New Dataset and Framework Tackle Evolving Safety Risks in Conversational AI with Images

Multimodal language models that process both text and images have grown powerful at understanding visual content, but deploying them in open-ended chat scenarios creates novel safety challenges that current defenses struggle to handle. The problem intensifies when users engage in extended back-and-forth conversations rather than isolated questions—adversaries can stitch together harmful requests across multiple turns, gradually dismantling safety constraints in ways that evade detection at any single point in the dialogue.

The Multi-turn Attack Problem#

Traditional safety alignment methods like reinforcement learning from human feedback (RLHF) were built around discrete visual question-and-answer pairs. They miss a critical vulnerability: the sequential nature of conversation allows attackers to probe boundaries incrementally, layering requests in ways that bypass guardrails designed for one-off interactions. Detecting and mitigating this cross-turn coordination is difficult because no individual exchange may appear obviously harmful—the real risk lies in the pattern.

MINT-Safe Dataset#

To address this gap, the researchers created MINT-Safe, an open-source training dataset containing 11,270 multi-image dialogues and 500 refusal scenarios. The dataset was constructed through multi-agent interaction, with synthetic image generation tools integrated into the annotation pipeline. Rather than relying solely on manual curation, this approach scales the diversity and coverage of safety scenarios.

TAD-Align Framework#

Building on this dataset, the team developed TAD-Align, a safety alignment framework that treats dialogue turns strategically rather than uniformly. The key innovation is a turn-aware dual-objective reward function. By measuring variance in safety scores across rollouts, the system identifies turns where the model behaves inconsistently—places where guardrails are shaky—and weights those moments more heavily during training.

Results and Impact#

Tests on models including Qwen2.5-VL-7B-Instruct and LLaVA-NeXT-7B showed meaningful gains: attack success rates dropped by over 10%, harmlessness improved by at least 8%, and helpfulness rose by 13% on multimodal multi-turn safety benchmarks. Critically, the improvements preserved overall model performance on general tasks, avoiding the typical trade-off between safety and capability.