mlsanityData to 7 Oct 2026

REVEAL: Multi-turn Evaluation of Image-Input Harms for Vision LLM

arXiv 2505.04673 ↗First posted 7 May 2025cs.CL cs.AIcited by 4

Not on the map. Why?

Abstract (arXiv)

Vision Large Language Models (VLLMs) represent a significant advancement in artificial intelligence by integrating image-processing capabilities with textual understanding, thereby enhancing user interactions and expanding application domains. However, their increased complexity introduces novel safety and ethical challenges, particularly in multi-modal and multi-turn conversations. Traditional safety evaluation frameworks, designed for text-based, single-turn interactions, are inadequate for addressing these complexities. To bridge this gap, we introduce the REVEAL (Responsible Evaluation of Vision-Enabled AI LLMs) Framework, a scalable and automated pipeline for evaluating image-input harms in VLLMs. REVEAL includes automated image mining, synthetic adversarial data generation, multi-turn conversational expansion using crescendo attack strategies, and comprehensive harm assessment through evaluators like GPT-4o. We extensively evaluated five state-of-the-art VLLMs, GPT-4o, Llama-3.2, Qwen2-VL, Phi3.5V, and Pixtral, across three important harm categories: sexual harm, violence, and misinformation. Our findings reveal that multi-turn interactions result in significantly higher defect rates compared to single-turn evaluations, highlighting deeper vulnerabilities in VLLMs. Notably, GPT-4o demonstrated the most balanced performance as measured by our Safety-Usability Index (SUI) followed closely by Pixtral. Additionally, misinformation emerged as a critical area requiring enhanced contextual defenses. Llama-3.2 exhibited the highest MT defect rate (16.55 %) while Qwen2-VL showed the highest MT refusal rate (19.1 %).

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Builds on 48 of its 68 references that are in the map. First posted on arXiv 7 May 2025.

Builds on

48 of 68 references.

References · 48

  1. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  2. 2024Qwen2-VL: Enhancing Vision-Language Model's Perception of the World at Any Resolutioncited by 4,151
  3. 2024Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phonecited by 1,883
  4. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  5. 2023LMSYS-Chat-1M: A Large-Scale Real-World LLM Conversation Datasetcited by 449
  6. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Promptscited by 368
  7. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  8. 2023Are aligned neural networks adversarially aligned?cited by 305
  9. 2022Easily Accessible Text-to-Image Generation Amplifies Demographic Stereotypes at Large Scalecited by 262
  10. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 260
  11. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Modelscited by 255
  12. 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 234
36 more
  1. 2022DALL-Eval: Probing the Reasoning Skills and Social Biases of Text-to-Image Generation Modelscited by 230
  2. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attackscited by 208
  3. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  4. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 175
  5. 2023Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Modelscited by 171
  6. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  7. 2023Sociotechnical Safety Evaluation of Generative AI Systemscited by 154
  8. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 145
  9. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 128
  10. 2024Attacks, Defenses and Evaluations for LLM Conversation Safety: A Surveycited by 124
  11. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Modelscited by 121
  12. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMscited by 117
  13. 2023How Many Unicorns Are in This Image? A Safety Evaluation Benchmark for Vision LLMscited by 103
  14. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 103
  15. 2024ALERT: A Comprehensive Benchmark for Assessing Large Language Models' Safety through Red Teamingcited by 96
  16. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 83
  17. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  18. 2024Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLMcited by 73
  19. 2024Safety of Multimodal Large Language Models on Images and Textscited by 70
  20. 2024Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialoguecited by 64
  21. 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Charactercited by 61
  22. 2023Automating Customer Service using LangChain: Building custom open-source GPT Chatbot for organizationscited by 59
  23. 2024VLSBench: Unveiling Visual Leakage in Multimodal Safetycited by 59
  24. 2023ROBBIE: Robust Bias Evaluation of Large Generative Language Modelscited by 53
  25. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Imagecited by 50
  26. 2024Arondight: Red Teaming Large Vision Language Models with Auto-generated Multi-modal Jailbreak Promptscited by 39
  27. 2024Assessment of Multimodal Large Language Models in Alignment with Human Valuescited by 36
  28. 2024Unveiling the Safety of GPT-4o: An Empirical Study using Jailbreak Attackscited by 35
  29. 2024MLLMGuard: A Multi-dimensional Safety Evaluation Suite for Multimodal Large Language Modelscited by 34
  30. 2024Leveraging the Context through Multi-Round Interactions for Jailbreaking Attackscited by 32
  31. 2024Red Teaming GPT-4V: Are GPT-4V Safe Against Uni/Multi-Modal Jailbreak Attacks?cited by 32
  32. 2023ToViLaG: Your Visual-Language Generative Model is Also An Evildoercited by 27
  33. 2024VIAssist: Adapting Multi-modal Large Language Models for Users with Visual Impairmentscited by 24
  34. 2023Towards Safer Generative Language Models: A Survey on Safety Risks, Evaluations, and Improvementscited by 14
  35. 2024Harm Amplification in Text-to-Image Modelscited by 14
  36. 2023Distilling Adversarial Prompts from Safety Benchmarks: Report for the Adversarial Nibbler Challengecited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 4.

4 papers.

  1. 2026Do No Harm: Exposing Hidden Vulnerabilities of LLMs via Persona-based Client Simulation Attack in Psychological Counselingcited by 4
  2. 2026Visual Memory Injection Attacks for Multi-Turn Conversationscited by 2
  3. 2026Multi-Turn Adaptive Prompting Attack on Large Vision-Language Modelscited by 0
  4. 2026IPO-Mine: A Toolkit and Dataset for Section-Structured Analysis of Long, Multimodal IPO Documentscited by 0