Whose Refusal Is It? The Unmeasured Contribution of Black-Box Multimodal Guardrails

• URL: http://arxiv.org/abs/2608.08641v1
• Date: Sun, 09 Aug 2026 11:19:30 GMT
• Title: Whose Refusal Is It? The Unmeasured Contribution of Black-Box Multimodal Guardrails
• Abstract summary: We show that the guardrail's actual share of the safety credited to it runs from none of it to essentially all of it.<n>The split is recoverable at no extra cost, because a guard block replaces the model's response.
• Score: 24.794304039477495
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: A black-box guardrail is evaluated as though the safety number it earns were its own. It is not. A defended pipeline holds two components that can refuse (the guardrail, and the target model out of its own alignment), and every reported metric is a sum over both. We show that the guardrail's actual share of the safety credited to it runs from none of it to essentially all of it, decided by two variables no evaluation records: which channel carries the payload, and what text the harness places in the defense's internal read. The split is recoverable at no extra cost, because a guard block replaces the model's response and the two counts are therefore disjoint. On a text guard across two open-weight targets: with the payload rendered as pixels the guard blocks nothing and the model produces every refusal the system makes; reading the encoded prompt the attacker actually sent, the guard produces a minority of the refusals attributed to it; reading the unencoded request behind the attack, it blocks almost everything and the model falls silent. The blindness is not inaccuracy: the same guards block no benign image inputs either, so their image-channel decision is a constant. Granting the unencoded request inflates measured benefit substantially for a guard gate, less for a caption-mediated re-check, and not at all for a majority-vote smoother; the ordering reproduces in an independent replicate. Isolating the grant within one defense shows it does not improve detection: the harm-verdict stage contributes nothing, while the stage that regenerates the answer carries the effect. Nor is the inflated setting careless; the reference implementation builds every stage from a single prompt field that cannot distinguish what the attacker sent from what the benchmark records, so faithful porting supplies it silently. Previously published figures of our own are among those revised.

