SpatialTrust: A Benchmark for Environmental Risk Recognition in Secure Authentication

SpatialTrust: A Benchmark for Environmental Risk Recognition in Secure Authentication Junbin Lu, Hsiang-Wei Huang, Saesha Wadhwa, Yu Ting Hsu, Jenq-Neng Hwang University of Washington, United States

arXiv:2608.29489v1 [cs.CR] 30 Aug 2026

{junbinlu, hwhuang, saeshw, yhsu24, hwang}@uw.edu

Abstract

age from the computer the user is logging into. For example, a nearby camera may face the login device, or another person may be positioned to observe the user’s computer. Prior work on shoulder surfing and camera-based monitoring shows that physical surroundings can introduce privacy and security risks during authentication [1, 3]. Understanding whether MLLMs can recognize, explain, and localize these environmental risk factors is important for building trustworthy authentication systems. Prior visual privacy datasets and tasks have focused on privacy attribute prediction and personalized privacy risk estimation [13], image-level privacy prediction [18], and private content in assistive images [6]. More recent MLLM privacy and safety evaluations examine image-based safety attacks and harmful query scenarios [8] and individuallevel privacy reasoning that links distributed multimodal evidence to identities [14]. However, the risk considered in secure authentication is more specific: visible elements in the captured scene may disclose information from the login computer or create a risk of such disclosure during verification. This requires spatial and contextual reasoning about the relationship between the user, the camera, the login device, and the surrounding environment, as well as distinguishing direct disclosure from indirect risk. A reliable model should therefore identify risks based on visible evidence rather than unsupported assumptions about the user’s identity, intent, occupation, or private context. To address this gap, we introduce SpatialTrust, a question-answering benchmark for evaluating environmental risk recognition in secure authentication. SpatialTrust focuses on visible background or non-primary-subject factors that could cause information leakage from the computer the user is logging into during a verification capture. We define a direct sensitive factor as a visible factor that directly causes sensitive information to be disclosed in the current image. We define an indirect sensitive factor as a visible factor that does not directly disclose sensitive information in the current image, but creates a possibility or risk that sensitive information may be disclosed. Each SpatialTrust item contains structured visual

Visual environmental risk recognition plays an important role in secure authentication, where a user’s surroundings may reveal sensitive information or introduce potential security risks. However, existing evaluations of multimodal large language models (MLLMs) rarely examine whether models can reliably recognize, localize, and explain such risks in spatially grounded authentication scenarios. We present SpatialTrust, a question-answering benchmark for evaluating environmental risk recognition in secure authentication. SpatialTrust assesses five complementary abilities: sensitive factor detection, direct factor identification, indirect factor identification, direct factor explanation, and indirect factor explanation. We evaluate both proprietary and open-source MLLMs and find that current models show limited performance, especially in understanding and explaining indirect risks, indicating that spatial risk awareness remains a challenging capability for MLLMs. In addition, we introduce SpatialTrustGuard, a structured QA-and-audit pipeline that improves Qwen3-VL-30B-A3B-Instruct from 36.78% to 41.12% overall. Our findings highlight the need for dedicated benchmarks and structured inference methods to improve the trustworthiness of MLLMs in secure authentication.

1. Introduction Multimodal large language models (MLLMs) are increasingly used in secure authentication scenarios, including laptop-camera-based user verification, where a camera captures an image of the user together with part of the surrounding scene. In such settings, the captured image is usually intended for a narrow purpose, such as verifying that the correct user is present during login. However, because the camera also observes the environment around the user, the verification capture may contain visible background or nonprimary-subject factors that could cause information leakWork done while the first author was at the University of Washington.

