Grounded operations break current MLLM defenses — here's the fix

Most multimodal safety filters still treat the prompt and image as a single blob. Run a benign summarization request over a screenshot that happens to contain a hidden prompt injection, and the model happily executes it because neither piece looks suspicious in isolation. The failure mode is structural: the danger only materializes after the model dereferences a visual target and binds an operation to it.

A new paper from the COMIC team (Context-Operation-Modality-Image-Classifier) frames this precisely. Their insight: the security-relevant unit isn't the prompt-image pair — it's the grounded operation-target pair produced during reference resolution. Current defenses degrade when harmful semantics are localized, activated only after grounding, and dependent on visual reference resolution.

COMIC adds a pre-generation gate that does four things before the MLLM ever sees the request:

1. Infers the requested operation and reference type — summarize, translate, follow, extract, etc., plus whether the reference is explicit ("the red box"), implicit ("that chart"), or ambiguous.

2. Constructs candidate targets — runs OCR and open-vocabulary object proposals (they use Grounding DINO) to enumerate plausible visual referents.

3. Grounds plausible referents — matches the inferred reference to candidate regions, producing explicit (operation, target) pairs with confidence scores.

4. Evaluates safety per pair — a lightweight classifier scores each pair; max-risk aggregation with quality-aware routing decides forward vs. block.

The conservative design matters. If grounding confidence is low, COMIC routes to a stricter path rather than gambling. That trade-off shows up in their numbers: across LLaVA-1.5, InstructBLIP, and Qwen-VL, they gain 18–27% ASR reduction on localized jailbreak benchmarks (FigStep, MM-SafetyBench) while benign utility drops <3% on reference-sensitive tasks like visual QA and document reasoning. Latency overhead is ~120 ms on A100 — practical for production.

What I appreciate: they don't claim COMIC solves everything. The paper explicitly notes that multi-hop reasoning, adversarial grounding errors, and novel operation types remain open. But it shifts the conversation from "filter the input pair" to "model the dereferencing step," which is where the actual attack surface lives.

If you're building multimodal guardrails, the takeaway is concrete: any pipeline that doesn't explicitly represent (operation, grounded target, confidence) before generation is structurally blind to this class of jailbreak. COMIC's architecture — infer → propose → ground → evaluate → route — is a template worth stealing.

Code and weights are on their project page. The classifier head is a 4-layer MLP on top of CLIP embeddings; swapping in a stronger vision encoder (SigLIP, DINOv2) is a one-line config change.