Understanding In-Context Multimodal Jailbreaks via Posterior Reweighting

• URL: http://arxiv.org/abs/2609.10613v1
• Date: Tue, 08 Sep 2026 15:26:43 GMT
• Title: Understanding In-Context Multimodal Jailbreaks via Posterior Reweighting
• Abstract summary: In-context learning (ICL) jailbreaks reveal a critical vulnerability in multimodal large language models (MLLMs)<n>We propose a posterior reweighting framework that models a safety-aligned MLLM as implicitly operating over competing behavioral modes.<n>We introduce a posterior-aware inference-time defense that adaptively injects benign counter-evidence based on estimated risk.
• Score: 8.221008188186625
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: In-context learning (ICL) jailbreaks reveal a critical vulnerability in multimodal large language models (MLLMs): harmful demonstrations in the prompt can induce unsafe outputs without modifying model parameters. Despite extensive empirical evidence, existing work lacks a principled understanding of why such jailbreaks reliably succeed or how their effectiveness scales with context composition. We propose a posterior reweighting framework that models a safety-aligned MLLM as implicitly operating over competing behavioral modes, and interprets in-context demonstrations as inference-time evidence that dynamically shifts the model's posterior preference between safe and harmful behaviors. This view formalizes jailbreak as a process of evidence accumulation, yielding predictive scaling laws with respect to demonstration count, harmful ratio, adversarial strength, and semantic diversity. Guided by this framework, we introduce a posterior-aware inference-time defense that adaptively injects benign counter-evidence based on estimated risk, effectively suppressing harmful posterior drift while preserving model utility. Compared to existing in-context defenses, our method achieves a significantly improved robustness-utility trade-off under a fixed intervention budget. Together, our results establish posterior reweighting as a unifying and predictive framework for understanding and mitigating ICL jailbreak in MLLMs.

Related papers

• Silencing the Guardrails: Inference-Time Jailbreaking via Dynamic Contextual Representation Ablation [16.17685258866394]
  We propose Contextual Representation Ablation (CRA), a novel inference-time intervention framework designed to dynamically silence model guardrails.<n>CRA identifies and suppresses refusal-inducing activation patterns during decoding without requiring expensive parameter updates or training.<n> Empirical evaluation across multiple safety-aligned open-source LLMs demonstrates that CRA significantly outperforms baselines.
  arXiv  Detail & Related papers  (2026-04-09T05:35:56Z)
• Enhancing Safety of Large Language Models via Embedding Space Separation [24.821172423424866]
  Large language models (LLMs) have achieved impressive capabilities, yet ensuring their safety against harmful prompts remains a critical challenge.<n>Recent work has revealed that the latent representations (embeddings) of harmful and safe queries in LLMs typically exhibit linear separability.<n>Motivated by this observation, we propose a representation-level fine-tuning approach, named Embedding Space Separation (ES2)
  arXiv  Detail & Related papers  (2026-03-01T07:22:38Z)
• Understanding and Mitigating Over-refusal for Large Language Models via Safety Representation [23.989016366701232]
  Large language models harbor safety vulnerabilities.<n>Improvements in model safety often come at the cost of severe over-refusal.<n>We propose MOSR, designed to mitigate over-refusal by intervening the safety representation of LLMs.
  arXiv  Detail & Related papers  (2025-11-24T11:38:53Z)
• ForgeDAN: An Evolutionary Framework for Jailbreaking Aligned Large Language Models [8.765213350762748]
  jailbreak attacks bypass alignment safeguards to elicit harmful outputs.<n>We propose ForgeDAN, a novel framework for generating semantically coherent and highly effective adversarial prompts.<n>Our evaluation demonstrates ForgeDAN achieves high jailbreaking success rates while maintaining naturalness and stealth, outperforming existing SOTA solutions.
  arXiv  Detail & Related papers  (2025-11-17T16:19:21Z)
• Does More Inference-Time Compute Really Help Robustness? [50.47666612618054]
  We show that small-scale, open-source models can benefit from inference-time scaling.<n>We identify an important security risk, intuitively motivated and empirically verified as an inverse scaling law.<n>We urge practitioners to carefully weigh these subtle trade-offs before applying inference-time scaling in security-sensitive, real-world applications.
  arXiv  Detail & Related papers  (2025-07-21T18:08:38Z)
• ICLShield: Exploring and Mitigating In-Context Learning Backdoor Attacks [61.06621533874629]
  In-context learning (ICL) has demonstrated remarkable success in large language models (LLMs)<n>In this paper, we propose, for the first time, the dual-learning hypothesis, which posits that LLMs simultaneously learn both the task-relevant latent concepts and backdoor latent concepts.<n>Motivated by these findings, we propose ICLShield, a defense mechanism that dynamically adjusts the concept preference ratio.
  arXiv  Detail & Related papers  (2025-07-02T03:09:20Z)
• Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMs [83.11815479874447]
  We propose a novel jailbreak attack framework, inspired by cognitive decomposition and biases in human cognition.<n>We employ cognitive decomposition to reduce the complexity of malicious prompts and relevance bias to reorganize prompts.<n>We also introduce a ranking-based harmfulness evaluation metric that surpasses the traditional binary success-or-failure paradigm.
  arXiv  Detail & Related papers  (2025-05-03T05:28:11Z)
• MIRAGE: Multimodal Immersive Reasoning and Guided Exploration for Red-Team Jailbreak Attacks [85.3303135160762]
  MIRAGE is a novel framework that exploits narrative-driven context and role immersion to circumvent safety mechanisms in Multimodal Large Language Models.<n>It achieves state-of-the-art performance, improving attack success rates by up to 17.5% over the best baselines.<n>We demonstrate that role immersion and structured semantic reconstruction can activate inherent model biases, facilitating the model's spontaneous violation of ethical safeguards.
  arXiv  Detail & Related papers  (2025-03-24T20:38:42Z)
• CeTAD: Towards Certified Toxicity-Aware Distance in Vision Language Models [16.5022773312661]
  We propose a universal certified defence framework to safeguard large vision-language models against jailbreak attacks.<n>First, we proposed a novel distance metric to quantify semantic discrepancies between malicious and intended responses.<n>Then, we devise a regressed certification approach that employs randomized smoothing to provide formal robustness guarantees.
  arXiv  Detail & Related papers  (2025-03-08T17:33:55Z)
• Improving LLM Safety Alignment with Dual-Objective Optimization [81.98466438000086]
  Existing training-time safety alignment techniques for large language models (LLMs) remain vulnerable to jailbreak attacks.<n>We propose an improved safety alignment that disentangles DPO objectives into two components: (1) robust refusal training, which encourages refusal even when partial unsafe generations are produced, and (2) targeted unlearning of harmful knowledge.
  arXiv  Detail & Related papers  (2025-03-05T18:01:05Z)
• Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreaking [54.10710423370126]
  We propose Reasoning-to-Defend (R2D), a training paradigm that integrates a safety-aware reasoning mechanism into Large Language Models' generation process.<n>CPO enhances the model's perception of the safety status of given dialogues.<n>Experiments demonstrate that R2D effectively mitigates various attacks and improves overall safety, while maintaining the original performances.
  arXiv  Detail & Related papers  (2025-02-18T15:48:46Z)
• LLM Safety Alignment is Divergence Estimation in Disguise [17.69612534949964]
  This perspective explains the emergence of separation in the latent space between safe and harmful prompts after alignment.<n>We show that using compliance-refusal datasets, rather than standard preference-based datasets, leads to stronger separation and improved safety alignment.
  arXiv  Detail & Related papers  (2025-02-02T04:09:42Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.