1

question-answering tasks that ask models to determine whether sensitive factors are present, distinguish direct from indirect sensitive factors, provide short natural-language explanations, and ground the relevant visual evidence with bounding boxes [22]. This design evaluates not only whether a model can select the correct answer, but also whether its answer is supported by concrete visible evidence in the image. By requiring both textual reasoning and spatial grounding, SpatialTrust tests whether MLLMs can produce evidence-based judgments about authenticationrelated environmental risks. The SpatialTrust task is challenging for current MLLMs because models must focus on background or non-primarysubject factors rather than the verified user, distinguish direct disclosure from indirect risk, and avoid speculative inferences beyond visible evidence [7]. In addition, models must maintain consistency between selected options, textual explanations, and grounding boxes. These requirements make SpatialTrust a test of both environmental risk recognition and disciplined evidence-based response generation. We systematically evaluate eight representative MLLMs [2, 4, 12, 15–17, 21] on SpatialTrust, covering both proprietary and open-source models. Our results reveal substantial limitations in current models when reasoning about environmental risks in authentication captures. In particular, models often struggle to distinguish direct and indirect sensitive factors, miss subtle risk factors in the background, or over-identify factors that are not sufficiently supported by visible evidence. Grounding also remains challenging, as models may produce answers whose visual evidence is incomplete, inconsistent, or poorly localized. These findings suggest that authentication-related environmental risk recognition remains an underdeveloped capability in current MLLMs. In addition, we introduce SpatialTrustGuard, an inference-time QA-and-audit pipeline that decomposes answer selection, conservative auditing, and grounded response generation [9, 20]. Built on Qwen3-VL-30B-A3BInstruct [2], SpatialTrustGuard improves the overall score from 36.78% to 41.12%, suggesting that structured decomposition and answer auditing can improve model behavior, although environmental risk recognition in verification captures remains challenging. Our contributions are threefold: • We introduce SpatialTrust, a benchmark for evaluating environmental risk recognition in secure authentication, with structured QA tasks covering sensitive factor detection, direct sensitive factor identification, indirect sensitive factor identification, direct sensitive factor explanation, and indirect sensitive factor explanation. • We systematically evaluate eight representative MLLMs on SpatialTrust and reveal substantial limitations in current models, particularly in distinguishing direct and in-

direct sensitive factors and grounding relevant visual evidence. • We propose SpatialTrustGuard, a staged inference-time QA pipeline with conservative self-verification, and show that structured decomposition and answer auditing can improve the overall performance of MLLMs on SpatialTrust.

2. Related Work 2.1. Privacy Risks in Authentication Visual privacy has been widely studied through tasks such as privacy attribute recognition, image privacy prediction, and privacy-sensitive region localization. Prior work has introduced visual privacy attributes and risk prediction [13], image-level privacy prediction datasets [18], and private visual information recognition in assistive settings [6]. Authentication research further shows that privacy and security risks can arise from the user’s physical environment: shoulder-surfing can leak authentication information through observation of devices or input behavior [1], while camera-based monitoring may capture sensitive information about the user and surrounding scene [3, 10]. These works provide important foundations, but they usually study general private content, specific attack procedures, or user perceptions of monitoring. In contrast, SpatialTrust focuses on laptop-camera-based login verification, where background or non-primary-subject factors such as observers or cameras may leak information from the login computer. SpatialTrust therefore requires models to recognize visible risk evidence and judge whether it creates a direct or indirect information-leakage risk in the verification capture.

2.2. Privacy and Safety Evaluation in VLMs Recent vision-language models (VLMs) and multimodal large language models (MLLMs) have achieved strong performance on general visual reasoning tasks, but their privacy and safety behavior remains a concern. Existing benchmarks evaluate MLLM safety under image-based manipulations and harmful query scenarios [8] and individuallevel privacy reasoning through identity linkage across multimodal evidence [14]. However, these evaluations mainly focus on harmful content or linking identifiers to personal attributes. SpatialTrust complements them by evaluating whether VLMs can identify authentication-related environmental risks, distinguish direct from indirect sensitive factors, and support their answers with visible evidence.

3. SpatialTrust Benchmark We introduce SpatialTrust, a benchmark for evaluating whether multimodal large language models can recognize 2

spatially grounded information-leakage risks in user verification scenarios. The scenario is a laptop-camera-based verification setting, where the camera captures an image of the user and the surrounding scene while the user is logging into a computer. SpatialTrust focuses on visible background or non-primary-subject factors that could cause information leakage from the computer the user is logging into during this verification capture. This setting is different from general visual privacy recognition. The goal is not to determine whether an image contains private content in a broad sense, nor to treat the primary user as a sensitive factor. Instead, SpatialTrust asks whether visible factors outside the primary subject may expose, capture, reflect, or enable access to information from the login computer. Therefore, the task requires models to reason about the spatial relationship among the user, the laptop camera, the login computer, and the surrounding environment.

or screen area, a window or layout that increases information exposure risk, or a nearby person who is not currently observing the screen but could potentially do so. This distinction is central to SpatialTrust. Direct factors correspond to visible evidence of immediate disclosure, while indirect factors correspond to visible conditions that may enable disclosure. At the same time, the benchmark requires conservative reasoning: a factor should be labeled sensitive only when the image provides concrete visual evidence supporting that judgment.

