Paper deep dive
SafeMLRM: Demystifying Safety in Multi-modal Large Reasoning Models
Junfeng Fang, Yukai Wang, Ruipeng Wang, Zijun Yao, Kun Wang, An Zhang, Xiang Wang, Tat-Seng Chua
Models: Mulberry, QVQ, R1-Onevision
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%
Last extracted: 3/12/2026, 7:54:44 PM
Summary
SafeMLRM is a systematic safety analysis of Multi-modal Large Reasoning Models (MLRMs), identifying that acquiring reasoning capabilities leads to a 'Reasoning Tax'âa significant degradation in safety alignment compared to base MLLMs. The study introduces OpenSafeMLRM, a toolkit for evaluating these models, and reveals critical findings regarding safety blind spots in specific scenarios and the existence of emergent self-correction mechanisms where models override unsafe reasoning with safe answers.
Entities (5)
Relation Signals (3)
SafeMLRM â introduced â OpenSafeMLRM
confidence 100% ¡ This work presents the first systematic safety analysis... we open-source OpenSafeMLRM
OpenSafeMLRM â evaluates â MLRM
confidence 95% ¡ OpenSafeMLRM, the first toolkit for MLRM safety evaluation
MLRM â exhibits â Reasoning Tax
confidence 95% ¡ The Reasoning Tax: Acquiring reasoning capabilities catastrophically degrades inherited safety alignment.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The rapid advancement of multi-modal large reasoning models (MLRMs) -- enhanced versions of multimodal language models (MLLMs) equipped with reasoning capabilities -- has revolutionized diverse applications. However, their safety implications remain underexplored. While prior work has exposed critical vulnerabilities in unimodal reasoning models, MLRMs introduce distinct risks from cross-modal reasoning pathways. This work presents the first systematic safety analysis of MLRMs through large-scale empirical studies comparing MLRMs with their base MLLMs. Our experiments reveal three critical findings: (1) The Reasoning Tax: Acquiring reasoning capabilities catastrophically degrades inherited safety alignment. MLRMs exhibit 37.44% higher jailbreaking success rates than base MLLMs under adversarial attacks. (2) Safety Blind Spots: While safety degradation is pervasive, certain scenarios (e.g., Illegal Activity) suffer 25 times higher attack rates -- far exceeding the average 3.4 times increase, revealing scenario-specific vulnerabilities with alarming cross-model and datasets consistency. (3) Emergent Self-Correction: Despite tight reasoning-answer safety coupling, MLRMs demonstrate nascent self-correction -- 16.9% of jailbroken reasoning steps are overridden by safe answers, hinting at intrinsic safeguards. These findings underscore the urgency of scenario-aware safety auditing and mechanisms to amplify MLRMs' self-correction potential. To catalyze research, we open-source OpenSafeMLRM, the first toolkit for MLRM safety evaluation, providing unified interface for mainstream models, datasets, and jailbreaking methods. Our work calls for immediate efforts to harden reasoning-augmented AI, ensuring its transformative potential aligns with ethical safeguards.
Tags
Links
- Source: https://arxiv.org/abs/2504.08813
- Canonical: https://arxiv.org/abs/2504.08813
Trouble viewing inline? Open PDF directly â
Full Text
39,486 characters extracted from source content.
Expand or collapse full text
SafeMLRM: Demystifying Safety in Multi-modal Large Reasoning Models Junfeng Fang 1 , Yukai Wang 1 , Ruipeng Wang 2 , Zijun Yao 1 , Kun Wang 3 , An Zhang 2 , Xiang Wang 2â , Tat-Seng Chua 1 1 National University of Singapore, 2 University of Science and Technology of China 3 Nanyang Technological University fangjf1997@gmail.com Abstract The rapid advancement of multi-modal large reasoning models (MLRMs) â en- hanced versions of multimodal language models (MLLMs) equipped with reason- ing capabilities â has revolutionized diverse applications. However, their safety implications remain underexplored. While prior work has exposed critical vul- nerabilities in unimodal reasoning models, MLRMs introduce distinct risks from cross-modal reasoning pathways. This work presents the first systematic safety analysis of MLRMs through large-scale empirical studies comparing MLRMs with their base MLLMs. Our experiments reveal three critical findings:(1) The Reasoning Tax:Acquiring reasoning capabilities catastrophically degrades inher- ited safety alignment. MLRMs exhibit 37.44% higher jailbreaking success rates than base MLLMs under adversarial attacks.(2) Safety Blind Spots:While safety degradation is pervasive, certain scenarios (e.g.,Illegal Activity) suffer 25Ăhigher attack rates â far exceeding the average 3.4Ăincrease, revealing scenario-specific vulnerabilities with alarming cross-model and datasets consistency.