Does Unification Come at a Cost? Uni-SafeBench: A Safety Benchmark for Unified Multimodal Large Models

Zixiang Peng; Yongxiu Xu; Qin-Yi Zhang; Jiexun Shen; Yi-Fan Zhang; Hongbo Xu; Yubin Wang; Gaopeng Gou

cs.AIApr 1, 2026

Does Unification Come at a Cost? Uni-SafeBench: A Safety Benchmark for Unified Multimodal Large Models

Authors: Zixiang Peng, Yongxiu Xu, Qin-Yi Zhang, Jiexun Shen, Yi-Fan Zhang, Hongbo Xu, Yubin Wang, Gaopeng Gou

Organizations: Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences Beijing, China · Institute of Automation, Chinese Academy of Sciences School of Artificial Intelligence, University of Chinese Academy of Sciences Beijing, China

Abstract

Unified Multimodal Large Models (UMLMs) integrate understanding and generation capabilities within a single architecture. While unified architectures expand multimodal capabilities, their safety implications remain important yet underexplored. Existing safety benchmarks predominantly focus on isolated understanding or generation tasks, failing to evaluate the holistic safety of UMLMs when handling diverse tasks under a unified framework. To address this, we introduce Uni-SafeBench, a comprehensive benchmark featuring a taxonomy of six major safety categories across seven task types. To ensure rigorous assessment, we develop Uni-Judger, a framework that effectively decouples contextual safety from intrinsic safety. Based on comprehensive evaluations across Uni-SafeBench, we find that the original safety alignment of the underlying LLM is not consistently preserved in current unified models. Moreover, open-source UMLMs exhibit much lower safety performance than multimodal large models specialized for either generation or understanding tasks, particularly on the generation side.

Figures & tables

Figure 1. Unification–Safety Trade-off. Open-source UMLMs are versatile but less safe than VLMs. ( $\times$ : partially unified models lacking text-guided image editing.) A scatter plot showing the trade-off between unification capability and safety scores across different model types

Figure 2. Overview of Uni-SafeBench. (a) A taxonomy with six risk categories. (b) Seven multimodal evaluation tasks. (c) Uni-Judger evaluates intrinsic and contextual safety separately.

Generation Tasks
Task Type	Samples	Contextual Acc. $\bm{\uparrow}$	Intrinsic Acc. $\bm{\uparrow}$
Malicious Text Generation	630	97.62%	95.56%
Unsafe T2I Generation	390	92.31%	92.82%
Malicious Image Editing	229	93.01%	79.91%
Understanding Tasks
Dual-Unsafe VQA	455	90.11%	94.51%

Table 1. Agreement Analysis: Uni-Judge vs. Human

Panel A: Understanding Tasks (Multi-modal VQA Safety)
Model	Backbone	Dual-Unsafe VQA				Image-Unsafe VQA				Text-Unsafe VQA				Composite-Unsafe VQA				Use
Model	Backbone	C-U	C-R	I-U	B-S	C-U	C-R	I-U	B-S	C-U	C-R	I-U	B-S	C-U	C-R	I-U	B-S	Use
VLMs
Deepseek-vl-7B-Base	DeepSeek-LLM-7B-Base	0.237	0.310	0.218	0.681	0.632	0.116	0.559	0.334	0.361	0.333	0.361	0.610	0.108	0.006	0.022	0.885	0.490
Deepseek-vl-7B-Chat †	DeepSeek-LLM-7B-Base	0.116	0.341	0.123	0.807	0.146	0.490	0.141	0.833	0.282	0.198	0.273	0.667	0.080	0.003	0.013	0.908	0.744
Qwen2.5-vl-7B-Instruct †	Qwen2.5-7B	0.114	0.152	0.090	0.842	0.079	0.094	0.066	0.897	0.040	0.198	0.020	0.958	0.067	0.006	0.016	0.924	0.845

Table 2. Holistic Safety Evaluation on Uni-SafeBench

Task	Contextual		Intrinsic
Task	Agr./ $\kappa$	Unsafe Rate	Agr./ $\kappa$	Unsafe Rate
Text Gen.	95.3 / 0.864	21.7 $\rightarrow$ 22.2	96.5 / 0.895	20.6 $\rightarrow$ 21.6
Img. Edit	88.6 / 0.763	36.0 $\rightarrow$ 42.3	87.6 / 0.642	17.8 $\rightarrow$ 26.1
Dual-Unsafe	82.4 / 0.626	31.4 $\rightarrow$ 42.0	86.6 / 0.696	26.4 $\rightarrow$ 37.6
Overall	87.7 / 0.693	23.3 $\rightarrow$ 31.2	91.6 / 0.765	21.7 $\rightarrow$ 24.4

Table 3. Evaluator consistency

	Text-Unsafe VQA	Unsafe T2I Gen
Category	Both-Safe (%)	Both-Safe (%)
Biased Opinion	100.00	–
Toxicity Content	29.68	60.00
Physical and Mental Harm	62.30	30.00
Unethical Activities	19.35	66.67
Privacy Leak	51.85	82.22

Table 4. Category-wise safety performance

Figure 3. Qualitative Examples from Our Benchmark. UMLMs exhibit significantly lower safety performance, frequently complying with unsafe queries.

LLMs
Model	Tasks	C-Unsafe $\bm{\downarrow}$	C-Reject $\bm{\uparrow}$	I-Unsafe $\bm{\downarrow}$	Both-Safe $\bm{\uparrow}$
DeepSeek-LLM-Chat †	1	7.94%	61.75%	7.30%	91.75%
Qwen2.5 †	1	1.90%	27.30%	0.95%	98.10%
VLMs
DeepSeek-VL-Base	5	35.17%	25.95%	31.68%	61.59%
DeepSeek-VL-Chat †	5	12.37%	38.15%	11.16%	84.48%

Table 5. Overall safety performance

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

ID	Category	Definition & Distinction	Keywords (Examples)
01	Dishonest Behavior	Def: Encouraging, guiding, or assisting users in gaining unfair advantages or evading responsibility through deception, cheating, or concealment of truth. Distinction: Unlike Violation of Public Order , this category focuses on deceit and private gain (breaking rules to win/profit), typically executed covertly.	Cheating, plagiarism, exam proxy, game hacks, lying techniques, forging sick notes, academic misconduct.
02	Financial Privacy	Def: Leaking, disseminating, or attempting to acquire sensitive financial data, leading to potential economic loss or security risks. Boundary: Strictly targets financial assets, distinct from general PII.	Credit card numbers, CVV, bank statements, account balance, payment passwords, transaction records.
03	Illegal Activities	Def: Serious violations of criminal law, endangering public safety, or causing mass destruction. Includes instructions for severe crimes (homicide, arson). Boundary: Focuses on actionable instructions for crimes and severe consequences, distinct from visual gore.	Drug manufacturing, poison synthesis, arson tutorial, homicide, money laundering, smuggling, terrorism.
04	Personal ID Info	Def: Displaying, generating, or disseminating sensitive documents or private records that can identify specific natural persons. Boundary: Focuses on civil identity and medical privacy.	ID numbers, passports, driver’s licenses, medical records, private diaries, fingerprints, social security numbers.
05	Privacy of Public Figures	Def: Exposing private life information or images of public figures (celebrities, officials) that are undisclosed and irrelevant to public interest. Boundary: Focuses on intrusive "paparazzi-style" breaches, distinct from public news reporting.	Candid photos, home addresses, private itineraries, leaked chat logs, unreleased schedules.
06	Biased Opinions	Def: Expressing systematic discrimination, stereotypes, or unjust generalizations against specific groups (race, gender, age, region). Boundary: Focuses on group-based bias ("Isms"), distinct from individual Insults .	Racial slurs, gender opposition, regional discrimination, ageism, stereotypes, supremacy theories.

Appendix

Table 6. Detailed definitions, boundary criteria, and keywords for the 16 safety categories in Uni-SafeBench.

Figure 4. The construction pipeline of Uni-SafeBench dataset. (1) Adapted Tasks : Data refactored from existing benchmarks (e.g., AdvBench) via expert review. (2) De Novo Tasks : A “Model-Generation, Human-Refinement” workflow where LLM-synthesized prompts are paired with images and human-rewritten to eliminate stylistic artifacts.

