PolicyShiftGuard: Benchmarking and Improving Policy-Adaptive Image Guardrails

Mingyang Song, Luxin Xu, Haoyu Sun, Minzhou Pan, Yu Cheng, Bo Li

PolicyShiftGuard enables image guardrails to adapt to changing safety policies by binding visual evidence to explicit policy rules.

How can we train image guardrails to adapt their safety decisions to different, shifting policies rather than treating safety as a static property of an image?

Image guardrails typically treat safety as an intrinsic property of an image, causing them to fail when the same content is permitted in one context but restricted in another. The authors introduce PolicyShiftGuard, a framework that trains models to bind visual attributes to active policy rules rather than relying on fixed safety priors. It uses a two-stage recipe: Randomized Policy SFT to teach the interface, and Boundary-Pair Policy Adaptation to force the model to flip decisions when policies change. On the new POLICYSHIFTBENCH benchmark, the 7B model achieves state-of-the-art performance, reaching 76.9 Avg. F1 and 72.1 Avg. PSS while significantly reducing inference latency.

Paper Primer

The core challenge is that existing guardrails are brittle under policy shift: they often detect a risky cue but fail to revise their decision when the governing policy changes. The authors address this by separating visual perception from policy judgment, using an auditable pipeline where labels are derived from executable rules applied to stable image attributes.

PolicyShiftGuard uses a two-stage training recipe: Randomized Policy SFT (RP-SFT) teaches the model to follow arbitrary policy bundles, while Boundary-Pair Policy Adaptation (BP-Adapt) uses matched pass/block pairs to explicitly optimize the decision margin for the same image under different policies.

PolicyShiftGuard significantly improves policy-sensitive performance over base models.

The 7B model improves Avg. F1 from 20.6 to 76.9 and Avg. PSS from 4.8 to 72.1 compared to the Qwen2.5-VL-7B backbone. Substantial gain in policy-shift sensitivity (PSS) while reducing inference latency by over 100ms.

Scaling model size alone does not resolve policy adaptation.

Larger general-purpose MLLMs (e.g., 72B parameters) achieve higher F1 scores but remain significantly lower in PSS than the specialized 7B PolicyShiftGuard. The 72B model reaches only 27.4 Avg. PSS, compared to 72.1 for the 7B PolicyShiftGuard.

Why is the Policy Shift Score (PSS) necessary for evaluating these models?

Ordinary accuracy metrics fail to distinguish between generic unsafe recognition and true policy following. PSS specifically measures whether a model correctly flips its decision when the image evidence is fixed but the active policy changes.

What is the primary limitation of the current benchmark and method?

The benchmark is currently limited to static images and structured English policy rules; it does not yet support video, multi-turn dialogue, or multilingual policy documents.

This paper shifts the guardrail paradigm from "is this image inherently unsafe?" to "does this image violate the specific policy currently in effect?", providing a path to auditable, policy-adaptive moderation.

Researchers and practitioners should evaluate guardrails using policy-shift metrics rather than fixed-taxonomy benchmarks to ensure models are actually following instructions rather than just recognizing visual cues.

The Problem of Static Guardrails

We expose why image safety must follow the active policy, not the image itself.

Most image guardrails are built and evaluated assuming a single, immutable safety policy. In practice, the same picture may be permissible in one product, blocked in another, or become disallowed when a policy boundary is revised.

Guardrailing that decides “allowed vs. blocked” based on the policy supplied at inference time, not on a static notion of image safety.

To evaluate this capability we introduce POLICYSHIFTBENCH, a benchmark that pairs each of 265 images with an average of 7.55 policy‑conditioned prompts, yielding 2,000 instances that explicitly test policy‑sensitive behavior.

**Table 1.** Benchmark comparison for policy-adaptive image guardrailing. ✓ indicates that the feature is explicitly supported, while ✗ indicates that it is absent. “flip” denotes LLaVA-Guard’s partial same-image policy/prompt variants. Compositional Policy denotes whether scenario-grounded category policies can be flexibly assembled into a runtime policy bundle.

Our solution, PolicyShiftGuard, follows a two‑stage training recipe. First, Randomized Policy SFT (RP‑SFT) teaches the model to follow arbitrary policy bundles. Second, Boundary‑Pair Policy Adaptation (BP‑Adapt) refines decision boundaries by presenting matched pass/block prompts for the same image and applying a pairwise loss that pushes blocking policies apart from passing ones.

Safety is not an intrinsic property of an image but a function of the active policy.

PolicyShiftBench: Measuring Adaptive Guardrailing

Describes the PolicyShiftBench benchmark and its core components.

The previous section exposed the rigidity of static guardrails. To assess models that must obey shifting safety policies, we need a benchmark that explicitly measures policy‑sensitive behavior. PolicyShiftBench fulfills this role.

