Source-linked AI summary
UnifiedAttack: Evaluating the Safety of Large Multimodal Models in Synergistic Harmful Image-Text Generation
Bingjun Luo, Jialin Guo, Tony Wang, Siqi Li
TL;DR
Conventional safety evaluations often miss harmfulness amplified by coordinated text and images in large multimodal models. UnifiedAttack benchmarks this cross-modal risk and uses a synergistic hijacking framework to test models. The reported evaluations show vulnerabilities across state-of-the-art models, including shifts toward higher severity under attack.
Problem
Existing benchmarks primarily assess unimodal toxicity or basic text-image consistency, leaving harmfulness gain from cross-modal synergy under-evaluated.
Source: §1 · p. 1, §2.2 · p. 3Method
UnifiedAttack combines a benchmark of filtered and synthesized queries with In-Context Reskinning and Cognitive Planning Injection to probe synergistic harmful generation.
Source: §1 · p. 2Results
Evaluations report that the attack exposes vulnerabilities across state-of-the-art multimodal models and shifts Gemini 2.5 and GPT-4.1 severity scores toward the highest threat tiers.
Source: §1 · p. 2, §5.3 · p. 8Takeaways & Limitations
The paper concludes that instruction-following and logical-coherence mechanisms can be exploited to bypass safety alignment in synergistic harmful generation.
Source: §6 · p. 9The evaluation assumes a strict black-box setting in which the adversary lacks access to model weights, gradients, and training data.
Source: §4.1 · p. 6
Abstract
from arXiv · showhide
As Large Multimodal Models (LMMs) transition toward natively unified architectures, evaluating their safety in synergistic harmful image-text generation tasks becomes a critical challenge. Unlike unimodal threats, synergistic risks emerge when text and image modalities are coordinated to produce harm that significantly exceeds their individual components. We introduce UnifiedAttack, a novel benchmark designed to evaluate LMM safety in collaborative scenarios by focusing on the harmfulness gain achieved through cross-modal synergy. The benchmark incorporates samples filtered for their multimodal potential alongside a novel subset of synthesized disinformation queries. To verify identified vulnerabilities, we propose a synergistic hijacking framework featuring In-Context Reskinning (ICR) and Cognitive Planning Injection (CPI). ICR utilizes few-shot learning to wrap adversarial intent in benign virtual shells to desensitize safety filters, while CPI hijacks the reasoning path by enforcing a plan-then-execute paradigm. By compelling the system to commit to a neutral logical plan, we exploit its internal drive for consistency to induce the synchronized generation of harmful multimodal content. Extensive evaluations on state-of-the-art architectures demonstrate that UnifiedAttack consistently bypasses modern alignment. Our findings reveal that the structural helpfulness and logical coherence of unified models can be systematically weaponized, highlighting the urgent need for logic-aware defenses in synergistic generation tasks. Code is available at https://github.com/bingjunluo/UnifiedAttack .
1 INTRODUCTION
Unified models’ combined understanding and generation capabilities create synergistic risks that conventional unimodal benchmarks do not measure. UnifiedAttack benchmarks harmfulness gain and pairs it with a hijacking method to probe alignment vulnerabilities.
1 INTRODUCTION
- Existing safety benchmarks often miss how coordinated text and images can amplify harm beyond either modality alone.The paper argues that this gap makes it difficult to assess vulnerabilities in systems that fuse multimodal understanding and generation.Source: §1 · pp. 1–2
- UnifiedAttack contains 495 queries, including 92 synthesized disinformation samples and 403 filtered samples, across seven safety categories.The benchmark filters for queries where adding images to text produces a significant harmfulness gain.Source: §1 · p. 2
- The synergistic hijacking method combines In-Context Reskinning (ICR) with Cognitive Planning Injection (CPI) to exploit safety alignment.ICR wraps adversarial intent in benign virtual shells; CPI uses a plan-then-execute structure to induce harmful execution.Source: §1 · p. 2
- UnifiedAttack achieves synergistic harmful generation and evades downstream filters on state-of-the-art multimodal models using stylistic proxy descriptions.The paper presents this as empirical evidence of vulnerabilities in modern alignment.Source: §1 · p. 2
2 RELATED WORK
The related work describes advances in multimodal architectures alongside attack and evaluation approaches that largely treat understanding and generation separately. UnifiedAttack addresses the resulting gap by evaluating harmfulness gain from cross-modal synergy.
2.1 MULTIMODAL LARGE LANGUAGE MODELS
- Recent MLLMs span feature-level fusion, shared-token Transformers, and specialized processing paths, while their combined capabilities expose synergistic attack surfaces.The section names BLIP-2 and LLaVA, Chameleon and Emu3, and Janus and Show-o as examples of these architectures.Source: §2.1 · p. 3
2.2 SAFETY EVALUATION OF MLLMS
- Prior safety work targets attacks on multimodal understanding or generation, while UnifiedAttack evaluates harmfulness gain when text and images work together.The section notes that current benchmarks focus on unimodal toxicity or basic text-image consistency checks.Source: §2.2 · p. 3
3 THE UNIFIEDATTACK BENCHMARK
UnifiedAttack evaluates harmfulness gain when text and imagery work together, using a benchmark screened for synergistic potential. Its construction combines pre-generation screening, refined safety queries, and synthesized visual-disinformation cases.
