Seeing Through, Still Complying: Binding Multimodal Safety to the Underlying Intent

Multimodal large language models (MLLMs) have made rapid progress in visual reasoning, enabling them to solve complex real-world tasks across images and text. This growing capability, however, also expands their attack surface. Recent multimodal jailbreaks conceal harmful requests by dispersing the intent across images, text, and task frames, leaving the model's own reasoning to reconstruct it. Modern MLLMs do reconstruct the intent, yet a gap remains between the intent they recover and the action they take. This gap is largest for the most dispersed attacks: with the model's own reconstructed intent held fixed, the attack frame alone suffices to elicit harmful content, and restating the intent in the prompt does not restore safety against the most dispersed attacks. These findings suggest that safety decisions should track the jointly formed intent rather than the surface frame through which it is presented. Guided by this principle, we construct BIND-5K, in which every harmful case is paired with benign counterparts that share either its image or its request. Its held-out benchmark scores each group of matched inputs as a single unit, granting credit only when every decision within it is correct. Unlike existing multimodal safety benchmarks that score each input independently, BIND-5K cannot be passed by uniformly refusing or answering all requests. On its training splits, we develop BIND-Align, which teaches the model to recover the joint intent before answering and optimizes its safety decision with a reward that explicitly couples behavior to that intent. Across four backbones, BIND-Align consistently balances resistance to dispersed attacks with helpful responses to benign requests, while defenses that perform strongly on attack-only benchmarks through broad refusal degrade substantially under our paired evaluation.