{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T17:34:37Z","timestamp":1783186477892,"version":"3.54.6"},"reference-count":123,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2025,12,26]],"date-time":"2025-12-26T00:00:00Z","timestamp":1766707200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,12,26]],"date-time":"2025-12-26T00:00:00Z","timestamp":1766707200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62206009"],"award-info":[{"award-number":["62206009"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int J Comput Vis"],"published-print":{"date-parts":[[2026,1]]},"DOI":"10.1007\/s11263-025-02613-1","type":"journal-article","created":{"date-parts":[[2025,12,26]],"date-time":"2025-12-26T17:33:34Z","timestamp":1766770414000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":8,"title":["SafeBench: A Safety Evaluation Framework for Multimodal Large Language Models"],"prefix":"10.1007","volume":"134","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7249-579X","authenticated-orcid":false,"given":"Zonghao","family":"Ying","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aishan","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Siyuan","family":"Liang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lei","family":"Huang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jinyang","family":"Guo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wenbo","family":"Zhou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xianglong","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dacheng","family":"Tao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,12,26]]},"reference":[{"key":"2613_CR1","unstructured":"X.AI. (2024). Grok-2 beta release. https:\/\/x.ai\/blog\/grok-2."},{"key":"2613_CR2","unstructured":"Abdin, M., Jacobs, S. A., Awan, A. A., and others (2024). Phi-3 technical report: A highly capable language model locally on your phone."},{"key":"2613_CR3","unstructured":"AI@Meta. (2024). Llama 3 model card."},{"key":"2613_CR4","unstructured":"Andriushchenko, M., & Flammarion, N. (2024). Does refusal training in llms generalize to the past tense?."},{"key":"2613_CR5","unstructured":"Anthropic. (2024). Claude 3.5 sonnet. https:\/\/www.anthropic.com\/news\/claude-3-5-sonnet."},{"key":"2613_CR6","unstructured":"Anthropic. (2024). The claude 3 model family: Opus, sonnet, haiku. https:\/\/www-cdn.anthropic.com\/de8ba9b01c9ab7cbabf5c33b80b7bbc618857627\/Model_Card_Claude_3.pdf."},{"key":"2613_CR7","unstructured":"Anthropic. (2025). Acceptable use policy. https:\/\/www.anthropic.com\/legal\/aup Retrieved September 27, 2025."},{"key":"2613_CR8","unstructured":"Bai, J., Bai, S., Chu, Y., and others (2023). Qwen technical report. arXiv preprintarXiv:2309.16609."},{"key":"2613_CR9","unstructured":"Bai, J., Bai, S., Yang, S., Wang, S., Tan, S., Wang, P., Lin, J., Zhou, C., & Zhou, J. (2023). Qwen-vl: A frontier large vision-language model with versatile abilities. arXiv preprintarXiv:2308.12966."},{"key":"2613_CR10","unstructured":"Bai, J., Bai, S., Yang, S., Wang, S., Tan, S., Wang, P., Lin, J., Zhou, C., & Zhou, J. (2023). Qwen-vl: A versatile vision-language model for understanding, localization, text reading, and beyond. arXiv preprintarXiv:2308.12966."},{"key":"2613_CR11","unstructured":"Bai, Y., Jones, A., Ndousse, K., Askell, A., and others (2022). Training a helpful and harmless assistant with reinforcement learning from human feedback. CoRR, abs\/2204.05862."},{"key":"2613_CR12","first-page":"38176","volume":"35","author":"M Bakker","year":"2022","unstructured":"Bakker, M., Chadwick, M., Sheahan, H., Tessler, M., Campbell-Gillingham, L., Balaguer, J., McAleese, N., Glaese, A., Aslanides, J., Botvinick, M., et al. (2022). Fine-tuning language models to find agreement among humans with diverse preferences. Advances in Neural Information Processing Systems, 35, 38176\u201338189.