Skip to content

PolicyShiftGuard: Benchmarking and Improving Policy-Adaptive Image Guardrails

🕒 Published (v1): 2026-07-07 07:04 UTC · Source: Arxiv · link

Why this paper was selected

Policy-adaptive image guardrails benchmark; critical for real deployment safety

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

Existing image guardrails treat safety as a fixed property of an image, failing when the governing policy changes at runtime. This paper introduces PolicyShiftBench, a benchmark testing whether models adapt decisions to the active policy rather than image-level risk priors, and proposes PolicyShiftGuard, a compact VLM-based guardrail trained with a two-stage recipe that explicitly optimizes for same-image policy-flip sensitivity. The 7B model achieves 76.9 Avg. F1 and 72.1 Avg. PSS on PolicyShiftBench, surpassing all evaluated baselines including closed-source frontier models, while reducing inference latency.

Problem

Current image safety benchmarks assign one fixed label per image under a static taxonomy; even recent policy-conditioned benchmarks (e.g., SafeEditBench with 5 policies) do not test generalization to held-out policy definitions or measure whether a model flips its decision when the same image transitions from a permissive to a restrictive policy. Existing VLMs and specialized guardrails (e.g., GuardReasoner-VL-3B: 59.2 Avg. F1, 3.2 Avg. PSS) can detect visually risky content but fail to revise decisions under policy change—a critical gap for real deployments where the same image may be allowed in one context and blocked in another.

Method

PolicyShiftBench provides 2,000 policy-discriminative instances over 265 images paired with 7.55 policy-conditioned prompts on average, organized across 7 risk categories × 5 moderation scenarios = 28 policy variants. The benchmark splits into an Adaptive Split (in-distribution policy families) and a Shift Split (held-out policies). Labels are constructed via a deterministic rule engine: three VLMs independently annotate attribute vectors \(A_c(x)\) per category \(c\) (e.g., exposed body parts, weapon type, PII presence), aggregated by majority vote; the policy rule \(f_{c,p}\) is then applied deterministically: $\(z_{c,p}(x) = f_{c,p}(A_c(x)),\quad \text{final label} = \bigvee_c z_{c,p_c}(x).\)$ The Policy Shift Score (PSS) counts only pairs \((q^+, q^-)\) sharing the same image and risk category but opposite gold labels, crediting a model only when it answers both correctly.

PolicyShiftGuard is trained from Qwen2.5-VL checkpoints in two stages: 1. Randomized Policy SFT (RP-SFT): Supervised next-token prediction on policy-conditioned examples with randomized policy order, surface identifiers, and category-slot assignment to prevent shortcut learning. Target format is a concise false or true | c. 2. Boundary-Pair Policy Adaptation (BP-Adapt): Fine-tunes on matched boundary pairs \((q^+, q^-)\) for the same image—one bundle blocks category \(c\), the other permits it. Adds a pairwise margin loss: $\(\mathcal{L}_\text{pair} = \max\!\left(0,\; m - s_\theta(\text{true} \mid q^+) + s_\theta(\text{true} \mid q^-)\right)\)$ combined with cross-entropy \(\mathcal{L}_\text{CE}\), a safe/unsafe prefix loss \(\mathcal{L}_\text{label}\), and a category-ID stabilization loss \(\mathcal{L}_\text{cat}\).

Key Contributions

  • PolicyShiftBench: 2,000 instances, 265 images, 28 policy variants across 7 risk categories and 5 moderation scenarios; introduces the PSS metric that rewards correct same-image policy flips rather than generic unsafe detection.
  • Auditable data pipeline: Separates visual attribute annotation (3-VLM majority vote) from policy-rule labeling (deterministic logic), making label flips traceable to specific policy changes on fixed image evidence.
  • Two-stage training recipe: RP-SFT for robust policy-following and format learning; BP-Adapt for explicit policy-flip optimization via pairwise margin loss on boundary pairs.
  • PolicyShiftGuard-3B/7B: Compact models with 5-token output format (true | c or false) achieving SOTA policy-adaptive performance with substantially lower latency than closed-source models.

Results

  • PolicyShiftGuard-7B: 76.9 Avg. F1, 72.1 Avg. PSS on PolicyShiftBench; baseline Qwen2.5-VL-7B achieves 20.6 Avg. F1 and 4.8 Avg. PSS.
  • Outperforms all specialized guardrails: best prior model (GuardReasoner-VL-7B) achieves 57.9 Avg. F1 and 10.5 Avg. PSS.
  • Outperforms closed-source frontier models: Gemini-3-Flash-Preview 70.6 Avg. F1 / 50.6 Avg. PSS; GPT-5.4 57.8 / 45.5; Claude-Sonnet-4.6 39.8 / 18.8.
  • Cross-benchmark (Table 3 Overall score): PolicyShiftGuard-7B 69.9, PolicyShiftGuard-3B 62.4 vs. best baseline SafeGuard-VL-RL-7B 52.5.
  • Latency: PolicyShiftGuard-7B 163.9 ms vs. Qwen2.5-VL-7B base 273.3 ms; Gemini-3-Flash-Preview 5,963.5 ms.
  • Human performance: 90.1 Avg. F1 / no PSS reported (PSS ground truth not applicable).
  • Data quality: 97.50% unanimous agreement across three VLM annotators; 88–90% blind human accuracy on Adaptive/Shift Splits; 95% qualified rate.

Limitations

  • PSS ground truth requires paired same-image instances with opposite labels, so it cannot be computed on arbitrary external benchmarks without re-annotation.
  • The Shift Split tests held-out policies within the same scenario-category schema; generalization to entirely novel risk taxonomies or out-of-distribution policy structures is untested.
  • Training data is image-disjoint from evaluation but still derived from the same 7-category / 5-scenario framework; real-world deployment policies may span different dimensions.
  • Scaling alone does not solve policy adaptation (Qwen2.5-VL-72B Avg. PSS = 27.4), but PolicyShiftGuard's training approach depends on the availability of boundary-pair supervision, which requires policy-discriminative data curation.
  • The paper truncates before reporting per-category difficulty breakdown (Finding 3), so full analysis of which categories remain most challenging is not available in the provided text.

Relevance to Vision-Language Models

This work directly benchmarks and trains VLMs in a policy-conditioned safety-classification role, revealing a systematic weakness: existing VLMs conflate unsafe-content recognition with policy compliance, as evidenced by the F1/PSS dissociation across all tested architectures. The boundary-pair pairwise loss is a fine-tuning strategy applicable to any VLM backbone and addresses a general limitation in instruction-following: models must bind visual evidence to runtime textual constraints rather than relying on prior category associations. For researchers tracking VLMs, PolicyShiftBench provides a controlled diagnostic for measuring whether a model truly reads and applies supplied policy text vs. pattern-matches image content—complementing existing benchmarks like LLaVA-Guard and SafeEditBench. The finding that scale (up to 72B) does not substitute for task-specific training on policy-flip examples has implications for how VLM capability generalizes to constrained real-world deployment scenarios.