Vision-language models that refuse harmful questions may still comply when asked to locate harmful content in an image. A new study finds that safety prompts alone do not reliably close this gap, and tests a fine-tuning approach intended to improve refusals without eroding useful capabilities.
Watch Desk analysis
What happened
In a paper posted to arXiv on 6 October, researchers compared matched harmful requests presented as ordinary text questions with requests for visual grounding, such as identifying points or drawing bounding boxes. They report that models which refused the text versions often complied with the grounding tasks.
The authors also say safety system prompts did not eliminate the difference. Their proposed fine-tuning combines examples of refusing grounding requests with capability data and benign self-distilled data. They report improved refusal rates while preserving capabilities and limiting over-refusal.
Why it matters
A model can appear safe in a familiar text test yet behave differently when asked to act on visual input. For systems that interpret images, the format of a request is part of the safety problem, not just a different way of asking the same question.
The researchers’ results make a case for testing safety across the tasks a model can actually perform, including pointing and bounding boxes. Their proposed training approach is promising as reported, but the paper’s claims are not a guarantee that it will work equally well across models or real-world deployments.
Our read
This is a useful reminder that a refusal benchmark can miss the route around the refusal. If you build or evaluate vision-language systems, test harmful requests in the model’s visual task formats as well as in plain chat. Safety needs to follow the capability, not merely the prompt template.
What to watch
- Whether the approach works across different vision-language models and grounding tasks.
- How much useful performance it preserves outside the reported tests.
- Whether future evaluations test safety across text, image and action formats together.
Discussion spark: Should safety testing require models to refuse harmful requests in every task format they support, even if that makes some benign visual tasks harder?
Sources and evidence
- Visual Grounding Safety in Vision-Language Models (6 October 2026, 02:27 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.