(3) Emergent Self-Correction:Despite tight reasoning-answer safety coupling, MLRMs demon- strate nascent self-correction â 16.9% of jailbroken reasoning steps are overridden by safe answers, hinting at intrinsic safeguards. These findings underscore the urgency of scenario-aware safety auditing and mechanisms to amplify MLRMsâ self-correction potential. To catalyze research, we open-sourceOpenSafeMLRM, the first toolkit for MLRM safety evaluation, providing unified interface for mainstream models, datasets, and jailbreaking methods. Our work calls for immediate efforts to harden reasoning-augmented AI, ensuring its transformative potential aligns with ethical safeguards. OpenSafeMLRM https://github.com/fangjf1/OpenSafeMLRM 1 Introduction With the rapid advancement of AI, large reasoning models (LRMs) like the DeepSeek series have gained significant attention [1,2,3,4]. These models excel in performing complex tasks through meticulous reasoning, enabling transformative impacts across various downstream domains [5, 6]. Recently, this influence has expanded to multi-modal applications [7,8,9]. By embedding chain-of-thought data during the fine-tuning or reinforcement learning phrase of base multi-modal large language models (MLLMs) [10,11,12], researchers have developedMulti-modal Large Reasoning Models (MLRMs)[13,14,15,16]. Compared to prompt-based multi-modal reasoning (e.g.,instructing base model with âPlease think step-by-stepâ) [17,18,19,20], MLRMs inherently encode reasoning process, demonstrating greater potential in alignment with human intentions; in contrast to asynchronous multi-modal reasoning paradigm (e.g.,using one model to describe an â Corresponding author:xiangwang1223@gmail.com. arXiv:2504.08813v1 [cs.LG] 9 Apr 2025 image for an LRM to reason) [21,22,23,24], MLRMs are end-to-end models rather than cascaded pipelines, avoiding compounding errors and modality-specific information loss. These advantages position MLRM as a cornerstone for future advancements in AI reasoning [25]. However, alongside these reasoning advancements, model safety concerns have become increasingly critical [26,27,28], particularly the risks of unsafe content generation [29,30]. Recent community efforts have evaluated the safety capabilities of mainstream LRMs like DeepSeek, especially their resilience to jailbreaking attacks [31,32,33]. These studies reveal urgent findings, demonstrating that exposure of reasoning processes amplifies safety risks, with attack success rates rise dramatically [34,35]. While these findings motivate deeper investigations into LRM safety, the safety protocol of MLRMs remains underexplored. This gap demands imperative attention: multi-modal integration introduces novel attack vectors like cross-modal adversarial triggers, fundamentally expanding the threat surface beyond traditional text-only vulnerabilities [36, 37]. This study conducts the first systematic safety evaluation of advancing MLRMs. To catalyze this, we open-sourceOpenSafeMLRM, the first toolkit for MLRM safety evaluation, providing unified interface for various models, datasets, and jailbreaking methods. WithOpenSafeMLRM, we evaluate mainstream MLRMs such as R1-Onevision [38], M-Eureka-Qwen [14], Mulberry-Qwen2VL [39], Mulberry-Llava [39] and Mulberry-Llama [39] across 10 canonical unsafe scenarios curated from M-SafetyBench [37], and further adapt black-box jailbreaking methods traditionally used for MLLMs [36] for probing MLRMsâ safety resilience. All evaluations are applied to both target MLRMs and their base MLLMs. This comparative framework allows us to quantify how reasoning capability acquisition impacts the safety protocols. Empirical results reveal several noval findings:(1) Reasoning Tax:The pursuit of advanced reasoning capabilities via supervised fine-tuning (SFT)/reinforcement learning (RL) imposes a steep safety cost â MLRMs exhibit 37.44% higher attack success rates than their base MLLMs, with safety alignment catastrophically eroded during capability enhancement.(2) Safety Blind Spots:While safety degradation is pervasive, certain scenarios (e.g.,Illegal Activity) suffer 25Ăhigher attack rates â far exceeding the average 3.4Ăincrease, revealing scenario-specific vulnerabilities with alarming cross-model and datasets consistency.(3) Emergent Self-Correction:Despite tight reasoning-answer safety coupling, MLRMs demonstrate nascent self-correction: 16.23% of jailbroken reasoning steps are overridden by safe answers, hinting at intrinsic safeguards. While our evaluation framework conduct comprehensive experiments, we acknowledge that selection bias in test samples and evaluation criteria design may inevitably introduce measurement distortions. To mitigate this, we will refine this evaluation framework by incorporating additional datasets, models, attack vectors, and defense baselines [36] to enhance its comprehensiveness and reliability. These findings reveal fundamental gaps in MLRMsâ current safety mechanisms and expose the alarming efficacy of adversarial strategies in bypassing their safeguards. In summary, our work calls for immediate efforts to harden reasoning-augmented AI, ensuring its transformative potential aligns with ethical safeguards. 2 Experimental Setup This work aims to systematically investigate the safety of MLRMs and their safety degradation compared to base MLLMs. Here, we formalize the research aim of this paper and provided specific experimental configurations, including datasets, baseline models and evaluation metrics. Research Aim Our aim is toexplore the safety vulnerabilities in MLRMs. Through comprehensive analysis across various unsafe scenarios, we highlight key risks and compare the safety performance of MLRMs against their base MLLMs, providing valuable insights for enhancing their safety. 