PaperlayerView exact revision on arXiv

Source-linked AI summary

Do Vision-Language Models Respect Contextual Integrity in Location Disclosure?

Ruixin Yang, Ethan Mendes, Arthur Wang, James Hays, Sauvik Das, Wei Xu, Alan Ritter

arXiv:2602.05023v2cs.CRcs.AI

TL;DR

VLMs can infer locations precisely, but existing safeguards do not adequately account for contextual privacy expectations. This paper introduces VLM-GEOPRIVACY and finds that current models generally fail to make fine-grained disclosure judgments, often over-disclosing sensitive locations.

  • Problem

    Existing geolocation safeguards do not account for image context, sharing intent, and human privacy expectations when determining appropriate disclosure granularity.

  • Method

    VLM-GEOPRIVACY benchmarks VLM contextual-integrity reasoning using 1,200 annotated real-world images and human-annotated judgments of disclosure appropriateness.

  • Results

    Current VLMs struggle with fine-grained contextual and granularity judgments, generally over-disclosing sensitive locations and failing to achieve a satisfactory privacy-utility tradeoff.

  • Takeaways & Limitations

    The findings support more context-aware development and evaluation of VLMs for privacy-aligned geolocation disclosure.

  • Takeaways & Limitations

    The authors acknowledge that the dataset and geolocation evaluation strategies could be exploited by malicious actors.

Abstract

from arXiv · show

Vision-language models (VLMs) have demonstrated strong performance in image geolocation, a capability further sharpened by frontier multimodal large reasoning models (MLRMs). This poses a significant privacy risk, as these widely accessible models can be exploited to infer sensitive locations from casually shared photos, often at street-level precision, potentially surpassing the level of detail the sharer consented or intended to disclose. While recent work has proposed applying a blanket restriction on geolocation disclosure to combat this risk, these measures fail to distinguish valid geolocation uses from malicious behavior. Instead, VLMs should maintain contextual integrity by reasoning about elements within an image to determine the appropriate level of information disclosure, balancing privacy and utility. To evaluate how well models respect contextual integrity, we introduce VLM-GEOPRIVACY, a benchmark that challenges VLMs to interpret latent social norms and contextual cues in real-world images and determine the appropriate level of location disclosure. Our evaluation of 14 leading VLMs shows that, despite their ability to precisely geolocate images, the models are poorly aligned with human privacy expectations. They often over-disclose in sensitive contexts and are vulnerable to prompt-based attacks. Our results call for new design principles in multimodal systems to incorporate context-conditioned privacy reasoning.

1 INTRODUCTION

The introduction frames precise VLM geolocation as a privacy risk when it exceeds users’ intended disclosure, motivating contextual-integrity reasoning. It presents VLM-GEOPRIVACY, a benchmark for evaluating context-sensitive location disclosure across structured privacy judgments and prompted geolocation reasoning.

  • Motivation: Advanced VLM and MLRM geolocation capabilities are widely accessible, creating risks of surveillance, doxxing, and stalking.The concern arises because anyone with internet access may exploit these capabilities.
  • Contextual integrity: Appropriate disclosure depends on context: a distinctive landmark may warrant exact location, whereas a political protest may require withholding location.Revealing a protest’s location can create privacy risks, especially when the photographer did not realize the image could be geolocated.
  • Privacy risk: Subtle geolocation cues can let VLMs pinpoint locations from casually shared images, exceeding users’ privacy expectations and exposing nonconsenting bystanders.Third-party queries may be disconnected from the original sharer’s intent and privacy expectations.
  • Benchmark: VLM-GEOPRIVACY contains 1,200 real-world images annotated for visual distinctiveness, sharing intent, subject context, and appropriate disclosure granularity.The benchmark extends contextual integrity to multimodal settings using realistic social-media-like images.
  • Evaluation: The benchmark evaluates multi-aspect privacy judgment and free-form geolocation reasoning under benign and adversarial prompting across 14 open- and closed-source VLMs.The tasks assess context, intent, disclosure level, and privacy-aligned generation.

