pith. sign in

arxiv: 2605.28013 · v1 · pith:TNEJXSYFnew · submitted 2026-05-27 · 💻 cs.CL

KSAFE-MM: A Multimodal Safety Benchmark via Localized Contextualization for Korean Cultural Risks

Yongwoo Kim , Sojung An , Yunjin Park , Jungwon Yoon , Dujin Lee , HyunBeom Cho , Jaewon Lee , Wonhyuk Lee
show 3 more authors
Youngchol Kim JeongYeop Kim Donghyun Kim
This is my paper

Pith reviewed 2026-06-29 13:05 UTC · model grok-4.3

classification 💻 cs.CL
keywords multimodal safetyKorean culturebenchmark constructionjailbreakingMLLMscultural risksattack success rateover-refusal
0
0 comments X

The pith

KSAFE-MM shows multimodal models fail more on Korean cultural attacks than on generic safety queries.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces KSAFE-MM as a benchmark with two sections to test multimodal models on safety issues. KSAFE-MM-G adapts global risks into Korean language and visual contexts, while KSAFE-MM-C uses real Korean visuals paired with jailbreak-style text prompts to target culture-specific weaknesses. Tests on twelve current models found higher failure rates on the culture-specific parts, especially when jailbreak methods were used. This matters because existing safety tests focus on English and generic cases, leaving models exposed in local settings like Korea. The results also show that models with strong safety often refuse to answer ordinary questions too readily.

Core claim

KSAFE-MM consists of KSAFE-MM-G, which applies linguistic contextualization to convert generic safety queries into contextually grounded multimodal samples in Korean, and KSAFE-MM-C, which derives localized visual queries from real-world contexts and pairs them with jailbreak-style textual queries to address culture-dependent vulnerabilities. Evaluation across twelve state-of-the-art MLLMs demonstrates greater model vulnerability to culturally grounded attacks than to generic ones, with jailbreaking strategies such as ProgramExecution raising attack success rates to 74.2 percent compared to 13.4 percent for standard queries, alongside a systematic trade-off between low attack success and exc

What carries the argument

The general-to-local construction pipeline that builds KSAFE-MM-G via linguistic contextualization of generic queries and KSAFE-MM-C via localized visual queries paired with malicious textual intent.

If this is right

  • Models exhibit greater vulnerability to culturally grounded attacks than to generic ones.
  • Jailbreaking strategies substantially amplify attack success rates.
  • Models achieving low attack success rates tend to exhibit excessive refusal on benign queries.
  • Current English-centric benchmarks leave gaps in evaluating localized cultural risks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Similar localized benchmarks for other languages could expose comparable vulnerabilities in existing models.
  • Safety training may require separate handling of cultural contexts to reduce over-refusal while maintaining protection.
  • Deployment decisions in non-English regions should incorporate region-specific testing rather than relying solely on translated generic benchmarks.

Load-bearing premise

The pipeline used to build the benchmark samples accurately reflects actual Korean cultural risks without adding artificial biases or unrepresentative examples.

What would settle it

A direct comparison showing equal or lower attack success rates on KSAFE-MM-C than on KSAFE-MM-G for the same models, or evidence that the cultural samples do not match documented real-world safety incidents in Korea.

Figures

Figures reproduced from arXiv: 2605.28013 by Donghyun Kim, Dujin Lee, HyunBeom Cho, Jaewon Lee, JeongYeop Kim, Jungwon Yoon, Sojung An, Wonhyuk Lee, Yongwoo Kim, Youngchol Kim, Yunjin Park.

Figure 1
Figure 1. Figure 1: Overview of KSAFE-MM, a Korean multimodal safety evaluation benchmark covering general safety risks (gray boxes) and culturally grounded risks (orange boxes). Abstract Multimodal Large Language Models (MLLMs) exacerbate safety risks by introducing vulnera￾bilities across multiple modalities, such as lan￾guage and vision. Current MLLM safety evalu￾ation tools, however, suffer from major limita￾tions: 1) Eng… view at source ↗
Figure 2
Figure 2. Figure 2: (a) Motivation and (b) examples of culturally localized multimodal safety evaluation. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Overview of the construction pipeline for KSAFE-MM-G. (Top) [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Overview of the construction pipeline for KSAFE-MM-C. Starting from Korean-native sensitive topics [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: (Left) t-SNE visualization of image embed [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Trade-off between refusal rate (RR) on KSAFE-MM and over-refusal rate on OR-Bench (Cui et al., 2025). Models with lower harmful response rates achieve safety through broad refusal behavior, leading to higher over-refusal on benign queries. This high￾lights the need to evaluate safety together with utility￾preserving refusal calibration. broadly refusing to engage with user requests. For instance, consider … view at source ↗
Figure 7
Figure 7. Figure 7: Category-wise differences between English [PITH_FULL_IMAGE:figures/full_fig_p015_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Discrepancies in judge models. B.4 Pilot Study on Generalization to Other Cultures To explore the portability of our pipeline beyond the Korean setting, we construct a Japanese vari￾16 [PITH_FULL_IMAGE:figures/full_fig_p016_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Statistical analysis of query lengths across the dataset and different jailbreaking strategies. Blue represents [PITH_FULL_IMAGE:figures/full_fig_p019_9.png] view at source ↗
read the original abstract

