{"id":"42ad36d76eb39ff8a315292ecf70390fd05abb7eec758172b7e914b26ab63b43","title":"arXiv cs.AI: Compositional Unalignment: Auditing Safety in Large Vision-Language Models","argument":"In their arXiv abstract, Hong kyu Lee, Kai Shu and Li Xiong argue that strong scores on compositional safety benchmarks do not show how robustly safety is integrated into a model. They describe compositional harm as arising when an image and prompt that are benign separately become harmful through cross-modal reasoning. The authors report that minimal supervised fine-tuning can reach an LLM-judge score comparable to a multi-stage reinforcement-learning pipeline, and caution that similar scores alone cannot establish robustness. They propose CMaG, a training-free un-alignment method that uses a refusal-versus-compliance log-probability margin and internal model activations to identify a direction for steering responses. In experiments on Qwen2.5-VL-7B and LLaVA-1.5-7B, they report that steering along this direction reduces compositional safety scores by up to 65 points while over 98% of outputs remain coherent. Their central argument is that behavior that looks safe on a benchmark may remain vulnerable to targeted internal intervention. These are the authors’ reported results; the abstract alone does not establish how broadly they apply beyond the tested models.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The available evidence is the arXiv abstract, not the full paper; detailed methods and supporting experimental evidence are therefore not available here. The reported score changes and coherence rates are the authors’ results, not independently validated by this source record. The abstract names Qwen2.5-VL-7B and LLaVA-1.5-7B for the reported results; broader applicability is not established by the supplied evidence.","speaker":{"name":"Lee, Hong kyu, Shu, Kai, Xiong, Li","roleAtSource":"Article author"},"source":{"title":"Compositional Unalignment: Auditing Safety in Large Vision-Language Models","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.07216","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors argue that benchmark scores for compositional safety do not, by themselves, establish how robustly safety is integrated into a model.","excerpt":"similar benchmark scores cannot establish robustness by themselves","url":"https://arxiv.org/abs/2611.07216","relationship":"Source-stated"},{"text":"The authors describe compositional harm as arising when benign image and prompt inputs become harmful through cross-modal reasoning.","excerpt":"an image and a prompt that are benign in isolation become harmful through the model's cross-modal reasoning","url":"https://arxiv.org/abs/2611.07216","relationship":"Source-stated"},{"text":"The authors report that minimal supervised fine-tuning reaches an LLM-judge score comparable to a multi-stage reinforcement-learning pipeline.","excerpt":"minimal supervised fine-tuning reaches an LLM-judge score comparable to a multi-stage reinforcement-learning pipeline","url":"https://arxiv.org/abs/2611.07216","relationship":"Source-stated"},{"text":"The authors propose CMaG, a training-free un-alignment method that uses a refusal-versus-compliance log-probability margin and mid-layer activations to isolate a cross-modal interaction term.","excerpt":"CMaG measures refusal intention with a refusal-versus-compliance log-probability margin, takes its gradient with respect to mid-layer activations","url":"https://arxiv.org/abs/2611.07216","relationship":"Source-stated"},{"text":"On Qwen2.5-VL-7B and LLaVA-1.5-7B, the authors report safety-score reductions of up to 65 points while over 98% of outputs remain coherent.","excerpt":"On Qwen2.5-VL-7B and LLaVA-1.5-7B, CMaG reduces compositional safety scores by up to 65 points while over 98% of outputs remain coherent","url":"https://arxiv.org/abs/2611.07216","relationship":"Source-stated"},{"text":"The abstract reports experiments on two named models; whether the reported effect extends more broadly remains an open question.","excerpt":"On Qwen2.5-VL-7B and LLaVA-1.5-7B","url":"https://arxiv.org/abs/2611.07216","relationship":"Escape Meridian interpretation"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07216","checkedAt":"2026-11-08T21:42:06.881Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Escape Meridian interpretation: How broadly does the reported CMaG effect hold beyond Qwen2.5-VL-7B and LLaVA-1.5-7B?