mlsanityData to 7 Oct 2026

Prompt-Induced Score Variance in Zero-Shot Binary Vision-Language Safety Classification

arXiv 2605.00326 ↗First posted 1 May 2026cs.CL cs.CVcited by 0

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

Single-prompt first-token probabilities from zero-shot vision-language model (VLM) safety classifiers are treated as decision scores, but we show they are unreliable under semantically equivalent prompt reformulation: even when the binary label is constrained to a fixed output position, equivalent prompts can induce materially different unsafe probabilities for the same sample. Across multimodal safety benchmarks and multiple VLM families, cross-prompt variance is strongly associated with prompt-level disagreement and higher error, making it a useful fragility diagnostic. A training-free mean ensemble improves NLL on all 14 dataset-model evaluation pairs and ECE on 12/14 relative to a train-selected single-prompt baseline, and wins more head-to-head NLL comparisons than labeled temperature scaling, Platt scaling, and isotonic regression applied to the same prompt. Ranking gains are consistent against the train-selected baseline on both AUROC and AUPRC, and against the full 15-prompt distribution remain consistent on AUPRC while softening on AUROC. Labeled calibration on top of the mean provides further gains when labels are available, identifying prompt averaging as a strong label-free first stage rather than a replacement for calibration. We frame this as a reliability stress test for zero-shot VLM first-token safety scores and recommend prompt-family evaluation with mean aggregation as a standard label-free reliability baseline.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 15 of its 36 references that are in the map. First posted on arXiv 1 May 2026.

Builds on

15 of 36 references.

Closest ancestors · 1

Same direction, newest first

  1. 2025Are Vision-Language Models Safe in the Wild? A Meme-Based Benchmark Study21 May

Other references · 14

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2017On Calibration of Modern Neural Networkscited by 4,860
  3. 2025Qwen3-VL Technical Reportcited by 2,534
  4. 2025InternVL3.5: Advancing Open-Source Multimodal Models in Versatility, Reasoning, and Efficiencycited by 1,419
  5. 2017Selective Classification for Deep Neural Networkscited by 799
  6. 2019SelectiveNet: A Deep Neural Network with an Integrated Reject Optioncited by 333
  7. 2025MiniCPM-V 4.5: Cooking Efficient MLLMs via Architecture, Data, and Training Recipecited by 174
  8. 2024ProSA: Assessing and Understanding the Prompt Sensitivity of LLMscited by 145
  9. 2024Calibrating Large Language Models with Sample Consistencycited by 72
  10. 2024VL-Uncertainty: Detecting Hallucination in Large Vision-Language Model via Uncertainty Estimationcited by 71
  11. 2025Promptception: How Sensitive Are Large Multimodal Models to Prompts?cited by 13
  12. 2025FESTA: Functionally Equivalent Sampling for Trust Assessment of Multimodal LLMscited by 5
2 more
  1. 2025PARC: A Quantitative Framework Uncovering the Symmetries within Vision Language Modelscited by 3
  2. 2025Do LVLMs Know What They Know? A Systematic Study of Knowledge Boundary Perception in LVLMscited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Model
  2. 2025Safe Vision-Language Models via Unsafe Weights Manipulation
  3. 2024NLPrompt: Noise-Label Prompt Learning for Vision-Language Models
  4. 2025ELITE: Enhanced Language-Image Toxicity Evaluation for Safety
  5. 2025SIA: Enhancing Safety via Intent Awareness for Vision-Language Models
  6. 2025Safety Mirage: How Spurious Correlations Undermine VLM Safety Fine-Tuning and Can Be Mitigated by Machine Unlearning
  7. 2025VSCBench: Bridging the Gap in Vision-Language Model Safety Calibration
  8. 2025SPARC: Score Prompting and Adaptive Fusion for Zero-Shot Multi-Label Recognition in Vision-Language Models