COMIC: Reference-Aware Safety Gating for Multimodal Large Language Models

Md Abdullahil Oaphy; Anhao Xiang; Zongxing Xie; Huayue Gu; Chenyu Wang; Honghui Xu

cs.CRAug 18, 2026

COMIC: Reference-Aware Safety Gating for Multimodal Large Language Models

Authors: Md Abdullahil Oaphy, Anhao Xiang, Zongxing Xie, Huayue Gu, Chenyu Wang, Honghui Xu

Organizations: Kennesaw State University, Kennesaw, GA, USA

Abstract

Multimodal large language models (MLLMs) are increasingly used to interact with screenshots, scanned documents, diagrams, and other visually grounded inputs. This shift introduces a new safety risk: in many multimodal jailbreaks, neither the prompt nor the image is harmful in isolation. Unsafe behavior emerges only when the model binds an apparently benign operation, such as summarizing, translating, or following, to a localized visual target. This reveals a structural weakness in current multimodal defenses, which largely moderate the prompt-image pair as a whole even though the true security-relevant unit is the grounded operation-target pair produced during dereference. In this work, we identify and analyze this reference-dependent failure mode and show that existing defenses degrade when harmful semantics are localized, activated only after grounding, and dependent on visual reference resolution. To address this problem, we propose COMIC (Context-Operation-Modality-Image-Classifier), a reference-aware pre-generation safety gate for MLLMs. COMIC first infers the requested operation and reference type, constructs candidate targets from OCR and open-vocabulary proposals, grounds plausible referents, and evaluates safety over explicit operation-target pairs. To handle ambiguity conservatively, COMIC combines max-risk aggregation with quality-aware routing before deciding whether to forward or block a request. We evaluate COMIC across multiple open-source MLLMs, localized and broader multimodal jailbreak benchmarks, and benign reference-sensitive settings. The results show that COMIC consistently improves robustness while preserving benign utility and practical efficiency. More broadly, our findings suggest that multimodal safety cannot be enforced reliably without modeling the requested operation, the visual target to which it applies, and the confidence of that grounding.

Figures & tables

Fig. 1: Multimodal LLM safety failure and COMIC motivation.

Fig. 2: Threat model for reference-conditioned multimodal jailbreaks.

Fig. 3: Moderation mismatch in a localized reference-conditioned jailbreak.

Fig. 4: Reference-dependent failure from localized visual grounding.

Fig. 5: Ambiguity-driven failure under localized visual grounding.

Fig. 6: Overview of COMIC for intent-aware grounding, operation–target safety scoring, and pre-generation defense mechanism.

p(\texttt{unsafe}\mid P_{t},I_{t})\leftarrow\max_{i\in I_{K}}p_{i}(\texttt{unsafe}\mid P_{t},I_{t})

Algorithm 1 COMIC Inference Pipeline

Dataset	Exp.	Purpose
FigStep Data	Block	Localized jailbreaks
JailBreakV-28K	Block	Broad jailbreak test
MM-Vet	Allow	Benign utility

TABLE I: Curated datasets used in COMIC .

	FigStep Data (%)					JailBreakV-28K (%)
Model	FigStep	AdaShield	CoCA	Immune	COMIC (Ours)	FigStep	AdaShield	CoCA	Immune	COMIC (Ours)
LLaVA-1.6	5.90	3.62	13.34	1.21	0.08	51.64	19.23	51.37	2.45	2.70
LLaVA-1.5	48.48	7.24	28.63	4.23	0.08	52.46	12.86	39.87	2.10	2.70
MiniGPT-4(7B)	8.32	5.76	5.74	4.43	0.09	27.74	32.21	29.74	18.34	2.90
Qwen-VL	4.56	5.04	43.92	3.23	0.11	14.42	15.88	15.69	8.58	3.20

TABLE II: ASR Comparison Between Baselines and Our COMIC under multimodal jailbreak attacks.

Fig. 7: ASR Comparison Between Baselines and Our COMIC under multimodal jailbreak attacks.

Model	Original / Baseline	FigStep	AdaShield	CoCA	Immune	COMIC (Ours)
LLaVA-1.6	37.3	28.1	32.2	36.1	37.7	37.5
LLaVA-1.5	30.3	26.6	21.6	29.3	31.3	32.1
MiniGPT-4(7B)	20.0	19.8	14.3	20.2	24.7	24.9
Qwen-VL	40.5	37.3	28.4	40.5	40.5	40.6

TABLE III: Benign utility comparison across models and defense methods.

Fig. 9: Benign utility on MM-Vet across protected MLLMs and defense methods.

Model	Original	AdaShield	CoCA	Immume	COMIC (Ours)
LLaVA-1.5	3.52	3.62	7.02	4.98	3.76
LLaVA-1.6	3.48	3.58	7.01	4.93	3.72
MiniGPT-4(7B)	10.38	10.48	19.86	14.76	11.03
Qwen-VL	1.91	2.01	7.43	4.57	2.16

TABLE IV: Inference-time overhead across protected MLLMs.

Fig. 10: Runtime comparison across protected MLLMs and defense methods.

Fig. 11: Relative ASR reduction of COMIC across FigStep and JailBreakV-28K.

