Skip to content

Do Vision-Language Models Respect Contextual Integrity in Location Disclosure?

🕒 Published (v1): 2026-01-01 · Source: ICLR · Venue: ICLR 2026 · link

Why this paper was selected

ICLR 2026; VLMs violate contextual integrity in location privacy disclosure

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

VLMs have strong geolocation capabilities but fail to respect contextual privacy norms when deciding how much location information to disclose. This paper introduces VLM-GeoPrivacy, a 1,200-image benchmark grounded in Contextual Integrity Theory, and shows that even the best models match human privacy expectations in only ~50% of free-form generation cases. Models systematically over-disclose in sensitive contexts and are vulnerable to adversarial prompting.

Problem

Prior geolocation benchmarks measure only localization accuracy; existing privacy guardrails apply blanket granularity restrictions (e.g., country-only) that fail to distinguish legitimate disclosure from harmful over-disclosure. No benchmark evaluated VLMs' ability to reason about contextually appropriate location disclosure—balancing privacy norms, sharing intent, subject visibility, and image sensitivity—against realistic human expectations.

Method

The authors introduce VLM-GeoPrivacy, a benchmark of 1,200 real-world images curated from YFCC100M, IM2GPS-3k, and GPTGeoChat via automated sensitive-image filtering (Phi-3.5-Vision) followed by manual validation. Each image is annotated across 7 MCQ dimensions: visual distinctiveness (Q1), location-sharing intent (Q2–3), subject visibility and relation (Q4–5), geolocation cue salience (Q6), and appropriate disclosure granularity (Q7), with annotation guidelines grounded in GDPR, ICCPR, and COPPA. Inter-annotator agreement reaches Krippendorff's \(\alpha = 0.83\) on granularity.

Evaluation covers two tasks: 1. Contextual Integrity Judgment — structured MCQs fed with a rule-of-thumb prompt; accuracy measured against human-annotated gold labels. 2. Privacy-Preserving Free-Form Geolocation Reasoning — three prompting regimes: (a) vanilla zero-shot, (b) iterative Chain-of-Thought with geographic least-to-most prompting, and (c) malicious prompting via FigStep (adversarial instruction image). Granularity is extracted via string matching + GPT-4.1-mini judging; directional error metrics—over-disclosure rate and under-disclosure rate—are reported alongside geolocation accuracy at street (\(<\)1 km), city (\(<\)25 km), and region (\(<\)200 km) thresholds.

Key Contributions

  • VLM-GeoPrivacy benchmark: 1,200 manually annotated real-world images with 7 per-image MCQ labels capturing context, intent, subject sensitivity, and expected disclosure granularity.
  • Formal operationalization of Contextual Integrity Theory for the multimodal geolocation setting.
  • Systematic evaluation of 14 VLMs (closed- and open-source, including reasoning models GPT-5, o3, o4-mini, Gemini-2.5-Flash, Claude Sonnet 4) across structured judgment and free-form generation tasks.
  • Three-tier adversarial prompting protocol (vanilla / iterative CoT / FigStep malicious) that reveals escalating privacy leakage under coercive inputs.
  • Novel metrics: contextualized location exposure rate and abstention violation rate.

Results

  • Best free-form granularity accuracy is 49.7% (o3), barely above the 33.3% random baseline; all models underperform humans at granularity judgment.
  • Structured intent prediction reaches ~80–84% accuracy for top models, but granularity (Q7) accuracy drops to ~47–67% for closed-source and near or below random for open-source models.
  • Over-disclosure under vanilla prompting: GPT-5 over-discloses 47.6% of the time; Gemini-2.5-Flash 45.6%; Claude Sonnet 4 is an outlier at 11.5% but has high under-disclosure (39.2%).
  • Malicious prompting dramatically increases leakage: GPT-4.1 abstention violation rate reaches 99.4%; o3 rises from 72.0% to 19.3% (o3 is more resistant due to conservative tendencies); Gemini-2.5-Flash hits 100%.
  • Claude Sonnet 4 is uniquely conservative: low over-disclosure (9.6% malicious) but highest under-disclosure (42.2% malicious), sacrificing utility.
  • Open-source models (Llama-3.2-11B, Deepseek-VL2) score near random on granularity classification and show ~27–30% free-form accuracy.
  • GPT-4.1-mini judge granularity extraction agrees with humans at 95.78%; alternative Grok-4-fast-reasoning judge reaches 96.41%, confirming robustness.

Limitations

  • Benchmark images are drawn from existing public geolocation datasets (YFCC100M, IM2GPS-3k, GPTGeoChat); geographic and demographic coverage may be uneven.
  • Evaluation uses GPT-4.1-mini as an automated judge for free-form granularity extraction, introducing potential model-specific biases despite human validation.
  • The benchmark is static; it cannot capture the evolving geolocation capabilities of rapidly updated models.
  • Only location disclosure is studied; broader multimodal privacy reasoning (e.g., identity, activity inference) is out of scope.
  • Malicious prompting is limited to a FigStep-style attack; other jailbreak vectors are not explored.

Relevance to Vision-Language Models

This paper directly measures a critical alignment gap in frontier VLMs: perceptual capability (geolocation) has substantially outpaced normative reasoning (contextual privacy). For VLM researchers, it establishes a rigorous benchmark exposing that chain-of-thought and reasoning-model scaling do not automatically confer context-sensitive disclosure behavior. The work also highlights a tension specific to multimodal systems—images carry latent geolocation signals that text-only privacy frameworks cannot address—making VLM-GeoPrivacy an important resource for evaluating and training privacy-aware multimodal models. The adversarial prompting results are particularly relevant for safety research, showing that simple visual prompt injection bypasses the privacy guardrails of most production models.