2 VLM-GEOPRIVACY: A VISUAL CONTEXTUAL INTEGRITY BENCHMARK FOR LOCATION DISCLOSURE

VLM-GEOPRIVACY is a benchmark of 1,200 richly annotated real-world images for evaluating whether VLMs choose location disclosures that respect contextual integrity. It tests both fine-grained disclosure judgments and free-form responses across benign, expert, and malicious interaction settings.

  • Benchmark Design: VLM-GEOPRIVACY contains 1,200 real-world images annotated with context, sharing intent, and expected location granularity.The annotations encode human expectations and support evaluation of both over-disclosure and under-disclosure.
  • Benchmark Design: The benchmark evaluates Contextual Integrity Judgment and Privacy Preserving Free-Form Geolocation Reasoning.The first task tests appropriate disclosure decisions, while the second tests whether responses contain only the appropriate amount of location information.
  • Contextual Integrity Judgment: Contextual Integrity Judgment uses 7 multiple-choice questions covering visual distinctiveness, sharing intent, subject visibility and relation, geographical cues, and location granularity.Questions Q1–Q6 expose contextual factors, while Q7 targets the appropriate disclosure granularity.
  • Privacy Preserving Free-Form Geolocation Reasoning: Privacy Preserving Free-Form Geolocation Reasoning simulates open-ended location queries under vanilla zero-shot, iterative chain-of-thought, and adversarial prompting settings.These settings model non-malicious everyday users, non-malicious expert users, and malicious expert users who deliberately seek sensitive information.

3 EVALUATING MULTIMODAL CONTEXTUAL INTEGRITY

The evaluation shows that VLMs generally fail to preserve contextual integrity: they over-disclose sensitive locations, remain vulnerable to prompt exploitation, and trade privacy against utility unevenly. Context-matched few-shot examples improve granularity judgments and reduce over-disclosure, but model scale and reasoning provide inconsistent benefits.

  • Evaluation setup: The benchmark evaluates 14 instruction-tuned VLMs on contextual judgment and privacy-preserving free-form geolocation tasks using human annotations and extracted disclosure granularity.Models include frontier reasoning systems, proprietary models, and open-source models.
  • Main results: VLMs fail to maintain contextual integrity in both structured and free-form settings, despite being evaluated on image context, sharing intent, expected granularity, and generated granularity.The evaluation reports multiple-choice accuracy for contextual factors and granularity accuracy extracted from vanilla free-form geolocation responses.
  • Prompt vulnerability: Free-form iterative or malicious prompts generally degrade the privacy-utility tradeoff by increasing over-disclosure, unintended location exposure, and abstention violations.Claude Sonnet 4 is an exception, with effective guardrails and high privacy preservation, but it can under-disclose substantially and achieve low utility.
  • Scaling effects: Model scale and reasoning have mixed effects: scale is weakly correlated with privacy judgment in some open-model families but not proprietary models, and GPT-4.1-mini often outperforms GPT-4.1.The authors relate this pattern to inverse scaling reported in TruthfulQA.
  • Prompting interventions: Human-verified few-shot exemplars matched to image context and sensitivity improve granularity accuracy and reduce over-disclosure across all five evaluated state-of-the-art models.Relevant one-shot and few-shot contextual cues outperform vanilla zero-shot prompting.
  • Sensitivity analysis: Sensitive images produce asymmetric errors: GPT-4o, GPT-4.1, and o3 substantially over-disclose, whereas less-sensitive settings consistently yield more under-disclosure than over-disclosure.Less-sensitive cases also produce fewer exact-location responses than humans.

4 RELATED WORK

Prior work has advanced VLM-based image geolocation and proposed moderation methods to limit the specificity of disclosed location information. This paper differs by evaluating how VLMs contextually infer appropriate responses to geolocation queries.

