Research map / Vision-language and multimodal / Multimodal LLMs

When Understanding Becomes a Risk: Authenticity and Safety Risks in the Emerging Image Generation Paradigm

CVPR 2026 · Vision-language and multimodal › Multimodal LLMs · approach: Benchmarks and analysis of MLLMs · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Systematically compares safety risks of unified MLLM image generators (Bagel, Janus, Janus Pro, TokenFlow, VILA-U) against diffusion models (SD3.5 Large/Turbo) on unsafe content generation and evasion of fake-image detectors.

Problem

Whether emerging MLLM-based image generators, with stronger semantic understanding, pose greater safety risks than diffusion models in generating unsafe content and evading fake image detection.

Approach

Uses diffusion models as a reference to measure unsafe-generation scores across five unsafe prompt datasets (including a new TemplateLong and Chinese translation) and detection accuracy of four detectors, attributing the MLLM gap to better semantic comprehension while diffusion models produce damaged images that evade the safety classifier.

Key results

• On TemplateLong, SD3.5 Large and Turbo average unsafe scores are 0.280 and 0.200, while Janus Pro reaches 0.613 and TokenFlow is the lowest MLLM at 0.300.
• Under Chinese prompts (TemplateLongChinese), both diffusion models score 0.000 while Bagel averages 0.407 and VILA-U 0.243.
• For DE-FAKE trained from scratch, accuracy on VILA-U drops from 0.982 (v0) to 0.877 (v2) and TokenFlow from 0.934 to 0.799, while diffusion models stay near 0.997.

Surprising findings

• Diffusion models' apparent safety largely stems from producing damaged or semantically unrelated images (e.g., 80% damaged for SD3.5 Large on unsafe prompts), which the safety classifier labels as safe.
• Both diffusion models produce zero unsafe scores on Chinese prompts, indicating the apparent safety is an artifact of limited multilingual comprehension.

Limitations

• Only seven main-text models (five MLLMs, two diffusion) and no proprietary MLLM coverage.
• Not every unsafe prompt produces unsafe images, possibly biasing results.
• Gender analysis limited to binary perception by two annotators on 10 prompts.

Experimental setup

Datasets: Lexica 4chan Template I2P TemplateLong TemplateLongChinese MSCOCO Flickr30k

Benchmarks: Lexica 4chan Template I2P TemplateLong TemplateLongChinese MSCOCO Flickr30k

Metrics: unsafe score damaged image rate detection accuracy female/male proportion agreement with human labels

Baselines: SD3.5 Large SD3.5 Large Turbo DALL·E-2 FLUX.1-schnell

Builds on: Unsafe Diffusion DE-FAKE Stable Diffusion 3.5

Closest papers by meaning

• MLLMGuard: A Multi-dimensional Safety Evaluation Suite for Multimodal Large Language Models (NeurIPS 2024 · similarity 0.90)
• SDEval: Safety Dynamic Evaluation for Multimodal Large Language Models (AAAI 2026 · similarity 0.89)
• Multimodal Situational Safety (ICLR 2025 · similarity 0.89)
• MultiTrust: A Comprehensive Benchmark Towards Trustworthy Multimodal Large Language Models (NeurIPS 2024 · similarity 0.88)
• Do We Really Need Curated Malicious Data for Safety Alignment in Multi-modal Large Language Models? (CVPR 2025 · similarity 0.88)
• VLSU: Mapping the Limits of Joint Multimodal Understanding for AI Safety (ICLR 2026 · similarity 0.88)