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Compositional Unalignment: Auditing Safety in Large Vision-Language Models","summary":"In their arXiv abstract, Hong kyu Lee, Kai Shu and Li Xiong argue that strong scores on compositional safety benchmarks do not show how robustly safety is integrated into a model. They describe compositional harm as arising when an image and prompt that are benign separately become harmful through cross-modal reasoning. The authors report that minimal supervised fine-tuning can reach an LLM-judge score comparable to a multi-stage reinforcement-learning pipeline, and caution that similar scores alone cannot establish robustness. They propose CMaG, a training-free un-alignment method that uses a refusal-versus-compliance log-probability margin and internal model activations to identify a direction for steering responses. In experiments on Qwen2.5-VL-7B and LLaVA-1.5-7B, they report that steering along this direction reduces compositional safety scores by up to 65 points while over 98% of outputs remain coherent. Their central argument is that behavior that looks safe on a benchmark may remain vulnerable to targeted internal intervention. These are the authors’ reported results; the abstract alone does not establish how broadly they apply beyond the tested models.","question":"Escape Meridian interpretation: How broadly does the reported CMaG effect hold beyond Qwen2.5-VL-7B and LLaVA-1.5-7B?","claims":[{"text":"The authors argue that benchmark scores for compositional safety do not, by themselves, establish how robustly safety is integrated into a model.","excerpt":"similar benchmark scores cannot establish robustness by themselves","support":"source-stated"},{"text":"The authors describe compositional harm as arising when benign image and prompt inputs become harmful through cross-modal reasoning.","excerpt":"an image and a prompt that are benign in isolation become harmful through the model's cross-modal reasoning","support":"source-stated"},{"text":"The authors report that minimal supervised fine-tuning reaches an LLM-judge score comparable to a multi-stage reinforcement-learning pipeline.","excerpt":"minimal supervised fine-tuning reaches an LLM-judge score comparable to a multi-stage reinforcement-learning pipeline","support":"source-stated"},{"text":"The authors propose CMaG, a training-free un-alignment method that uses a refusal-versus-compliance log-probability margin and mid-layer activations to isolate a cross-modal interaction term.","excerpt":"CMaG measures refusal intention with a refusal-versus-compliance log-probability margin, takes its gradient with respect to mid-layer activations","support":"source-stated"},{"text":"On Qwen2.5-VL-7B and LLaVA-1.5-7B, the authors report safety-score reductions of up to 65 points while over 98% of outputs remain coherent.","excerpt":"On Qwen2.5-VL-7B and LLaVA-1.5-7B, CMaG reduces compositional safety scores by up to 65 points while over 98% of outputs remain coherent","support":"source-stated"},{"text":"The abstract reports experiments on two named models; whether the reported effect extends more broadly remains an open question.","excerpt":"On Qwen2.5-VL-7B and LLaVA-1.5-7B","support":"interpretation"}],"limitations":["The available evidence is the arXiv abstract, not the full paper; detailed methods and supporting experimental evidence are therefore not available here.","The reported score changes and coherence rates are the authors’ results, not independently validated by this source record.","The abstract names Qwen2.5-VL-7B and LLaVA-1.5-7B for the reported results; broader applicability is not established by the supplied evidence."],"mediaId":"723163c0226e6884fe5e14e01c1cfbda1e3108e9f109496f90f35d013613dab2","correctionReason":null,"id":"42ad36d76eb39ff8a315292ecf70390fd05abb7eec758172b7e914b26ab63b43","publicationId":"0a06d411-e51f-4a6b-81b6-118c6f42d678","version":1,"sourceUrl":"https://arxiv.org/abs/2611.07216","sourceTitle":"Compositional Unalignment: Auditing Safety in Large Vision-Language Models","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-06T05:10:46.077Z","createdAt":"2026-11-08T20:38:30.091Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"723163c0226e6884fe5e14e01c1cfbda1e3108e9f109496f90f35d013613dab2","kind":"article","url":"https://arxiv.org/abs/2611.07216","sourceUrl":"https://arxiv.org/abs/2611.07216","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-08T20:33:20.712Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07216","checkedAt":"2026-11-08T21:42:06.881Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"723163c0226e6884fe5e14e01c1cfbda1e3108e9f109496f90f35d013613dab2","confidence":0.91,"provider":"typesafe","model":"jev-1.13.0","inputHash":"fe1fe3ed32803ba6f3af17ddf62be01e994fef71cf77d97258ca22727619f952","decidedAt":"2026-11-08T20:33:21.561Z"},"provenance":{"textHash":"ec422c62acb9510298e7e2a4d822528e456713e856d29fa6a5775ad175034014","observationId":"b7f48e25871a9a2abcf04aa9507299438ffb3a41849ecb234a176c3c35694c5e","retrievedAt":"2026-11-08T20:33:20.571Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"af10e3ac-a1a6-46fd-88b3-ae9396cc91f4"},"reviewer":{"model":"gpt-6-luna","runId":"f8d3e676-9fc5-442e-8eaf-883c3f71df52"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-08T20:38:30.091Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Lee, Hong