After studying this material, students should be able to:

1. Explain the limitations of existing safety benchmarks for multimodal AI models
2. Understand the concept of intention-grounded evaluation methodology
3. Describe the structure and components of UNISAF-Bench
4. Identify systematic safety gaps found in unified multimodal generation models
5. Apply the evaluation framework concepts to critically assess AI safety benchmarks

---

Step-by-Step Teaching

Step 1: Foundation — What Are Unified Multimodal Generation (UMMG) Models?

Definition

UMMG models are AI systems that can:

• Handle multiple types of inputs (text, images, audio)
• Produce multiple types of outputs (text, images, audio)
• Do all of this within a single conversational interface

Simple Analogy

Think of a Swiss Army knife vs. separate tools. Traditional AI models are separate tools — one for text, one for images. UMMG models are the Swiss Army knife — everything in one place.

Why This Matters

Because everything is unified, safety must also be evaluated in a unified way.

---

Step 2: The Core Problem — What's Wrong With Existing Safety Benchmarks?

Current Approach (Flawed)

Modality A (Text)    → Prompt Set A → Tests Intentions {1, 2, 3}
Modality B (Image)   → Prompt Set B → Tests Intentions {4, 5, 6}
Modality C (Mixed)   → Prompt Set C → Tests Intentions {7, 8, 9}

The Problem Visualized

Key Insight

If Modality A tests "easy" harmful intentions and Modality B tests "hard" ones, comparing their safety scores is meaningless — like comparing exam scores from different tests.

---

Step 3: The Solution — Intention-Grounded Evaluation Methodology

Core Principle

Every modality combination is tested against the SAME set of harmful intentions.

New Approach

Harmful Intention Set {1, 2, 3, ... N}
         ↓
Modality A (Text)    → Tests ALL intentions {1...N}
Modality B (Image)   → Tests ALL intentions {1...N}
Modality C (Mixed)   → Tests ALL intentions {1...N}

How Scoring Works

Instead of averaging over modality-specific prompt sets, scores are aggregated at the intention level:

Safety Score (Modality A) = Average safety across intentions {1, 2, 3...N}
Safety Score (Modality B) = Average safety across intentions {1, 2, 3...N}

✅ Now scores are directly comparable ✅ No distortion from different prompt sets ✅ Accurate safety profile per model

Bonus Feature: Extensibility

The methodology is incrementally extensible:

• Add a new modality? → Test it against existing intentions
• Add a new harmful intention? → Test it across existing modalities
• No need to rebuild the entire benchmark

---

Step 4: UNISAF-Bench — The Benchmark Built on This Methodology

What Is It?

UNISAF-Bench = UNIfied intention-grounded SAFety Benchmark

Key Numbers at a Glance

Structural Components Explained

1. Harmful Intentions (1,257)

• These are the core building blocks
• Each intention represents a specific harmful goal (e.g., "generate instructions for making weapons")
• Human-verified = real people checked these for quality and relevance

2. 19 Policies

• Think of these as categories of harm
• Examples might include: violence, misinformation, privacy violations, etc.
• Each intention maps to one policy

3. Conversation Types

20,112 conversations =
├── Single-turn (one prompt, one response)
├── Multi-turn (back-and-forth dialogue)
├── Policy-violating variants (clearly harmful)
└── Boundary-benign variants (similar but acceptable)

Why Boundary-Benign Variants?

These are prompts that look similar to harmful ones but are actually acceptable. They test whether a model is overly cautious — refusing things it shouldn't refuse.

---

Step 5: Key Findings — Safety Gaps Discovered

The benchmark was tested on four open-source UMMG models, revealing three critical findings:

Finding 1: Multimodal Inputs Degrade Text-Output Safety

Text input only    → Model refuses harmful request ✅
Image + Text input → Model complies with harmful request ❌

What this means: Adding an image to a harmful text prompt can bypass safety filters that would otherwise work correctly.

Finding 2: Safety Alignment Fails to Transfer to Image Generation

Model trained to be safe in text → Safe text outputs ✅
Same model generating images     → Unsafe image outputs ❌

What this means: Safety training in one modality does not automatically carry over to other modalities. A model safe in text can still generate harmful images.

Finding 3: Multi-Turn Deflection Bias

Turn 1: Harmful prompt  → Refused ✅
Turn 2: Benign prompt   → Also refused ❌ (incorrectly)

What this means: In multi-turn conversations, models develop a bias toward refusal — they start refusing even harmless follow-up questions because earlier turns were harmful. This inflates refusal rates on both harmful AND benign prompts, making safety evaluation misleading.

---

Step 6: Synthesis — Why This All Matters

The Big Picture

Problem: Existing benchmarks → Unfair, incomplete safety evaluation
Solution: Intention-grounded methodology → Fair, comparable evaluation
Implementation: UNISAF-Bench → Reveals real-world safety gaps
Impact: Better understanding → Better safety alignment

Conceptual Summary Table

---

Quick Self-Check Questions

1. Why can't you compare safety scores across modalities in traditional benchmarks?
2. What does "intention-grounded" mean in the context of this methodology?
3. How does UNISAF-Bench ensure fair comparison across modalities?
4. What are the three safety gaps discovered, and why is each concerning?
5. Why are boundary-benign variants important in the benchmark?

---

Key Vocabulary Summary