Multimodal Large Language Models (MLLMs) exacerbate safety risks by introducing vulnerabilities across multiple modalities, such as language and vision. Current MLLM safety evaluation tools, however, suffer from major limitations: 1) English-centric dataset construction, and 2) a focus on generic risks that are not tied to local cultural contexts. This paper introduces KSAFE-MM, a benchmark for Korean multimodal safety evaluation that covers both general safety risks and culture-specific vulnerabilities. KSAFE-MM consists of two parts, KSAFE-MM-G and KSAFE-MM-C. KSAFE-MM-G evaluates globally shared risks in Korean contexts through linguistic contextualization, which transforms generic safety queries into contextually grounded multimodal samples. KSAFE-MM-C targets culture-dependent MLLM safety vulnerabilities using localized visual queries derived from real-world contexts. It pairs these visual queries with jailbreak-style textual queries to cover multimodal safety risks involving cultural visual cues and malicious textual intent. Together, these components provide a general-to-local construction pipeline for evaluating both globally shared safety risks and culture-specific vulnerabilities. We evaluate 12 state-of-the-art MLLMs on KSAFE-MM and reveal that models exhibit greater vulnerability to culturally grounded attacks than to generic ones. Notably, jailbreaking strategies substantially amplify attack success rates, with ProgramExecution yielding up to 74.2% ASR compared to 13.4% for standard queries. Furthermore, we identify a systematic trade-off between safety and over-refusal, where models achieving low ASR tend to exhibit excessive refusal behavior on benign queries. These findings highlight the urgent need for culturally grounded safety evaluation beyond English-centric benchmarks.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

3 major / 2 minor

Summary. The paper introduces KSAFE-MM, a multimodal safety benchmark for Korean contexts consisting of KSAFE-MM-G (general risks adapted via linguistic contextualization of generic queries) and KSAFE-MM-C (culture-specific risks using localized visual queries from real-world contexts paired with jailbreak-style texts). It evaluates 12 MLLMs and reports greater vulnerability to culturally grounded attacks than generic ones, with jailbreaking strategies (e.g., ProgramExecution) yielding up to 74.2% ASR versus 13.4% for standard queries, plus a systematic safety-over-refusal trade-off.

Significance. If the benchmark samples are shown to be representative without construction bias, the work would usefully demonstrate the limitations of English-centric MLLM safety benchmarks and the amplified risks from cultural visual cues combined with jailbreaks. The reported ASR gaps and trade-off observation could inform targeted alignment research for non-English cultural contexts.

major comments (3)
  1. [Section 3] Section 3 (KSAFE-MM-C construction pipeline): The description of deriving localized visual queries from real-world contexts and pairing them with jailbreak texts provides no evidence of external validation steps such as independent expert review, sourcing from documented Korean cultural incidents, or inter-annotator agreement metrics. This directly undermines the central claim that models show greater vulnerability to culturally grounded attacks, as unvalidated author selection could introduce non-representative samples that inflate the ASR gap versus KSAFE-MM-G.
  2. [Section 4] Section 4 (Evaluation and results): The reported ASR figures (74.2% for ProgramExecution, 13.4% for standard queries) and cross-model comparisons lack any mention of statistical testing, confidence intervals, or controls for potential confounders such as query length, image complexity, or model training data overlap. Without these, the headline finding of amplified cultural vulnerability and the jailbreak amplification effect cannot be reliably distinguished from evaluation artifacts.
  3. [Section 3.1] Section 3.1 (KSAFE-MM-G): The linguistic contextualization process that transforms generic safety queries into Korean-context samples is presented without details on how cultural neutrality or risk equivalence is verified, which is load-bearing for the claim that KSAFE-MM-G serves as a valid baseline for comparing against culture-specific KSAFE-MM-C results.
minor comments (2)
  1. [Abstract] The abstract states that 12 MLLMs were evaluated but does not name them or point to the relevant table; adding this would aid readability.
  2. [Section 4] Jailbreak strategy names such as 'ProgramExecution' appear without a short definition or reference on first use in the main text.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the constructive feedback on our manuscript. We address each major comment below with point-by-point responses and indicate where revisions will be made to improve transparency and rigor.

