Evolving Contextual Safety in Multi-Modal Large Language Models via Inference-Time Self-Reflective Memory
On the map: LLM reasoning → Reasoning for agents, planning and code
Abstract (arXiv)
Multi-modal Large Language Models (MLLMs) have achieved remarkable performance across a wide range of visual reasoning tasks, yet their vulnerability to safety risks remains a pressing concern. While prior research primarily focuses on jailbreak defenses that detect and refuse explicitly unsafe inputs, such approaches often overlook contextual safety, which requires models to distinguish subtle contextual differences between scenarios that may appear similar but diverge significantly in safety intent. In this work, we present MM-SafetyBench++, a carefully curated benchmark designed for contextual safety evaluation. Specifically, for each unsafe image-text pair, we construct a corresponding safe counterpart through minimal modifications that flip the user intent while preserving the underlying contextual meaning, enabling controlled evaluation of whether models can adapt their safety behaviors based on contextual understanding. Further, we introduce EchoSafe, a training-free framework that maintains a self-reflective memory bank to accumulate and retrieve safety insights from prior interactions. By integrating relevant past experiences into current prompts, EchoSafe enables context-aware reasoning and continual evolution of safety behavior during inference. Extensive experiments on various multi-modal safety benchmarks demonstrate that EchoSafe consistently achieves superior performance, establishing a strong baseline for advancing contextual safety in MLLMs. All benchmark data and code are available at https://echosafe-mllm.github.io.
Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 54 of its 61 references that are in the map. First posted on arXiv 16 Mar 2026.
Builds on
54 of 61 references.
Closest ancestors · 3
Same direction, newest first
- 2025SafePTR: Token-Level Jailbreak Defense in Multimodal LLMs via Prune-then-Restore Mechanism2 Jul
- 2024Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment27 Nov
- 2024Eyes Closed, Safety On: Protecting Multimodal LLMs via Image-to-Text Transformation14 Mar
Other references · 51
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
- 2025Qwen3 Technical Reportcited by 8,820
- 2023Visual Instruction Tuningcited by 7,869
- 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
- 2025Qwen2.5-VL Technical Reportcited by 5,587
- 2023Improved Baselines with Visual Instruction Tuningcited by 4,418
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2016Improved Techniques for Training GANscited by 2,970
- 2024LLaVA-OneVision: Easy Visual Task Transfercited by 2,719
- 2023MMBench: Is Your Multi-modal Model an All-around Player?cited by 2,141
- 2022Learn to Explain: Multimodal Reasoning via Thought Chains for Science Question Answeringcited by 1,919
- 2019Towards VQA Models That Can Readcited by 1,718
38 more
- 2023MME: A Comprehensive Evaluation Benchmark for Multimodal Large Language Modelscited by 1,652
- 2025InternVL3.5: Advancing Open-Source Multimodal Models in Versatility, Reasoning, and Efficiencycited by 1,510
- 2023MM-Vet: Evaluating Large Multimodal Models for Integrated Capabilitiescited by 1,239
- 2025Qwen-Image Technical Reportcited by 1,044
- 2023Safe RLHF: Safe Reinforcement Learning from Human Feedbackcited by 656
- 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Promptscited by 398
- 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 328
- 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 284
- 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Modelscited by 274
- 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 273
- 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attackscited by 230
- 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 172
- 2024Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Modelscited by 167
- 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Modelscited by 136
- 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Promptingcited by 125
