REVEAL: Multi-turn Evaluation of Image-Input Harms for Vision LLM

TL;DR

This work targets the safety challenges of Vision LLMs in multi-turn, cross-modal use by introducing REVEAL, a scalable pipeline that automates image mining, synthetic adversarial data generation, crescendo-based multi-turn expansions, and GPT-4o-based evaluation against defined harm policies. Through evaluations of five VLLMs across three harm categories, REVEAL reveals that multi-turn interactions amplify defect rates and that misinformation remains a persistent vulnerability, while GPT-4o demonstrates the strongest overall safety-usability balance. The framework emphasizes modularity, policy customization, and public data release to enable ongoing, reproducible cross-modal safety assessment. These insights offer practical guidance for pre-deployment testing, safety monitoring, and policy development in cross-modal AI systems.

Abstract

Vision Large Language Models (VLLMs) represent a significant advancement in artificial intelligence by integrating image-processing capabilities with textual understanding, thereby enhancing user interactions and expanding application domains. However, their increased complexity introduces novel safety and ethical challenges, particularly in multi-modal and multi-turn conversations. Traditional safety evaluation frameworks, designed for text-based, single-turn interactions, are inadequate for addressing these complexities. To bridge this gap, we introduce the REVEAL (Responsible Evaluation of Vision-Enabled AI LLMs) Framework, a scalable and automated pipeline for evaluating image-input harms in VLLMs. REVEAL includes automated image mining, synthetic adversarial data generation, multi-turn conversational expansion using crescendo attack strategies, and comprehensive harm assessment through evaluators like GPT-4o. We extensively evaluated five state-of-the-art VLLMs, GPT-4o, Llama-3.2, Qwen2-VL, Phi3.5V, and Pixtral, across three important harm categories: sexual harm, violence, and misinformation. Our findings reveal that multi-turn interactions result in significantly higher defect rates compared to single-turn evaluations, highlighting deeper vulnerabilities in VLLMs. Notably, GPT-4o demonstrated the most balanced performance as measured by our Safety-Usability Index (SUI) followed closely by Pixtral. Additionally, misinformation emerged as a critical area requiring enhanced contextual defenses. Llama-3.2 exhibited the highest MT defect rate ($16.55 \%$) while Qwen2-VL showed the highest MT refusal rate ($19.1 \%$).

Figures (8)

• Figure 1: While a text-only model correctly refuses to assist with growing poppy plants (which have legal and safety concerns), a multimodal model bypasses safeguards when the query includes an image.
• Figure 2: The REVEAL Framework flow diagram depicting the five primary components. Each component adds value to the evaluation process as depicted in the quality checks.
• Figure 3: REVEAL Framework Pipeline Run demonstrating the generation of an Adversarial Conversational Context for Violence Harm Policy
• Figure 4: Comparison of Defect Rates (DR) and Refusal Rates (RR) Across Harm Categories for Various LLMs in Single-Turn (ST) and multi-turn (MT) settings.
• Figure 5: REVEAL Framework Pipeline Run Demonstrating the Generation of an Adversarial Context for Above Harm Policy