Pith. sign in

REVIEW 4 major objections 6 minor 2 cited by

VSCBench: Bridging the Gap in Vision-Language Model Safety Calibration

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read No vision-language model tested is well-calibrated for safety, the paper claims.

desk verdict VSCBench is a useful new two-axis VLM safety benchmark, but its headline numbers depend on an unvalidated GPT-4o judge and need to be treated as provisional. read the letter →

arxiv 2505.20362 v1 pith:B27PNT57 submitted 2025-05-26 cs.IR cs.AI

Jiahui Geng , Qing Li , Zongxiong Chen , Yuxia Wang , Derui Zhu , Zhuohan Xie , Chenyang Lyu , Xiuying Chen
show 2 more authors
Preslav Nakov Fakhri Karray
This is my paper · ORCID
classification cs.IRcs.AI
keywords safetycalibrationvision-languagemodelsmultimodaloversafetyundersafetybenchmarkrefusalbehaviortest-time
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that vision-language models (VLMs) have a safety-calibration problem, not just a safety problem: they either answer unsafe queries (undersafety) or refuse safe ones (oversafety), and current evaluation methods only look at one side. To make both sides measurable, the authors build VSCBench, a benchmark of 3,600 image-text pairs in which safe and unsafe versions are visually or textually similar but differ in safety, and score models by their refusal accuracy on safe and unsafe queries (SRAs and SRAu). Evaluating eleven proprietary, open-weight, and safety-aligned VLMs, they report that no model is well-calibrated: proprietary models lean oversafe or undersafe depending on category, open-weight models mostly under-refuse, and safety-aligned models are inconsistent across risk categories. They also test four test-time calibration methods and find that the effective ones (few-shot learning and internal activation revision) improve calibration but degrade general task accuracy. If correct, VSCBench gives the field a common yardstick for measuring and comparing safety calibration in multimodal models.

What carries the argument

The load-bearing object is VSCBench itself, built by a human-LLM pipeline. The image-centric half contains 1,800 pairs of visually similar safe and unsafe images (e.g., roses versus poppy flowers) sharing the same query across six risk categories. The text-centric half takes the 450 XSTest safe/unsafe text queries and renders them into 1,800 image-text pairs using QueryRelevant-style extraction (object or scene shown in an image) and FigStep-style typographic prompts, so the same query appears with safe or unsafe images. The evaluation metric is refusal accuracy: SRAs measures correct non-refusal on safe queries, SRAu measures correct refusal or risk-flagging on unsafe queries, and both are computed from an indicator function $I(r_i)$ that checks for refusal phrases or warnings, with GPT-4o as the judge. The paired design is what makes the two failure modes visible: identical text with swapped image content isolates whether the model's safety decision tracks visual or textual signals.

What would settle it

Take a random sample of 200 VSCBench responses that GPT-4o labeled safe because they contain refusals or warnings, run an independent toxicity detector and human annotation on them, and check whether a substantial fraction contain toxic content despite the warning; if the mislabel rate is high, the reported SRA values and the calibration patterns would change.

Watch

Extended reading notes

Core claim

The paper's central claim is that safety alignment in VLMs should be evaluated as calibration between two failure modes, and that under that lens every model tested is miscalibrated. A response is scored safe when it refuses or flags risk; it is scored unsafe when it answers without warning. On the image-centric subset, Claude shows oversafety with high SRAu but low SRAs, Gemini refuses only 6.3% of pornography-related unsafe queries, and open-weight models exceed 90% SRAs while falling below 40% SRAu. On the text-centric subset, models that look calibrated on plain text shift toward undersafety or oversafety once the same query is paired with an image, showing that textual calibration does not transfer to multimodal input. The paper also finds that undersafety is not the same as toxicity: some models give non-toxic but unsafe descriptions, while others produce explicitly toxic content.

Load-bearing premise

The whole scoring scheme rests on GPT-4o correctly deciding whether a response contains a refusal or warning phrase and treating every response without such phrases as unsafe, even though the paper concedes that a response can contain both a warning and toxic content.