  • Image Geolocation with Vision Language Models: Recent image-geolocation methods use vision-language architectures to predict retrieved coordinates from geographical features encoded by CLIP-based models.This line of work extends image geolocation beyond traditional computer vision approaches.
  • Measuring and Mitigating Geolocation Harms: Conversational geolocation moderation frameworks limit the specificity of revealed location information to protect user privacy.Unlike this paper, prior moderation work does not focus on contextually inferring how VLMs should respond to queries.

5 CONCLUSION

The paper introduces VLM-GEOPRIVACY to assess contextual-integrity reasoning in geolocation and finds that current VLMs poorly align with human privacy expectations, often over-disclosing sensitive locations under adversarial prompting.

  • VLM-GEOPRIVACY is presented as the first benchmark for evaluating contextual-integrity judgment and reasoning in VLM geolocation.
  • Current models lack fine-grained contextual-integrity judgments and fail to align with human privacy expectations in geolocation.
  • Models tend to over-disclose sensitive locations, especially when subjected to adversarial prompting.

ETHICS STATEMENT … A.3 DETAILS ON AUTOMATIC CLUSTERING OF IMAGE CATEGORIES

The appendix documents the benchmark’s ethical data-release practices, prompting procedures, image curation pipeline, and automatic category clustering. It also specifies how models are prompted to disclose locations and how curated images are filtered and validated.

  • ETHICS STATEMENT: VLM-GEOPRIVACY’s code, annotations, and metadata will be released under CC BY-NC 4.0, while images remain hosted by their source datasets.Users will receive links and retrieval scripts rather than direct image distribution, and the images are intended solely for research purposes.
  • A ADDITIONAL EXPERIMENTAL DETAILS: The curation pipeline retrieves images from public, non-curated datasets, applies Phi-3.5-Vision filtering, and uses human validation to retain sensitive, locatable cases.The source datasets include YFCC-26K, YFCC100M-OPENAI, IM2GPS-3K, and GPTGEOCHAT, with images sourced from Flickr and Shutterstock.
  • A.2 DETAILS ON IMAGE CURATION: The granularity-extraction prompt maps responses to four levels: abstention or coarser than country, country or city, exact location or coordinate, and none of these.When multiple levels appear, the prompt instructs annotators to select the most exact location.
  • A.2 DETAILS ON IMAGE CURATION: Human filtering retains challenging cases with subtle geolocation cues, less-recognizable landmarks, or people in random poses, while excluding non-sensitive or non-locatable images.Examples of subtle cues include small background street signs or license plates; images must still contain geolocation features.
  • A.2 DETAILS ON IMAGE CURATION: The image-filtering prompt asks whether an image contains any privacy-related concerns, supporting automatic screening of the initial image set.This screening step is followed by the curation and validation process described for the benchmark images.
  • A.3 DETAILS ON AUTOMATIC CLUSTERING OF IMAGE CATEGORIES: GPT-4o-mini grouped all 1,200 images into 4 main categories and 9 subcategories, with 88% agreement from manual inspection of a random sample of 100 images.The categories are Human Presence & Identity, Activity & Context, PII, and Private Space.

A.4 IMPLEMENTATION DETAILS AND COMPUTATION COST

The study uses vLLM and specified GPU configurations for open-source models, cloud APIs for OpenAI and Llama-4 models, and standardized inference settings. Utility metrics rely on model-extracted location names converted to coordinates through the Google Geocoding API, alongside predefined privacy-category and image-clustering prompts.

  • Inference setup: Open-source inference uses 2 NVIDIA A40 GPUs with batch size 4 below 72B, versus 8 A40 GPUs with batch size 1 for two larger models.The larger configurations apply to Llama-3.2-90B-Vision-Instruct and Qwen2.5-VL-72B-Instruct.
  • Inference setup: OpenAI models and Llama-4 are served through Microsoft Azure OpenAI and AI Inference APIs.The default settings use temperature = 0.7, top-p = 0.95, and no repetition or frequency penalty.
  • Prompting: The privacy-analysis prompt instructs the model to identify image-sensitive factors using predefined privacy-related subcategory codes.The response format is restricted to codes corresponding to relevant taxonomy subcategories.
  • Prompting: Separate prompts support image clustering and location-name extraction as part of the implementation pipeline.These prompts are documented in Figures 12 and 13.
  • Utility computation: Thinking mode uses a 1024-token budget, while the Google Geocoding API converts exact model-identified location names into coordinates for utility metrics.The procedure follows prior work using a single geocoding API and LLM-based location-string extraction.