2.1 Datasets & Jailbreaking Methods. We evaluate our framework on two widely adopted benchmarks for MLLM safety: M-SafetyBench [37] and SafetyBench [40]. 2 Figure 1: Comparison of ASR and HR scores across various MLRMs and their base MLLMs under vanilla unsafe text queries. The dark blue bars represent the ASR and HR of the base MLLMs. Best viewed in color. â˘M-SafetyBench comprises 13 safety-critical scenarios (e.g.,illegal activities, hate speech) that MLLMs should strictly prohibit. Constructed via the QueryRelated pipeline [37], this dataset first generates malicious queries across scenarios, then uses GPT-4 [41] to extract unsafe keywords and synthesize three image types: (1) Stable Diffusion (SD) [42] images: Visually aligned with unsafe keywords. (2) Text-overlaid images: Unsafe text superimposed on benign visuals. (3) Hybrid images: SD-generated visuals combined with adversarial typography. Following [37], we adopt hybrid images (empirically shown to be the most effective jailbreaking method among the three) as the jailbreaking method for evaluation. â˘SafetyBench covers 10 prohibited topics curated from the OpenAI and Metaâs Llama-2 [43] usage policies. Built via the FigStep pipeline [40], it leverages GPT-4 [41] to rewrite queries into instructional formats (e.g.,âSteps to manufacture illegal drugsâ), enumerates them as numbered lists, and converts these into typographic images. These images are then fed to target models to complete missing steps â a second jailbreaking paradigm in our evaluation. To ensure cross-benchmark consistency, we retain the 10 overlapping safety topics between two datasets. 2.2 Baseline MLRMs We evaluate five prominent open-source MLRMs spanning diverse base architectures and parameter scales: R1-OneVision [38], M-EUREKA-Qwen [14], Mulberry-Qwen2-VL [39], Mulberry-LLaVA [39] and Mulberry-LlaMA [39]. These models exhibit R1-style reasoning capabilities through SFT and RL with human feedback al ignment. Specifically, they generate intermediate reasoning steps before producing final answers, enhancing performance on complex multi-modal tasks but simultane- ously amplifies safety risks due to extended reasoning pathways. 2.3 Evaluation Metrics We selected two evaluation metrics. The first isHarmfulness Rating (HR), which employs an addi- tional LLM to assess the level of harm in the generated content. Following [44], we adopted a two-step evaluation to calculate HR: Initially, the output undergoes a substring lookup; if the modelâs response contains phrases like âSorry, I can notâ, the HR is immediately set to 0. Next, a detailed prompt with specific scoring rules is designed to instruct GPT-4o-mini [45] to evaluate the harmfulness of the modelâs output according to the rules, using a 0-5 scale where 0 indicates no harmfulness, and 5 indicates extremely harmful content. 3 Figure 2: Comparison of ASR and HR scores across MLRMs and their base MLLMs under jailbreak attacks. The dark blue bars represent the ASR and HR of the base MLLMs. Best viewed in color. The second metric isAttack Success Rate (ASR), defined as the number of successful attacks divided by the total number of attempted attacks. Formally, for a particular instruction datasetD, we define ASR=I(Q i )/|D|, whereQ i represents the set of text and image queries, andI(¡)is an indicator function such thatI(¡) = 1if the response engages with the malicious query, andI(¡) = 0otherwise. ASR is a common metric for evaluating model safety and robustness. In our experiments, we addressed a potential issue: directly using the LLM as a judge to determine if the model output has been âjailbrokenâ introduces considerable uncertainty. Therefore, based on the detailed guidelines in the aforementioned prompt, we define a jailbreak as successful when the HR score equals 4 or 5. Evaluation Dimensions:As there has been no comprehensive evaluation specifically targeting MLRMs, we define two key dimensions for assessment:Result SafetyandOverall Safety. These are equally important, as different LRM models may present outcomes in varying formats â either as raw results or as reasoning alongside the results. In the following sections, we will exhibit and analyze the metrics for these two dimensions. Note that while we also report metrics related toReasoning Safetyfor investigating the relationship between the safety of the reasoning process and the final output, we consider this secondary to the two primary dimensions. 3 Safety Inspection of MLRMs 3.1 Reasoning Tax Prior work has observed the âsafety taxâ in reasoning models,i.e.,performance deterioration caused by safety alignment [35]. We identify a critical counterpart: the reasoning tax, defined as the safety degradation incurred when augmenting MLLMs with reasoning capabilities through SFT or RL. To quantify this phenomenon, we systematically compare safety metrics between four safety-aligned base MLLMs and five MLRMs derived from them. Experimental Protocol.To isolate the impact of reasoning capability acquisition, we adopt a two- stage evaluation: For base MLLMs, we directly assess the outputs for HR and ASR, as these models lack explicit reasoning step generation. For MLRMs, we collect HR and ASR across Think, Answer and Overall processes. Note that although we employed a standard prompt template to enforce the separation of the reasoning and answer processes, some MLRMs (e.g.,Mulberry-LlaMA) still struggled to strictly follow the âThink + Answerâ format in their outputs. For these models, we report their overall safety solely. Figure 1 and 2 exhibit the results under vanilla unsafe text queries and jailbreak attacks, respectively. 