Understanding In-Context Multimodal Jailbreaks via Posterior Reweighting

Xu Zhang; Dev Mistry; Xiang Xu; Ren Wang

Source-linked AI summary

Understanding In-Context Multimodal Jailbreaks via Posterior Reweighting

Xu Zhang, Dev Mistry, Xiang Xu, Ren Wang

arXiv:2609.10613v1Sep 8, 2026cs.CRcs.LG

TL;DR

In-context multimodal jailbreaks lack a principled account of how demonstrations shift safety-aligned behavior. This paper models those shifts as posterior reweighting and introduces adaptive benign counter-evidence, consistently improving the robustness–utility trade-off across datasets and models without retraining.

Problem
Existing work shows empirical jailbreak effectiveness but lacks mechanistic understanding of how demonstrations reweight safe versus harmful behavior and when defenses should intervene.
Method
The paper models aligned MLLMs as competing safe and harmful latent modes, then uses risk-gated benign demonstrations as inference-time counter-evidence.
Results
The framework yields predictable jailbreak scaling laws and consistently improves the robustness–utility trade-off across multiple datasets and models without retraining.
Takeaways & Limitations
Posterior reweighting provides a unifying framework for understanding and mitigating in-context multimodal jailbreaks.
Takeaways & Limitations
Unconditional benign injection consistently degrades utility; QWEN3-VL-30B-A3B’s average performance drops from 79.1 to 76.8 after eight demonstrations.

Abstract

from arXiv · show

In-context learning (ICL) jailbreaks reveal a critical vulnerability in multimodal large language models (MLLMs): harmful demonstrations in the prompt can induce unsafe outputs without modifying model parameters. Despite extensive empirical evidence, existing work lacks a principled understanding of why such jailbreaks reliably succeed or how their effectiveness scales with context composition. We propose a posterior reweighting framework that models a safety-aligned MLLM as implicitly operating over competing behavioral modes, and interprets in-context demonstrations as inference-time evidence that dynamically shifts the model's posterior preference between safe and harmful behaviors. This view formalizes jailbreak as a process of evidence accumulation, yielding predictive scaling laws with respect to demonstration count, harmful ratio, adversarial strength, and semantic diversity. Guided by this framework, we introduce a posterior-aware inference-time defense that adaptively injects benign counter-evidence based on estimated risk, effectively suppressing harmful posterior drift while preserving model utility. Compared to existing in-context defenses, our method achieves a significantly improved robustness-utility trade-off under a fixed intervention budget. Together, our results establish posterior reweighting as a unifying and predictive framework for understanding and mitigating ICL jailbreak in MLLMs.

1 INTRODUCTION

The paper addresses the limited mechanistic understanding of how in-context demonstrations erode safety alignment in multimodal jailbreaks. It models demonstrations as inference-time evidence that reweights safe and harmful generation modes, motivating a gated posterior-aware defense.

Motivation: The work targets a gap in prior studies, which establish empirical jailbreak effectiveness but provide limited mechanistic understanding of safety-alignment erosion during in-context learning.The unresolved issue is how demonstrations reweight a safety-aligned model’s internal preference between safe and harmful behaviors.
Posterior reweighting framework: The posterior reweighting framework explains multimodal jailbreaks as demonstrations shifting an MLLM from safe toward harmful latent generation modes.Each demonstration serves as inference-time evidence that reinforces either safe behavior, such as refusal, or harmful behavior.
Posterior-aware defense: The posterior-aware defense injects benign demonstrations only in uncertain risk regimes identified by a harmfulness detector.Gated intervention is intended to suppress jailbreaks while avoiding the excessive refusal and utility degradation associated with unconditional benign injection.
Predictive scaling laws: The framework yields testable scaling predictions for how jailbreak success varies with harmful demonstrations and their composition.The contribution explicitly presents predictive scaling laws for jailbreak behavior rather than only categorizing attack constructions.

