Transfer Safety Awareness for Cross-Modal Safety Drift in Multimodal Large Language Models

Tianqi Xiao; Shiyao Cui; Minghao Zhang; Junxiao Yang; Renmiao Chen

Source-linked AI summary

Transfer Safety Awareness for Cross-Modal Safety Drift in Multimodal Large Language Models

Tianqi Xiao, Shiyao Cui, Minghao Zhang, Junxiao Yang, Renmiao Chen

arXiv:2609.02082v1Sep 2, 2026cs.MMcs.AIcs.CLcs.CR

TL;DR

Cross-modal safety drift arises when benign text conveys harmful intent through image-text grounding, exposing a safety-alignment gap in MLLMs. The paper analyzes failure patterns and safety representations, then proposes SRT, which transfers refined harmful-text-induced safety awareness; experiments show improved safety while preserving utility.

Problem
Cross-modal safety drift occurs when MLLMs become less safe for harmful intent conveyed through image-text grounding despite reliably refusing explicit harmful text.
Method
SRT refines coarse safety awareness derived from harmful-text-induced activations and transfers it to cross-modal safety drift with a frozen MLLM backbone.
Results
Experiments show that SRT effectively enhances MLLM safety across different cross-modal settings while preserving model utility.
Takeaways & Limitations
SRT provides a lightweight approach for improving safety across diverse cross-modal settings without changing the base MLLM.
Takeaways & Limitations
SRT’s generalization to broader architectures remains uncertain because models may encode refusal-related computation and internal safety mechanisms differently.

Abstract

from arXiv · show

Visual modality enhances the capabilities of multimodal large language models (MLLMs) but also introduces a safety concern: a benign textual query may convey harmful intent when grounded in a visual image. We term this cross-modal safety drift and our pilot studies show that the safety response rate for such requests is substantially lower than that for requests containing explicitly unsafe text. This paper aims to systematically study this issue. First, we conduct an empirical analysis to identify representative unsafe response patterns. Building on these, we interpret model representations and attentions, revealing that visually risky cues receive limited attention and weakly trigger refusal. Motivated by the observation that safety signals from unsafe text processing can be transferred, we propose safety-awareness representation transfer (SRT), a lightweight direction-refinement method that mitigates cross-modal safety drift with a frozen MLLM backbone. Experiments across multiple benchmarks and models show that SRT effectively improves safety in diverse cross-modal settings while preserving utility. Code is available at https://github.com/cucu220123/safety-awareness.

1 Introduction

MLLMs can lose safety awareness when benign text conveys harmful intent through images, creating cross-modal safety drift. The paper characterizes this problem, interprets its mechanisms, and proposes SRT to improve safety while preserving utility.

Problem: Cross-modal safety drift occurs when image-text grounding reveals harmful intent that benign text alone does not express.The paper distinguishes safe text with unsafe image (StUi →U) from safe text with safe image (StSi →U).
Problem: Existing MLLM safety-alignment methods struggle to elicit safety awareness under cross-modal grounding.The stated alignment goal is to process requests with safety concern and refuse or warn on unsafe requests.
Approach: The paper characterizes typical failure patterns through response-level analysis of cross-modal safety drift.It analyzes StUi →U and StSi →U cases to provide empirical input for mechanistic interpretation.
Approach: Activation and attention analyses examine how missing explicit harmful text affects safety and whether harmful-text-induced safety signals transfer.These analyses motivate transferring safety awareness from unsafe-text processing to cross-modal risky inputs.
Method: SRT refines coarse safety awareness from harmful-text-induced activations and transfers it to cross-modal safety drift with the base MLLM frozen.The method is designed to balance safety and utility.
Results: Across representative cross-modal benchmarks, SRT significantly improves safety performance while preserving utility.The method is presented as a lightweight direction-refinement approach.

2 Empirical Analysis

An analysis of failed cross-modal safety cases identifies two recurring patterns: models may overlook visual risk cues or recognize them without incorporating their safety implications.

Visual risk unawareness: 37% of inspected failure cases showed visual risk unawareness, with risky visual regions insufficiently incorporated during response generation.In the example, the response followed the textual instruction without mentioning the gun in the image.
Safety implication unawareness: 63% of manually analyzed failure cases showed safety implication unawareness despite the model capturing risk-related image semantics.The model responded to a firearm-related request but failed to recognize the safety risks of providing guidance.

3 Interpret Cross-modal Safety Drift

The analysis shows that explicit harmful text strengthens refusal-related representations, whereas visual risk cues receive insufficient attention. Unsafe-text-induced activation directions can nevertheless be transferred to cross-modal risky inputs, with some layers producing more selective refusal increases than others.

