title: MSTS: A Multimodal Safety Test Suite for Vision-Language Models
summary: Vision-language models (VLMs), which process image and text inputs, are
  increasingly integrated into chat assistants and other consumer AI
  applications. Without proper safeguards, however, VLMs may give harmful advice
  (e.g. how to self-harm) or encourage unsafe behaviours (e.g. to consume drugs).
  Despite these clear hazards, little work so far has evaluated VLM safety and
  the novel risks created by multimodal inputs. To address this gap, we introduce
  MSTS, a Multimodal Safety Test Suite for VLMs. MSTS comprises 400 test prompts
  across 40 fine-grained hazard categories. Each test prompt consists of a text
  and an image that only in combination reveal their full unsafe meaning. With
  MSTS, we find clear safety issues in several open VLMs. We also find some VLMs
  to be safe by accident, meaning that they are safe because they fail to
  understand even simple test prompts. We translate MSTS into ten languages,
  showing non-English prompts to increase the rate of unsafe model responses. We
  also show models to be safer when tested with text only rather than multimodal
  prompts. Finally, we explore the automation of VLM safety assessments, finding
  even the best safety classifiers to be lacking.
paper_authors._id: 678e6e149abc7b5b42df8807
paper_authors.name: Paul Röttger
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:50:28.923Z
paper_authors._id: 602ce925374a0dbe5856eca1
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/602ce925374a0dbe5856eca1/lBvTn6hYOCF0ggD-rk_mf.jpeg
paper_authors.fullname: Paul Röttger
paper_authors.type: user
paper_authors.user: Paul
paper_authors._id: 678e6e149abc7b5b42df8808
paper_authors.name: Giuseppe Attanasio
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:50:34.269Z
paper_authors._id: 60d494e250c47659f83f5cd0
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/1670856721262-60d494e250c47659f83f5cd0.png
paper_authors.fullname: Giuseppe Attanasio
paper_authors.type: user
paper_authors.user: g8a9
paper_authors._id: 678e6e149abc7b5b42df8809
paper_authors.name: Felix Friedrich
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:50:41.413Z
paper_authors._id: 62e7dd4036a8e8a82700041c
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/62e7dd4036a8e8a82700041c/Dgk9mXYLVd4LpiNLWjn-q.jpeg
paper_authors.fullname: Felix Friedrich
paper_authors.type: user
paper_authors.user: felfri
paper_authors._id: 678e6e149abc7b5b42df880a
paper_authors.name: Janis Goldzycher
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:50:46.971Z
paper_authors._id: 62cd7047c4eb470b622a5017
paper_authors.avatarUrl: /avatars/94f9cf171dcc7e114b56a9b3100b44d4.svg
paper_authors.fullname: Janis Goldzycher
paper_authors.type: user
paper_authors.user: jagoldz
paper_authors._id: 678e6e149abc7b5b42df880b
paper_authors.name: Alicia Parrish
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:50:52.506Z
paper_authors._id: 659d71eaf0ae1a57ae140831
paper_authors.avatarUrl: /avatars/b9eb8c70b4fe5dbd0f1555602ae41b65.svg
paper_authors.fullname: Alicia Parrish
paper_authors.type: user
paper_authors.user: avparrish
paper_authors._id: 678e6e149abc7b5b42df880c
paper_authors.name: Rishabh Bhardwaj
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:53:17.453Z
paper_authors._id: 5f278507e923d665e616271b
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/5f278507e923d665e616271b/tWFuswXOTXtvMdL8zSrr_.png
paper_authors.fullname: Rishabh Bhardwaj
paper_authors.type: user
paper_authors.user: RishabhBhardwaj
paper_authors._id: 678e6e149abc7b5b42df880d
paper_authors.name: Chiara Di Bonaventura
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:53:11.524Z
paper_authors._id: 62de70fb86220b5cb895e199
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/62de70fb86220b5cb895e199/k7w8pTBIvCwkrTksQJ7GM.jpeg
paper_authors.fullname: Chiara Di Bonaventura
paper_authors.type: user
paper_authors.user: dibo
paper_authors._id: 678e6e149abc7b5b42df880e
paper_authors.name: Roman Eng
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:53:04.803Z
paper_authors._id: 641f6e40f8c8b04c0babc208
paper_authors.avatarUrl: /avatars/02438bebb15ca8aea8126e726896d158.svg
paper_authors.fullname: Roman Eng
paper_authors.type: user
paper_authors.user: romaneng
paper_authors._id: 678e6e149abc7b5b42df880f
paper_authors.name: Gaia El Khoury Geagea
paper_authors._id: 678e6e149abc7b5b42df8810
paper_authors.name: Sujata Goswami
paper_authors._id: 678e6e149abc7b5b42df8811
paper_authors.name: Jieun Han
paper_authors._id: 678e6e149abc7b5b42df8812