3.3. Data Collection and Annotation

Given an image captured during user verification, the model must identify visible background or non-primary-subject factors that could cause information leakage from the computer the user is logging into. Each benchmark instance contains five questions, covering sensitive factor detection, direct sensitive factor identification, indirect sensitive factor identification, direct factor explanation, and indirect factor explanation, as illustrated in Fig. 1. All answers must be based only on visible evidence in the image. A valid prediction should not infer hidden intent, user identity, occupation, unseen activity, or private context beyond the image. When a sensitive factor is visible and localizable, the model is required to provide a bounding box for the supporting evidence. This design evaluates not only whether a model gives the correct answer, but also whether its judgment is grounded in the correct background or nonprimary-subject region.

Fig. 2 shows the overall benchmark construction and evaluation pipeline. SpatialTrust images are constructed from frames sampled from a source video [5]. We first apply initial preprocessing to the selected frames, including imagesize normalization and other standardization operations, so that the images follow a consistent authentication-style format. Each processed frame contains a central user and a surrounding scene, with the benchmark focusing on background and non-primary-subject regions. We then use ChatGPT Images 2.0 [11] to edit the preprocessed images. The central person in each image is replaced through face swapping, and if other faces appear in non-central regions, those faces are also replaced. After this identity-level editing step, GPT-5.4 [12] analyzes each identity-edited image, designs situation-level editing plans, and generates the corresponding image-editing prompts. We then call ChatGPT Images 2.0 [11] again with these prompts to diversify the images at the situation level, creating varied authentication scenarios and sensitive-factor configurations, as illustrated in Fig. 3. Finally, GPT-5.4 [12] is used to generate the fixed questions, answer choices, and initial answers for each image. Human annotators then manually review the generated content, revise the answer choices, and label the correct answers to ensure the quality and reliability of the benchmark.

3.2. Direct and Indirect Sensitive Factors

3.4. Dataset Statistics

SpatialTrust separates sensitive factors into direct and indirect categories. A direct sensitive factor is a visible factor that directly causes sensitive information to be disclosed in the current image. In the user verification setting, this means that the factor already creates an immediate disclosure path in the captured scene. Examples include a nonprimary person looking toward the camera or login area, a phone or camera aimed at the scene, or a surveillance camera facing the user. An indirect sensitive factor is a visible factor that does not directly disclose sensitive information in the current image, but creates a possibility or risk of sensitive information being disclosed. Examples include an open doorway that could allow another person to observe the login computer

Tab. 1 summarizes the main statistics of SpatialTrust. The benchmark contains 577 images and 2,885 QA items, with five questions for each image. All images are normalized to a resolution of 1440 × 960. The QA set contains 577 answer-only questions and 2,308 grounded questions. By question type, the benchmark includes 1,612 single-choice questions, 119 multiple-choice questions, and 1,154 shortanswer questions. At the image level, 391 images contain at least one sensitive factor and 186 images contain no sensitive factor. For localizable sensitive-factor annotations, 220 images contain direct sensitive factors and 280 images contain indirect sensitive factors. These two categories are not mutually exclusive: 109 images contain both direct and indirect sensitive

3.1. Task Definition

3

Q1

SpatialTrust

Does the image background or non-primary-subject area contain any sensitive factor?

Q4

Briefly describe all visible direct sensitive factors and explain why each factor is a direct sensitive factor.

VLM System Prompt You are an expert visual question-answering evaluator for privacy-sensitive visual benchmarks.

Multiple-Choice Question

A. Yes B. No C. Not clear

Q2

Answer questions using only visible evidence in the image. Do not infer hidden context, identity, intent, profession, ethnicity, age, or other unsupported attributes.

Short Answer

Grounded

(open-ended response)

The task focuses on sensitive factors in the background or non-primary-subject area. The scenario is a user verification setting where a laptop camera captures an image of the user and surrounding scene. Identify visible background or non-primary-subject factors that could cause information leakage from the computer the user is logging into during this verification capture.

Which visible and localizable direct sensitive factor(s) are present in the non-primary area?

Multiple-Choice Question

Grounded

Definitions: - Direct sensitive factor: a visible factor that directly causes sensitive information to be disclosed in the current image. - Indirect sensitive factor: a visible factor that does not directly disclose sensitive information but creates a possibility or risk of sensitive information being disclosed. Do not count the primary/central subject as a sensitive factor merely because their face or body is visible.

A. a background person reading a book B. a wall photo collage C. a hanging dark coat

Q5

D. a framed poster

Briefly describe all visible indirect sensitive factors and explain why each factor is an indirect sensitive factor.

E. None of the above Short Answer

Q3

Which visible and localizable indirect sensitive factors are present in the scene background?

Multiple-Choice Question

Grounded

(open-ended response)

Grounded

A. a wall photo collage

B. a bedroom interior layout C. a background person reading a book D. a hanging dark coat E. None of the above

Figure 1. Example SpatialTrust item. Each image is paired with a visible-evidence-only system prompt and five structured questions.