Safety representations: Refusal layers are identified by large refusal-score increases on benign samples, concentrating mainly in layers 19–30 for Qwen3-VL-8B-Instruct and 20–48 for Gemma-3-12B-IT.The refusal-score increase is measured after adding an activation direction during the forward pass.
Safety representations: Paired harmful-text and benign-text inputs retain similar semantics but separate along the refusal axis, showing that explicit harmful text increases refusal tendency.This comparison uses paired inputs with the same unsafe image and underlying intent.
Attention patterns: Harmful textual tokens receive 16.23% of text-token attention, whereas harmful-semantics visual tokens receive only 2.98% of image-token attention in cross-modal risky inputs.The visual cues “drugs” and “stone” are described as insufficiently attended to at refusal layers.
Transferability: Unsafe-text-induced activation directions substantially increase refusal on cross-modal risky inputs, especially within the identified refusal layers.The directions are constructed from harmful-text and cross-modal sets and tested by subtracting the original refusal-score baseline.
Transferability: At layer 16 for Qwen3-VL-8B-Instruct and layer 15 for Gemma-3-12B-IT, refusal increases are much larger on risky inputs than on benign VQA inputs.These layers therefore show a selective effect rather than a uniform push toward refusal.

4 Method

SRT refines safety-awareness directions extracted from unsafe-text activations, balancing refusal-process effects with output behavior while keeping the base MLLM frozen.

Safety-awareness representation transfer: SRT transfers unsafe-text-induced safety awareness to cross-modal risky inputs after refining the direction for safety and utility.The method treats unsafe-text scenarios as the source of safety signals and applies the refined representation to cross-modal safety drift.
Refusal-Process Supervision: SRT optimizes a direction inserted at pre-refusal layers to activate refusal-related computation in subsequent refusal layers.The intervention’s downstream influence is measured between a source layer and a later refusal layer.
Refusal-Process Supervision: The refusal-process objective preserves the direction’s effect on risky inputs while suppressing downstream effects on benign inputs.The contrastive constraint treats DCM as positive and DB as negative, encouraging effects specific to risky inputs.
Output-Behavior Supervision: Output-behavior supervision further refines safety awareness so increased internal refusal processing translates into final output behavior.The output-level contrast includes preservation and suppression components, with suppression measured using KL divergence between original and intervened distributions.
Optimization: The final objective combines refusal-process and output-behavior supervision while optimizing only the safety-awareness direction.The base MLLM remains frozen during direction optimization.

5 Experiment

Experiments evaluate SRT across unsafe image-text combinations, utility benchmarks, multiple MLLM families, and larger models. SRT consistently improves safety while preserving utility and safe helpfulness.

Setups: SRT is evaluated on StSi, StUi, UtSi, and UtUi settings using multiple safety benchmarks, alongside MM-Vet, MME, and L-Bench for utility.Safety uses benchmark-specific ASR or unsafe rate, while utility follows official benchmark scores.
Safety Main Results: Across all evaluated models and defenses, St-settings perform worse than Ut-settings, with unsafe generation exceeding 90% under some St-settings.This indicates that harmful intent conveyed through benign text remains especially challenging for existing defenses.
Safety Main Results: SRT consistently achieves the lowest unsafe generation rate in both StSi and StUi settings.The result supports transferring safety behaviors learned from unsafe-text scenarios to benign textual contexts.
Safety Main Results: SRT improves safety across model families and all four cross-modal settings, including evaluations on Qwen3-VL-32B and Gemma-3-27B-IT.On the larger models, SRT consistently improves safety on SIUO and FigStep.
Utility Evaluation: SRT maintains performance comparable to the original models on MM-Vet, MME, and L-Bench while outperforming most baselines.It achieves the best or tied-best MM-Vet scores on Qwen3-VL-8B and LLaVA-OneVision-7B, improves MME on InternVL2-8B, and remains competitive on L-Bench.
Safe Helpfulness and Ablation: SRT consistently improves safe helpfulness, indicating that its safety gains are not merely caused by indiscriminate refusal.The ablation shows that refusal-process and output-behavior supervision are complementary, while SRT offers a favorable safety-utility trade-off.

6 Related Work

Related work includes training-stage and inference-stage safety alignment, while representation steering modifies internal activations without full fine-tuning. This paper instead transfers safety capability from explicit unsafe-text cases to cross-modal failures.

Training-Stage Methods: Training-stage methods strengthen MLLM safety with curated supervision but require additional training and depend on safety-data coverage.VLGuard and SPA-VL exemplify this direction.
Inference-Stage Methods: Inference-stage methods target specific failures without full-model updates, but may increase latency or reduce helpfulness through defensive processing.Examples include captioning, detection, and defensive prompts.
Cross-Modal Safety Drift: Existing methods struggle to elicit safety awareness in compositional-risk settings such as StSi →U.The paper therefore focuses on improving safety across cross-modal settings.
Representation Steering: Representation steering can regulate unsafe behavior without full fine-tuning, but prior methods mainly derive signals from risk-specific activations, auxiliary estimators, or modality shifts.This work uses steering as a transfer mechanism instead, extracting safety capability from explicit unsafe-text behavior.

7 Conclusion

This work studies cross-modal safety drift, where MLLMs become less safe when harmful intent is conveyed through image-text grounding despite reliably refusing explicit harmful text. It proposes SRT and reports improved safety while preserving utility across cross-modal settings.