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"2613_CR13","doi-asserted-by":"crossref","unstructured":"Banerjee, S., Layek, S., Hazra, R., & Mukherjee, A. (2024). How (un)ethical are instruction-centric responses of llms? unveiling the vulnerabilities of safety guardrails to harmful queries.","DOI":"10.1609\/icwsm.v19i1.35811"},{"key":"2613_CR14","unstructured":"Cai, Z., Cao, M., Chen, H., and others (2024). Internlm2 technical report."},{"key":"2613_CR15","unstructured":"Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G. J., & Wong, E. (2023). Jailbreaking black box large language models in twenty queries. arXiv preprintarXiv:2310.08419."},{"key":"2613_CR16","unstructured":"Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G. J., & Wong, E. (2023). Jailbreaking black box large language models in twenty queries. CoRR, abs\/2310.08419."},{"key":"2613_CR17","doi-asserted-by":"crossref","unstructured":"Chen, J., Guo, H., Yi, K., Li, B., & Elhoseiny, M. (2022). Visualgpt: Data-efficient adaptation of pretrained language models for image captioning. In IEEE\/CVF Conference on Computer Vision and Pattern Recognition.","DOI":"10.1109\/CVPR52688.2022.01750"},{"key":"2613_CR18","doi-asserted-by":"crossref","unstructured":"Chen, L., Li, J., Dong, X., Zhang, P., He, C., Wang, J., Zhao, F., & Lin, D. (2023). Sharegpt4v: Improving large multi-modal models with better captions.","DOI":"10.1007\/978-3-031-72643-9_22"},{"key":"2613_CR19","doi-asserted-by":"crossref","unstructured":"Chen, Z., Wang, W., Tian, H., Ye, S., Gao, Z., Cui, E., Tong, W., Hu, K., Luo, J., Ma, Z., and others (2024). How far are we to gpt-4v? closing the gap to commercial multimodal models with open-source suites. arXiv preprint arXiv:2404.16821.","DOI":"10.1007\/s11432-024-4231-5"},{"key":"2613_CR20","unstructured":"Chu, Y., Xu, J., Yang, Q., Wei, H., Wei, X., Guo, Z., Leng, Y., Lv, Y., He, J., Lin, J., Zhou, C., & Zhou, J. (2024). Qwen2-audio technical report."},{"key":"2613_CR21","unstructured":"Chu, Y., Xu, J., Zhou, X., Yang, Q., Zhang, S., Yan, Z., Zhou, C., & Zhou, J. (2023). Qwen-audio: Advancing universal audio understanding via unified large-scale audio-language models."},{"issue":"1","key":"2613_CR22","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1177\/001316446002000104","volume":"20","author":"J Cohen","year":"1960","unstructured":"Cohen, J. (1960). A coefficient of agreement for nominal scales. Educational and psychological measurement, 20(1), 37\u201346.","journal-title":"Educational and psychological measurement"},{"key":"2613_CR23","unstructured":"Cui, X., Aparcedo, A., Jang, Y. K., & Lim, S. (2023). On the robustness of large multimodal models against image adversarial attacks. arXiv preprintarXiv:2312.03777."},{"key":"2613_CR24","unstructured":"Cui, S., Zhang, Z., Chen, Y., Zhang, W., Liu, T., Wang, S., & Liu, T. (2023). FFT: towards harmlessness evaluation and analysis for llms with factuality, fairness, toxicity. CoRR, abs\/2311.18580."},{"key":"2613_CR25","unstructured":"Databricks. (2024). Introducing dbrx: A new state-of-the-art open llm. https:\/\/www.databricks.com\/blog\/introducing-dbrx-new-state-art-open-llm."},{"key":"2613_CR26","doi-asserted-by":"crossref","unstructured":"Deng, G., Liu, Y., Li, Y., Wang, K., Zhang, Y., Li, Z., Wang, H., Zhang, T., & Liu, Y. (2024). Masterkey: Automated jailbreaking of large language model chatbots. In Proceedings 2024 Network and Distributed System Security Symposium. Internet Society.","DOI":"10.14722\/ndss.2024.24188"},{"key":"2613_CR27","unstructured":"Esser, P., Kulal, S., Blattmann, A., Entezari, R., M\u00fcller, J., Saini, H., Levi, Y., Lorenz, D., Sauer, A., Boesel, F., Podell, D., Dockhorn, T., English, Z., Lacey, K., Goodwin, A., Marek, Y., & Rombach, R. (2024). Scaling rectified flow transformers for high-resolution image synthesis."},{"issue":"200","key":"2613_CR28","doi-asserted-by":"publisher","first-page":"675","DOI":"10.1080\/01621459.1937.10503522","volume":"32","author":"M Friedman","year":"1937","unstructured":"Friedman, M. (1937). The use of ranks to avoid the assumption of normality implicit in the analysis of variance. Journal of the american statistical association, 32(200), 675\u2013701.","journal-title":"Journal of the american statistical association"},{"key":"2613_CR29","unstructured":"Fu, C., Lin, H., Wang, X., Zhang, Y. -F., Shen, Y., Liu, X., Cao, H., Long, Z., Gao, H., Li, K., Ma, L., Zheng, X., Ji, R., Sun, X., Shan, C., & He, R. (2025). Vita-1.5: Towards gpt-4o level real-time vision and speech interaction."