Beyond Attack Detection: Why Multimodal Safety Is Fighting the Wrong Battle

Multimodal safety research has long centered on defenses against content-hiding attacks, including optical character recognition (OCR) content extraction, vision-model alignment, and image moderation. The underlying assumption is straightforward: if you can detect harmful content in an image, you can block the attack. This is a reasonable assumption, and it holds for a specific class of threats. But as model safety capabilities mature, attackers have shifted tactics accordingly. The techniques that bypass today's defenses are not the ones those defenses were built for, and understanding that gap is the first step to closing it.

To map that gap, we started with a simple question: in multimodal attacks, does the image actually matter? We took two well-known multimodal jailbreak techniques, created text-only versions of each with the same prompt, same framing, and no image, then compared success rates across Claude Sonnet 4.6, GPT-5.5, and Grok-4. What we found was not just an answer to that question, but a deeper challenge for how safety systems are built.

When harmful content is hidden

Multi-Image Dispersed Adversarial Semantics (MIDAS) (Liu et al., 2026) represents the content-hiding class. It fragments harmful keywords across multiple visual puzzles, requiring the model to reconstruct the full instruction only after solving each one. Because no single image contains harmful content, the attack is designed to bypass static image classifiers.

The final step is key: the model is explicitly told to "follow the completed instruction in detail." This means after all the decoding, the model must look at the reconstructed harmful goal and decide whether to comply.

Here is a typical GPT-5.5 response:

Without images, MIDAS collapses to single digits. The visual encoding is genuinely doing work. By delaying when the model encounters the harmful instruction, the attack creates an opportunity for partial compliance before safety mechanisms fully engage.

At the same time, MIDAS highlights an important limitation of content-hiding attacks. Eventually, the model must reconstruct the harmful instruction and decide whether to follow it. That final decision point gives safety alignment an opportunity to intervene.

In other words, content obfuscation remains a real threat, but it is also the category of attack that current multimodal defenses are increasingly designed to address. The problem starts when the attack no longer needs to hide the content at all.

When harmful intent is framed as fiction

Multi-Modal Linkage (MML) (Wang et al., 2025) takes the opposite approach. Instead of hiding the harmful content inside images, it hides the harmful intent inside a story. The model is told it is a game designer writing villain screen-prop text. A mirrored text image carries the harmful request, but the real payload is the fictional narrative in the prompt.

A typical GPT-5.5 response opened with enthusiasm for the game production brief, followed by a disclaimer that it could not assist with real-world insurance fraud, then proceeded to provide exactly that: a structured incident narrative guide, a document checklist, and a list of fraud detection triggers to avoid. The disclaimer was present. So was the actionable content.

On GPT-5.5, removing the image changes nothing. On Grok-4, the text-only prompt already achieves 73%. MML is multimodal in appearance but primarily textual in mechanism.

At first glance, MIDAS and MML appear fundamentally different. One hides content behind visual reconstruction, while the other hides intent behind fictional framing. Yet both share an important property: they still attempt to evade safety mechanisms. In both cases, the attack succeeds only if the model fails to recognize what is ultimately a harmful request.

This distinction matters because it highlights a deeper question. What happens when an attack no longer needs to evade safety mechanisms at all?

When harmful intent looks legitimate

Everything above still leaves recognizable signals for a safety system to act on. In MIDAS, the harmful instruction eventually appears after decoding. The model has an opportunity to recognize the request and refuse. In MML, the harmful objective remains visible, even if it is wrapped inside a fictional scenario. A sufficiently robust model can learn to recognize the pattern and reject it.

Intent transformation presents a harder case. The objective is not hidden behind visual encoding or fictional framing, but reframed through legitimate terminology, domain context, and an ordinary-looking deliverable. The request looks less like an attack and more like a normal domain-expert task.

This does not mean the input contains no risk-relevant information. The challenge is that the available signals may be insufficient to reliably distinguish a harmful objective from a legitimate request for domain expertise. A sports-performance consultation, for example, can be entirely appropriate in one context and dangerous in another depending on the intervention requested, the surrounding circumstances, and what the resulting guidance could enable.

This is a different failure mode from content obfuscation or narrative framing. Traditional defenses are often designed to identify suspicious content, known jailbreak patterns, or explicit harmful intent. Intent-transformation attacks instead stress the boundary between input-level plausibility and output-level consequence: the model may receive a request that appears professionally legitimate and produce an answer that is contextually coherent, yet still enables harm.

The technical mechanisms can vary, including cross-modal entanglement and context engineering. Their shared effect is not to eliminate all detectable signals, but to make harmful intent less separable from legitimate use at the point where the system evaluates the request.