Editorial extensions

If this is right

  • Existing safety-aligned VLMs give inconsistent protection: they over-refuse in Violence, Health & Drugs, and Discrimination while under-refusing in Illegal Activities and Pornography.
  • A model that is well-calibrated on text-only inputs can become miscalibrated when the same query is paired with an image, so multimodal safety cannot be inferred from language-model safety scores.
  • Few-shot demonstration pairs and internal activation revision can noticeably improve calibration (e.g., Gemini's pornography SRAu rises from 6.3% to 71.2% with one example), but chain-of-thought and prompt engineering alone are unreliable.
  • All effective calibration methods reduce model helpfulness on ScienceQA and POPE, so safety calibration currently trades off against utility.
  • VSCBench can serve as a standardized testbed for future calibration methods, since it reports both SRAs and SRAu on the same paired inputs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's refusal-phrase indicator could be combined with a toxicity detector to catch responses that warn and then comply; this would likely lower the reported SRAu values on jailbreak-style outputs.
  • Because the benchmark pairs visually similar safe and unsafe images, it could be extended to test whether calibration transfers across languages, domains, or adversarial image perturbations beyond the six current categories.
  • The observed category-level inconsistency suggests that safety alignment should be trained with category-balanced calibration objectives rather than aggregate refusal rates.
  • The utility cost finding implies that deployment decisions may need to choose which categories to calibrate first, since fixing every category at once appears to degrade helpfulness with current methods.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes VSCBench, a 3,600-pair vision-language safety benchmark for evaluating both undersafety and oversafety. It introduces the notion of safety calibration, measured by SRAs and SRAu, which score a model's accuracy on safe and unsafe queries, respectively. The dataset is built with a human-LLM pipeline: GPT-4o generates candidate safe/unsafe items under six categories, images are retrieved, and three rounds of human review filter mismatches. The authors evaluate eleven proprietary, open-weight, and safety-aligned VLMs, reporting prevalent oversafety and undersafety, and then explore four test-time calibration methods (CoT, prompt engineering, few-shot learning, and internal activation revision), finding that effective calibration often degrades helpfulness. The central empirical claim is that no evaluated VLM is well-calibrated and that VSCBench provides a valid tool for measuring safety calibration.

Significance. If its measurement layer is validated, VSCBench fills a real gap: most prior VLM safety benchmarks focus on undersafety only, whereas VSCBench pairs visually or textually similar safe and unsafe queries, enabling per-category analysis of oversafety and undersafety. The three-round human verification during construction is a notable strength, and the paired design is well suited to fine-grained calibration analysis. The authors also ship code and data and report their compute budget. However, the empirical conclusions are currently conditional on the reliability of the GPT-4o judge used for every score in Table 2; the paper's own Limitations section concedes the judge's key failure mode, so the benchmark's usefulness as a measurement tool is not yet established.

major comments (4)
  1. [Section 4.2 / Limitations] Equations (1)-(2) define SRAs and SRAu through an indicator I(r_i) that marks a response as safe when it contains refusal phrases or warnings, and in practice this indicator is applied by a GPT-4o judge using the four-level rubric in Table 4, with levels 0 and 1 collapsed to safe. The paper reports no human validation of this judge, no alternative-judge comparison, and no agreement statistics. The Limitations section explicitly concedes that a response could contain both a warning and toxic content, which the metric would count as safe, and that responses can be unstable. Because every SRA value in Table 2 and Figure 1 derives from this indicator, the central claim that no evaluated VLM is well-calibrated is not yet independently supported. Please validate the judge on a stratified sample against human labels, report agreement, and examine whether the model ordering changes with a different judge or with a stricter definition of a safe response.
  2. [Section 4.2 / Limitations] The authors acknowledge in the Limitations that model responses are unstable and that SRA values 'may fluctuate,' yet all results in Table 2, Table 5, and Figure 1 are single point estimates with no confidence intervals, repeated runs, or significance tests. Some headline differences are large, but several within-category comparisons are only a few points apart, and the reported instability could affect the claimed oversafety/undersafety patterns. Please report repeated-run statistics or bootstrap confidence intervals so that the comparisons are robust.
  3. [Section 5.1 / Table 5] The IAR configuration (14th layer, interference strength 1.50) is chosen after searching over four layers and four strengths. The subsequent evaluation in Section 5.3 and Table 5 is conducted on the same categories used for this exploration (Health & Drugs, Discrimination, Pornography, and QueryRelevant Retr+Typo). This is a test-set selection procedure, so the reported IAR gains may be optimistic. The paper should either use a held-out validation split for hyperparameter selection or present the full grid search results so readers can assess sensitivity and the risk of overfitting to the evaluation subset.
  4. [Section 3.2.1 / Section 4.2] GPT-4o plays three roles: it generates the safety categories and candidate items in Section 3.2.1, it acts as the judge for all responses in Section 4.2, and it is itself one of the eleven evaluated models in Table 2. This triple role creates a risk of circularity: the category taxonomy is derived from GPT-4o's own safety policy, and GPT-4o's responses may be judged more favorably by a judge that shares the same policy. Please discuss this risk and provide at least one robustness check, such as evaluating with a second judge or a human-annotated sample, to ensure that GPT-4o's relative ranking is not an artifact of judging its own outputs.
minor comments (6)
  1. [Table 1] The Violence subcategory counts sum to 270 (120+90+60) and the Illegal Activities subcategory counts sum to 324 (114+66+144), while the table reports totals of 300 for each; the percentage columns are inconsistent with these sums. Please correct the counts or percentages.
  2. [Section 4.3.1] The sentence 'open-weight VLMs also display pronounced undersafety, achieving an average SRAs of over 90.0%, while SRAu is below 40.0%' is not accurate for InternVL (8B), which has SRAs 78.8% and SRAu 57.6% in Table 2. Qualify the claim to 'most open-weight VLMs' or exclude InternVL.
  3. [Table 2 caption] The caption states 'Red bold and orange are the highest and second-highest results of different categories,' but the rendered table does not show which entries are red, bold, or orange, and the color encoding is inaccessible to color-blind readers. Please replace with a clear textual or symbol-based annotation.
  4. [Throughout] The model name 'LLaV A' appears with an unusual space throughout the paper (e.g., 'LLaV A-v1.6'); it should likely be 'LLaVA'.
  5. [Section 4.2] The claim that 'LLM-as-a-Judge is increasingly being recognized for its effectiveness and reliability' has no citation; please add a reference to prior work on LLM-based evaluation.
  6. [Section 5.1] The sentence 'we identify the 14th layer with a strength of 1.50 as the optimal configuration' does not state the optimization criterion. Please specify whether the selection used SRAa, a combined SRAs/SRAu objective, or another measure.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: VSCBench's safe/unsafe labels are externally constructed and human-verified, and the GPT-4o judge is a measurement-validity risk rather than an input that the results are derived from by construction.

full rationale

The paper's central measurement is an external benchmark, not a quantity derived from the models under test. Safe/unsafe labels come from LLM candidate generation followed by three rounds of human verification (Section 3.2.1, Step 3; Section 3.2.2, Step 3), and the text-centric subdataset is derived from the external XSTest benchmark. Equations (1)-(2) define SRA_s and SRA_u using an indicator I(r_i) over model responses, with GPT-4o as the evaluator; the judge is a measurement instrument and is not fitted to the benchmark or to the target models, so the reported values are not forced by definition. GPT-4o is also not the best-performing model on the headline metric, which weakens any claim that its use as generator/judge predetermines the ranking. The self-citations (Geng et al. 2024; Geng et al. 2025; Li et al. 2025a/b) are background references or a separately executed method (IAR) whose reported numbers are measured, not assumed from the citations. The paper's limitations explicitly concede that a response could contain both a warning and toxic content and would then be counted as safe, and that SRA values may fluctuate; these are genuine threats to the validity of the measurement, but they concern judge accuracy and variance, not circular derivation. No equation, fitted parameter, or self-citation chain reduces the paper's central claims to its inputs.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The central measurement rests on the judge and labeling pipeline, not on model parameters. The only explicit free parameter is the IAR configuration, which is fit to the evaluation data. The safety labels are a domain assumption produced by GPT-4o and human review, not an externally verified standard.

free parameters (1)
  • IAR layer index and interference strength = 14th layer, strength 1.50
    Selected by searching four layers (9, 14, 19, 24) and four strengths (1.0, 1.5, 2.0, 2.5) and then used for the reported IAR gains; Section 5.1 and Appendix A.2. Tuning on the evaluation categories makes the gains partly fitted.
assumptions (4)
  • domain assumption The GPT-4o judge accurately detects refusal phrases and warnings in model responses, so the indicator function I(ri) in Equations (1)-(2) is a valid safety classifier.
    Invoked in Section 4.2 to compute every SRA value. The Limitations section explicitly acknowledges that responses can contain both a warning and toxic content, which this metric would count as safe.
  • domain assumption The ground-truth safe/unsafe labels in VSCBench are correct and reflect a shared safety policy.
    Section 3.2 describes GPT-4o candidate generation plus three rounds of human verification as the labeling process; if these labels are wrong or contested, the benchmark's ground truth is invalid.
  • ad hoc to paper The six safety categories (Violence, Health & Drugs, Illegal Activities, Religion & Politics, Discrimination, Pornography) cover the relevant safety space for calibration.
    Section 3.2.1 states the categories are based on GPT-4o's safety alignment policy; this choice bounds coverage and is not derived from an external taxonomy.
  • ad hoc to paper SRA_s and SRA_u together constitute 'safety calibration'.
    Section 1 defines safety calibration via these two refusal-rate metrics, repurposing the term from probabilistic calibration (Guo et al., 2017) without a calibration curve or confidence scores.

how reviews work

0 comments
Cite this review

Pith. "Pith review of VSCBench: Bridging the Gap in Vision-Language Model Safety Calibration." pith.science (2026). https://pith.science/paper/B27PNT57

@misc{pith2026250520362,
  author       = {Pith},
  title        = {Pith review of: VSCBench: Bridging the Gap in Vision-Language Model Safety Calibration},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/B27PNT57}},
  note         = {Machine review of arXiv:2505.20362}
}
abstract

The rapid advancement of vision-language models (VLMs) has brought a lot of attention to their safety alignment. However, existing methods have primarily focused on model undersafety, where the model responds to hazardous queries, while neglecting oversafety, where the model refuses to answer safe queries. In this paper, we introduce the concept of $\textit{safety calibration}$, which systematically addresses both undersafety and oversafety. Specifically, we present $\textbf{VSCBench}$, a novel dataset of 3,600 image-text pairs that are visually or textually similar but differ in terms of safety, which is designed to evaluate safety calibration across image-centric and text-centric scenarios. Based on our benchmark, we evaluate safety calibration across eleven widely used VLMs. Our extensive experiments revealed major issues with both undersafety and oversafety. We further investigated four approaches to improve the model's safety calibration. We found that even though some methods effectively calibrated the models' safety problems, these methods also lead to the degradation of models' utility. This trade-off underscores the urgent need for advanced calibration methods, and our benchmark provides a valuable tool for evaluating future approaches. Our code and data are available at https://github.com/jiahuigeng/VSCBench.git.

Figures

Figures reproduced from arXiv: 2505.20362 by the authors.

Figure 1
Figure 1. Safety calibration evaluation of various VLMs [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of the human-LLM collaborative framework for dataset construction. LLMs are prompted to [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Representative examples illustrating the causes for incorrect responses. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Illustration of different models’ responses to unsafe queries, showing distinctions between safe, toxic, and [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Calibration results for different methods and VLMs. The four subfigures in the top row show the calibration [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. PolicyShiftGuard: Benchmarking and Improving Policy-Adaptive Image Guardrails

    cs.CV 2026-07 conditional novelty 6.0 of 10

    PolicyShiftGuard, trained with randomized policy SFT plus matched pass/block boundary pairs, reaches 76.9 Avg. F1 and 72.1 Avg. PSS on a new policy-shift image-guardrail benchmark where existing VLMs stay brittle.

  2. Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities

    cs.CR 2025-05 conditional novelty 6.0 of 10

    Con Instruction embeds harmful textual instructions into adversarial images or audio by aligning their representations, achieving successful jailbreaks on several vision- and audio-language models.

Reference graph

Works this paper leans on

37 extracted references · 4 canonical work pages · cited by 2 Pith papers

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Arnav Arora, Preslav Nakov, Momchil Hardalov, Sheikh Muhammad Sarwar, Vibha Nayak, Yoan Dinkov, Dimitrina Zlatkova, Kyle Dent, Ameya Bhatawdekar, Guillaume Bouchard, and Isabelle Augenstein. 2023. https://doi.org/10.1145/3603399 Detecting harmful content on online platforms: What platforms need vs. where research efforts go . ACM Comput. Surv., 56(3)

    doi:10.1145/3603399 2023

  4. [4]

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners. Advances in neural information processing systems, 33:1877--1901

    2020

  5. [5]

    Zhe Chen, Jiannan Wu, Wenhai Wang, Weijie Su, Guo Chen, Sen Xing, Muyan Zhong, Qinglong Zhang, Xizhou Zhu, Lewei Lu, et al. 2024. Internvl: Scaling up vision foundation models and aligning for generic visual-linguistic tasks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24185--24198

    2024

  6. [6]

    Justin Cui, Wei-Lin Chiang, Ion Stoica, and Cho-Jui Hsieh. 2024. Or-bench: An over-refusal benchmark for large language models. arXiv preprint arXiv:2405.20947

    arXiv 2024

  7. [7]

    Yinpeng Dong, Huanran Chen, Jiawei Chen, Zhengwei Fang, Xiao Yang, Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. 2023. https://openreview.net/forum?id=qtpTVc1c3c How robust is google's bard to adversarial image attacks? In R0-FoMo:Robustness of Few-shot and Zero-shot Learning in Large Foundation Models

    work page 2023

  8. [8]

    Lang Gao, Xiangliang Zhang, Preslav Nakov, and Xiuying Chen. 2024. Shaping the safety boundaries: Understanding and defending against jailbreaks in large language models. arXiv preprint arXiv:2412.17034

    arXiv 2024

Show all 37 references
  1. [9]

    Jiahui Geng, Fengyu Cai, Yuxia Wang, Heinz Koeppl, Preslav Nakov, and Iryna Gurevych. 2024. https://doi.org/10.18653/v1/2024.naacl-long.366 A survey of confidence estimation and calibration in large language models . In Proceedings of the 2024 Conference of the North American ...

    2024 doi

  2. [10]

    Jiahui Geng, Qing Li, Herbert Woisetschlaeger, Zongxiong Chen, Yuxia Wang, Preslav Nakov, Hans-Arno Jacobsen, and Fakhri Karray. 2025. A comprehensive survey of machine unlearning techniques for large language models. arXiv preprint arXiv:2503.01854

    2025 arXiv

  3. [11]

    Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2023. Figstep: Jailbreaking large vision-language models via typographic visual prompts. arXiv preprint arXiv:2311.05608

    2023 arXiv

  4. [12]

    Weinberger

    Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. 2017. https://proceedings.mlr.press/v70/guo17a.html On calibration of modern neural networks . In Proceedings of the 34th International Conference on Machine Learning, volume 70 of Proceedings of Machine Learning Resea...

    2017

  5. [13]

    Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. 2022. Large language models are zero-shot reasoners. In Proceedings of the 36th International Conference on Neural Information Processing Systems, NIPS '22, Red Hook, NY, USA. Curran Associates Inc

    2022

  6. [14]

    Michelle Jie Li. 2023. Nsfw text classifier. https://huggingface.co/michellejieli/NSFW_text_classifier. Accessed: 2025-02-11

    2023

  7. [15]

    Qing Li, Jiahui Geng, Zongxiong Chen, Kun Song, Lei Ma, and Fakhri Karray. 2025 a . Internal activation revision: Safeguarding vision language models without parameter update. arXiv preprint arXiv:2501.16378

    2025 arXiv

  8. [16]

    Qing Li, Jiahui Geng, Derui Zhu, Zongxiong Chen, Kun Song, Lei Ma, and Fakhri Karray. 2025 b . Internal activation revision: Safeguarding vision language models without parameter update. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 27428--27436

    2025

  9. [17]

    Xirui Li, Hengguang Zhou, Ruochen Wang, Tianyi Zhou, Minhao Cheng, and Cho-Jui Hsieh. 2024. Mossbench: Is your multimodal language model oversensitive to safe queries? arXiv preprint arXiv:2406.17806

    2024 arXiv

  10. [18]

    Yifan Li, Yifan Du, Kun Zhou, Jinpeng Wang, Xin Zhao, and Ji-Rong Wen. 2023. https://doi.org/10.18653/v1/2023.emnlp-main.20 Evaluating object hallucination in large vision-language models . In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processi...

    2023 doi

  11. [19]

    Haotian Liu, Chunyuan Li, Yuheng Li, Bo Li, Yuanhan Zhang, Sheng Shen, and Yong Jae Lee. 2024 a . https://llava-vl.github.io/blog/2024-01-30-llava-next/ Llava-next: Improved reasoning, ocr, and world knowledge

    2024

  12. [20]

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. https://proceedings.neurips.cc/paper_files/paper/2023/file/6dcf277ea32ce3288914faf369fe6de0-Paper-Conference.pdf Visual instruction tuning . In Advances in Neural Information Processing Systems, volume 36, pages 34...