2 RELATED WORK

Prior work frames multimodal jailbreaks as attacks exploiting visual inputs, interprets in-context learning through inference-time mechanisms, and develops both training-time and inference-time MLLM defenses.

Attacks on Multimodal Large Language Models: Visual inputs expand MLLM attack surfaces beyond text-only jailbreaks, with prior attacks commonly categorized as perturbation-based or structure-based.
In-Context Learning Theory: A dominant theory views in-context learning as Bayesian inference, where demonstrations provide evidence for implicit posterior inference over latent task variables.
Defenses for Multimodal Large Language Models: MLLM defenses include training-time alignment through supervised fine-tuning or harmfulness detection, alongside lightweight inference-time interventions that avoid modifying model parameters.

3 A POSTERIOR REWEIGHTING FRAMEWORK FOR ICL-BASED JAILBREAK

The framework models ICL jailbreaks as posterior shifts between latent harmful and safe generation modes, with demonstrations accumulating evidence that changes harmful-mode preference. It predicts how jailbreak effectiveness scales with demonstration count, harmful ratio, strength, and semantic diversity, and is empirically supported by model-selection results favoring two components.

Latent-mode formulation: The model represents aligned MLLMs as mixtures of harmful and safe latent generation modes, with safety alignment reducing but not eliminating the harmful-mode prior.The harmful mode assigns higher probability to harmful outputs, while the safe mode more often generates safe outputs.
Posterior reweighting: ICL jailbreak success is governed by posterior mass on the harmful mode, which contexts shift by accumulating demonstrations’ log-likelihood evidence against the alignment prior.The posterior log-odds combine the alignment prior with cumulative contextual evidence.
Scaling laws: More harmful demonstrations monotonically increase jailbreak probability with sigmoid saturation, while increasing the harmful ratio raises success likelihood at fixed context size.Benign demonstrations provide counter-evidence that offsets harmful-mode evidence.
Scaling laws: Stronger harmful demonstrations produce larger posterior shifts and higher jailbreak likelihood across visual, textual, and multimodal attack signals.Increasing demonstration evidence strength increases the positive contributions toward the harmful mode.
Scaling laws: Greater semantic diversity improves jailbreak effectiveness by reducing redundancy and enabling harmful demonstrations to contribute more independent posterior evidence.The framework models this effect with redundancy-corrected posterior log-odds.
Empirical validation: 96812.74 BIC for the two-component model is lower than the single-component model’s 100988.35 and the three- and four-component models’ 100323.18 and 104936.12.The comparison indicates that a single mode is insufficient to capture realistic model behavior.

4 POSTERIOR-AWARE INFERENCE-TIME DEFENSE

The section motivates selective intervention by showing that unconditional benign demonstrations degrade utility, then introduces a posterior-aware defense that gates benign injection using estimated harmfulness.

Limitation of Unconditional Injection: Unconditional injection causes utility degradation across evaluated MLLMs, motivating selective rather than uniform intervention.After eight benign demonstrations, QWEN3-VL-8B falls from 72.1 to 70.4, while QWEN3-VL-2B’s average score drops from 59.2 to 56.1 and OCRBENCH from 808 to 770.
Adaptive Posterior-Aware Defense: The proposed defense uses a lightweight harmfulness detector to estimate input risk and condition benign-demonstration injection without participating in response generation.The detector maps the target input and context to a scalar score in [0, 1] and operates independently of the base MLLM.
Gated Injection Rule: Benign demonstrations are injected only for intermediate-risk inputs, while low-risk inputs remain unchanged and high-risk inputs may be refused.The rule injects demonstrations when τℓ ≤ u(xt, C) ≤ τu, preserves the original posterior below τℓ, and permits direct refusal above τu.
Learning the Gating Thresholds: The gating thresholds are learned with a lightweight two-layer network using a differentiable objective that balances benign-task utility and safe behavior on harmful inputs.The objective includes utility loss on benign Q&A data, refusal-oriented loss on harmful inputs, and a balancing parameter µ.

