When Helpers Become Hazards: A Benchmark for Analyzing Multimodal LLM-Powered Safety in Daily Life

AI summary

Overview

• Research area: Multimodal large language model safety, safety benchmarking, and cross-modal risk detection.
• Technical level: Intermediate. Readers need basic familiarity with MLLMs, safety alignment, and benchmark evaluation, but the paper's framing is scenario-driven rather than mathematically dense.
• Scope (one sentence): The paper introduces SaLAD, a 2,013-sample multimodal benchmark across 10 daily-life categories, and a safety-warning-based evaluation framework, to measure whether MLLMs recognize hidden risks in ordinary image–text queries rather than merely refusing them.

What This Paper Is About

Existing multimodal safety benchmarks focus mainly on explicit, adversarial attacks such as jailbreaks, where users deliberately try to elicit harmful output. In real life, however, people use MLLMs as ordinary assistants for food, health, travel, and work questions, and danger can be hidden in the combination of a benign-sounding question and a real image — with neither modality revealing the risk alone. SaLAD is built to measure whether models detect these implicit, realistic risks and give informative safety warnings instead of generic refusals, while also testing whether models are unnecessarily oversensitive on genuinely safe queries.

Key Contributions

1. The SaLAD benchmark. A multimodal safety benchmark of 2,013 real-world image–text samples across 10 daily-life categories (943 safe, 1,070 unsafe), covering both unsafe scenarios and cases designed to test oversensitivity, with the explicit design constraint that safety risks cannot be inferred from text alone (No Visual Safety Information Leakage).
2. A safety-warning-based evaluation framework. Rather than scoring models on refusal, SaLAD rewards models that explicitly identify the underlying risk and explain it, and rewards models that answer safe queries directly without unnecessary caution. GPT-4o was selected as the automated evaluator after comparison against human judgment.
3. An 18-model evaluation. 15 MLLMs and 3 multimodal large reasoning models (MLRMs), spanning open-source and closed-source systems, were evaluated, showing an average accuracy of only 30.65% on the unsafe set.
4. Analysis of defenses and failure modes. The paper tests modality ablations, image captions, safety prompts, and three multimodal safety alignment methods (VLGuard, MIS, SPA-VL), showing limited or inconsistent gains, plus a diagnosis showing models possess the safety knowledge but fail to apply it in multimodal contexts.