4 Table 1: Comparison of HR scores on M-SafetyBench datasets across various MLRMs and their base MLLMs. For abbreviations,Vani.andJail.refer to performance under vanilla unsafe text queries and jailbreak attacks, respectively. The dash in the âModelâ column represents the base MLLMs. BaseModelMethodStage IA HS RA PH FR PO PV LO FA HC QW2.5-VL[46] - Vani.Overall0.040.280.841.210.301.850.682.674.043.27 Jail.Overall2.482.734.253.833.404.113.683.154.224.18 R1- OV [38] Vani. Think3.102.972.633.493.403.673.103.453.624.23 Answer3.553.293.234.193.924.513.204.104.364.32 Overall3.033.072.703.993.484.403.183.724.354.28 Jail. Think4.123.624.274.354.143.904.123.203.844.20 Answer4.363.864.664.594.514.154.543.714.034.25 Overall4.313.914.614.604.374.324.333.504.224.21 Eureka- QW [14] Vani. Think1.951.973.203.452.704.002.903.333.933.54 Answer2.031.873.343.112.294.152.553.354.043.62 Overall2.232.013.363.532.654.222.973.233.993.90 Jail. Think3.403.124.004.243.903.913.793.194.013.74 Answer2.893.254.304.033.663.823.673.083.913.71 Overall3.393.454.254.243.974.054.013.254.113.91 QW2-VL [47] - Vani.Overall0.050.050.550.790.141.750.361.853.822.25 Jail.Overall3.663.294.344.224.274.394.063.104.053.88 MBerry- QW [39] Vani. Think2.122.342.573.063.122.962.632.573.282.83 Answer2.452.473.323.442.623.953.063.353.883.61 Overall2.502.443.393.552.754.103.033.654.083.82 Jail. Think3.272.873.023.583.452.973.472.382.492.91 Answer4.414.074.484.474.444.084.323.393.863.86 Overall4.484.194.364.574.604.334.453.554.083.99 LMA3- LVA [48] - Vani. Overall0.150.501.451.920.582.450.912.074.072.64 Jail.Overall3.773.154.054.224.053.763.963.323.803.85 MBerry- LVA [39] Vani.Overall1.953.364.413.393.743.802.603.323.993.55 Jail.Overall3.853.523.554.033.773.783.893.253.443.79 LMA-3.2- Vision [43] - Vani.Overall0.100.732.071.760.624.431.093.734.423.63 Jail.Overall0.761.662.181.961.883.592.373.044.173.84 MBerry- LMA [39] Vani.Overall0.100.641.111.310.623.000.763.834.294.23 Jail.Overall3.383.182.983.583.113.653.423.513.564.07 Key Findings.Figures 1 and 2 reveal systematic safety degradation across all MLRMs. Specifically, â˘Overall Safety Collapse: MLRMs exhibit 31.30% higher ASR (59.52%vs.base MLLMsâ 28.22%) and 1.64 higher HR (3.07%vs.1.43), demonstrating that exposing reasoning chains fundamentally expands attack surfaces. â˘Persistent Answer Degradation: Even when ignoring unsafe reasoning steps, MLRM answers show 25.89% higher ASR and 1.30 higher HR compared to base models. This proves safety erosion persists beyond reasoning exposure, suggesting SFT/RL alignment damages intrinsic safeguards. â˘Architectural Vulnerability: Qwen2.5-based MLRMs suffer catastrophic safety loss (ASR + 40.06%, HR + 2.02), suggesting architectural incompatibility between reasoning and safety mechanisms. Notably, MBerry-LMA exhibits an inverse trend: its safety metrics improve post-reasoning aug- mentation (ASR - 4.8%, HR - 0.21). We believe this anomaly hints at potential safeguards, and may provide a rare blueprint for designing safety-resilient reasoning models. â˘Reasoning as Attack Vector: Unsafe reasoning occurs 12.52% more frequently than unsafe answers, highlighting systemic risks in exposing intermediate reasoning to users. 5 Table 2: Comparison of HR scores on SafetyBench datasets across various MLRMs and their base MLLMs. For abbreviations,Vani.andJail.refer to performance under vanilla unsafe text queries and jailbreak attacks, respectively. The dash in the âModelâ column represents the base MLLMs. BaseModelMethodStage IA HS RA PH FR PO PV LO FA HC QW2.5-VL [46] - Vani.Overall0.220.420.000.180.501.960.743.943.923.70 Jail.Overall2.782.684.363.044.084.043.143.564.323.62 R1- OV [38] Vani. Think3.302.574.122.943.484.173.103.404.003.22 Answer4.003.193.983.433.944.593.393.763.944.18 Overall3.442.663.843.143.664.302.983.224.063.64 Jail. Think4.123.794.864.584.444.204.523.403.804.34 Answer4.673.884.914.604.514.384.583.673.874.02 Overall4.183.784.884.624.544.484.523.583.883.98 Eureka- QW [14] Vani. Think2.891.613.262.142.184.042.283.303.903.54 Answer2.501.583.021.941.864.142.123.143.643.50 Overall2.501.503.041.901.844.002.303.303.543.28 Jail. Think3.142.843.903.343.464.183.503.383.783.62 Answer3.262.984.123.603.604.143.663.263.723.36 Overall3.322.83.983.523.584.183.543.523.863.60 QW2-VL [47] - Vani.Overall0.280.340.280.060.062.240.763.083.923.68 Jail.Overall3.302.744.823.344.404.483.824.044.284.40 MBerry- QW [39] Vani. Think2.722.423.142.392.623.372.622.713.243.33 Answer2.962.473.452.682.964.102.843.803.653.92 Overall2.882.303.422.463.064.162.683.723.663.86 Jail. Think4.153.954.484.104.314.364.163.733.893.82 Answer4.464.084.804.384.564.664.403.564.004.20 Overall4.694.244.884.424.644.524.463.464.004.18 LMA3- LVA [48] - Vani.Overall0.660.842.260.861.082.601.203.323.863.58 Jail.Overall4.223.064.484.364.243.764.043.323.803.85 MBerry- LVA [39] Vani.Overall1.901.463.681.523.283.482.223.624.043.64 Jail.Overall4.383.564.424.083.944.043.843.383.383.58 LMA-3.2- Vision [43] - Vani.Overall1.781.361.200.721.684.301.763.904.404.00 Jail.Overall2.923.304.263.863.644.223.583.523.983.96 MBerry- LMA [39] Vani.Overall1.180.721.700.881.003.181.123.844.243.64 Jail.Overall3.964.044.744.524.484.463.943.903.984.20 Takeaway 3.1: Reasoning Tax in MLRMs SFT/RL-based reasoning acquisition severely compromises safety alignment of base MLLMs, a phenomenon we term the âreasoning taxâ in MLRMs. 