	FigStep Data (%)					JailBreakV-28K (%)
Model	FigStep	AdaShield	CoCA	Immune	COMIC (Ours)	FigStep	AdaShield	CoCA	Immune	COMIC (Ours)
LLaVA-1.6	59.81	75.34	9.13	91.76	99.46	14.32	68.09	14.77	95.93	95.52
LLaVA-1.5	17.24	87.64	51.13	92.78	99.86	6.97	77.19	29.30	96.28	95.21
MiniGPT-4(7B)	30.38	51.80	51.97	62.93	99.25	58.69	52.03	55.71	72.69	95.68
Qwen-VL	81.01	79.01	-82.92	86.55	99.54	37.28	30.93	31.75	62.68	86.08
Mean	47.11	73.45	7.32	83.50	99.53	29.31	57.06	32.88	81.89	93.12

TABLE V: Relative ASR reduction across multimodal jailbreak benchmarks.

MLLM Safety

See all 28 papers

Mar 23, 2026

Structured Visual Narratives Undermine Safety Alignment in Multimodal Large Language Models

Multimodal Large Language Models (MLLMs) extend text-only LLMs with visual reasoning, but also introduce new safety failure modes under visually grounded instructions. We study comic-template jailbreaks that embed harmful goals inside simple three-panel visual narratives and prompt the model to role-play and "complete the comic." Building on JailbreakBench and JailbreakV, we introduce ComicJailbreak, a comic-based jailbreak benchmark with 1,167 attack instances spanning 10 harm categories and 5 task setups. Across 15 state-of-the-art MLLMs (six commercial and nine open-source), comic-based attacks achieve success rates comparable to strong rule-based jailbreaks and substantially outperform plain-text and random-image baselines, with ensemble success rates exceeding 90% on several commercial models. Then, with the existing defense methodologies, we show that these methods are effective against the harmful comics, they will induce a high refusal rate when prompted with benign prompts. Finally, using automatic judging and targeted human evaluation, we show that current safety evaluators can be unreliable on sensitive but non-harmful content. Our findings highlight the need for safety alignment robust to narrative-driven multimodal jailbreaks.

Rui Yang Tan, Yujia Hu, Roy Ka-Wei Lee

Singapore University of Technology and Design. · University of British Colombia.

MLLM Safety Adversarial Attacks on VLMs Adversarial Attacks on LLMs LLM Safety Alignment LLM Safety Benchmarks Language Model Safety Evaluation

Ask PDF

Aug 21, 2026

ReFrame: Evidence-Guided Test-Time Safety Alignment in Multimodal Large Language Models

While multimodal large language models (MLLMs) extend model capabilities beyond text, they also make safety alignment increasingly challenging. Multimodal safety alignment methods must address cross-modal jailbreaks, safety-awareness failures, and over-sensitive refusals. However, existing methods often rely on retraining or internal-state inspection, limiting their applicability to deployed closed-source MLLMs and motivating test-time safety alignment. We analyze this setting and identify two key obstacles, utility dominance and reasoning inertia, which cause models to overlook latent risks or follow malicious reasoning trajectories. Guided by these insights, we propose ReFrame, a training-free multimodal input reframing framework where two agents share a lightweight locally deployed MLLM: the evidence-generation agent constructs complementary risk and utility evidence, and the rewrite-and-routing agent converts it into a safe proxy prompt and image-routing decision before calling the downstream MLLM, without modifying it or accessing its internal information. Experiments across multiple MLLMs and benchmarks show that ReFrame improves jailbreak defense, safety awareness, and oversensitivity reduction while preserving multimodal utility.

Wenzheng Jiang, Xuankun Rong, Yuanzhao Zhai +2

College of Computer Science and Technology, National University of Defense Technology · State Key Laboratory of Complex & Critical Software Environment · School of Computer Science, Wuhan University

MLLM Safety LLM Safety Alignment Multimodal Large Language Models Jailbreak Defense

Ask PDF

May 18, 2026

DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs

Multimodal Large Language Models (MLLMs) are vulnerable to jailbreak attacks, which can elicit harmful responses from MLLMs. Many MLLMs support multi-image inputs, inadvertently introducing new vulnerabilities due to less efforts on multi-image safety alignment. Previous MLLM jailbreak methods only uses a single image, which restricts the attack space: they cannot distribute harmful requests across multiple images, carry abundant information, or exploit additional visual reasoning tasks to distract MLLMs. To address these limitations, in this paper, we propose a compositional jailbreak framework, DMN, which leverages Distributed instruction, Multimodal evidence and a Number chain task to fully enhance the jailbreak performance. Extensive experiments show that DMN is highly effective for MLLM jailbreaking, e.g. achieving attack success rates of over 90% on GPT-4o, Gemini-2.5-pro and Claude Sonnet 4, surpassing other baselines by a large margin. This compositional, multi-image jailbreak strategy reveals fundamental weaknesses in their safety mechanisms.

Wenzhuo Xu, Zhipeng Wei, Zonghao Ying +4

AI Security Lab, Beijing, China · International Computer Science Institute, CA, USA · UC Berkeley, CA, USA +1

Multimodal Large Language Models LLM Safety Multimodal Jailbreak Attacks Adversarial Attacks on Unified Multimodal Models

Ask PDF

Abstract

MLLM Safety

Explore similar work

Structured Visual Narratives Undermine Safety Alignment in Multimodal Large Language Models

ReFrame: Evidence-Guided Test-Time Safety Alignment in Multimodal Large Language Models

DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs