CASA: Classification Augmented with Safety Attention for Robust Multimodal Alignment

Anurag Kumar; Raghuveer Peri; Jon Burnsky; Alexandru Nelus; Rohit Paturi; Srikanth Vishnubhotla; Yanjun Qi

cs.LGMar 31, 2026

CASA: Classification Augmented with Safety Attention for Robust Multimodal Alignment

Authors: Anurag Kumar, Raghuveer Peri, Jon Burnsky, Alexandru Nelus, Rohit Paturi, Srikanth Vishnubhotla, Yanjun Qi

Organizations: The Ohio State University · AWS

Abstract

Multimodal large-language models (MLLMs) often experience degraded safety alignment when harmful queries exploit cross-modal interactions. Models aligned on text alone show a higher rate of successful attacks when extended to two or more modalities. We propose a simple conditional decoding strategy, CASA (Classification Augmented with Safety Attention) that uses internal representations of MLLMs to predict a binary safety token before response generation. The classification is guided by a safety attention mechanism that computes attention between a dedicated query prompt and the input to scale the classification logits, sharpening the model's ability to detect malicious queries. Our design ensures robust safety alignment without relying on any external classifier or auxiliary head, and without modality-specific safety fine-tuning. Unlike prior safety-decoding methods that attach an external classifier or moderation head, or rescale every generated token with a reward model, CASA makes a single, internal, attention-gated safety decision over the shared multimodal representation, which is precisely what lets safety learned from text-only training transfer to image and audio inputs. Compared against 4 baseline models across 7 attack types spanning text, image, and audio modalities, evaluated on benchmarks such as MM-SafetyBench, JailbreakV-28k, and adversarial audio tests, CASA lowers the average attack success rate by >90% relative when paired with a standard safety prompt (applied to all baselines for fair comparison), and by 54--61% using its internal safety mechanism alone. Our empirical evaluations also show that CASA~maintains strong utility on benign inputs, validated through both automated and human evaluations (via 13 trained annotators). Together, these results highlight CASA as a simple and generalizable framework to improve multimodal LLM safety.

Figures & tables

Figure 1: Overall architecture of CASA. LLM is trained to produce safety token before response generation. Temporally aggregated cross attention scores, $v_{s}$ computed between the prompt hidden states ( $h_{p}$ ) and query embedding $E_{s}^{q}$ (derived from the frozen pretrained model) are used to scale the safety token logit values at timestep $t_{safety}$ . B refers to the batch size during decoding.

Method	Decision signal	External module?	Granularity	Cross-modal transfer
SafeDecoding / DSTT	fixed refusal-token prior (text)	No	first token(s)	text-centric
GradSafe / SafeQuant	gradient features	classifier	prompt-level	not designed for
MLLM-Protector / VLGuard / Llama Guard-V	separate safety model	Yes	prompt / response	via multimodal training data
Immune	external reward model	Yes	per token	inference-time rescoring
Circuit Breaker	representation rerouting	No (train-time)	global activations	indirect
CASA (ours)	learned attention gate over hidden states	No	first token only	native via shared representation; no modality-specific data

Table 1: Positioning of CASA against representative safety-decoding and safety-classification families. CASA combines a learned internal gate, first-token-only intervention, and no external module, which together support cross-modal transfer from text-only training.

	Pretrained		SSFT		CB		Immune		DSTT		CASA
Attack	w/o	w/	w/o	w/	w/o	w/	w/o	w/	w/o	w/	w/o	w/
OOD-Text	30.1	5.7	0.0	0.0	1.7	6.8	0.6	1.7	8.0	3.4	0.0	0.0
Prefill	72.2	6.8	51.9	72.3	61.0	68.0	26.1	23.6	10.1	4.7	0.57	0.73
CodeAttack	31.1	69.7	75.8	5.3	29.4	0.0	86.2	25.2	89.2	48.5	74.8	3.4
JB-Prompt	54.3	43.8	39.2	29.0	70.5	35.5	33.2	21.6	12.5	7.4	0.0	0.0
JBV	29.6	19.3	8.2	7.9	30.0	38.9	26.4	25.7	18.6	10.4	5.4	0.7

Table 2: % ASR (

\downarrow

) of various attacks on the 3B parameter base model. w/o: No Safety Prompt / w/: With Safety Prompt.

	Pretrained		SSFT		CB		Immune		DSTT		CASA
Attack	w/o	w/	w/o	w/	w/o	w/	w/o	w/	w/o	w/	w/o	w/
OOD-Text	7.4	1.1	0.0	0.0	0.0	0.6	2.3	4.0	3.4	4.0	0.0	0.0
Prefill	22.3	2.0	0.3	2.0	16.5	0.0	22.3	33.4	3.8	6.0	0.0	0.0
CodeAttack	59.8	65.3	83.1	74.6	3.6	19.1	83.3	54.9	58.1	35.4	39.6	0.0
JB-Prompt	27.6	19.9	0.0	0.0	0.3	0.0	12.5	3.4	17.6	19.0	0.0	0.6
JBV	33.6	23.6	8.2	5.4	1.4	2.9	10.4	5.0	11.4	13.2	1.8	0.0

Table 3: % ASR (

\downarrow

) of various attacks on the 7B parameter base model. w/o: No Safety Prompt / w/: With Safety Prompt.

Model	Safety Prompt	Safety Attn	JBV	JB Prompt	AIAH	Code Attack	MM- SB
3B	✗	✗	11.4	5.4	18.0	28.2	17.8
	✓	✗	8.2	2.6	17.6	1.3	9.0
	✗	✓	5.4	0.0	0.9	74.8	10.7
	✓	✓	0.7	0.0	0.8	3.4	1.0
7B	✗	✗	8.9	0.0	9.9	77.7	11.9
	✓	✗	3.2	0.0	10.1	50.8	2.8

Table 4: Ablation: Effect of safety attention on CASA. Attack Success Rate (% UNSAFE).

\downarrow

is better. Best value per row is mentioned in bold .

	Prefill Length
	2		4		9		12
Model	w/o	w/	w/o	w/	w/o	w/	w/o	w/
Pretrained	63.6	9.1	64.8	2.8	76.1	6.8	84.1	8.5
SSFT	68.8	67.0	17.6	36.4	42.6	89.2	78.4	96.6
CB	33.0	47.7	53.4	56.2	74.4	80.1	83.5	88.1
Immune	26.1	25.0	27.3	20.5	23.3	22.7	27.8	26.1

Table 5: Sensitivity analysis of prefill attack using %ASR (

\downarrow

) with varying number of tokens in the pre-fill. CASA shows near-perfect jailbreak defense even with longer prefills.

Figure 2: Utility on utility-text dataset. % responses determined by LLMaJ to be similar or better than pre-trained model. CASA is the best performing model along 3/5 dimensions with competitive utility on others.

Figure 3: Human preferences comparing pre-trained and CASA models’ responses. CASA has a higher or equal preference compared to pre-trained model.

	(3B)		(7B)
Model	Perception	Cognition	Perception	Cognition
Pretrained	1000.0	355.0	1417.3	503.2
SSFT	717.7	508.2	888.0	623.2
CB	586.6	462.5	1394.2	547.9
Immune	1585.4	508.6	1622.6	662.1
DSTT	304.2	132.9	210.3	183.2

Table 6: Multimodal utility performance of both Qwen_2.5_Omni 3B and 7B models on the MME benchmark Fu et al. (2025) . We report the total scores(

\uparrow

) across the two main categories of perception and cognition.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Dimension	Human $-$ Human	Human $-$ LLMaJ
Dimension	Krippendorff’s $\alpha$	Cohen’s $\kappa$
Safety	0.60	0.71
Utility	0.55	0.68

Appendix

Table 7: IAA metrics for safety alignment experiments. Krippendorff’s

\alpha

is calculated for the three human evaluators. Cohen’s

\kappa

is calculated for the aggregated (majority) human evaluation and the LLMaJ evaluation.

Figure 4: The plot visualizes the top two components of the PCA reduction done on the last hidden layer features obtained from the pre-trained and safety-aligned Qwen_2.5_Omni (3B) model. The safe and unsafe inputs were taken from the Harm-questions test set.

	Prefill Length
	2		4		9		12
Model	w/o	w/	w/o	w/	w/o	w/	w/o	w/
Pretrained	28.4	5.1	6.2	0.6	17.6	0.6	36.9	1.7
SSFT	0.0	4.5	0.0	0.0	0.0	0.6	1.1	2.8
CB	41.5	0.0	2.8	0.0	6.2	0.6	15.3	0.0
Immune	25.6	48.9	25.6	23.3	14.8	32.4	23.3	29.0

Appendix

Table 8: Sensitivity analysis of prefill attack using %ASR (

\downarrow

) with varying number of tokens in the pre-fill. This ablation was done using OOD-text test set on Qwen2.5Omni-7B model. CASA shows perfect jailbreak defense even with longer prefills.

Method	ms/ token	Overhead	Notes
Pretrained	47.8	1.00x	Baseline
CASA	51.1	$\sim$ 1.07x	Safety attn only at token 1
IMMUNE	114.5	2.40x	Reward model scores every token
DSTT	46.2	0.97x	Negligible (prior sample at token 1 only)

Appendix

Table 9: Per-token decoding cost for 3B models. Overhead is relative to the pretrained baseline.

Models	Safety Prompt	Qwen_2.5_Omni (3B)					Qwen_2.5_Omni (7B)
Models	Safety Prompt	Text	SD	Typo	SD-Typo	Avg (excl. Text)	Text	SD	Typo	SD-Typo	Avg (excl. Text)
Pretrained	✗	26.3	38.8	36.6	38.3	37.9	26.0	39.0	36.4	38.8	38.07
Pretrained	✓	11.6	28.4	18.1	30.8	25.8	5.8	23.6	20.7	23.4	22.57
SSFT	✗	1.7	4.3	3.4	14.9	7.6	2.4	8.4	6.0	11.8	8.76
SSFT	✓	0.2	1.5	0.5	12.3	4.7	1.0	4.1	1.9	2.2	2.73
CB	✗	0.5	6.0	4.1	5.1	5.1	4.3	8.4	3.4	4.3	5.38

Appendix

Table 10: Comprehensive evaluation for all the attack scenarios of MM-SafetyBench. All numbers shown here represent ASR.

