Research map / Vision-language and multimodal / Multimodal LLMs
ELITE: Enhanced Language-Image Toxicity Evaluation for Safety
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ELITE, a toxicity-augmented rubric evaluator for VLM safety and a 4,587-pair benchmark filtered from existing benchmarks plus newly generated safe-safe/unsafe pairs, showing better human alignment than StrongREJECT.
Problem
Automated safety evaluators for vision-language models overestimate jailbreak success (e.g., counting descriptive, unhelpful responses as harmful) and existing VLM safety benchmarks have low harmfulness, ambiguous pairs, and limited image-text combination diversity.
Approach
Extends the StrongREJECT rubric with a 0-5 toxicity score multiplied into the score, so descriptive but non-harmful VLM answers are not counted as successful attacks; uses this evaluator to filter existing benchmarks and adds four generated methods (Role Playing, Fake News, Blueprint, Flowchart) to cover all safe/unsafe image-text combinations.
Key results
- The ELITE evaluator (GPT-4o) reaches AUC 0.77 against human labels versus 0.46 for StrongREJECT (GPT-4o) on 963 pairs, with 0.726 accuracy and 0.637 F1.
- Pixtral-12B is the most vulnerable model with 79.86% E-ASR on the ELITE benchmark, while GPT-4o is the most robust at 15.67%.
- On the human validation split, 67.27% of From-ELITE samples were labeled unsafe versus 11.86% of Not-From-ELITE samples.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use ELITE evaluator (toxicity-augmented rubric) instead of StrongREJECT for judging responses | VLM safety evaluation with GPT-4o judge · Human evaluation dataset (963 pairs) | AUC: 0.46 -> 0.77 | Helped |
| Filter existing benchmarks with ELITE evaluator (threshold 10) to keep only harmful pairs | ELITE benchmark vs existing VLGuard, MM-SafetyBench, MLLMGuard · LLaVa-v1.5-7B, E-ASR | E-ASR: ELITE 63.59 vs VLGuard 27.75, MM-SafetyBench 45.06, MLLMGuard 27.26 | Helped |
| Use ELITE evaluator with open-source InternVL2.5-26B judge instead of GPT-4o (ablation) | ELITE evaluator · Human evaluation dataset (963 pairs) | F1 score: 0.637 -> 0.485 | Hurt |
| Add flowchart and blueprint image-text generation methods to benchmark (ablation) | ELITE benchmark (generated) · LLaVa-v1.5-13B and DeepSeek-VL-7B, E-ASR | E-ASR: Flowchart 87.11 and Blueprint 82.00 on LLaVa-13B; Blueprint 85.00 on DeepSeek-7B | Helped |
| Filter threshold on ELITE score raised from 10 to 20 (ablation) | ELITE evaluator threshold · Human evaluation dataset (963 pairs) | Accuracy: 0.726 -> 0.728 | No clear effect |
| Lower filter threshold from 10 to 5 (ablation) | ELITE evaluator threshold · Human evaluation dataset (963 pairs) | Accuracy: 0.726 -> 0.661 | Hurt |
| Add toxicity score to rubric (ELITE vs StrongREJECT) on human-labeled 'Not From ELITE' pairs | Filtered-out samples · Additional human evaluation (228 samples) | unsafe rate by human majority vote: 67.27% From ELITE vs 11.86% Not From ELITE | Helped |
Surprising findings
- 52.54% of the excluded samples were responses that merely described the input image, showing that StrongREJECT-style scoring overcounts such descriptive answers as harmful.
- Safe-safe image-text pairs can still elicit harmful responses, and 593 such pairs were included in the generated subset.
Limitations
- Rubric-based evaluation performance depends on the capability of the judge VLM.
- Benchmark omits multi-turn jailbreak techniques.
- Threshold of 10 was not the best-performing on the human set (accuracy 0.726 at 10 vs 0.728 at 20), chosen to retain diversity.
Experimental setup
Datasets: VLGuard MLLMGuard MM-SafetyBench SIUO FigStep SPA-VL JailbreakV-28k CelebA
Benchmarks: ELITE benchmark VLGuard MM-SafetyBench MLLMGuard
Metrics: E-ASR ASR AU-ROC accuracy F1 score Pearson correlation
Baselines: StrongREJECT evaluator LlamaGuard3-Vision-11B LlavaGuard-13B OpenAI Moderation API VLGuard MM-SafetyBench MLLMGuard
Builds on: StrongREJECT AILuminate
Closest papers by meaning
- VLSU: Mapping the Limits of Joint Multimodal Understanding for AI Safety (ICLR 2026 · similarity 0.91)
- SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Models (CVPR 2025 · similarity 0.90)
- MLLMGuard: A Multi-dimensional Safety Evaluation Suite for Multimodal Large Language Models (NeurIPS 2024 · similarity 0.90)
- ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time (ICLR 2025 · similarity 0.89)
- Rethinking Bottlenecks in Safety Fine-Tuning of Vision Language Models (ICLR 2026 · similarity 0.89)
- Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models (ICML 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.