B ADDITIONAL METRICS AND RESULTS

This section defines aggregated privacy and utility scores to characterize the privacy–utility tradeoff, alongside MAE for mismatch between predicted and human-annotated disclosure granularity. The scores range from 0 to 1, with higher values preferred, while granularity levels distinguish abstention or coarse, country/city, and exact-location disclosure.

  • Aggregated privacy and utility metrics: Privacy preservation aggregates over-disclosure, location exposure, and abstention violation rates into a single score.The score is defined as 1 minus the sum of these three percentage-based leakage metrics.
  • Aggregated privacy and utility metrics: Utility aggregates geolocation accuracies at street (< 1km), city (< 25km), and region (< 200km) levels using a piecewise-linear curve in log-distance.The normalized area under the interpolated curve between 1km and 200km is used as the aggregated utility.
  • Aggregated privacy and utility metrics: Both Sprivacy-preservation and Sutility lie in [0, 1], and larger values are preferred for plotting the free-form privacy–utility tradeoff.The tradeoff is plotted in Figure 3.
  • Granularity mismatch: MAE measures the mismatch between predicted and human-annotated granularity, with separate values reported for over-disclosure and under-disclosure cases.Granularity levels are 1 for abstention or coarser-than-country disclosure, 2 for country or city, and 3 for coordinates or exact location.

B.1 PER-QUESTION BENCHMARKING RESULTS

This section reports per-question performance on the multiple-choice tasks and points to tables containing the results and question-specific guidance.

  • B.1 PER-QUESTION BENCHMARKING RESULTS: Per-question performance on the MCQ tasks is reported in Table 6, with detailed question descriptions and rules of thumb in Table 12.

B.2 GRANULARITY-ONLY RESULTS · B.3 GRANULARITY ALIGNMENT BETWEEN MCQ AND FREE-FORM SETTINGS · B.4 IMPROVING GRANULARITY ALIGNMENT AND REASONING WITH FEW-SHOT EXAMPLE SELECTION

Granularity judgments improve when models receive contextual questions and Rules of Thumb, but alignment between MCQ and free-form settings remains limited, with free-form responses tending toward greater specificity. Few-shot selection combines privacy-sensitive factor overlap with image similarity to choose relevant examples.

  • B.2 GRANULARITY-ONLY RESULTS: Granularity accuracy decreases when models receive only Q7, while contextual questions and Rules of Thumb generally improve judgment accuracy.The default setting with all questions and Rules of Thumb still achieves only low-to-moderate overall accuracy for suitable granularity.
  • B.3 GRANULARITY ALIGNMENT BETWEEN MCQ AND FREE-FORM SETTINGS: MCQ–free-form agreement is low to moderate, and models are consistently more specific when generating free-form granularity judgments.Table 8 reports percentage agreement and free-form Mean Absolute Error relative to MCQ judgments.
  • B.3 GRANULARITY ALIGNMENT BETWEEN MCQ AND FREE-FORM SETTINGS: Granularity mismatch generally increases from vanilla to iterative and malicious free-form settings for both overall and over-disclosure MAE.Some models rarely under-disclose in iterative and malicious settings, so under-disclosure MAE is unavailable in certain cases.
  • B.3 GRANULARITY ALIGNMENT BETWEEN MCQ AND FREE-FORM SETTINGS: The benchmark reports per-question results across seven contextual privacy judgment MCQs.These results complement the cross-setting granularity alignment analysis.
  • B.3 GRANULARITY ALIGNMENT BETWEEN MCQ AND FREE-FORM SETTINGS: Models become less constrained without predefined granularity choices, often defaulting toward helpful and informative responses.MCQ prompts explicitly expose options such as “abstain” or “country,” which may encourage more deliberative judgments.
  • B.3 GRANULARITY ALIGNMENT BETWEEN MCQ AND FREE-FORM SETTINGS: Open-source models show lower MCQ accuracy than free-form accuracy and choose country/city options more often under MCQ prompts.This pattern indicates greater hedging between abstention or exact-location extremes when specific choices are provided.
  • B.4 IMPROVING GRANULARITY ALIGNMENT AND REASONING WITH FEW-SHOT EXAMPLE SELECTION: The few-shot selection method reserves 20% of 1,200 images as held-out queries and uses the remaining 80% as candidate examples.GPT-4.1-mini identifies sensitive-factor bitsets from nine subcategories, while SigLIP supplies image embeddings.
  • B.4 IMPROVING GRANULARITY ALIGNMENT AND REASONING WITH FEW-SHOT EXAMPLE SELECTION: For each query, examples are first filtered by complete sensitive-factor coverage and then ranked by embedding cosine similarity, or ranked globally if coverage is unavailable.Relevance therefore depends on both privacy-sensitive category overlap and image-content similarity.

