Research map / Large language models / Reasoning and chain of thought
GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Builds GuardReasoner-VL, a reasoning-based VLM guard trained via reasoning SFT on a 123K-sample text/image/text-image corpus followed by online GRPO with safety-aware data concatenation, dynamic clipping, and a length-aware reward.
Problem
Existing VLM guard models only output classifications, lacking interpretability and generalization, and are limited by offline training, scarce multimodal reasoning data, and token cost of reasoning.
Approach
Cold-start reasoning SFT on a multimodal reasoning corpus, then online GRPO (no KL term) with rejection-sampled hard samples, safety-aware concatenation augmentation (harmful if any part harmful), a decaying clipping schedule, and a reward penalizing reasoning length.
Key results
- GuardReasoner-VL 7B achieves 79.07% average F1 over all prompt-harmfulness benchmarks, the best among compared models.
- GuardReasoner-VL 7B reaches 77.58% average F1 on response harmfulness detection, outperforming LLaMA Guard 3 Vision 11B (54.01%) by a wide margin on the all-benchmark average.
- The Eco variant of GuardReasoner-VL reduces output tokens by about 12-14% at a cost of roughly 0.5-1.4% F1.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add reasoning processes to supervised fine-tuning (ablation) | GuardReasoner-VL · Prompt harmfulness detection | F1 score | Helped |
| Train with reasoning data from text, image, and text-image modalities (ablation) | GuardReasoner-VL · Prompt harmfulness detection | F1 score | Helped |
| Use image-only reasoning SFT instead of multimodal reasoning SFT (ablation) | GuardReasoner-VL · Text prompt harmfulness detection | F1 score | Hurt |
| Add safety-aware data augmentation via safety-aware data concatenation (ablation) | GuardReasoner-VL online RL · Prompt harmfulness detection | F1 score | Helped |
| Use a dynamic clipping strategy (ablation) | GuardReasoner-VL online RL · Prompt harmfulness detection | F1 score | Helped |
| Add the length term to the reward (ablation) | GuardReasoner-VL online RL · Prompt harmfulness detection | F1 score | Helped |
| Set the length constraint β to 1/6 (ablation) | GuardReasoner-VL 3B · Prompt and response harmfulness detection | F1 score: 77.65 -> 77.27 | Hurt |
| Set the length constraint β to 1/6 (ablation) | GuardReasoner-VL 3B · Prompt and response harmfulness detection | Output tokens: 213.32 -> 187.30 | Helped |
| Set the length constraint β to 1/6 (ablation) | GuardReasoner-VL 7B · Prompt and response harmfulness detection | F1 score: 78.33 -> 77.22 | Hurt |
| Set the length constraint β to 1/6 (ablation) | GuardReasoner-VL 7B · Prompt and response harmfulness detection | Output tokens: 208.33 -> 180.08 | Helped |
Surprising findings
- SFT on image data alone degrades the model's textual capability, yielding unpromising performance.
- Existing VLM guard models such as LLaMA Guard 3 Vision score near zero on image-only moderation.
Limitations
- Token efficiency of reasoning is still limited.
- May underperform on in-the-wild attacks such as indirect prompt injection against computer-use agents.
Experimental setup
Datasets: WildGuardTrain AegisTrain BeaverTailsTrain ToxicChatTrain UnsafeBench BadNews HatefulMemes HatefulPoliticalMemes HOD VLGuard SPA-VL-Train
Benchmarks: ToxicChat OpenAIModeration AegisSafetyTest SimpleSafetyTests HarmBench WildGuardTest HarmImageTest SPA-VL-Eval SafeRLHF BeaverTails XSTestResponse
Metrics: F1 score output tokens
Baselines: LLaMA Guard 3 Vision 11B OpenAI Moderation API Azure Content Safety API Qwen2.5-VL-Instruct 7B GuardReasoner 8B WildGuard 7B LLaMA Guard 3 8B
Builds on: GuardReasoner GRPO Qwen2.5-VL WildGuard
Closest papers by meaning
- GuardTrace-VL: Detecting Unsafe Multimodel Reasoning via Iterative Safety Supervision (CVPR 2026 · similarity 0.90)
- $R^2$-Guard: Robust Reasoning Enabled LLM Guardrail via Knowledge-Enhanced Logical Reasoning (ICLR 2025 · similarity 0.88)
- RSafe: Incentivizing proactive reasoning to build robust and adaptive LLM safeguards (NeurIPS 2025 · similarity 0.87)
- Critic-V: VLM Critics Help Catch VLM Errors in Multimodal Reasoning (CVPR 2025 · similarity 0.86)
- ReasoningShield: Safety Moderation over Reasoning Traces of Large Reasoning Models (NeurIPS 2026 · similarity 0.86)
- DynaGuard: A Dynamic Guardian Model With User-Defined Policies (ICLR 2026 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.