    2023

  13. [21]

    Xin Liu , Yichen Zhu , Jindong Gu , Yunshi Lan , Chao Yang , and Yu Qiao . 2023. https://doi.org/10.48550/arXiv.2311.17600 MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models . arXiv e-prints, arXiv:2311.17600

    2023 doi arXiv

  14. [22]

    Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024 b . https://doi.org/10.1007/978-3-031-72992-8_22 Mm-safetybench: A benchmark for safety evaluation of multimodal large language models . In Computer Vision – ECCV 2024: 18th European Conference, Milan, I...

    2024 doi

  15. [23]

    Haoyu Lu, Wen Liu, Bo Zhang, Bingxuan Wang, Kai Dong, Bo Liu, Jingxiang Sun, Tongzheng Ren, Zhuoshu Li, Hao Yang, et al. 2024. Deepseek-vl: towards real-world vision-language understanding. arXiv preprint arXiv:2403.05525

    2024 arXiv

  16. [24]

    Pan Lu, Swaroop Mishra, Tanglin Xia, Liang Qiu, Kai-Wei Chang, Song-Chun Zhu, Oyvind Tafjord, Peter Clark, and Ashwin Kalyan. 2022. Learn to explain: Multimodal reasoning via thought chains for science question answering. Advances in Neural Information Processing Systems, 35:2...

    2022

  17. [25]

    Weidi Luo, Siyuan Ma, Xiaogeng Liu, Xiaoyu Guo, and Chaowei Xiao. 2024. https://openreview.net/forum?id=GC4mXVfquq Jailbreakv: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks . In First Conference on Language Modeling

    2024

  18. [26]

    Renjie Pi, Tianyang Han, Jianshu Zhang, Yueqi Xie, Rui Pan, Qing Lian, Hanze Dong, Jipeng Zhang, and Tong Zhang. 2024. https://doi.org/10.18653/v1/2024.emnlp-main.895 MLLM -protector: Ensuring MLLM `s safety without hurting performance . In Proceedings of the 2024 Conference o...

    2024 doi

  19. [27]

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2024. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems, 36

    2024

  20. [28]

    Paul R \"o ttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. https://doi.org/10.18653/v1/2024.naacl-long.301 XST est: A test suite for identifying exaggerated safety behaviours in large language models . In Proceedings of the 2024 Co...

    2024 doi

  21. [29]

    John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347

    2017 arXiv

  22. [30]

    Yuxia Wang, Haonan Li, Xudong Han, Preslav Nakov, and Timothy Baldwin. 2024. https://aclanthology.org/2024.findings-eacl.61 Do-not-answer: Evaluating safeguards in LLM s . In Findings of the Association for Computational Linguistics: EACL 2024, pages 896--911, St. Julian ' s, ...

    2024

  23. [31]

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824--24837

    2022

  24. [33]

    Yongting Zhang, Lu Chen, Guodong Zheng, Yifeng Gao, Rui Zheng, Jinlan Fu, Zhenfei Yin, Senjie Jin, Yu Qiao, Xuanjing Huang, et al. 2024 b . Spa-vl: A comprehensive safety preference alignment dataset for vision language model. arXiv preprint arXiv:2406.12030

    2024 arXiv

  25. [34]

    Zhexin Zhang, Junxiao Yang, Pei Ke, Shiyao Cui, Chujie Zheng, Hongning Wang, and Minlie Huang. 2024 c . Safe unlearning: A surprisingly effective and generalizable solution to defend against jailbreak attacks. arXiv preprint arXiv:2407.02855

    2024 arXiv

  26. [35]

    Zihao Zhao, Eric Wallace, Shi Feng, Dan Klein, and Sameer Singh. 2021. Calibrate before use: Improving few-shot performance of language models. In International conference on machine learning, pages 12697--12706. PMLR

    2021

  27. [36]

    Kaiwen Zhou, Chengzhi Liu, Xuandong Zhao, Anderson Compalas, Dawn Song, and Xin Eric Wang. 2024. Multimodal situational safety. arXiv preprint arXiv:2410.06172

    2024 arXiv

  28. [37]

    Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. 2024. https://doi.org/10.48550/arXiv.2402.02207 Safety fine-tuning at (almost) no cost: A baseline for vision large language models . In Proceedings of the 41st International Conference on Machine...

    2024 doi arXiv

  29. [38]

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.