[Track A] Feedback: Cross-Modal Safety Bypass

[rocklambros]

Sprint 2 Feedback — Cross-Modal Safety Bypass

This issue collects qualitative feedback on the Cross-Modal Safety Bypass new candidate entry. Submit your Importance, Clarity, and Distinctness scores via the Sprint 2 Google Form (single ballot covering both tracks).

• Vote: https://docs.google.com/forms/d/e/1FAIpQLSebmFQyJPOMuw1IorHCJ2FdW98ZT2oLNBuVgYqpPoayW9v6ww/viewform — page through to the Track A section, then to Cross-Modal Safety Bypass
• Read the draft: https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/new_entry_candidates/cross-modal-safety-bypass.md
• Voting closes: May 18, 2026 at 23:59 UTC
• Code of Conduct: https://owasp.org/www-policy/operational/code-of-conduct

Scoring rubric

• Importance (1–5): How critical is this risk to LLM application security in 2026?
• Clarity (1–5): How clearly does the candidate describe the risk and mitigations?
• Distinctness (1–5): Is this materially different from existing entries (LLM01–LLM10), or could it be merged into one of them?

Why Distinctness matters

Sprint 3 cuts 8 candidates down to 5. A high-Importance candidate that overlaps heavily with an existing entry is a merge target, not a standalone winner. Distinctness scores let the working group make defensible cut, keep, or merge calls.

How to comment

Reply to this issue with feedback specific to Cross-Modal Safety Bypass. Use one comment per topic so the working group can triage cleanly. Format we like:

Section: <which section of the candidate>
Issue: <what is wrong, missing, unclear, or duplicative>
Proposed change: <your suggested fix, addition, or merge target>
Overlaps with: <existing entry LLM01–LLM10 if applicable>
Evidence: <CVE, paper, incident, or research note ID if applicable>

Out of scope here

• Cross-cutting comments → use Discussions
• Comments on existing entries (LLM01–LLM10) → comment on the relevant Track B issue
• Process or governance questions → comment in Discussions

Triage

Working group entry leads classify each comment within 48 hours as:

• actionable — feeds Sprint 3 revision or merge decision
• clarification — requires reply, not action
• out-of-scope — closed with redirect

Sprint 3 begins May 18 with this issue's triage as input.

[nagasatish007]

Section: Prevention and Mitigation Strategies

Issue: The mitigations focus on training-time alignment and per-modality
classifiers, but don't address a simpler, deterministic pre-processing step
that can be applied at the governance layer without ML inference.

Proposed change: Add a mitigation for deterministic text extraction before
policy evaluation:

• Images: Apply OCR to extract embedded text, then run extracted text through
  existing text-based policy filters (prompt injection, content moderation,
  PII detection)
• Audio: Apply transcription, then run transcript through text-based filters
• Video: Frame sampling + OCR, then text-based filtering on extracted content
• All modalities: Strip metadata (EXIF, ID3, etc.) before governance evaluation

This doesn't replace modality-specific classifiers — it layers a deterministic,
zero-ML-overhead check underneath them. The key insight: most cross-modal
attacks encode text instructions in non-text formats. Extracting that text
and running it through existing text-based governance catches a meaningful
subset without requiring vision/audio ML models in the governance path.

Overlaps with: LLM01 (Prompt Injection) — the extracted text is then subject
to the same injection detection as direct text input.

Evidence: The FC-Attack pattern (Zhang et al., EMNLP 2025) encodes instructions
as flowchart node labels — OCR extraction would surface these as text, making
them detectable by standard prompt injection filters. The 96% ASR drops
significantly when the governance layer can "read" the image content as text.