ReFrame: Evidence-Guided Test-Time Safety Alignment in Multimodal Large Language Models

In the rapidly evolving world of artificial intelligence, a new generation of models has emerged that can see and speak simultaneously. These systems, known as multimodal large language models, do not just process text; they understand images, connecting visual details with written words to answer questions, solve problems, and generate creative content. However, this expanded ability to see and reason brings a complex new challenge: safety. While these models are designed to be helpful, they can sometimes be tricked into ignoring their safety rules. An attacker might hide a harmful request inside a picture or split a dangerous instruction between an image and a sentence, confusing the model into thinking the request is harmless. This creates a difficult situation for developers. Many of the most powerful models are "black boxes," meaning their inner workings are hidden and cannot be changed or retrained by outside users. When a model is already deployed and cannot be modified, finding a way to keep it safe without breaking its ability to be useful becomes a critical puzzle.

Researchers have been exploring ways to fix this, but many existing solutions require access to the model's internal code or involve expensive retraining, which is impossible for closed systems. A team of scientists has now proposed a different approach called ReFrame, a method that acts as a smart filter before the model ever sees the user's request. Instead of trying to change the model itself, ReFrame intercepts the incoming image and text, analyzes them, and rewrites the request into a safer version. This process happens entirely at the moment of use, without needing to touch the model's internal settings or retrain it on new data. The system is designed to catch hidden dangers that might slip through standard defenses while ensuring the model still answers legitimate questions effectively.

The core of the problem the researchers identified is that these models often prioritize being helpful over being safe. When a user asks a question, the model's primary drive is to complete the task, which can sometimes cause it to overlook subtle risks hidden in an image or a tricky sentence structure. Furthermore, once a model starts following a line of reasoning, it can get stuck on a harmful path, continuing to generate unsafe content even if it realizes the danger later. To solve this, the researchers built a two-step system that uses a smaller, local version of an AI model to act as a gatekeeper. This gatekeeper does not answer the user's question directly. Instead, it examines the request and creates two specific summaries, or "cards," that describe the situation.

The first card, the risk card, looks for any hidden dangers. It asks: Is there a harmful intent concealed in the image or text? If the answer is yes, it identifies exactly what the danger is and plans how to rewrite the request to remove the threat. The second card, the utility card, focuses on what should be saved. It asks: What parts of the request are harmless and useful? This ensures that when the dangerous parts are removed, the model does not throw away the entire question or refuse to help on a topic that is actually safe. By separating the risk from the usefulness, the system can make a precise decision about how to proceed.

Once these two cards are created, a second step takes over. This part of the system combines the information from both cards to rewrite the original request. If the request was safe to begin with, it passes it through with only minor adjustments. If the request contained a hidden trap, the system rewrites the prompt to steer the model toward a safe and helpful answer. For example, if a user asks for instructions on how to commit a crime but frames it as a game scenario, the system recognizes the game wrapper as a disguise. It strips away the game instructions and rewrites the prompt to ask about safety or legal alternatives instead. Crucially, the system also decides whether to send the original image along with the rewritten text. Sometimes the image itself contains the dangerous clue, so the system blocks it. Other times, the image is harmless and necessary for the answer, so it is allowed through.

The researchers tested this method on several different large models, including some of the most advanced commercial systems available today. They used a wide variety of tests designed to trick models into breaking their safety rules, as well as tests to see if the models could still answer normal questions about math, science, and everyday objects. The results showed that the new method was highly effective at stopping harmful requests that other defenses missed. It successfully blocked attacks where the danger was hidden in the way an image was mirrored or where the text was scrambled to hide a bad intent. At the same time, it did not make the models overly cautious. In cases where users asked safe questions about sensitive topics like medicine or chemistry, the system allowed the models to provide helpful answers instead of refusing to talk about them.

The study also looked at how much extra time this process took. Because the system uses a smaller, local model to do the rewriting before the main model answers, it adds a small amount of delay, but the researchers found this cost to be manageable. The method proved to be flexible, working well with different types of models and different sizes of the local gatekeeper. This suggests that the approach is not tied to one specific technology but can be applied broadly. The findings indicate that by carefully analyzing the intent behind an image-text pair and rewriting the request before it reaches the main model, it is possible to significantly improve safety without sacrificing the model's ability to be useful. This offers a practical path forward for keeping powerful AI systems safe, even when their internal workings cannot be changed.