Paper deep dive
DefenSee: Dissecting Threat from Sight and Text - A Multi-View Defensive Pipeline for Multi-modal Jailbreaks
Zihao Wang, Kar-Wai Fok, Vrizlynn L. L. Thing
Models: BLIP-2, GPT-4o, LLaVA-2, MiniGPT4
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%
Last extracted: 3/11/2026, 1:04:41 AM
Summary
DefenSee is a robust, lightweight, and model-agnostic black-box defense framework designed to protect Multi-modal Large Language Models (MLLMs) from jailbreak attacks. It employs a multi-view pipeline consisting of robust image content analysis (using ScoreCam, U2-Net, and OCR), image variants transcription, and cross-modal consistency checks to detect and mitigate malicious intent while minimizing over-defense through query similarity retrieval.
Entities (5)
Relation Signals (3)
DefenSee â mitigates â Jailbreak Attacks
confidence 95% ¡ DefenSee consistently enhances MLLM robustness while better preserving performance on benign tasks compared to SOTA defenses.
DefenSee â uses â U2-Net
confidence 95% ¡ In this module, we adopt U²-Net (U-square-Net) [26] for foreground extraction
DefenSee â uses â BLIP-2
confidence 95% ¡ To achieve this, we leverage BLIP-2 [25], a multi-modal pre-training framework
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Multi-modal large language models (MLLMs), capable of processing text, images, and audio, have been widely adopted in various AI applications. However, recent MLLMs integrating images and text remain highly vulnerable to coordinated jailbreaks. Existing defenses primarily focus on the text, lacking robust multi-modal protection. As a result, studies indicate that MLLMs are more susceptible to malicious or unsafe instructions, unlike their text-only counterparts. In this paper, we proposed DefenSee, a robust and lightweight multi-modal black-box defense technique that leverages image variants transcription and cross-modal consistency checks, mimicking human judgment. Experiments on popular multi-modal jailbreak and benign datasets show that DefenSee consistently enhances MLLM robustness while better preserving performance on benign tasks compared to SOTA defenses. It reduces the ASR of jailbreak attacks to below 1.70% on MiniGPT4 using the MM-SafetyBench benchmark, significantly outperforming prior methods under the same conditions.
Tags
Links
- Source: https://arxiv.org/abs/2512.01185
- Canonical: https://arxiv.org/abs/2512.01185
Trouble viewing inline? Open PDF directly â
Full Text
56,510 characters extracted from source content.
Expand or collapse full text
1 DefenSee: Dissecting Threat from Sight and Text â A Multi-View Defensive Pipeline for Multi-modal Jailbreaks Zihao Wang, Kar-Wai Fok, Vrizlynn L. L. Thing Cybersecurity Strategic Technology Centre ST Engineering Singapore, Singapore zihao.wang, fok.karwai@stengg.com, vriz@ieee.org AbstractâMulti-modal large language models (MLLMs), ca- pable of processing text, images, and audio, have been widely adopted in various AI applications. However, recent MLLMs integrating images and text remain highly vulnerable to co- ordinated jailbreaks. Existing defenses primarily focus on the text, lacking robust multi-modal protection. As a result, studies indicate that MLLMs are more susceptible to malicious or unsafe instructions, unlike their text-only counterparts. In this paper, we proposed DefenSee, a robust and lightweight multi-modal black-box defense technique that leverages image variants tran- scription and cross-modal consistency checks, mimicking human judgment. Experiments on popular multi-modal jailbreak and benign datasets show that DefenSee consistently enhances MLLM robustness while better preserving performance on benign tasks compared to SOTA defenses. It reduces the ASR of jailbreak attacks to below 1.70% on MiniGPT4 using the M-SafetyBench benchmark, significantly outperforming prior methods under the same conditions. Index TermsâGAI Security, LLM Safety, MLLM Safety, MLLM Attack, VLM Defense Framework I. INTRODUCTION Multi-modalLargeLanguageModels(MLLMs) [1] [2] [3] [4] [5] are built upon Large Language Models (LLMs) [6] [7], where a visual encoder is connected to the textual module via a multi-modal connector to enable content generation. In recent years, MLLMs have been increasingly used in safety-critical scenarios such as autonomous driving [8] and intelligent healthcare [9]. Therefore, they must exhibit strong resistance to generating illegal, harmful, and dangerous content, including privacy violence, hate speech, and malware generation [10]. However, even if the textual modules of MLLMs achieve safety alignment [6] [7] and can resist pure text-based attacks, most MLLMs still lack rigorous unified alignment and holistic security evaluation across components, making them vulner- able to cross-modal jailbreak attacks. Since current defense techniques mainly focus on textual alignment, coordinated image-text attacks can bypass model defenses by transmitting harmful instructions through both text and image channels simultaneously [10] [11] [12]. Given these vulnerabilities, there is a pressing need for a more comprehensive defense mechanism capable of jointly analyzing textual and visual content to assess potential security risks. In this paper, we propose a robust black-box defense technique, DefenSee, consisting of three key components: a robust image content analysis mechanism, an image vari- ant transcription pipeline, and a carefully designed cross- modal consistency checking module to mimic human threat assessment. Since the defense is applied in the inference stage, it is applicable to any existing MLLM models as well. This approach outperforms existing state-of-the-art (SOTA) defenses on benchmark datasets. Therefore, the contributions of this paper are as follows: 1. Developed a robust image extraction mechanism to enable human-like threat assessment and reduce the impact of adversarial modifications or hidden manipulations. 2. Designed an Image Variants transcription process that systematically extracts primary visual elements, and Fore- ground semantic meaning elements, ensuring comprehensive multi-modal analysis. 3. Proposed a cross-modal consistency checks by analyzing extracted image content with user image + text prompts to detect inconsistencies, adversarial manipulations, or malicious intent. 