Table 1. Dataset statistics of SpatialTrust.

factors, 111 contain only direct factors, 171 contain only indirect factors, and 186 contain neither type. SpatialTrust also provides grounding annotations for evaluating whether model predictions are supported by the correct visual evidence. In total, 1,000 QA items require evidence boxes, and the dataset contains 1,262 annotated evidence boxes. All boxes use absolute xyxy coordinates and fall within the image boundaries. These annotations allow SpatialTrust to evaluate both the correctness of model answers and the spatial grounding of the supporting evidence.

Statistic Images Image resolution QA items QA items per image Answer-only QA items Grounded QA items Single-choice questions Multiple-choice questions Short-answer questions Images with any sensitive factor Images without sensitive factors Images with direct sensitive factors Images with indirect sensitive factors Images with both direct and indirect sensitive factors Images with only direct factors Images with only indirect factors Images with neither factor type QA items requiring evidence boxes Annotated evidence boxes

3.5. Evaluation Protocol We evaluate all models on a fixed benchmark of 577 images, where each image is associated with five questions covering both answer-only recognition and grounded reasoning. The questions are evaluated at the image-question level. q1 measures whether the model can correctly determine whether the non-primary-subject region contains any sensitive factor. q2 and q3 evaluate grounded recognition of direct and indirect sensitive factors, respectively. q4 and q5 further evaluate whether the model can describe the corresponding direct and indirect sensitive factors and explain why they are sensitive. For q1, we use exact-match accuracy over the normalized multiple-choice answer. For q2 and q3, we use optionlevel scoring with grounding verification. The predicted

Count 577 1440 × 960 2,885 5 577 2,308 1,612 119 1,154 391 186 220 280 109 111 171 186 1,000 1,262

option set is first compared with the ground-truth option set. If the prediction contains any extra incorrect option, the score for that question is set to zero. Otherwise, each correctly predicted ground-truth option receives credit when it is sufficiently grounded. For options without a corresponding ground-truth evidence box, such as None of the 4

GPT-5.4

ChatGPT Images 2.0

Human review

(a) Benchmark Construction

Video Frame Sampling

Image Initialization

Face Replacement

Situation Planning

Prompt Generation

SOURCE

PREPROCESSING

CHATGPT IMAGES 2.0

GPT-5.4

GPT-5.4

Final Benchmark Dataset

Human Review & Annotation

QA Generation

Situation Diversification

GPT-5.4

CHATGPT IMAGES 2.0

IMAGE ·QUESTION ·ANSWER

HUMAN-IN-THE-LOOP

VLM Answering

Predicted Answers

LLM-as-a-Judge

Accuracy

VISION-LANGUAGE MODEL

MODEL OUTPUT

PREDICTED vs GROUND-TRUTH

FINAL METRIC

benchmark

(b) Evaluation VLM + LLM-as-a-Judge

Figure 2. Overview of the SpatialTrust benchmark construction and evaluation pipeline. The benchmark is built through video-frame sampling, image preprocessing, identity-level and situation-level image editing, QA generation, and human review; evaluation compares model predictions against ground truth using answer accuracy and grounded judging.

No Situation

truth box Bg , IoU is defined as:

Situations

|Bp ∩ Bg | |Bp ∪ Bg | |Bp ∩ Bg | = . |Bp | + |Bg | − |Bp ∩ Bg |

IoU(Bp , Bg ) =

(1)

We use an IoU threshold of τ = 0.5 in all experiments. Let G and P denote the ground-truth and predicted option sets, respectively. For each option o, let Bg (o) and Bp (o) be the sets of ground-truth and predicted evidence boxes associated with that option. We define Figure 3. Examples of situation-level diversification in SpatialTrust. The editing stage produces both images without an added sensitive situation and images with varied authentication-related sensitive-factor configurations.

M (o) =

max

Bp ∈Bp (o), Bg ∈Bg (o)

IoU(Bp , Bg ),

(2)

with M (o) = 0 when either box set is empty. For q2 and q3, the question score is ( 0, P \ G ̸= ∅, P s2/3 = (3) 1 c(o), otherwise, o∈G |G|

above, selecting the option is sufficient because no IoU can be assessed.

where   1, c(o) = 1,   0,

The grounding quality is measured using Intersection over Union (IoU). Given a predicted box Bp and a ground5

o ∈ P and Bg (o) = ∅, o ∈ P and Bg (o) ̸= ∅ and M (o) > τ, (4) otherwise.

