Elamur Research⌕
☰
home / papers / 2026 / MTMCS-Bench: Evaluating Contextual Safety of Multimodal Large Language Models in Multi-Turn Dialogues

MTMCS-Bench: Evaluating Contextual Safety of Multimodal Large Language Models in Multi-Turn Dialogues

Paper · 2026 · Zheyuan Liu, Dongwhi Kim, Yixin Wan et al.

Summary

Most safety benchmarks for multimodal large language models (MLLMs) test one image–prompt pair at a time. They miss harmful intent that builds up over a conversation or that is stated early and then hidden behind innocent follow-ups. MTMCS-Bench fills this gap with three-turn dialogues grounded in COCO-style images. It covers two risk types:

  • Type A (escalation): the dialogue starts harmlessly and drifts toward a harmful goal.
  • Type B (context switch): a malicious goal appears first, and later questions look benign.

Each unsafe dialogue has a safe twin that uses the same scene and differs only in intent. Every sample also has a text-only version, which isolates the contribution of the visual input. A multi-agent pipeline generated the dialogues. Evaluation measures three things separately: intent recognition (MCQ/TF), how well models recognize and respond to risk in unsafe dialogues, and how useful their answers are in benign ones. The last two are scored by LLM judges validated against human annotations.

Across 15 MLLMs, the authors observe consistent safety–utility trade-offs. Models either miss implied risk or refuse harmless requests. Existing guardrails help only partly. The benchmark therefore shows that safety methods need to track intent across the whole dialogue rather than filtering turn by turn.

Key points

  • Scale: 752 base images, 2,256 image variants, 12,032 dialogues and 18,048 questions, for 30,080 samples across 10 safety scenarios. Each sample comes in multimodal and unimodal (text-only) form.
  • Models tested: eight open-source and seven proprietary MLLMs. Typical failures are missing harm that is implied rather than stated, and over-refusing safe dialogues.
  • Guardrails tested: five defenses applied to Qwen3-VL-8B: DPP, AdaShield-Adapt, CoT+Agg, Immune and Self-Exam.
  • Guardrail results:
    • Prompt-based steering (DPP, AdaShield-Adapt) raised safety-awareness the most but lowered MCQ accuracy on unsafe Type B questions.
    • Immune improved safety at a clear cost to helpfulness.
    • Self-Exam had the most balanced effect.
    • No defense improved all three metrics across both risk types.
  • Limitations: the benchmark is diagnostic and limited to everyday scenes, not high-stakes domains such as medicine or law. It also depends on LLM judges.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 5The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 worksComputer Vision and Pattern Recognition · 2,869 works

🧭 Topics 4Research subjects and languages the work is about.Language models & pretraining · 3,320 worksDialogue systems · 624 worksVision & language · 657 worksBias, fairness & safety · 517 works

Cite

Cite as Zheyuan Liu, Dongwhi Kim, Yixin Wan, Xiangchi Yuan, Zhaoxuan Tan, Fengran Mo and Meng Jiang. 2026. MTMCS-Bench: Evaluating Contextual Safety of Multimodal Large Language Models in Multi-Turn Dialogues. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.96

@inproceedings{liu2026mtmcs,
  title = {{MTMCS-Bench: Evaluating Contextual Safety of Multimodal Large Language Models in Multi-Turn Dialogues}},
  author = {Zheyuan Liu, Dongwhi Kim, Yixin Wan, Xiangchi Yuan, Zhaoxuan Tan, Fengran Mo and Meng Jiang},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.96},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.96}
}

