Research map / Vision-language and multimodal / Multimodal LLMs
MMDT: Decoding the Trustworthiness and Safety of Multimodal Foundation Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces MMDT, a unified benchmark platform evaluating text-to-image and image-to-text multimodal foundation models across safety, hallucination, fairness, privacy, adversarial robustness, and OOD robustness.
Problem
Existing multimodal benchmarks mostly assess helpfulness or cover only narrow trustworthiness perspectives (e.g., fairness or privacy), leaving MMFM safety and trustworthiness under-evaluated across modalities.
Approach
A single platform covering six trustworthiness perspectives for both T2I and I2T models, with red-teaming and optimization-based data generation (jailbreak suffixes, adversarial images, OOD transformations, hallucination scenarios) that selects challenging instances using surrogate models.
Key results
- Nova Canvas achieves the lowest average harmful content generation rate (0.117) among T2I models, while GPT-4V has the lowest for I2T (0.014).
- Average hallucination non-hallucination accuracy is below 50% for all MMFMs; Nova Pro scores highest among I2T at 46.9% and Flux highest among T2I at 39.7%.
- Under adversarial inputs, the best T2I model Nova Canvas reaches 62.42% average robust accuracy and the best I2T model GPT-4o reaches 90.04% average.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GPT-4V instead of GPT-4o | I2T models · MMDT Safety, all scenarios | HGR: 0.089 -> 0.014 | Helped |
| Use Nova Canvas instead of Flux | T2I models · MMDT Safety, all scenarios | HGR: 0.306 -> 0.117 | Helped |
| Use Flux instead of DALL·E 3 | T2I models · MMDT Hallucination, average | accuracy: 38.7 -> 39.7 | Helped |
| Use Nova Pro instead of Nova Lite | I2T models · MMDT Hallucination, average | accuracy: 45.6 -> 46.9 | Helped |
| Use DALL·E 3 instead of DALL·E 2 | DALL·E family · MMDT Fairness T2I | overkill fairness score O: 0.575 -> 0.449 | Helped |
| Use GPT-4o instead of Llama-3.2 | I2T models · MMDT Fairness, overkill fairness | overkill fairness score O: 0.995 -> 0.152 | Helped |
| Use GPT-4o for inference on street-view images | I2T models · Location inference, country | accuracy: 91.03 -> 98.16 | Helped |
| Use GPT-4o instead of GPT-4V | I2T models · MMDT Adversarial Robustness, average | robust accuracy (%): 85.27 -> 90.04 | Helped |
| Use Nova Lite instead of Nova Pro | Nova family · MMDT Adversarial Robustness, average | robust accuracy (%): 78.88 -> 79.60 | Helped |
| Apply OOD transformations to inputs | MMFMs · OOD evaluation | performance: more than 15% | Hurt |
| Use image style transformations rather than image corruptions | I2T models · OOD robustness | performance | Helped |
| Evaluate with adversarial inputs rather than benign inputs | T2I models · Adversarial robustness | accuracy: higher than 10% | Hurt |
Surprising findings
- Lower bypass rate (higher rejection) does not necessarily mean safer outputs; input-level and output-level resilience are not observably correlated.
- Within the Nova family, the smaller Nova Lite shows better adversarial robustness than Nova Pro.
Limitations
- Many evaluated models are closed-source APIs, limiting reproducibility of results.
- Challenging data are selected using surrogate models, so results may depend on surrogate choice.
- Adversarial and red-team data are kept private for future evaluations, limiting public access to some data.
Experimental setup
Datasets: MS COCO Re-LAION-2B-EN-Research-Safe HRS-Bench Selfies&IDs Images Dataset
Benchmarks: MMDT-Safety MMDT-Hallucination MMDT-Fairness MMDT-Privacy MMDT-Adv MMDT-OOD
Metrics: Bypass Rate Harmful content Generation Rate accuracy group unfairness individual unfairness overkill fairness refusal rate robust accuracy CLIP similarity
Baselines: DALL·E 2 DALL·E 3 SDXL Flux GPT-4V GPT-4o Gemini Pro-1.5 Llama-3.2
Builds on: HRS-Bench HEx-PHI AIR-Bench 2024 GCG MS COCO
Closest papers by meaning
- VMDT: Decoding the Trustworthiness of Video Foundation Models (NeurIPS 2025 · similarity 0.88)
- MultiTrust: A Comprehensive Benchmark Towards Trustworthy Multimodal Large Language Models (NeurIPS 2024 · similarity 0.88)
- MLLMGuard: A Multi-dimensional Safety Evaluation Suite for Multimodal Large Language Models (NeurIPS 2024 · similarity 0.87)
- VLSU: Mapping the Limits of Joint Multimodal Understanding for AI Safety (ICLR 2026 · similarity 0.86)
- T2ISafety: Benchmark for Assessing Fairness, Toxicity, and Privacy in Image Generation (CVPR 2025 · similarity 0.85)
- Multimodal Situational Safety (ICLR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.