3.2 Safety Blind Spots We conduct fine-grained analysis to uncover safety blind spotsâscenarios where MLRMs exhibit catastrophic safety failures despite base MLLMs achieving near-perfect alignment. We ask: (1) Do MLRMs inherit base modelsâ scenario-specific safety profiles? (2) Does the reasoning tax manifest heterogeneously across scenarios? Experimental Protocol.Following [37], we evaluate 10 safety-critical scenarios:Illegal Activity, Hate Speech,Malware Generation,Physical Harm,Fraud,Pornography,Privacy Violence, Legal Opinion,Financial Advice, andConsultation. Comparison of HR scores across various scenarios on M-SafetyBench and SafetyBench datasets are exhibited in Table 1 and 2, respectively. 6 Figure 3: Comparison of ASR scores across different MLRMs and their base MLLMs. For abbre- viations,va.andja.refer to performance under vanilla unsafe text queries and jailbreak attacks, respectively. We useMBto denote MLRM that are developed with MBerry method. Additionally, we provide a more intuitive display for ASR in the form of a radar chart, as shown in Figure 3. Key Findings.Experimental results reveal alarming safety blind spots. For instance, inIllegal Activityscenario, MLRMs show 3.79Ăhigher ASR than base MLLMs on average. Further- more, while the base MLLM Qwen2.5-VL achieves near-perfect safety (ASR < 3%), its MLRM derivative R1-Onevision suffers catastrophic failure (ASR > 50%), achieving near 25Ădegrada- tion. This exposes catastrophic alignment erosion in reasoning-enhanced architectures. Overall, safety degradation varies dramatically across scenarios (ÎASR range: 8.1%-2500%), withIllegal Activity/Pornographybeing most/least affected scenarios, demanding urgent scenario-specific red teaming and adaptive alignment protocols for MLRMs. Takeaway 3.2: Safety Blind Spots MLRMs introduce critical safety blind spots â scenarios where base MLLMs excel (e.g., Illegal Activity) become catastrophic vulnerabilities post-reasoning augmentation. 3.3 Emergent Self-Correction In this section, we aim to analyze the relationship between thinking safety and answer safety. This helps uncover potential correlations in the safety resilience across different stages of MLRM outputs, providing insights for constructing hierarchical defense strategies. Experimental Protocol.We select three MLRMs (i.e.,R1-OneVision, M-EUREKA-Qwen, Mulberry-Qwen), all strictly following âThink + Answerâ output formats. From the 10 safety- critical scenarios, we randomly sample 100 adversarial queries per scenario, forming a 1000-sample test set. For each query, we compute Think-HR and Answer-HR under jailbreaking and visualize their normalized joint distribution via 2D heatmaps, as exhibited in Figure 4. Key Findings.Figure 4 reveals strong symmetric coupling between Think-HR and Answer-HR. Specifically, 7 Figure 4: The relationship between reasoning safety and answer safety, where the horizontal and vertical axes represent HR scores. The numbers in the color blocks represent the normalized probabil- ities, with deeper colors indicating higher probabilities. Best viewed in color. ⢠Reasoning-Answer Coupling: When reasoning steps are compromised (Think-HR > 3), answer jailbreaking success rate reaches 90.9%, indicating that unsafe cognitive frameworks propagate to outputs. Conversely, 93.7% of compromised answers (Answer-HR > 3) originate from unsafe reasoning steps, suggesting output vulnerabilities necessitate but are not fully determined by reasoning flaws. â˘Emergent Self-Correction: A subset of MLRMs (e.g.,Mulberry-Qwen) exhibit right-upper quadrant clustering in heatmaps, where 12.4% of unsafe reasoning steps (Think-HR > 3) yield safe answers (Answer-HRâ¤3), exhibiting emergent self-correction capabilities in MLRMs. This nascent capability provides a foothold for layered defenses: hardening reasoning steps while amplifying innate safeguards. Takeaway 3.3: Emergent Self-Correction MLRMs exhibit intrinsic self-correction: 12.4% of unsafe reasoning chains are overridden by safe answers, revealing preserved safeguards that reject harmful cognition. 