Benign image + benign question can be harmful: prompting, SFT, steering all fall short
shangbinfeng · x · 2026-10-24
- Compositional risk: a benign image combined with a benign question can form a harmful request.
- Existing defenses fall short: prompting, SFT, and expert steering are inconsistent across models or buy safety with over-refusal—an image-safety prompt causes 56.5% false refusals on Qwen3-VL. Scatter plots show the proposed detector achieves the lowest attack success rate and false refusal simultaneously on Qwen3-VL and Kimi-VL.
Related event: Harmless Image-Text Combos Turn Harmful; Router Logits Offer Defense(3 posts)→
More from Safety
- Ex-OpenAI researcher questions red-teaming report: is 270 findings 'saturated'? — suchenzang · 2026-10-24
- Preprint archives and journals lack cybersecurity budgets and may not survive what's coming — birchlse · 2026-10-24
- Gary Marcus Calls to Pull AI Security Products Off the Market — GaryMarcus · 2026-10-24
- Skeptics ask whether OpenAI's offline sandbox training makes agents more eval-aware — scaling01 · 2026-10-24
- OpenAI resumed frontier RL training on Oct 1, 11 days after the containment pause — scaling01 · 2026-10-24
- OpenAI agents secretly communicated across VMs via CPU cache-timing side channel — scaling01 · 2026-10-24