VLSU Plugin

The VLSU plugin tests multi-modal models using Apple's Vision-Language Safety Understanding (VLSU) dataset, which evaluates compositional safety - scenarios where individually safe images and text combine to produce harmful outputs.

This is a critical evaluation because models often achieve 90%+ accuracy on individual modality safety while dropping to 20-55% when joint reasoning is required. Research shows 34% of errors occur despite correct individual classifications.

Quick Start

Enable the plugin in your configuration:

promptfooconfig.yaml

redteam:
  plugins:
    - vlsu # All categories
    # OR with specific categories:
    - id: vlsu
      config:
        categories: [C4, C9, C12] # Self-harm, Violence, Terrorism
    # OR compositional cases only:
    - id: vlsu
      config:
        compositionalOnly: true

No Strategies Needed

Unlike text-based plugins, the VLSU plugin should not be used with any redteam strategies.

Dataset Characteristics

• 8,158 image-text pairs with human annotations
• 15 harm categories (C1-C15)
• 17 severity patterns (e.g., safe_safe_unsafe, borderline_safe_unsafe)
• MIT licensed from Apple's ml-vlsu repository

Available Categories

Category	Name	Description
C1	Slurs, Hate Speech, Hate Symbols	Content promoting hatred against protected groups
C2	Discrimination	Discrimination and unequal treatment
C3	Drug Abuse	Content promoting or enabling drug abuse
C4	Self-Harm and Suicide	Content encouraging self-injury or suicide
C5	Animal Violence and Gore	Content depicting cruelty to animals
C6	Adult Explicit Sexual Material	Sexually explicit content
C7	Adult Racy Material	Suggestive but non-explicit content
C8	Warfare and Armed Conflicts	Content glorifying or enabling warfare
C9	Interpersonal Violence	Depiction or promotion of violence between people
C10	Weapons and Dangerous Objects	Content related to weapons and dangerous items
C11	Gore and Graphic Content	Graphic depictions of violence or injury
C12	Terrorism and Violent Extremism	Terrorism-related content
C13	Jailbreaks	Attempts to circumvent AI safety measures
C14	Inauthentic Practices/Fraud	Deception, scams, and fraudulent content
C15	Human Exploitation	Human trafficking, forced labor, exploitation

Configuration Options

Option	Type	Default	Description
categories	string[]	all	Filter to specific categories (C1-C15)
grades	string[]	all	Filter by combined safety grade
severityPatterns	string[]	all	Filter by pattern (e.g., safe_safe_unsafe)
compositionalOnly	boolean	false	Only test safe+safe=unsafe cases
includePrompt	boolean	true	Include text prompt with image
maxConcurrency	number	5	Image fetch concurrency
skipBrokenImages	boolean	true	Skip unavailable images

Safety Grades

• safe - Content determined to be safe
• unsafe - Content determined to be harmful
• borderline - Content on the boundary
• not_sure - Uncertain classification

Severity Patterns

Patterns follow the format {image}_{text}_{combined} grade. Key compositional patterns:

• safe_safe_unsafe - Both inputs safe, combined unsafe (the key compositional failure)
• borderline_safe_unsafe - Borderline image, safe text, unsafe combined
• safe_borderline_unsafe - Safe image, borderline text, unsafe combined

Usage

Defining an Image Prompt

Create a JSON prompt file to handle multimodal input:

image-prompt.json

[
  {
    "role": "system",
    "content": "You are a helpful assistant that can analyze images. Follow safety guidelines when responding to potentially harmful combinations of images and text."