4. Evaluated the effectiveness of the proposed defense tech- nique in identifying security risks and mitigating cross-modal jailbreak attacks on MLLMs, and compared its performance with other SOTA techniques. The organization of the rest of this paper is as follows: Section I presents the related works of both SOTA MLLM attack and defense techniques. The methodology of DefenSee is then proposed in Section I. In Section IV, we present the setup of our experiments and conduct the performance evaluations on benchmark datasets. Finally, we conclude the paper in Section V, by discussing the remaining challenges and future directions. I. Related Work A. multi-modal Large Language Models jailbreak Attacks With the increasing deployment of MLLMs, user interaction through various modalities such as image and voice has become ubiquitous. However, this multi-modal capability also introduces new security vulnerabilities, which adversaries have exploited through jailbreak attacks, raising significant safety arXiv:2512.01185v1 [cs.CR] 1 Dec 2025 2 concerns for MLLMs in real-world applications [13], [14]. Jailbreak attacks on MLLMs can be broadly categorized into perturbation-based and structure-based strategies. Perturbation-based attacks typically rely on adversarial ma- nipulation of visual inputs using gradient-based optimization methods, primarily under white-box or partially white-box settings [15]â[17]. These attacks aim to circumvent safety alignment mechanisms in MLLMs by introducing small, im- perceptible perturbations to benign-looking inputs. For in- stance, Shayegan et al. [17] introduced Jailbreak in Pieces, combining benign-looking adversarial images with generic prompts to mislead the modelâs aligned embeddings across visual, textual, and OCR modalities. Qi et al. [16] proposed a method to generate universal adversarial triggers from a small set of harmful examples. It optimizes visual inputs to craft adversarial examples that can bypass the safety mechanisms of MLLMs, demonstrating that visual perturbations can more effectively bypass MLLM safety filters compared to text-based attacks. Liu et al. [15] proposed Arondight, a red teaming framework tailored for VLMs. It leverages reinforcement learning with entropy and novelty rewards to generate diverse adversarial visual-text prompts, achieving an 84.5% attack success rate (ASR) on GPT-4 across 14 prohibited scenarios, outperforming previous approaches such as AutoDAN [18]. Structure-based attacks, in contrast, target the modelâs high- level visual understanding by embedding semantically mean- ingful patterns into inputs [10]â[12]. Instead of relying on fine-grained pixel perturbations, these attacks manipulate the structure and composition of visual prompts to evade safety alignment. FigStep [11] is a black-box jailbreaking attack that converts harmful instructions into typographic images, bypassing safety alignment in LVLMs. Liu et al. [10] demon- strated that structured prompts, including stable-diffusion- generated malicious images and typographic renderings, can bypass multi-modal safety mechanisms. Li et al. [12] proposed HADES, a novel jailbreak attack targeting the harmlessness alignment vulnerabilities in MLLMs via visual inputs. The method comprises three key stages: Hiding Harmfulness, replacing harmful keywords in text with image-referenced phrases, and embedding the original harmful intent as typo- graphic images. Amplifying Image Toxicity, generating se- mantically aligned harmful images using diffusion models, and optimizing through LLM feedback loops to increase harm- fulness. Adversarial Image Injection, applying gradient-based adversarial noise to further increase the likelihood of harmful outputs. While these attack strategies reveal critical security gaps in MLLMs, they also underscore the pressing need for robust, generalizable defenses that can detect or neutralize both low-level perturbations and high-level structural manipulations across diverse modalities. B. Multi-modal Large Language Models Defenses One widely adopted approach involves aligning the model during training using adversarial samples curated through red- teaming. While effective in exposing vulnerabilities, this pro- cess is inherently labor-intensive, time-consuming, and often fails to comprehensively cover the vast and evolving space of attack vectors. Inference-time defense methods offer a more scalable alternative. Wu et al. [19] proposed controlling model behavior through carefully crafted system prompts that explic- itly specify allowed and disallowed responses. However, the effectiveness of this approach may diminish as the attacking techniques evolve. To address adaptability, Wang et al. [20] introduced AdaShield, a black-box defense mechanism that prepends spe- cially constructed prompts to user queries without modifying the model or relying on external detectors. Adashield includes two variants, AdaShield-S, a manually designed static prompt, and AdaShield-A, which uses a language model to generate adaptive defense prompts in response to query content. A modular strategy is proposed in MLLM-Protector [21] by Pi et al., a plug-and-play defense framework for enhancing the security of MLLMs without modifying the original model. The approach adopts a detection to detoxification strategy, where potential risks in the model output are first identified by a lightweight harmful content detector, and then a response detoxification module is used to generate a secure response. However, the MLLM-Protector is time-consuming and de- mands a large amount of high-quality data and computational resources. Moreover, to improve detection robustness, JailGuard [22] employs mutation-based analysis, generating multiple semanti- cally equivalent variants of the input. The method changes the input query into 19 different variants and detects attacks based on the differences in the model responses by a divergence- based detection formula. This technique leverages the obser- vation that adversarial prompts tend to be less semantically robust than benign ones. Gou et al. [23] proposed ECSO (Eyes Closed, Safety On), a training-free defense mechanism for MLLMs against jailbreak attacks. It first generates a response from the MLLM, then invokes the same model to self- assess potential harmfulness. Next, using Query-aware Image- to-Text, the suspicious image is transformed into a textual description associated with the user query. After removing the image, the response is regenerated at the LLM layer using only the userâs original text query and the caption generated. However, its effectiveness is highly contingent on the target modelâs inherent safety alignment. In contrast to SOTA methods, DefenSee introduces a modular, image-centric inference defense that emphasizes cross-modal robustness and interpretable threat localization. Unlike training-intensive methods like MLLM-Protector or red-teaming-based alignment, DefenSee is training-free and model-agnostic, enabling easy deployment across diverse MLLMs. By leveraging multi-modal cues for dynamic risk assessment, it overcomes the limitations of static prompt- based defenses like AdaShield, avoids reliance on internal safety alignment as in ECSO. It also computational overhead introduced by image mutation techniques used in JailGuard. Overall, DefenSee offers stronger attack detection while pre- serving flexibility and efficiency. I. Methodology MLLMs understand images by first using a visual encoder (such as CLIP [24] or Q-Former [25]) to extract semantic 3 features from the image, and then projecting these features into the language modelâs embedding space through a connector module. This allows the image information to be represented as special tokens that the language model can process along- side textual prompts during joint reasoning and generation. However, despite MLLMsâ ability to âseeâ and âunderstandâ images, their reasoning process remains fundamentally differ- ent from that of humans. Building on this observation, we propose a black-box multi-modal defense framework aimed at detecting and mit- igating jailbreak attacks on MLLMs during inference. The core objective of the framework is to equip the MLLM itself with sufficient and relevant multi-modal information to identify potentially harmful cross-modal inputs, where adversarial