Multimodal Model Safety Evaluation

The standard path begins with a shift from simple image-text attacks to failures created while a model combines several inputs. Harmless-looking signals can form harmful intent after fusion, while intermediate layers may preserve useful capabilities but weaken refusal behavior. During the first year, researchers will compare single-modal and combined inputs, trace refusal signals across layers, and reproduce physical or black-box attacks. Application teams will add these cases to release tests for multimodal assistants and action-capable systems. A key threshold will be independent evidence that runtime steering or small adapters can restore refusal across several model families without excessive delay or loss of normal capability.

If that threshold is crossed, the second year will bring layer-aware and cross-modal tests into shared benchmarks and higher-risk deployment gates. Defenses will increasingly use internal refusal signals and measurements of conflict during modality fusion. Practical systems will combine training-time alignment with runtime monitoring or steering rather than relying on either alone. This follows a process-control mechanism: test the combined input streams, observe vulnerable internal stages, and keep a runtime interlock for failures missed before release.

By the third year, this approach could stabilize into layered safety gates for systems that combine language with sensor data. Research would extend toward longer agent tasks, changing physical conditions, and attacks that adapt to the deployed system. In bounded action-critical uses, compositional testing and refusal-health monitoring may become routine parts of release and update procedures. One monitoring cue is the spread of joint-modality test requirements and standardized layer diagnostics across organizations. Progress should be downgraded if newer models resist split-intent attacks as well as ordinary attacks, or if runtime controls repeatedly cause unacceptable latency or capability loss. The process-control analogy also remains imperfect because multimodal models face open-ended inputs and frequent updates, unlike systems with stable materials and predictable failure ranges.

The contender path treats the expansion into physical and action-critical settings as a resource problem. Relevant environments, model versions, and attack combinations are growing faster than expert review and physical testing capacity. During the first year, teams will adopt a sentinel-surveillance mechanism, using small recurring test sets as early-warning canaries. These canaries will probe meaning split across modalities, safety differences between layers, and weakening refusal signals. Selected simulations and physical test sites will then check whether cheap alerts match expert judgments and observed system behavior. The first major threshold is reached when recurring canaries and written escalation rules become required release conditions rather than optional research exercises.

If that happens, the second year will make the workflow more systematic. Researchers will define consistent evidence records covering model version, operating context, and follow-up findings. Application teams will use these records as assurance logs and will send only ambiguous or severe alerts to costly human review. Confirmed failures may trigger runtime steering, narrower operating conditions, or retraining. Defense studies will compare hybrid safeguards while checking that useful perception and reasoning remain intact.

By the third year, public canaries may become less effective because attackers and developers can learn their patterns. Research will respond with rotating private probes, adaptive black-box attacks, and tests derived from real incidents. Evaluation groups could pool redacted failure evidence to direct scarce human and physical testing toward the most consequential cases. Qualification may then operate as a continuous cycle of monitoring, investigation, correction, capability checking, and documentation. A useful monitoring cue is whether organizations adopt version-by-version assurance logs with clear escalation authority. The scenario weakens if canary results correlate poorly with expert review, providers expose no useful safety controls, or static one-time tests remain dominant. Privacy risks and deliberate evasion also limit the surveillance analogy, so local scoring and carefully redacted reporting would remain important.

The maybe path extends current multimodal safety work through an independent rating mechanism similar to Euro NCAP. A neutral group would publish repeatable tests and graded results, encouraging developers to improve systems because the scores affect qualification decisions. During the first year, researchers would turn fusion failures, uneven layer alignment, and split-intent attacks into shared scenarios for action-capable systems. Evaluation would move beyond content refusal toward action-level outcomes, such as whether a system follows a malicious visual instruction or fails to return control safely. Human-reviewed datasets and agreement studies would help determine whether automated judges reflect physical behavior. Early use would center on internal release gates and shared test tools.

The decisive threshold is an operator, system integrator, or qualification program citing the test battery in a real requirement. That would transform a research library into a practical standard and create pressure for auditable safety improvements. If the threshold is crossed, the second year will focus on neutral governance and independent red teams. Hidden scenarios would rotate so that developers cannot simply memorize public cases. Researchers would combine external behavior tests with internal evidence about refusal signals, while complete defense stacks would join training-time alignment with monitored runtime steering.

By the third year, the rating system would face a stronger validity test. Adaptive black-box methods would continuously create hidden cases, and researchers would check whether highly rated systems resist novel attacks more reliably than unrated ones. Qualification bodies and downstream integrators might then request action-safety results from general-purpose multimodal model providers. A key monitoring cue is qualification language that explicitly names multimodal prompt injection or backdoors in action-capable systems. If ratings remain predictive, they may become routine in product documentation and qualification agreements. The scenario is weakened by persistent evaluator disagreement, failure to secure a qualification trigger by July 2027, or continued dependence on refusal scores that do not predict physical behavior. A serious failure by a highly rated system would also force shorter reassessment cycles and continuous penetration testing, showing the limit of comparison with fixed vehicle-safety tests.