A new technique lets multimodal AI models reject unsafe image and video inputs using safety training that never touched a single image or video.
Researchers published a paper introducing Modality-Agnostic Refusal Steering, or MARS, a training-free method that lifts "refusal directions" — internal activation patterns a text-only model uses to decline harmful requests — and applies them directly to multimodal inputs. The catch they had to solve first: those text-derived signals sometimes misfired on benign images, flagging safe content as harmful. MARS corrects this by re-centering activations to account for the gap between modalities, then scales steering strength within a calculated boundary and picks the most effective layer to intervene — all at the moment the model generates its first token.
This matters because collecting unsafe multimodal training data — images, video — is substantially harder than collecting text equivalents, legally and logistically. If safety structure genuinely transfers across modalities, labs could harden vision models against jailbreaks without building out separate, expensive multimodal red-teaming pipelines. The researchers tested MARS on five state-of-the-art multimodal models and reported consistent safety gains without meaningful drops in everyday usefulness.
That "training-free" label deserves some scrutiny: MARS still requires access to the model's internal activations and enough engineering headroom to tune layer selection and steering strength, which puts it out of reach for anyone who can't peer inside the model. But as a research direction, it suggests the industry has been treating text and vision safety as more separate problems than they actually are.