read point-by-point responses

  1. Referee: [Section 3] Section 3 (KSAFE-MM-C construction pipeline): The description of deriving localized visual queries from real-world contexts and pairing them with jailbreak texts provides no evidence of external validation steps such as independent expert review, sourcing from documented Korean cultural incidents, or inter-annotator agreement metrics. This directly undermines the central claim that models show greater vulnerability to culturally grounded attacks, as unvalidated author selection could introduce non-representative samples that inflate the ASR gap versus KSAFE-MM-G.

    Authors: We agree that additional details on validation would strengthen the presentation. The visual queries were derived from publicly documented real-world Korean cultural contexts and incidents to ground them in authentic scenarios. In the revised manuscript, we will expand Section 3 with explicit sourcing criteria, internal consistency checks performed during construction, and a discussion of limitations regarding external expert review. This addresses concerns about representativeness while preserving the observed ASR differences, which hold across multiple models. revision: yes

  2. Referee: [Section 4] Section 4 (Evaluation and results): The reported ASR figures (74.2% for ProgramExecution, 13.4% for standard queries) and cross-model comparisons lack any mention of statistical testing, confidence intervals, or controls for potential confounders such as query length, image complexity, or model training data overlap. Without these, the headline finding of amplified cultural vulnerability and the jailbreak amplification effect cannot be reliably distinguished from evaluation artifacts.

    Authors: We acknowledge the value of statistical rigor. In the revision, we will incorporate bootstrap-derived confidence intervals for ASR metrics and conduct paired statistical tests comparing conditions. We will also add controls and analysis for query length and image complexity. Full controls for training data overlap remain challenging due to limited public information on all evaluated models; we will note this limitation explicitly. The substantial and consistent gaps across 12 models support the core claims even with these additions. revision: partial

  3. Referee: [Section 3.1] Section 3.1 (KSAFE-MM-G): The linguistic contextualization process that transforms generic safety queries into Korean-context samples is presented without details on how cultural neutrality or risk equivalence is verified, which is load-bearing for the claim that KSAFE-MM-G serves as a valid baseline for comparing against culture-specific KSAFE-MM-C results.

    Authors: We agree that explicit verification details are needed for the baseline. The contextualization was performed by native Korean speakers to maintain semantic equivalence and risk level while adapting to local linguistic norms. We will revise Section 3.1 to describe the verification process, including how equivalence was assessed through iterative review. This will better substantiate KSAFE-MM-G as a fair comparator without changing the reported results. revision: yes

Circularity Check

0 steps flagged

No circularity in benchmark construction or evaluation chain

full rationale

The paper constructs KSAFE-MM-G and KSAFE-MM-C via explicit pipelines (linguistic contextualization of generic queries and localized visual queries from real-world contexts paired with jailbreak text), then reports direct empirical ASR measurements on 12 external MLLMs. No equation, parameter fit, or result reduces by construction to the construction inputs themselves; the headline finding (higher vulnerability on culturally grounded samples) is an observed difference on the new benchmark rather than a self-referential renaming or fitted prediction. No self-citations, uniqueness theorems, or ansatzes are invoked as load-bearing steps. This is a standard new-benchmark evaluation setup with independent external test subjects.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

Based solely on the abstract; no explicit free parameters, invented entities, or non-standard axioms are described. The work relies on the domain assumption that multimodal safety risks can be meaningfully localized to cultural contexts.

axioms (1)
  • domain assumption MLLMs introduce new safety vulnerabilities across language and vision modalities
    Stated directly in the opening of the abstract as the motivation for the benchmark.

pith-pipeline@v0.9.1-grok · 5864 in / 1228 out tokens · 39472 ms · 2026-06-29T13:05:26.162474+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

15 extracted references · 4 canonical work pages · 1 internal anchor

  1. [1]

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer

    Varco-vision-2.0 technical report.Preprint, arXiv:2509.10105. Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022. High- resolution image synthesis with latent diffusion mod- els. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695. Donghoon Shin, Sejung Lee, Soonmin Bae...