5 EXPERIMENTS

Experiments show that harmful-context jailbreak success scales monotonically with demonstration quantity, harmful ratio, attack strength, and semantic diversity. The same evidence-accumulation behavior persists across dialogue turns, while increasing the gating parameter reduces ASR with stable utility up to μ = 0.7.

Scaling Effects: ASR increases monotonically with harmful demonstration count k, harmful ratio r, attack strength, and semantic diversity m across evaluated models and modalities.These trends support posterior reweighting through accumulated likelihood evidence, while benign demonstrations provide counter-evidence.
Effect of the Harmful Demonstration Ratio: Increasing the harmful demonstration ratio r shifts the posterior toward harmful generation, whereas benign demonstrations suppress this shift.The proposed interpretation attributes this behavior to likelihood-ratio accumulation from context composition.
Multi-turn Jailbreak: Multi-turn jailbreaks on Qwen3-VL-8B retain the single-turn monotonic scaling pattern, indicating that accumulated evidence matters more than its temporal placement.The demonstrations are distributed across dialogue turns without changing their set.
Gated Defense: Increasing μ consistently reduces ASR across image, text, and mixed attacks while utility remains largely stable through μ = 0.7.The experiments therefore select μ = 0.7 as the default utility–robustness balance.

6 CONCLUSION

The paper frames in-context multimodal jailbreaks as posterior shifts between safe and harmful modes, with predictable scaling laws, and introduces a posterior-aware defense using benign counter-evidence. It also documents controlled defensive evaluation and reproducibility resources.

6 CONCLUSION: The posterior reweighting framework explains in-context multimodal jailbreaks as shifts between latent safe and harmful generation modes with predictable scaling laws.The framework unifies diverse empirical observations about jailbreak effectiveness.
6 CONCLUSION: The posterior-aware inference-time defense injects benign demonstrations as counter-evidence and improves the robustness–utility trade-off across multiple settings.The defense is designed to suppress harmful posterior shifts while preserving utility.
6 CONCLUSION: The study restricts harmful-prompt evaluation to controlled benchmark settings and focuses on defensive analysis and mitigation to address dual-use risks.Experiments use public datasets or model-generated inputs and involve no human subjects or personally identifiable information.
6 CONCLUSION: Detailed settings, ablations, robustness evaluations, theoretical derivations, and anonymous source code are provided to facilitate independent reproduction.The appendix covers datasets, models, attack configurations, defense baselines, metrics, detector training, and gating procedures.

A APPENDIX · A.1 PROOFS OF THEORETICAL RESULTS

The appendix proves that benign demonstrations downweight the harmful latent mode and derives the harmful-mode posterior from posterior log-odds through a sigmoid transformation.

A.1 PROOFS OF THEORETICAL RESULTS: The mode-harmfulness assumption posits harmful-output propensity ph greater than ps for harmful and safe latent modes, respectively.This assumption establishes that the latent modes differ in their propensity to generate harmful outputs.
A.1 PROOFS OF THEORETICAL RESULTS: Benign demonstrations provide safety-aligned evidence because their responses are more likely under the safe mode, reducing the harmful-mode posterior.The appendix interprets benign demonstrations as evidence that downweights the harmful mode.
A.1 PROOFS OF THEORETICAL RESULTS: Proposition 1 applies the law of total probability over the latent mode Z and bounds the conditional terms using the mode-harmfulness assumption.The proof proceeds by decomposing the outcome probability across the harmful and safe modes.
A.1 PROOFS OF THEORETICAL RESULTS: The resulting expression is ph Pr(Z = h | C)+ps Pr(Z = s | C) = ps +(ph −ps) Pr(Z = h | C).This identity completes the proposition's proof by expressing harmful-output probability through the harmful-mode posterior.
A.1 PROOFS OF THEORETICAL RESULTS: The appendix defines the posterior log-odds L(C) as the logarithm of the harmful-mode posterior odds and uses Pr(Z = s | C) = 1 −Pr(Z = h | C).The derivation starts from the posterior odds and rewrites the safe-mode probability as the complement of the harmful-mode probability.
A.1 PROOFS OF THEORETICAL RESULTS: Exponentiating L(C) gives exp(L(C)) = Pr(Z = h | C) 1 −Pr(Z = h | C), the harmful-to-safe posterior odds.This step converts the logarithmic odds definition into a direct posterior-odds relationship.
A.1 PROOFS OF THEORETICAL RESULTS: Solving the odds equation yields Pr(Z = h | C) = exp(L(C)) 1 + exp(L(C)) = σ(L(C)).Thus, the harmful-mode posterior is represented as the sigmoid of the posterior log-odds.