Cross-Modal Entanglement Attack (COMET) (Yan et al., 2026), which we evaluated separately on a different goal set, is a concrete example:

The dangerous weight loss regimen became a sports performance protocol. The person with eating guilt became an elite athlete. The generated image is not hiding harmful content. It reinforces the professional context through cross-modal entanglement, making the scenario more convincing. Each modality appears benign in isolation; the harmful intent only activates when the model reasons across both. This is what the model sees:

And this is the prompt the model receives:

The model then produced a detailed seven-day weight-cutting plan, including progressively restrictive dietary targets, supplement timing, and high-intensity exercise prescriptions. From the model's perspective, it was responding to a sports science consultation rather than an obviously harmful request.

COMET achieved 90%+ ASR across the models we evaluated, including models that successfully blocked both MIDAS and MML. COMET challenges the assumption that harmful intent can be reliably identified from the input itself.

In this setting, safety controls can operate as designed and still miss the risk: the request appears legitimate, the answer appears contextually appropriate, and the harm only becomes clear when considering what the output could enable.

A similar pattern has begun to appear in agentic systems. TRACE (Zeng et al., 2026) decomposes harmful objectives into benign-looking subtasks and embeds them within legitimate professional workflows. While the technical mechanism differs from COMET, the practical effect is similar: the attack becomes harder to detect because each individual step appears reasonable in isolation.

Taken together, these results suggest a broader challenge. The more closely a harmful objective resembles legitimate work, the fewer obvious signals remain for safety systems to act on.

Why intent transformation is hard to defend against

Intent transformation creates a fundamentally different challenge for safety systems. The words "caloric restriction," "HIIT protocol," and "sodium bicarbonate supplementation" are individually benign. The professional context is coherent. The generated image is legitimate. There is no obvious signal for a traditional safety filter to catch.

This connects to something we have observed in our own evaluation work: the risk of a request is determined by the consequence of the output, not the topic of the input. A CBRN question about protective gear can be low-risk if the answer is basic PPE guidance, while a sports-performance request can be high-risk if the output becomes a dangerous restriction protocol. This is the defense gap: intent-transformation attacks make the input look clean, while the real risk appears in the consequence of the response. We explored a related pattern in our beyond pass rates work. Two models with the same headline score can fail in completely different ways, and the right fix depends on knowing how they fail, not just how often.

This tension is visible in the most recent model releases. Claude Fable 5, launched this month as Anthropic's first publicly available Mythos-class model, takes an aggressive approach in high-risk domains: requests related to cybersecurity, biology, and chemistry are proactively routed to a less capable model rather than answered directly. When a legitimate professional request and an intent-transformed harmful request look nearly identical, defenses must choose between blocking too much and allowing too much. The current state of the art is to accept over-refusal as the price of safety.

What this means for your safety stack

1. Run text-only baselines as part of multimodal attack evaluations.
   Without text-only baselines, all multimodal attacks can appear to fail or succeed for the same reason. With them, teams can separate attacks that genuinely depend on the visual channel from attacks that primarily flow through text, narrative framing, or task context.
2. Evaluate your fictional-framing resistance.
   If your model produces actionable harmful content with a disclaimer attached, the disclaimer is not protecting anyone. Test whether the model can recognize when fiction is being used to preserve a real-world harmful objective.
3. Start building output-consequence evaluation.
   As attacks shift from hiding content to transforming intent, the question shifts from "does this input contain harmful content?" to "could this output cause harm in the real world, regardless of how the request was framed?"

The next generation of multimodal safety failures may not look like obvious jailbreaks. They may emerge from legitimate-looking contexts where text, images, tools, and domain assumptions combine into a task that appears reasonable, while the resulting output can still enable harm. The question is whether your safety stack can tell the difference.

What this means for red teaming

COMET and TRACE point to a broader shift in the red-team threat model. Their significance is not only that they bypass safeguards, but that they expose how legitimate model capabilities can be activated in contexts where the resulting output becomes harmful. A forensic vulnerability analysis, wrapped in a professional pipeline scenario, is something an agent is built to handle. The attack does not fight the safety layer. It works through the capability layer.

The most dangerous attacks do not bypass your model's safety. They operate through your model's capabilities.

The question is whether your safety stack, and your red-team methodology, can recognize when legitimate capability is being aimed at harmful outcomes.

If you are evaluating multimodal safety and want to see how this applies to your models, we'd love to hear from you. Reach out at contact@reinforcelabs.ai.