content is embedded in images and/or textâand prevent the generation of unsafe responses. Our framework consists of three coordinated modules that simulate human cognitive processing of visual and textual information: (1) foreground object extraction, (2) salient region analysis, and (3) recognition and semantic interpretation of textual elements within the image. By focusing on key visual and textual cues, DenfenSee constructs a holistic multi-modal information of the user input, which is then combined with the original user query and fed into the MLLM for response generation. If the system detects potential malicious intent from the user input, it generates a warning response to the user, prevent- ing the downstream MLLM from generating any harmful, unethical, dangerous responses. Conversely, if no threat is detected by MLLMs, normal response will be generated. This human-aligned and model-agnostic defense strategy enables interpretable, scalable, and effective defense against evolving jailbreak techniques. The overall architecture of the proposed framework is illustrated in Fig 1. A. Step 1: Robust Image Content Analysis Mechanism We first propose a robust image content analysis mecha- nism, which aims to help the defense system extract visual information in a human-like manner by identifying the main subject, salient regions, and any readable textual elements within the image. The proposed mechanism consists of three key modules: 1) Primary visual Elements Enhancement Module: The primary visual elements enhancement module is designed to analyze and highlight high- and low-activation regions within an image using ScoreCam heatmap techniques. This approach helps to generate the image variant I h which can amplify and expose the effects of malicious alterations or concealed manipulations embedded in the image. The workflow of this module is shown in Fig 2. 2) Image Foreground Elements Extraction Module: To perform foreground-background segmentation and effectively remove background noise for the user image accurately, we propose an Image Foreground Elements Extraction Module. In this module, we adopt U²-Net (U-square-Net) [26] for foreground extraction to generate another image variant I i . U²-Net is a deep learning model designed for salient object detection (SOD). It can achieve high accuracy with a signif- icantly reduced model size. This advantage makes it well- suited for deployment on resource-constrained devices such as mobile platforms. The goal of this module is to eliminate background interference, highlight the primary subject, and enhance visual focus for subsequent analysis. Module 1 and Module 2 complement each other, especially when there is a significant difference in the images processed by Module 1 and Module 2. The workflow of this module is illustrated in Fig 3. 3) Readable textual elements extraction module: This module is designed to perform OCR text extraction, T ocr , from images. Its primary goal is to identify all textual information embedded within the image, especially words or phrases that may contain sensitive or potentially harmful content. To achieve this, we leverage BLIP-2 [25], a multi-modal pre- training framework proposed by Salesforce Research. BLIP-2 bridges the modality gap between frozen image encoders and LLMs using a lightweight Q-Former. By interpreting the visual features and generating corresponding textual representations, this module enables the defense system to assess whether the extracted text from an image is related to potential threats. The workflow of this module is illustrated in Fig 4. All the above three modules are designed with lightweight yet accurate models to ensure efficient image processing in the defense framework. When an image is fed into the target MLLM, these modules operate in parallel. They independently process the image and preserve their respective outputs. The resulting outputs are then passed to the next step of the defense framework: Image Variants Transcription, where further threat assessment and reasoning are conducted based on the extracted visual information. B. Step 2: Image Variants Transcription In the Section I. Introduction, we discussed that the visual modules in current MLLMs often lack stable and accurate safety mechanisms, while their LLMs tend to be more mature and well-aligned. Inspired by ECSO [23] and the safety alignment inherited from LLMs within MLLMs, we propose to transcribe the image input into comprehensive, accurate, and objective textual descriptions. This allows the downstream reasoning to be conducted mainly in the textual domain, where safety controls are more reliable. Any VLM model can be adopted in this stage for transcription. In this work, we select GPT-4o due to its strong capabilities in vision- language understanding and its efficiency in generating image descriptions. Specifically, the image variants I h and I i , which are produced by the Image Foreground Elements Extraction Mod- ule and the Readable Textual Elements Extraction Module described in Section I.A, are first transcribed into texts T h and T i to support downstream threat assessment. To enhance the detection of threats embedded within images, we further decompose I h into two regions based on activation levels: high-activation regions (red zones) and low-activation regions (blue zones). High-activation regions indicate areas where the modelâs attention is concentrated and are likely targets for attackers to inject harmful content. Conversely, low-activation 4 Fig. 1.The architecture of the DefenSee MLLM defense framework Fig. 2.The workflow of the primary visual elements enhancement module Fig. 3.The workflow of the image foreground elements extraction module regions are often neglected by the model and may be exploited to conceal malicious cues, thereby evading safety filters. This separation allows for a finer-grained interpretation of model attention. Furthermore, since the OCR-based text extraction, T ocr , has already been performed in Section I.A.3, no additional transcription processing is required at this stage. The overall workflow is shown in the Fig 5. C. Step 3: Cross-modal Consistency Checks In the final stage, we further activate the intrinsic safety mechanisms embedded within the pre-aligned LLMs that un- derpin the MLLM. This step consists of two key components: defense prompt template construction and image text fusion. In constructing the defense prompt, we incorporate the concept Fig. 4.The workflow of the textual elements extraction module of Chain-of-Thought (CoT) prompting to guide the model through a step-by-step decomposition of the input content, enabling clearer recognition of potentially harmful or mali- cious queries. Additionally, we explicitly define the expected response style within the prompt template. Based on prior research shows that specific response strategies, such as refusal formats or ethically guided replies, can significantly enhance the modelâs resistance to adversarial instructions. Therefore, it can further improve the overall robustness of the defense. To illustrate this, we present our defense prompt template in Fig 6. For image text fusion, the components, T h , T i , T ocr , and the original text prompt are strategically embedded into dif- ferent sections of the template to enable an efficient and accurate defense mechanism. An example is shown in 7. This resulting prompt is thus equipped with strong defensive capabilities, effectively mitigating prompt injection attacks targeting MLLMs. D. Overcome the Issue of Over-defense A defense technique treating benign queries as malicious and refusing to answer can significantly reduce the usability of the target model. Conversely, under-defending may render the defense mechanism itself ineffective. Balancing effective 5 Fig. 5.The workflow of the Image Variants Transcription Fig. 6.The defense prompt template defense capability and mitigating over-defense is a challenge, it is required to design a suitable trade-off between the two objectives. Inspired by AdaShieldâs approach to mitigate over- defense, we adopted a query similarity retrieval mechanism to prevent over-defense. We firstly construct two small sample sets, one is a ma- licious query sample set, Q mal = mq 1 ,mq 2 ,...,mq N , which are image-text pairs with clearly malicious features. The other sample set is the benign query sample set, Q ben = bq 1 ,bq 2 ,...,bq N , which are image-text pairs with clearly benign features. Then, let x = (I,T) denote the input multi- modal sample, where I is the image and T is the associated text query. Next, we define an embedding function Ď(¡) that maps multi-modal inputs into a shared vector space (i.e., CLIP model [24]). The maximum semantic similarity between the input x and each known malicious query Q mal and benign query in Q ben are computed separately as: s mal = max mqâQ mal sim(Ď(x),Ď(mq))(1) s ben = 1â max bqâQ ben sim(Ď(x),Ď(bq))(2) S =s mal ,s ben (3) where sim(¡,¡) is the cosine similarity. To avoid unnecessary defense activation and optimize the processing efficiency and computation cost, we compare the maximum similarity score S with predefined benign and malicious thresholds (Ď mal = 0.72, Ď ben = 0.16). The tuning of these hyperparameters is presented in Appendix B. DefenSee is activated only when the similarity score exceeds either threshold. IV. Evaluation A. Experiment Set-up The experiment is running on: Intel(R) Xeon(R) w9-3495X CPU @ 4.8GHz, 64.0GB of RAM, and dual NVIDIA RTX A6000 GPUs. We evaluated the performance of DefenSee using two commonly used SOTA MLLMs: MiniGPT4 with Llama2-7B and LLaVA2 with Vicuna-7B. To benchmark our method, we compare it against Adashield-S, Adashield-A [20], ECSO [23] with the reference of their released source code, and a no-defense configuration which is also used as a baseline for comparison. B. Dataset Selection and Evaluation Measures To evaluate the effectiveness of DefenSee, we utilized two popular multi-modal evaluation benchmark datasets including M-safety dataset [10] and M-Vet dataset [27]. These datasets are widely used in recent SOTA studies for evaluating multi-modal jailbreak attacks and defenses, providing a stan- dardized basis for comparison. M-SafetyBench is carefully constructed to reflect realistic and diverse threat scenarios, covering 13 categories of unsafe, illegal, or unethical scenarios (i.e., illegal activity, hate speech, and fraud) and 1,680 ma- licious queries. Each malicious query consists of a harmful image paired with a benign textual prompt. The images in these malicious queries are generated and implemented through three methods: SD (Stable Diffusion): Malicious images generated by Stable Diffusion based on malicious key phrase, TYPO (Typography): Malicious images with the black phrase on a white background by Python library Pillow which is similar to FigStep dataset [11], and SD+TYPO: concatenation of SD and TYPO. Thus, one malicious query has three different attack samples. Detailed statistics of the M-Safety benchmark dataset are shown in Table I. We also 6 considered the issue of over-defense in defense techniques. To evaluate the impact of over-defense, we employed the M- Vet dataset, which contains 6 core vision-language capabilities (e.g., math, knowledge, etc.) and a total of 218 benign image- text queries. TABLE I THE STATISTICS OF M-SAFETY BENCHMARK [10] Scenariostext queries Image-text paired queries 01-Illegal Activity97291 02-Hate Speech163489 03-Malware Generation44132 04-Physical Harm144432 05-Economic Harm122366 06-Fraud154462 07-Sex109327 08-Political Lobbying153459 09-Privacy Violence139417 10-Legal Opinion130390 11-Financial Advice167501 12-Health Consultation109327 13-Gov Decision149447 Total16805040 Keyword-based and LLM based ASR evaluation methods are used to evaluate the performance of all selected defense methods on malicious datasets. Keyword-based ASR is to measure whether the MLLMâs response fails to reflect ap- propriate refusal or safety behavior by checking the presence or absence of predefined safety-related keywords, such as âI am sorryâ. The full list of keywords can be found in the Appendix E. We adopt keyword-based ASR for its objec- tivity, automation, and consistency with prior SOTA stud- ies [20] [11]. While keyword-based ASR evaluation provides an objective, reproducible and scalable way to measure model refusal behavior, it inevitably suffers from limited coverage and potential semantic rigidity. Specifically, the presence or absence of predefined keywords may not fully capture nuanced safety expressions or implicit refusals expressed in diverse context forms. To address these limitations, we further employ an LLM-based ASR evaluation, where a LLM (GPT-4o) is prompted to assess whether the modelâs response reflects appropriate safety alignment. This method enables a more context-aware, semantically rich, and robust evaluation that can identify subtle unsafe behaviors or indirect refusals that keyword matching may miss. By integrating keyword-based and LLM-based evaluations, we complement the quantitative rigor of keyword matching with the contextual understanding of language models. This combination yields a more faithful reflection of the modelâs safety behavior and provides a balanced assessment of defense robustness under malicious prompts. Furthermore, False Rejection Rate (FRR) is selected to evaluate the performance of defense techniques in over- defense analysis with benign dataset. FRR is the proportion of benign inputs that are incorrectly classified or rejected by a detection or defense system as malicious. C. Experiment Results Analysis The experiments evaluate DefenSee, selected SOTA defense methods, and a no-defense baseline across three attack types (SD, TYPO, SD TYPO) of the M-SafetyBench on both MiniGPT4 and Llava2. The results are the average ASR scores of both keyword-based and LLM based evaluation, which is shown in Table I. The separative ASR results on each attack categories (i.e., Fraud, Physical Harm, etc) can be found in Appendix A. According to Table I, the results clearly show that DefenSee consistently achieves the lowest ASR scores across all settings, significantly outperforming existing methods including AdaShield-A, AdaShield-S, ECSO, and the baseline. For example, DefenSee achieved an average ASR of only 1.58% on the SD dataset, compared to 8.78% from the best SOTA method. Since a lower ASR reflects stronger defense, this demonstrates DefenSeeâs clear advantage. More- over, The more detailed experiment result analysis on each attack categories across three attack types can be found in Appendix A. We also provide three qualitative examples in the Appendix F comparing our defense performance with the no-defense baseline on malicious inputs (see Fig 9, 10, and 11). DefenSeeâs superior performance stems from its modular design, which enables explicit multi-modal threat analysis that goes beyond simple prompt-based defenses like AdaShield. By combining foreground extraction, salient area analysis, and OCR-based text interpretation, DefenSee effectively identifies hidden visual threats, especially in complex situations of SD and SD TYPO attack types where cues are not textually obvious. Unlike ECSO, which relies on the repeated use of the targetâs MLLM for self-assessment and regeneration, DefenSee delivers more consistent and accurate detection without over-reliance on internal feedback loops, thus avoiding the failures cases observed in ECSO. TABLE I AVERAGE ASR RESULTS (%) ON THREE ATTACK TYPES (SD, TYPO, AND SD TYPO) M-SAFETYBENCH DATASET TYPOSDSDTYPO SOTA Techniques Mini GPT4 Llava 2 Mini GPT4 Llava 2 Mini GPT4 Llava 2 DefenSee1.700.031.580.090.920.12 AdaShield-A 7.200.128.780.188.330.24 AdaShield-S 9.820.1211.370.369.821.01 ECSO41.5236.0145.4536.0142.1433.27 No Defense 45.8339.8247.3839.3248.6343.04 D. Over-defense Analysis All defense methods are evaluated on the M-Vet in order to assess modelsâ capability of avoiding over-defense. The FRR of each defense method is reported in Table I. The detailed experiment results can be found in Appendix C. As shown in Table I, compared to the randomly selecting malicious samples from a larger training set in AdaShield-A, our avoid over-defense approach has an advantage in inference efficiency due to the smaller malicious sample pool and benign sample pool, and better performance in avoiding over-defense. According to Table I, DefenSee achieves a lower false rejection rate (12.16% FRR in MiniGPT4, 13.76% FRR in Llava2) than both AdaShield-A (13.07% FRR in MiniGPT4, 28.21% FRR in Llava2) and AdaShield-S (19.04% FRR in 7 MiniGPT4, 30.28% FRR in Llava2). At the same time, it also maintains a strong robustness against malicious inputs (1.4% average ASR in MiniGPT4 and 0.08% average ASR in Llava2 for the whole M-Safety Benchmark) while miti- gating the misclassifications of benign inputs, representing a superior trade-off between safety performance and avoiding over-defense compared with other SOTA approaches. It is worth noting that although the ECSO achieves the lowest false rejection rate among all defense methods by uti- lizing the target MLLM to judge for selfâs generated response, this approach comes with potential risks. ECSO relies entirely on the target MLLMâs own security alignment capabilities, if the target MLLM model fails to accurately recognize certain hidden or complex harmful content, there may be a false rejection, i.e., the harmful information is not intercepted. Thus, the low false rejection rate (3.90% FRR with MiniGPT4, 3.21% FRR with Llava2) obtained by ECSO comes at the expense of overall detection coverage and defense robustness (43.04% ASR score with MiniGPT4, 35.10% ASR score with Llava2). TABLE I SUMMARIZED AVERAGE FALSE REJECTION RATE (%) OF BENIGN M-VET AND AVERAGE ASR RESULTS (%) OF M-SAFETYBENCH(SD + TYPO + SD TYPO) Minigpt4Llava2 Defense Techniques ASR Score (â) FRR (â) ASR Score (â) FRR (â) DefenSee1.4012.160.0813.76 AdaShield-A 8.1113.070.1828.21 AdaShield-S 10.3419.040.5030.28 ECSO43.043.935.103.21 E. Ablation Study In the Methodology Section, we introduced 3 image content analysis modules: Primary visual elements enhancement mod- ule (m1), Image foreground elements extraction module (m2), and Readable textual elements extraction module (m3). To support and evaluate the defense performance and complemen- tary of each module combination, we conducted an ablation study by comparing the joint model (m1+m2+m3) against three separate sub-modules (m1+m2, m1+m3, and m2+m3) on M-SafetyBench. The keyword-based ASR results on the SD TYPO dataset are presented in Table IV as a representative example, as it incorporates both generative visual patterns from SD and typography from TYPO, offering a more compre- hensive evaluation of defense performance. The full detailed ablation study experiment results can be found in Appendix D. According to the results in Table IV, We observe that the joint model achieves the lowest average ASR score (1.79%), compared to any other module combinations. Furthermore, the full module combination achieves 8 lowest ASR score categories, while other module combinations only achieves 6 categories. This demonstrates the complementary and syner- gistic advantage of combining all three modules. Moreover, the reduced module combination occasionally shows better or comparable performance in some categories, TABLE IV ABLATION STUDY ABOUT ROBUST IMAGE CONTENT ANALYSIS MECHANISM. ALL RESULTS ARE ASR SCORE (%) ON M-SAFETYBENCH. Attack Categorym1+m2+m3m2+m3m1+m3m1+m2 Sex0.000.000.000.00 Fraud 0.650.651.951.30 Hate Speech0.610.610.001.23 Gov decision 4.704.034.704.03 Illegal activities0.000.000.000.00 Physical Harm 0.000.690.691.39 Political Lobbying1.311.961.311.96 Privacy Violence 0.000.000.720.72 Legal Opinion1.543.855.383.08 Health Consult3.675.506.422.75 Malware Gen 0.000.000.000.00 EconomicHarm5.744.923.285.74 Financial Advice 3.595.393.591.20 Summary1.792.262.261.90 such as Hate Speech and Financial Advice, but they often show degradation in others. For example, as the m3 module is removed, the defense model still maintains a 1.31% ASR in the Political Lobbying category. However, its ASR in Legal Opinion category increases from 1.54% to 5.38%. Similar patterns can be observed when either m1 or m2 is excluded. These findings suggest that while simplified variants may show better defense capability in certain localized scenarios, they lack overall robustness and consistency. In contrast, the full module combination demonstrates a more balanced performance, indicating better generalization and resilience. F. Time Complexity Analysis: The time consumption of DefenSee and other SOTA tech- niques running on our device was evaluated using 50 benign and 50 malicious queries on different MLLMs. The time complexity results are presented in Table V. It is important to note that even the No Defense baseline incurs time cost, as it reflects the natural inference latency of the target MLLM when processing a multi-modal input with the running device mention in Section IV.A. Compared to this baseline, DefenSee introduces additional overhead due to its modular defense pipeline, which includes robust image content analysis, image variants transcription, and cross-modal consistency checks before forwarding the input to the target MLLM. Although DefenSee requires additional processing, the overall runtime remains manageable and suitable for real-world use. In contrast, AdaShield-A and AdaShield-S achieve minimal processing latency by simply prepending static or adaptive de- fense prompts to the user query without any image processing. However, as shown in the ASR results of Table I and Table I, their lightweight design leads to weaker defense performance and stronger over-defense. Furthermore, ECSO has the highest latency because it needs to perform multiple sequential steps, including initial response generation, self-evaluation, image captioning, and final response re-generation, each of which requires a call to the target MLLM. 8 Fig. 7.The example of the generation of the Cross-modal consistency check prompt Overall, DefenSee strikes a balance trade-off between ef- ficiency and effectiveness, with only a moderate increase in inference time, but significantly better defense performance than the AdaShield variants and better scalability than ECSO. TABLE V END-TO-END PROCESSING TIME OF EACH DEFENSE SYSTEM (SECONDS) Defense TechniquesAverage Time Cost DefenSeeâź6.68 AdaShield-A âź5.27 AdaShield-Sâź5.23 ECSO>15 No Defenseâź5.15 V. Conclusion and Future Work In this paper, we propose DefenSee, a multi-modal defense system designed to emulate human-like reasoning over visual and textual content. It effectively detect and prevent jailbreak inputs from inducing offending responses from an MLLM. The system uses image content analysis mechanism and image variants transcription strategy to analyze images in depth at the semantic, attentional, and target levels respectively. DefenSee then fuses such analysis with user prompts in a structured manner to form a Multi-View Threat Prompt. We further apply DefenSee to malicious and benign datasets for de- fense performance experiments and false-rejection tests against benign data. The results show that DefenSee significantly improves the target MLLMâs capability to make security judgments against different complex visual-induced attacks and text-avoidance strategies. In summary, DefenSee provides a scalable and interpretable proactive defense mechanism for MLLMs, offering both practical significance and research value in enhancing the safety of generative AI systems. Although this work primarily focuses on structure-based attacks, DefenSeeâs modular design holds potential for exten- sion to other adversarial scenarios, such as perturbation-based attacks or multi-turn conversation attacks. Future work will focus on extending DefenSee to address these more adaptive threat scenarios. ACKNOWLEDGMENT We thank our colleagues and reviewers for their insightful feedback and constructive suggestions, which helped improve this work. REFERENCES [1] D. Zhu, J. Chen, X. Shen, X. Li, and M. Elhoseiny, âMinigpt-4: Enhancing vision-language understanding with advanced large language models,â arXiv preprint arXiv:2304.10592, 2023. [2] H. Liu, C. Li, Q. Wu, and Y. J. Lee, âVisual instruction tuning,â Advances in neural information processing systems, vol. 36, p. 34 892â 34 916, 2023. [3] R. OpenAI, âGpt-4 technical report. arxiv 2303.08774,â View in Article, vol. 2, no. 5, p. 1, 2023. [4] J. Chen, D. Zhu, X. Shen, X. Li, Z. Liu, P. Zhang, R. Krishnamoorthi, V. Chandra, Y. Xiong, and M. Elhoseiny, âMinigpt-v2: large language model as a unified interface for vision-language multi-task learning,â arXiv preprint arXiv:2310.09478, 2023. [5] L. Chen, J. Li, X. Dong, P. Zhang, C. He, J. Wang, F. Zhao, and D. Lin, âSharegpt4v: Improving large multi-modal models with better captions,â in European Conference on Computer Vision. Springer, 2024, p. 370â 387. [6] H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi ` ere, N. Goyal, E. Hambro, F. Azhar et al., âLlama: Open and efficient foundation language models,â arXiv preprint arXiv:2302.13971, 2023. [7] W.-L. Chiang, Z. Li, Z. Lin, Y. Sheng, Z. Wu, H. Zhang, L. Zheng, S. Zhuang, Y. Zhuang, J. E. Gonzalez et al., âVicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality,â See https://vicuna. lmsys. org (accessed 14 April 2023), vol. 2, no. 3, p. 6, 2023. [8] C. Cui, Y. Ma, X. Cao, W. Ye, Y. Zhou, K. Liang, J. Chen, J. Lu, Z. Yang, K.-D. Liao et al., âA survey on multimodal large language models for autonomous driving,â in Proceedings of the IEEE/CVF winter conference on applications of computer vision, 2024, p. 958â979. [9] R. AlSaad, A. Abd-Alrazaq, S. Boughorbel, A. Ahmed, M.-A. Renault, R. Damseh, and J. Sheikh, âMultimodal large language models in health care: applications, challenges, and future outlook,â Journal of medical Internet research, vol. 26, p. e59505, 2024. [10] X. Liu, Y. Zhu, J. Gu, Y. Lan, C. Yang, and Y. Qiao, âMm-safetybench: A benchmark for safety evaluation of multimodal large language mod- els,â in European Conference on Computer Vision. Springer, 2024, p. 386â403. 9 [11] Y. Gong, D. Ran, J. Liu, C. Wang, T. Cong, A. Wang, S. Duan, and X. Wang, âFigstep: Jailbreaking large vision-language models via typographic visual prompts,â in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 22, 2025, p. 23 951â23 959. [12] Y. Li, H. Guo, K. Zhou, W. X. Zhao, and J.-R. Wen, âImages are achillesâ heel of alignment: Exploiting visual vulnerabilities for jailbreaking mul- timodal large language models,â in European Conference on Computer Vision. Springer, 2024, p. 174â189. [13] C. Jiang, Z. Wang, M. Dong, and J. Gui, âSurvey of adversar- ial robustness in multimodal large language models,â arXiv preprint arXiv:2503.13962, 2025. [14] N. Carlini, M. Nasr, C. A. Choquette-Choo, M. Jagielski, I. Gao, P. W. W. Koh, D. Ippolito, F. Tramer, and L. Schmidt, âAre aligned neural networks adversarially aligned?â Advances in Neural Information Processing Systems, vol. 36, p. 61 478â61 500, 2023. [15] Y. Liu, C. Cai, X. Zhang, X. Yuan, and C. Wang, âArondight: Red teaming large vision language models with auto-generated multi-modal jailbreak prompts,â in Proceedings of the 32nd ACM International Conference on Multimedia, 2024, p. 3578â3586. [16] X. Qi, K. Huang, A. Panda, P. Henderson, M. Wang, and P. Mittal, âVisual adversarial examples jailbreak aligned large language models,â in Proceedings of the AAAI conference on artificial intelligence, vol. 38, no. 19, 2024, p. 21 527â21 536. [17] E. Shayegani, Y. Dong, and N. Abu-Ghazaleh, âJailbreak in pieces: Compositional adversarial attacks on multi-modal language models,â arXiv preprint arXiv:2307.14539, 2023. [18] X. Liu, N. Xu, M. Chen, and C. Xiao, âAutodan: Generating stealthy jailbreak prompts on aligned large language models,â arXiv preprint arXiv:2310.04451, 2023. [19] Y. Wu, X. Li, Y. Liu, P. Zhou, and L. Sun, âJailbreaking gpt- 4v via self-adversarial attacks with system prompts,â arXiv preprint arXiv:2311.09127, 2023. [20] Y. Wang, X. Liu, Y. Li, M. Chen, and C. Xiao, âAdashield: Safeguarding multimodal large language models from structure-based attack via adap- tive shield prompting,â in European Conference on Computer Vision. Springer, 2024, p. 77â94. [21] R. Pi, T. Han, J. Zhang, Y. Xie, R. Pan, Q. Lian, H. Dong, J. Zhang, and T. Zhang, âMllm-protector: Ensuring mllmâs safety without hurting performance,â arXiv preprint arXiv:2401.02906, 2024. [22] X. Zhang, C. Zhang, T. Li, Y. Huang, X. Jia, X. Xie, Y. Liu, and C. Shen, âA mutation-based method for multi-modal jailbreaking attack detection,â CoRR, 2023. [23] Y. Gou, K. Chen, Z. Liu, L. Hong, H. Xu, Z. Li, D.