4 Related Work Multi-modal Reasoning in Language Models.CoT reasoning process has proven effective for enhancing multi-modal capabilities in language models [25]. Initial approaches focused on prompt engineering such as constructing zero-shot prompts like âthink step-by-step to understand the given text and image inputsâ directly [17]. In contrast, the cascade paradigm achieved multi-modal rea- soning asynchronously (e.g.,using one model to describe an image for an LRM to reason) [24]. Reinforcement learning-based models such as LLaVA-Reasoner [9] and Insight-V [12] leveraged CoT datasets and direct preference optimization (DPO) with human feedback to acquire intrinsic reasoning skills. The success of DeepSeek-R1 further catalyzed this trend, inspiring derivative architectures such as Easy-R1 [49], R1-OneVision [50], Multimodal-Open-R1 [13], R1-V [51], VLM-R1 [10] and LMM-R1 [52]. Notably, process reward models (PRMs) like MSTaR [241] and VisualPRM [242] represent a paradigm shift from outcome-focused reward models (ORMs). By providing stepwise feedback during reasoning, PRMs enhance self-consistency and enable iterative self-improvement in MLLMs [25]. 8 Safety Exploration of LRMs.The rapid advancement of LRMs has prompted growing attention to their safety risks. Recent work systematically evaluates mainstream LRMs across multiple dimensions [28,35,32,33]. For example, [53] reveals significant gaps between open-source R1 models and commercial counterparts like o3-mini, while [54] verifies that DeepSeek-R1 failed to successfully block most harmful prompts, exposing critical vulnerabilities under adversarial conditions. Works by [34,27,55,26,30] further probe the safety boundaries of the LRM and identify their failure modes. Concurrently, researchers have begun investigating attack and defense paradigms specific to LRMs â [29] demonstrates that LRMs are uniquely vulnerable to fine-tuning attacks and [31] critiques the limitations of RL-based safety alignment (e.g.,reward hacking, generalization failures) in mitigating harmful outputs. However,these efforts focus narrowly on unimodal LRMs, leaving the safety implications of MLRMs largely unexploredâ a critical gap given the distinct risks introduced by cross-modal interactions inherent to MLRM architectures. 5 Conclusion The rapid integration of reasoning capabilities into MLLMs has birthed powerful MLRMs with transformative potential. However, our systematic evaluation reveals that this advancement comes at a profound cost to safety. Through large-scale empirical studies comparing MLRMs with their base MLLMs, we uncover three critical insights: (1) A reasoning tax: MLRMs suffer 37.44% higher jailbreaking rates than base MLLMs due to eroded safety alignment; (2) Scenario-specific blind spots: risks spike 25Ăin contexts likeIllegal Activity, far exceeding average degradation; (3) Emergent self-correction: Despite tight reasoning- answer safety coupling, MLRMs demonstrate nascent self-correction. That is, 16.23% of jailbroken reasoning steps are overridden by safe answers, hinting at intrinsic safeguards. To catalyze mitigation, we releaseOpenSafeMLRM, an open-source toolkit with unified interface for evaluating mainstream MLRMs, datasets, and attacks. These findings mandate urgent efforts to govern how multi-modal AI reasons ensuring capability advances align with ethical imperatives. References [1]DeepSeek-AI, Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, Xiaokang Zhang, Xingkai Yu, Yu Wu, Z. F. Wu, Zhibin Gou, Zhihong Shao, Zhuoshu Li, Ziyi Gao, Aixin Liu, Bing Xue, Bingxuan Wang, Bochao Wu, Bei Feng, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, Damai Dai, Deli Chen, Dongjie Ji, Erhang Li, Fangyun Lin, Fucong Dai, Fuli Luo, Guangbo Hao, Guanting Chen, Guowei Li, H. Zhang, Han Bao, Hanwei Xu, Haocheng Wang, Honghui Ding, Huajian Xin, Huazuo Gao, Hui Qu, Hui Li, Jianzhong Guo, Jiashi Li, Jiawei Wang, Jingchang Chen, Jingyang Yuan, Junjie Qiu, Junlong Li, J. L. Cai, Jiaqi Ni, Jian Liang, Jin Chen, Kai Dong, Kai Hu, Kaige Gao, Kang Guan, Kexin Huang, Kuai Yu, Lean Wang, Lecong Zhang, Liang Zhao, Litong Wang, Liyue Zhang, Lei Xu, Leyi Xia, Mingchuan Zhang, Minghua Zhang, Minghui Tang, Meng Li, Miaojun Wang, Mingming Li, Ning Tian, Panpan Huang, Peng Zhang, Qiancheng Wang, Qinyu Chen, Qiushi Du, Ruiqi Ge, Ruisong Zhang, Ruizhe Pan, Runji Wang, R. J. Chen, R. L. Jin, Ruyi Chen, Shanghao Lu, Shangyan Zhou, Shanhuang Chen, Shengfeng Ye, Shiyu Wang, Shuiping Yu, Shunfeng Zhou, Shuting Pan, and S. S. Li. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning.CoRR, abs/2501.12948, 2025. [2]DeepSeek-AI, Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, Damai Dai, Daya Guo, Dejian Yang, Deli Chen, Dongjie Ji, Erhang Li, Fangyun Lin, Fucong Dai, Fuli Luo, Guangbo Hao, Guanting Chen, Guowei Li, H. Zhang, Han Bao, Hanwei Xu, Haocheng Wang, Haowei Zhang, Honghui Ding, Huajian Xin, Huazuo Gao, Hui Li, Hui Qu, J. L. Cai, Jian Liang, Jianzhong Guo, Jiaqi Ni, Jiashi Li, Jiawei Wang, Jin Chen, Jingchang Chen, Jingyang Yuan, Junjie Qiu, Junlong Li, Junxiao Song, Kai Dong, Kai Hu, Kaige Gao, Kang Guan, Kexin Huang, Kuai Yu, Lean Wang, Lecong Zhang, Lei Xu, Leyi Xia, Liang Zhao, Litong Wang, Liyue Zhang, Meng Li, Miaojun Wang, Mingchuan Zhang, Minghua Zhang, Minghui Tang, Mingming Li, Ning Tian, Panpan Huang, Peiyi Wang, Peng Zhang, Qiancheng Wang, Qihao Zhu, Qinyu Chen, Qiushi Du, R. J. Chen, R. L. Jin, Ruiqi Ge, Ruisong Zhang, Ruizhe Pan, Runji Wang, Runxin Xu, Ruoyu Zhang, Ruyi Chen, S. S. Li, Shanghao Lu, Shangyan Zhou, Shanhuang