References

49 references, 15 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774.
  2. Rawan AlSaad, Alaa Abd-Alrazaq, Sabri Boughorbel, Arfan Ahmed, Max-Antoine Renault, Rafat Damseh, and Javaid Sheikh. 2024. Multimodal large language models in health care: applications, challenges, and future outlook. Journal of medical Internet research. find
  3. Anthropic. 2025. The claude 3 model family: Opus, sonnet, haiku. https://assets.anthropic.com/m/61e7d27f8c8f5919/ original/Claude-3-Model-Card.pdf. ↗
  4. Anna Bavaresco, Raffaella Bernardi, Leonardo Bertolazzi, Desmond Elliott, Raquel Fernández, Albert Gatt, Esam Ghaleb, Mario Giulianelli, Michael Hanna, Alexander Koller, and 1 others. 2025. Llms instead of human judges? a large scale empirical study across 20 nlp evaluation tasks. In ACL.
  5. Ling-Hao Chen, Shunlin Lu, Ailing Zeng, Hao Zhang, Benyou Wang, Ruimao Zhang, and Lei Zhang. 2024. Motionllm: Understanding human behaviors from human motions and videos. arXiv preprint arXiv:2405.20340. — [arXiv:2405.20340](https://arxiv.org/abs/2405.20340) find
  6. Zhili Cheng, Yuge Tu, Ran Li, Shiqi Dai, Jinyi Hu, Shengding Hu, Jiahao Li, Yang Shi, Tianyu Yu, Weize Chen, and 1 others. 2025. Embodiedeval: Evaluate multimodal llms as embodied agents. arXiv preprint arXiv:2501.11858. — [arXiv:2501.11858](https://arxiv.org/abs/2501.11858) find
  7. Wenliang Dai, Junnan Li, Dongxu Li, Anthony Meng Huat Tiong, Junqi Zhao, Weisheng Wang, Boyang Li, Pascale Fung, and Steven Hoi. 2025. Instructblip: Towards general-purpose vision–language models with instruction tuning. In NeurIPS.
  8. Soumya Suvra Ghosal, Souradip Chakraborty, Vaibhav Singh, Tianrui Guan, Mengdi Wang, Ahmad Beirami, Furong Huang, Alvaro Velasquez, Dinesh Manocha, and Amrit Singh Bedi. 2025. Immune: Improving safety against jailbreaks in multi-modal llms via inference-time alignment. In CVPR. find
  9. Gonzalo Gonzalez-Pumariega, Vincent Tu, Chih-Lun Lee, Jiachen Yang, Ang Li, and Xin Eric Wang. 2025. The unreasonable effectiveness of scaling agents for computer use. Preprint, arXiv:2510.02250. — [arXiv:2510.02250](https://arxiv.org/abs/2510.02250) find
  10. Tianle Gu, Zeyang Zhou, Kexin Huang, Dandan Liang, Yixu Wang, Haiquan Zhao, Yuanqi Yao, Xingge Qiao, Keqing Wang, Yujiu Yang, Yan Teng, Yu Qiao, and Yingchun Wang. 2024. Mllmguard: A multidimensional safety evaluation suite for multimodal large language models. Preprint, arXiv:2406.07594. — [arXiv:2406.07594](https://arxiv.org/abs/2406.07594) find
  11. Weiyang Guo, Jing Li, Wenya Wang, YU LI, Daojing He, Jun Yu, and Min Zhang. 2025. Mtsa: Multi-turn safety alignment for llms through multi-round red-teaming. Preprint, arXiv:2505.17147.
  12. Jimin Huang, Mengxi Xiao, Dong Li, Zihao Jiang, Yuzhe Yang, Yifei Zhang, Lingfei Qian, Yan Wang, Xueqing Peng, Yang Ren, Ruoyu Xiang, Zhengyu Chen, Xiao Zhang, Yueru He, Weiguang Han, Shunian Chen, Lihang Shen, Daniel Kim, Yangyang Yu, and 25 others. 2025. Open-finllms: Open multimodal large languag… — [arXiv:2408.11878](https://arxiv.org/abs/2408.11878) find
  13. Xirui Li, Hengguang Zhou, Ruochen Wang, Tianyi Zhou, Minhao Cheng, and Cho-Jui Hsieh. 2024. Mossbench: Is your multimodal language model oversensitive to safe queries? arXiv preprint arXiv:2406.17806. — [arXiv:2406.17806](https://arxiv.org/abs/2406.17806) find
  14. Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. In EECV.
  15. Fenglin Liu, Tingting Zhu, Xian Wu, Bang Yang, Chenyu You, Chenyang Wang, Lei Lu, Zhangdaihong Liu, Yefeng Zheng, Xu Sun, and 1 others. 2023a. A medical multimodal large language model for future pandemics. NPJ Digital Medicine. find
  16. Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. 2024a. Improved baselines with visual instruction tuning. In CVPR.
