One-sentence Summary

Researchers from Fudan University, Tongji University, and collaborators introduce PolicyShiftBench, a benchmark for policy-adaptive image guardrails, and PolicyShiftGuard, a compact guardrail trained via Randomized Policy SFT and Boundary-Pair Policy Adaptation that uses matched pass/block pairs with a pairwise comparison loss to separate blocking from passing policies, where the 7B model achieves 76.9 average F1 and 72.1 average PSS on PolicyShiftBench, transfers well to UnSafeBench and SafeEditBench, and improves the latency–performance trade-off with concise output, substantially outperforming existing brittle VLMs under policy shift.

Key Contributions

• POLICYSHIFTBENCH is introduced, a benchmark with 2,000 policy-discriminative instances across 265 images, seven risk categories, five moderation scenarios, and 28 policy variants for evaluating policy-adaptive image guardrailing.
• PolicyShiftGuard, a policy-conditioned guardrail, is trained with a two-stage recipe combining Randomized Policy SFT for robust instruction following and Boundary-Pair Policy Adaptation that uses matched pass/block pairs to explicitly handle policy shifts.
• Experiments show that existing VLMs and guardrails are brittle under policy shift, while PolicyShiftGuard achieves state-of-the-art results on POLICYSHIFTBENCH (76.9 Avg. F1, 72.1 Avg. PSS), transfers to UnSafeBench and SafeEditBench, and improves the latency-performance trade-off.

Introduction

Image guardrails in production systems must enforce ever-changing content policies across different products, age groups, regions, and institutions. Existing benchmarks, however, assign fixed labels under a single taxonomy and cannot distinguish whether a model merely recognizes risky content or truly adapts its decision when the active rule changes. Correspondingly, current guardrails often fail to flip their verdict for the same image when the policy boundary shifts. The authors address this gap with POLICYSHIFTBENCH, a benchmark that evaluates policy-adaptive guardrailing through 28 policy variants derived from realistic moderation scenarios, where each image appears with both pass and block labels under different rules. They further introduce PolicyShiftGuard, a compact model trained with auditable, rule-based data and a two-stage recipe that explicitly optimizes same-image policy flips, substantially improving policy-sensitive performance over existing vision-language models.

Dataset

The authors introduce PolicyShiftBench, a policy-adaptive image guardrailing benchmark built around seven risk categories and realistic moderation scenarios. Its key data features are:

• Dataset composition and sources

• The benchmark is constructed from a curated image set annotated with category-specific attribute vectors.

• It comprises an evaluation set of 2,000 policy-discriminative instances across 265 unique images and 28 policy variants.

• A separate training corpus contains 9,816 policy-conditioned instances over 2,945 training images.

• Annotations come from multiple multimodal annotators; field-level majority voting produces structured metadata for each image.

• Key details for each subset

• Adaptive Split (evaluation): 1,000 instances, 130 images, 16 policies. Designed to test adaptation to known policy variations.

• Shift Split (evaluation): 1,000 instances, 152 images, 12 held-out policies. Used to measure generalization to unseen policy shifts.

• Training corpus:

• 3,000 RP-SFT “no-think” examples for basic policy-conditioned response learning.

• 3,000 aligned think diagnostic examples that include reasoning traces.

• 3,816 BP-Adapt boundary-pair examples where a fixed image and category appear with two policies that flip the correct decision, emphasizing boundary adaptation.

• Metadata construction and processing

• Each image receives category-specific attribute annotations, e.g., exposed body parts, weapons, real/fictional violence, medical context, etc.

• Annotators only provide atomic facts; they never directly decide policy violations.

• Labels are built deterministically: for every category-policy pair, a rule is evaluated on the majority-voted attributes to output a block/pass decision. The final sample-level label is “unsafe” if any of the seven categories blocks the image, otherwise “safe”.

• The benchmark emphasizes policy-discriminative instances: an identical image and target category appear with different policies, causing the correct decision to flip. This forces models to read and apply the current policy rather than rely on static unsafe cues.

• Quality control: 97.5% of field annotations are unanimous; the rest are resolved by majority vote. Human auditing yields 88% (Adaptive) and 90% (Shift) blind accuracy, and a 95% qualified rate for data quality. Train and evaluation partitions are kept image-disjoint.