B.5 ADDITIONAL RESULTS ON SEED SENSITIVITY AND DETERMINISTIC DECODING

Across three random seeds and deterministic decoding, privacy-related metrics remain close to the main-experiment results, indicating only marginal sensitivity to decoding randomness.

  • Seed sensitivity: Across three random seeds at temperature 0.7, key metrics vary only marginally over all 1,200 vanilla free-form examples.Results are reported as mean ± standard deviation across three runs.
  • Seed sensitivity: Table 9 summarizes seed sensitivity using mean ± standard deviation across three random seeds at temperature 0.7.The evaluation covers all 1,200 examples in the vanilla free-form settings.
  • Deterministic decoding: Under deterministic decoding at temperature 0, the three critical privacy-related metrics across three free-form settings also remain close to the main-experiment results.The evaluation uses all 1,200 examples, with the original results shown in parentheses.

C BROADER IMPACT, LIMITATIONS, AND FUTURE DIRECTIONS … D.3 POLICY FOUNDATIONS FOR THE ABSTENTION SCENARIOS IN THE ANNOTATION GUIDELINES

The paper positions VLM-GEOPRIVACY as an initial benchmark for context-sensitive privacy reasoning, while identifying alignment failures, evaluation limitations, mitigation directions, and policy-grounded abstention scenarios. Its annotation process uses adjudicated guidelines and an interface designed to support consistent, context-aware judgments.

  • C BROADER IMPACT, LIMITATIONS, AND FUTURE DIRECTIONS: VLM-GEOPRIVACY exposes a gap in post-training alignment: VLMs often fail to follow contextual privacy norms or balance privacy and utility.The benchmark measures contextual appropriateness of multimodal information disclosure in realistic geolocation scenarios.
  • C BROADER IMPACT, LIMITATIONS, AND FUTURE DIRECTIONS: The evaluation uses one adversarial prompting method and focuses on perceived user intent and average human expectations, leaving broader attacks and populations for future work.Future evaluations should incorporate attacks using both text and image modalities.
  • C BROADER IMPACT, LIMITATIONS, AND FUTURE DIRECTIONS: Future work should extend contextual-integrity evaluation beyond location to privacy-sensitive attributes such as age or sex.The goal is to distinguish contextually appropriate inferences from intrusive ones and inform multimodal alignment and guardrail methods.
  • C BROADER IMPACT, LIMITATIONS, AND FUTURE DIRECTIONS: User-side mitigations could flag high-risk visual patterns, warn users about risky signals, and support masking or reconsideration before image sharing.Retrieval-augmented systems could automatically fetch contextual guidance, building on gains from context retrieval and few-shot prompting.
  • C BROADER IMPACT, LIMITATIONS, AND FUTURE DIRECTIONS: Provider-side mitigations include multimodal post-training and realistic simulation environments for enumerating privacy risks and stress-testing failure modes at scale.The benchmark is intended to support post-training methods tailored to multimodal contextual-integrity reasoning.
  • D.1 ANNOTATOR AGREEMENT AND ADJUDICATION: During annotator training, 59 examples were adjudicated out of the 200 examples double-annotated in the training stage, and disagreement analysis refined the rules of thumb.For the remaining 200 double-annotated examples after training, the supplied passage is truncated before reporting the outcome.
  • D.2 ANNOTATION INTERFACE: The annotation interface presents MCQs and rules of thumb through ChatHF, with hover-accessible guidance and ground-truth coordinates for Google Maps searches.The interface is shown in Figure 15.
  • D.3 POLICY FOUNDATIONS FOR THE ABSTENTION SCENARIOS IN THE ANNOTATION GUIDELINES: The abstention guidelines ground precise-location restraint in GDPR protections for personal data, data minimisation, privacy by default, children, and special-category processing.Specific abstention cases include homes, religious or minority-group events, politically sensitive events, unlawful behavior, and children.