A.2 QUANTITATIVE VALIDATION OF THE PREDICTED SCALING LAW

The fitted sigmoid scaling law generalizes from calibration measurements to held-out configurations, with measured jailbreak success rates closely tracking predictions across image, text, and mixed-modal attacks.

Evaluation design: Validation uses disjoint calibration and held-out subsets to assess predictive accuracy on configurations not used for fitting.The calibration subset estimates scaling-law parameters, while the separate validation subset evaluates out-of-sample performance.
Scaling-law model: The model predicts jailbreak success from harmful demonstration count, harmful ratio, adversarial strength, and distinct harmful-category count.Parameters are estimated by logistic regression using only the calibration measurements and then fixed for held-out prediction.
Out-of-sample validation: Held-out attack success rates closely follow the sigmoid relationship predicted from calibration data across image, text, and mixed-modal jailbreak configurations.Prediction errors are computed exclusively on the disjoint validation subset, rather than on measurements used for fitting.

A.3 DESIGN CONSIDERATIONS

The defense is designed to preserve in-context generalization by avoiding direct modification or deletion of user-supplied context, which could disrupt prompt semantics and reduce utility. However, it may be less effective against highly diverse harmful demonstrations because fixed benign counter-evidence may not be sufficiently targeted.

Preserving in-context generalization: The defense prioritizes preserving in-context generalization rather than removing or filtering harmful demonstrations, since modifying user context could disrupt prompt semantics and degrade utility.
Limitations under high semantic diversity: High semantic diversity among harmful demonstrations can reduce defense effectiveness because fixed benign demonstrations may provide insufficiently targeted counter-evidence.
Limitations under high semantic diversity: Category-aware benign injection is identified as a possible mitigation, requiring finer-grained harmfulness classification and adaptive benign-demonstration selection, but is not adopted.

A.4 EXPERIMENTAL SETUP

The experiments evaluate multimodal utility and jailbreak defenses across diverse benchmarks, models, attack modalities, baselines, and risk-gated inference settings. Jailbreak effectiveness is measured by ASR, while utility is summarized by average multimodal benchmark performance.