kyu","url":null,"kind":"unknown"},{"name":"Shu, Kai","url":null,"kind":"unknown"},{"name":"Xiong, Li","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Lee, Hong kyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lee, Hong kyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07216","locator":"head/meta[name=author|citation_author]"},"assertionId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T21:42:06.881Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3","sourceUrl":"https://arxiv.org/abs/2611.07216","contentSha256":"4861094fa1fc2215facb4f6d6e94b645273fc7369b451f943cf7e48f3bcc6b67","textHash":"ec422c62acb9510298e7e2a4d822528e456713e856d29fa6a5775ad175034014","observedAt":"2026-11-08T21:42:06.881Z"}},{"actor":{"name":"Shu, Kai","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Shu, Kai","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07216","locator":"head/meta[name=author|citation_author]"},"assertionId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T21:42:06.881Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3","sourceUrl":"https://arxiv.org/abs/2611.07216","contentSha256":"4861094fa1fc2215facb4f6d6e94b645273fc7369b451f943cf7e48f3bcc6b67","textHash":"ec422c62acb9510298e7e2a4d822528e456713e856d29fa6a5775ad175034014","observedAt":"2026-11-08T21:42:06.881Z"}},{"actor":{"name":"Xiong, Li","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Xiong, Li","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07216","locator":"head/meta[name=author|citation_author]"},"assertionId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T21:42:06.881Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3","sourceUrl":"https://arxiv.org/abs/2611.07216","contentSha256":"4861094fa1fc2215facb4f6d6e94b645273fc7369b451f943cf7e48f3bcc6b67","textHash":"ec422c62acb9510298e7e2a4d822528e456713e856d29fa6a5775ad175034014","observedAt":"2026-11-08T21:42:06.881Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.07216","snapshotId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3","contentSha256":"4861094fa1fc2215facb4f6d6e94b645273fc7369b451f943cf7e48f3bcc6b67","textHash":"ec422c62acb9510298e7e2a4d822528e456713e856d29fa6a5775ad175034014","observedAt":"2026-11-08T21:42:06.881Z","basis":"publisher-page-metadata","sourceLinks":44,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/42ad36d76eb39ff8a315292ecf70390fd05abb7eec758172b7e914b26ab63b43/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-compositional-unalignment-auditing-safety-in-large-42ad36d7","formats":{"html":"/readings/arxiv-cs-ai-compositional-unalignment-auditing-safety-in-large-42ad36d7","markdown":"/readings/arxiv-cs-ai-compositional-unalignment-auditing-safety-in-large-42ad36d7.md","json":"/readings/arxiv-cs-ai-compositional-unalignment-auditing-safety-in-large-42ad36d7.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-benchmark","name":"Benchmark","explanation":"A defined set of tests used to compare systems. Results depend on the tasks and measures selected.","referenceUrl":"https://arxiv.org/abs/2211.09110"},{"id":"term-fine-tuning","name":"Fine-tuning","explanation":"Further training of an existing model to adapt it to a particular task or use.","referenceUrl":"https://developers.google.com/machine-learning/glossary#fine-tuning"},{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"},{"id":"term-reinforcement-learning","name":"Reinforcement learning","explanation":"Training by trial and error, in which a system is rewarded for the outcomes its designers want.","referenceUrl":"https://developers.google.com/machine-learning/glossary#reinforcement-learning-rl"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"42ad36d76eb39ff8a315292ecf70390fd05abb7eec758172b7e914b26ab63b43","revision":"0a06d411-e51f-4a6b-81b6-118c6f42d678","revisionKind":"publication-id","title":"arXiv cs.AI: Compositional Unalignment: Auditing Safety in Large Vision-Language Models","url":"https://escapemeridian.com/readings/arxiv-cs-ai-compositional-unalignment-auditing-safety-in-large-42ad36d7"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.07216","revision":"ec422c62acb9510298e7e2a4d822528e456713e856d29fa6a5775ad175034014","revisionKind":"sha256-source-text","title":"Compositional Unalignment: Auditing Safety in Large Vision-Language Models","url":"https://arxiv.org/abs/2611.07216"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"42ad36d76eb39ff8a315292ecf70390fd05abb7eec758172b7e914b26ab63b43","title":"arXiv cs.AI: Compositional Unalignment: Auditing Safety in