Thus, q2 and q3 use the maximum IoU between predicted and ground-truth boxes under the same option label rather than requiring a fixed one-to-one box correspondence. As shown in the evaluation stage of Fig. 2, q4 and q5 require free-form textual answers, so we combine semantic evaluation with grounding evaluation. A structured LLM judge [19] compares the model response with the groundtruth answer and determines whether each ground-truth sensitive factor is semantically identified and whether the explanation correctly states why the factor is sensitive. The judge also flags unsupported predictions, where the model claims sensitive factors that are not present in the ground truth; such cases receive zero score for the corresponding question. For q4 and q5, let u indicate whether the judge flags an unsupported prediction. Let N be the number of groundtruth evidence annotations for the question. When N > 0, the judge matches each ground-truth factor i to at most one predicted evidence box Bp(i) . Let ai indicate semantic correctness and ei indicate explanation correctness for factor i. We credit a factor only when it is semantically correct, its explanation is correct, and its matched evidence box is sufficiently grounded:   ri = 1 ai = 1 ∧ ei = 1 ∧ IoU(Bp(i) , Bg,i ) > τ . (5)

SpatialTrustGuard

Input image + q1–q5

Selection VLM predict q1–q3 options only

Conservative SelfVerification

Grounded Answer VLM

keep / delete q2–q3 sensitive-factor candidates

locked q1–q3 + q4 / q5 explanations + evidence boxes

Final JSON output

Staged QA Decomposition

Direct VLM

Input image + q1–q5

Single VLM Call answer all questions in one pass

Final JSON output

Figure 4. Overview of SpatialTrustGuard. Compared with direct one-pass VLM answering, SpatialTrustGuard decomposes inference into candidate selection, conservative self-verification, and grounded answer generation with locked intermediate choices.

First, the model performs candidate factor selection for q1 , q2 , and q3 . This stage asks only for categorical judgments: whether any sensitive factor is present, which direct sensitive factors are visible, and which indirect sensitive factors are visible. By postponing explanation and localization, this stage isolates the model’s basic recognition decision from the more open-ended generation tasks that follow. Second, SpatialTrustGuard applies conservative selfverification [9] to the selected q2 and q3 options. The verifier re-examines each proposed sensitive factor under an evidence-sufficiency criterion: the factor should be retained only if the complete described condition is clearly visible in the image. The verifier is restricted to removing unsupported candidates and is not allowed to introduce new factors. This makes the verification step conservative and reduces the chance that later explanations will be built around speculative claims. Third, the model generates the final grounded answers for all five questions using the verified q1 –q3 answers as fixed semantic commitments. The direct-factor explanation in q4 must be derived from the verified direct factors in q2 , and the indirect-factor explanation in q5 must be derived from the verified indirect factors in q3 . When no visually supported factor is retained for a category, the final response states the absence of such evidence rather than inventing a grounding target. The generated answer is then checked for structural and semantic consistency, including preservation of the verified choices and alignment between identification labels, explanations, and grounding regions.

If the matched predicted evidence box is missing or invalid, ri = 0. The q4 and q5 score is   u = 1, 0, (6) s4/5 = r0 , u = 0 and N = 0,   1 PN i=1 ri , u = 0 and N > 0, N where r0 = 1 only if the model clearly states that no such factor exists and provides no spurious evidence; otherwise r0 = 0.

4. SpatialTrustGuard We propose SpatialTrustGuard, an inference-time strategy that improves model consistency on SpatialTrust without fine-tuning or additional training data. The method targets a common failure mode in grounded privacy-risk reasoning: models may introduce unsupported sensitive factors and then generate fluent explanations and plausible-looking grounding regions for them. SpatialTrustGuard addresses this issue by decomposing the task into staged answer selection, conservative verification, and final grounded generation, as detailed below.

4.1. Method Overview

4.2. Staged QA Decomposition

Given an image I and the five SpatialTrust questions Q = {q1 , . . . , q5 }, SpatialTrustGuard produces a structured answer set A = {a1 , . . . , a5 }. As shown in Fig. 4, the pipeline contains three stages.