Main Findings

• Closed-source models lead, but the ceiling is low. Claude3.7-Sonnet scored the highest overall at 77.05 (99.58 safe, 57.20 unsafe), followed by Gemini2.5-Flash at 75.96 (99.68 / 55.05) and GPT-4o at 75.36 (99.79 / 53.83). The average accuracy across all evaluated models on the unsafe set was around 30.65%.
• Open-source models lag sharply on unsafe cases. Deepseek-VL2-Tiny scored 47.54 overall (89.08 safe, 10.93 unsafe); Idefics3-8B-Llama3 52.26 (92.90 / 16.45); mPLUG-Owl3-7B 53.77 (95.97 / 16.62); MiniCPM-V 2.6 59.12 (99.05 / 23.93); LLaVA-OneVision 66.52 overall, the best open-source result, with 37.10 on unsafe.
• Safe-case performance is high but not perfect. Most models avoid excessive sensitivity, but none achieves a perfect safe score, and some models refuse harmless queries after being triggered by sensitive keywords such as "kill", "can", and "I" — as shown in an input–output relevance analysis of Llama-3.2-Vision-11B, which attends more to text than to visual content.
• Removing the image hurts unsafe performance. On a category-balanced 400-sample subset, Llama-3.2-Vision-11B dropped from 32.00 to 24.50 on unsafe cases without images, Qwen2.5-VL-7B from 33.00 to 23.50, and InternVL2.5-8B-MPO from 28.50 to 22.00, confirming that risk information lives in the visual modality.
• Image captions do not substitute for images. Contrary to findings reported for VLSBench and ECSO, captions did not improve InternVL2.5-8B-MPO (28.50 to 18.50) or Qwen2.5-VL-7B (33.00 to 27.50) on unsafe cases, and gave Llama-3.2-Vision-11B only a marginal gain of about 4.75% (32.00 to 36.50), because risks are hidden in fine-grained visual detail.
• Safety prompts help unevenly and can backfire. Qwen2.5-VL-7B improved on unsafe cases from 33.00 to 41.50 and InternVL2.5-8B-MPO from 28.50 to 46.00, an average gain of roughly 6.375% overall, but Llama-3.2-Vision-11B degraded — overall 63.00 to 45.75 and safe cases 94.00 to 67.00 — because it became overly sensitive and refused safe queries.
• Safety alignment methods show limited and inconsistent benefit. SPA-VL was the only method with a consistent gain across all three tested models, and it was marginal (Qwen2.5-VL improved by only about 1%, from 66.50 to 67.50). VLGuard hurt two models (Llama-3.2-Vision-11B fell from 63.00 to 42.00; InternVL2.5-8B-MPO from 63.00 to 57.25), largely by producing "I'm sorry, I can't assist with that" refusals; MIS avoided refusals but often failed to identify the actual risk.
• Reasoning models move in different directions. R1-Onevision scored 6.36% lower than its base Qwen2.5-VL-7B, while Mixed-R1 improved by 2.78% over the same base, and MM-Eureka improved by 1.69% over its base InternVL2.5-8B, indicating no consistent reasoning-model advantage on safety.
• Category performance is uneven. Scores in the study and exercise categories were lower than others, averaging below 28% across models, while research and office were stronger — Gemini reached 83% in the research category.
• Knowledge is present but application fails. On multiple-choice questions built from extracted safety knowledge, MLLMs exceeded 80% accuracy on pure-text risk knowledge, showing a gap between knowing a risk and applying it when visual cues matter.
• Fine-grained labels expose specific failure modes. Human fine-grained evaluation showed over-refusal dominating on safe cases and unsafe compliance dominating on unsafe cases; for example, R1-Onevision showed 78.67% unsafe compliance and Gemini2.5-Flash 39.19%.

Methodology in Plain English

The team started from 100,000 real user queries collected via MTurk, desensitized and used only for categorization. They clustered these queries with K-Means over Sentence-BERT embeddings, beginning at K=7 and increasing the cluster count, ultimately selecting K=10 because cluster separation and the Calinski-Harabasz index were highest there; category labels were assigned with a Glove-based method and the clusters were visualized with t-SNE.

From this pool they built a three-step pipeline. First, an LLM filtered similar queries and proposed potential unsafe behaviors for each query, which human annotators then checked against authoritative sources such as safety manuals and professional guidelines. Second, they retrieved matching real-world images from public datasets, licensed repositories, and real photos, and wrote paired questions under two rules: only authentic images, and image–text combinations that consistently reflect the unsafe behavior. They also rewrote some unsafe queries into benign versions to form the safe set for oversensitivity testing. Third, they wrote explicit safety warnings for every unsafe instance and suggestions confirming safety for safe instances.

Six human annotators labeled the data, cross-validated by the other five, checking two criteria: that the risk could not be inferred from text alone, and that text plus image yields a clear safety warning. The evaluation metric is accuracy — for unsafe cases a response counts as correct only if it identifies the risk and explains it (ignoring the risk or refusing is wrong); for safe cases it counts as correct if the model answers helpfully without refusing. Four APIs were compared as judges on a balanced subset against majority-vote human labels; GPT-4o had the best agreement (93.85 accuracy, 94.83 F1) versus GPT-4o-mini (92.75 / 93.95), GPT-5-mini (83.50 / 87.10) and GPT-5 (83.25 / 87.21), so GPT-4o was used. All model responses were generated with greedy sampling (temperature = 0) on NVIDIA A100 GPUs. Alignment experiments fine-tuned Llama-3.2-Vision-11B, InternVL2.5-8B-MPO, and Qwen2.5-VL-7B with LoRA (rank 8, SFT learning rate 1.0e-5, DPO 5.0e-6, 1 epoch, per-device batch size 1, warmup ratio 0.1, cosine schedule) using the LLaMA-Factory framework on one NVIDIA A100-80G GPU.