},{"key":"2613_CR30","doi-asserted-by":"crossref","unstructured":"Gehman, S., Gururangan, S., Sap, M., Choi, Y., & Smith, N. A. (2020). Realtoxicityprompts: Evaluating neural toxic degeneration in language models.","DOI":"10.18653\/v1\/2020.findings-emnlp.301"},{"key":"2613_CR31","first-page":"3356","volume-title":"Findings of the Association for Computational Linguistics: EMNLP 2020, Online Event, 16\u201320 November 2020, volume EMNLP 2020 of Findings of ACL","author":"S Gehman","year":"2020","unstructured":"Gehman, S., Gururangan, S., Sap, M., Choi, Y., & Smith, N. A. (2020). Realtoxicityprompts: Evaluating neural toxic degeneration in language models. In T. Cohn, Y. He, & Y. Liu (Eds.), Findings of the Association for Computational Linguistics: EMNLP 2020, Online Event, 16\u201320 November 2020, volume EMNLP 2020 of Findings of ACL (pp. 3356\u20133369). Association for Computational Linguistics."},{"key":"2613_CR32","unstructured":"Gemma Team. (2024). Gemma."},{"key":"2613_CR33","unstructured":"GLM, T., Zeng, A., Xu, B., and others (2024). Chatglm: A family of large language models from glm-130b to glm-4 all tools."},{"key":"2613_CR34","unstructured":"GLM, T., Zeng, A., Xu, B., Wang, B., and others (2024). Chatglm: A family of large language models from glm-130b to glm-4 all tools."},{"key":"2613_CR35","unstructured":"Gong, Y., Ran, D., Liu, J., Wang, C., Cong, T., Wang, A., Duan, S., & Wang, X. (2023). Figstep: Jailbreaking large vision-language models via typographic visual prompts. CoRR, abs\/2311.05608."},{"key":"2613_CR36","unstructured":"Google DeepMind. (2024). Gemini flash. https:\/\/deepmind.google\/technologies\/gemini\/flash\/."},{"key":"2613_CR37","unstructured":"Google DeepMind. (2024). Gemini pro. https:\/\/deepmind.google\/technologies\/gemini\/pro\/."},{"key":"2613_CR38","doi-asserted-by":"crossref","unstructured":"Guo, J., Bao, W., Wang, J., Ma, Y., Gao, X., Xiao, G., Liu, A., Dong, J., Liu, X., & Wu, W. (2023). A comprehensive evaluation framework for deep model robustness. Pattern Recognition.","DOI":"10.1016\/j.patcog.2023.109308"},{"key":"2613_CR39","doi-asserted-by":"crossref","unstructured":"Hartvigsen, T., Gabriel, S., Palangi, H., Sap, M., Ray, D., & Kamar, E. (2022). Toxigen: A large-scale machine-generated dataset for adversarial and implicit hate speech detection. In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio, editors, Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2022, Dublin, Ireland, May 22-27, 2022, pages 3309\u20133326. Association for Computational Linguistics.","DOI":"10.18653\/v1\/2022.acl-long.234"},{"key":"2613_CR40","unstructured":"He, M., Liu, Y., Wu, B., Yuan, J., Wang, Y., Huang, T., & Zhao, B. (2024). Efficient multimodal learning from data-centric perspective. arXiv preprint arXiv:2402.11530."},{"key":"2613_CR41","unstructured":"Holistic AI Team. (2025). Holistic AI\u2019s Grok-3 Audit: Initial Jailbreaking & Security Findings, February."},{"key":"2613_CR42","unstructured":"Huang, L., Yu, W., Ma, W., Zhong, W., Feng, Z., Wang, H., Chen, Q., Peng, W., Feng, X., Qin, B., & Liu, T. (2023). A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions. CoRR, abs\/2311.05232."},{"key":"2613_CR43","unstructured":"Inan, H., Upasani, K., Chi, J., Rungta, R., Iyer, K., Mao, Y., Tontchev, M., Hu, Q., Fuller, B., Testuggine, D., & Khabsa, M. (2023). Llama guard: Llm-based input-output safeguard for human-ai conversations."},{"key":"2613_CR44","unstructured":"Infinigence AI. (2024). Megrez-3b-omni: The first open-source end-side full modality understanding model."},{"key":"2613_CR45","unstructured":"Jiang, L., Rao, K., Han, S., Ettinger, A., Brahman, F., Kumar, S., Mireshghallah, N., Lu, X., Sap, M., Choi, Y., & Dziri, N. (2024). Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models."