Chen, Shaoqing Wu, 9 Shengfeng Ye, Shengfeng Ye, Shirong Ma, Shiyu Wang, Shuang Zhou, Shuiping Yu, Shunfeng Zhou, Shuting Pan, T. Wang, Tao Yun, Tian Pei, Tianyu Sun, W. L. Xiao, and Wangding Zeng. Deepseek-v3 technical report.CoRR, abs/2412.19437, 2024. [3] OpenAI. Learning to reason with LLMs. 2024. [4]Edward Y. Chang, Yuxuan Tong, Morry Niu, Graham Neubig, and Xiang Yue. Demystifying long chain-of-thought reasoning in llms.CoRR, abs/2502.03373, 2025. [5]Daya Guo, Qihao Zhu, Dejian Yang, Zhenda Xie, Kai Dong, Wentao Zhang, Guanting Chen, Xiao Bi, Yu Wu, YK Li, et al. Deepseek-coder: When the large language model meets programmingâthe rise of code intelligence.arXiv preprint arXiv:2401.14196, 2024. [6]Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, Y Wu, et al. Deepseekmath: Pushing the limits of mathematical reasoning in open language models.arXiv preprint arXiv:2402.03300, 2024. [7] Jingyi Zhang, Jiaxing Huang, Huanjin Yao, Shunyu Liu, Xikun Zhang, Shijian Lu, and Dacheng Tao. R1-vl: Learning to reason with multimodal large language models via stepwise group relative policy optimization. 2025. arXiv preprint arXiv:2503.12397. [8]Hengguang Zhou, Xirui Li, Ruochen Wang, Minhao Cheng, Tianyi Zhou, and Cho-Jui Hsieh. R1-zeroâs âaha momentâ in visual reasoning on a 2b non-sft model. 2025. [9]Ruohong Zhang, Bowen Zhang, Yanghao Li, Haotian Zhang, Zhiqing Sun, Zhe Gan, Yinfei Yang, Ruoming Pang, and Yiming Yang. Improve vision language model chain-of-thought reasoning.arXiv preprint arXiv:2410.16198, 2024. [10]Haozhan Shen, Zilun Zhang, Qianqian Zhang, Ruochen Xu, and Tiancheng Zhao. Vlm-r1: A stable and generalizable r1-style large vision-language model. 2025. Accessed: 2025-02-15. [11] Liu Yuqi, Peng Bohao, Zhong Zhisheng, Yue Zihao, Lu Fanbin, Yu Bei, and Jia Jiaya. Seg-zero: Reasoning-chain guided segmentation via cognitive reinforcement. 2025. [12] Yuhao Dong, Zuyan Liu, Hai-Long Sun, Jingkang Yang, Winston Hu, Yongming Rao, and Ziwei Liu. Insight-v: Exploring long-chain visual reasoning with multimodal large language models.arXiv preprint arXiv:2411.14432, 2024. [13] EvolvingLMMs Lab. Multimodal open r1. GitHub repository, 2025. Accessed: 2025-02-28. [14]Fanqing Meng, Lingxiao Du, Zongkai Liu, Zhixiang Zhou, Quanfen Lu, Daocheng Fu, Botian Shi, Wenhai Wang, Junjun He, Kaipeng Zhang, Ping Luo, Yu Qiao, Qiaosheng Zhang, and Wenqi Shao. Mm-eureka: Exploring visual aha moment with rule-based large-scale reinforcement learning. 2025. [15] Zhangquan Chen, Xufang Luo, and Dongsheng Li. Visrl: Intention-driven visual perception via reinforced reasoning. 2025. arXiv preprint arXiv:2503.07523. [16] Jiaxing Zhao, Xihan Wei, and Liefeng Bo. R1-omni: Explainable omni-multimodal emotion recognition with reinforcement learning.arXiv e-prints, pages arXivâ2503, 2025. [17]Vaishnavi Himakunthala, Andy Ouyang, Daniel Rose, Ryan He, Alex Mei, Yujie Lu, Chinmay Sonar, Michael Saxon, and William Yang Wang. Letâs think frame by frame with vip: A video infilling and prediction dataset for evaluating video chain-of-thought.arXiv preprint arXiv:2305.13903, 2023. [18]Fanxu Meng, Haotong Yang, Yiding Wang, and Muhan Zhang. Chain of images for intuitively reasoning.arXiv preprint arXiv:2311.09241, 2023. [19]Jingran Xie, Shun Lei, Yue Yu, Yang Xiang, Hui Wang, Xixin Wu, and Zhiyong Wu. Leveraging chain of thought towards empathetic spoken dialogue without corresponding question answering data.arXiv preprint arXiv:2501.10937, 2025. 10 [20]Xuewen Luo, Fan Ding, Yinsheng Song, Xiaofeng Zhang, and Junnyong Loo. Pkrd-cot: A unified chain-of-thought prompting for multi-modal large language models in autonomous driving.arXiv preprint arXiv:2412.02025, 2024. [21] Haojie Zheng, Tianyang Xu, Hanchi Sun, Shu Pu, Ruoxi Chen, and Lichao Sun. Thinking before looking: Improving multimodal llm reasoning via mitigating visual hallucination.arXiv preprint arXiv:2411.12591, 2024. [22]Timin Gao, Peixian Chen, Mengdan Zhang, Chaoyou Fu, Yunhang Shen, Yan Zhang, Shengchuan Zhang, Xiawu Zheng, Xing Sun, Liujuan Cao, et al. Cantor: Inspiring multi- modal chain-of-thought of mllm. InProceedings of the 32nd ACM International Conference on Multimedia, pages 9096â9105, 2024. [23]Wenshan Wu, Shaoguang Mao, Yadong Zhang, Yan Xia, Li Dong, Lei Cui, and Furu Wei. Mindâs eye of llms: Visualization-of-thought elicits spatial reasoning in large language models. InThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. [24]Bozhi Luan, Hao Feng, Hong Chen, Yonghui Wang, Wengang Zhou, and Houqiang Li. Textcot: Zoom in for enhanced multimodal text-rich image understanding.arXiv preprint arXiv:2404.09797, 2024. [25]Yaoting Wang, Shengqiong Wu, Yuecheng Zhang, William Wang, Ziwei Liu, Jiebo Luo, and Hao Fei. Multimodal chain-of-thought reasoning: A comprehensive survey.arXiv preprint arXiv:2503.12605, 2025. [26] Chatterbox. Gen ai safety model comparison and reasoning results, 2025. [27] Adversa.ai. Introducing safety aligned deepseek r1 model by enkrypt ai, 2025. [28] Wenjing Zhang, Xuejiao Lei, Zhaoxiang Liu, Ning Wang, Zhenhong Long, Peijun Yang, Jiaojiao Zhao, Minjie Hua, Chaoyang Ma, Kai Wang, et al. Safety evaluation of deepseek models in chinese contexts.arXiv preprint arXiv:2502.11137, 