paper_authors.name: Dirk Hovy
paper_authors._id: 678e6e149abc7b5b42df8813
paper_authors.name: Seogyeong Jeong
paper_authors._id: 678e6e149abc7b5b42df8814
paper_authors.name: Paloma Jeretič
paper_authors._id: 678e6e149abc7b5b42df8815
paper_authors.name: Flor Miriam Plaza-del-Arco
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:52:00.837Z
paper_authors._id: 60f7ec6ad51f9e10a4f422af
paper_authors.avatarUrl: /avatars/12ac5037657cfba4e2b48b08c688a629.svg
paper_authors.fullname: Flor Miriam Plaza-del-Arco
paper_authors.type: user
paper_authors.user: fmplaza
paper_authors._id: 678e6e149abc7b5b42df8816
paper_authors.name: Donya Rooein
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:51:51.329Z
paper_authors._id: 64074d104dc5f2846c95db00
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/64074d104dc5f2846c95db00/8T4KCvjdjSldDwwTOZreF.jpeg
paper_authors.fullname: Donya Rooein
paper_authors.type: user
paper_authors.user: Donya
paper_authors._id: 678e6e149abc7b5b42df8817
paper_authors.name: Patrick Schramowski
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:51:44.897Z
paper_authors._id: 62d021a3dd7bdfc5e5c61c5c
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/62d021a3dd7bdfc5e5c61c5c/bnQW2SqirfGaQmI84HW_c.jpeg
paper_authors.fullname: Patrick Schramowski
paper_authors.type: user
paper_authors.user: PSaiml
paper_authors._id: 678e6e149abc7b5b42df8818
paper_authors.name: Anastassia Shaitarova
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:51:39.084Z
paper_authors._id: 650b2163a27ba14323dafc03
paper_authors.avatarUrl: /avatars/9ff16cbceaee57601aed6ac8a9711171.svg
paper_authors.fullname: Anastassia Shaitarova
paper_authors.type: user
paper_authors.user: ShaitanRa
paper_authors._id: 678e6e149abc7b5b42df8819
paper_authors.name: Xudong Shen
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:51:32.813Z
paper_authors._id: 63c628610be43255f36f2a40
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/1673930799006-noauth.jpeg
paper_authors.fullname: Xudong Shen
paper_authors.type: user
paper_authors.user: XudongShen
paper_authors._id: 678e6e149abc7b5b42df881a
paper_authors.name: Richard Willats
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:51:26.120Z
paper_authors._id: 6718ff9d04139dd58a39e63b
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/6718ff9d04139dd58a39e63b/nw5xku95PFTQEqs0O3Prm.jpeg
paper_authors.fullname: Richard WIllats
paper_authors.type: user
paper_authors.user: rwillats
paper_authors._id: 678e6e149abc7b5b42df881b
paper_authors.name: Andrea Zugarini
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-01-22T20:51:19.992Z
paper_authors._id: 6426a5c798a5be164d38ae44
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/6426a5c798a5be164d38ae44/3crh3dtGViXB_xlDW_WeM.jpeg
paper_authors.fullname: Andrea Zugarini
paper_authors.type: user
paper_authors.user: azugarini
paper_authors._id: 678e6e149abc7b5b42df881c
paper_authors.name: Bertie Vidgen
paper_title: MSTS: A Multimodal Safety Test Suite for Vision-Language Models
paper_summary: Vision-language models (VLMs), which process image and text inputs, are
  increasingly integrated into chat assistants and other consumer AI
  applications. Without proper safeguards, however, VLMs may give harmful advice
  (e.g. how to self-harm) or encourage unsafe behaviours (e.g. to consume drugs).
  Despite these clear hazards, little work so far has evaluated VLM safety and
  the novel risks created by multimodal inputs. To address this gap, we introduce
  MSTS, a Multimodal Safety Test Suite for VLMs. MSTS comprises 400 test prompts
  across 40 fine-grained hazard categories. Each test prompt consists of a text
  and an image that only in combination reveal their full unsafe meaning. With
  MSTS, we find clear safety issues in several open VLMs. We also find some VLMs
  to be safe by accident, meaning that they are safe because they fail to
  understand even simple test prompts. We translate MSTS into ten languages,
  showing non-English prompts to increase the rate of unsafe model responses. We
  also show models to be safer when tested with text only rather than multimodal
  prompts. Finally, we explore the automation of VLM safety assessments, finding
  even the best safety classifiers to be lacking.
paper_ai_summary: MSTS, a Multimodal Safety Test Suite, identifies safety issues in VLMs by evaluating responses to multimodal prompts across various hazard categories.
paper_ai_keywords: Vision-language models VLMs Multimodal Safety Test Suite MSTS hazard categories multimodal inputs safety assessments safety classifiers