},{"key":"2613_CR46","unstructured":"Jiang, A. Q., Sablayrolles, A., Mensch, A., Bamford, C., Chaplot, D. S., de\u00a0las Casas, D., Bressand, F., Lengyel, G., Lample, G., Saulnier, L., Lavaud, L. R., Lachaux,M. -A., Stock, P., Le Scao, T., Lavril, T., Wang, T., Lacroix, T., & El Sayed, W. (2023). Mistral 7b."},{"key":"2613_CR47","first-page":"47094","volume":"37","author":"L Jiang","year":"2024","unstructured":"Jiang, L., Rao, K., Han, S., Ettinger, A., Brahman, F., Kumar, S., Mireshghallah, N., Lu, X., Sap, M., Choi, Y., et al. (2024). Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models. Advances in Neural Information Processing Systems, 37, 47094\u201347165.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"2613_CR48","unstructured":"Jigsaw. Perspective. [Online]. https:\/\/perspectiveapi.com\/."},{"key":"2613_CR49","doi-asserted-by":"crossref","unstructured":"Koo, R., Lee, M., Raheja, V., Park, J. I., Kim, Z. M., & Kang, D. (2024). Benchmarking cognitive biases in large language models as evaluators.","DOI":"10.18653\/v1\/2024.findings-acl.29"},{"key":"2613_CR50","unstructured":"Lacombe, Y., Srivastav, V., & Gandhi, S. (2024). Parler-tts. https:\/\/github.com\/huggingface\/parler-tts."},{"key":"2613_CR51","unstructured":"Lee, J., Cha, S., Lee, Y., & Yang, C. (2024). Visual question answering instruction: Unlocking multimodal large language model to domain-specific visual multitasks. arXiv preprint arXiv:2402.08360."},{"key":"2613_CR52","doi-asserted-by":"crossref","unstructured":"Li, H., Guo, D., Li, D., Fan, W., Hu, Q., Liu, X., Chan, C., Yao, D., Yao, Y., & Song, Y. (2024). Privlm-bench: A multi-level privacy evaluation benchmark for language models. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors, Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2024, Bangkok, Thailand, August 11-16, 2024, pages 54\u201373. Association for Computational Linguistics.","DOI":"10.18653\/v1\/2024.acl-long.4"},{"key":"2613_CR53","doi-asserted-by":"crossref","unstructured":"Li, M., Li, L., Yin, Y., Ahmed, M., Liu, Z., & Liu, Q. (2024). Red teaming visual language models.","DOI":"10.18653\/v1\/2024.findings-acl.198"},{"key":"2613_CR54","unstructured":"Li, X., Liang, S., Zhang, J., Fang, H., Liu, A., & Chang, E. -C. (2024). Semantic mirror jailbreak: Genetic algorithm based jailbreak prompts against open-source llms. arXiv preprintarXiv:2402.14872."},{"key":"2613_CR55","unstructured":"Liang, J., Liang, S., Liu, A., Jia, X., Kuang, J., & Cao, X. (2024). Poisoned forgery face: Towards backdoor attacks on face forgery detection. arXiv preprint arXiv:2402.11473."},{"key":"2613_CR56","doi-asserted-by":"crossref","unstructured":"Liang, S., Zhu, M., Liu, A., Wu, B., Cao, X., & Chang, E. -C. (2023). Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning. arXiv preprint arXiv:2311.12075.","DOI":"10.1109\/CVPR52733.2024.02327"},{"key":"2613_CR57","first-page":"16160","volume-title":"Findings of the Association for Computational Linguistics, ACL 2024, Bangkok, Thailand and virtual meeting, August 11\u201316, 2024","author":"M Li","year":"2024","unstructured":"Li, M., Chen, J., Chen, L., & Zhou, T. (2024). Can llms speak for diverse people? tuning llms via debate to generate controllable controversial statements. In K. Lun-Wei, A. Martins, & V. Srikumar (Eds.), Findings of the Association for Computational Linguistics, ACL 2024, Bangkok, Thailand and virtual meeting, August 11\u201316, 2024 (pp. 16160\u201316176). Association for Computational Linguistics."},{"key":"2613_CR58","doi-asserted-by":"crossref","unstructured":"Lin, S., Hilton, J., & Evans, O. (2022). Truthfulqa: Measuring how models mimic human falsehoods. In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio, editors, Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2022, Dublin, Ireland, May 22-27, 2022, pages 3214\u20133252. Association for Computational Linguistics.","DOI":"10.18653\/v1\/2022.acl-long.229"},{"key":"2613_CR59","unstructured":"Lin, W., Wei, X., An, R., Gao, P., Zou, B., Luo, Y., Huang, S., Zhang, S., & Li, H. (2024). Draw-and-understand: Leveraging visual prompts to enable mllms to comprehend what you want."