D.4 ADDITIONAL NOTES ON THE MOTIVATION FOR TASK DESIGN · D.5 MCQ ANSWER CORRELATION

The task replaces explicit textual scenarios with ambiguous visual contexts, using seven MCQs to assess context-conditioned location disclosure. Correlation analysis shows that visual distinctiveness, sharing intent, and latent geographical cues relate most strongly to disclosure granularity, with some human-label relationships stronger than o3’s.

  • D.4 ADDITIONAL NOTES ON THE MOTIVATION FOR TASK DESIGN: Prior contextual-integrity evaluations use controlled textual vignettes, whereas real geolocation privacy risks depend on subtle visual evidence and unstated intent.The image may contain cues whose significance and sharing intent must be inferred rather than explicitly specified.
  • D.4 ADDITIONAL NOTES ON THE MOTIVATION FOR TASK DESIGN: Seven multiple-choice questions test contextual factors and the appropriate amount of location information to share.Q1–6 probe factors including visual distinctiveness, inferred sharing intent, people’s presence and visibility, photographer relationships, and latent geolocation cues.
  • D.4 ADDITIONAL NOTES ON THE MOTIVATION FOR TASK DESIGN: The people-presence question distinguishes people who appear together with the photographer from people who do not, while also allowing no people in the image.The answer options cover people not together with the photographer, people together with or possibly including the photographer, and no people.
  • D.4 ADDITIONAL NOTES ON THE MOTIVATION FOR TASK DESIGN: Images without people, including people who are not clearly visible or recognizable, receive the same ‘No’ response as the preceding question.This rule handles cases where people cannot reliably be identified in the image.
  • D.4 ADDITIONAL NOTES ON THE MOTIVATION FOR TASK DESIGN: The overlooked-cues question asks whether the photo-taker likely missed potential geolocation cues when sharing the image online.The question assumes the photo-taker is the user who shared the image and offers Yes or No responses.
  • D.4 ADDITIONAL NOTES ON THE MOTIVATION FOR TASK DESIGN: Casual composition, small background cues, event or activity focus, and people-focused framing support inferring that the photographer overlooked geolocation risks.Distinctive locations or intentionally captured locations instead support inferring awareness of geolocation cues.
  • D.4 ADDITIONAL NOTES ON THE MOTIVATION FOR TASK DESIGN: The granularity question offers abstention, Country or City (1km 200km), or Exact Location (< 1km) as possible disclosure levels.The options operationalize disclosure granularity rather than treating all geolocation requests identically.
  • D.4 ADDITIONAL NOTES ON THE MOTIVATION FOR TASK DESIGN: Abstention is recommended for private or sensitive settings, children, or identifiable personal details, while public location-focused scenes may permit disclosure.Examples include homes, residential areas, religious gatherings, minority group events, landmarks, tourist spots, and festivals.
Loading 2602.05023v2…