Researchers have built a benchmark that catches vision-language models bluffing their way through safety tests.
Most VLM safety benchmarks only check the final answer: did the model refuse, warn, or comply. A new framework called EviSafe argues that's not enough, because a model can look safe while missing the actual visual hazard, triggering on a keyword instead of the image content, or over-refusing harmless requests. Its companion benchmark, EviSafeBench, uses 1,181 gold image-text scenarios plus 2,452 counterfactual variants across eight safety domains, each paired with an annotated correct decision and a policy for what a safe response should say. Models are probed three ways - a natural response, a request to report their evidence, and a counterfactual version where a key visual detail changes - then graded by an evidence-aware judge.
The results are rough. Across eleven VLMs tested, accuracy on correctly judging severity ranged from just 27.6% to 52.8%, consistency between a model's stated reasoning and its actual evidence ranged from 6.1% to 29.3%, and models only flipped from unsafe to safe judgments correctly 30.4% to 58.4% of the time when the risky detail was removed. In plain terms, these models are frequently right for reasons that have nothing to do with what's actually in the picture.
That distinction matters as VLMs get folded into moderation tools, robotics, and accessibility apps where the image is the whole point, not a side input. A chatbot that refuses on a scary word is annoying. A vision system that refuses - or worse, complies - without looking at the photo is a liability once it's making calls about real scenes.
Text-only safety evaluation went through the same reckoning years ago, when researchers found refusals were often pattern-matched rather than reasoned. Vision models are apparently repeating the lesson, just with pictures this time.