Research map / Vision-language and multimodal / Multimodal LLMs

Towards Policy-Adaptive Image Guardrail: Benchmark and Method

CVPR 2026 · Vision-language and multimodal › Multimodal LLMs · approach: VLM capability analysis · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces SafeEditBench, a cross-policy harmful-image guardrail benchmark built from minimally edited safe/unsafe image pairs under five policies, and SafeGuard-VL, a two-stage SFT-then-RLVR (GRPO) guardrail that generalizes better across policies while preserving general VQA ability.

Problem

Harmful-image guardrails are trained and evaluated under a single fixed safety policy, so VLM-based guardrails overfit, fail on unseen or shifting policies, and lose instruction-following and general knowledge.

Approach

Build policy-aligned safe/unsafe image pairs via image editing for cross-policy evaluation, and train a guardrail with SFT on self-recaptioned unsafe descriptions followed by policy-conditioned GRPO with ground-truth safe/unsafe rewards, since RL samples from the model's own distribution and retains general ability.

Key results

• SafeGuard-VL-Full reaches 72.2 overall on UnsafeBench versus 41.7 for Qwen2.5-7B and 43.6 for QwenGuard-7B.
• SafeGuard-VL-RL scores 62.39 on UnsafeBench versus 41.71 for Qwen2.5-7B while keeping general overall at 57.02 (vs 56.92 baseline), whereas QwenGuard-7B drops to 35.98 general overall.
• On SafeEditBench, Ours (RL+SafeEditTrain) reaches 49.43 overall F1 versus 32.76 for QwenGuard-7B and 48.68 for Qwen2.5-VL-7B.

Surprising findings

• An SFT model trained on policy L1 degenerates into an always-safe classifier, scoring 0% on all other policies.
• QwenGuard-7B scores 84.57 on LlavaGuardBench but drops to 43.56 on UnsafeBench and 12.05 on BLINK, and sometimes outputs JSON rationales instead of following the requested format.

Limitations

• SafeEditBench is small (128 images in the main text, 62 pairs per policy), limiting statistical power.
• Policies are randomly generated by Gemini and benchmark results are reported only for a limited set of five policies.
• Edited safe images are generated with Nano Banana, so the benchmark depends on a proprietary image editor.

Experimental setup

Datasets: LlavaGuard training set LlavaGuard test set UnsafeBench LlavaGuardBench MMMU RealWorldQA BLINK MMT-Bench

Benchmarks: SafeEditBench UnsafeBench LlavaGuardBench MMMU RealWorldQA BLINK MMT-Bench

Metrics: F1-score accuracy

Baselines: QwenGuard-7B LlavaGuard-7B LlavaGuard-0.5B Llama Guard ShieldGemma2 Qwen2.5-VL-7B GLM-4V-9B Qwen2-VL-7B NudeNet NSFW_Detector

Builds on: GRPO LlavaGuard UnsafeBench

Closest papers by meaning

• SafeWatch: An Efficient Safety-Policy Following Video Guardrail Model with Transparent Explanations (ICLR 2025 · similarity 0.93)
• LlavaGuard: An Open VLM-based Framework for Safeguarding Vision Datasets and Models (ICML 2025 · similarity 0.90)
• Rethinking Bottlenecks in Safety Fine-Tuning of Vision Language Models (ICLR 2026 · similarity 0.89)
• VLSU: Mapping the Limits of Joint Multimodal Understanding for AI Safety (ICLR 2026 · similarity 0.88)
• GuardAlign: Robust Safety Alignment in Multimodal Large Language Models (ICLR 2026 · similarity 0.88)
• ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time (ICLR 2025 · similarity 0.87)