MME-Safety - Refusal Rate: leaderboard
The share of final answers that explicitly refuse the request in MME-Safety (Shi et al., 2026), over 3,801 manually verified image-text pairs with harmful intent, balanced over nine risk categories and nine combinations of image and text stealth level whose intent is harmful, judged by GPT-4o. Percent; higher is better.
Metric: Refusal rate (%; share of final answers to 3,801 manually verified image-text pairs with harmful intent across nine risk categories and nine image/text stealth combinations, zero-shot; GPT-4o judge that the response explicitly refuses). Source: arxiv.org. Saturation forecast: Around February 2027. 17 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Qwen 3 VL 235B A22B Instruct | 77.95 | #521 |
| 2 | Claude Sonnet 4 (Thinking) | 75.86 | #397 (Claude Sonnet 4) |
| 3 | Claude 3.7 Sonnet | 75.76 | #455 |
| 4 | O4 Mini | 71.91 | #354 |
| 5 | Claude 3.7 Sonnet (Thinking) | 71.89 | #455 (Claude 3.7 Sonnet) |
| 6 | Qwen 3 VL 235B A22B (Thinking) | 71.01 | #451 |
| 7 | Qwen 3 VL 32B (Thinking) | 70.14 | #557 |
| 8 | Gemini 3 Pro | 64.13 | #135 |
| 9 | Qwen 3 VL 8B (Thinking) | 63.56 | #887 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=mme-safety-refusal-rate · How It Works · Data refreshed daily, snapshot 2026-11-12.