The first stage decomposes SpatialTrust into a lightweight choice-answering task. The model receives the image together with the question text and answer options for q1 , q2 , 6

5. Experiments

and q3 , while ground-truth annotations, explanations, and grounding regions are withheld. The output of this stage is a compact set of selected option labels, with a single choice for the binary presence question and a set of choices for each factor-identification question. This decomposition reduces the burden of solving several different tasks at once [20]. In a one-pass prompting setting, the model must simultaneously detect sensitive factors, distinguish direct from indirect factors, write explanations, and localize evidence. These requirements can interfere with each other. For example, the model may select one factor in q2 , describe a different factor in q4 , or produce a bounding box that corresponds to neither. By separating answer selection from explanation and grounding, SpatialTrustGuard first establishes a compact answer state that later stages must follow. The selected answers are standardized into a compact choice state before grounded generation. SpatialTrustGuard enforces a single valid choice for q1 and valid sets of choices for q2 and q3 , with mutually exclusive options such as “None of the above” handled as exclusive selections. After verification, the final stage receives the full benchmark item together with these fixed answers: grounding is generated only for verified q2 and q3 factor choices, and the explanations in q4 and q5 must remain tied to the same direct and indirect factors, respectively. If no factor is verified for a category, the response records the absence of visible supporting evidence and assigns no grounding region.

5.1. Experimental Setup We evaluate multimodal large language models on the full SpatialTrust benchmark using the image and five structured questions defined in Sec. 3.1. For localization questions, evidence boxes are scored with an IoU threshold of 0.5. We report five task-level scores: sensitive factor detection, direct factor identification, indirect factor identification, direct factor explanation, and indirect factor explanation. The overall score is the average performance over all five question types. All scores are reported as percentages. We compare two proprietary models, GPT-5.4 [12] and Gemini-2.5-flash [4], with six opensource models: GLM-4.1V-9B-Thinking [15], GLM-4.6VFlash [17], InternVL3-38B-Instruct [21], Qwen2-VL-7BInstruct [16], Qwen3-VL-8B-Instruct and Qwen3-VL-30BA3B-Instruct [2]. SpatialTrustGuard is built on Qwen3-VL30B-A3B-Instruct and uses the staged inference pipeline described in Sec. 4.

5.2. Main Results on SpatialTrust Tab. 2 shows the performance of representative VLMs and SpatialTrustGuard on SpatialTrust. Current VLMs achieve moderate sensitive factor detection, with most models scoring around 66–69%, but their performance drops substantially on factor identification, explanation, and grounding. This indicates that detecting possible sensitive factors is easier than localizing the relevant evidence and explaining its role in authentication-related information leakage. Among proprietary models, Gemini-2.5-flash outperforms GPT-5.4 overall, mainly due to stronger factor identification and explanation. Among open-source models, Qwen3-VL-30B-A3B-Instruct performs best, reaching 36.78% overall and showing relatively strong results on indirect factor identification and explanation. Qwen3-VL-8BInstruct and GLM-4.6V-Flash obtain the next best opensource results, but still trail the larger Qwen3 model on the more difficult indirect and explanation tasks. In contrast, InternVL3-38B-Instruct and Qwen2-VL-7B-Instruct achieve comparable sensitive factor detection scores but much lower grounded explanation scores, suggesting that general detection ability does not directly translate into reliable spatial reasoning. Overall, the open-source results show that SpatialTrust is less limited by recognizing whether a sensitive factor may exist and more limited by identifying the correct factor type and grounding the explanation. SpatialTrustGuard achieves the best overall score, improving Qwen3-VL-30B-A3B-Instruct from 36.78% to 41.12%. The gains mainly come from structured reasoning and grounding: indirect factor identification improves from 28.65% to 34.20%, direct factor explanation from 25.74%

4.3. Conservative Self-Verification The conservative self-verification stage audits the sensitivefactor options selected in q2 and q3 . For each selected non“None of the above” option, the verifier evaluates whether the complete option description is visually supported by the image. An option is kept only when the relevant factor is clearly visible and does not require inference beyond the available visual evidence. The verifier is intentionally restricted to deletion-only editing. It cannot add a missed sensitive factor, replace an incorrect factor with another option, or alter q1 . This restriction mainly targets false positives, which are especially harmful in SpatialTrust because an unsupported factor can later be expanded into a fluent explanation and paired with an arbitrary grounding region. By allowing only removal, the verifier reduces unsupported claims while preserving the original selection structure. If all proposed factors for q2 or q3 are removed, the corresponding category is treated as having no visually supported sensitive factor. The verified choices then serve as fixed constraints for final generation. This prevents the final stage from introducing new direct or indirect factors that were not selected and verified. 7

Table 2. Model performance on SpatialTrust with an IoU threshold of 0.5 for grounded evidence.

