Vision Language Safety Understanding

• Vision Language Safety Understanding is a framework that defines safety by categorizing multimodal content into safe, borderline, and unsafe classes to address compositional risks.
• The approach utilizes multi-stage data generation, including context-conditioned text synthesis and expert annotation, to benchmark 17 key multimodal safety patterns.
• It reveals critical trade-offs in model performance, showing that improved instruction framing can lower over-blocking rates while potentially compromising overall safety detection.

Vision Language Safety Understanding (VLSU) refers to the systematic evaluation and enhancement of multimodal foundation models—specifically those integrating vision and language—for robust safety in the presence of complex, real-world risks. VLSU has emerged to address the inadequacy of existing unimodal safety paradigms, which often fail to capture harm that arises from the composition of image and text content. The field is driven by the demand for models that can both recognize obvious safety threats and distinguish context-dependent or borderline cases, while minimizing over-blocking (false positives) and under-refusal (false negatives) in automated moderation or safety-critical applications.

1. Foundations of Multimodal Safety Evaluation

Central to VLSU is the recognition that safety cannot be adequately evaluated by analyzing vision and language modalities in isolation. The VLSU framework formalizes safety classification via a combinatorial scheme, introducing the “borderline” class for content mentioning harm but within acceptable contexts (e.g., educational or neutral presentations). Each data instance is annotated as Safe (S), Borderline (B), or Unsafe (U) for the image, text, and joint combination, producing a safety tuple $s_i – s_t – s_j$ ($s_i,s_t,s_j \in \{S,B,U\}$). This taxonomy enables systematic assessment of 17 practically occurring multimodal patterns (out of 27 theoretical combinations), covering a complete spectrum of safety scenarios across both modalities.

Data generation in VLSU involves multi-stage pipelines: parameterized concept generation (driven by models such as Gemini-1.5), large-scale real-world image retrieval (with perceptual uniqueness checks), context-conditioned text synthesis (varying style, length, and severity), and expert-level multi-stage annotation. The resulting benchmarks, such as the presented 8,187-sample set spanning 15 harm categories, support comprehensive analysis and are constructed to include substantial proportions of safe (26%), borderline (41%), and unsafe (33%) multimodal samples (Palaskar et al., 21 Oct 2025).

2. Safety Patterns, Harm Taxonomy, and Combinatorics

VLSU organizes risk scenarios using a harm taxonomy (e.g., hate speech, discrimination, explicit content, self-harm, fraud, weaponry, jailbreaks) and evaluates each pattern in terms of its emergence from unimodal or joint cues. For instance, S-S-U captures benign image and text inputs that, when combined, yield unsafe intent—a failure point for compositional reasoning. Table 1 below summarizes representative combinatorial patterns:

Image (s_i)	Text (s_t)	Joint (s_j)	Typical Context
S	S	S	Benign multimodal content
S	S	U	Unsafe intent via composition
U	S	U	Visual unsafe, text amplifies
B	S	B	Borderline visual, safe text
S	B	S/B/U	Context-dependent resolution

This formalization, along with exhaustive coverage of unsafety types, allows VLSU to probe failure modes where crucial compositional reasoning is needed to identify risk (Palaskar et al., 21 Oct 2025).

3. Model Performance and Joint Reasoning Limitations

State-of-the-art models (e.g., GPT‑4o, Gemini-1.5, Qwen2.5VL, LLaVA-1.5, InternVL3) generally achieve over 90% accuracy on unimodal safety detection when harm is explicit. However, when fine-grained joint reasoning is required (notably in S-S-U, S-B-U, etc.), model performance drops dramatically to between 20% and 55%. Even the strongest models achieve a maximum F1 of approximately 70.9% on joint safety—far below the human-annotator F1 of 91%.

A critical finding is that 34% of errors occur in cases where both the image-only and text-only modalities are classified correctly, yet the joint label is missed, highlighting the inadequacy of current fusion mechanisms for compositional safety. Furthermore, models display an over-sensitivity to individual unsafe signals: the presence of a single borderline or unsafe cue in one modality often causes over-blocking, even when true risk depends on the joint context. These phenomena indicate that models rely primarily on strong unimodal triggers, rather than robust cross-modal reasoning (Palaskar et al., 21 Oct 2025).

4. Instruction Framing and Alignment Trade-Offs

VLSU reveals that safety-aligned models face a persistent trade-off in balancing over-blocking (false positives on borderline or educational content) versus under-refusal (false negatives on genuinely unsafe instances). Instruction framing—i.e., tweaking the model’s policy prompt to emphasize helpfulness or harmlessness—adjusts this balance. For example, reframing model instructions in Gemini-1.5 lowered the over-blocking rate on borderline content from 62.4% to 10.4%, but at a pronounced cost to overall safety, as the refusal rate on unsafe (U) content fell from 90.8% to 53.9%. This highlights the fine line between censorship and permissiveness in automated safety systems, and demonstrates how policy guidance alone cannot resolve the alignment gap (Palaskar et al., 21 Oct 2025).

5. Error Taxonomy and Model Limitations

The error analysis in VLSU identifies several persistent failure modes:

• Absent compositional reasoning: Models classify each modality correctly but do not detect when benign image and text combine into a harmful context.
• Unimodal over-sensitivity: Overblocking of borderline or safe contexts when a single strong cue is present.
• Under-refusal rates: Borderline instruction framing improves engagement but degrades refusal rates on unsafe content.
• Failure on complex patterns: Certain harm categories (e.g., self-harm/suicide, jailbreak, discrimination) remain resistant to both instruction optimization and scale increases.

These findings demonstrate that increasing parameter count does not bridge the compositional gap. The limitations reflect model architecture and training paradigms that prioritize modular (image-only or text-only) signal processing over their interaction (Palaskar et al., 21 Oct 2025).

6. Implications for Research, Benchmarking, and Safety Algorithm Design

The VLSU framework establishes a principled benchmark that exposes vulnerabilities missed by prior siloed evaluations. It underpins the following implications for the field:

• Benchmarking: Future safety evaluation must center joint, fine-grained multimodal benchmarks with explicit consideration of the borderline class and combinatorial patterns.
• Model Development: There is a critical need for training objectives, architectures, and datasets that emphasize cross-modal fusion, compositional reasoning, and context-aware risk assessment.
• Policy Interfaces: Relying on instruction framing to trade off between over-blocking and under-refusal is inadequate; models must be engineered to dynamically resolve the intent behind joint cues.
• Research Directions: Progress may emerge from better integration of hierarchical attention, intent reasoning (e.g., intent inference (Na et al., 21 Jul 2025)), and multi-task objectives that explicitly encode compositional safety constraints.

The VLSU framework, by formalizing the taxonomy of joint safety reasoning and revealing the alignment gap in present models, delineates the necessary milestones for achieving robust, real-world vision-language safety. It serves as both a test bed and a catalyst for advancing research in this rapidly evolving area (Palaskar et al., 21 Oct 2025).