Research map / Vision-language and multimodal / Multimodal LLMs

GuardTrace-VL: Detecting Unsafe Multimodel Reasoning via Iterative Safety Supervision

CVPR 2026 · Vision-language and multimodal › Multimodal LLMs · approach: Chain-of-thought multimodal reasoning · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes GuardTrace-VL, a vision-aware guard that audits full multimodal Question-Thinking-Answer traces, trained on a new GuardTrace dataset with a three-stage SFT→DPO→oracle-guided DPO pipeline.

Problem

Existing multimodal safety guards evaluate only the input question and final answer, missing unsafe content that emerges in the intermediate reasoning traces of multimodal large reasoning models.

Approach

A vision-language safety auditor that jointly judges image, question, reasoning trace and answer, trained with progressive SFT, DPO on 2:1-vote pairs, and an oracle-guided DPO stage using hard negatives and expert-resolved ambiguous cases.

Key results

• GuardTrace-VL-3B achieves average F1 93.10% across the four GuardTrace-Test subsets, versus 88.86% for GPT-5 and 79.55% for LLaMA4-Guard-12B.
• On the text-only ReasoningShield-Test, GuardTrace-VL-3B reaches 88.11% F1, slightly below ReasoningShield-3B (90.23%).
• Training ablation on GuardTrace-Test S-Eval-VL F1 rises from 43.61 (base) to 89.89 (SFT), 92.16 (SFT+DPO), and 93.33 (full with OGDPO).

Surprising findings

• Caption-augmented text-only guards (ReasoningShield-3B) remain competitive, but the authors report that image captions cannot fully convey visual safety cues.
• The stated 13.5% F1 improvement in the abstract is not clearly reconciled with the table averages (e.g., 93.10 vs 79.55 for LLaMA4-Guard).

Limitations

• Training data is generated by open-source MLRMs and labels come from ensemble MLLM voting, so label quality depends on those judges.
• The dataset will not be fully open-sourced due to harmful content, limiting reproducibility.
• Text-only QTA performance trails the specialized ReasoningShield-3B.

Experimental setup

Datasets: GuardTrace-Train S-Eval HADES CS-DJ FigStep LLaVA-CC3M-Pretrain-595K MM-SafetyBench SafeBench MMJ-Bench ReasoningShield-Test BeaverTails WildGuard

Benchmarks: GuardTrace-Test (S-Eval-VL, HADES-Eval, MM-Eval, MMJ-Eval) ReasoningShield-Test BeaverTails WildGuard SPA-VL-Test

Metrics: accuracy F1

Baselines: OpenAI Moderation API GPT-5 Qwen3-VL-Plus Qwen2.5-VL-3B-Instruct Qwen2.5-VL-32B-Instruct LLaMA3-Guard-11B-Vision LLaMA4-Guard-12B GuardReasoner-VL-7B WildGuard-7B Beaver-Dam-7B ReasoningShield-3B

Builds on: DPO S-Eval ReasoningShield LLaMA-Factory Qwen2.5-VL

Closest papers by meaning

• GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning (NeurIPS 2025 · similarity 0.90)
• GuardAlign: Robust Safety Alignment in Multimodal Large Language Models (ICLR 2026 · similarity 0.89)
• Rethinking Bottlenecks in Safety Fine-Tuning of Vision Language Models (ICLR 2026 · similarity 0.89)
• SafeGRPO: Self-Rewarded Multimodal Safety Alignment via Rule-Governed Policy Optimization (CVPR 2026 · similarity 0.89)
• When Safe Unimodal Inputs Collide: Optimizing Reasoning Chains for Cross-Modal Safety in Multimodal Large Language Models (AAAI 2026 · similarity 0.88)
• VLSU: Mapping the Limits of Joint Multimodal Understanding for AI Safety (ICLR 2026 · similarity 0.88)