• How the training data is used

• The full training corpus of 9,816 instances is used to train guardrail models.

• The RP-SFT subset teaches the model to output block/pass decisions when given an image and a policy.

• The aligned think diagnostic subset encourages the model to articulate reasoning before deciding.

• The BP-Adapt boundary-pair subset specifically trains the model to handle policy boundaries where the same visual evidence must lead to different decisions under different rules.

Method

The authors propose a two-stage training recipe for PolicyShiftGuard, as shown in the figure below:

The first stage, Randomized Policy SFT (RP-SFT), teaches the model to follow policy bundles and produce structured guardrail outputs. The second stage, Boundary-Pair Policy Adaptation (BP-Adapt), trains matched pass/block boundary pairs so that the final decision changes when the active policy changes.

In the first stage, Randomized Policy SFT (RP-SFT), the authors train the guardrail model on policy-conditioned supervised fine-tuning data. The images used in this stage are disjoint from all evaluation splits. Each training example consists of an image $x$x, a runtime policy bundle $\mathcal{B} = \{p_1, \ldots, p_7\}$B={p1​,…,p7​}, and a deterministic target computed by executing the active policy rules on the voted visual metadata $a(x)$a(x). The target $y(x, \mathcal{B})$y(x,B) is defined as:

The model is optimized using supervised next-token prediction with the loss function:

where $\rho$ρ randomizes the policy presentation, including policy order, surface identifiers, and category-slot assignment, while applying the same transformation to the target category identifier. This randomization removes easy shortcuts from fixed policy positions or fixed textual templates, forcing the model to read the supplied policy bundle, bind visual evidence to the active rule, and output the structured decision.

In the second stage, Boundary-Pair Policy Adaptation (BP-Adapt), the authors build a post-training source to improve adaptation to new policies. The core unit is a boundary pair where the image and visual evidence are fixed, but the active policy changes the correct label:

Here, $\mathcal{B}^+$B+ blocks category $c$c and $\mathcal{B}^-$B− permits the same evidence. The RP-SFT checkpoint is fine-tuned using a final-token objective plus boundary-aware margins:

$\mathcal{L}_{\mathrm{CE}}$LCE​ trains the exact answer string, $\mathcal{L}_{\text{label}}$Llabel​ separates the correct safe or unsafe prefix for each prompt, and $\mathcal{L}_{\text{cat}}$Lcat​ stabilizes the violated category ID on blocked examples. The key term is the pair margin:

where $s_{\theta}(\text{true} \mid q)$sθ​(true∣q) is the model score for the unsafe decision prefix. This pair loss forces the blocking policy to receive a higher unsafe score than the passing policy under matched visual evidence, directly optimizing the policy-conditioned decision margin.

Experiment

The PolicyShiftBench benchmark evaluates whether image guardrail models can adapt their decisions when moderation policies shift, revealing that many models recognize unsafe content but fail to sensitively update judgments for the same image under different policies. Scaling model size improves content recognition but does not close the policy-adaptation gap, and reasoning-heavy or RL-based training often underperforms direct, concise boundary-pair optimization. The proposed PolicyShiftGuard demonstrates that explicitly training on policy-discriminative image pairs and streamlining output tokens yields both higher policy sensitivity and a favorable latency and accuracy trade-off. Overall, the experiments show that effective policy-adaptive guardrailing requires a focused training approach and that evaluation must jointly measure safety performance and inference speed.

Most visual safety benchmarks enforce a single fixed policy with one label per image and lack mechanisms to switch policies or compose policy bundles. The introduced benchmark supports variable, scenario-grounded policies, compositional policy bundles, and a paired evaluation metric that directly captures same-image policy flips, along with publicly released policy-conditioned training data. Prior benchmarks, except SafeEditBench and LLaVA-Guard, do not vary the active safety policy, assigning a single static label to each image. Compositional policy support, where category policies flexibly assemble into a runtime bundle, is absent from all earlier benchmarks and only provided by the new benchmark. A dedicated policy-shift metric (PSS) that explicitly measures correct decision flips for the same image under different policies is unique to the introduced benchmark. LLaVA-Guard offers partial policy variation (‘flip’) but does not include compositional policies or a policy-adaptive evaluation metric. Public policy-conditioned training data is sparse; the new benchmark provides a comprehensive set, whereas most earlier benchmarks release little or no training data for policy-adaptive scenarios.

