@inproceedings{zhu-etal-2026-cross,
title = "Cross-Modal Emergent Misalignment Through Narrow-Domain Fine-Tuning",
author = "Zhu, Han and
Cai, Chengkun and
Wen, Pengcheng and
Zhu, Yanxu and
Chauhan, Jagmohan and
Li, Lei and
Guo, Yike and
Han, Sirui",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.2241/",
pages = "50993--51012",
ISBN = "979-8-89176-459-0",
abstract = "The rapid advancement of artificial intelligence has brought safety concerns to the forefront of research. Recent studies indicate that Large Language Models (LLMs) may exhibit emergent misalignment during training progress: when exposed to narrow-domain harmful data, they can develop unsafe behaviors across broad, unrelated tasks. This phenomenon raises a critical question: do current alignment methods genuinely eliminate harmful capabilities, or do they merely condition models to ``simulate'' safety? To investigate this, we conduct a comprehensive study on cross-modal emergent misalignment involving diverse Multimodal Large Language Models (MLLMs), including vision-language models (VLMs) such as Gemma3 and Qwen2.5-VL and unified any-to-any models including Janus and Bagel. We utilize a multimodal training setup encompassing text-to-text (T2T), text-image-to-text (TI2T), and text-to-image (T2I) tasks to probe safety boundaries. Our experiments yield four critical findings: (1) Cross-modal penetration: Current alignment methods primarily constrain model behavior rather than unlearning harmful knowledge, as evidenced by safety breaches transferring across modalities. (2) Backbone vulnerability: Mechanistic analysis reveals that the LLM backbone, rather than the visual encoder/decoder, is the primary source of cross-modal vulnerabilities. (3) Evaluation gaps: We identify significant deficiencies in current safety evaluation practices, demonstrating that single-modality testing is inadequate for detecting cross-modal risks. These findings underscore the urgent need for comprehensive cross-modal evaluation frameworks to mitigate safety concerns in next-generation multimodal models."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="zhu-etal-2026-cross">
<titleInfo>
<title>Cross-Modal Emergent Misalignment Through Narrow-Domain Fine-Tuning</title>
</titleInfo>
<name type="personal">
<namePart type="given">Han</namePart>
<namePart type="family">Zhu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Chengkun</namePart>
<namePart type="family">Cai</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Pengcheng</namePart>
<namePart type="family">Wen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yanxu</namePart>
<namePart type="family">Zhu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jagmohan</namePart>
<namePart type="family">Chauhan</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Lei</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yike</namePart>
<namePart type="family">Guo</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sirui</namePart>
<namePart type="family">Han</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>The rapid advancement of artificial intelligence has brought safety concerns to the forefront of research. Recent studies indicate that Large Language Models (LLMs) may exhibit emergent misalignment during training progress: when exposed to narrow-domain harmful data, they can develop unsafe behaviors across broad, unrelated tasks. This phenomenon raises a critical question: do current alignment methods genuinely eliminate harmful capabilities, or do they merely condition models to “simulate” safety? To investigate this, we conduct a comprehensive study on cross-modal emergent misalignment involving diverse Multimodal Large Language Models (MLLMs), including vision-language models (VLMs) such as Gemma3 and Qwen2.5-VL and unified any-to-any models including Janus and Bagel. We utilize a multimodal training setup encompassing text-to-text (T2T), text-image-to-text (TI2T), and text-to-image (T2I) tasks to probe safety boundaries. Our experiments yield four critical findings: (1) Cross-modal penetration: Current alignment methods primarily constrain model behavior rather than unlearning harmful knowledge, as evidenced by safety breaches transferring across modalities. (2) Backbone vulnerability: Mechanistic analysis reveals that the LLM backbone, rather than the visual encoder/decoder, is the primary source of cross-modal vulnerabilities. (3) Evaluation gaps: We identify significant deficiencies in current safety evaluation practices, demonstrating that single-modality testing is inadequate for detecting cross-modal risks. These findings underscore the urgent need for comprehensive cross-modal evaluation frameworks to mitigate safety concerns in next-generation multimodal models.</abstract>
<identifier type="citekey">zhu-etal-2026-cross</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.2241/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>50993</start>
<end>51012</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Cross-Modal Emergent Misalignment Through Narrow-Domain Fine-Tuning
%A Zhu, Han
%A Cai, Chengkun
%A Wen, Pengcheng
%A Zhu, Yanxu
%A Chauhan, Jagmohan
%A Li, Lei
%A Guo, Yike
%A Han, Sirui
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F zhu-etal-2026-cross
%X The rapid advancement of artificial intelligence has brought safety concerns to the forefront of research. Recent studies indicate that Large Language Models (LLMs) may exhibit emergent misalignment during training progress: when exposed to narrow-domain harmful data, they can develop unsafe behaviors across broad, unrelated tasks. This phenomenon raises a critical question: do current alignment methods genuinely eliminate harmful capabilities, or do they merely condition models to “simulate” safety? To investigate this, we conduct a comprehensive study on cross-modal emergent misalignment involving diverse Multimodal Large Language Models (MLLMs), including vision-language models (VLMs) such as Gemma3 and Qwen2.5-VL and unified any-to-any models including Janus and Bagel. We utilize a multimodal training setup encompassing text-to-text (T2T), text-image-to-text (TI2T), and text-to-image (T2I) tasks to probe safety boundaries. Our experiments yield four critical findings: (1) Cross-modal penetration: Current alignment methods primarily constrain model behavior rather than unlearning harmful knowledge, as evidenced by safety breaches transferring across modalities. (2) Backbone vulnerability: Mechanistic analysis reveals that the LLM backbone, rather than the visual encoder/decoder, is the primary source of cross-modal vulnerabilities. (3) Evaluation gaps: We identify significant deficiencies in current safety evaluation practices, demonstrating that single-modality testing is inadequate for detecting cross-modal risks. These findings underscore the urgent need for comprehensive cross-modal evaluation frameworks to mitigate safety concerns in next-generation multimodal models.
%U https://aclanthology.org/2026.emnlp-main.2241/
%P 50993-51012
Markdown (Informal)
[Cross-Modal Emergent Misalignment Through Narrow-Domain Fine-Tuning](https://aclanthology.org/2026.emnlp-main.2241/) (Zhu et al., EMNLP 2026)
ACL
- Han Zhu, Chengkun Cai, Pengcheng Wen, Yanxu Zhu, Jagmohan Chauhan, Lei Li, Yike Guo, and Sirui Han. 2026. Cross-Modal Emergent Misalignment Through Narrow-Domain Fine-Tuning. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 50993–51012, Budapest, Hungary. Association for Computational Linguistics.