Factor Identification

Factor Explanation

Direct

Indirect

Direct

Indirect

68.80 66.38

26.08 40.81

5.83 12.36

24.44 38.91

4.53 10.60

25.94 33.81

67.07 69.32 67.76 66.38 68.80 67.42

14.21 26.78 9.10 6.76 28.68 39.17

8.64 13.75 4.74 3.90 17.85 28.65

11.96 15.94 6.41 1.56 18.28 25.74

6.21 6.47 3.52 0.87 10.92 22.91

21.62 26.45 18.31 15.89 28.91 36.78

65.51

41.07

34.20

35.44

29.38

41.12

Sensitive Factor Detection

Model Proprietary Models GPT-5.4 Gemini-2.5-flash Open-Source Models GLM-4.1V-9B-Thinking GLM-4.6V-Flash InternVL3-38B-Instruct Qwen2-VL-7B-Instruct Qwen3-VL-8B-Instruct Qwen3-VL-30B-A3B-Instruct Our Method SpatialTrustGuard

Overall

Table 3. Ablation study of SpatialTrustGuard with an IoU threshold of 0.5 for grounded evidence.

Variant Qwen3-VL-30B-A3B-Instruct + Staged QA Decomposition + Conservative Self-Verification

Sensitive Factor Detection 67.42 66.38 65.51

Factor Identification

Factor Explanation

Direct

Indirect

Direct

Indirect

39.17 38.13 41.07

28.65 31.57 34.20

25.74 31.72 35.44

22.91 27.01 29.38

to 35.44%, and indirect factor explanation from 22.91% to 29.38%. Sensitive factor detection drops from 67.42% to 65.51%, reflecting the conservative deletion-only verification step, but the overall score improves because SpatialTrust emphasizes correct identification, explanation, and grounding of direct and indirect evidence.

Overall 36.78 38.96 41.12

identification and both explanation tasks. The largest gains occur in explanation and grounding, where locked and verified choices constrain the final response to evidence tied to the selected sensitive factors. These results show that both decomposition and conservative answer auditing are useful, with verification providing further protection against unsupported factor claims.

5.3. Ablation Study

6. Conclusion

Tab. 3 evaluates the contributions of Staged QA Decomposition and Conservative Self-Verification. Starting from the Qwen3-VL-30B-A3B-Instruct one-pass baseline, we first add Staged QA Decomposition, which separates candidate selection from final grounded answer generation while omitting self-verification. This raises the overall score from 36.78% to 38.96%, showing that decomposing SpatialTrust into intermediate answer states helps produce more consistent final responses. Adding Conservative Self-Verification on top of this decomposition further raises the overall score to 41.12%. The full SpatialTrustGuard pipeline outperforms the decomposition-only variant on direct and indirect factor

We introduced SpatialTrust, a benchmark for evaluating whether multimodal large language models can recognize, distinguish, explain, and ground environmental information-leakage risks in secure authentication captures. SpatialTrust focuses on visible background and nonprimary-subject factors that may disclose, reflect, record, or enable access to information from the login computer, and evaluates whether model judgments are supported by concrete visual evidence. Our evaluation of eight representative MLLMs shows that current models remain limited, especially in distinguishing direct and indirect sensitive factors and grounding their explanations in relevant evidence. We further proposed SpatialTrustGuard, a staged 8

inference-time pipeline with conservative self-verification, which improves the overall score from 36.78% to 41.12%. These results suggest that structured decomposition can improve consistency, while spatially grounded environmental risk recognition remains a challenging direction for building more reliable, evidence-based MLLMs in privacy- and security-sensitive authentication scenarios.

