Research map / Vision-language and multimodal / Multimodal LLMs

LLaVAShield: Safeguarding Multimodal Multi-Turn Dialogues in Vision-Language Models

CVPR 2026 · Vision-language and multimodal › Multimodal LLMs · approach: VLM capability analysis · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces MMDS, a 4,484-dialogue multimodal multi-turn safety dataset built with an MCTS red-teaming framework (MMRT), and fine-tunes LLaVA-OV-7B into LLaVAShield, a dual-role safety moderator that outperforms GPT-5-mini and other moderation tools.

Problem

Content moderation for multimodal multi-turn dialogues is hard because malicious intent is concealed, risk accumulates across turns, and joint cross-modal risks arise, and existing moderators are limited to single-turn or single-modality settings with few suitable datasets.

Approach

Combine an MCTS-based multimodal multi-turn red-teaming pipeline (MMRT) for generating unsafe dialogues with a dual-role, rationale-augmented moderation model (LLaVAShield) trained on the resulting MMDS dataset, with augmentation for policy dropout, safety rewrite, perspective masking, and policy relaxation.

Key results

• LLaVAShield-7B reaches 95.71% user-side F1 and 92.24% assistant-side F1 on the MMDS test set, beating GPT-5-mini by about 20.25 and 14.31 points.
• On MM-SafetyBench LLaVAShield-7B averages 97.62% recall versus 48.44% for GPT-5-mini; on VLGuard-Test it reaches 90.55% F1 versus 86.39%.
• Under relaxed policy configurations LLaVAShield gets 0% false positive rate on both sides, while GPT-5-mini gets 30% (user) and 34% (assistant).

Surprising findings

• Removing rationales changes aggregate F1 only slightly (e.g., LLaVAShield user F1 95.71 to 95.12), suggesting limited impact on metrics.
• GPT-5-mini and Claude-3.7-Sonnet resist attacks more often than open models, yet all tested VLMs reach high attack success rates under MMRT (e.g., Qwen2.5-VL-72B 100%).

Limitations

• Training on 8 A100-class GPUs for about 3 hours, with dataset of only 4,484 dialogues.
• Test set of 330 samples and a 50-dialogue policy adaptation study; results may be sensitive to small sample size.
• Attack success rate and evaluations rely on GPT-4o/GPT-5-mini judges and a fixed MMRT budget.

Experimental setup

Datasets: MMDS MMDU-45k MM-SafetyBench VLGuard-Test

Benchmarks: MMDS test set MM-SafetyBench VLGuard-Test

Metrics: accuracy precision recall F1 false positive rate attack success rate average score gain

Baselines: GPT-5-mini GPT-4o Gemini-2.5-Pro LLaVA-OV-7B InternVL3-8B InternVL3-78B InternVL3.5-38B Qwen2.5-VL-72B-Instruct Qwen3-VL-30B-A3B-Instruct Ovis2-34B OpenAI Moderation Llama Guard-4-12B

Builds on: IDEATOR LLaVA-OV LlavaGuard Monte Carlo Tree Search

Closest papers by meaning

• Multimodal Situational Safety (ICLR 2025 · similarity 0.91)
• VLSU: Mapping the Limits of Joint Multimodal Understanding for AI Safety (ICLR 2026 · similarity 0.89)
• ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time (ICLR 2025 · similarity 0.88)
• MLLMGuard: A Multi-dimensional Safety Evaluation Suite for Multimodal Large Language Models (NeurIPS 2024 · similarity 0.88)
• SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Models (CVPR 2025 · similarity 0.88)
• Pragma-VL: Towards a Pragmatic Arbitration of Safety and Helpfulness in MLLMs (ICLR 2026 · similarity 0.88)