Datasets: Utility is evaluated with OpenCompass across MMBench V1.1, MMStar, MMMU, MathVista, OCRBench, and MMVet, covering broad multimodal reasoning capabilities.The benchmark suite spans general understanding, visual reasoning, mathematics, hallucination detection, document understanding, OCR, and task-oriented reasoning.
Datasets: Jailbreak and defense effectiveness are assessed with SafetyBench, AdvBench, and JailbreakBench, including 13 prohibited scenarios defined from OpenAI usage policies.SafetyBench covers risks including illegal activity, hate speech, malware, physical harm, fraud, privacy violations, and medical or legal advice.
Models: The evaluation spans open-weight Qwen3-VL and Kimi-VL models alongside proprietary GPT-5.4 and Gemini 3.5 Flash models.The models cover different parameter scales, architectures, and access settings to assess whether jailbreak behavior generalizes beyond publicly available models.
Attack Configurations: Attacks include image-based, text-based, and mixed-modal jailbreaks, with proprietary-model perturbations transferred from a MiniGPT-4/Vicuna-13B surrogate.The default configuration uses k = 8 fully harmful demonstrations across four harmful categories.
Baselines and Metrics: Defense comparisons inject five benign demonstrations and include ICD, unconditional benign injection, and AdaShield, while ASR and average benchmark score measure robustness and utility.ASR is the fraction of prohibited queries producing prohibited responses; utility is the average score across the multimodal benchmark suite.
Harmfulness Detector Training: The harmfulness detector is a CLIP-ViT-Base-Patch32 binary classifier trained on balanced harmful and benign examples, with sigmoid relaxation during training and hard thresholding at inference.The training set contains 520 harmful GPT-5 inputs and 520 benign OK-VQA inputs; the relaxation uses κ = 10 unless otherwise specified.

A.5 ADDITIONAL MULTI-TURN RESULTS ON OTHER MLLMS … A.11 INFERENCE LATENCY OVERHEAD

Across additional MLLMs and attack settings, harmful-context scaling consistently increases jailbreak effectiveness, while the proposed risk-gated defense lowers ASR with near-baseline utility. Ablations, adaptive-attack tests, qualitative examples, and latency measurements further characterize its mechanisms, robustness, and modest overhead.

A.5 ADDITIONAL MULTI-TURN RESULTS ON OTHER MLLMS: Across open-weight and proprietary MLLMs, increasing harmful demonstrations, adversarial strength, or semantic diversity generally raises ASR across attack modalities.Examples include mixed-modal ASR rising from 29.74% to 60.97% on Qwen3-VL-2B as k increases, and from 41.06% to 67.03% on Qwen3-VL-30B-A3B as adversarial strength increases.
A.6 ADDITIONAL DEFENSE RESULTS ON OTHER MLLMS: The gated defense consistently achieves the lowest ASR across additional MLLMs while preserving utility close to the no-defense baseline, outperforming AdaShield and ECSO.On Qwen3-VL-2B, ASR falls from 67.61% to 33.85% with a 0.3-point utility drop; on Qwen3-VL-30B-A3B, it falls from 51.87% to 24.40% with a 0.2-point drop.
A.7 DEFENSE EVALUATION UNDER FIGSTEP: Against FigStep, the proposed defense achieves the lowest ASR across evaluated models while keeping utility close to the no-defense baseline.The evaluation uses a structure-based multimodal jailbreak that embeds harmful instructions into visual inputs.
A.8 QUALITATIVE EXAMPLES: Risk-gated benign injection succeeds when harmful evidence is concentrated, but becomes less effective as harmful demonstrations span more diverse categories.Figure 4 compares contexts containing harmful demonstrations from two versus four distinct harmful categories under the same query.
A.9 ABLATION STUDY OF THE RISK-GATING MECHANISM: The detector remains robust across thresholds from 0.3 to 0.7, while component ablations separately assess benign injection and direct refusal within the gating policy.The ablation evaluates detector FNR, FPR, accuracy, and F1, and measures ASR after removing either defense component on Qwen3-VL-8B.
A.10 DETECTOR ROBUSTNESS UNDER ADAPTIVE ATTACKS: Under detector-aware adaptive attacks, ASR increases with perturbation budget, but a robustified detector at ϵ = 16 reduces Qwen3-VL-8B image-attack ASR from 46.80% to 40.79%.The results indicate graceful degradation and partial recovery from stronger perturbations through detector robustness.
A.11 INFERENCE LATENCY OVERHEAD: The defense adds modest end-to-end latency overhead, with relative overhead decreasing from 17.6% on Qwen3-VL-2B to 9.4% on Qwen3-VL-30B-A3B.Latency is reported as average per-sample inference time with and without defense across target MLLMs.