{"id":"https://openalex.org/W7163137385","doi":"https://doi.org/10.48550/arxiv.2606.01837","title":"Benign Inputs, Harmful Outputs: Cross-Modal Jailbreaking via Distributed Semantic Recomposition","display_name":"Benign Inputs, Harmful Outputs: Cross-Modal Jailbreaking via Distributed Semantic Recomposition","publication_year":2026,"publication_date":"2026-06-01","ids":{"openalex":"https://openalex.org/W7163137385","doi":"https://doi.org/10.48550/arxiv.2606.01837"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.01837","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.01837","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.01837","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137640361","display_name":"Yani Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Yani","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137641812","display_name":"Yilong Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Yilong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137683541","display_name":"Yang Liu","orcid":"https://orcid.org/0009-0000-7025-5293"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137680760","display_name":"Zhuzhu Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Zhuzhu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137706923","display_name":"Zuobin Ying","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ying, Zuobin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137615540","display_name":"Zhuo Ma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Zhuo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.32710000872612,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.32710000872612,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.15440000593662262,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12262","display_name":"Hate Speech and Cyberbullying Detection","score":0.1379999965429306,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.6175000071525574},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.5148000121116638},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.4846999943256378},{"id":"https://openalex.org/keywords/cognition","display_name":"Cognition","score":0.4503999948501587},{"id":"https://openalex.org/keywords/block","display_name":"Block (permutation group theory)","score":0.38449999690055847},{"id":"https://openalex.org/keywords/content","display_name":"Content (measure theory)","score":0.2973000109195709}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7192000150680542},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.6175000071525574},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.5148000121116638},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.4880000054836273},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.4846999943256378},{"id":"https://openalex.org/C169900460","wikidata":"https://www.wikidata.org/wiki/Q2200417","display_name":"Cognition","level":2,"score":0.4503999948501587},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42640000581741333},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.38449999690055847},{"id":"https://openalex.org/C2778152352","wikidata":"https://www.wikidata.org/wiki/Q5165061","display_name":"Content (measure theory)","level":2,"score":0.2973000109195709},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.27399998903274536},{"id":"https://openalex.org/C189950617","wikidata":"https://www.wikidata.org/wiki/Q937228","display_name":"Property (philosophy)","level":2,"score":0.27149999141693115},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.25360000133514404}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.01837","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.01837","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.01837","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.01837","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.46340954303741455}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Multimodal":[0],"Large":[1],"Language":[2],"Models":[3],"(MLLMs)":[4],"have":[5],"recently":[6],"demonstrated":[7],"remarkable":[8],"capabilities":[9],"in":[10,157],"content":[11,50,70],"synthesis":[12],"and":[13,67,97],"autonomous":[14],"reasoning.":[15],"Previous":[16],"safety":[17,63],"guardrails":[18],"are":[19],"primarily":[20],"designed":[21],"for":[22],"unimodal":[23,36],"textual":[24,37,96],"input":[25,53,147],"interception,":[26],"leaving":[27],"them":[28],"vulnerable":[29],"to":[30,65],"cross-modal":[31,40,84,121],"jailbreak":[32,85],"attacks.":[33],"However,":[34],"regardless":[35],"attack":[38,136],"or":[39,48,144],"jailbreak,":[41],"typically":[42],"inclusive":[43],"part":[44],"of":[45,94,111],"explicit":[46],"harmful":[47,89,117,174],"sensitive":[49],"at":[51],"the":[52,61,102,108,120,160],"level,":[54],"which":[55],"is":[56],"called":[57],"Harm-Bearing.":[58],"It":[59],"allow":[60],"model's":[62,103,161],"filters":[64],"detect":[66],"block":[68],"such":[69],"easily.":[71],"To":[72],"address":[73],"this":[74],"limitations,":[75],"we":[76],"propose":[77],"Distributed":[78],"Semantic":[79],"Recomposition":[80],"(DSR),":[81],"a":[82,92,153],"novel":[83],"framework":[86],"that":[87,132],"decomposes":[88],"intent":[90],"into":[91,116],"set":[93],"benign":[95],"visual":[98],"primitives.":[99],"By":[100],"exploiting":[101],"reasoning":[104],"ability,":[105],"DSR":[106,133],"enables":[107],"latent":[109],"fusion":[110],"these":[112],"seemingly":[113],"innocent":[114],"components":[115],"outputs":[118],"during":[119],"inference":[122],"phase.":[123],"Extensive":[124],"experiments":[125],"on":[126],"multiple":[127],"commercial":[128],"MLLMs":[129],"pipelines":[130],"demonstrate":[131],"achieves":[134],"superior":[135],"success":[137],"rates":[138],"while":[139],"maintaining":[140],"an":[141],"extremely":[142],"low":[143],"even":[145],"negligible":[146],"toxicity":[148],"rate.":[149],"Our":[150],"findings":[151],"uncover":[152],"critical":[154],"Utility-Safety":[155],"Paradox":[156],"MLLMs,":[158],"where":[159],"instruction-following":[162],"proficiency":[163],"facilitates":[164],"its":[165],"own":[166],"cognitive":[167],"exploitation.":[168],"Content":[169],"Warning:":[170],"This":[171],"paper":[172],"contains":[173],"model":[175],"responses.":[176]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-03T00:00:00"}