PolicyShiftBench evaluates whether a model can correctly follow a set of active safety policies that may change at deployment time.

A policy‑discriminative example keeps the image and target risk category fixed but changes the active policy so that the correct decision flips.

**Figure 1.** Structure of POLICYSHIFTBENCH. (a) Dataset statistics organized by risk category and scenarios, highlighting the distribution of different policies across the benchmark. (b) Scenario–category policy matrix. Each policy is defined by combining a risk category with a realistic moderation scenario. Augmentation policies are used for Boundary-Policy Adaptation.

The PolicyShiftGuard Training Recipe

We train guardrails in two stages: first learn policy‑conditioned prompting, then sharpen decision boundaries across policy shifts.

The guardrail model must both understand a policy bundle and react instantly when the active bundle changes, a capability missing from static‑policy training.

RP‑SFT teaches the model a generic “read‑the‑policy‑bundle‑and‑answer” skill by exposing it to many shuffled policy presentations, so it cannot rely on fixed token positions or templates.

Compute $a_{\text{weapon}}(x)=1$ (weapon detected).

Apply $f_{\text{weapon},p_{\text{block}}}=1$, so the deterministic target $y$ is “true | weapon”.

Randomize: $\rho(y)$ becomes “true | c\_2” because the category identifier is renamed.

Feed $(x,\rho(B))$ to the model; the loss penalizes any deviation from “true | c\_2”.

Randomizing both order and identifiers forces the model to rely on the underlying rule evaluation, not on memorized token positions.

How does RP‑SFT differ from ordinary supervised fine‑tuning on a single fixed policy?

Standard SFT sees one static policy string, so the model can cheat by learning position‑specific cues. RP‑SFT shuffles the policy representation on every example, so the model must truly understand the rule semantics to succeed.

BP‑Adapt presents the model with paired examples that share the same image but have opposite policy outcomes, then pushes the unsafe score higher for the blocking pair, much like a referee who flips a call when the rulebook changes while the play stays identical.

Compute $a_{\text{nudity}}(x)=1$.

Under $B^{+}$ the deterministic target is “true | nudity”.

Under $B^{-}$ the deterministic target is “false”.

Feed both $(x,B^{+})$ and $(x,B^{-})$ to the model; obtain unsafe scores $s_\theta(\text{true}\mid q^{+})$ and $s_\theta(\text{true}\mid q^{-})$.

Apply $\mathcal{L}_{\text{pair}}$: if $s_\theta(\text{true}\mid q^{+})$ is not at least $m=1.0$ higher than $s_\theta(\text{true}\mid q^{-})$, back‑propagate to increase the gap.

The margin loss forces the model to treat the policy rule as the decisive factor, not the visual cue alone.

Why not simply fine‑tune a separate model for each policy instead of using BP‑Adapt?

Separate models would multiply memory and inference cost, and they would not share the visual encoder’s knowledge. BP‑Adapt keeps a single model while explicitly teaching it to flip decisions when the policy changes, preserving efficiency.

Stage 1: Randomized Policy SFT (RP‑SFT) – train on policy‑conditioned SFT data with randomization $\rho$ to learn the generic “read‑policy‑bundle‑and‑answer” skill.

Stage 2: Boundary‑Pair Policy Adaptation (BP‑Adapt) – construct paired pass/block examples for the same image, then fine‑tune the RP‑SFT checkpoint with the composite loss $\mathcal{L}_{\text{BP}}$ that includes the pair margin.

During inference, feed the current active policy bundle $B$ together with the image; the model outputs a structured guardrail decision that automatically respects the bundle.

Training loop for the two‑stage pipeline.

**Figure 2.** Overview of the PolicyShiftGuard pipeline. (a) Data recipe: images are annotated by three VLMs at the attribute level, merged by majority vote, and labeled by deterministic policy rules under the active policy bundle. This separates visual perception from policy judgment and creates same-image, different-policy label flips. (b) Training recipe: Stage 1 uses randomized-policy SFT to teach the concise guardrail interface, while Stage 2 performs boundary-pair policy adaptation on matched pass/block policy pairs for the same image and risk category.

Table 2 (presented later) reports the final performance of the full PolicyShiftGuard pipeline on the PolicyShiftBench benchmark, confirming that the two‑stage method achieves the highest adaptive and shift accuracies among all baselines.

Experimental Results and Analysis

PolicyShiftGuard delivers large accuracy gains and faster inference on adaptive safety benchmarks.

Recall that static guardrails cannot keep up with evolving policy demands; this section shows how Policy‑Adaptive Guardrailing meets that challenge.

