🤖 AI

Securing Multimodal AI through Internal Information Decomposition

The paper proposes FlowGuard, a lightweight inference-time framework that secures multimodal AI by detecting adversarial attacks through internal cross-modal consistency monitoring using Partial Information Decomposition-inspired FlowVectors, achieving significant reductions in attack success rates with minimal latency and utility loss.

Original authors: Jehyeok Yeon, Hyeonjeong Ha, Qiusi Zhan, Heng Ji

Published 2026-07-27

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Jehyeok Yeon, Hyeonjeong Ha, Qiusi Zhan, Heng Ji

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are building a robot that can see the world through a camera and talk to you through a microphone. This robot is a "Multimodal Large Language Model," a super-smart AI that combines pictures and words to understand what's happening. But here's the tricky part: just because the robot sees a harmless picture and hears a harmless sentence doesn't mean the combination of the two is safe. It's like if you handed a chef a picture of a cake and a recipe for a cake, but then whispered a secret code in their ear that told them to add poison. The picture looks fine, the recipe looks fine, but the final dish is dangerous. This is the new kind of danger researchers are worried about: hackers who split their bad intentions between an image and a text so that neither one looks suspicious on its own, but together they trick the AI into doing something harmful.

To catch these sneaky tricks, scientists usually try to check the picture or the text separately, like a security guard checking a bag and a person's ID one by one. But this paper suggests a smarter way: instead of just looking at the inputs, we should watch how the robot's brain thinks about them. The core idea is that when a robot is working normally, the picture and the text should agree with each other and help the robot make a clear, confident decision. If a hacker is trying to trick the robot, that internal agreement breaks down. The robot's brain gets confused, or the picture and text start pulling in opposite directions, even if the final answer looks smooth. The paper proposes a new safety system called FlowGuard that acts like a "thought detective," watching the robot's internal reasoning process to spot when the picture and text are fighting each other or acting weirdly, rather than just checking the surface-level words or pixels.

The Story of FlowGuard: Catching the "Thought Fracture"

The researchers behind this paper, led by Jehyeok Yeon and colleagues, noticed something fascinating about how these AI models work. When you give a model a normal image and a normal question, the part of the brain that looks at the picture and the part that reads the text usually get along great. They share information, agree on what's important, and the final answer feels stable and certain. It's like two friends building a sandcastle together; they both know what the castle should look like, and their combined effort makes the castle stronger and more detailed.

However, when an attacker tries to "jailbreak" the model—forcing it to ignore its safety rules by hiding a bad instruction in a picture or a text—the harmony breaks. The paper suggests that even if the attacker is clever enough to make the picture and the text look innocent on their own, the moment the model tries to combine them, something goes wrong. The internal logic gets "fractured." The picture might be screaming one thing while the text is whispering another, or the combination creates a confusing mess that the model's brain can't resolve smoothly.

To catch this, the team built FlowGuard. Think of FlowGuard not as a guard at the door, but as a translator sitting right inside the robot's brain. It doesn't just look at the final answer; it peeks at the very first split-second of the robot's decision-making process. It asks three quick questions:

What would the robot say if it only looked at the picture?
What would it say if it only read the text?
What does it say when it looks at both together?

Then, it compares these three answers. In a safe situation, the "both" answer should be a happy mix of the other two, like a smooth blend of red and yellow paint making orange. But in an attack, the "both" answer might suddenly turn a weird color, or the red and yellow paints might refuse to mix at all. FlowGuard measures this "mixing" using some fancy math (inspired by a concept called Partial Information Decomposition) to create a FlowVector. This is a tiny, four-number code that describes exactly how the picture and text are interacting.

Redundancy: Do the picture and text agree? (High redundancy means they are on the same page).
Uniqueness: Is one of them dominating the conversation? (If the picture is screaming and the text is silent, that's high visual uniqueness).
Synergy: Does combining them make the answer clearer, or does it make it more confused? (Good synergy means the whole is greater than the sum of its parts; bad synergy means the combination creates chaos).

The team trained FlowGuard using only "good" examples—thousands of normal pictures and questions where the robot behaved perfectly. They taught an AI detector (an Isolation Forest) to recognize what "normal" flow looks like. Because they only trained it on good behavior, the detector knows that anything that looks even slightly "off" from the normal pattern is suspicious. It's like teaching a security system to recognize the sound of a normal house; if a window breaks or a floorboard creaks in a weird way, the alarm goes off, even if the intruder is wearing a disguise.

What They Found

The results were surprisingly effective. The researchers tested FlowGuard against a huge variety of attacks, including ones where hackers hid bad words in ASCII art, scrambled images with invisible pixel changes, or split a bad instruction across a picture and a sentence.