2025. [29] Zhiyuan Xu, Joseph Gardiner, and Sana Belguith. The dark deep side of deepseek: Fine-tuning attacks against the safety alignment of cot-enabled models.arXiv preprint arXiv:2502.01225, 2025. [30]Haoyu Wang, Zeyu Qin, Li Shen, Xueqian Wang, Minhao Cheng, and Dacheng Tao. Leveraging reasoning with guidelines to elicit and utilize knowledge for enhancing safety alignment.arXiv preprint arXiv:2502.04040, 2025. [31]Manojkumar Parmar and Yuvaraj Govindarajulu.Challenges in ensuring ai safety in deepseek-r1 models: The shortcomings of reinforcement learning strategies.arXiv preprint arXiv:2501.17030, 2025. [32] Abhinav Kumar, Jaechul Roh, Ali Naseh, Marzena Karpinska, Mohit Iyyer, Amir Houmansadr, and Eugene Bagdasarian. Overthink: Slowdown attacks on reasoning llms.arXiv e-prints, page arXivâ2502, February 2025. [33]Qiguang Chen, Libo Qin, Jiaqi Wang, Jingxuan Zhou, and Wanxiang Che. Unlocking the capabilities of thought: A reasoning boundary framework to quantify and optimize chain-of- thought. InThe Thirty-eighth Annual Conference on Neural Information Processing Systems, September 2024. [34]Zonghao Ying, Guangyi Zheng, Yongxin Huang, Deyue Zhang, Wenxin Zhang, Quanchen Zou, Aishan Liu, Xianglong Liu, and Dacheng Tao. Towards understanding the safety boundaries of deepseek models: Evaluation and findings.arXiv preprint arXiv:2503.15092, 2025. [35]Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, Zachary Yahn, Yichang Xu, and Ling Liu. Safety tax: Safety alignment makes your large reasoning models less reasonable. arXiv preprint arXiv:2503.00555, 2025. [36]Mang Ye, Xuankun Rong, Wenke Huang, Bo Du, Nenghai Yu, and Dacheng Tao. A sur- vey of safety on large vision-language models: Attacks, defenses and evaluations.CoRR, abs/2502.14881, 2025. 11 [37] Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. InECCV (56), volume 15114 ofLecture Notes in Computer Science, pages 386â403. Springer, 2024. [38]Yi Yang, Xiaoxuan He, Hongkun Pan, Xiyan Jiang, Yan Deng, Xingtao Yang, Haoyu Lu, Dacheng Yin, Fengyun Rao, Minfeng Zhu, Bo Zhang, and Wei Chen. R1-onevision: Ad- vancing generalized multimodal reasoning through cross-modal formalization.arXiv preprint arXiv:2503.10615, 2025. [39]Huanjin Yao, Jiaxing Huang, Wenhao Wu, Jingyi Zhang, Yibo Wang, Shunyu Liu, Yingjie Wang, Yuxin Song, Haocheng Feng, Li Shen, et al. Mulberry: Empowering mllm with o1-like reasoning and reflection via collective monte carlo tree search.arXiv preprint arXiv:2412.18319, 2024. [40]Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. Figstep: Jailbreaking large vision-language models via typographic visual prompts.arXiv preprint arXiv:2311.05608, 2023. [41]Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report.arXiv preprint arXiv:2303.08774, 2023. [42]Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and BjĂśrn Ommer. High- resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684â10695, 2022. [43]Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models.arXiv preprint arXiv:2307.09288, 2023. [44]Yu Wang, Xiaofei Zhou, Yichen Wang, Geyuan Zhang, and Tianxing He. Jailbreak large visual language models through multi-modal linkage.arXiv preprint arXiv:2412.00473, 2024. [45] Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. Gpt-4o system card.arXiv preprint arXiv:2410.21276, 2024. [46] Qwen Team. Qwen2.5-vl, January 2025. [47]Peng Wang, Shuai Bai, Sinan Tan, Shijie Wang, Zhihao Fan, Jinze Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Yang Fan, Kai Dang, Mengfei Du, Xuancheng Ren, Rui Men, Dayiheng Liu, Chang Zhou, Jingren Zhou, and Junyang Lin. Qwen2-vl: Enhancing vision- language modelâs perception of the world at any resolution.arXiv preprint arXiv:2409.12191, 2024. [48] Bo Li, Kaichen Zhang, Hao Zhang, Dong Guo, Renrui Zhang, Feng Li, Yuanhan Zhang, Ziwei Liu, and Chunyuan Li. Llava-next: Stronger llms supercharge multimodal capabilities in the wild, May 2024. [49]Zheng Yaowei, Lu Junting, Wang Shenzhi, Feng Zhangchi, Kuang Dongdong, and Xiong Yuwen. Easyr1: An efficient, scalable, multi-modality rl training framework. 2025. [50]Yangyi VAI. R1-onevision: Open-source multimodal large language model with reason- ing.Online, 2025.Available at:https://yangyi-vai.notion.site/r1-onevision# 198b1e4047f780c78306fb451be7160d. [51]Liang Chen, Lei Li, Haozhe Zhao, Yifan Song, and Vinci. R1-v: Reinforcing super generalization ability in vision-language models with less than $3. 2025. Accessed: 2025-02-02. [52]Peng Yingzhe, Zhang Gongrui, Zhang Miaosen, You Zhiyuan, Liu Jie, Zhu Qipeng, Yang Kai, Xu Xingzhong, Geng Xin, and Yang Xu. Lmm-r1: Empowering 3b lmmâs with strong reasoning abilities through two-stage rule-based rl. 2025. 12 [53]Aitor Arrieta, Miriam Ugarte, Pablo Valle, JosĂŠ Antonio Parejo, and Sergio Segura. O3-mini vs deepseek-r1: Which one is safer?arXiv preprint arXiv:2501.18438, 2025. [54]Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal.arXiv preprint arXiv:2402.04249, 2024. [55]Kaiwen Zhou, Chengzhi Liu, Xuandong Zhao, Shreedhar Jangam, Jayanth Srinivasa, Gaowen Liu, Dawn Song, and Xin Eric Wang. The hidden risks of large reasoning models: A safety assessment of r1.arXiv preprint arXiv:2502.12659, 2025. 13