Source-linked AI summary
MUSE: A Run-Centric Platform for Multimodal Unified Safety Evaluation of Large Language Models
Zhongxi Wang, Yueqian Lin, Jingyang Zhang, Hai Helen Li, Yiran Chen
TL;DR
Multimodal safety evaluation lacks unified infrastructure for testing whether alignment generalizes across audio, image, and video inputs. MUSE integrates cross-modal attack generation, multi-turn orchestration, routing, and fine-grained judgment, finding 90–100% ASR in some multi-turn evaluations and model-family-specific modality effects.
Problem
Existing safety evaluation is predominantly text-centric, and current frameworks lack infrastructure to systematically test alignment across modalities.
Method
MUSE is a run-centric platform combining cross-modal payload generation, multi-turn attacks, provider-agnostic routing, a five-level judge, dual ASR metrics, and ITMS.
Results
90–100% ASR was achieved by multi-turn strategies against models with near-perfect single-turn refusal, while ITMS accelerated convergence and modality effects varied by model family.
Takeaways & Limitations
The evaluation underscores the need for provider-aware cross-modal safety testing rather than assuming alignment transfers uniformly across modalities.
Takeaways & Limitations
GPT-4o and Claude Sonnet 4 were tested only with text and image because their standard evaluation APIs did not accept audio.
Abstract
from arXiv · showhide
Safety evaluation and red-teaming of large language models remain predominantly text-centric, and existing frameworks lack the infrastructure to systematically test whether alignment generalizes to audio, image, and video inputs. We present MUSE (Multimodal Unified Safety Evaluation), an open-source, run-centric platform that integrates automatic cross-modal payload generation, three multi-turn attack algorithms (Crescendo, PAIR, Violent Durian), provider-agnostic model routing, and an LLM judge with a five-level safety taxonomy into a single browser-based system. A dual-metric framework distinguishes hard Attack Success Rate (Compliance only) from soft ASR (including Partial Compliance), capturing partial information leakage that binary metrics miss. To probe whether alignment generalizes across modality boundaries, we introduce Inter-Turn Modality Switching (ITMS), which augments multi-turn attacks with per-turn modality rotation. Experiments across six multimodal LLMs from four providers show that multi-turn strategies can achieve up to 90-100% ASR against models with near-perfect single-turn refusal. ITMS does not uniformly raise final ASR on already-saturated baselines, but accelerates convergence by destabilizing early-turn defenses, and ablation reveals that the direction of modality effects is model-family-specific rather than universal, underscoring the need for provider-aware cross-modal safety testing.
1 Introduction
Multimodal models broaden the attack surface, while existing safety tools lack unified cross-modal infrastructure and binary metrics miss partial leakage. MUSE addresses these gaps with a run-centric platform, fine-grained evaluation, and ITMS for testing modality-boundary alignment.
- Multimodal agents process audio, images, and video alongside language, broadening the attack surface for harmful requests.
- Existing frameworks lack either native multimodal payload generation, interactive run management, or both.
- Binary ASR cannot distinguish complete safety bypass from partial information leakage.
- MUSE unifies cross-modal payload generation, multi-turn attack orchestration, automated safety judgment, and provider-agnostic routing in one browser-based system.
- Hard ASR counts Compliance only, whereas soft ASR also includes Partial Compliance to quantify partial leakage.
- ITMS rotates delivery modality per turn and uses ablation to isolate modality switching from individual modality effects.
- Approximately 3,700 red-teaming runs span six multimodal LLMs from four providers, five attack strategies, and controlled ITMS ablations.
2 Related Work
Prior work developed iterative attacks, multimodal safety evaluations, programmatic red-teaming, and standardized benchmarks, but these capabilities remained fragmented. MUSE combines them with interactive run management and a taxonomy that captures partial information leakage.
- Single-turn attacks optimize or transform prompts, while PAIR, Crescendo, and Violent Durian apply iterative conversational pressure.
- PyRIT and Garak support programmatic red-teaming but lack native multimodal payload generation.
- HarmBench and JailbreakBench provide standardized benchmarks without interactive run management.
- MUSE combines a five-level taxonomy separating full compliance from partial leakage with multimodal generation, multi-turn orchestration, and interactive batch management.
- ITMS probes whether safety alignment holds across modality boundaries.
3 System Design
MUSE uses a reproducible, extensible run-centric architecture that coordinates attacks, modality conversion, provider routing, and safety judgment. Its five-level taxonomy yields hard and soft ASR plus longitudinal resistance analyses.
- MUSE’s client-server design supports browser-based exploration, backend computation, persistence, and real-time streaming.
- The architecture is organized around a run-centric data model, pluggable attack engine, provider-agnostic routing, cross-modal generation, and an LLM judge.
- Each persistent run records configuration, every conversation turn, delivery modality, generated media, judge label, and final outcome.
- Crescendo escalates through increasingly harmful turns and backtracks after refusals, while MUSE implements attack algorithms through a common interface.
- ITMS rotates per-turn modalities for context-maintaining strategies, converts attacker text into multimodal messages, and logs the sequence for controlled ablation.
