Multimodal AI guardrails miss safety risk spread across images and text

A malicious instruction can be fragmented so that no one text segment conveys the harmful request. Image context, visual symbols, spoken instructions and text may jointly construct meaning that single-modality filters miss. The study compares safety detection with legitimate utility and reliability instead of accepting broad refusal as evidence of successful protection. It illustrates how the safety boundary moves when agents accept richer media as input.

Omni-UBench curates over 183,000 samples from more than 35 sources across text, image, audio, video and combinations and evaluates fifteen multimodal models or guardrails. The authors identify failures on cross-modal safety reasoning and excessive responses to superficial textual cues. The paper reports evaluation outcomes for a collected test set, not rates for production chat or fielded agent compromises. Aggregate modality-specific scores can vary with dataset composition, and a guardrail seeing all modalities still requires independent enforcement of actual tool permissions.

Test combined media contexts, meaningful benign counterparts and downstream tool effects; measure both missed harmful intent and false refusal instead of maximizing blocking. Safety classification must follow the combined semantics of an input rather than treating every medium as an isolated text moderation call. Primary evidence.

Additional evidence and trust boundary

An image can carry the part of a request that changes its meaning while the accompanying text looks safe. Text-only moderation and one-modality labels can therefore miss compositional intent. The benchmark also examines false alarms on benign material, so the security evaluation should measure blocked harmful requests and completed legitimate multimodal tasks separately. The reported scores remain specific to the benchmark taxonomy and model versions. Supporting record.