Large Vision-Language Models","argument":"In their arXiv abstract, Hong kyu Lee, Kai Shu and Li Xiong argue that strong scores on compositional safety benchmarks do not show how robustly safety is integrated into a model. They describe compositional harm as arising when an image and prompt that are benign separately become harmful through cross-modal reasoning. The authors report that minimal supervised fine-tuning can reach an LLM-judge score comparable to a multi-stage reinforcement-learning pipeline, and caution that similar scores alone cannot establish robustness. They propose CMaG, a training-free un-alignment method that uses a refusal-versus-compliance log-probability margin and internal model activations to identify a direction for steering responses. In experiments on Qwen2.5-VL-7B and LLaVA-1.5-7B, they report that steering along this direction reduces compositional safety scores by up to 65 points while over 98% of outputs remain coherent. Their central argument is that behavior that looks safe on a benchmark may remain vulnerable to targeted internal intervention. These are the authors’ reported results; the abstract alone does not establish how broadly they apply beyond the tested models.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The available evidence is the arXiv abstract, not the full paper; detailed methods and supporting experimental evidence are therefore not available here. The reported score changes and coherence rates are the authors’ results, not independently validated by this source record. The abstract names Qwen2.5-VL-7B and LLaVA-1.5-7B for the reported results; broader applicability is not established by the supplied evidence.","speaker":{"name":"Lee, Hong kyu, Shu, Kai, Xiong, Li","roleAtSource":"Article author"},"source":{"title":"Compositional Unalignment: Auditing Safety in Large Vision-Language Models","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.07216","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors argue that benchmark scores for compositional safety do not, by themselves, establish how robustly safety is integrated into a model.","excerpt":"similar benchmark scores cannot establish robustness by themselves","url":"https://arxiv.org/abs/2611.07216","relationship":"Source-stated"},{"text":"The authors describe compositional harm as arising when benign image and prompt inputs become harmful through cross-modal reasoning.","excerpt":"an image and a prompt that are benign in isolation become harmful through the model's cross-modal reasoning","url":"https://arxiv.org/abs/2611.07216","relationship":"Source-stated"},{"text":"The authors report that minimal supervised fine-tuning reaches an LLM-judge score comparable to a multi-stage reinforcement-learning pipeline.","excerpt":"minimal supervised fine-tuning reaches an LLM-judge score comparable to a multi-stage reinforcement-learning pipeline","url":"https://arxiv.org/abs/2611.07216","relationship":"Source-stated"},{"text":"The authors propose CMaG, a training-free un-alignment method that uses a refusal-versus-compliance log-probability margin and mid-layer activations to isolate a cross-modal interaction term.","excerpt":"CMaG measures refusal intention with a refusal-versus-compliance log-probability margin, takes its gradient with respect to mid-layer activations","url":"https://arxiv.org/abs/2611.07216","relationship":"Source-stated"},{"text":"On Qwen2.5-VL-7B and LLaVA-1.5-7B, the authors report safety-score reductions of up to 65 points while over 98% of outputs remain coherent.","excerpt":"On Qwen2.5-VL-7B and LLaVA-1.5-7B, CMaG reduces compositional safety scores by up to 65 points while over 98% of outputs remain coherent","url":"https://arxiv.org/abs/2611.07216","relationship":"Source-stated"},{"text":"The abstract reports experiments on two named models; whether the reported effect extends more broadly remains an open question.","excerpt":"On Qwen2.5-VL-7B and LLaVA-1.5-7B","url":"https://arxiv.org/abs/2611.07216","relationship":"Escape Meridian interpretation"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07216","checkedAt":"2026-11-08T21:42:06.881Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Escape Meridian interpretation: How broadly does the reported CMaG effect hold beyond Qwen2.5-VL-7B and LLaVA-1.5-7B?