  17. Haotian Liu, Chunyuan Li, Yuheng Li, Bo Li, Yuanhan Zhang, Sheng Shen, and Yong Jae Lee. 2024b. Llavanext: Improved reasoning, ocr, and world knowledge. find
  18. Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023b. Visual instruction tuning. NeurIPS.
  19. Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024c. Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. In ECCV. find
  20. Xinyue Lou, You Li, Jinan Xu, Xiangyu Shi, Chi Chen, and Kaiyu Huang. 2025. Think in safety: Unveiling and mitigating safety alignment collapse in multimodal large reasoning model. Preprint, arXiv:2505.06538. find
  21. Antonia Karamolegkou, Malvina Nikandrou, Georgios Pantazopoulos, Danae Sanchez Villegas, Phillip Rust, Ruchira Dhar, Daniel Hershcovich, and Anders Søgaard. 2025. Evaluating multimodal language models as visual assistants for visually impaired users. Preprint, arXiv:2503.22610. find
  22. Xinyue Lou, Jinan Xu, Jingyi Yin, Xiaolong Wang, Zhaolu Kang, Youwei Liao, Yixuan Wang, Xiangyu Shi, Fengran Mo, Su Yao, and 1 others. 2026. When helpers become hazards: A benchmark for analyzing multimodal llm-powered safety in daily life. arXiv preprint arXiv:2601.04043.
  23. Omar Khattab, Arnav Singhvi, Paridhi Maheshwari, Zhiyuan Zhang, Keshav Santhanam, Sri Vardhamanan, Saiful Haq, Ashutosh Sharma, Thomas T. Joshi, Hanna Moazam, Heather Miller, Matei Zaharia, and Christopher Potts. 2023. Dspy: Compiling declarative language model calls into self-improving pipelines. P…
  24. AI Meta. 2024. Llama 3.2: Revolutionizing edge ai and vision with open, customizable models. Meta AI Blog. Retrieved December, 20:2024. find
  25. Hugo Laurençon, Andrés Marafioti, Victor Sanh, and Léo Tronchon. 2024. Building and better understanding vision-language models: insights and future directions. Preprint, arXiv:2408.12637. — [arXiv:2408.12637](https://arxiv.org/abs/2408.12637) find
  26. Dexter Le, Aybars Yunusoglu, Karn Tiwari, Murat Isik, and I. Can Dikmen. 2024. Multimodal llm for intelligent transportation systems. Preprint, arXiv:2412.11683. find
  27. Mansi Phute, Alec Helbling, Matthew Daniel Hull, ShengYun Peng, Sebastian Szyller, Cory Cornelius, and Duen Horng Chau. 2024. LLM self defense: By self examination, LLMs know they are being tricked. In The Second Tiny Papers Track at ICLR 2024. find
  28. Salman Rahman, Liwei Jiang, James Shiffer, Genglin Liu, Sheriff Issaka, Md Rizwan Parvez, Hamid Palangi, Kai-Wei Chang, Yejin Choi, and Saadia Gabriel. 2025. X-teaming: Multi-turn jailbreaks and defenses with adaptive multi-agents. Preprint, arXiv:2504.13203. — [arXiv:2504.13203](https://arxiv.org/abs/2504.13203) find
  29. Ram Ramrakhya, Matthew Chang, Xavier Puig, Ruta Desai, Zsolt Kira, and Roozbeh Mottaghi. 2025. Grounding multimodal llms to embodied agents that ask for help with reinforcement learning. Preprint, arXiv:2504.00907. — [arXiv:2504.00907](https://arxiv.org/abs/2504.00907) find
  30. Katrin Renz, Long Chen, Ana-Maria Marcu, Jan Hünermann, Benoit Hanotte, Alice Karnsund, Jamie Shotton, Elahe Arani, and Oleg Sinavski. 2024. Carllava: Vision language models for camera-only closed-loop driving. arXiv preprint arXiv:2406.10165. — [arXiv:2406.10165](https://arxiv.org/abs/2406.10165) find
  31. Kayla Schroeder and Zach Wood-Doughty. 2024. Can you trust llm judgments? reliability of llm-as-a-judge. arXiv preprint arXiv:2412.12509. — [arXiv:2412.12509](https://arxiv.org/abs/2412.12509) find
  32. Omar Shaikh, Shardul Sapkota, Shan Rizvi, Eric Horvitz, Joon Sung Park, Diyi Yang, and Michael S. Bernstein. 2025. Creating general user models from computer use. Preprint, arXiv:2505.10831. find
  33. Guangzhi Sun, Xiao Zhan, Shutong Feng, Philip C Woodland, and Jose Such. 2025. Case-bench: Context-aware safety benchmark for large language models. arXiv e-prints, pages arXiv–2501. find
