The Boy Who Cried Wolf: Adversarial Misclassification of Safe Inputs as Unsafe in Multimodal Guardrails
Shuo Shi, Rui Yin, Naen Xu, Jiahao Chen, Chunyi Zhou, Tianyu Du, Zhihui Fu, Jun Wang, Zhaoxiang Wang, Shouling Ji
cs.CR
Submitted: 2026-08-02
Comments: Accepted by KDD 2026
License: http://creativecommons.org/licenses/by/4.0/
The gist: Multimodal guard models have emerged as critical safety components for screening content in vision-language systems.
Terminology
Abstract
Multimodal guard models have emerged as critical safety components for screening content in vision-language systems. While adversarial research has extensively studied jailbreaking attacks that produce false negatives, the inverse threat of inducing false positives on benign inputs remains unexplored. We introduce Unsafe Induction Attacks, where adversaries distribute imperceptibly perturbed safe images that trigger guard models to reject legitimate user requests, causing a "Boy Who Cried Wolf" effect that degrades service availability and erodes trust. This reveals an availability failure mode in deployed safety filters. To realize this threat under diverse user prompts, we propose Unsafe Semantic Distillation (USD), which aligns adversarial perturbations with distributional representations of unsafe content rather than prompt-specific instances. Evaluated on four state-of-the-art guard models across realistic user simulation scenarios, USD achieves 84% attack success rates, outperforming existing methods and exposing fundamental vulnerabilities in current multimodal safety architectures.
Sources
- Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs
- On Evaluating Adversarial Robustness
- MVI-Bench: A Comprehensive Benchmark for Evaluating Robustness to Misleading Visual Inputs in LVLMs
- Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversations
- Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
- On the Efficacy of Adversarial Data Collection for Question Answering: Results from a Large-Scale Randomized Study
- Modular Safety Guardrails Are Necessary for Foundation-Model-Enabled Robots in the Real World
- A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1
- VLM-Guard: Safeguarding Vision-Language Models via Fulfilling Safety Alignment Gap
- E$^2$AT: Multimodal Jailbreak Defense via Dynamic Joint Optimization for Multimodal Large Language Models
- Refusing Safe Prompts for Multi-modal Large Language Models
- ALERT: A Comprehensive Benchmark for Assessing Large Language Models' Safety through Red Teaming
- Ethical and social risks of harm from Language Models
- "I See What You Did There": Can Large Vision-Language Models Understand Multimodal Puns?
- Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors
- AI Risk Categorization Decoded (AIR 2024): From Government Regulations to Corporate Policies
- LLM Safeguard is a Double-Edged Sword: Exploiting False Positives for Denial-of-Service Attacks
- Hidden Tail: Adversarial Image Causing Stealthy Resource Consumption in Vision-Language Models
- MM-RLHF: The Next Step Forward in Multimodal LLM Alignment
- CollabEdit: Towards Non-destructive Collaborative Knowledge Editing
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Estimating the Social Cost of Corporate Data Breaches
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills