Pith. sign in

REVIEW 4 major objections 6 minor 51 references

MDIT-Bench: Evaluating the Dual-Implicit Toxicity in Large Multimodal Models

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper establishes a new category of toxicity, dual-implicit toxicity, and shows that 13 large multimodal models miss it, with long-context prompts activating substantial hidden toxicity.

desk verdict A large, well-documented benchmark for a genuinely new construct, but the headline claim about latent 'hidden toxicity' rests on a multiple-choice artifact and a many-shot confound that the paper does not control for. read the letter →

arxiv 2505.17144 v1 pith:ROFFQYZD submitted 2025-05-22 cs.CL cs.AI

Bohan Jin , Shuhan Qi , Kehai Chen , Xinyi Guo , Xuan Wang This is my paper
classification cs.CLcs.AI
keywords dual-implicittoxicitylargemultimodalmodelsbenchmarksafetyhiddenlong-contextjailbreakingprejudiceanddiscriminationmultiple-choiceevaluation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Toxicity in image-and-text inputs is usually tested in forms that are visible in a single modality: an insulting phrase, or a hateful image. This paper argues that a subtler kind, dual-implicit toxicity, exists only in the combination of the two: the text is innocuous without the image, and the image is innocuous without the text. To make this measurable, the authors built MDIT-Bench, a 317,638-question multiple-choice benchmark in which the correct answer is the non-toxic option and the toxic options require cross-modal reasoning; questions span 12 prejudice and discrimination categories at three difficulty levels. Across 13 open and closed large multimodal models, accuracy at the medium level peaks at 67.2%, and at the hard level, where toxic demonstrations are inserted into the prompt, accuracy drops roughly by half for several models, which the paper interprets as hidden but activatable toxicity. The paper also contributes a Hidden Toxicity metric that quantifies this drop.

What carries the argument

The load-bearing object is the MDIT-Bench multiple-choice item. Each question masks the crucial referent with the phrase "the [] in the picture", so a model that ignores the image cannot know who or what is being discussed. The five options are a non-toxic answer, a plainly toxic answer, a concatenation of the first two with a confusing tail, an image caption, and a near-correct answer with a distractor word swapped in, and the correct option is shuffled among letters A through E. Difficulty tiers come from source data, with explicit or single-implicit toxicity for the easy level and dual-implicit toxicity for the medium level, while the hard level adds Long-context Jailbreaking: the medium prompt is prefixed with 32, 64, or 128 toxic few-shot demonstrations. The Hidden Toxicity metric is $$ HT(G) = \sum_{i\in N}\left(1-\frac{\mathrm{Acc}_{n=i}}{\mathrm{Acc}_{n=0}}\right)\mathrm{Norm}_N(i), \quad \mathrm{Norm}_N(i)=\frac{1/\log_2 i}{\sum_{i\in N}1/\log_2 i}, $$ with $N=\{32,64,128\}$, which weights each shot count by a power-law factor and reports the fraction of latent toxicity that the long-context setting activates.

What would settle it

Rewrite a random subset of Ans3 options as single fluent paragraphs with the same toxic sentence, add a length-matched non-toxic fifth option, and compare model accuracy; if accuracy shifts materially, the benchmark is measuring option phrasing rather than dual-implicit toxicity.

Watch

Extended reading notes

Core claim

The paper's central claim is that large multimodal models cannot reliably detect dual-implicit toxicity, defined as toxicity that is undetectable from either the visual or the textual modality alone and only becomes apparent when both are integrated. To demonstrate this, the authors construct the MDIT-Dataset with 112,873 toxic questions using a multi-stage human-in-the-loop in-context generation method, then build MDIT-Bench with 317,638 multiple-choice questions across three difficulty levels. On the medium level, the best open model reaches only 67.2% accuracy, several models fall at or below the 20% random baseline, and on the hard level, where 32 to 128 toxic demonstrations are prepended to the prompt, accuracy drops by roughly half for several models. The paper reports Hidden Toxicity values between about 0.28 and 0.53 across the tested models, concluding that models contain substantial toxicity that is latent under ordinary conditions but can be activated by long-context jailbreaking. Human evaluation on a 2,300-question subset reaches 98% accuracy in identifying the toxic options, which the paper offers as evidence that the benchmark's toxicity is recognizable to people.

Load-bearing premise

The measurements treat models that choose Ans3 as failing to detect toxicity, but Ans3 is an artificially assembled option that the paper admits does not read naturally, so accuracy may partly reflect option style rather than toxic awareness.

Editorial extensions

If this is right

  • Safety evaluations that only test explicit or single-modality toxicity will overstate how safe a model is; dual-implicit toxicity is a distinct failure mode that even strong models miss.
  • Long-context jailbreaking gives a practical way to stress-test for latent toxicity: inserting toxic demonstrations into the prompt reliably lowers accuracy and increases toxic-option choices.
  • The Hidden Toxicity metric provides a single comparable number for the gap between normal-condition and stressed-condition performance, which accuracy alone does not capture.
  • Category-level results identify classism and subcultural discrimination as weak spots across models, pointing to where alignment data and training are most needed.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: because Ans3 is a concatenation of a safe sentence, a toxic sentence, and a confusing tail, part of the measured "toxicity" could be a preference for longer or less fluent options; a length-matched non-toxic option would separate those factors.
  • Editorial inference: the paper's text-only ablation on one model suggests that single-modality checks underestimate the problem; rerunning the full medium level on several models without images would show how much of the failure is cross-modal integration versus text understanding.
  • Editorial inference: the masked phrase "the [] in the picture" could be transferred to audio or video contexts, where the hidden referent would be carried by a non-text modality, making the same benchmark design applicable to other safety domains.
  • Editorial inference: the power-law weighting in the Hidden Toxicity metric assumes shot-count scaling follows a particular functional form; testing with shot counts outside {32, 64, 128} and with shuffled demonstrations would reveal whether the metric's ranking is robust.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces the notion of dual-implicit toxicity, in which offensive content is detectable only by jointly reasoning over image and text, and presents MDIT-Bench, a multimodal multiple-choice benchmark with 317,638 questions across easy, medium, and hard tiers, built via a multi-stage human-in-the-loop in-context generation pipeline. The authors report accuracy for 13 large multimodal models (LMMs) on the medium and easy tiers, and a proposed Hidden Toxicity (HT) metric computed from accuracy at the hard tier, which is constructed by prepending 32, 64, or 128 toxic demonstrations. The headline claims are that the evaluated LMMs cannot effectively handle dual-implicit toxicity, and that most models contain substantial hidden, activatable toxicity as measured by accuracy drops at the hard level.

Significance. If the benchmark is valid, this would be a useful and unusually large resource for studying a genuinely under-explored safety axis: cross-modal implicit prejudice. The strengths include the scale of the dataset (317k items, 12 categories, 780 topics), the explicit human-in-the-loop generation protocol, the effort to include a non-toxic easy tier for comparison, the public release of data, and the paper's own candid Limitations section, which acknowledges the multiple-choice restriction and the fact that toxicity categories cover only prejudice and discrimination. The central claims, however, rest on the validity of the five-option MCQ format and on the interpretation of accuracy drops under long-context jailbreaking; both need additional evidence before the headline conclusions can be accepted.

major comments (4)
  1. [Appendix C.1, Figure 8, and Section 4.3 (Stage 2)] The Ans3 option is an artifact-prone distractor. It is constructed as a concatenation of the non-toxic Ans1, the toxic Ans2, and a 'please respect' clause, and the paper itself acknowledges that 'Ans3 may not read as smoothly as natural text' and that paraphrasing 'could disrupt this balance.' Because Ans3 is systematically longer and contains both the safe and the toxic statements, a model with a length bias or a preference for hedged, compound-sentence responses can select it without detecting mid-sentence toxicity. Figure 4 shows that Qwen2-VL and CogVLM2 choose Ans3 very frequently, and the paper interprets this as missing mid-sentence toxicity, but the option format is a plausible alternative explanation. The Stage 2 human evaluation (Section 4.3, Appendix H.1) only asks annotators to choose between Ans1 and Ans2, never to perform the full five-option task that the models face. Thus the 98% human accuracy does not establish that the designated correct answer is the one humans would choose when Ans3 is present. This is load-bearing: the medium-level accuracy values and the hard-level HT values both depend on the assumption that selecting Ans2 or Ans3 indicates toxicity detection failure rather than a format-driven choice. I recommend adding a human validation of the full five-option task (or a controlled experiment varying option length and phrasing) and, if necessary, redesigning Ans3 so that it is matched for length and surface form with Ans1/Ans2.
  2. [Equations (1)-(2), Table 3, and Section 4.2.2] The Hidden Toxicity metric, as defined in Eq. (1)-(2), has two problems that affect the comparability of the reported HT values. First, the normalization Norm_N(i) = (1/log2 i) / sum_{i in N} (1/log2 i) is hand-set: the choice of N = {32,64,128}, the use of log2, and the restriction to powers of two are not derived from any model or task property, and the paper does not report sensitivity to these choices. Second, HT is computed on different shot sets across models: Table 3 leaves the 128-shot entry empty for LLaVA-1.5 and LLaVA-NeXT, and Section G.1 explains that these models produced 'No answer' at 128 shots. This means HT for those models is computed only from 32- and 64-shot points, while BLIP2 and Qwen2-VL use all three, so the HT values are not directly comparable. In addition, Section 4.1.1 states that 'we conducted multiple tests to reduce generative randomness,' but no error bars, confidence intervals, or run-to-run variance are reported anywhere in Tables 2-4, making it impossible to judge whether differences like the 0.4758 vs 0.5300 HT values are significant. At minimum, the paper should report variance across runs, provide an ablation of the normalization, and either compute HT on a common shot set for all models or report per-shot-set values.
  3. [Abstract and Section 4.1.2] The claim that 'these LMMs cannot handle dual-implicit toxicity effectively' is stronger than the evidence supports. Qwen2-VL-7B reaches 67.2% accuracy on the medium level, which is substantially above the 20% guessing baseline and also above several other models; the paper provides no human accuracy on the full five-option task, so 'cannot handle' is not tied to a meaningful reference point. The statement may be intended to mean 'well below a human-level ceiling,' but that ceiling is not measured. I recommend either measuring human accuracy on the full MCQ (including Ans3) or qualifying the claim to say that most models perform well below the levels they achieve on the easy tier, with specific thresholds for what 'cannot handle' means.
  4. [Section 4.2.1 and Appendix F (hard-level setup)] The interpretation that the hard-level accuracy drop constitutes 'hidden toxicity' assumes that many-shot jailbreaking activates latent toxic associations rather than teaching the model to imitate the pattern of the provided demonstrations, or causing a more general degradation of instruction-following. The paper does not provide a control condition, such as injecting neutral or non-toxic demonstrations of the same length and format, or scrambled toxic demonstrations. Given that the same long-context manipulation causes LLaVA-1.5 and LLaVA-NeXT to stop producing answers altogether (Section G.1), the accuracy drop in other models could be partly attributable to context-length effects or output-format drift rather than specifically to toxicity. A control with non-toxic few-shot demonstrations, and an analysis of whether the selected answers preserve the syntactic or lexical pattern of the demonstrations, would substantially strengthen the claim.
minor comments (6)
  1. [Section 3.3 title] The subsection title reads 'Multi-satge Human-in-loop In-context Generation'; 'satge' should be 'stage.'
  2. [Section 8 (Limitations)] The fourth limitation uses 'Forth' where 'Fourth' is intended.
  3. [Figure 8] The example question contains a typo: 'Are thses people in the picture...' should be 'Are these people...'.
  4. [Appendix A] The text references 'Figure 14' and 'Figure 1(c)' for examples of dual-implicit toxicity, but Figure 14 is not defined in the main text and the numbering is easy to confuse with the human-evaluation figures in Appendix H. Please renumber or label the figures more distinctly.
  5. [Table 3 and Table 4] The tables do not state the number of repeated runs or the random seed used; the sentence in Section 4.1.1 about conducting 'multiple tests' should be made concrete by reporting the number of runs and the standard deviation in the tables.
  6. [Appendix C.1] The paper uses the terms 'cheating word' and 'confusing sentence' without formal definitions; consider more neutral technical terms, such as 'surface-form distractor' and 'mid-sentence toxic distractor,' to make the construction rules reproducible.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the paper's conclusions are empirical measurements from an explicitly defined benchmark, not derivations from their own inputs; the HT metric is an operational definition, and the self-citations are not load-bearing.

full rationale

MDIT-Bench is a benchmark construction paper rather than a claimed first-principles derivation. The central findings (low accuracy on dual-implicit toxicity, accuracy drops under long-context jailbreaking) are measured outcomes of an independently constructed dataset with external anchors such as MMHS150K, CV ALUES, and human evaluation, so they are not equivalent to the paper's inputs by construction. The Hidden Toxicity metric (Eq. 1) is explicitly defined as the relative accuracy drop between hard and medium levels; reporting that models 'contain hidden toxicity' when that metric is high is a transparent operationalization rather than a circular derivation, though the latent-toxicity interpretation is a construct-validity assumption. The human evaluation (Section 4.3) validates a binary toxic/non-toxic subset and does not fully control for the Ans3 length/incoherence artifact, but this is a measurement-validity concern, not a circularity of the derivation. The only self-citation (Qi et al., 2023, used to justify replacing words in options) is minor and not load-bearing for the main claims. Overall, the paper is self-contained against external benchmarks and its reported numbers are not fitted parameters renamed as predictions; no step reduces to its own input or to a self-citation chain.

Assumptions & free parameters 2 free parameters · 4 assumptions · 1 invented entities

The central results rest on the benchmark's validity, which is supported mainly by the construction process and a small human evaluation, and on the interpretation of the accuracy drop in the hard level as 'hidden toxicity'.

free parameters (2)
  • HT normalization weights = 1/log2(i) for i=32,64,128, normalized
    The Hidden Toxicity Metric weights shot counts by 1/log2(i); this choice is not derived from theory but affects HT values.
  • Shot counts N = 32, 64, 128
    The number of demonstrations in the hard level is chosen arbitrarily (powers of two), affecting the measured accuracy drops.
assumptions (4)
  • domain assumption Human evaluation in Stage 2 validates that MDIT-Bench questions contain toxicity detectable by humans, on a 2300-question subset.
    The benchmark's validity rests on this human check; the subset is small and the evaluation is not exhaustive.
  • domain assumption The five-option multiple-choice format measures toxicity sensitivity rather than other capabilities.
    Options like Ans3 are concatenations that may introduce length or coherence artifacts, so the format's validity is assumed.
  • domain assumption Images crawled from the internet are correctly matched to the intended replaced words.
    Mismatched or irrelevant images would break the dual-implicit property; only manual filtering is described.
  • ad hoc to paper Many-shot jailbreaking activates latent toxicity rather than teaching the model to imitate the displayed toxic answers.
    The hard level adds toxic demonstrations from the same distribution; no control for pure in-context imitation is described.
invented entities (1)
  • Hidden toxicity
    purpose: To explain the accuracy drop under long-context jailbreaking as evidence of latent toxic associations in model parameters
    The paper provides no evidence outside the benchmark's own measurements that this drop corresponds to latent toxicity rather than in-context learning; it is an interpretation of the HT metric.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MDIT-Bench: Evaluating the Dual-Implicit Toxicity in Large Multimodal Models." pith.science (2026). https://pith.science/paper/ROFFQYZD

@misc{pith2026250517144,
  author       = {Pith},
  title        = {Pith review of: MDIT-Bench: Evaluating the Dual-Implicit Toxicity in Large Multimodal Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ROFFQYZD}},
  note         = {Machine review of arXiv:2505.17144}
}
read the original abstract

The widespread use of Large Multimodal Models (LMMs) has raised concerns about model toxicity. However, current research mainly focuses on explicit toxicity, with less attention to some more implicit toxicity regarding prejudice and discrimination. To address this limitation, we introduce a subtler type of toxicity named dual-implicit toxicity and a novel toxicity benchmark termed MDIT-Bench: Multimodal Dual-Implicit Toxicity Benchmark. Specifically, we first create the MDIT-Dataset with dual-implicit toxicity using the proposed Multi-stage Human-in-loop In-context Generation method. Based on this dataset, we construct the MDIT-Bench, a benchmark for evaluating the sensitivity of models to dual-implicit toxicity, with 317,638 questions covering 12 categories, 23 subcategories, and 780 topics. MDIT-Bench includes three difficulty levels, and we propose a metric to measure the toxicity gap exhibited by the model across them. In the experiment, we conducted MDIT-Bench on 13 prominent LMMs, and the results show that these LMMs cannot handle dual-implicit toxicity effectively. The model's performance drops significantly in hard level, revealing that these LMMs still contain a significant amount of hidden but activatable toxicity. Data are available at https://github.com/nuo1nuo/MDIT-Bench.

Figures

Figures reproduced from arXiv: 2505.17144 by the authors.

Figure 1
Figure 1. Three types of toxicity: (a) Explicit toxic [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Toxicity categories of MDIT-Dataset. MDIT [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. MDIT-Benchmark Construction Process: (1) [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (10 more)
Figure 5
Figure 5. Figure 5: The accuracy of each category at medium level. The detection difficulty across different categories varies and certain categories require further attention. to their toxicity being manifested early, as reflected in their low accuracy at the medium level. Notably, the h…
Figure 6
Figure 6. Figure 6: The proportion of toxic options selections in [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 8
Figure 8. Figure 8: An example of the MDIT-Bench’s answers. The correct option is Ans1. [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: The accuracy of the tested models on each [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]
Figure 11
Figure 11. Figure 11: A bad case where no options are output after the inference process. To ensure fairness among the models [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]
Figure 12
Figure 12. Figure 12: A case of the easy level of MDIT-Bench (other outputs hidden). This easy level questions in MDIT-Bench [PITH_FULL_IMAGE:figures/full_fig_p020_12.png]
Figure 13
Figure 13. Figure 13: An example of human evaluation stage 1. The evaluators are asked to check whether Ans1 is truly non-toxic and whether Ans2 is truly toxic. What You Need to Know: 1. This benchmark is a toxic benchmark, which is used to evaluate the toxicity of Large Multimodal Models …
Figure 14
Figure 14. Figure 14: An example of human evaluation stage 2. The evaluators are asked to select the toxic option [PITH_FULL_IMAGE:figures/full_fig_p020_14.png]
Figure 15
Figure 15. Figure 15: A case of medium level of MDIT-Bench (other outputs hidden). This easy level questions in MDIT [PITH_FULL_IMAGE:figures/full_fig_p021_15.png]
Figure 16
Figure 16. Figure 16: A case of hard level of MDIT-Bench (other outputs hidden). Unlike Figures [PITH_FULL_IMAGE:figures/full_fig_p022_16.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

51 extracted references · 17 canonical work pages

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Marah Abdin, Jyoti Aneja, Hany Awadalla, Ahmed Awadallah, Ammar Ahmad Awan, et al. 2024. https://arxiv.org/abs/2404.14219 Phi-3 technical report: A highly capable language model locally on your phone . Preprint, arXiv:2404.14219

    arXiv 2024

  4. [4]

    Andrew Altman. 2020. https://plato.stanford.edu/archives/sum2020/entries/discrimination/ Discrimination . In Edward N. Zalta, editor, The Stanford Encyclopedia of Philosophy , S ummer 2020 edition. Metaphysics Research Lab, Stanford University

    work page 2020

  5. [5]

    Cem Anil, Esin DURMUS, Nina Rimsky, Mrinank Sharma, Joe Benton, et al. 2024. https://openreview.net/forum?id=cw5mgd71jW Many-shot jailbreaking . In The Thirty-eighth Annual Conference on Neural Information Processing Systems

    work page 2024

  6. [6]

    Anthropic. 2024. https://www-cdn.anthropic.com/fed9cc193a14b84131812372d8d5857f8f304c52/Model_Card_Claude_3_Addendum.pdf Claude 3.5 sonnet model card addendum

    2024

  7. [7]

    Bethlehem

    Douglas W. Bethlehem. 2015. https://www.taylorfrancis.com/books/mono/10.4324/9781315730318/social-psychology-prejudice-douglas-bethlehem A Social Psychology of Prejudice . Psychology Press

    work page doi:10.4324/9781315730318/social-psychology-prejudice-douglas-bethlehem 2015

  8. [8]

    Jun Chen, Deyao Zhu, Xiaoqian Shen, Xiang Li, Zechun Liu, et al. 2023. https://arxiv.org/abs/2310.09478 Minigpt-v2: large language model as a unified interface for vision-language multi-task learning . Preprint, arXiv:2310.09478

    arXiv 2023

Show all 51 references
  1. [9]

    William T. L. Cox, Lyn Y. Abramson, Patricia G. Devine, and Steven D. Hollon. 2012. https://doi.org/10.1177/1745691612455204 Stereotypes, prejudice, and depression: The integrated perspective . Perspectives on Psychological Science, 7(5):427--449. PMID: 26168502

    2012 doi

  2. [10]

    Wenliang Dai, Junnan Li, Dongxu Li, Anthony Meng Huat Tiong, Junqi Zhao, Weisheng Wang, Boyang Li, Pascale Fung, and Steven Hoi. 2023. https://arxiv.org/abs/2305.06500 Instructblip: Towards general-purpose vision-language models with instruction tuning . Preprint, arXiv:2305.06500

    2023 arXiv

  3. [11]

    Mai ElSherief, Caleb Ziems, David Muchlinski, Vaishnavi Anupindi, Jordyn Seybolt, Munmun De Choudhury, and Diyi Yang. 2021. https://doi.org/10.18653/v1/2021.emnlp-main.29 Latent hatred: A benchmark for understanding implicit hate speech . In Proceedings of the 2021 Conference ...

    2021 doi

  4. [12]

    Erasmus+ . 2019. https://ec.europa.eu/programmes/erasmus-plus/project-result-content/ad0ee025-12aa-4c1e-8dab-dcd48baffed7/Brochure_-_Slovakia__Portugal__Italy.pdf Discrimination, prejudices and stereotypes

    2019

  5. [13]

    Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. 2020. https://arxiv.org/abs/2009.11462 Realtoxicityprompts: Evaluating neural toxic degeneration in language models . Preprint, arXiv:2009.11462

    2020 arXiv

  6. [14]

    Raul Gomez, Jaume Gibert, Lluis Gomez, and Dimosthenis Karatzas. 2020. https://doi.org/10.1109/wacv45572.2020.9093414 Exploring hate speech detection in multimodal publications . In 2020 IEEE Winter Conference on Applications of Computer Vision (WACV)

    2020

  7. [15]

    Tianle Gu, Zeyang Zhou, Kexin Huang, Liang Dandan, Yixu Wang, Haiquan Zhao, Yuanqi Yao, xingge qiao, Keqing wang, Yujiu Yang, Yan Teng, Yu Qiao, and Yingchun Wang. 2024. https://openreview.net/forum?id=k4tuZmvSnl MLLMG uard: A multi-dimensional safety evaluation suite for mult...

    2024

  8. [16]

    Wenyi Hong, Weihan Wang, Ming Ding, Wenmeng Yu, Qingsong Lv, et al. 2024. https://arxiv.org/abs/2408.16500 Cogvlm2: Visual language models for image and video understanding . Preprint, arXiv:2408.16500

    2024 arXiv

  9. [17]

    Yue Huang, Lichao Sun, Haoran Wang, Siyuan Wu, Qihui Zhang, et al. 2024. https://proceedings.mlr.press/v235/huang24x.html Position: T rust LLM : Trustworthiness in large language models . In Proceedings of the 41st International Conference on Machine Learning, volume 235 of Pr...

    2024

  10. [18]

    Jigsaw . 2024 . https://perspectiveapi.com/ Perspective API . [Online]

    2024

  11. [19]

    Keita Kurita, Anna Belova, and Antonios Anastasopoulos. 2019. https://arxiv.org/abs/1912.06872 Towards robust toxic content classification . Preprint, arXiv:1912.06872

    2019 arXiv

  12. [20]

    Jens Lemmens, Ilia Markov, and Walter Daelemans. 2021. https://doi.org/10.18653/v1/2021.nlp4if-1.2 Improving hate speech type and target detection with hateful metaphor features . In Proceedings of the Fourth Workshop on NLP for Internet Freedom: Censorship, Disinformation, an...

    2021 doi

  13. [21]

    Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. 2023. https://proceedings.mlr.press/v202/li23q/li23q.pdf Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models . In International conference on machine learning, pages 19730...

    2023

  14. [22]

    Lijun Li, Bowen Dong, Ruohui Wang, Xuhao Hu, Wangmeng Zuo, Dahua Lin, Yu Qiao, and Jing Shao. 2024. https://doi.org/10.18653/v1/2024.findings-acl.235 SALAD -bench: A hierarchical and comprehensive safety benchmark for large language models . In Findings of the Association for ...

    2024 doi

  15. [23]

    Hongzhan Lin, Ziyang Luo, bo Wang, Ruichao Yang, and Jing Ma. 2024. https://arxiv.org/pdf/2401.01523 Goat-bench: Safety insights to large multimodal models through meme-based social abuse . arXiv preprint arXiv:2401.01523

    2024 arXiv

  16. [24]

    Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. 2024 a . https://openaccess.thecvf.com/content/CVPR2024/papers/Liu_Improved_Baselines_with_Visual_Instruction_Tuning_CVPR_2024_paper.pdf Improved baselines with visual instruction tuning . In Proceedings of the IEEE/CVF Co...

    2024

  17. [25]

    Haotian Liu, Chunyuan Li, Yuheng Li, Bo Li, Yuanhan Zhang, Sheng Shen, and Yong Jae Lee. 2024 b . https://llava-vl.github.io/blog/2024-01-30-llava-next/ Llava-next: Improved reasoning, ocr, and world knowledge

    2024

  18. [26]

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. https://openreview.net/forum?id=w0H2xGHlkw Visual instruction tuning . In Thirty-seventh Conference on Neural Information Processing Systems

    2023

  19. [27]

    Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2025. Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. In Computer Vision -- ECCV 2024, pages 386--403, Cham. Springer Nature Switzerland

    2025

  20. [28]

    Xin Liu, Yichen Zhu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024 c . https://doi.org/10.24963/ijcai.2024/901 Safety of multimodal large language models on images and text . In Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence, IJCAI-24 , pa...

    2024 doi

  21. [29]

    Rijul Magu and Jiebo Luo. 2018. https://doi.org/10.18653/v1/w18-5112 Determining code words in euphemistic hate speech using word embedding networks . In Proceedings of the 2nd Workshop on Abusive Language Online (ALW2)

    2018 doi

  22. [30]

    Nicol \'a s Benjam \' n Ocampo, Ekaterina Sviridova, Elena Cabrio, and Serena Villata. 2023. https://doi.org/10.18653/v1/2023.eacl-main.147 An in-depth analysis of implicit and subtle hate speech messages . In Proceedings of the 17th Conference of the European Chapter of the A...

    2023 doi

  23. [31]

    OpenAI. 2024 a . https://openai.com/index/gpt-4o-mini-advancing-cost-efficient-intelligence/ Gpt-4o mini (version july 18, 2024)

    2024

  24. [32]

    OpenAI. 2024 b . https://arxiv.org/abs/2410.21276 Gpt-4o system card . Preprint, arXiv:2410.21276

    2024 arXiv

  25. [33]

    John Pavlopoulos, Jeffrey Sorensen, Lucas Dixon, Nithum Thain, and Ion Androutsopoulos. 2020. https://arxiv.org/abs/2006.00998 Toxicity detection: Does context really matter? Preprint, arXiv:2006.00998

    2020 arXiv

  26. [34]

    Shuhan Qi, Zhengying Cao, Jun Rao, Lei Wang, Jing Xiao, and Xuan Wang. 2023. https://doi.org/10.1016/j.ipm.2023.103510 What is the limitation of multimodal llms? a deeper look into multimodal llms through prompt probing . Information Processing & Management, 60(6):103510

    2023

  27. [35]

    Organizers Of Queerinai, Anaelia Ovalle, Arjun Subramonian, Ashwin Singh, Claas Voelcker, et al. 2023. https://doi.org/10.1145/3593013.3594134 Queer in ai: A case study in community-led participatory ai . In Proceedings of the 2023 ACM Conference on Fairness, Accountability, a...

    2023

  28. [36]

    Jun Rao, Liang Ding, Shuhan Qi, Meng Fang, Yang Liu, Li Shen, and Dacheng Tao. 2023 a . https://doi.org/10.1109/TMM.2023.3236837 Dynamic contrastive distillation for image-text retrieval . IEEE Transactions on Multimedia, pages 1--13

    2023

  29. [37]

    Jun Rao, Xuebo Liu, Lian Lian, Shengjun Cheng, Yunjie Liao, and Min Zhang. 2024. https://doi.org/10.18653/v1/2024.emnlp-main.561 C ommon IT : Commonality-aware instruction tuning for large language models via data partitions . In EMNLP, pages 10064--10083, Miami, Florida, USA....

    2024 doi

  30. [38]

    Jun Rao, Xv Meng, Liang Ding, Shuhan Qi, and Dacheng Tao. 2023 b . https://ieeexplore.ieee.org/document/10272648/ Parameter-efficient and student-friendly knowledge distillation . IEEE Transactions on Multimedia

    2023

  31. [39]

    Jun Rao, Fei Wang, Liang Ding, Shuhan Qi, Yibing Zhan, Weifeng Liu, and Dacheng Tao. 2022. https://arxiv.org/abs/2203.03853 Where does the performance improvement come from - a reproducibility concern about image-text retrieval . In SIGIR

    2022 arXiv

  32. [40]

    Kunsheng Tang, Wenbo Zhou, Jie Zhang, Aishan Liu, Gelei Deng, Shuai Li, Peigui Qi, Weiming Zhang, Tianwei Zhang, and Nenghai Yu. 2024. https://arxiv.org/abs/2408.12494 Gendercare: A comprehensive framework for assessing and reducing gender bias in large language models . Prepr...

    2024 arXiv

  33. [41]

    Gemini Team. 2024. https://arxiv.org/abs/2403.05530 Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context . Preprint, arXiv:2403.05530

    2024 arXiv

  34. [42]

    Elliot Turiel. 2007. https://doi.org/10.1177/0165025407083670 Commentary: The problems of prejudice, discrimination, and exclusion . International Journal of Behavioral Development, 31(5):419--422

    2007 doi

  35. [43]

    Peng Wang, Shuai Bai, Sinan Tan, Shijie Wang, Zhihao Fan, et al. 2024 a . https://arxiv.org/abs/2409.12191 Qwen2-vl: Enhancing vision-language model's perception of the world at any resolution . Preprint, arXiv:2409.12191

    2024 arXiv

  36. [44]

    Siyin Wang, Xingsong Ye, Qinyuan Cheng, Junwen Duan, Shimin Li, Jinlan Fu, Xipeng Qiu, and Xuanjing Huang. 2024 b . https://arxiv.org/abs/2406.15279 Cross-modality safety alignment . Preprint, arXiv:2406.15279

    2024 arXiv

  37. [45]

    Xinpeng Wang, Xiaoyuan Yi, Han Jiang, Shanlin Zhou, Zhihua Wei, and Xing Xie. 2023. https://openreview.net/forum?id=mU6C04mAJk Tovilag: Your visual-language generative model is also an evildoer . In The 2023 Conference on Empirical Methods in Natural Language Processing

    2023

  38. [46]

    Jiaxin Wen, Pei Ke, Hao Sun, Zhexin Zhang, Chengfei Li, Jinfeng Bai, and Minlie Huang. 2023. https://doi.org/10.18653/v1/2023.emnlp-main.84 Unveiling the implicit toxicity in large language models . In Proceedings of the 2023 Conference on Empirical Methods in Natural Language...

    2023 doi

  39. [47]

    Guohai Xu, Jiayi Liu, Ming Yan, Haotian Xu, Jinghui Si, et al. 2023. https://arxiv.org/abs/2307.09705 Cvalues: Measuring the values of chinese large language models from safety to responsibility . Preprint, arXiv:2307.09705

    2023 arXiv

  40. [48]

    Zonghao Ying, Aishan Liu, Siyuan Liang, Lei Huang, Jinyang Guo, Wenbo Zhou, Xianglong Liu, and Dacheng Tao. 2024. https://arxiv.org/abs/2410.18927 Safebench: A safety evaluation framework for multimodal large language models . Preprint, arXiv:2410.18927

    2024 arXiv

  41. [49]

    Yongting Zhang, Lu Chen, Guodong Zheng, Yifeng Gao, Rui Zheng, Jinlan Fu, Zhenfei Yin, Senjie Jin, Yu Qiao, Xuanjing Huang, Feng Zhao, Tao Gui, and Jing Shao. 2024 a . https://arxiv.org/abs/2406.12030 Spa-vl: A comprehensive safety preference alignment dataset for vision langu...

    2024 arXiv

  42. [50]

    Zhexin Zhang, Leqi Lei, Lindong Wu, Rui Sun, Yongkang Huang, Chong Long, Xiao Liu, Xuanyu Lei, Jie Tang, and Minlie Huang. 2024 b . https://doi.org/10.18653/v1/2024.acl-long.830 S afety B ench: Evaluating the safety of large language models . In Proceedings of the 62nd Annual ...

    2024 doi

  43. [51]

    Kaiwen Zhou, Chengzhi Liu, Xuandong Zhao, Anderson Compalas, Dawn Song, and Xin Eric Wang. 2024. https://arxiv.org/abs/2410.06172 Multimodal situational safety . Preprint, arXiv:2410.06172

    2024 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.