mlsanityData to 7 Oct 2026

MSTS: A Multimodal Safety Test Suite for Vision-Language Models

arXiv 2501.10057 ↗First posted 17 Jan 2025cs.CLcited by 9

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

Vision-language models (VLMs), which process image and text inputs, are increasingly integrated into chat assistants and other consumer AI applications. Without proper safeguards, however, VLMs may give harmful advice (e.g. how to self-harm) or encourage unsafe behaviours (e.g. to consume drugs). Despite these clear hazards, little work so far has evaluated VLM safety and the novel risks created by multimodal inputs. To address this gap, we introduce MSTS, a Multimodal Safety Test Suite for VLMs. MSTS comprises 400 test prompts across 40 fine-grained hazard categories. Each test prompt consists of a text and an image that only in combination reveal their full unsafe meaning. With MSTS, we find clear safety issues in several open VLMs. We also find some VLMs to be safe by accident, meaning that they are safe because they fail to understand even simple test prompts. We translate MSTS into ten languages, showing non-English prompts to increase the rate of unsafe model responses. We also show models to be safer when tested with text only rather than multimodal prompts. Finally, we explore the automation of VLM safety assessments, finding even the best safety classifiers to be lacking.

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 15 of its 38 references that are in the map. First posted on arXiv 17 Jan 2025.

Builds on

15 of 38 references.

Closest ancestors · 4

Same direction, newest first

  1. 2024Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversations15 Nov
  2. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models14 Mar
  3. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  4. 2023Can Language Models be Instructed to Protect Personal Information?3 Oct

Other references · 11

  1. 2024Qwen2-VL: Enhancing Vision-Language Model's Perception of the World at Any Resolutioncited by 4,151
  2. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,175
  3. 2024MiniCPM-V: A GPT-4V Level MLLM on Your Phonecited by 1,061
  4. 2024Molmo and PixMo: Open Weights and Open Data for State-of-the-Art Vision-Language Modelscited by 321
  5. 2024InternLM-XComposer-2.5: A Versatile Large Vision Language Model Supporting Long-Contextual Input and Outputcited by 195
  6. 2024Building and better understanding vision-language models: insights and future directionscited by 169
  7. 2024xGen-MM (BLIP-3): A Family of Open Large Multimodal Modelscited by 116
  8. 2024SafetyPrompts: a Systematic Review of Open Datasets for Evaluating and Improving Large Language Model Safetycited by 75
  9. 2024Introducing v0.5 of the AI Safety Benchmark from MLCommonscited by 60
  10. 2024GOAT-Bench: Safety Insights to Large Multimodal Models through Meme-Based Social Abusecited by 50
  11. 2024LlavaGuard: An Open VLM-based Framework for Safeguarding Vision Datasets and Modelscited by 49

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 2; 2026: 7.

9 papers.

  1. 2025VLSU: Mapping the Limits of Joint Multimodal Understanding for AI Safetycited by 7
  2. 2025SafetyPairs: Isolating Safety Critical Image Features with Counterfactual Image Generationcited by 2
  3. 2026Jailbreaks on Vision Language Model via Multimodal Reasoningcited by 2
  4. 2026Multimodal Reward Hacking in Reinforcement Learningcited by 2
  5. 2026RuleSafe-VL: Evaluating Rule-Conditioned Decision Reasoning in Vision-Language Content Moderationcited by 1
  6. 2026No Safe Dose: How Training Data Drives Unsafe Image Generationcited by 0
  7. 2026Autonomous VR-Based Risk Detection for Situational Awareness in Dangerous Settingscited by 0
  8. 2026Hazard or Anomaly? Evaluating VLMs for Understanding Dangers and Discrepanciescited by 0
  9. 2026V-DEAL: Diagnosing Video Safety De-Calibration as an Understanding-Refusal Coupling Failurecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Can't See the Forest for the Trees: Benchmarking Multimodal Safety Awareness for Multimodal LLMs
  2. 2025SIA: Enhancing Safety via Intent Awareness for Vision-Language Models
  3. 2024Multimodal Situational Safety
  4. 2026When Helpers Become Hazards: A Benchmark for Analyzing Multimodal LLM-Powered Safety in Daily Life
  5. 2025MSR-Align: Policy-Grounded Multimodal Alignment for Safety-Aware Reasoning in Vision-Language Models
  6. 2026Lingua-SafetyBench: A Benchmark for Safety Evaluation of Multilingual Vision-Language Models
  7. 2025Are Vision-Language Models Safe in the Wild? A Meme-Based Benchmark Study
  8. 2026Reading, Not Manipulating: Leveraging Router Logits for Multimodal Safety in MoE Vision-Language Models