SafeMLRM: Demystifying Safety in Multi-modal Large Reasoning Models

2025/04/09 by Junfeng Fang, Yukai Wang, Fang, Junfeng +12 · 32 citations
Computer Science · Decision Sciences · Health Professions · #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Occupational Health and Safety Research #Risk and Safety Analysis #Topic Modeling

paper · pdf · doi:10.48550/arxiv.2504.08813

openalex publication_date 2025/04/09 · openalex created_date 2025/10/14 · openalex updated_date 2026/07/28

Abstract

The rapid advancement of multi-modal large reasoning models (MLRMs) -- enhanced versions of multimodal language models (MLLMs) equipped with reasoning capabilities -- has revolutionized diverse applications. However, their safety implications remain underexplored. While prior work has exposed critical vulnerabilities in unimodal reasoning models, MLRMs introduce distinct risks from cross-modal reasoning pathways. This work presents the first systematic safety analysis of MLRMs through large-scale empirical studies comparing MLRMs with their base MLLMs. Our experiments reveal three critical findings: (1) The Reasoning Tax: Acquiring reasoning capabilities catastrophically degrades inherited safety alignment. MLRMs exhibit 37.44% higher jailbreaking success rates than base MLLMs under adversarial attacks. (2) Safety Blind Spots: While safety degradation is pervasive, certain scenarios (e.g., Illegal Activity) suffer 25 times higher attack rates -- far exceeding the average 3.4 times increase, revealing scenario-specific vulnerabilities with alarming cross-model and datasets consistency. (3) Emergent Self-Correction: Despite tight reasoning-answer safety coupling, MLRMs demonstrate nascent self-correction -- 16.9% of jailbroken reasoning steps are overridden by safe answers, hinting at intrinsic safeguards. These findings underscore the urgency of scenario-aware safety auditing and mechanisms to amplify MLRMs' self-correction potential. To catalyze research, we open-source OpenSafeMLRM, the first toolkit for MLRM safety evaluation, providing unified interface for mainstream models, datasets, and jailbreaking methods. Our work calls for immediate efforts to harden reasoning-augmented AI, ensuring its transformative potential aligns with ethical safeguards.

Citations

• VLM-R1: A Stable and Generalizable R1-style Large Vision-Language Model
• Towards Understanding the Safety Boundaries of DeepSeek Models: Evaluation and Findings
• R1-VL: Learning to Reason with Multimodal Large Language Models via Step-wise Group Relative Policy Optimization
• Multimodal Chain-of-Thought Reasoning: A Comprehensive Survey
• R1-Onevision: Advancing Generalized Multimodal Reasoning through Cross-Modal Formalization
• VisRL: Intention-Driven Visual Perception via Reinforced Reasoning
• MM-Eureka: Exploring the Frontiers of Multimodal Reasoning with Rule-based Reinforcement Learning
• LMM-R1: Empowering 3B LMMs with Strong Reasoning Abilities Through Two-Stage Rule-Based RL
• Seg-Zero: Reasoning-Chain Guided Segmentation via Cognitive Reinforcement
• R1-Omni: Explainable Omni-Multimodal Emotion Recognition with Reinforcement Learning
• R1-Zero's "Aha Moment" in Visual Reasoning on a 2B Non-SFT Model
• Safety Tax: Safety Alignment Makes Your Large Reasoning Models Less Reasonable
• The Hidden Risks of Large Reasoning Models: A Safety Assessment of R1
• Safety Evaluation of DeepSeek Models in Chinese Contexts
• A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations
• Safety Reasoning with Guidelines
• Demystifying Long Chain-of-Thought Reasoning in LLMs
• OverThink: Slowdown Attacks on Reasoning LLMs
• The dark deep side of DeepSeek: Fine-tuning attacks against the safety alignment of CoT-enabled models
• o3-mini vs DeepSeek-R1: Which One is Safer?
• Challenges in Ensuring AI Safety in DeepSeek-R1 Models: The Shortcomings of Reinforcement Learning Strategies
• Leveraging Chain of Thought towards Empathetic Spoken Dialogue without Corresponding Question-Answering Data
• Mulberry: Empowering MLLM with o1-like Reasoning and Reflection via Collective Monte Carlo Tree Search
• PKRD-CoT: A Unified Chain-of-thought Prompting for Multi-Modal Large Language Models in Autonomous Driving
• Jailbreak Large Vision-Language Models Through Multi-Modal Linkage
• Insight-V: Exploring Long-Chain Visual Reasoning with Multimodal Large Language Models
• Thinking Before Looking: Improving Multimodal LLM Reasoning via Mitigating Visual Hallucination
• GPT-4o System Card
• Improve Vision Language Model Chain-of-thought Reasoning
• Unlocking the Capabilities of Thought: A Reasoning Boundary Framework to Quantify and Optimize Chain-of-Thought
• Qwen2-VL: Enhancing Vision-Language Model's Perception of the World at Any Resolution
• Cantor: Inspiring Multimodal Chain-of-Thought of MLLM
• TextCoT: Zoom In for Enhanced Multimodal Text-Rich Image Understanding
• Mind's Eye of LLMs: Visualization-of-Thought Elicits Spatial Reasoning in Large Language Models
• HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal
• BioXP-0.5B: Explainable Medical-AI via RL-GRPO
• DeepSeek-Coder: When the Large Language Model Meets Programming -- The Rise of Code Intelligence
• MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models
• FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts
• Chain of Images for Intuitively Reasoning
• Llama 2: Open Foundation and Fine-Tuned Chat Models
• GPT-4 Technical Report
• High-Resolution Image Synthesis with Latent Diffusion Models
• High-Resolution Image Synthesis with Latent Diffusion Models