  34. Jiaqi Wang, Hanqi Jiang, Yiheng Liu, Chong Ma, Xu Zhang, Yi Pan, Mengyuan Liu, Peiran Gu, Sichen Xia, Wenjun Li, Yutong Zhang, Zihao Wu, Zhengliang Liu, Tianyang Zhong, Bao Ge, Tuo Zhang, Ning Qiang, Xintao Hu, Xi Jiang, and 5 others. 2024a. A comprehensive review of multimodal large language models… — [arXiv:2408.01319](https://arxiv.org/abs/2408.01319) find
  35. Wenxuan Wang, Xiaoyuan Liu, Kuiyi Gao, Jen-tse Huang, Youliang Yuan, Pinjia He, Shuai Wang, and Zhaopeng Tu. 2025a. Can’t see the forest for the trees: Benchmarking multimodal safety awareness for multimodal llms. arXiv preprint arXiv:2502.11184. find
  36. Wenxuan Wang, Xiaoyuan Liu, Kuiyi Gao, Jen tse Huang, Youliang Yuan, Pinjia He, Shuai Wang, and Zhaopeng Tu. 2025b. Can’t see the forest for the trees: Benchmarking multimodal safety awareness for multimodal llms. Preprint, arXiv:2502.11184. find
  37. Yu Wang, Xiaogeng Liu, Yu Li, Muhao Chen, and Chaowei Xiao. 2024b. Adashield: Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting. In ECCV. find
  38. Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, and 1 others. 2022. Chain-of-thought prompting elicits reasoning in large language models. NeurIPS.
  39. Chen Xiong, Xiangyu Qi, Pin-Yu Chen, and Tsung-Yi Ho. 2025. Defensive prompt patch: A robust and generalizable defense of large language models against jailbreak attacks. arXiv preprint arXiv:2405.20099. find
  40. Miao Xiong, Zhiyuan Hu, Xinyang Lu, YIFEI LI, Jie Fu, Junxian He, and Bryan Hooi. 2024. Can LLMs express their uncertainty? an empirical evaluation of confidence elicitation in LLMs. In The Twelfth International Conference on Learning Representations. find
  41. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388.
  42. Jiarui Ye and Hao Tang. 2025. Multimodal large language models for medicine: A comprehensive survey. Preprint, arXiv:2504.21051. — [arXiv:2504.21051](https://arxiv.org/abs/2504.21051) find
  43. Zonghao Ying, Aishan Liu, Siyuan Liang, Lei Huang, Jinyang Guo, Wenbo Zhou, Xianglong Liu, and Dacheng Tao. 2024. Safebench: A safety evaluation framework for multimodal large language models. Preprint, arXiv:2410.18927. — [arXiv:2410.18927](https://arxiv.org/abs/2410.18927) find
  44. Beibei Zhang, Yanan Lu, Ruobing Xie, Zongyi Li, Siyuan Xing, Tongwei Ren, and Fen Lin. 2025a. Harnessing multimodal large language models for personalized product search with query-aware refinement. Preprint, arXiv:2509.18682. — [arXiv:2509.18682](https://arxiv.org/abs/2509.18682) find
  45. Chunhui Zhang, Sirui Wang, Zhongyu Ouyang, Xiangchi Yuan, and Soroush Vosoughi. 2025b. Growing through experience: Scaling episodic grounding in language models. In ACL.
  46. Hongjian Zhou, Fenglin Liu, Boyang Gu, Xinyu Zou, Jinfa Huang, Jinge Wu, Yiru Li, Sam S Chen, Peilin Zhou, Junling Liu, and 1 others. 2023. A survey of large language models in medicine: Progress, application, and challenge. arXiv preprint arXiv:2311.05112.
  47. Kaiwen Zhou, Chengzhi Liu, Xuandong Zhao, Anderson Compalas, Dawn Song, and Xin Eric Wang. 2024. Multimodal situational safety. arXiv preprint arXiv:2410.06172. — [arXiv:2410.06172](https://arxiv.org/abs/2410.06172) find
  48. Han Zhu, Juntao Dai, Jiaming Ji, Haoran Li, Chengkun Cai, Pengcheng Wen, Chi-Min Chan, Boyuan Chen, Yaodong Yang, Sirui Han, and 1 others. 2025. Safemt: Multi-turn safety for multimodal language models. arXiv preprint arXiv:2510.12133.
  49. Chenfei Wu, Jiahao Li, Jingren Zhou, Junyang Lin, Kaiyuan Gao, Kun Yan, Sheng ming Yin, Shuai Bai, Xiao Xu, Yilei Chen, Yuxiang Chen, Zecheng Tang, Zekai Zhang, Zhengyi Wang, An Yang, Bowen Yu, Chen Cheng, Dayiheng Liu, Deqing Li, and 20 others. 2025. Qwen-image technical report. Preprint, arXiv:250…

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/liu-2026-mtmcs-bench-evaluating-contextual-safety/