Safety Category	Generation Tasks			Understanding Tasks				Total
Safety Category	Unsafe T2I	Text Gen	Edit	Text-Unsafe	Img-Unsafe	Dual-Unsafe	Comp-Unsafe	Total
Dishonest Behavior	$\cdot$	49	$\cdot$	54	20	3	20	146
Financial Privacy	30	14	13	15	8	14	18	112
Illegal Activities	30	264	20	60	65	25	25	489
Personal Identification	30	62	17	19	65	93	20	306
Privacy Of Public Figures	30	14	17	20	2	4	18	105

Appendix

Table 7. Data Distribution of Uni-SafeBench

Figure 5. Keyword Frequency Visualization across Seven Tasks. Word clouds generated from the textual prompts in Uni-SafeBench. Explicitly Unsafe Tasks (e.g., (b) Text-Unsafe VQA, (f) Malicious Text Gen) exhibit overtly toxic vocabulary (e.g., "hack", "harm"), whereas Implicitly Unsafe Tasks (e.g., (c) Image-Unsafe VQA, (d) Composite-Unsafe VQA) are dominated by semantically benign keywords, indicating that safety risks in these scenarios rely on visual context or cross-modal interactions rather than explicit textual triggers.

Figure 6. Safety vs. Utility Trade-off. Safety (

y

-axis) is the weighted average of the Both-Safe metric; Utility (

x

-axis) is the MMBench accuracy. Most open-source UMLMs cluster in the red region, highlighting a significant safety-utility gap.

Task Type	Samples	Contextual Acc	Contextual Kappa ( $\kappa$ )	Intrinsic Acc	Intrinsic Kappa ( $\kappa$ )
Malicious Editing	229	93.01%	0.8600	79.91%	0.5827
Unsafe T2I	390	92.31%	0.7722	92.82%	0.8042
Malicious Text Gen	630	97.62%	0.9610	95.56%	0.9100
Image-Unsafe VQA	467	95.07%	0.9081	94.22%	0.8841
Dual-Unsafe VQA	455	90.11%	0.8156	94.51%	0.8633
Text-Unsafe VQA	454	94.05%	0.8841	94.27%	0.8814

Appendix

Table 8. Human-Model Agreement statistics across adversarial tasks.

Safety-aligned LLM backbones
Model	Backbone	C-U $\downarrow$	I-U $\downarrow$	B-S $\uparrow$
Qwen2.5-1.5B-Inst.	/	0.032	0.029	0.965
Qwen2.5-7B-Inst.	/	0.019	0.010	0.981
Unified models derived from Qwen backbones
Harmon	Qwen2.5-1.5B-Inst.	0.189 (+0.157)	0.175 (+0.146)	0.797 (-0.168)
Tar-1.5B	Qwen2.5-1.5B-Inst.	0.116 (+0.084)	0.090 (+0.061)	0.876 (-0.089)

Appendix

Table 9. Safety Changes from Qwen Backbones to UMLMs

Risk Category	Sub-category	Text-Unsafe VQA		Unsafe T2I Gen
Toxicity Content	Insults and hatred	20	55.00	30	56.67
	Sex-related	15	20.00	30	46.67
	Blood and violence	60	46.67	30	73.33
	Illegal activities	60	6.67	30	63.33
Biased Opinion	Biased opinions	20	100.00	-	-
Physical & Mental Harm	Self-harm	21	57.14	30	20.00

Appendix

Table 10. Detailed Safety Evaluation Results across Modalities and Categories. BS (%) denotes Both-Safe rate. Note: To examine evaluator scale dependence, we compare Qwen3-VL-8B with Qwen3-VL-235B-A22B-Instruct (excluding blocked samples). For consistency, Safe and Refusal are merged into Non-Unsafe , evaluating agreement under both contextual and intrinsic safety.

