DUAL-Bench: Measuring Over-Refusal and Robustness in Vision-Language Models

1. Problem Statement

As Vision-Language Models (VLMs) become more capable, a critical challenge has emerged: the trade-off between safety and usefulness. Current safety mechanisms often lead to over-refusal, where models decline benign requests due to excessive caution triggered by visual content.

The paper identifies a specific gap in existing research:

• Dual-Use Scenarios: Many real-world cases involve benign instructions (e.g., "Describe this image") paired with images containing harmful text or content (e.g., instructions on self-harm or violence).
• Binary Failure Modes: Models currently struggle in these scenarios, falling into a "binary trap":
  1. Over-Refusal: Refusing the benign task entirely because the image contains harmful elements.
  2. Unsafe Generation: Ignoring the harm and generating dangerous content.
• Lack of Benchmarks: Existing benchmarks focus primarily on defense robustness (can the model refuse jailbreaks?) or text-only over-refusal. There is no large-scale benchmark evaluating safe completion (fulfilling the benign part while warning about the harmful part) in the visual modality, nor is there a systematic evaluation of how semantics-preserving perturbations (e.g., rotation, noise, font changes) affect these safety boundaries.

2. Methodology & Benchmark Design (DUAL-Bench)

The authors introduce DUAL-Bench, a large-scale multimodal benchmark designed to evaluate over-refusal and safe completion under realistic conditions.

A. Dataset Construction

• Scale: The dataset comprises 192,372 images in total.
  • Core Set: 32,062 harmful instruction images paired with 32,062 benign (detoxified) counterparts.
  • Dual-Use Subset: 1,200 original harmful images + 1,200 benign images, each with 5 perturbations, totaling 14,400 instances for the main benchmark evaluation.
• Categories: Covers 12 hazard categories based on the MLCommons safety taxonomy (e.g., Violent Crimes, Child Sexual Exploitation, Suicide & Self-Harm, Hate Speech, etc.).
• Dual-Use Prompting: The task instruction is fixed as a benign prompt: "Describe the image." The harmful content is embedded visually within the image (e.g., text rendered in the image asking "How to make a bomb?"). This isolates the refusal trigger to the visual content rather than the text prompt.
• Perturbations: To test robustness, each image undergoes five semantics-preserving perturbations:
  1. Real Background (overlay on natural photos).
  2. Noise Background.
  3. Rotation.
  4. Font Size Reduction.
  5. Language Perturbation (Translation, e.g., English to Chinese).
     These perturbations preserve the semantic meaning of the instruction but introduce distribution shifts that often destabilize model safety boundaries.

B. Evaluation Metrics

The paper proposes a multi-dimensional evaluation framework:

1. Refusal Rate (RR): Proportion of times the model refuses the task.
2. Direct Answer Rate (DAR): Proportion of times the model answers directly.
3. Safe Completion Rate (SCR): The core metric. It measures the ability to fulfill the benign task (describe the image) while explicitly warning about the harmful content detected. This is defined as the "third path" between blind compliance and blanket refusal.
4. Instruction Robustness Gap ($\Delta$IR): The difference in task completion performance between benign and harmful inputs ($DAR_{benign} - DAR_{harmful}$). A large gap indicates that safety mechanisms are severely degrading the model's core utility.

C. Evaluation Protocol

• Models Evaluated: 18 State-of-the-Art (SOTA) VLMs, including OpenAI (GPT-4.1, GPT-5 family), Google (Gemini 2.5), Qwen, Mistral, and LLaMA families.
• Judgment: A dual-layer LLM-as-a-Judge framework is used to categorize outputs into Direct Answer, Direct Refusal, Indirect Refusal, and Safe Completion. Cross-validation with multiple judge models ensures reliability.

3. Key Results

A. The "Binary Trap"

Models exhibit extremely fragile safety boundaries in dual-use scenarios. They predominantly oscillate between:

• Over-Refusal: Refusing benign tasks because the image contains harmful text.
• Unsafe Generation: Failing to warn about the harm.
• Safe Completion is Rare: Even the best-performing models struggle to achieve safe completion.
  • GPT-5-Nano: Highest SCR at 12.9%.
  • GPT-5 Family Average: 7.9%.
  • Qwen Family Average: 3.9%.
  • GPT-4.1 & LLaMA Families: Near 0% safe completion (collapsing to binary refusal).

B. Robustness to Perturbations

• Fragility: Safety boundaries are highly sensitive to minor visual changes.
• Correlation: Models with higher baseline refusal rates (e.g., GPT-4.1, LLaMA) tend to be less robust, showing larger fluctuations in performance under perturbations.
• Specific Vulnerabilities:
  • Noise Sensitivity: GPT-4.1 showed hypersensitivity to noise backgrounds, increasing refusal rates significantly.
  • Language Shifts: Cross-lingual translation (e.g., to Chinese) caused drastic drops in Safe Completion rates (e.g., Qwen-2.5-VL-32B dropped from 0.80 to 0.61 DAR).

C. Model Family Differences

• GPT-5 Family: Shows the best balance, achieving non-trivial safe completion rates, though still low in absolute terms.
• GPT-4.1 & LLaMA: Exhibit "aggressive" alignment, leading to high over-refusal and poor utility on benign tasks when harmful visual cues are present.
• Size vs. Safety: Safety capability is not strictly correlated with parameter size. It is driven by specific developer alignment paradigms. Smaller models sometimes achieve higher safe completion but are more fragile; larger models are more robust but often revert to binary refusal.

4. Key Contributions

1. DUAL-Bench Dataset: The first large-scale multimodal benchmark specifically targeting over-refusal and safe completion in dual-use scenarios, featuring 12 hazard categories and robustness testing via perturbations.
2. Safe Completion Metric: Formalizes and evaluates "Safe Completion" as a distinct, desirable third behavior, moving beyond the binary "Refuse vs. Answer" paradigm.
3. Comprehensive Evaluation: Provides the first systematic analysis of 18 VLMs, revealing that current safety alignment strategies are inadequate for balancing helpfulness and harmlessness in visual contexts.
4. Insight on Robustness: Demonstrates that safety boundaries are brittle and easily disrupted by semantics-preserving perturbations, suggesting current alignment methods lack true robustness.

5. Significance and Future Directions

• Paradigm Shift: The paper argues that the industry must move away from "blanket refusal" strategies. The ideal behavior is Safe Completion: acknowledging the risk, warning the user, but still fulfilling the benign part of the request.
• Implications for Alignment: Current RLHF and Constitutional AI approaches often create "hypersensitive" models that fail in nuanced, real-world scenarios (e.g., a medical professional analyzing a harmful image for research).
• Future Work: The authors propose:
  • Fine-grained RLHF: Training models specifically on "Dual-Use" and "Safe Completion" preference data.
  • Safety Chain-of-Thought (SCoT): Encouraging models to reason internally about safety before responding.
  • Adversarial Training: Using the perturbation data to train models to ignore non-semantic noise (layout, font) while maintaining safety.

In conclusion, DUAL-Bench highlights that current VLMs are failing to navigate the complex middle ground between safety and utility. The benchmark serves as a critical tool for developing the next generation of alignment strategies that can handle the nuance of dual-use visual content.