The Boy Who Cried Wolf: Adversarial Misclassification of Safe Inputs as Unsafe in Multimodal Guardrails

2026-08-02

AI Summary

This work addresses a critical yet overlooked vulnerability in multimodal safety guardrails: their tendency to misclassify benign inputs as unsafe, thereby degrading service availability and eroding user trust. We systematically uncover and investigate this risk through the lens of false-positive attacks, introducing “unsafe induction attacks”—a novel threat wherein imperceptible perturbations are injected into safe images to deliberately trigger erroneous rejections of legitimate requests. To enable such attacks with cross-prompt generalization, we propose Unsafe Semantic Distillation and develop a unified attack framework grounded in adversarial perturbation generation and multimodal representation alignment. Evaluated on four state-of-the-art safety models, our method achieves an 84% attack success rate, substantially outperforming existing approaches and exposing fundamental weaknesses in current multimodal safety mechanisms.

Abstract

Multimodal guard models have emerged as critical safety components for screening content in vision-language systems. While adversarial research has extensively studied jailbreaking attacks that produce false negatives, the inverse threat of inducing false positives on benign inputs remains unexplored. We introduce Unsafe Induction Attacks, where adversaries distribute imperceptibly perturbed safe images that trigger guard models to reject legitimate user requests, causing a "Boy Who Cried Wolf" effect that degrades service availability and erodes trust. This reveals an availability failure mode in deployed safety filters. To realize this threat under diverse user prompts, we propose Unsafe Semantic Distillation (USD), which aligns adversarial perturbations with distributional representations of unsafe content rather than prompt-specific instances. Evaluated on four state-of-the-art guard models across realistic user simulation scenarios, USD achieves 84% attack success rates, outperforming existing methods and exposing fundamental vulnerabilities in current multimodal safety architectures.

Problem

• multimodal guardrails
• adversarial misclassification
• false positives
• availability failure
• unsafe induction

Innovation

• Unsafe Induction Attacks
• Multimodal Guardrails
• Adversarial Misclassification
• Unsafe Semantic Distillation
• False Positive Attacks