PolicyShiftGuard substantially improves policy-adaptive guardrailing over its base models, achieving the strongest overall performance on the benchmark. General-purpose multimodal models exhibit a clear gap between recognizing unsafe content and adapting to policy changes, with many attaining moderate average F1 but extremely low average policy shift sensitivity. Even scaling model size does not close this adaptation gap, emphasizing that the benchmark isolates a distinct capability. PolicyShiftGuard-7B raises the base model's average F1 from 20.6 to 76.9 and average policy shift sensitivity from 4.8 to 72.1, establishing the best overall policy-adaptive performance. Several general-purpose models reach nontrivial average F1 scores (e.g., 59.2) yet achieve near-zero average policy shift sensitivity, showing that safe/unsafe recognition and policy-shift sensitivity are separate abilities. Larger Qwen2.5-VL variants improve average F1 with scale but policy shift sensitivity remains low, rising only from 4.8 at 7B to 27.4 at 72B, demonstrating that model size alone is insufficient for policy adaptation. PolicyShiftGuard-7B cuts inference latency from 273.3 ms to 163.9 ms relative to its base model while simultaneously boosting accuracy, largely due to a concise output format that resolves decisions in under five tokens. The performance gap between recognizing visually risky content and adapting to a different policy is especially pronounced in categories requiring finer attribute extraction, such as regulated goods, IP and brand safety, and privacy.

PolicyShiftGuard-7B achieves the highest overall average across all four safety benchmarks, and PolicyShiftGuard-3B is the second-best overall model. Among baseline systems, SafeGuard-VL-RL-7B leads on UnSafeBench and Adaptive, while GuardReasoner-VL-3B shows strong policy-shift generalization, and the base Qwen2.5-VL-7B struggles heavily on held-out policy shifts. PolicyShiftGuard-7B attains the top overall score, while PolicyShiftGuard-3B ranks second, outperforming all evaluated baselines. The base Qwen2.5-VL-7B fails on policy-shift tasks (12.1 F1 on Shift), but specialized guard models like GuardReasoner-VL-3B and SafeGuard-VL-RL-7B raise Shift scores above 54.

Policy randomization during supervised fine-tuning (RP-SFT) consistently improves the average F1 score over standard SFT, with the benefit being substantially larger for the 7B model than for the 3B model. However, randomization alone does not guarantee better policy-adaptive behavior; for the 7B model, the shift PSS metric declines sharply, indicating that breaking reliance on fixed policy order is not enough to ensure robust adaptation to held-out policies. RP-SFT raises the overall average F1 by 1.2 points for the 3B model and by 7.2 points for the 7B model. For the 7B model, randomization causes a 9.7-point drop in shift PSS, revealing weaker adaptation to unseen policies.

Removing the pair loss causes average F1 to fall well below stage-1 baselines, while adding it substantially raises both average F1 and average policy-specific sensitivity (PSS) for both model sizes. The gains are larger for the 7B model, confirming that explicitly learning to separate matched pass/block decisions across policies is critical for effective policy-adaptive guardrailing. Without pair loss, stage-2 average F1 drops to 56.1 (3B) and 59.2 (7B); adding the loss improves average F1 by 10.6 points for 3B and 17.7 points for 7B. Average PSS improves from 45.2 to 70.4 for the 7B model when pair loss is used, showing that boundary-pair training dramatically improves sensitivity to policy shifts in larger models.

The introduced benchmark reveals that policy-adaptive visual guardrailing is a distinct capability from recognizing unsafe content, as general multimodal models achieve nontrivial safety scores yet near-zero sensitivity to policy changes, a gap that does not close with larger scale. PolicyShiftGuard substantially bridges this gap through policy-conditioned training, with its 7B variant achieving the strongest policy-adaptive performance across multiple safety benchmarks while also reducing inference latency. Ablations confirm that pairing images with contrasting policy decisions during fine-tuning is critical for learning to correctly flip outputs, while policy randomization alone can even harm adaptation to new policies.