Daily Digest — August 21, 2026

When a safety-aligned vision-language model refuses to answer a visual question, does it refuse because it stopped processing the image — or because it processed it correctly and then decided to withhold the answer? It's the latter. And a targeted activation nudge is enough to restore the visual answer without any retraining.

Aligned VLMs frequently abstain from visual questions that remain answerable under default (unaligned) instruction, even when the image-question input is identical. The paper analyzes internal decoding dynamics across multiple architectures and multimodal benchmarks, finding that visual evidence consistently and significantly influences the internal representations of abstained outputs throughout decoding — perceptual grounding is retained, not suppressed, by safety alignment. Safety alignment operates as a late-stage representational override: the model sees and encodes the image normally, routes the visual signal through its reasoning pathway, and only at the final generation stage substitutes a refusal. Targeted activation-level interventions that suppress refusal-related representations reliably restore grounded, correct answering behavior across all tested architectures — no retraining, no modification of visual inputs required. The finding has dual implications: it clarifies why safety-aligned VLMs are often recoverable via activation steering, and it suggests that safety circuits and perceptual circuits are anatomically separable at the representation level.

Safety evaluation suites for LLMs almost universally test text-only adversarial prompts. Appending emojis to the same prompts bypasses safety filters in three of four tested models, with up to a 10% success rate — zero effort, zero prompt engineering.

The study evaluates 50 adversarial prompts augmented with emoji modifiers across Mistral 7B, Qwen 2 7B, Gemma 2 9B, and Llama 3 8B. All four models show 0% bypass rate under the standard text-only version of the same prompts. With emoji augmentation: Gemma 2 9B and Mistral 7B each exhibit 10% bypass; Llama 3 8B shows 6%; Qwen 2 7B demonstrates complete resistance. The scope is explicitly limited (50 prompts, 4 models, one attack surface dimension), but the zero-effort nature of the bypass and the 0%→10% jump make it a concrete documentation of a gap in standard safety evaluation methodology. The finding aligns with a broader body of work showing that safety alignment optimized on text-token adversarial examples does not generalize robustly to alternative token representations.