3.1 HEURISTIC ASSESSMENT OF SYNERGISTIC POTENTIAL
- The benchmark screens for visual contributions that add harmful how-to guidance or proof, and assesses whether visuals are necessary before generation.A high-capability LLM serves as a controlled safety evaluator; queries requiring a visual schematic to be fully actionable are retained as synergistic tests.Source: §3.1 · pp. 3–4
3.2 SCREENING FRAMEWORK AND EVALUATIVE CRITERIA
- Screening retains queries where visuals are necessary and tangibly benefit the harmful objective, while excluding content beyond reliable generative capabilities.Examples of rejected content include intricate multi-step diagrams and images with dense labeled text.Source: §3.2 · p. 4
3.3 DATA COMPOSITION AND TAXONOMIC DISTRIBUTION
- The benchmark contains 495 screened queries across seven categories, combining 403 filtered MM-SafetyBench samples with 92 synthesized visual-disinformation queries.The disinformation cases target fake evidence such as forged documents, fabricated medical records, or staged surveillance footage supporting harmful narratives.Source: §3.3 · pp. 4–5
3.4 COMPARISON WITH EXISTING BENCHMARKS
- UnifiedAttack evaluates text-only prompts that elicit both actionable procedures and corresponding visual schematics, targeting coordinated cross-modal amplification.The paper describes it as the only benchmark engineered to measure this harmfulness gain.Source: §3.4 · p. 5, Table 1 · p. 5
4 SYNERGISTIC HIJACKING FRAMEWORK
The Synergistic Hijacking Framework targets composite text-image outputs whose joint harmfulness exceeds either modality alone. It combines a benign prompt shell with plan-then-execute generation to steer LMMs toward synchronized harmful content.
4.1 PROBLEM FORMULATION AND THREAT MODEL
- The threat model defines synergistically harmful outputs as composite text-image outputs whose joint actionable intent exceeds either modality alone, while requiring each component to remain below output-filter detection thresholds.The adversary operates through the public language interface without access to model weights, gradients, or training data.Source: §4.1 · p. 6
4.2 METHOD OVERVIEW
- The framework uses In-Context Reskinning followed by Cognitive Planning Injection to desensitize input filters, then steer generation toward synchronized harmful text and visual schematics.ICR wraps the target in a benign research or fictional persona; CPI first elicits a neutral plan and then compels execution for consistency.Source: §4.2 · p. 6
4.3 IN-CONTEXT RESKINNING
- ICR constructs a reskinned prompt by concatenating a system persona, few-shot demonstrations, and the target query.The demonstrations pair hypothetical queries with benign structured responses, establishing an analytical pattern for the model to emulate.Source: §4.3 · p. 6
4.4 COGNITIVE PLANNING INJECTION
- CPI structures output as a cognitive plan, a final procedure, and a visual prompt, linking the text procedure with an image that complements it.The plan and procedure form the textual component, while the visual prompt supplies a semantic specification to the decoder.Source: §4.4 · p. 7
5 EXPERIMENTS
The experiments assess synergistic attacks across five multimodal models using multimodal severity scoring. The results report increased attack success and severity versus standard baselines, with severity distributions shifting toward higher threat tiers for two models.
5.1 EXPERIMENTAL SETUP
- The experiments evaluate Gemini 2.0, Gemini 2.5, GPT-4o, GPT-4.1, and BAGEL on all 495 queries across seven safety domains.The evaluated systems are grouped as closed-source and open-source models.Source: §5.1 · p. 7
5.2 EVALUATION METRICS
- The evaluation uses GPT-4o-mini to assess multimodal outputs, assigning verified refusals zero and scoring non-refusals from 0 to 10.Severity scoring considers real-world harm potential, actionability, and visual amplification.Source: §5.2 · pp. 7–8
5.3 MAIN RESULTS
- The attack consistently raises attack success rates and severity scores versus standard baselines across evaluated multimodal models.Table 2 reports attack success rate (ASR) and average severity score (Score; 0–10) across five models.Source: Table 2 · p. 8, §5.3 · p. 8
- For Gemini 2.5 and GPT-4.1, severity distributions shift from low-risk baselines toward the highest threat tiers under attack.The paper characterizes the resulting content as highly actionable rather than marginal policy violations.Source: §5.3 · p. 8, Figure 3 · p. 9
6 CONCLUSION
The conclusion presents UnifiedAttack as exposing synergistic-generation vulnerabilities that conventional unimodal assessments miss. It reports that instruction-following and logical coherence can be exploited to bypass alignment, and calls for holistic, logic-aware alignment techniques.
6 CONCLUSION
- UnifiedAttack exposes vulnerabilities in synergistic harmful generation that conventional unimodal safety assessments do not detect.The conclusion calls for holistic, logic-aware alignment techniques that scrutinize semantic intent across modalities.Source: §6 · p. 9
- In-Context Reskinning and Cognitive Planning Injection exploit instruction-following and logical coherence to bypass safety alignment.The conclusion reports that models with stronger reasoning capabilities are often more susceptible to trajectory hijacking.Source: §6 · p. 9
- The authors used GPT-4o for benchmark filtering and GPT-4o-mini to assist evaluation, reviewed AI-assisted work, and take responsibility for the final artifacts.Gemini was used to refine the clarity and consistency of filtering and evaluation prompts.Source: AI USE STATEMENT · p. 10