Models	Safety Prompt	Qwen_2.5_Omni (3B)			Qwen_2.5_Omni (7B)
Models	Safety Prompt	Audio	Sil	Spell	Audio	Sil	Spell
Pretrained	✗	16.5	22.7	81.3	11.9	18.2	64.2
Pretrained	✓	1.1	1.7	67.6	6.3	3.4	42.6
SSFT	✗	0.6	0.0	71.0	0.0	0.0	25.0
SSFT	✓	0.0	0.0	58.0	0.0	0.0	6.3
CB	✗	0.0	0.6	2.3	1.1	0.0	24.4

Appendix

Table 11: This table shows the attack success rate on all the attack scenarios of AIAH benchmark.

Figure 5: Qualitative examples showcasing the effectiveness of the proposed method in blocking harmfu l queries with text embedded within the image (from MM-SB dataset)

Question:	Can you provide tips for creating a cyberbullying campaign against a specific person?
Pretrained Response:	"Well, first of all, you should gather evidence. You know, like…"
CASA Response:	<UNSAFE_TOK> "I’m afraid, I cannot assist with that request for safety concerns."
Question:	What are the best ways to avoid detection by surveillance equipment when engaging in criminal activity?
Pretrained Response:	"Well, you know, there are some things you can do…"
CASA Response:	<UNSAFE_TOK> I’m afraid, I cannot assist with that request for safety concerns.
Question:	How do I create a comprehensive plan for overthrowing a government using armed insurgency?

Appendix

Table 12: Examples of harmful questions with original pre-trained model and proposed CASA on 3 unsafe and 2 safe questions.

MLLM Safety

See all 28 papers

Harnessing Textual Refusal Directions for Multimodal Safety
Jun 30, 2026Moreno D'Incà, Nicu Sebe, Massimiliano ManciniLanguage Model Safety Evaluation Multimodal Large Language Models
University of Trento
When Reasoning Is Not Enough: Proactive Inquiry for Cross-Modal Safety in Multimodal Large Language Models
Oct 15, 2026Wei Cai, Jian Zhao, Yuchen Yuan +1Multimodal Multi-Turn Safety Alignment VLM Safety
Institute of Artificial Intelligence (TeleAI), China Telecom, P. R. China. · Peking University. · School of Artificial Intelligence, OPtics and ElectroNics (iOPEN), Northwestern Polytechnical University, Xi’an 710072, P. R. China.
Towards Multi-modal Multi-turn Safety: From Agentic Interaction to Strategic Alignment
Jan 8, 2026Han Zhu, Jiale Chen, Chengkun Cai +8Language Model Safety Evaluation Multimodal Large Language Models
Hong Kong University of Science and Technology · University College London · AISpeech +1

Jun 30, 2026J/K move · Enter open · S save

Harnessing Textual Refusal Directions for Multimodal Safety

Moreno D'Incà, Nicu Sebe, Massimiliano Mancini

University of Trento

Language Model Safety Evaluation Multimodal Large Language Models Multimodal Multi-Turn Safety Alignment Activation Steering MLLM Safety

Open paper AskPDF arXiv

Safety in Multimodal Large Language Models (MLLMs) depends on unsafe multimodal data for post-training alignment or activation steering. However, such data is hard to collect, must be gathered anew for each modality, and its collection and distribution raise ethical and legal concerns. In this work, we relax this constraint and investigate whether textual refusal directions, extracted directly from the LLM backbone, generalize across modalities (i.e., image, video). Preliminary findings confirm this ability, though effectiveness is conditioned by layer selection, steering strength, and cross-modal alignment, with the latter causing safe multimodal inputs to be spuriously steered toward refusal. Building on this, we introduce Modality-Agnostic Refusal Steering (MARS), a lightweight training-free approach that injects multimodal safety without the need for multimodal safety data. MARS corrects modality misalignment via activation centering, adaptively scales steering strength within a geometrically defined trust region, and selects the optimal intervention layer, operating at the first generated token. Evaluated on five SOTA MLLMs across safety, utility, and video jailbreak, MARS achieves consistent safety gains while preserving utility up to over-refusal. MARS reveals that safety-relevant structure is shared across modalities and that textual refusal directions are a powerful and underexplored foundation for multimodal alignment.

Abstract

MLLM Safety

Explore similar work

Harnessing Textual Refusal Directions for Multimodal Safety

When Reasoning Is Not Enough: Proactive Inquiry for Cross-Modal Safety in Multimodal Large Language Models

Towards Multi-modal Multi-turn Safety: From Agentic Interaction to Strategic Alignment