},{"key":"2613_CR60","unstructured":"Liu, H., Li, C., Li, Y., Li, B., Zhang, Y., Shen, S., & Lee, Y. J. (2024). Llava-next: Improved reasoning, ocr, and world knowledge, January."},{"key":"2613_CR61","doi-asserted-by":"crossref","unstructured":"Liu, A., Liu, X., Yu, H., Zhang, C., Liu, Q., & Tao, D. (2021). Training robust deep neural networks via adversarial noise propagation. TIP.","DOI":"10.1109\/TIP.2021.3082317"},{"key":"2613_CR62","doi-asserted-by":"crossref","unstructured":"Liu, Z., Opazo, C.R., Teney, D., & Gould, S.(2021). Image retrieval on real-life images with pre-trained vision-and-language models. In IEEE\/CVF International Conference on Computer Vision.","DOI":"10.1109\/ICCV48922.2021.00213"},{"key":"2613_CR63","unstructured":"Liu, X., Xu, N., Chen, M., & Xiao, C. (2024). Autodan: Generating stealthy jailbreak prompts on aligned large language models."},{"key":"2613_CR64","unstructured":"Liu, A., Zhang, X., Xiao, Y., Zhou, Y., Liang, S., Wang, J., Liu, X., Cao, X., & Tao, D. (2023). Pre-trained trojan attacks for visual recognition. arXiv preprint arXiv:2312.15172."},{"key":"2613_CR65","doi-asserted-by":"crossref","unstructured":"Liu, X., Zhu, Y., Gu, J., Lan, Y., Yang, C., & Qiao, Y. (2024). Mm-safetybench: A benchmark for safety evaluation of multimodal large language models.","DOI":"10.1007\/978-3-031-72992-8_22"},{"key":"2613_CR66","unstructured":"Luo, H., Gu, J., Liu, F., Torr, P. (2024). An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models. arXiv preprintarXiv:2403.09766."},{"key":"2613_CR67","unstructured":"Luo, W., Ma, S., Liu, X., Guo, X., & Xiao, C. (2024). Jailbreakv-28k: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. CoRR, abs\/2404.03027."},{"key":"2613_CR68","unstructured":"Luo, W., Ma, S., Liu, X., Guo, X., & Xiao, C. (2024). Jailbreakv-28k: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks."},{"key":"2613_CR69","unstructured":"Mazeika, M., Phan, L., Yin, X., Zou, A., Wang, Z., Mu, N., Sakhaee, E., Li, N., Basart, S., Li, B., and others (2024). Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprintarXiv:2402.04249."},{"key":"2613_CR70","unstructured":"Mazeika, M., Phan, L., Yin, X., Zou, A., Wang, Z., Mu, N., Sakhaee, E., Li, N., Basart, S., Li, B., Forsyth, D., & Hendrycks, D. (2024). Harmbench: A standardized evaluation framework for automated red teaming and robust refusal."},{"key":"2613_CR71","unstructured":"Mehrotra, A., Zampetakis, M., Kassianik, P., Nelson, B., Anderson, H. S., Singer, Y., & Karbasi, A. (2023). Tree of attacks: Jailbreaking black-box llms automatically. CoRR, abs\/2312.02119."},{"key":"2613_CR72","unstructured":"Meta. Use-policy. [Online]. https:\/\/ai.meta.com\/llama\/use-policy\/."},{"key":"2613_CR73","unstructured":"Microsoft. (2024). Phi-3.5-vision-instruct. online."},{"key":"2613_CR74","unstructured":"Microsoft. (2024). Phi-3-vision-128k-instruct. online."},{"key":"2613_CR75","unstructured":"Mixtral AI. (2023). A high quality sparse mixture-of-experts. https:\/\/mistral.ai\/news\/mixtral-of-experts\/."},{"key":"2613_CR76","unstructured":"Muscato, B., Mala, C. S., Manerba, M. M., Gezici, G., & Giannotti, F. (2024). An overview of recent approaches to enable diversity in large language models through aligning with human perspectives. In Proceedings of the 3rd Workshop on Perspectivist Approaches to NLP (NLPerspectives)@ LREC-COLING 2024, pages 49\u201355."},{"key":"2613_CR77","unstructured":"OpenAI. (2024). Gpt-4o mini: advancing cost-efficient intelligence. https:\/\/openai.com\/index\/gpt-4o-mini-advancing-cost-efficient-intelligence\/."},{"key":"2613_CR78","unstructured":"OpenAI. (2024). Gpt-4o system card. https:\/\/openai.com\/index\/gpt-4o-system-card."},{"key":"2613_CR79","unstructured":"OpenAI. (2025). Moderation guide, Accessed: 2025-02-22."},{"key":"2613_CR80","unstructured":"OpenAI, Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F. L., and others (2024). Gpt-4 technical report. arXiv preprint arXiv:2303.08774"},{"key":"2613_CR81","unstructured":"Ouyang, L., Wu, J., Diogo Almeida, X. J., and others (2022). Training language models to follow instructions with human feedback. In Sanmi Koyejo, S.