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Compositional Unalignment: Auditing Safety in Large Vision-Language Models","summary":"In their arXiv abstract, Hong kyu Lee, Kai Shu and Li Xiong argue that strong scores on compositional safety benchmarks do not show how robustly safety is integrated into a model. They describe compositional harm as arising when an image and prompt that are benign separately become harmful through cross-modal reasoning. The authors report that minimal supervised fine-tuning can reach an LLM-judge score comparable to a multi-stage reinforcement-learning pipeline, and caution that similar scores alone cannot establish robustness. They propose CMaG, a training-free un-alignment method that uses a refusal-versus-compliance log-probability margin and internal model activations to identify a direction for steering responses. In experiments on Qwen2.5-VL-7B and LLaVA-1.5-7B, they report that steering along this direction reduces compositional safety scores by up to 65 points while over 98% of outputs remain coherent. Their central argument is that behavior that looks safe on a benchmark may remain vulnerable to targeted internal intervention. These are the authors’ reported results; the abstract alone does not establish how broadly they apply beyond the tested models.","question":"Escape Meridian interpretation: How broadly does the reported CMaG effect hold beyond Qwen2.5-VL-7B and LLaVA-1.5-7B?","claims":[{"text":"The authors argue that benchmark scores for compositional safety do not, by themselves, establish how robustly safety is integrated into a model.","excerpt":"similar benchmark scores cannot establish robustness by themselves","support":"source-stated"},{"text":"The authors describe compositional harm as arising when benign image and prompt inputs become harmful through cross-modal reasoning.","excerpt":"an image and a prompt that are benign in isolation become harmful through the model's cross-modal reasoning","support":"source-stated"},{"text":"The authors report that minimal supervised fine-tuning reaches an LLM-judge score comparable to a multi-stage reinforcement-learning pipeline.","excerpt":"minimal supervised fine-tuning reaches an LLM-judge score comparable to a multi-stage reinforcement-learning pipeline","support":"source-stated"},{"text":"The authors propose CMaG, a training-free un-alignment method that uses a refusal-versus-compliance log-probability margin and mid-layer activations to isolate a cross-modal interaction term.","excerpt":"CMaG measures refusal intention with a refusal-versus-compliance log-probability margin, takes its gradient with respect to mid-layer activations","support":"source-stated"},{"text":"On Qwen2.5-VL-7B and LLaVA-1.5-7B, the authors report safety-score reductions of up to 65 points while over 98% of outputs remain coherent.","excerpt":"On Qwen2.5-VL-7B and LLaVA-1.5-7B, CMaG reduces compositional safety scores by up to 65 points while over 98% of outputs remain coherent","support":"source-stated"},{"text":"The abstract reports experiments on two named models; whether the reported effect extends more broadly remains an open question.","excerpt":"On Qwen2.5-VL-7B and LLaVA-1.5-7B","support":"interpretation"}],"limitations":["The available evidence is the arXiv abstract, not the full paper; detailed methods and supporting experimental evidence are therefore not available here.","The reported score changes and coherence rates are the authors’ results, not independently validated by this source record.","The abstract names Qwen2.5-VL-7B and LLaVA-1.5-7B for the reported results; broader applicability is not established by the supplied evidence."],"mediaId":"723163c0226e6884fe5e14e01c1cfbda1e3108e9f109496f90f35d013613dab2","correctionReason":null,"id":"42ad36d76eb39ff8a315292ecf70390fd05abb7eec758172b7e914b26ab63b43","publicationId":"0a06d411-e51f-4a6b-81b6-118c6f42d678","version":1,"sourceUrl":"https://arxiv.org/abs/2611.07216","sourceTitle":"Compositional Unalignment: Auditing Safety in Large Vision-Language Models","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-06T05:10:46.077Z","createdAt":"2026-11-08T20:38:30.091Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"723163c0226e6884fe5e14e01c1cfbda1e3108e9f109496f90f35d013613dab2","kind":"article","url":"https://arxiv.org/abs/2611.07216","sourceUrl":"https://arxiv.org/abs/2611.07216","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-08T20:33:20.712Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07216","checkedAt":"2026-11-08T21:42:06.881Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"723163c0226e6884fe5e14e01c1cfbda1e3108e9f109496f90f35d013613dab2","confidence":0.91,"provider":"typesafe","model":"jev-1.13.0","inputHash":"fe1fe3ed32803ba6f3af17ddf62be01e994fef71cf77d97258ca22727619f952","decidedAt":"2026-11-08T20:33:21.561Z"},"provenance":{"textHash":"ec422c62acb9510298e7e2a4d822528e456713e856d29fa6a5775ad175034014","observationId":"b7f48e25871a9a2abcf04aa9507299438ffb3a41849ecb234a176c3c35694c5e","retrievedAt":"2026-11-08T20:33:20.571Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"af10e3ac-a1a6-46fd-88b3-ae9396cc91f4"},"reviewer":{"model":"gpt-6-luna","runId":"f8d3e676-9fc5-442e-8eaf-883c3f71df52"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-08T20:38:30.091Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Lee, Hong