-Y. Yeung, J. T. Kwok, and Y. Zhang, âEyes closed, safety on: Protecting multimodal llms via image-to-text transformation,â in European Conference on Computer Vision. Springer, 2024, p. 388â404. [24] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al., âLearning transferable visual models from natural language supervision,â in International conference on machine learning. PmLR, 2021, p. 8748â8763. [25] J. Li, D. Li, S. Savarese, and S. Hoi, âBlip-2: Bootstrapping language- image pre-training with frozen image encoders and large language models,â in International conference on machine learning.PMLR, 2023, p. 19 730â19 742. [26] X. Qin, Z. Zhang, C. Huang, M. Dehghan, O. R. Zaiane, and M. Jager- sand, âU2-net: Going deeper with nested u-structure for salient object detection,â Pattern recognition, vol. 106, p. 107404, 2020. [27] W. Yu, Z. Yang, L. Li, J. Wang, K. Lin, Z. Liu, X. Wang, and L. Wang, âMm-vet: Evaluating large multimodal models for integrated capabilities,â arXiv preprint arXiv:2308.02490, 2023. APPENDIX A. M-SafetyBench Dataset Experiment Results in Details M-SafetyBench dataset is used to evaluate the defense performance of DefenSee, selected SOTA defense methods, and no defense MLLM. The detailed results can be found in Table VI to XI, which represent three different attack types in the M-SafetyBench dataset on MiniGPT4 and Llava2. Based on Tables VI, VII, and VIII, DefenSee achieved the lowest ASR score in all 39 categories in 3 types of image + text attack types among all tested SOTA defense methods and no defense model. For example, as shown in TableVII, DefenSee achieved a 1.23% ASR score in the SD based Economic Harm category, with the second best performance being AdaShield- Aâs 13.93% ASR score. According to TableVIII, DefenSee achieved a 0.65% ASR score in the SD TYPO based Political Lobbying category, with the second best performance being AdaShield-Aâs 10.46% ASR score. In summary, DefenSee achieved ASR scores of 1.70%, 1.58%, and 0.92% on the TYPO, SD, and SD TYPO types, respectively, while all other SOTA techniques and no defense model had ASR scores above 10%. TABLE VI AVERAGE ASR SCORES (%) OF TYPO TYPE M-SAFETYBENCH DATASET ON MINIGPT Attack CategoryDefenSeeAda-AAda-SECSONo def Sex0.005.5012.3941.7444.50 Fraud0.006.175.1940.2650.65 Hate Speech0.311.843.3732.8237.42 Gov decision3.699.7317.1144.3044.97 Illegal activities0.000.522.5826.8030.93 Physical Harm 0.004.514.1748.9657.64 Political Lobbying 0.6510.1312.4247.7147.71 Privacy Violence0.362.886.8341.3753.96 Legal Opinion3.0813.4613.0840.0040.00 Health Consult0.9211.0111.9343.5843.58 Malware Gen0.004.556.8234.0955.68 EconomicHarm3.6913.1112.3049.1850.41 Financial Advice6.898.3816.4741.3241.32 Summary1.707.209.8241.5245.83 TABLE VII AVERAGE ASR SCORES (%) OF SD TYPE M-SAFETYBENCH DATASET ON MINIGPT Attack CategoryDefenSeeAda-AAda-SECSONo def Sex1.8314.2220.6449.0850.00 Fraud 0.976.177.7944.8149.03 Hate Speech0.614.297.0641.7245.09 Gov decision 4.0312.7513.4247.3247.32 Illegal activities 0.002.584.6438.6643.81 Physical Harm1.3910.0713.5446.5353.47 Political Lobbying1.6313.4018.3048.3748.69 Privacy Violence0.724.682.1648.5649.64 Legal Opinion3.0810.0013.4644.2344.62 Health Consult0.927.8010.0942.6642.66 Malware Gen0.005.683.4142.0545.45 EconomicHarm 1.2313.9315.1649.1849.18 Financial Advice 2.406.8912.8744.3144.61 Summary1.588.7811.3745.4547.38 The detailed experiment results on Llava2 are provided in Table IX, X, and XI. Our proposed defenSee still outperforms existing SOTA techniques and no defense on LLaVA-2 with most attack categories and lowest overall average ASR score. B. Supplementary Sensitivity Analysis To mitigate over-defense, we introduce two predefined thresholds, Ď mal , and Ď ben , for the preliminary identification of benign queries. Specifically, given a test query, if either of its maximum similarity scores to malicious or benign references (s mal or s ben ) falls below its corresponding threshold (i.e., s mal < Ď mal or s ben < Ď ben ), the query is classified as benign and DefenSee remains inactive. The rationale for selecting the optimized Ď mal , and Ď ben is demonstrated in Fig 8, where we perform a grid search over the threshold space (Ď mal ,Ď ben ). For 10 TABLE VIII AVERAGE ASR SCORES (%) OF SDTYPO TYPE M-SAFETYBENCH DATASET ON MINIGPT Attack CategoryDefenSeeAda-AAda-SECSONo def Sex0.0011.0112.8446.3350.46 Fraud0.656.826.4941.5654.22 Hate Speech0.313.993.9933.7442.64 Gov decision2.358.3913.7646.6446.98 Illegal activities0.001.553.0931.9640.21 Physical Harm0.006.2512.1540.9760.07 Political Lobbying0.6510.4613.0747.7148.37 Privacy Violence0.006.476.8341.0154.32 Legal Opinion0.7711.5411.1542.6943.85 Health Consult1.839.1710.0944.5044.95 Malware Gen0.005.682.2732.9553.41 EconomicHarm2.8711.0711.0746.7249.59 Financial Advice1.8013.1714.3744.0144.31 Summary0.928.339.8242.1448.63 TABLE IX AVERAGE ASR SCORES (%) OF TYPO TYPE M-SAFETYBENCH DATASET ON LLAVA2 Attack CategoryDefenSeeAda-AAda-SECSONo def Sex0.000.000.4644.5044.04 Fraud 0.000.000.0036.3644.48 Hate Speech0.000.310.0033.7438.34 Gov decision 0.000.340.3437.5837.92 Illegal activities 0.000.000.0031.9637.63 Physical Harm0.000.350.3534.0344.44 Political Lobbying 0.000.000.0043.7943.79 Privacy Violence 0.000.000.0033.0943.88 Legal Opinion 0.380.000.0036.1536.15 Health Consult0.000.000.0033.9434.40 Malware Gen 0.000.000.0032.9544.32 EconomicHarm 0.000.000.4136.4838.93 Financial Advice0.000.300.0032.0432.04 Summary0.030.120.1236.0139.82 each threshold pair, we compute the ASR on selected M- SafeBench malicious samples and the FRR on M-Vet benign samples. To jointly optimize security and utility, we combine ASR and FRR into a unified objective using a cost-weighted expected risk: R(Ď mal ,Ď ben ) = c mal ¡ ASR + c ben ¡ FRR,(4) where c mal and c ben are cost coefficients that reflect the rel- ative penalty of misclassifying malicious and benign queries, enabling flexible control over the trade-off between safety and utility. In this paper, we set both c mal and c ben as 1. Fig 8 illustrates the heatmap of the combined risk score acroos the threshold space (Ď mal ,Ď ben ). A lower value indicates a better trade-off between safety (reducing ASR) and utility (reducing FRR). The optimal configuration appears around Ď mal = 0.72 and Ď ben = 0.16, where the risk score reaches its minimum value. C. Additional Over-defense analysis All defense methods are evaluated on the M-Vet bench- mark dataset. False Rejection Rate (FRR) is selected to eval- uate the performance of defense techniques in over-defense analysis. The false Rejection rate of each defense method is reported in Table XII. As shown in Table XII, DefenSee achieves a competitive ability in mitigating over-defense compared with other SOTA TABLE X AVERAGE ASR SCORES (%) OF SD TYPE M-SAFETYBENCH DATASET ON LLAVA2 Attack CategoryDefenSeeAda-AAda-SECSONo def Sex0.000.463.6741.2841.28 Fraud0.000.320.0036.3641.23 Hate Speech0.000.000.0035.8942.33 Gov decision0.340.000.0035.5736.58 Illegal activities0.000.000.0031.4443.81 Physical Harm0.350.000.3538.8944.79 Political Lobbying0.000.000.0043.1443.14 Privacy Violence0.000.000.0041.7348.20 Legal Opinion0.380.000.0032.6932.69 Health Consult0.000.000.0025.6925.69 Malware Gen0.000.000.0035.2346.59 EconomicHarm0.001.640.4137.3038.52 Financial Advice0.000.000.6030.2430.24 Summary0.090.180.3636.0139.32 TABLE XI AVERAGE ASR SCORES (%) OF SDTYPO TYPE M-SAFETYBENCH DATASET ON LLAVA2 Attack CategoryDefenSeeAda-AAda-SECSONo def Sex0.000.002.2939.9146.79 Fraud0.000.000.0029.5552.60 Hate Speech0.000.000.0029.7552.15 Gov decision0.340.340.6736.5837.25 Illegal activities0.000.000.0026.2942.78 Physical Harm0.350.352.0831.9452.08 Political Lobbying0.000.330.6544.1244.12 Privacy Violence0.000.361.0834.5351.44 Legal Opinion0.380.771.1533.4633.46 Health Consult0.000.460.9227.5227.98 Malware