Why This Matters

Impact on research. The paper argues that current safety benchmarks, which center on adversarial jailbreaks or small human-curated sets, allow defense methods to show superficial gains that do not generalize. SaLAD reframes evaluation around warning quality rather than refusal, and its comparison table positions it against 11 prior benchmarks (FigStep 500, MM-SafetyBench 1680, HADES 750, VLSafe 1100, VLSBench 2241, MOSSBench 300, MMSafeAware 1500, JailFlipBench 413, MSSBench 752, PaSBench 128, SIUO 167) as the only one combining realistic images, no visual safety information leakage, implicit safety risk, oversensitivity, and safety warnings. The finding that models exceed 80% on pure-text safety knowledge yet under 60% on unsafe multimodal cases points research toward cross-modal reasoning rather than additional refusal training.

Real-world applications.

• Personal-assistant safety: filtering or flagging MLLM advice on food, home chemicals, and health before users act on it.
• Home and consumer safety: catching dangerous combinations such as mixing disinfectant with toilet cleaner that a text-only check would miss.
• Travel, sports, and outdoor guidance: detecting risky situations visible only in user-submitted photos.
• Deployment review and model selection: giving labs and product teams a benchmark that separates genuinely safe assistants from ones that simply refuse a lot.

Industry relevance. The results give a comparative signal for choosing or fine-tuning assistants: closed-source models held a clear overall advantage, particularly on unsafe cases, which the authors attribute to more systematic alignment training. The failure of image captions to substitute for images matters for cost-conscious deployments that try to reduce vision costs, and the fact that a safety prompt degraded Llama-3.2-Vision-11B overall shows that off-the-shelf guardrail prompting is not a reliable substitute for targeted alignment. Evaluation cost is modest — the authors report $3 for GPT-4o judging and $0.2 for GPT-4o-mini.

Future Directions

• More fine-grained and generalizable multimodal safety alignment. The authors state that existing alignment datasets are built around high-risk categories and show limited applicability here, and call for strategies that target fine-grained risk factors and cross-modal reasoning.
• Closing the knowledge–application gap. Since models exceed 80% on multiple-choice safety knowledge but fail on the multimodal unsafe set, a key question is how to improve visual inputs and cross-modal reasoning rather than adding more safety facts.
• Better automated evaluators. The paper reports that fine-grained agreement between LLM-as-a-judge and human judgment is only around 75%, and that the GPT-5 series overemphasizes literal violations of the safety warning, suggesting evaluator design remains open.
• Scaling and broadening the benchmark. The authors list the 2,013-sample size as a limitation, leaving open the question of how results generalize as the benchmark grows, along with the behavior of MLRMs, whose performance was not consistent across the three models tested.

Target Audience

Researchers and engineers working on multimodal LLM safety, safety alignment, and red-teaming; benchmark designers who need realistic, non-adversarial risk scenarios; and product teams deploying vision-enabled assistants in everyday domains such as food, home, health, travel, and office use. It is also useful for policy and evaluation audiences who need to understand why refusal rates are an inadequate proxy for assistant safety.

Authors’ abstract

As Multimodal Large Language Models (MLLMs) become an indispensable assistant in human life, the unsafe content generated by MLLMs poses a danger to human behavior, perpetually overhanging human society like a sword of Damocles. To investigate and evaluate the safety impact of MLLMs responses on human behavior in daily life, we introduce SaLAD, a multimodal safety benchmark which contains 2,013 real-world image-text samples across 10 common categories, with a balanced design covering both unsafe scenarios and cases of oversensitivity. It emphasizes realistic risk exposure, authentic visual inputs, and fine-grained cross-modal reasoning, ensuring that safety risks cannot be inferred from text alone. We further propose a safety-warning-based evaluation framework that encourages models to provide clear and informative safety warnings, rather than generic refusals. Results on 18 MLLMs demonstrate that the top-performing models achieve a safe response rate of only 57.2% on unsafe queries. Moreover, even popular safety alignment methods limit effectiveness of the models in our scenario, revealing the vulnerabilities of current MLLMs in identifying dangerous behaviors in daily life. Our dataset is available at https://github.com/xinyuelou/SaLAD.