\u00a0Mohamed, A.\u00a0Agarwal, Danielle Belgrave, K.\u00a0Cho, and A.\u00a0Oh, editors, Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, LA, USA, November 28 - December 9, 2022."},{"key":"2613_CR82","doi-asserted-by":"crossref","unstructured":"Qi, X., Huang, K., Panda, A., Henderson, P., Wang, M., & Mittal, P. (2024). Visual adversarial examples jailbreak aligned large language models. In Michael\u00a0J. Wooldridge, Jennifer\u00a0G. Dy, and Sriraam Natarajan, editors, Thirty-Eighth AAAI Conference on Artificial Intelligence, AAAI 2024, Thirty-Sixth Conference on Innovative Applications of Artificial Intelligence, IAAI 2024, Fourteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2014, February 20-27, 2024, Vancouver, Canada, pages 21527\u201321536. AAAI Press.","DOI":"10.1609\/aaai.v38i19.30150"},{"key":"2613_CR83","doi-asserted-by":"crossref","unstructured":"Qi, X., Huang, K., Panda, A., Henderson, P, Wang, M., & Mittal, P. (2023). Visual adversarial examples jailbreak aligned large language models.","DOI":"10.1609\/aaai.v38i19.30150"},{"key":"2613_CR84","unstructured":"Qwen. (2024). Qwen2-vl-7b-instruct model card. https:\/\/huggingface.co\/Qwen\/Qwen2-VL-7B-Instruct."},{"key":"2613_CR85","unstructured":"QwenLM. (2025). Qwen3guard technical report. https:\/\/github.com\/QwenLM\/Qwen3Guard\/blob\/main\/Qwen3Guard_Technical_Report.pdf, 2025. Retrieved September 27."},{"key":"2613_CR86","unstructured":"Rafailov, R., Sharma, A., Mitchell, E., Manning, C. D., Ermon, S., & Finn, C. (2023). Direct preference optimization: Your language model is secretly a reward model. In Alice Oh, Tristan Naumann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine, editors, Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - 16, 2023."},{"key":"2613_CR87","unstructured":"Ran, D., Liu, J., Gong, Y., Zheng, J., He, X., Cong, T., & Wang, A. (2024). Jailbreakeval: An integrated toolkit for evaluating jailbreak attempts against large language models. CoRR, abs\/2406.09321."},{"key":"2613_CR88","doi-asserted-by":"crossref","unstructured":"Schlarmann, C., & Hein, M. (2023). On the adversarial robustness of multi-modal foundation models. In IEEE\/CVF International Conference on Computer Vision.","DOI":"10.1109\/ICCVW60793.2023.00395"},{"key":"2613_CR89","unstructured":"Shayegani, E., Dong, Y., & Abu-Ghazaleh, N. (2023). Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. arXiv preprint arXiv:2307.14539."},{"key":"2613_CR90","unstructured":"Shayegani, E., Dong, Y., & Abu-Ghazaleh, N. (2024). Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. In International Conference on Learning Representations."},{"key":"2613_CR91","doi-asserted-by":"crossref","unstructured":"Shen, X., Chen, Z., Backes, M., Shen, Y., & Zhang, Y. (2024). \" do anything now\": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1671\u20131685.","DOI":"10.1145\/3658644.3670388"},{"issue":"2","key":"2613_CR92","doi-asserted-by":"publisher","first-page":"420","DOI":"10.1037\/0033-2909.86.2.420","volume":"86","author":"PE Shrout","year":"1979","unstructured":"Shrout, P. E., & Fleiss, J. L. (1979). Intraclass correlations: uses in assessing rater reliability. Psychological bulletin, 86(2), 420.","journal-title":"Psychological bulletin"},{"key":"2613_CR93","unstructured":"Tang, S., Gong, R., Wang, Y., Liu, A., Wang, J., Chen, X., Yu, F., Liu, X., Song, D., & Yuille, A., and others. (2021). Benchmarking robustness on architecture design and training techniques. ArXiv: Robustart."},{"key":"2613_CR94","unstructured":"Team, G., Anil, R., Borgeaud, S., Alayrac, J. -B., Yu, J., and others. (2024). A family of highly capable multimodal models: Gemini."},{"key":"2613_CR95","unstructured":"Thakur, A. S., Choudhary, K., Ramayapally, V. S., Vaidyanathan, S., & Hupkes, D. (2024). Judging the judges: Evaluating alignment and vulnerabilities in llms-as-judges. CoRR, abs\/2406.12624."},{"key":"2613_CR96","unstructured":"Tu, H., Cui, C., Wang, Z., Zhou, Y., Zhao, B., Han, J., Zhou, W., Yao, H., & Xie, C. (2023). How many unicorns are in this image? A safety evaluation benchmark for vision llms. CoRR, abs\/2311.16101."