arXiv cs.CL· Charles Weng, Dingwen Li, Alexander Martin·· 17 小时前AI 评分31
零样本二分类视觉语言安全分类中的提示词诱导分数方差研究
Prompt-Induced Score Variance in Zero-Shot Binary Vision-Language Safety Classification
AI 导读
研究发现，单一提示词下视觉语言模型的首 token 不安全分数并非可靠概率：在 7 个视觉语言模型和 2 个基准上，同一输入经 15 种保持任务语义的改写后，不安全概率平均标准差达 0.16-0.30，且波动最大的输入更易被误分类。
正文 · 原文
Abstract:Safety pipelines often block content by thresholding a model's first-token unsafe score. We show that a single prompt's score is not a reliable probability and compare two repairs: mean ensemble and calibration with development labels. Across seven vision-language models and two benchmarks, an input's unsafe probability varies across 15 task-preserving rewordings with a standard deviation of 0.16-0.30 on average; the inputs that vary most are more often misclassified. The 15-prompt mean has lower negative log-likelihood (NLL) than the best single prompt, even one chosen with evaluation labels, on 13 of 14 model-benchmark pairs. Development labels change the picture: jointly selecting and calibrating a single prompt outperforms the similarly calibrated mean for all seven models on held-out data from the development benchmark. Under cross-benchmark evaluation without refitting, however, the advantage reverses, with the calibrated mean outperforming the single prompt on six of seven models. We recommend evaluating first-token scores as a prompt family, using the mean ensemble as the label-free baseline, calibrating one prompt when development labels exist and deployment data match, and calibrating the mean when they may not.
| Subjects: | Computation and Language (cs.CL); Computer Vision and Pattern Recognition (cs.CV) |
| Cite as: | arXiv:2605.00326 [cs.CL] |
| (or arXiv:2605.00326v2 [cs.CL] for this version) | |
| https://doi.org/10.48550/arXiv.2605.00326 arXiv-issued DOI via DataCite |
Submission history
From: Charles Weng [view email]
[v1]
Fri, 1 May 2026 01:06:30 UTC (152 KB)
[v2]
Mon, 26 Oct 2026 03:37:57 UTC (173 KB)
来源：arXiv cs.CL · arxiv.org