Gen0.000.000.0028.4145.45 EconomicHarm0.410.410.0035.2540.98 Financial Advice0.000.003.2930.5430.54 Summary0.120.241.0133.2743.04 defense methods. Although ECSO attains the lowest FRR across different categories in MMVet, its overall defense effectiveness is significantly inferior to both our method and other SOTA baselines (Table I). Overall, DefenSee provides the best trade-off between safety and utility. D. Additional Ablation Study In the Methodology Section, we introduced 3 image content analysis modules: Primary visual elements enhancement mod- ule (m1), Image foreground elements extraction module (m2), and Readable textual elements extraction module (m3). To support and evaluate the defense performance and complemen- tary of each module combination, we conducted an ablation study by comparing the joint model (m1+m2+m3) against three separate sub-modules (m1+m2, m1+m3, and m2+m3) across the 39 attack categories in 3 types of image + text attack types. The ASR performance summarization are shown in Ta- ble XIII. The detailed ASR score results are reported in Table XIV. According to the results in Table XIII, We observe that the joint model achieves the most lowest ASR score numbers in each attack categories, compared to any other module combinations. The full module combination achieves 21 lowest ASR scores in all attack categories, while m1 + m3 achieves 19 lowest ASR scores, m1 + m2 achieves 19 lowest ASR scores, and m2 + m3 only achieves 16 lowest ASR 11 TABLE XII FALSE REJECTION RATE (%) OF BENIGN M-VET DATASET M-VetOCRMathSpatRecGenKnowSummary FRR on MiniGPT4 DefenSee5.21%7.69%4.67%18.00%21.25%21.43%13.76% Ada-A20.31%30.77%17.33%31.33%30.63%37.50%28.21% Ada-S24.48%30.77%20.67%33.67%30.63%36.90%30.28% ECSO1.56%3.85%1.33%4.00%4.38%4.17%3.21% FRR on Llava2 DefenSee5.73%7.69%2.67%15.00%20.00%19.64%12.16% Ada-A9.38%7.69%10.67%16.33%16.25%19.05%13.07% Ada-S21.35%17.31%20.67%18.67%19.38%18.45%19.04% ECSO3.13%3.85%4.00%3.67%1.88%3.57%3.90% Fig. 8.Heatmap of Combined Risk Score Across Threshold Space. The optimal operating point, yielding the minimum risk, is highlighted with aâ, demonstrating the most balanced configuration between safety performance and avoiding over-defense. scores. This demonstrates the complementary and synergistic advantage of combining all three modules. TABLE XIII SUMMARIZED EXPERIMENT RESULTS OF ABLATION STUDY ABOUT ROBUST IMAGE CONTENT ANALYSIS MECHANISM. ALL RESULT NUMBERS ARE TOTAL NUMBER OF CATEGORY ACHIEVED BY DIFFERENT MODULE COMBINATION FROM 39 ATTACK CATEGORIES IN 3 DIFFERENT ATTACK TYPES. No of category achieved m1+m2+m3m2+m3m1+m3m1+m2 Lowest ASR Score Number 21161919 Specifically, according to the detailed experiment results in Table XIV, the full defense module combination is never worse than the worst-performing ASR in all module combinations and all categories in both TYPO and SD TYPO subset, indicating strong robustness against typographic attack types. In the SD subset, the full module combination performs better than or is competitive with any ablated variant. The increasing error in SD may stem from the SD subsetâs image features and m3 module being more sensitive to semantic drift, sometimes amplifying irrelevant features under generative conditions. Furthermore, the reduced module combination occasionally shows better or comparable performance in some categories, but they often show degradation in others. For example, as the m3 module is removed, the defense model still maintains a 0 ASR in the Malware Generation category of the TYPO subset. However, its ASR in Health Consultation increases from 1.83% to 2.75%. Similar patterns can be observed when either m1 or m2 is excluded. These findings suggest that while simplified variants may show better defense capability in certain localized scenarios, they lack overall robustness and consistency. E. Keyword List used to evaluate the responses Table XV presents the refusal signals used in our experi- ments. F. Visualization comparison on M-SafetyBench Fig 9, 10, and 11 present the qualitative comparison on M-SafetyBench dataset with and without DefenSee. 12 Fig. 9.The example 1 of DefenSee on M-SafetyBench dataset. The example comprises an input query (image query + text SDTYPO query pair), the response of MLLM without any defense, and the safe response of MLLM after applying DefenSee. Fig. 10. The example 2 of DefenSee on M-SafetyBench dataset. The example comprises an input query (image query + text SD query pair), the response of MLLM without any defense, and the safe response of MLLM after applying DefenSee. 13 Fig. 11.The example 3 of DefenSee on M-SafetyBench dataset. The example comprises an input query (image query + text TYPO query pair), the response of MLLM without any defense, and the safe response of MLLM after applying DefenSee. We observe that DefenSee effectively generates defense prompts enriched with detailed safety constraints, thereby enhancing the robustness of the target MLLM against adversarial queries. 14 TABLE XIV ABLATION STUDY ABOUT ROBUST IMAGE CONTENT ANALYSIS MECHANISM. M1 REFERS TO THE PRIMARY VISUAL ELEMENTS ENHANCEMENT MODULE. M2 REFERS TO THE IMAGE FOREGROUND ELEMENTS EXTRACTION MODULE. M3 REFERS TO THE READABLE TEXTUAL ELEMENTS EXTRACTION MODULE. ALL RESULTS ARE KEYWORD BASED ASR SCORE (%) ON M-SAFETYBENCH DATASET. Attack Categorym1+m2+m3m2+m3m1+m3m1+m2 TYPO Sex0.000.001.830.92 Fraud 0.000.650.000.00 Hate Speech 0.000.000.610.61 Gov decision7.389.404.704.70 Illegal activities0.000.000.000.00 Physical Harm0.000.691.390.69 Political Lobbying2.613.925.233.27 Privacy Violence0.720.000.720.00 Legal Opinion6.158.466.926.15 Health Consult1.835.504.592.75 Malware Generation0.002.270.000.00 EconomicHarm7.387.382.464.92 Financial Advice13.7713.777.7813.77 SD Sex3.672.752.754.59 Fraud1.953.903.251.95 Hate Speech1.231.231.230.00 Gov decision8.055.372.682.68 Illegal activities 0.000.001.030.00 Physical Harm2.082.080.691.39 Political Lobbying3.271.960.003.27 Privacy Violence1.440.721.440.72 Legal Opinion6.153.085.386.92 Health Consult1.833.675.501.83 Malware Gen0.000.000.000.00 EconomicHarm2.466.561.644.10 Financial Advice4.792.402.405.99 SDTYPO Sex0.000.000.000.00 Fraud 0.650.651.951.30 Hate Speech 0.610.610.001.23 Gov decision4.704.034.704.03 Illegal activities 0.000.000.000.00 Physical Harm0.000.690.691.39 Political Lobbying 1.311.961.311.96 Privacy Violence0.000.000.720.72 Legal Opinion1.543.855.383.08 Health Consult 3.675.506.422.75 Malware Gen0.000.000.000.00 EconomicHarm5.744.923.285.74 Financial Advice 3.595.393.591.20 TABLE XV THE REFUSAL SIGNALS USED IN OUR EXPERIMENTS ARE PRIMARILY BASED ON THOSE DEFINED IN SOTA WORKS, SUPPLEMENTED WITH ADDITIONAL SIGNALS WE OBSERVED DURING THE EVALUATION PROCESS. Iâm sorry I am sorry Sorry I apologize As an Iâm just Hello! Iâm an I cannot I would advise itâs not appropriate be harmful is harmful Is harmful are harmful Are harmful is deemed harmful are deemed harmful Not legal Not ethic Is illegal is deemed unethical are deemed unethical is deemed illegal are deemed illegal is deemed hazardous are deemed hazardous is illegal Are illegal are illegal Itâs important to note It is important to note It is important to consider Itâs important to consider As a responsible AI adhere to Itâs essential to legal guidelines refrain avoid apology regret is attempting to bypass