mlsanityData to 14 Oct 2026

OVERT: A Benchmark for Over-Refusal Evaluation on Text-to-Image Models

arXiv 2505.21347 ↗First posted 27 May 2025cs.LGcited by 5

On the map: LLM safety and security → Vision-language and text-to-image safety

Abstract (arXiv)

Text-to-Image (T2I) models have achieved remarkable success in generating visual content from text inputs. Although multiple safety alignment strategies have been proposed to prevent harmful outputs, they often lead to overly cautious behavior -- rejecting even benign prompts -- a phenomenon known as textitover-refusal that reduces the practical utility of T2I models. Despite over-refusal having been observed in practice, there is no large-scale benchmark that systematically evaluates this phenomenon for T2I models. In this paper, we present an automatic workflow to construct synthetic evaluation data, resulting in OVERT (OVEr-Refusal evaluation on Text-to-image models), the first large-scale benchmark for assessing over-refusal behaviors in T2I models. OVERT includes 4,600 seemingly harmful but benign prompts across nine safety-related categories, along with 1,785 genuinely harmful prompts (OVERT-unsafe) to evaluate the safety-utility trade-off. Using OVERT, we evaluate several leading T2I models and find that over-refusal is a widespread issue across various categories (Figure 1), underscoring the need for further research to enhance the safety alignment of T2I models without compromising their functionality. As a preliminary attempt to reduce over-refusal, we explore prompt rewriting; however, we find it often compromises faithfulness to the meaning of the original prompts. Finally, we demonstrate the flexibility of our generation framework in accommodating diverse safety requirements by generating customized evaluation data adapting to user-defined policies.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Placed in Vision-language and text-to-image safety, one of 12 directions in LLM safety and security. Builds on 25 of its 37 references that are in the map. First posted on arXiv 27 May 2025.

Builds on

25 of 37 references.

Closest ancestors · 5

Same direction, newest first

  1. 2024AlignGuard: Scalable Safety Alignment for Text-to-Image Generation13 Dec
  2. 2024ART: Automatic Red-teaming for Text-to-Image Models to Protect Benign Users24 May
  3. 2024Adversarial Nibbler: An Open Red-Teaming Method for Identifying Diverse Harms in Text-to-Image Generation14 Feb
  4. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Models20 May
  5. 2022Red-Teaming the Stable Diffusion Safety Filter3 Oct

Other references · 20

  1. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  2. 2024Scaling Rectified Flow Transformers for High-Resolution Image Synthesiscited by 4,181
  3. 2024Chameleon: Mixed-Modal Early-Fusion Foundation Modelscited by 927
  4. 2023Erasing Concepts from Diffusion Modelscited by 539
  5. 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Modelscited by 513
  6. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  7. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
  8. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 244
  9. 2023MMA-Diffusion: MultiModal Attack on Diffusion Modelscited by 194
  10. 2023Having Beer after Prayer? Measuring Cultural Bias in Large Language Modelscited by 153
  11. 2024Investigating Cultural Alignment of Large Language Modelscited by 143
  12. 2024Latent Guard: a Safety Framework for Text-to-image Generationcited by 71
8 more
  1. 2025Trading Inference-Time Compute for Adversarial Robustnesscited by 61
  2. 2022Re-contextualizing Fairness in NLP: The Case of Indiacited by 55
  3. 2023Membership Inference of Diffusion Modelscited by 46
  4. 2024Controllable Safety Alignment: Inference-Time Adaptation to Diverse Safety Requirementscited by 36
  5. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Surveycited by 35
  6. 2024Automatic Pseudo-Harmful Prompt Generation for Evaluating False Refusals in Large Language Modelscited by 35
  7. 2024Fantastic Copyrighted Beasts and How (Not) to Generate Themcited by 24
  8. 2025A Systematic Review of Open Datasets Used in Text-to-Image (T2I) Gen AI Model Safetycited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 3.

5 papers.

Similar, not cited

Close in wording, no citation either way

  1. 2025T2ISafety: Benchmark for Assessing Fairness, Toxicity, and Privacy in Image Generation
  2. 2025T2I-RiskyPrompt: A Benchmark for Safety Evaluation, Attack, and Defense on Text-to-Image Model
  3. 2025TokenProber: Jailbreaking Text-to-image Models via Fine-grained Word Impact Analysis
  4. 2026Harnessing Textual Refusal Directions for Multimodal Safety
  5. 2025Towards Evaluating Robustness of Prompt Adherence in Text to Image Models
  6. 2026Arena-T2I Hard: Benchmarking and Improving Faithfulness with Dependency-Aware Checklist
  7. 2025Iterative Prompt Refinement for Safer Text-to-Image Generation
  8. 2023Evaluating the Robustness of Text-to-image Diffusion Models against Real-world Attacks