The paper characterizes cross-modal safety drift as reduced safety when harmful intent is conveyed through image-text grounding rather than explicit harmful text.
SRT improves MLLM safety across different cross-modal settings while preserving model utility.

Limitations

SRT depends on extracting meaningful safety-awareness directions from harmful-text activations and has uncertain generalization beyond the evaluated MLLM families.

SRT assumes that harmful-text-induced activation directions contain a meaningful raw safety-awareness representation v0.
If a base MLLM cannot reliably refuse explicit harmful-text requests, selecting and refining an effective v0 becomes difficult.
SRT’s generalization to broader architectures remains uncertain because models may encode refusal computation in different layers or internal safety mechanisms.

Ethics Statement

The work aims to reduce harmful responses under cross-modal risks, but its method requires harmful data and may not eliminate unsafe responses in every case.

SRT requires harmful data for activation extraction and may still produce unsafe responses in some cases.
The paper includes unsafe image-text inputs and model responses that may be disturbing or sensitive to some readers.

A More Empirical Analysis

The empirical analysis identifies two cross-modal safety failure modes: overlooking visual risk cues and failing to connect recognized content to safety decisions. It also describes the evaluation datasets, utility checks, baselines, and activation-direction analysis used in the study.

Failure patterns: MLLMs exhibit visual risk unawareness by overlooking image cues that change the safety implication of benign textual requests.
Failure patterns: MLLMs exhibit safety implication unawareness by perceiving relevant content without connecting it to safety-aligned decision making.
Activation analysis: The analysis extracts activation directions by contrasting harmful-text and benign-sample mean activations, then tests their effects through hidden-state intervention.
Refusal measurement: Refusal tendency is measured from next-token probabilities over refusal-related tokens and converted into a log-odds score.
Safety benchmarks: HoliSafe covers five image-text safeness combinations, while SIUO targets individually safe modalities whose joint semantics induce unsafe outputs.
Safety benchmarks: VLSBench, MM-SafetyBench, and FigStep evaluate risks primarily conveyed through unsafe visual content while accompanying text appears benign or instruction-like.
Utility evaluation: MM-Vet, MME, and L-Bench assess whether SRT preserves multimodal reasoning, perception, and benign visual instruction-following abilities.
Baselines: ETA, DTR, and ShiftDC provide inference-time or training-free safety-alignment baselines for comparison.

E Implementation Details

Experiments use official model weights, processors, and chat templates across several MLLMs, with benchmark-specific utility evaluation and human validation. SRT’s inference overhead is minimal, and its safety and utility remain stable across reduced training-set sizes.

Models: Experiments evaluate Qwen3-VL-8B-Instruct, Gemma-3-12B-IT, InternVL2-8B, and LLaVA-OneVision-7B, plus larger Qwen3-VL-32B and Gemma-3-27B-IT models.Official model weights, processors, and chat templates are used; greedy decoding is applied unless otherwise specified.
Evaluation: Utility evaluation follows each benchmark’s official protocol, using GPT-4o-mini for MM-Vet and GPT-4.1 for L-Bench.MME is scored by matching yes/no answers against ground-truth labels.
Human Validation: 95.65% agreement is achieved between human majority labels and GPT-4o-mini judgments on 351 of 367 responses.The comparison uses a sampled subset of VLSBench and three annotators.
Training-Set Sensitivity: SRT maintains comparable safety and utility across 25%, 50%, and 100% training-set sizes.The selected initial safety-awareness direction remains at the same layer and position across these settings.

F.2 Sensitivity to Training Domain

SRT transfers across different cross-modal training domains while preserving comparable safety and utility. Refinement reduces disturbance on benign samples, strengthens refusal on risky samples, and improves responses in representative visual-risk and safety-implication cases.

Training Domain: VLSBench emphasizes safe-text and unsafe-image cases, whereas SIUO contains individually safe text and images that become unsafe through cross-modal composition.SRT trained with SIUO is evaluated on VLSBench, FigStep, and L-Bench.
Training Domain: SRT trained with SIUO achieves performance comparable to its VLSBench-trained counterpart across the evaluated safety and utility benchmarks.The results suggest limited sensitivity to the specific training domain and transfer across different cross-modal risk settings.
Training Dynamics: On benign samples, KL and effect scores consistently decrease during SRT refinement, indicating less disturbance to normal VQA behavior.The refinement uses joint refusal-process and output-behavior supervision.
Training Dynamics: On risky samples, refusal scores increase while the refined direction produces stronger harmful-token attention at refusal layers than the raw direction.The contrastive constraint discards broad perturbations and retains components contributing to safety awareness.
Efficiency: SRT remains efficient, with latency close to the vanilla base model and lower overhead than other inference-time methods.The intervention operates at the activation level without additional decoding, image captioning, or optimization.
Case Studies: In StUi and StSi case studies, SRT recognizes visual risk or its safety implications and refuses or redirects guidance that the base model provides.Examples include firearm modification, dangerous visual context, a limb-difference mismatch, and extreme-eating promotion.