Cited by

• Beyond SFT: Reinforcement Learning for Safer Large Reasoning Models with Better Reasoning Ability
• GuardTrace-VL: Detecting Unsafe Multimodel Reasoning via Iterative Safety Supervision
• From Perception to Reasoning: Deep Thinking Empowers Multimodal Large Language Models
• Enhancing CLIP Robustness via Cross-Modality Alignment
• Path Drift in Large Reasoning Models:How First-Person Commitments Override Safety
• LinearRAG: Linear Graph Retrieval Augmented Generation on Large-scale Corpora
• VisuoAlign: Safety Alignment of LVLMs with Multimodal Tree Search
• SaFeR-VLM: Toward Safety-aware Fine-grained Reasoning in Multimodal Models
• COSMO-RL: Towards Trustworthy LMRMs via Joint Safety and Stability
• MLLMEraser: Achieving Test-Time Unlearning in Multimodal Large Language Models through Activation Steering
• DocPruner: A Storage-Efficient Framework for Multi-Vector Visual Document Retrieval via Adaptive Patch-Level Embedding Pruning
• A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Models
• Don't Overthink It: A Survey of Efficient R1-style Large Reasoning Models
• SafeMobile: Chain-level Jailbreak Detection and Automated Evaluation for Multimodal Mobile Agents
• RSafe: Incentivizing proactive reasoning to build robust and adaptive LLM safeguards
• Adaptive Multi-prompt Contrastive Network for Few-shot Out-of-distribution Detection
• AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructions
• Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025
• The Eye of Sherlock Holmes: Uncovering User Private Attribute Profiling via Vision-Language Model Agentic Framework
• PD³F: A Pluggable and Dynamic DoS-Defense Framework Against Resource Consumption Attacks Targeting Large Language Models
• SAFEPATH: Preventing Harmful Reasoning in Chain-of-Thought via Early Alignment
• Think in Safety: Unveiling and Mitigating Safety Alignment Collapse in Multimodal Large Reasoning Model
• Safety in Large Reasoning Models: A Survey

Related

• Think in Safety: Unveiling and Mitigating Safety Alignment Collapse in Multimodal Large Reasoning Model
• The Hidden Risks of Large Reasoning Models: A Safety Assessment of R1
• When Models Outthink Their Safety: Mitigating Self-Jailbreak in Large Reasoning Models with Chain-of-Guardrails
• RAJ-PGA: Reasoning-Activated Jailbreak and Principle-Guided Alignment Framework for Large Reasoning Models
• Safety is Not Only About Refusal: Reasoning-Enhanced Fine-tuning for Interpretable LLM Safety