Remote sensing has emerged as an important domain for multimodal large language models (MLLMs), where reliable understanding requires locating small, dense, and spatially subtle visual evidence. However, our diagnostic analysis shows that current MLLMs often fail because their reasoning is not grounded to the correct visual evidence, leading to wrong-region attention or missed task-relevant objects. To address this issue, we introduce RsEvi-8B, an evidence-aware remote sensing MLLM that reasons with parseable bounding-box-grounded evidence. To enable this capability, we construct RsEvi-248K, a large-scale supervised dataset spanning VQA, visual grounding, object detection, object counting, and scene classification. The dataset provides verified bounding-box-grounded reasoning traces, where each intermediate visual claim is aligned with supporting evidence regions and filtered for both answer correctness and evidence faithfulness. To improve evidence-faithful reasoning, we further propose the evidence-aware GRPO, which uses an evidence verifier to regulate learning on generated evidence spans while preserving task-level outcome optimization. Extensive experiments across five remote-sensing task families show that RsEvi-8B improves the dataset-balanced average score by 17.15 points over Qwen3-VL-8B-Instruct, establishing explicit visual grounding as a key ingredient for reliable remote-sensing reasoning.

Safety concerns in large language models (LLMs) have gained significant attention due to their exposure to potentially harmful data during pre-training. In this paper, we identify a new safety vulnerability in LLMs: their susceptibility to natural distribution shifts between attack prompts and original toxic prompts, where seemingly benign prompts, semantically related to harmful content, can bypass safety mechanisms. To explore this issue, we introduce a novel attack method, ActorBreaker, which identifies actors related to toxic prompts within pre-training distribution to craft multi-turn prompts that gradually lead LLMs to reveal unsafe content. ActorBreaker is grounded in Latour’s actor-network theory, encompassing both human and non-human actors to capture a broader range of vulnerabilities. Our experimental results demonstrate that ActorBreaker outperforms existing attack methods in terms of diversity, effectiveness, and efficiency across aligned LLMs. To address this vulnerability, we propose expanding safety training to cover a broader semantic space of toxic content. We thus construct a multi-turn safety dataset using ActorBreaker. Fine-tuning models on our dataset shows significant improvements in robustness, though with some trade-offs in utility. Code is available at https://github.com/AI45Lab/ActorAttack.