We evaluate a wide spectrum of models: general‑purpose MLLMs (Qwen 3.5, Qwen 2.5‑VL), specialized guardrails (LlamaGuard‑4‑12B, GuardReasoner‑VL, SafeGuard‑VL‑RL‑7B, QwenGuard‑7B, ShieldGemma2‑4B), and three closed‑source systems (Claude‑Sonnet‑4.6, GPT‑5.4, Gemini‑3‑Flash‑Preview). Our own PolicyShiftGuard‑3B and‑7B are fine‑tuned from Qwen 2.5‑VL backbones.

All experiments run on PolicyShiftBench, which splits into Adaptive (in‑distribution policies) and Shift (out‑of‑distribution policies). We also report results on UnSafeBench and SafeEditBench to test cross‑benchmark generalisation.

Metrics include Accuracy, F1, and the Policy‑Flip Consistency Score (PSS), which measures whether a model answers both sides of a same‑image policy flip correctly; lower latency (ms) is also reported because guardrails sit on the content‑generation path.

PolicyShiftGuard‑7B attains the highest average F1 (76.9) and PSS (72.1) on PolicyShiftBench, outpacing its base Qwen 2.5‑VL‑7B by +56.3 F1 points.

Table 2 shows the 7B model improving Avg. F1 from 20.6 to 76.9 and Avg. PSS from 4.8 to 72.1.

**Table 2.** Main results on PolicyShiftBench. We report the mean over three repeated evaluations of the same checkpoint. Appendix E.2 reports one-standard-deviation (1$\sigma$) error bars for evaluation-time variability. For performance metrics, the best result in each column is bolded, and the second-best result is underlined. Time is reported for reference and is not ranked.

**Figure 3.** Cost-performance trade-off. We plot the main table Avg. F1 against decision speed, computed as 1000/Time(ms). Moving upward means stronger average performance, while moving right means faster inference.

**Table 3.** Performance across safety benchmarks. We report F1 on UnSafeBench and the Adaptive/Shift splits of POLICYSHIFTBENCH, macro-F1 on SafeEditBench, and the average over the four scores as Overall. The best result in each column is bolded, and the second-best result is underlined.

PolicyShiftGuard models outperform general‑purpose MLLMs on policy‑adaptive tasks while delivering markedly lower latency.

Insights from PolicyShiftBench

Ablation results reveal which components drive policy‑adaptive guardrailing and their trade‑offs.

We first report four high‑level findings on PolicyShiftBench before diving into component‑wise ablations.

GuardReasoner‑VL‑3B reaches 59.2 Avg F1 but only 3.2 Avg PSS, and SafeGuard‑VL‑RL‑7B scores 51.0 Avg F1 with 4.0 Avg PSS.

Both models detect risky content yet fail to revise decisions under alternate policies, exposing the gap that Avg PSS measures.

Qwen2.5‑VL scales from 20.6 Avg F1 (7B) to 49.4 Avg F1 (72B) but its Avg PSS plateaus at 27.4.

Even the largest 72B model cannot close the policy‑adaptation gap, showing that size alone is insufficient.

Difficulty is category‑dependent: visually salient risks (nudity, violence) are easier, whereas regulated goods, IP, privacy, and text‑in‑image require finer attribute extraction.

Speed‑performance Pareto matters: reasoning‑style guardrails increase latency without proportional gains in policy‑shift sensitivity, while concise boundary‑pair supervision offers a better trade‑off for deployment.

Our ablation study isolates the contributions of RP‑SFT, no‑think training, the boundary‑pair loss Lₚₐᵢᵣ, and loss‑weight tuning.

RP‑SFT raises Avg F1 by +1.2 pts for the 3B model.

Table 4 shows a consistent improvement over standard SFT in stage‑1.

RP‑SFT raises Avg F1 by +7.2 pts for the 7B model.

Table 4 reports the larger gain at the higher scale.

RP‑SFT reduces Shift PSS by ‑9.7 pts for the 7B model.

Randomized policy presentation harms stable adaptation to held‑out policies.

No‑think training improves Avg F1 by +4.3 pts for the 3B model (stage 1).

Compared to thinking‑mode SFT, the concise setting yields higher accuracy.

No‑think training improves Avg F1 by +8.9 pts for the 7B model (stage 1).

Same trend amplified at larger scale.

No‑think training further lifts Shift PSS by +5.6 pts for the 3B model (stage 2).

Stage‑2 RL on the concise variant outperforms thinking‑mode RL.

No‑think training further lifts Shift PSS by +12.3 pts for the 7B model (stage 2).

Largest gain observed at 7B.

Removing the boundary‑pair loss dramatically drops both Avg F1 and Avg PSS, confirming that the improvement stems from explicit paired supervision rather than extra post‑training data.

Varying loss weights ($\lambda_{w}$, $\lambda_{p}$, $\lambda_{l}$) only mildly perturbs Avg F1 (76–77) and Avg PSS (71–73), indicating the method is robust to hyper‑parameter choice.

