CrossGuard: Safeguarding MLLMs against Joint-Modal Implicit Malicious Attacks

TL;DR

Problem: joint-modal implicit jailbreaks challenge guardrails by requiring cross-modal reasoning. Approach: ImpForge generates diverse joint image-text malicious samples with RL red-teaming, then CrossGuard is trained as an intent-aware safeguard using LoRA on LLaVA-1.5-7B. Findings: CrossGuard achieves state-of-the-art robustness, attaining very low ASR across explicit and implicit benchmarks and showing strong OOD performance, while ImpForge reliably reveals vulnerabilities and improves guardrails when used for training. Significance: the combination offers a scalable, practical path to harden MLLMs against real-world multimodal threats without sacrificing utility.

Abstract

Multimodal Large Language Models (MLLMs) achieve strong reasoning and perception capabilities but are increasingly vulnerable to jailbreak attacks. While existing work focuses on explicit attacks, where malicious content resides in a single modality, recent studies reveal implicit attacks, in which benign text and image inputs jointly express unsafe intent. Such joint-modal threats are difficult to detect and remain underexplored, largely due to the scarcity of high-quality implicit data. We propose ImpForge, an automated red-teaming pipeline that leverages reinforcement learning with tailored reward modules to generate diverse implicit samples across 14 domains. Building on this dataset, we further develop CrossGuard, an intent-aware safeguard providing robust and comprehensive defense against both explicit and implicit threats. Extensive experiments across safe and unsafe benchmarks, implicit and explicit attacks, and multiple out-of-domain settings demonstrate that CrossGuard significantly outperforms existing defenses, including advanced MLLMs and guardrails, achieving stronger security while maintaining high utility. This offers a balanced and practical solution for enhancing MLLM robustness against real-world multimodal threats.

Figures (8)

• Figure 1: Conventional text-based (a) or vision-based (b) malicious queries, where malicious intents are explicitly expressed in a single modality and thus handled by existing guardrails. (c) shows the joint-modal implicit malicious case studied in this work, where neither the text nor the image can alone reveals harmful intent, but their joint interpretation bypasses existing guardrails and induces unsafe responses. (d) compares the attack success rate (ASR) on explicit (VLGuard vlguard) and implicit multimodal malicious datasets (SIUO siuo). Although existing MLLMs qwen2.5-VLhurst2024gptclaude performes low ASR on explicit malicious queries, their defense drops sharply on implicit ones (top row). Extra guardrails are thus needed, yet existing methods llamaguardvisionhiddendetect still show a large gap between explicit and implicit defense (bottom row), underscoring the challenging of implicit attack. In contrast, CrossGuard maintains consistently strong robustness across both.
• Figure 2: Overview of proposed ImpForge. In Stage 1, a keyword list is selected from all text-based malicious queries. Each query is paired with a benign image that is semantically related to the keyword in the query. In Stage 2, a policy-trainable rewriter model reconstructs the prompt given the initialized image–text pair. Three reward modules are designed to evaluate rewritten samples and guide policy updates.
• Figure 3: Security–Utility trade-offs across models. The x-axis shows the utility on safe image-text QA inputs from MMBench liu2024mmbench, reflecting the model’s general ability to provide answers without unnecessary refusals. The y-axis reports the Security (1 – ASR) on malicious inputs from MM-SafetyBench mmsafetybench. Models in the upper-left region suffer from over-defense, those in the lower-right show insufficient robustness. The ideal behavior lies toward the upper-right corner, balancing both security and utility.
• Figure 4: Comparison between fine-tuning with and without ImpForge-generated data.
• Figure 5: We leverage ImpForge to generate 1,390 implicit multimodal malicious samples spanning 14 categories for red-teaming evaluation.