When Reasoning Is Not Enough: Proactive Inquiry for Cross-Modal Safety in Multimodal Large Language Models

1 INTRODUCTION

• Intent-level risk occurs when safety-critical cross-modal ambiguity forces an assumption that can commit subsequent reasoning to a hazardous branch.Path-level optimization alone cannot repair a wrong premise once reasoning proceeds from it.Source: §1 · pp. 1–2
• Entropy-only clarification can over-interrupt benign inputs and miss hazardous ones, while existing multi-turn benchmarks do not supervise clarification of ambiguous cross-modal premises.The paper identifies gaps in triggering signals, reward design, and data.Source: §1 · p. 2
• SAFE-PRO combines proactive clarification and risk-guided path optimization through an RCU signal that joins predictive entropy with a learned cross-modal risk score.The outer loop asks when RCU is high; the inner loop concentrates contrastive path supervision on high-risk steps.Source: §1 · p. 2
• SSUI-Dialog supplies cross-modal multi-turn examples with safety-critical premise ambiguity and dual-intent supervision.Its construction adds ambiguity injection and safe- and unsafe-intent reply simulation to the SSUI pipeline [15].Source: §1 · p. 2, Figure 2 · p. 3
• SAFE-PRO raises average safety by 6.59 points and lowers average harm by 5.03 points relative to SRPO, while roughly halving over-refusal on MOSSBench.Across seven benchmarks and two base MLLMs, it also outperforms GPT-4o and Claude-3.5-Sonnet on every evaluated metric.Source: §1 · p. 2

2.1 Cross-Modal Safety in MLLMs

• Existing cross-modal defenses often judge safety at the final output and presume fully specified intent, leaving intermediate reasoning vulnerable to error propagation.Prior multi-turn multimodal resources focus on risks that emerge or escalate across turns, rather than training or evaluating clarification of an ambiguous premise.Source: §2.1 · p. 3

2.2 Interactive and Proactive Language Models

• SSUI-Dialog inherits SSUI’s three-tier taxonomy of 3 primary, 19 secondary, and 68 tertiary categories [15].The taxonomy passage identifies the categories as a structure for cross-modal safety risk.Source: Figure 3 · p. 4
• Prior proactive-inquiry methods establish feasibility in unimodal text settings, but were not designed for safety-critical multimodal scenarios.Their signals are safety-unaware, their reward structures penalize clarification at risky branches, and they do not train or evaluate on multimodal inputs.Source: §2.2 · pp. 3–4

3 THE SSUI-DIALOG DATASET

• SSUI-Dialog targets a data gap: existing benchmarks do not supply safety-critical ambiguous cross-modal inputs paired with naturalistic multi-turn dialogues that resolve the ambiguity.The dataset is constructed to support training and evaluation for intent-level cross-modal safety.Source: §3 · p. 4

3.1 Construction Pipeline

• The six-stage pipeline removes a safety-critical premise, generates a neutral clarification, simulates safe and unsafe replies, composes labeled trajectories, then verifies and unifies them.Dual replies train distinct downstream behavior conditioned on clarified intent rather than rote continuation.Source: §3.1 · p. 4

3.2 Scale and Safety Taxonomy

• The pipeline yields 3,912 SSUI-Dialog instances, expanded to 7,824 trajectories, with source-instance splits of 3,130 / 391 / 391 for train, validation, and test.Splitting by SSUI source instance is intended to prevent train/test leakage.Source: §3.2 · p. 4
• SSUI-Dialog inherits SSUI’s taxonomy of 3 primary, 19 secondary, and 68 tertiary categories, with each ambiguous query retaining its source sample’s leaf label.The labels ground removed premises in typed hazards and support category-resolved analysis.Source: §3.2 · p. 5

4.1 Overview and Notation

• The RCU gate triggers clarification at u ≥ τhigh, selects intermediate steps for training-time path optimization, and leaves lower-uncertainty reasoning untouched.At inference, only the outer-loop clarification gate is active.Source: §4.1 · p. 5

4.2 Risk-Conditioned Uncertainty Estimation

• RCU combines normalized predictive entropy with cross-modal risk; its risk head is trained on SRPO contrastive branches and reaches 0.894 ROC-AUC versus 0.612 for entropy alone.The branches provide safe/unsafe labels without additional annotation, treated as weak supervision because early steps of unsafe branches may be benign.Source: §4.2 · pp. 5–6

4.3 Inner Loop: Risk-Guided Path Optimization

• The inner loop contrasts safe and unsafe continuations at intermediate steps, shaping the trajectory where the paths diverge rather than only preferring a final answer.Risk-proportional step sampling is importance-weighted to keep gradients unbiased and can reduce variance under the stated positive-correlation condition.Source: §4.3 · p. 6

4.4 Outer Loop: Cross-Modal Proactive Inquiry

• When RCU crosses the high threshold, the outer loop asks a safety-grounded question about the uncertain premise and reintegrates the user’s reply into the reasoning trace.Clarifications are bounded by Kmax = 3.Source: §4.4 · pp. 6–7

4.5 Composite Reward

• The composite reward prioritizes verified answer safety over over-refusal, helpfulness, and interaction efficiency, with efficiency too lightly weighted to override safety.The components include a benign-input refusal penalty and a reward for fewer clarification turns.Source: §4.5 · p. 7