- The conversion pipeline produces audio, images, and video, caching assets by project, prompt, and modality for reuse across target models.
- Provider routing presents a uniform interface while dispatching requests to thin provider-specific clients.
- The five-level taxonomy distinguishes Compliance, Partial Compliance, Indirect Refusal, Direct Refusal, and Non-Responsive.
4 Experiments
Experiments evaluate five red-teaming strategies across six models, beginning with strong single-turn refusal and then testing multi-turn attacks, convergence, harm categories, and modality configurations. Multi-turn attacks achieve high hard ASR, while ITMS primarily accelerates convergence and produces model-family-dependent modality effects.
- Experimental Setup: 50 harmful goals span five categories and are evaluated across six models from four providers using five strategies with a 10-turn maximum.The evaluation comprises approximately 3,700 runs, including single-turn baselines, the main red-teaming experiment, and ITMS ablation.
- Single-Turn Baseline: 90–100% single-turn refusal rates establish strong baseline safety across all six models and tested modalities.The baseline is intended to show that subsequent attack success follows multi-turn pressure rather than weak direct-request safety.
- Automated Red-Teaming: 90–98% hard ASR is achieved by Crescendo across all six models, while PAIR reaches 96–100% on five of six models.PAIR reaches 60% hard ASR against Claude Sonnet 4, where a 26-point GZW indicates more partial than complete disclosure.
- Automated Red-Teaming: Violent Durian varies from 2% hard ASR against Claude Sonnet 4 to 86% against Qwen2.5-Omni, indicating model-specific rather than universal weaknesses.The result concerns template-driven high-pressure tactics and shows substantial cross-model variance.
- ITMS Convergence: ITMS reaches success in fewer turns for four of six models, while final ASR changes are mixed when Crescendo already saturates defenses.For Qwen2.5-Omni, ITMS-VD raises hard ASR from 86% to 100% and reduces mean turns from 3.0 to 2.1.
- Convergence and Categories: Crescendo and ITMS-Crescendo accumulate successes across ten turns, whereas Violent Durian concentrates 70% of successes in the first three turns and PAIR plateaus by turn 8.Fraud is most vulnerable across strategies, while Drugs and Weapons are most resistant.
- ITMS Ablation: Modality effects are model-family-dependent: non-text inputs raise Gemini hard ASR by 2–6 points but lower Qwen ASR, including a −14-point image-only change for Qwen2.5-Omni.Adding text partially attenuates both effects, and a third modality adds no further incremental change.
5 Conclusion
MUSE provides a reproducible platform for multimodal safety evaluation, and its evaluation finds strong multi-turn attack success, faster ITMS convergence, and model-family-specific modality effects.
- MUSE integrates cross-modal payload generation, multi-turn attack orchestration, and a five-level LLM judge in one interactive platform.Its run-centric architecture supports reproducible analysis of approximately 3,700 red-teaming runs across six models, five strategies, and six modality configurations.
- Multi-turn strategies achieve 90–100% ASR against models with near-perfect single-turn refusal.
- ITMS accelerates convergence by destabilizing early-turn defenses even when final ASR is saturated.
- Modality effects are model-family-specific, supporting provider-aware cross-modal safety testing.
A.1 Human Validation of Automated Judge
The automated judge was compared with human relabeling on 100 randomly sampled runs using the same five-level taxonomy, with high agreement and disagreements concentrated near the Compliance boundary.
- 93% agreement was observed between the GPT-4o judge and human annotations across 100 randomly sampled runs.The sample covered different models and attack strategies, and humans used the same five-level taxonomy.
- Most disagreements occurred between Compliance and Partial Compliance.
- No clear refusals were labeled as full Compliance, and no systematic hard-ASR inflation was observed.
A.2 System Interface
MUSE provides separate interfaces for configurable multi-turn red-teaming and single-turn multimodal testing, both accessible through unified navigation.
- Figure 4 illustrates the workflow through two web interfaces exposed from a unified navigation bar.
- Automated Red Teaming: The Automated Red Teaming interface configures multi-turn strategies, target goals, target models, modality rotation, and maximum turns.It supports controlled and reproducible attack runs.
- Multimodal Test: The Multimodal Test interface composes prompts across text, audio, image, or video and generates the corresponding payload.It returns both the model output and automated safety judgment.
A.3 Average Turns to Success
Average turns to success measures how quickly successful attacks reach the first Compliance judgment, revealing convergence differences that final ASR alone cannot show.
- Average turns to success is computed only over successful runs and reports the turns required to reach the first Compliance judgment.
- ITMS-VD reaches 100% ASR on Qwen2.5-Omni with a mean of 2.1 turns and zero failures.
- Parenthesized Δ values compare ITMS variants with their base strategies, while bold values indicate faster ITMS convergence.
A.4 License
MUSE is released under the MIT License. The accompanying figure labels identify two MUSE user-interface panels.
- MUSE is released under the MIT License.
- Panel (a) is labeled the Automated Red Teaming interface.
- Panel (b) is labeled the Multimodal Test interface and described as single-turn.