PSG PolicyShiftGuard

Policy-adaptive image guardrails

Benchmarking and Improving Policy-Adaptive Image Guardrails

PolicyShiftGuard studies whether multimodal guardrails can follow the active runtime policy, rather than applying a fixed safe/unsafe taxonomy to every image.

Mingyang Song*, Luxin Xu*, Haoyu Sun, Minzhou Pan, Yu Cheng†, Bo Li†

* Equal contribution · † Corresponding authors

Paper Models Dataset Code
Overview of benchmark construction and training pipeline
2,000 evaluation instances
265 unique images
28 evaluation policies
7 x 5 risk categories x scenarios

PolicyShiftBench

A benchmark where the same image can flip labels under different policies.

PolicyShiftBench separates image perception from policy judgment. Fine-grained visual attributes are voted by multiple annotators, then deterministic policy rules produce category-level and image-level labels.

  • Seven risk categories spanning nudity, violence, regulated goods, IP, culture, privacy, and text safety.
  • Scenario-grounded policy variants from mainstream social platforms to specialized domains.
  • Same-image policy flips for measuring true policy sensitivity.
PolicyShiftBench data statistics and scenario by risk category policy matrix
Data statistics and the Scenario × Risk Category policy matrix of PolicyShiftBench. Each policy combines a risk category with a realistic moderation scenario (Adaptive / Shift / Augmentation).

PolicyShiftGuard

Two-stage training for policy-conditioned decisions.

The model is trained to read policy text, bind it to visual evidence, and output a concise structured decision.

Stage 1

Randomized Policy SFT

Randomizes policy identifiers and ordering during supervised fine-tuning so the model follows policy semantics instead of memorizing fixed slots.

Stage 2

Boundary-Pair Policy Adaptation

Trains paired prompts for the same image and target risk category, where one policy permits the image and another policy blocks it.

Output

Structured Guardrail Decision

Uses short final answers such as true | 02 or false, enabling fast evaluation and reliable category attribution.

PolicyShiftGuard method overview

Main findings

Policy sensitivity improves while keeping the guardrail compact.

PolicyShiftGuard-7B 76.9

Avg. F1 on PolicyShiftBench

PolicyShiftGuard-7B 72.1

Avg. Policy Shift Score

Qwen2.5-VL-7B baseline 20.6 -> 76.9

Avg. F1 after policy-adaptive training

Average F1 versus inference speed
Average F1 versus inference speed: the performance–latency tradeoff.
Risk category heatmap of accuracy and F1
Category-wise accuracy and F1 reveal uneven policy difficulty.
Loss-weight ablation: Average F1 and Average PSS versus the three Boundary-Pair-SFT loss weights
Ablation over the three Boundary-Pair-SFT loss weights (λw, λp, λl), on Qwen2.5-VL-7B. Each panel sweeps one weight while reporting Average F1 (red, left axis) and Average Policy Shift Score (blue, right axis). Both curves stay nearly flat, showing PolicyShiftGuard is robust to these weights and needs no careful per-weight tuning.

Qualitative policy flips

One image, different active policies, different correct decisions.

These cases show why image-level safety recognition alone is not enough: the model must follow the policy boundary currently in force.

Open resources

Models and data on Hugging Face.

All checkpoints and datasets are released under the PolicyShiftGuard organization.

Model

PolicyShiftGuard-7B

Full policy-adaptive guardrail, 7B.

 Model

PolicyShiftGuard-3B

Compact policy-adaptive guardrail, 3B.

 Model

PolicyShiftGuard-7B-RP-SFT

Stage-1 Randomized Policy SFT checkpoint, 7B.

 Model

PolicyShiftGuard-3B-RP-SFT

Stage-1 Randomized Policy SFT checkpoint, 3B.

 Dataset

PolicyShiftBench

Evaluation benchmark with same-image policy flips.

 Dataset

adaptive-policy-v2.8-withreason

Policy-adaptive training data with reasoning.

Citation

Cite PolicyShiftGuard

Our paper is available on arXiv:2607.05910.

@article{song2026policyshiftguard,
  title   = {PolicyShiftGuard: Benchmarking and Improving Policy-Adaptive Image Guardrails},
  author  = {Song, Mingyang and Xu, Luxin and Sun, Haoyu and Pan, Minzhou and Cheng, Yu and Li, Bo},
  journal = {arXiv preprint arXiv:2607.05910},
  year    = {2026}
}