Pedro Cardoso-Leite. Balancing the perception of cheating detection, privacy and fairness: A mixed-methods study of visual data obfuscation in remote proctoring. In Proceedings of the 2024 European Symposium on Usable Security, pages 337–353, New York, NY, USA, 2024. Association for Computing Machinery. [11] OpenAI. Introducing ChatGPT Images 2.0. https : //openai.com/index/introducing- chatgptimages-2-0/, 2026. [12] OpenAI. Introducing GPT-5.4. https://openai.com/ index/introducing-gpt-5-4/, 2026. [13] Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Towards a visual privacy advisor: Understanding and predicting privacy risks in images. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), 2017. [14] Xiongtao Sun, Hui Li, Jiaming Zhang, Yujie Yang, Kaili Liu, Ruxin Feng, Wen Jun Tan, and Wei Yang Bryan Lim. MultiPriv: Benchmarking individual-level privacy reasoning in vision-language models, 2026. arXiv preprint arXiv:2511.16940. [15] V Team, Wenyi Hong, Wenmeng Yu, Xiaotao Gu, et al. GLM-4.5V and GLM-4.1V-Thinking: Towards versatile multimodal reasoning with scalable reinforcement learning, 2025. arXiv preprint arXiv:2507.01006. [16] Peng Wang, Shuai Bai, Sinan Tan, Shijie Wang, Zhihao Fan, Jinze Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Yang Fan, Kai Dang, Mengfei Du, Xuancheng Ren, Rui Men, Dayiheng Liu, Chang Zhou, Jingren Zhou, and Junyang Lin. Qwen2-VL: Enhancing vision-language model’s perception of the world at any resolution, 2024. arXiv preprint arXiv:2409.12191. [17] Z.ai. GLM-4.6V: Open source multimodal models with native tool use. https://z.ai/blog/glm-4.6v, 2025. [18] Chenye Zhao, Jasmine Mangat, Sujay Koujalgi, Anna Squicciarini, and Cornelia Caragea. PrivacyAlert: A dataset for image privacy prediction. Proceedings of the International AAAI Conference on Web and Social Media, 16(1):1352– 1361, 2022. [19] Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. Judging LLM-as-a-judge with MT-bench and Chatbot Arena. In Proceedings of the 37th International Conference on Neural Information Processing Systems, Red Hook, NY, USA, 2023. Curran Associates Inc. [20] Denny Zhou, Nathanael Schärli, Le Hou, Jason Wei, Nathan Scales, Xuezhi Wang, Dale Schuurmans, Claire Cui, Olivier Bousquet, Quoc V Le, and Ed H. Chi. Least-to-Most prompting enables complex reasoning in large language models. In The Eleventh International Conference on Learning Representations, 2023. [21] Jinguo Zhu, Weiyun Wang, Zhe Chen, et al. InternVL3: Exploring advanced training and test-time recipes for open-source multimodal models, 2025. arXiv preprint arXiv:2504.10479. [22] Yuke Zhu, Oliver Groth, Michael Bernstein, and Li Fei-Fei. Visual7W: Grounded question answering in images. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 4995–5004, 2016.

References [1] Adam J. Aviv, John T. Davin, Flynn Wolf, and Ravi Kuber. Towards baselines for shoulder surfing on mobile authentication. In Proceedings of the 33rd Annual Computer Security Applications Conference, pages 486–498. Association for Computing Machinery, 2017. [2] Shuai Bai, Yuxuan Cai, Ruizhe Chen, et al. Qwen3-VL technical report, 2025. arXiv preprint arXiv:2511.21631. [3] David G. Balash, Dongkun Kim, Darika Shaibekova, Rahel A. Fainchtein, Micah Sherr, and Adam J. Aviv. Examining the examiners: Students’ privacy and security perceptions of online proctoring services. In Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021), pages 633–652. USENIX Association, 2021. [4] Gheorghe Comanici, Eric Bieber, Mike Schaekermann, et al. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities, 2025. arXiv preprint arXiv:2507.06261. [5] Hugo Cornellier. AGE 12 TO MARRIED – I Took A Photo Every Day. YouTube video, https://www.youtube. com/watch?v=65nfbW-27ps, 2017. [6] Danna Gurari, Qing Li, Chi Lin, Yinan Zhao, Anhong Guo, Abigale Stangl, and Jeffrey P. Bigham. VizWiz-Priv: A dataset for recognizing the presence and purpose of private visual information in images taken by blind people. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, pages 939–948. Computer Vision Foundation / IEEE, 2019. [7] Yifan Li, Yifan Du, Kun Zhou, Jinpeng Wang, Xin Zhao, and Ji-Rong Wen. Evaluating object hallucination in large visionlanguage models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 292–305, Singapore, 2023. Association for Computational Linguistics. [8] Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. MM-SafetyBench: A benchmark for safety evaluation of multimodal large language models. In Computer Vision – ECCV 2024: 18th European Conference, Milan, Italy, September 29–October 4, 2024, Proceedings, Part LVI, pages 386–403, Berlin, Heidelberg, 2024. SpringerVerlag. [9] Aman Madaan, Niket Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegreffe, Uri Alon, Nouha Dziri, Shrimai Prabhumoye, Yiming Yang, Shashank Gupta, Bodhisattwa Prasad Majumder, Katherine Hermann, Sean Welleck, Amir Yazdanbakhsh, and Peter Clark. SelfRefine: Iterative refinement with self-feedback. In Thirtyseventh Conference on Neural Information Processing Systems, 2023. [10] Suvadeep Mukherjee, Verena Distler, Gabriele Lenzini, and

9

Related documents

• KRYPTOS K4: Constraint-Based Structural Cryptanalysis from Public Anchors#191052
• TRUST-SC: truthful multi-task double auction for quality-aware spatial crowdsourcing in strategic environment.#480969
• Improve Trust and Adversarial Robustness of AI models in Remote Sensing#307622
• Agentic Cloud Decoys: A Deception-Driven Framework for Autonomous Intrusion Investigation#405549
• Secure Password Ciphersuites for Transport Layer Security (TLS)#133465