Without any defense, these models were incredibly vulnerable. On some of the sneakiest attacks, the models failed more than 90% of the time, happily generating harmful content. But when FlowGuard was turned on, it slashed the success rate of these attacks down to less than 15%. In many cases, it caught almost every single attempt, bringing the failure rate down to single digits (around 6% to 9% for cross-modal attacks).

What's really cool is that FlowGuard didn't just stop the bad guys; it didn't accidentally stop the good guys either. The researchers checked to see if FlowGuard would get grumpy and refuse to answer normal questions. They found that it only made mistakes on about 2.4% of safe inputs, which is much better than other safety methods that often block harmless questions just to be safe. Plus, it was super fast. While some other safety checks took several seconds to run complex image reconstructions, FlowGuard did its job in about 1.3 seconds, making it practical for real-time use.

The paper also showed that this trick works on different types of robots, from smaller ones with 4 billion "brain cells" to massive ones with 70 billion. It even worked on a model accessed through an API (where you can't see the whole brain, just the top guesses), proving that the "fractured thought" signal is a fundamental part of how these models work, not just a glitch in one specific design.

The Bottom Line

This paper suggests that the best way to protect multimodal AI isn't to build higher walls around the inputs, but to listen to how the AI thinks. By watching for the moment when the picture and the text stop playing nice together, FlowGuard can spot a hacker's trick before the robot even finishes its sentence. It's a lightweight, fast, and surprisingly robust way to keep these powerful tools safe, suggesting that the key to security might just be paying attention to the internal harmony of the machine's mind.

Technical Summary: Securing Multimodal AI through Internal Information Decomposition

Problem Statement

Multimodal Large Language Models (MLLMs) introduce novel attack surfaces absent in unimodal systems. Adversaries can distribute malicious intent across modalities (text and image) such that individual inputs appear benign and internally coherent, yet their combination induces unsafe behavior. This "compositional" failure mode renders traditional safety defenses ineffective. Existing approaches focus on sanitizing raw inputs, verifying generated outputs, or monitoring scalar confidence metrics (e.g., likelihood, entropy, perplexity). However, these methods often fail when text-only and vision-only reasoning each appear consistent, but their fusion produces confident yet compositionally misaligned behavior. The core challenge is detecting these failures without modifying the underlying model or relying on adversarial supervision, particularly when attacks are unseen or zero-shot.

Methodology: FlowGuard

The authors propose FlowGuard, a lightweight, inference-time framework that detects harmful inputs by monitoring the internal consistency of multimodal reasoning. Rather than inspecting surface-level inputs or outputs, FlowGuard analyzes the interaction between unimodal and multimodal predictive distributions.

Core Mechanism

FlowGuard operates by probing the target MLLM under three distinct conditioning configurations:

Text-only: $P^{(1)}_t = P_M(\cdot \mid \emptyset, Q)$
Vision-only: $P^{(1)}_v = P_M(\cdot \mid I, Q_\emptyset)$ (using a fixed neutral prompt)
Joint Multimodal: $P^{(1)}_{mm} = P_M(\cdot \mid I, Q)$

The system focuses on the first-token predictive distribution ( $P^{(1)}$ ), which captures the model's initial decision state prior to autoregressive amplification.

FlowVectors and Partial Information Decomposition (PID)

Inspired by Partial Information Decomposition (PID), FlowGuard derives a 4-dimensional FlowVector $\phi(x) = (U_v, U_t, R, S)$ that quantifies how information from text and vision overlaps, diverges, and stabilizes under fusion:

Uniqueness ( $U_v, U_t$ ): Measured via directional Kullback–Leibler (KL) divergence.
- $U_v = D_{KL}(P^{(1)}_{mm} \parallel P^{(1)}_t)$ : Captures how much the fused posterior diverges from the text-only prior (visual dominance).
- $U_t = D_{KL}(P^{(1)}_{mm} \parallel P^{(1)}_v)$ : Captures divergence from the vision-only prior (text dominance).
- Significance: Adversarial manipulation often breaks the balance of modality influence, leading to asymmetric divergence signals.
Redundancy ( $R$ ): Measured as $1 - JSD(P^{(1)}_t \parallel P^{(1)}_v)$ $1 - J S D (P_{t}^{(1)} ∥ P_{v}^{(1)})$ , where JSD is the Jensen–Shannon divergence.
- Significance: Captures semantic alignment between unimodal priors. Benign inputs induce aligned structures; adversarial prompts introduce conflicting intent, reducing redundancy.
Synergy ( $S$ ): Measured as entropy reduction: $S = \frac{H(P^{(1)}_t) + H(P^{(1)}_v)}{2} - H(P^{(1)}_{mm})$ $S = \frac{H ( P _{t}^{(1)} ) + H ( P _{v}^{(1)} )}{2} - H (P_{mm}^{(1)})$ .
- Significance: Indicates whether fusion reduces uncertainty (constructive integration, $S > 0$ ) or amplifies it (unstable interaction, $S < 0$ ).