},{"key":"2613_CR97","unstructured":"Wang, E., Cassano, F., Wu, C., Bai, Y., Song, W., Nath, V., Han, Z., Hendryx, S., Yue, S., & Zhang, H. (2024). Planning in natural language improves llm search for code generation."},{"key":"2613_CR98","unstructured":"Wang, W., Lv, Q., Yu, W., Hong, W., Qi, J., Wang, Y., Ji, J., Yang, Z., Zhao, L., Song, X., Xu, J., Xu, B., Li, J., Dong, Y., Ding, M., & Tang, J. (2023). Cogvlm: Visual expert for pretrained language models."},{"key":"2613_CR99","unstructured":"Wang, S., Ye, X., Cheng, Q., Duan, J., Li, S., Fu, J., Qiu, X., & Huang, X. (2024). Cross-modality safety alignment."},{"key":"2613_CR100","unstructured":"Wei, A., Haghtalab, N., & Steinhardt, J. (2023). Jailbroken: How does LLM safety training fail? In Advances in Neural Information Processing Systems."},{"key":"2613_CR101","unstructured":"Wei, J., Wang, X., Schuurmans, D., Bosma, M., Ichter, B., Xia, F., Chi, E., Le, Q., & Zhou, D. (2023). Chain-of-thought prompting elicits reasoning in large language models."},{"key":"2613_CR102","unstructured":"xAI. (2025). Grok 3 beta \u2013 the age of reasoning agents, February."},{"key":"2613_CR103","unstructured":"Xia, Y. M. M., & Chen, D. (2024). Simpo: Simple preference optimization with a reference-free reward. CoRR, abs\/2405.14734."},{"key":"2613_CR104","unstructured":"Xie, Z., & Wu, C. (2024). Mini-omni: Language models can hear, talk while thinking in streaming."},{"key":"2613_CR105","unstructured":"Xie, T., Qi, X., Zeng, Y., Huang, Y., Sehwag, U. M., Huang, K., He, L., Wei, B., Li, D., Sheng, Y., Jia, R., Li, B., Li, K., Chen, D., Henderson, P., & Mittal, P. (2024). Sorry-bench: Systematically evaluating large language model safety refusal behaviors."},{"key":"2613_CR106","unstructured":"Xu, Z., Jain, S., & Kankanhalli, M. S. (2024). Hallucination is inevitable: An innate limitation of large language models. CoRR, abs\/2401.11817."},{"key":"2613_CR107","doi-asserted-by":"crossref","unstructured":"Yang, Y., Li, Z., Dong, Q., Xia, H., & Sui, Z. (2024). Can large multimodal models uncover deep semantics behind images? In K. Lun-Wei, A. Martins, & V. Srikumar (Eds.), Findings of the Association for Computational Linguistics, ACL 2024, Bangkok, Thailand and virtual meeting, August 11\u201316, 2024 (pp. 1898\u20131912). Association for Computational Linguistics.","DOI":"10.18653\/v1\/2024.findings-acl.113"},{"key":"2613_CR108","unstructured":"Yao, Y., Yu, T., Zhang, A., Wang, C., Cui, J., Zhu, H., Cai, T., Li, H., Zhao, W., He, Z., and others (2024). Minicpm-v: A gpt-4v level mllm on your phone. arXiv preprintarXiv:2408.01800."},{"key":"2613_CR109","unstructured":"Yao, Y., Yu, T., Zhang, A., Wang, C., Cui, J., Zhu, H., Cai, T., Li, H., Zhao, W., He, Z., and others (2024). Minicpm-v: A gpt-4v level mllm on your phone. arXiv preprintarXiv:2408.01800."},{"key":"2613_CR110","unstructured":"Ying, Z., Liu, A., Liu, X., & Tao, D. (2024). Unveiling the safety of gpt-4o: An empirical study using jailbreak attacks. CoRR, abs\/2406.06302."},{"key":"2613_CR111","unstructured":"Ying, Z., Liu, A., Zhang, T., Yu, Z., Liang, S., Liu, X., & Tao, D. (2024). Jailbreak vision language models via bi-modal adversarial prompt. arXiv preprintarXiv:2406.04031."},{"key":"2613_CR112","unstructured":"Ying, Z., Liu, A., Zhang, T., Yu, Z., Liang, S., Liu, X., & Tao, D. (2024). Jailbreak vision language models via bi-modal adversarial prompt. CoRR, abs\/2406.04031."},{"key":"2613_CR113","unstructured":"Young, A., Chen, B., Li, C., and others (2024). Yi: Open foundation models by 01.ai."},{"key":"2613_CR114","unstructured":"Yu, J., Lin, X., Yu, Z., & Xing, X. (2023). GPTFUZZER: red teaming large language models with auto-generated jailbreak prompts. arXiv preprint arXiv:2309.10253."},{"key":"2613_CR115","doi-asserted-by":"crossref","unstructured":"Zeng, Y., Lin, H., Zhang, J., Yang, D., Jia, R., & Shi, W. (2024). How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms.","DOI":"10.18653\/v1\/2024.acl-long.773"},{"key":"2613_CR116","unstructured":"Zeng, Z., Yu, J., Gao, T., Meng, Y., Goyal, T., & Chen. D. (2024). Evaluating large language models at evaluating instruction following."