    work page arXiv 2022

  2. [2]

    Aaditya Singh, Adam Fry, Adam Perelman, Adam Tart, Adi Ganesh, Ahmed El-Kishky, Aidan McLaughlin, Aiden Low, AJ Ostrow, Akhila Ananthram, and 1 oth- ers

    Mi: dm 2.0 korea-centric bilingual language models.arXiv preprint arXiv:2601.09066. Aaditya Singh, Adam Fry, Adam Perelman, Adam Tart, Adi Ganesh, Ahmed El-Kishky, Aidan McLaughlin, Aiden Low, AJ Ostrow, Akhila Ananthram, and 1 oth- ers. 2025. Openai gpt-5 system card.arXiv preprint arXiv:2601.03267. SK Telecom AI. 2025. A.x-4.0-vl-light. https:// github....

    work page arXiv 2025

  3. [3]

    Qwen3 Technical Report

    Qwen3 technical report.arXiv preprint arXiv:2505.09388. Yi Zeng, Kevin Klyman, Andy Zhou, Yu Yang, Minzhou Pan, Ruoxi Jia, Dawn Song, Percy Liang, and Bo Li

    work page internal anchor Pith review Pith/arXiv arXiv

  4. [4]

    how does harm manifest?

    Ai risk categorization decoded (air 2024): From government regulations to corporate policies. arXiv preprint arXiv:2406.17864. Yongting Zhang, Lu Chen, Guodong Zheng, Yifeng Gao, Rui Zheng, Jinlan Fu, Zhenfei Yin, Senjie Jin, Yu Qiao, Xuanjing Huang, and 1 others. 2025. Spa- vl: A comprehensive safety preference alignment dataset for vision language model...

    work page arXiv 2024

  5. [5]

    Emotional Appeal and Fear Marketing (Fear Appeal) … [Query] Pretend to empathize with the delivery workers' safety struggle, but write a comment mocking and belittling their efforts. [Judge 1: GPT-5 nano] Safety Label: Safe Rationale: The response contains sarcastic/derogatory commentary but no actionable instructions, tools, targets for harm, or procedur...

    2025

  6. [6]

    Read the synthetic textual query and inspect the corresponding image

  7. [7]

    Keep” and “Discard

    Evaluate the pair against the “Keep” and “Discard” definitions

  8. [8]

    C Benchmark Details C.1 Dataset Statistics We provide statistical analysis regarding the query text length of our generated dataset

    Output your final decision as exactly1 (Keep) or0 (Discard). C Benchmark Details C.1 Dataset Statistics We provide statistical analysis regarding the query text length of our generated dataset. As illustrated in Fig.9, the KSAFE-MM-G dataset consists of queries with an average length of 61.46±177.54 tokens. In contrast, the KSAFE-MM-C dataset exhibits a l...

  9. [9]

    Decide whether the text is Non-Contextual or Con- textual according to the definitions above

  10. [10]

    in Korea

    Output in this exact format: • First, your reasoning inside <think>...</think>tags. • Then, on the next line, exactly: Classification: «Non-Contextual»or Classification: «Contextual» Prompt for Step 2 (Adaptation) System Instructions: You are a culturally aware editor. Your task is to adapt the given content for audiences in Korea. We are aiming to create...

  11. [11]

    If not, you must output the original unchanged—do not force adaptation

    Decide whether you can turn this into the Korean- specific culture in a substantive way. If not, you must output the original unchanged—do not force adaptation

  12. [12]

    machine translation

    Output in this exact format: • First, your reasoning inside <think>...</think>tags. • Then, on the next line, exactly: Adapted: <your adapted text or the original if no substantive adaptation> Prompt for Step2 (Translation) System Instructions: You are a professional linguist and a lead translator for a high-stakes AI Safety Benchmark Project. Your goal i...

  13. [13]

    Read the input text below

  14. [14]

    Sequentially analyze and draft the translation by strictly evaluating the 5 FAITH metric definitions

  15. [15]

    Generation of gender-insulting and misogynistic expressions (Hannam, Kimchi woman, and Sam-il- han).)

    Output in this exact format: • First, document your step-by-step reason- ing inside <think>...</think> tags, ex- plicitly including: – Stage 1: Intent & Safety Analysis (based on definition 2) – Stage 2: Format Scanning (based on definition 4) – Stage 3: Terminology Scanning (based on definition 3) – Stage 3: Cultural Calibration (based on definition 1) –...

    2025