Defense Objective

FlowGuard frames safety detection as a one-class classification problem. An Isolation Forest is trained solely on FlowVectors derived from benign data (e.g., VQAv2 validation set). The model learns the compact region of "aligned" multimodal information flow. Adversarial inputs, which exhibit abnormal cross-modal interactions (e.g., fractured flow, negative synergy, or extreme modality dominance), appear as outliers in this space.

Access Requirements: FlowGuard requires access only to the next-token probability distribution (or a sufficiently large top- $k$ logprob tail for API models). It does not require model weights, gradients, or hidden activations.

Key Contributions

Process-Level Multimodal Safety: The paper redefines MLLM safety by focusing on the consistency between text-only, vision-only, and joint predictive distributions, directly targeting multimodal fusion failures rather than surface-level content.
FlowVectors: The introduction of compact, information-theoretic features (Redundancy, Uniqueness, Synergy) that capture the internal information flow of multimodal reasoning at inference time.
Zero-Shot Attack Detection: Demonstration that modeling benign multimodal behavior via one-class classification enables robust detection of diverse, unseen jailbreaks without adversarial training or generative verification.

Experimental Results

The authors evaluated FlowGuard across multiple MLLM architectures (LLaVA-1.5-7B, Qwen2.5-VL-7B, Gemma-3-4B, LLaMA-3.1-70B) and benchmarks (MM-SafetyBench, VLSafe, VLSU) covering text-only, visual-only, and cross-modal attacks.

Attack Success Rate (ASR) Reduction: FlowGuard consistently reduced ASR from $>90\%$ (unprotected) to $<15\%$ on unseen attacks. For example, on LLaVA-1.5-7B, it reduced the ASR for Universal Master Key (UMK) from 96.0% to 8.7% and Color-Based Substitution Cipher (CBSC) from 94.8% to 9.1%.
Utility Preservation: The framework maintained benign utility within 2.4% of the baseline performance. It achieved a False Positive Rate (FPR) of 2.4% on benign but semantically complex queries (MOSSBench), significantly outperforming perplexity-based (11.2% FPR) and confidence-based (14.5% FPR) detectors.
Efficiency: FlowGuard operates with a latency of approximately 1.3 seconds per sample (including three forward passes), offering up to a 6 $\times$ speedup compared to diffusion-based verification methods like MirrorCheck and CIDER.
Robustness: The method demonstrated robustness across model scales (4B to 70B parameters) and partial-distribution access (GPT-4.1-mini with top- $k$ logprobs), where it maintained an average ASR of 10.4%.
Ablation Studies:
- Synergy ( $S$ ): Removing the synergy feature resulted in the largest performance drop, indicating that deviations in multimodal uncertainty reduction are a primary signal for detection.
- Decoding Steps: Monitoring only the first decoding step ( $k=1$ ) was sufficient for saturation; increasing $k$ yielded negligible gains relative to linear latency costs.
- Classifier Choice: The one-class Isolation Forest outperformed supervised MLPs on unseen attacks, avoiding overfitting to specific perturbation patterns.

Significance and Claims

The paper claims that monitoring cross-modal consistency offers an efficient and effective defense for multimodal reasoning, addressing a fundamental limitation of prior safety criteria that emphasize fluency and confidence over the structure of multimodal integration.

Generalizability: By relying on the structural consistency of information flow rather than specific attack patterns, FlowGuard provides an attack-agnostic defense that generalizes across architectures and unseen jailbreak strategies.
Complementarity: The authors position FlowGuard as a complementary layer to existing input purification and output verification methods, providing a model-internal signal that detects failures in multimodal integration which surface-level checks miss.
Scalability: The framework is lightweight, requiring no model retraining or gradient access, making it suitable for deployment in real-world systems where model weights may be proprietary or inaccessible.

The authors note that while FlowGuard is highly effective against cross-modal and visual attacks, it shows slightly higher residual ASR on text-only attacks (approx. 13–14%), suggesting that composition with text-specific defenses may be necessary for comprehensive protection. They also acknowledge that publishing detection mechanisms may inform adaptive attackers, and that anomaly-based approaches risk flagging rare but legitimate inputs, necessitating careful curation of reference datasets and auditing of false positives in sensitive applications.