COMIC: Reference-Aware Safety Gating for Multimodal Large Language Models
| Source: arXiv AI
Tags: multimodal-safety, jailbreak, MLLM, safety-gating, OCR, AI-security
COMIC identifies a structural gap in multimodal LLM safety: most defenses moderate the prompt-image pair as a whole, but many jailbreaks only become harmful when the model binds a benign operation (summarize, translate) to a specific visual target. COMIC intercepts this at the grounded operation-target level, consistently improving robustness on localized jailbreak benchmarks without harming benign utility.
Details
As MLLMs gain the ability to act on screenshots, scanned documents, and visual workflows, the attack surface for jailbreaks has changed. Many current multimodal jailbreaks involve neither a harmful prompt nor a harmful image in isolation — the danger emerges only when the model resolves a visual reference and binds an operation to it. Existing safety systems that check the prompt-image pair as a unit miss this structural pattern. COMIC (Context-Operation-Modality-Image-Classifier) is a pre-generation safety gate designed to address this reference-dependent failure mode. It works in four stages: (1) infer the requested operation and reference type, (2) construct candidate visual targets from OCR and open-vocabulary proposals, (3) ground plausible referents, (4) evaluate safety over explicit operation-target pairs. To handle ambiguity conservatively, COMIC combines max-risk aggregation (any high-risk operation-target pair triggers a block) with quality-aware routing before deciding to forward or block a request. Evaluation across multiple open-source MLLMs shows COMIC consistently improves robustness on both localized and broader multimodal jailbreak benchmarks, while preserving benign utility and practical efficiency. The paper argues the key insight is architectural: multimodal safety cannot be enforced reliably without explicitly modeling the requested operation, the visual target, and the confidence of grounding. For teams deploying MLLMs on document or image workflows, this is a concrete warning: your current safety layer likely has blind spots around reference-dependent attacks.