Research map / Vision-language and multimodal / Multimodal LLMs

Anchoring the Mind of Multimodal Reasoners: Cognitive Bias as a Vector for Jailbreak Attacks

CVPR 2026 · Vision-language and multimodal › Multimodal LLMs · approach: Unified any-modality language models

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that multimodal reasoning models exhibit an anchoring effect in safety judgments and exploits it with RA-Attack, a jailbreak pairing a structured visual mind-map safe anchor with a text safe anchor and harmful intent guidance, plus an Anchor Debiasing Prompt defense.

Problem

Multimodal large reasoning models can rationalize harmful requests during multi-step reasoning, and existing jailbreaks do not target cognitive biases in the reasoning process itself.

Approach

Exploit the anchoring effect: placing a benign, structured visual mind map and an educational text anchor before a harmful intent guidance biases the model's safety judgment and induces rationalized harmful output. Contrasts with prior reasoning hijacking (VisCRA, H-CoT) by using a cognitive bias rather than forced reasoning steps.

Key results

• RA-Attack reaches 92% ASR on Gemini-2.5-Pro and 82% on GPT-4o on AdvBench, outperforming VisCRA (60% on GPT-4o).
• On o4-mini, the most robust model, RA-Attack achieves 44% ASR on AdvBench versus at most 12% for baselines.
• The Anchor Debiasing Prompt lowers GPT-4o ASR on AdvBench from 82% to 8% and Gemini-2.5-Pro from 92% to 28% while MM-Vet scores stay roughly unchanged or rise.

Surprising findings

• Placing the safe anchor after the harmful intent (Anchor-Last) reduces ASR relative to Anchor-First, which the authors use as evidence of anchoring rather than content obfuscation alone.
• Irrelevant-topic structured anchors substantially reduce ASR on GPT-4o (38% vs 82%), indicating thematic relevance matters.

Limitations

• Evaluation relies on GPT-4o as the sole harmfulness judge for ASR, with no human evaluation reported.
• Anchoring effect is inferred from ASR deltas and t-SNE visualization rather than a direct mechanistic test.
• Only AdvBench (50 deduplicated instructions) and Hades (750 samples) are used, with 7 models evaluated.

Experimental setup

Datasets: AdvBench Hades MM-Vet

Benchmarks: AdvBench Hades MM-Vet

Metrics: attack success rate rationalization rate MM-Vet score

Baselines: Hades VA-Attack SI-Attack FC-Attack CS-DJ VisCRA

Builds on: VisCRA SI-Attack FC-Attack CS-DJ Hades

Closest papers by meaning

• The Emotional Baby Is Truly Deadly: Does Your Multimodal Large Reasoning Model Have Emotional Flattery Towards Humans? (AAAI 2026 · similarity 0.88)
• SAFEPATH: Preventing Harmful Reasoning in Chain-of-Thought via Early Alignment (NeurIPS 2025 · similarity 0.88)
• Safety Recovery in Reasoning Models Is Only a Few Early Steering Steps Away (ICML 2026 · similarity 0.88)
• MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs (ICLR 2026 · similarity 0.87)
• Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Training (ICLR 2026 · similarity 0.87)
• When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness? (NeurIPS 2026 · similarity 0.87)