- 2023DRESS: Instructing Large Vision-Language Models to Align and Interact with Humans via Natural Language Feedbackcited by 103
- 2024Safeguarding Large Language Models: A Surveycited by 78
- 2024Safety of Multimodal Large Language Models on Images and Textscited by 75
- 2023The Art of Defending: A Systematic Evaluation and Analysis of LLM Defense Strategies on Safety and Over-Defensivenesscited by 67
- 2024ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Timecited by 60
- 2024White-box Multimodal Jailbreaks Against Large Vision-Language Modelscited by 59
- 2024Multimodal Situational Safetycited by 58
- 2025From Hard Refusals to Safe-Completions: Toward Output-Centric Safety Trainingcited by 52
- 2025Jailbreaking Multimodal Large Language Models via Shuffle Inconsistencycited by 51
- 2025Self-Correcting Decoding with Generative Feedback for Mitigating Hallucinations in Large Vision-Language Modelscited by 44
- 2025Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategycited by 44
- 2024Vision-LLMs Can Fool Themselves with Self-Generated Typographic Attackscited by 38
- 2024IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using Themselvescited by 37
- 2024Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Modelscited by 33
- 2024MOSSBench: Is Your Multimodal Language Model Oversensitive to Safe Queries?cited by 30
- 2025Safe RLHF-V: Safe Reinforcement Learning from Multi-modal Human Feedbackcited by 30
- 2024Safe Inputs but Unsafe Output: Benchmarking Cross-modality Safety Alignment of Large Vision-Language Modelcited by 26
- 2024From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreakingcited by 24
- 2025Can't See the Forest for the Trees: Benchmarking Multimodal Safety Awareness for Multimodal LLMscited by 23
- 2025VERIFY: A Benchmark of Visual Explanation and Reasoning for Investigating Multimodal Reasoning Fidelitycited by 23
- 2025ONLY: One-Layer Intervention Sufficiently Mitigates Hallucinations in Large Vision-Language Modelscited by 16
- 2026pySpatial: Generating 3D Visual Programs for Zero-Shot Spatial Reasoningcited by 14
- 2025USB: A Comprehensive and Unified Safety Evaluation Benchmark for Multimodal Large Language Modelscited by 10
50 most cited of 51 All 51 (JSON)
Built on by
Citing papers per year: 2026: 5.
5 papers.
- 2026LENS: Adaptive Spatio-Temporal Zooming for Keyframe Sampling in Long-Form Videoscited by 2
- 2026EviSafe: Evidence-Grounded Safety Evaluation for Vision-Language Modelscited by 1
- 2026Automatic Hard Example Synthesis with Multi-Level Agentic Data Curationcited by 0
- 2026ReFrame: Evidence-Guided Test-Time Safety Alignment in Multimodal Large Language Modelscited by 0
- 2026Video2Skill: From Streaming Experience to Reusable Embodied Skillscited by 0
- 2026Video2Skill: From Streaming Experience to Reusable Embodied Skills29 Sep 2026
- 2026EviSafe: Evidence-Grounded Safety Evaluation for Vision-Language Models24 Aug 2026
- 2026ReFrame: Evidence-Guided Test-Time Safety Alignment in Multimodal Large Language Models21 Aug 2026
- 2026LENS: Adaptive Spatio-Temporal Zooming for Keyframe Sampling in Long-Form Videos27 Jul 2026
- 2026Automatic Hard Example Synthesis with Multi-Level Agentic Data Curation15 Jul 2026
Similar, not cited
Close in wording, no citation either way
- 2025Think-Reflect-Revise: A Policy-Guided Reflective Framework for Safety Alignment in Large Vision Language Models
- 2026MTMCS-Bench: Evaluating Contextual Safety of Multimodal Large Language Models in Multi-Turn Dialogues
- 2025Steering Multimodal Large Language Models Decoding for Context-Aware Safety
- 2025RedDiffuser: Auditing Multimodal Safety Failures in Vision-Language Models via Reinforced Diffusion
- 2025Self-Aware Safety Augmentation: Leveraging Internal Semantic Understanding to Enhance Safety in Vision-Language Models
- 2026Evolving Safety Landscape of Multi-modal Large Language Models: A Survey of Emerging Threats and Safeguards
- 2026Transfer Safety Awareness for Cross-Modal Safety Drift in Multimodal Large Language Models
- 2026MCBench: A Multicontext Safety Assessment Benchmark for Omni Large Language Models