SafetyPairs: Isolating Safety Critical Image Features with Counterfactual Image Generation

TL;DR

SafetyPairs tackles the challenge of context dependent image safety by isolating safety relevant features through counterfactual image pairs. It presents a four step pipeline that uses safety policies, captioning, and instruction based image editing to flip unsafe images to safe ones while preserving non safety content, validated by a VQA consistency check. The resulting SafetyPairs benchmark contains 3,020 images across diverse safety categories and reveals that state of the art zero shot vision language models struggle with fine grained safety distinctions, more so than on prior LlavaGuard data. Beyond evaluation, SafetyPairs serves as an effective data augmentation strategy that improves the sample efficiency of training lightweight guard models across multiple encoders.

Abstract

What exactly makes a particular image unsafe? Systematically differentiating between benign and problematic images is a challenging problem, as subtle changes to an image, such as an insulting gesture or symbol, can drastically alter its safety implications. However, existing image safety datasets are coarse and ambiguous, offering only broad safety labels without isolating the specific features that drive these differences. We introduce SafetyPairs, a scalable framework for generating counterfactual pairs of images, that differ only in the features relevant to the given safety policy, thus flipping their safety label. By leveraging image editing models, we make targeted changes to images that alter their safety labels while leaving safety-irrelevant details unchanged. Using SafetyPairs, we construct a new safety benchmark, which serves as a powerful source of evaluation data that highlights weaknesses in vision-language models' abilities to distinguish between subtly different images. Beyond evaluation, we find our pipeline serves as an effective data augmentation strategy that improves the sample efficiency of training lightweight guard models. We release a benchmark containing over 3,020 SafetyPair images spanning a diverse taxonomy of 9 safety categories, providing the first systematic resource for studying fine-grained image safety distinctions.

Figures (13)

• Figure 1: SafetyPairs expose safety vulnerabilities in VLMs. (A) We create counterfactual image pairs that only vary from each other according to their safety label. (B) These pairs serve as challenging evaluation data for multi-modal models like VLMs, which struggle to differentiate them.
• Figure 2: SafetyPairs contains over 3k fine-grained image pairs, one safe and the other unsafe, covering a diverse safety taxonomy.
• Figure 3: Our framework performs safety-aware image augmentations. By leveraging image editing models we can make perform fine-grained edits to images that take into account safety-relevant features.
• Figure 4: We create visual question answering constraints to ensure the consistency of our edit. (a) First, we generate a set of constraints for "facts" in the source image, and then leverage the edit instruction to identify which facts should change. (b) We apply a VLM models to answer these precise yes/no questions given the edited image to ensure the image matches expectations. Here we see the editing model unnecessarily changed the appearance of the flag, which our system detects and rejects.
• Figure 5: A Sankey diagram highlighting the yield of our synthetic data pipeline. We show the number of total image edit attempts, the number of images that make it through the VQA consistency check, the number of those images that pass human validation, and finally the number of unique pairs that those images create.