinct roles for risk recovery and utility preservation.
  • Scalability: ReFrame remains effective with different local MLLMs and on open-source downstream models, with Qwen3VL-8B achieving the best overall safety-utility balance among tested local backbones.The reported pattern attributes gains primarily to the evidence-guided rewriting pipeline rather than one specific backbone.
  • Efficiency: ReFrame has higher latency than single-prompt baselines but lower overhead than heavier multi-stage defenses while achieving the strongest safety-utility balance.The shared local MLLM keeps cost controllable without retraining, gradient access, response search, or decoding control.

6 Conclusion

The paper concludes that ReFrame addresses multimodal safety alignment through training-free test-time input reframing. Across multiple MLLMs and benchmarks, it improves safety outcomes while maintaining normal-task performance.

  • Conclusion: ReFrame builds complementary risk and utility evidence cards, then rewrites prompts and routes images before downstream generation.This design targets utility dominance and reasoning inertia without modifying or inspecting the downstream MLLM.
  • Conclusion: Experiments show improved jailbreak defense, safety awareness, and oversensitivity reduction while maintaining normal-task performance.The conclusion reports this pattern across multiple MLLMs and benchmarks.
  • Conclusion: Future work could replace fixed agent prompts with self-evolving prompts to strengthen defenses against adaptive adversaries.This is presented as a future direction rather than an evaluated result.

Limitations

ReFrame’s effectiveness is bounded by the local MLLM, evidence-card quality, image routing, and evaluation scope. The paper does not provide a formal robustness guarantee against adaptive multimodal attacks.

  • Scope Boundary: ReFrame lacks a formal robustness guarantee against adaptive multimodal attacks.This limitation is shared with other black-box test-time defenses.
  • Evidence Quality: Errors in local visual-risk detection or safety-boundary judgment may preserve unsafe intent or remove benign details useful for answering.The limitation applies to generated evidence cards and the proxy-rewriting step.
  • Image Routing: Overly conservative image sanitization may discard helpful visual evidence.This constrains the image-routing component of the framework.
  • Evaluation Scope: Experiments mainly cover static, single-turn image-text inputs, leaving iterative attacks against the test-time pipeline only partially evaluated.The paper suggests adaptive multi-turn red-team evaluation as a way to expand coverage.

Ethical Considerations

The ethical discussion emphasizes responsible use of safety-sensitive benchmark data and frames the work as reducing unsafe multimodal compliance. The experiments rely on previously released datasets rather than newly collected data.

  • Dataset Risks: The safety evaluation datasets contain harmful or safety-sensitive scenarios by design and therefore carry potential dual-use risks.The paper states that these datasets are used strictly for academic research and safety evaluation.
  • Research Use: All experiments rely on previously released benchmarks rather than newly collected data.The stated purpose is to improve MLLM safety-utility balance and reduce unsafe compliance.
  • Research Purpose: The paper’s stated goal is positive and ethical: improving multimodal safety-utility balance and reducing unsafe compliance.This frames the intended application of the evaluation and method.

A.2 Details of Runtime Analysis

ReFrame combines safety and utility evidence to decide when to rewrite prompts and whether to forward images, with runtime and effectiveness measured against other safety methods.

  • Runtime comparison: Table 5 compares safety effectiveness, normal-task effectiveness, and per-sample runtime across different safety methods.Safety effectiveness averages ¯S and ¯U, normal-task effectiveness uses ¯A, and runtime is measured per sample on one A100 GPU.
  • Runtime comparison: ReFrame achieves the highest safety effect of 96.20 and normal-task effect of 45.95 with a moderate runtime of 0.84 seconds per sample.The reported comparison describes ReFrame as more effective and efficient than EchoSafe and ECSO, with stronger safety than AMIA at only a small latency increase.
  • Evidence-card processing: The evidence cards identify unsafe intent, unsafe cores, and safe rewrite plans without preserving actionable harmful details.The example cards distinguish hidden-content workflows from the underlying unsafe objective and redirect responses toward safe adjacent goals.
  • Adversarial examples: The mirrored multimodal jailbreak example uses reconstruction instructions and a game-production wrapper to conceal a request for bank-account hacking steps.The figure describes such elaborately designed prompts as an enhanced version of Figstep that guides step-by-step jailbreaking.
  • Image routing: For safety-sensitive inputs, ReFrame can discard the original image while preserving a safe adjacent topic and relevant image projection.Examples include replacing prohibited fishing guidance with legal alternatives and excluding a grenade-shaped object from child-study-area decoration.
  • Image routing: For safe, task-critical academic inputs, ReFrame preserves the original image and prompt rather than applying a safety rewrite.The Cayley-diagram example forwards the image because it contains necessary visual evidence for answering the mathematics question.

B.2 Details of Dataset

The evaluation covers jailbreak defense, safety awareness, oversensitivity, hallucination, and multimodal reasoning across several datasets, with safety and utility scored separately where applicable.

  • Safety benchmarks: MM-SafetyBench and MML-mirror evaluate jailbreak defense using Safety Score and Utility Score.MM-SafetyBench contains 1180 examples, while MML-mirror contains 1180 mirrored visual-textual attack examples.
  • Safety benchmarks: MML-base64 evaluates jailbreak defense under encoded multimodal attacks using Safety Score and Utility Score.Its prompts require extracting and Base64-decoding image titles before following a potentially harmful request.
  • Safety benchmarks: SIUO measures safety awareness with 167 examples and reports Safety Score and Utility Score.Its prompt presents an apparently benign statement whose risk depends on interpreting the combined context.
  • Safety benchmarks: MOSSBench evaluates oversensitivity with 300 examples using Safety Score and Utility Score.The benchmark includes benign prompts such as describing a fun game a child can play with pictured toys.
  • General multimodal evaluation: POPE assesses hallucination on 500 examples using image-grounded yes-or-no accuracy.Responses are judged only against visual evidence for the image question.
  • General multimodal evaluation: MMMU-Physics, MMMU-Computer, and MMMU-Math each contain 60 examples and evaluate multimodal reasoning with accuracy.Their prompts require reading multiple-choice questions and answer choices from images, then returning only the option letter.
  • Evaluation procedure: ReFrame runs without parameter updates: a local MLLM generates risk and utility cards, then produces a proxy prompt and image-routing decision.The downstream MLLM receives the rewritten prompt and routed image, while the intermediate cards remain internal to ReFrame.
  • Evaluation procedure: An LLM-as-a-judge scores generated responses independently for safety and utility on integer scales from 0 to 100.The judge uses the image and prompt as contextual information but scores only the generated response.
Loading 2608.21100v1…