Research map / Vision-language and multimodal / Multimodal LLMs
MLLM-as-a-Judge for Image Safety without Human Labeling
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CLUE, a zero-shot, label-free framework that uses MLLMs to judge image safety against objectified constitutions via relevance scanning, precondition decomposition, debiased token-probability judgment, and cascaded reasoning.
Problem
Zero-shot image safety judgment against a written safety constitution with MLLMs is unreliable due to subjective rules, difficulty reasoning over long rules, and inherent language-prior and image-region biases; existing safety classifiers require human-labeled data and generalize poorly.
Approach
Objectify safety rules, filter rules by CLIP image-rule similarity, decompose each rule into precondition chains, and judge each precondition using debiased token probabilities (subtracting a no-image score and a centric-region-removed score), falling back to chain-of-thought reasoning when confidence is low.
Key results
- CLUE with InternVL2-76B reaches 95.9% recall, 94.8% accuracy, and 0.949 F-1 on OS Bench, versus 79.7% recall / 85.5% accuracy for the best entire-constitution baseline (InternVL2-76B direct answer).
- Relevance scanning with CLIP keeps 96.6% of ground-truth rules while filtering out 67% of rules.
- Removing debiased token probability judgment drops InternVL2-8B-AWQ accuracy from 87.4% to 66.6%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use CLUE instead of zero-shot direct-answer or whole-constitution prompting | Qwen2-VL-7B-Instruct · OS Bench | accuracy: 74.4% -> 86.3% | Helped |
| use CLUE instead of zero-shot direct-answer or whole-constitution prompting | InternVL2-8B-AWQ · OS Bench | accuracy: 69.5% -> 87.4% | Helped |
| use CLUE instead of zero-shot direct-answer or whole-constitution prompting | LLaVA-v1.6-34B · OS Bench | accuracy: 75.1% -> 86.2% | Helped |
| use CLUE instead of zero-shot direct-answer or whole-constitution prompting | InternVL2-76B · OS Bench | accuracy: 85.5% -> 94.8% | Helped |
| use CLUE instead of the strongest listed fine-tuning baseline | LLaVA-v1.6-34B · OS Bench | accuracy: 61.2% -> 86.2% | Helped |
| objectify the legs-spread safety rule (ablation) | CLUE with InternVL2-76B · OS Bench: legs-spread rule and borderline-safe images | accuracy: 74.0% -> 98.0% | Helped |
| add debiased token probability judgment (ablation) | CLUE with InternVL2-8B-AWQ · OS Bench | accuracy: 66.6% -> 87.4% | Helped |
| add debiased token probability judgment (ablation) | CLUE with InternVL2-8B-AWQ · OS Bench | F-1: 0.746 -> 0.879 | Helped |
| add precondition extraction (ablation) | CLUE with InternVL2-8B-AWQ · OS Bench | accuracy: 82.7% -> 87.4% | Helped |
| add precondition extraction (ablation) | CLUE with LLaVA-v1.6-34B · OS Bench | accuracy: 82.2% -> 86.2% | Helped |
| add score differences between whole and centric-region-removed images (ablation) | CLUE with InternVL2-8B-AWQ · OS Bench | recall: 90.5% -> 91.2% | Helped |
| add score differences between whole and centric-region-removed images (ablation) | CLUE with InternVL2-8B-AWQ · OS Bench | # Cascaded Reasoning for each Image: 1.32 -> 1.16 | Helped |
Surprising findings
- Fine-tuned safety classifiers (Q16, SD Safety Checker, NSFW Detector, LLaVA Guard) perform near chance (~60-62% accuracy) on OS Bench, indicating poor generalization beyond their training rules.
- Adding COT reasoning often hurts zero-shot baselines (e.g., Qwen2-VL-7B recall drops from 55.2% to 31.4% under prior-knowledge queries).
Limitations
- Inference is slow: about 22 to 102 seconds per image depending on model and hardware.
- OS Bench is small (about 1,400 images) and synthetic, generated with a text-to-image model.
- Thresholds and objectification rely on heuristic settings and human adjustment of parameters.
Experimental setup
Datasets: OS Bench (generated with text-to-image diffusion)
Benchmarks: OS Bench
Metrics: precision recall accuracy F-1
Baselines: Q16 Stable Diffusion Safety Checker LAION NSFW Detector LLaVA Guard Prior Knowledge direct answer Prior Knowledge COT Entire constitution direct answer Entire constitution COT
Builds on: CLIP OWLv2 LLM-as-an-Optimizer chain-of-thought prompting
Closest papers by meaning
- VLSU: Mapping the Limits of Joint Multimodal Understanding for AI Safety (ICLR 2026 · similarity 0.89)
- MLLMGuard: A Multi-dimensional Safety Evaluation Suite for Multimodal Large Language Models (NeurIPS 2024 · similarity 0.89)
- Multimodal Situational Safety (ICLR 2025 · similarity 0.89)
- SDEval: Safety Dynamic Evaluation for Multimodal Large Language Models (AAAI 2026 · similarity 0.88)
- Image Safeguarding: Reasoning with Conditional Vision Language Model and Obfuscating Unsafe Content Counterfactually (AAAI 2024 · similarity 0.88)
- When Understanding Becomes a Risk: Authenticity and Safety Risks in the Emerging Image Generation Paradigm (CVPR 2026 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.