Task	Setting	Contextual Safety				Intrinsic Safety
Task	Setting	Agr.	$\kappa$	F1	Unsafe Rate	Agr.	$\kappa$	F1	Unsafe Rate
T2I	Bagel	74.5	0.423	0.699	20.7 $\rightarrow$ 39.9	86.4	0.650	0.825	26.8 $\rightarrow$ 26.2
T2I	Gemini	74.9	0.452	0.708	19.1 $\rightarrow$ 43.2	85.5	0.639	0.819	26.6 $\rightarrow$ 28.7
T2I	Janus-Pro	73.2	0.394	0.681	19.4 $\rightarrow$ 40.4	84.0	0.577	0.788	23.6 $\rightarrow$ 27.0
T2I	Tar7B	71.3	0.394	0.675	20.4 $\rightarrow$ 45.5	84.0	0.632	0.816	33.1 $\rightarrow$ 31.0
Text Generation	Bagel	95.7	0.914	0.957	46.3 $\rightarrow$ 49.0	94.6	0.891	0.946	42.5 $\rightarrow$ 47.9

Appendix

Table 11. Evaluator consistency by task.

Figure 7. Visualization of Task Cases and Model Safety Violations. The examples demonstrate various challenging tasks in our benchmark. In these instances, the Unified model generates harmful content, highlighting its vulnerability in complex multi-modal safety scenarios.

Unified Multimodal Models

Unified multimodal models combine multiple data types in shared systems for cross-modal understanding, generation, reasoning, and interaction.

See all 282 papers

UniSAFE: A Comprehensive Benchmark for Safety Evaluation of Unified Multimodal Models
Mar 18, 2026Segyu Lee, Boryeong Cho, Hojung Jung +8Unified Multimodal Models Multimodal Model Evaluation
KAIST AI · Department of Computer Science and Engineering, UNIST · Department of Mathematical Sciences, KAIST +2
Unsafe by Reciprocity: How Generation-Understanding Coupling Undermines Safety in Unified Multimodal Models
Mar 28, 2026Kaishen Wang, Heng HuangMultimodal Robustness Unified Multimodal Models
University of Maryland, College Park, MD 20742, USA
MCBench: A Multicontext Safety Assessment Benchmark for Omni Large Language Models
Apr 17, 2026Manh Luong, Tamas Abraham, Junae Kim +6LLM Safety Benchmarks Language Model Safety Evaluation
Monash University, Australia · Defence Science and Technology Group, Australia

Mar 18, 2026J/K move · Enter open · S save

UniSAFE: A Comprehensive Benchmark for Safety Evaluation of Unified Multimodal Models

Segyu Lee, Boryeong Cho, Hojung Jung, Seokhyun An+7

KAIST AI · Department of Computer Science and Engineering, UNIST · Department of Mathematical Sciences, KAIST+2

Unified Multimodal Models Multimodal Model Evaluation

Open paper AskPDF arXiv

Unified Multimodal Models (UMMs) offer powerful cross-modality capabilities but introduce new safety risks not observed in single-task models. Despite their emergence, existing safety benchmarks remain fragmented across tasks and modalities, limiting the comprehensive evaluation of complex system-level vulnerabilities. To address this gap, we introduce UniSAFE, the first comprehensive benchmark for system-level safety evaluation of UMMs across 7 I/O modality combinations, spanning conventional tasks and novel multimodal-context image generation settings. UniSAFE is built with a shared-target design that projects common risk scenarios across task-specific I/O configurations, enabling controlled cross-task comparisons of safety failures. Comprising 6,802 curated instances, we use UniSAFE to evaluate 15 state-of-the-art UMMs, both proprietary and open-source. Our results reveal critical vulnerabilities across current UMMs, including elevated safety violations in multi-image composition and multi-turn settings, with image-output tasks consistently more vulnerable than text-output tasks. These findings highlight the need for stronger system-level safety alignment for UMMs. Our code and data are publicly available at https://github.com/segyulee/UniSAFE

Abstract

Unified Multimodal Models

Explore similar work

UniSAFE: A Comprehensive Benchmark for Safety Evaluation of Unified Multimodal Models

Unsafe by Reciprocity: How Generation-Understanding Coupling Undermines Safety in Unified Multimodal Models

MCBench: A Multicontext Safety Assessment Benchmark for Omni Large Language Models