},{"key":"2613_CR117","unstructured":"Zhang, Y., Huang, Y., Sun, Y., Liu, C., Zhao, Z., Fang, Z., Wang, Y., Chen, H., Yang, X., Wei, X., Su, H., Dong, Y., & Zhu, J. (2024). Benchmarking trustworthiness of multimodal large language models: A comprehensive study."},{"key":"2613_CR118","doi-asserted-by":"crossref","unstructured":"Zhang, H., Shao, W., Liu, H., Ma, Y., Luo, P., Qiao, Y., & Zhang, K. (2024). Avibench: Towards evaluating the robustness of large vision-language model on adversarial visual-instructions.","DOI":"10.1109\/TIFS.2024.3520306"},{"key":"2613_CR119","unstructured":"Zhang, Z., Zhang, A., Li, M., Zhao, H., Karypis, G., & Smola, A. (2024). Multimodal chain-of-thought reasoning in language models."},{"key":"2613_CR120","unstructured":"Zhao, W., Ren, X., Hessel, J., Cardie, C., Choi, Y., & Deng, Y. (2024). Wildchat: 1m chatgpt interaction logs in the wild. arXiv preprint arXiv:2405.01470."},{"key":"2613_CR121","unstructured":"Zheng, L., Chiang, W. -L., Sheng, Y., Li, T., Zhuang, S., Wu, Z., Zhuang, Y., Li, Z., Lin, Z., Xing, E. P., and others (2023). Lmsys-chat-1m: A large-scale real-world llm conversation dataset. arXiv preprintarXiv:2309.11998."},{"key":"2613_CR122","unstructured":"Zheng, L., Chiang, W., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., Lin, Z., Li, Z., Li, D., Xing, E. P., Zhang, H., Gonzalez, J. E., & Stoica, I. (2023). Judging llm-as-a-judge with mt-bench and chatbot arena. In Alice Oh, Tristan Naumann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine, editors, Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - 16, 2023."},{"key":"2613_CR123","unstructured":"Zou, A., Wang, Z., Kolter, J. Z., & Fredrikson, M. (2023). Universal and transferable adversarial attacks on aligned language models. CoRR, abs\/2307.15043."}],"container-title":["International Journal of Computer Vision"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-025-02613-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11263-025-02613-1","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-025-02613-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,20]],"date-time":"2026-02-20T15:39:06Z","timestamp":1771601946000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11263-025-02613-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12,26]]},"references-count":123,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2026,1]]}},"alternative-id":["2613"],"URL":"https:\/\/doi.org\/10.1007\/s11263-025-02613-1","relation":{},"ISSN":["0920-5691","1573-1405"],"issn-type":[{"value":"0920-5691","type":"print"},{"value":"1573-1405","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,12,26]]},"assertion":[{"value":"26 September 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"12 November 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"26 December 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"This study aims to investigate the safety risks associated with MLLMs. While our evaluation may produce potentially unsafe content that could be harmful to readers, we emphasize that our intention is not to cause harm. On the contrary, our work is designed to promote the importance of safety assessments for MLLMs and to provide a foundation for future red team testing methodologies, such as jailbreak techniques, by developing novel datasets and evaluation protocols. We are committed to responsible research in the development of\n                      SafeBench\n                      . For our supplementary dataset of \u201cin-the-wild\u201d queries from public platforms, we adhered to platform policies, performed rigorous PII anonymization, and operated under the Fair Use principle for academic research. We acknowledge the inherent biases in such data but include it in the spirit of responsible disclosure, believing that understanding real-world risks is crucial for building safer MLLMs.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical statement and broader impact"}}],"article-number":"18"}}