kyu","url":null,"kind":"unknown"},{"name":"Shu, Kai","url":null,"kind":"unknown"},{"name":"Xiong, Li","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Lee, Hong kyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lee, Hong kyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07216","locator":"head/meta[name=author|citation_author]"},"assertionId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T21:42:06.881Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3","sourceUrl":"https://arxiv.org/abs/2611.07216","contentSha256":"4861094fa1fc2215facb4f6d6e94b645273fc7369b451f943cf7e48f3bcc6b67","textHash":"ec422c62acb9510298e7e2a4d822528e456713e856d29fa6a5775ad175034014","observedAt":"2026-11-08T21:42:06.881Z"}},{"actor":{"name":"Shu, Kai","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Shu, Kai","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07216","locator":"head/meta[name=author|citation_author]"},"assertionId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T21:42:06.881Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3","sourceUrl":"https://arxiv.org/abs/2611.07216","contentSha256":"4861094fa1fc2215facb4f6d6e94b645273fc7369b451f943cf7e48f3bcc6b67","textHash":"ec422c62acb9510298e7e2a4d822528e456713e856d29fa6a5775ad175034014","observedAt":"2026-11-08T21:42:06.881Z"}},{"actor":{"name":"Xiong, Li","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Xiong, Li","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07216","locator":"head/meta[name=author|citation_author]"},"assertionId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T21:42:06.881Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3","sourceUrl":"https://arxiv.org/abs/2611.07216","contentSha256":"4861094fa1fc2215facb4f6d6e94b645273fc7369b451f943cf7e48f3bcc6b67","textHash":"ec422c62acb9510298e7e2a4d822528e456713e856d29fa6a5775ad175034014","observedAt":"2026-11-08T21:42:06.881Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.07216","snapshotId":"9a15576a8b647f51655bdd64a1491dac078db84f44a4ca4c437cd3fb5b8fa2e3","contentSha256":"4861094fa1fc2215facb4f6d6e94b645273fc7369b451f943cf7e48f3bcc6b67","textHash":"ec422c62acb9510298e7e2a4d822528e456713e856d29fa6a5775ad175034014","observedAt":"2026-11-08T21:42:06.881Z","basis":"publisher-page-metadata","sourceLinks":44,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/42ad36d76eb39ff8a315292ecf70390fd05abb7eec758172b7e914b26ab63b43/source"}}}],"audits":[{"publicationId":"0a06d411-e51f-4a6b-81b6-118c6f42d678","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading correctly credits Hong kyu Lee, Kai Shu and Li Xiong and frames the results as their abstract's claims. The arXiv cs.AI label matches the feed publisher, even though the page lists cs.LG as the primary category.","excerpt":"Authors:Hong kyu Lee, Kai Shu, Li Xiong"},{"dimension":"summary","status":"uncertain","explanation":"The reading is faithful but leaves out key parts of the argument. It never explains un-alignment, meaning deliberately undoing safety behavior, as the authors' proposed audit. It also skips the finding that recognition and refusal are decoupled. It says only that CMaG steers responses; the abstract says it converts refusals into compliance using one backward pass over 80 examples. It omits transfer to text-explicit harm and to defensively hardened models. Smallest repair: one sentence each on un-alignment as an audit, conversion of refusal to compliance at low cost, and the transfer claims. LLM-judge and log-probability margin need tooltips.","excerpt":"A single backward pass over 80 examples yields a direction along which steering monotonically converts refusal into compliance."},{"dimension":"date","status":"pass","explanation":"The originalPublished date of 2026-11-04 matches the v1 submission date. The 2026-11-06 feed date is correctly not used.","excerpt":"[Submitted on 4 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"Each claim matches the abstract, including the cross-modal interaction term, which the abstract states. The question is labeled as interpretation and stays within the evidence, because the results were reported on two named models. That question does not contradict the abstract's separate claims of transfer to other harm types and to hardened models, though the summary should mention those claims.","excerpt":"contrasts it against partially benign pairs to isolate the cross-modal interaction term"},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the original arXiv abstract page, which is the most direct access to the source.","excerpt":null}],"createdAt":"2026-11-08T20:38:30.091Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}