4.6 Training Pipeline

• Training proceeds through risk-head pretraining, interactive supervised fine-tuning, and RCU-gated GRPO that jointly optimizes the outer and inner loops.The interactive fine-tuning stage masks user-reply tokens from the policy loss; the final stage uses the composite reward and risk-guided contrastive supervision.Source: §4.6 · p. 7

5.1 Variance Reduction of Risk-Guided Sampling

• When Cov[g^2, log a] > 0, risk-guided sampling reduces gradient-estimator variance for a range of γ, but excessive concentration can raise it again.The variance-optimal distribution is proportional to gradient norm; risk scores provide a computable surrogate, and γ = 1.5 is selected empirically.Source: §5.1 · pp. 7–8

5.2 Safety Bound under RCU Gating

• The safety bound decomposes residual unsafe-completion risk into missed critical steps, unresolved clarifications, and exhausted clarification budgets, under calibration, clarification-efficacy, and localization assumptions.The bound is informative only when its right-hand side is below one.Source: §5.2 · p. 8
• With α = β = 0.5 and τhigh = 0.65, confidently unsafe near-zero-entropy steps cannot trigger clarification and are addressed only by the training-time inner loop.Lowering τhigh or increasing β can shrink the missed-step term ξ, at the cost of more interruptions and a greater chance of exhausting the clarification budget.Source: §5.2 · pp. 8–9

5.3 Variance Reduction and Optimization

• For γ in the variance-reducing range, the inner-loop contrastive updates required scale down proportionally to the estimator-variance factor κ = V(γ)/V(0) < 1.This optimization argument covers Jinner only, not Stage 3’s GRPO term.Source: §5.3 · p. 9

6.1 Experimental Setup

• Evaluation applies SAFE-PRO to two MLLM backbones across five single-turn benchmarks, SSUI-Dialog, and MOSSBench, measuring safety, helpful clarification, resolution turns, and over-refusal.Baselines include safety-only, interactive-only, and commercial MLLMs.Source: §6 · p. 9, §6.1 · p. 9

6.2 Main Results

• 82.77 vs. 76.18 Avg↑ and 7.64 vs. 12.67 Avg↓ on Qwen2.5-VL; SAFE-PRO leads on every Table 1 metric, while LLaVA-NeXT exceeds commercial models on both averages.The Qwen2.5-VL comparisons are against SRPO; its USBBench ARR is 2.41 versus Claude-3.5-Sonnet’s 25.79.Source: §6.2 · pp. 9–10, Table 1 · p. 10
• STaR-GATE and CollabLLM lower USBBench ASR from 75.26 to 61.40 and 52.70, respectively, but CollabLLM remains 21.24 points above SAFE-PRO.The authors identify trigger alignment, safety-prioritized reward, and cross-modal multi-turn training data as deficiencies addressed by SAFE-PRO.Source: §6.2 · p. 10

6.3 Multi-Turn Safety Dialogue

• 15.83 ASR and 0.68 CSHC with TTR 1.62 make SAFE-PRO the strongest SSUI-Dialog result, using 0.62 clarification questions per dialogue on average.SRPO reports 41.20 ASR and 0.31 CSHC; CollabLLM reports TTR 3.18 and has ASR more than double SAFE-PRO’s.Source: Table 2 · p. 10, §6.3 · p. 10

6.4 Over-Refusal Analysis

• 19.7 ORR and 79.62 MSSBench accuracy roughly halve SRPO’s over-refusal while raising accuracy; SAFE-PRO has the lowest ORR among compared models.Removing the over-refusal penalty raises ORR to 33.5; the benign controls for that penalty contain no MOSSBench images or prompts.Source: §6.4 · pp. 10–11, Table 3 · p. 11

6.5 Ablation Studies

• Removing either RCU signal or either loop worsens SSUI-Dialog safety: entropy-only increases TTR to 3.05, while removing the outer loop raises ASR to 38.50.Using only the risk score worsens ASR by 5.6 points; removing the inner loop yields ASR 24.71.Source: Table 4 · p. 11, §6.5 · p. 11
• Removing the over-refusal penalty raises ORR from 19.70 to 33.50; removing helpfulness lowers CSHC from 0.68 to 0.51, and uniform step sampling worsens ASR by 4.0 points.The risk head achieves ROC-AUC 0.894 versus 0.612 for predictive entropy alone. Without the dialogue extension, multi-turn ASR is 32.18, more than double the full system’s.Source: §6.5 · p. 12

6.6 Qualitative Case Study

• The baseline assumes the user intends to mix bleach and acid cleaner, whereas SAFE-PRO asks which product is intended and resumes safely after clarification.The case illustrates a hazardous premise—not faulty reasoning—as the source of the baseline’s failure.Source: Figure 5 · p. 11, §6.6 · p. 12

• SAFE-PRO reduces attack success rates and pathological caution relative to path-only and interaction-only baselines.Source: §7 · p. 12
• Intent-level risk is a distinct MLLM vulnerability: cross-modal ambiguity that reasoning-path optimization alone cannot resolve.Source: §7 · p. 12
• SAFE-PRO integrates reasoning-path optimization with proactive inquiry, using RCU to trigger targeted clarification at safety-critical states while limiting over-interruption and over-refusal.Source: §7 · p. 12
• SSUI-Dialog is a cross-modal multi-turn dialogue dataset featuring safety-critical intent ambiguity and dual-intent supervision.Source: §7 · p. 12
• The analysis characterizes when risk-guided sampling reduces gradient variance and bounds unsafe-completion probability under RCU gating.Source: §7 · p. 12