Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

The Side Effects of Being Smart: Safety Risks in MLLMs' Multi-Image Reasoning

Renmiao Chen, Yida Lu, Shiyao Cui, Xuan Ouyang, Victor Shea-Jay Huang, Shumin Zhang, Chengwei Pan, Han Qiu, Minlie Huang

TL;DR

This work investigates safety risks that arise when Multimodal Large Language Models (MLLMs) perform multi-image reasoning. It introduces MIR-SafetyBench, the first benchmark focused on reasoning-based safety across 9 multi-image relation types, containing 2,676 instances and a five-stage generation/evaluation pipeline. Evaluations on 19 MLLMs reveal pervasive safety vulnerabilities, with higher Attack Success Rates (ASR) often accompanying stronger multi-image reasoning, though some frontier models maintain robustness. The authors also analyze internal model signals using attention-entropy to identify potential cognitive-load-related safety signatures, offering a diagnostic foundation for future mitigation and safer deployment of advanced multimodal systems.

Abstract

As Multimodal Large Language Models (MLLMs) acquire stronger reasoning capabilities to handle complex, multi-image instructions, this advancement may pose new safety risks. We study this problem by introducing MIR-SafetyBench, the first benchmark focused on multi-image reasoning safety, which consists of 2,676 instances across a taxonomy of 9 multi-image relations. Our extensive evaluations on 19 MLLMs reveal a troubling trend: models with more advanced multi-image reasoning can be more vulnerable on MIR-SafetyBench. Beyond attack success rates, we find that many responses labeled as safe are superficial, often driven by misunderstanding or evasive, non-committal replies. We further observe that unsafe generations exhibit lower attention entropy than safe ones on average. This internal signature suggests a possible risk that models may over-focus on task solving while neglecting safety constraints. Our code and data are available at https://github.com/thu-coai/MIR-SafetyBench.

The Side Effects of Being Smart: Safety Risks in MLLMs' Multi-Image Reasoning

TL;DR

This work investigates safety risks that arise when Multimodal Large Language Models (MLLMs) perform multi-image reasoning. It introduces MIR-SafetyBench, the first benchmark focused on reasoning-based safety across 9 multi-image relation types, containing 2,676 instances and a five-stage generation/evaluation pipeline. Evaluations on 19 MLLMs reveal pervasive safety vulnerabilities, with higher Attack Success Rates (ASR) often accompanying stronger multi-image reasoning, though some frontier models maintain robustness. The authors also analyze internal model signals using attention-entropy to identify potential cognitive-load-related safety signatures, offering a diagnostic foundation for future mitigation and safer deployment of advanced multimodal systems.

Abstract

As Multimodal Large Language Models (MLLMs) acquire stronger reasoning capabilities to handle complex, multi-image instructions, this advancement may pose new safety risks. We study this problem by introducing MIR-SafetyBench, the first benchmark focused on multi-image reasoning safety, which consists of 2,676 instances across a taxonomy of 9 multi-image relations. Our extensive evaluations on 19 MLLMs reveal a troubling trend: models with more advanced multi-image reasoning can be more vulnerable on MIR-SafetyBench. Beyond attack success rates, we find that many responses labeled as safe are superficial, often driven by misunderstanding or evasive, non-committal replies. We further observe that unsafe generations exhibit lower attention entropy than safe ones on average. This internal signature suggests a possible risk that models may over-focus on task solving while neglecting safety constraints. Our code and data are available at https://github.com/thu-coai/MIR-SafetyBench.
Paper Structure (41 sections, 7 equations, 5 figures, 5 tables)

This paper contains 41 sections, 7 equations, 5 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Advances in MLLM Reasoning
  4. Safety Issues in Advanced MLLMs
  5. Multi-image Relations Taxonomy
  6. Benchmark Construction
  7. Multi-image Instance Generation
  8. 1. Rewrite Harmful Question (Revisor).
  9. 2. Generate Images (Image Generator).
  10. 3. Test the Attack (Tester).
  11. 4. Harmfulness Judgement (Harmbench Judge).
  12. 5. Evaluate & Refine (Evaluator).
  13. Experiments
  14. Experimental Setup
  15. Main Results on MIR-SafetyBench
  16. ...and 26 more sections

Figures (5)

  • Figure 1: Illustration of the 'side effect of being smart': as MLLMs' reasoning improves, they move from failing to understand a complex harmful request (Level 1) to providing a detailed high-risk procedure (Level 3).
  • Figure 2: Examples of the nine relations in our proposed taxonomy. Each case hides harmful intent within the complex relationships across multiple images and a textual prompt.
  • Figure 3: Overview of our multi-stage pipeline for constructing the MIR-SafetyBench.
  • Figure 4: Heatmaps of attention entropy gaps between safe and unsafe cases, where red indicates a larger discrepancy, for a chat model (Qwen2.5-VL-3B-Instruct, top) and a reasoning model (GLM-4.1V-9B-Thinking, bottom) in multi- ((a),(c)) and single-image ((b),(d)) settings.
  • Figure 5: Heatmaps of attention entropy gaps between safe and unsafe cases, where red indicates a larger discrepancy, for a chat model (MiniCPM-o-2.6, top) and a reasoning model (Kimi-VL-A3B-Thinking-2506, bottom) in multi ((a),(c)) and single-image ((b),(d)) settings.