Related papers

• VeriPhy: Agentic Physical Reasoning for World Model Evaluation and Refinement [57.86962208273888]
  We present an auditable physical-verification system in which a text-only planner compiles the prompt into typed physical obligations.<n>Each action returns a provenance-carrying evidence record whose payload, when usable, is either a typed measurement or an explicitly tagged learned state.<n>We anchor evaluation in a 1,500-clip corpus of human-annotated flaw records that localize real generation failures in prompt reference, space, and time.
  arXiv  Detail & Related papers  (2026-09-02T20:36:45Z)
• The Guard That Cried Wolf: How Scary Words Make Agent Guardrails Refuse Legitimate Actions [12.920644711310109]
  Cautious Bench is the first benchmark to make over-safety the construct for agent guardrails.<n>A build-time gate re-derives every example to certify it, so each label is a mechanical consequence of the policy.<n>We find a name-superstition effect: each over-refuses an authorized action more often under a scary-looking object name.
  arXiv  Detail & Related papers  (2026-08-27T11:55:22Z)
• More Rejective, Not More Discriminative: The Unit of Verification in Pre-Execution LLM Oversight [3.8564927363194754]
  Pre-execution oversight is core to trusted monitoring in AI control.<n>Existing designs take the unit as given; its effect on fallible monitors is unmeasured.<n>Our framework is the first controlled, pre-registered instrument for this choice and never reads catch alone.
  arXiv  Detail & Related papers  (2026-08-25T00:59:55Z)
• Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models [4.1626636325601405]
  Our defense, decoy hardening, concedes the refusal strip and poisons its payoff.<n>We instantiate it on seven models from five families (9B-122B, dense and mixture-of-experts)
  arXiv  Detail & Related papers  (2026-08-17T23:26:32Z)
• Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks [7.766839238117721]
  We report a counter-intuitive interaction between image inputs and existing black-box defenses on Vision--Language Models.<n>A caption-mediated defense (ECSO) that leaves ASR essentially unchanged on text-only encoded input drops it by up to $73$pp once a content-free decoy is attached.<n>We frame this as an observation about pipeline interaction, not as a robust defense.
  arXiv  Detail & Related papers  (2026-08-02T07:00:49Z)
• Recover, Decode, Reguard: Guard-Agnostic Defense Amplification againstEncoded VLM Jailbreaks [7.287314790466206]
  We build a guard-agnostic recover-and-decode amplifier for vision-language models.<n>We evaluate it against an ensemble of eleven attacks, scoring a behavior as broken if any succeeds.<n>This exposes our central finding: an empirical safety-utility ceiling for the non-iterative recovery defenses we evaluate.
  arXiv  Detail & Related papers  (2026-07-29T07:53:35Z)
• When Are Reasoning-Based Guardrails Not Efficient? ResponseGuard: A Fast Vision-Language Guard for Real-Time Moderation [9.68749971398651]
  A vision-language AI assistant returns its answer as a stream of generated tokens.<n>A safety guard that watches that answer has to keep up with the stream and stop a harmful reply before a user reads it.<n>Recent vision-language guardrails instead generate a chain of thought before they issue a verdict.
  arXiv  Detail & Related papers  (2026-07-23T15:02:24Z)
• Security--Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense [24.794318726705118]
  Attack-success metrics cannot see a model that ignores an injection and one that faithfully processes it as data score identically.<n>We introduce SecFid, a benchmark built so that executing an injection, processing it as data, and ignoring it produce distinguishable outputs.
  arXiv  Detail & Related papers  (2026-06-29T18:11:17Z)
• Manufactured Confidence: How Memory Consolidation Turns Hearsay into Confident Facts [0.0]
  LLM agents rewrite conversation into stored "facts" that later steps trust.<n>A role that was true once and never corrected is stored as a flat fact and acted on like a deliberate injection.<n>A single load-bearing memory is the hazard, and one redundant source restores correct decisions.
  arXiv  Detail & Related papers  (2026-06-28T08:56:48Z)
• Localization then Neutralization: Gradient-guided Token Suppression against Visual Prompt Injection Attack [78.02110947708535]
  Adversarial images pose a severe security threat to multimodal large language models through prompt injection.<n>We show that successful adversarial attacks do not rely on the entire image uniformly but instead depend on a small subset of critical image tokens.<n>We propose Gradient Token Masking (GTM), which localizes these tokens via gradient analysis and neutralizes them through masking.
  arXiv  Detail & Related papers  (2026-05-24T17:51:34Z)
• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
  Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
  arXiv  Detail & Related papers  (2026-04-14T06:48:33Z)
• Bag of Tricks for Subverting Reasoning-based Safety Guardrails [62.139297207938036]
  We present a bag of jailbreak methods that subvert the reasoning-based guardrails.<n>Our attacks span white-, gray-, and black-box settings and range from effortless template manipulations to fully automated optimization.
  arXiv  Detail & Related papers  (2025-10-13T16:16:44Z)
• Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs [54.90315421117162]
  We propose a novel poisoning method via completely harmless data.<n>Inspired by the causal reasoning in auto-regressive LLMs, we aim to establish robust associations between triggers and an affirmative response prefix.<n>We observe an interesting resistance phenomenon where the LLM initially appears to agree but subsequently refuses to answer.
  arXiv  Detail & Related papers  (2025-05-23T08:13:59Z)
• TextGuard: Provable Defense against Backdoor Attacks on Text Classification [83.94014844485291]
  We propose TextGuard, the first provable defense against backdoor attacks on text classification. In particular, TextGuard divides the (backdoored) training data into sub-training sets, achieved by splitting each training sentence into sub-sentences. In our evaluation, we demonstrate the effectiveness of TextGuard on three benchmark text classification tasks.
  arXiv  Detail & Related papers  (2023-11-19T04:42:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.