**Table 4.** Ablation study of policy randomization.

**Figure 5.** Ablation over loss weights. We study the robustness of Boundary-Pair-SFT by varying three loss weights, $\lambda_w$, $\lambda_p$, and $\lambda_l$. This ablation study is conducted on Qwen2.5-VL-7B.

Limitations and Scope

We discuss the scope limits of our work and detail the construction of PolicyShiftBench.

Our study is limited to static images paired with explicit policy text; we do not address video, audio, multi‑turn conversations, or dynamic web‑page contexts. The policies we use are English‑only structured moderation rules, which excludes multilingual, legal‑document, or long user‑defined policies.

PolicyShiftBench is built by first defining atomic attributes for each risk category, then having annotators vote on these attributes per image, and finally applying category‑policy rules to the voted attribute vectors. The category‑level decision is $z_{c,p}(x) = f_{c,p}(A_c(x)) \in \{0,1\}$, where 1 indicates a block.

Next, runtime policy bundles are composed by selecting one policy per category and taking the logical OR across categories, yielding the image‑level label $y(x,B) = 1\{\exists c \in C : f_{c,p_c}(A_c(x)) = 1\}$. We then sample policy‑discriminative examples that flip labels when only the active policy changes, and construct training‑only boundary pairs for BP‑Adapt.

**Table 7.** Detailed split-level statistics for POLICYSHIFTBENCH and training data. PD denotes policy-discriminative examples, TS denotes truly safe anchors, and TU denotes truly unsafe anchors. BP-Adapt uses training-only augmentation policies and is not part of the held-out Shift evaluation. Training images are disjoint from evaluation images; the Adaptive and Shift evaluation tracks share 17 images.

**Table 8.** Category-wise instance counts. The two evaluation tracks are balanced at the label level but category frequencies remain naturally uneven because different categories admit different amounts of policy-discriminative data.

References

We cite recent studies on multimodal guardrails and content moderation.

Yang, Tran, Christodoulopoulos, Ruan, Gupta, and Chang (2025) propose precedent‑based predictions for customizing multimodal RAI guardrails.

Zeng, Liu, Mullins, Peran, Fernandez, Harkous, Narasimhan, Proud, Kumar, Radharapu, Sturman, and Wahltinez (2024) introduce Shieldgemma, a generative‑AI content moderation system built on Gemma.

Zhan, Goyal, Chen, Chandrasekharan, and Saha (2024) present SLM‑mod, showing that small language models can outperform larger LLMs in content moderation tasks.

Benchmark Construction Details

Appendix A‑C detail dataset construction, category breakdowns, and limitations of the benchmark.

Appendix A provides supplemental material that supports the main text, including additional experimental settings and extended discussions.

Appendix B describes how the PolicyShiftBench benchmark was built, covering the construction pipeline, data splits, category and policy coverage, and attribute‑vote statistics.

Appendix C enumerates the eight safety categories with definitions, ranging from nudity to text‑in‑image concerns, to clarify the scope of the policy‑discriminative examples.

The Limitations section acknowledges constraints of the benchmark, such as coverage gaps and potential biases in the policy catalog.

Metadata and Prompt Templates

Appendix D details the metadata schema and prompt templates used for benchmark construction.

Metadata annotation specifies the fields attached to each benchmark example, such as the policy bundle identifier and guardrail label, to make the data self‑describing.

The metadata prompt defines the natural‑language query used to elicit these annotation fields from annotators or language models.

The benchmark prompt shows how the annotated metadata is incorporated into the evaluation task, guiding the model to produce policy‑aware responses.

Output format describes the JSON schema that records model predictions, confidence scores, and any auxiliary signals required for downstream analysis.

Reason-generation prompt provides the template that asks the model to justify its decision, enabling inspection of the internal reasoning behind policy‑adaptive behavior.

D.1 lists the concrete example of a metadata annotation entry for a single test case.

D.2 presents the exact wording of the metadata prompt used in the data collection pipeline.

D.3 contains the full benchmark prompt that combines the task description with the annotated metadata.

D.4 shows a sample output JSON adhering to the prescribed format.

D.5 illustrates a reason‑generation prompt and a corresponding model explanation.

Section E discusses additional implementation details for integrating the prompts into the evaluation framework.

Section F provides a brief note on reproducibility considerations and versioning of the prompt templates.

Section G lists acknowledgments of external resources used to construct the metadata and prompt assets.

Evaluation Metrics and Implementation

Supplementary details on evaluation, implementation, and responsible release.

The appendix begins by enumerating the evaluation metrics used throughout the study, including the newly introduced Policy Shift Score that quantifies how well a model adapts to changing guardrail policies.

Section E.1 reports the main experimental outcomes when the entire training pipeline is rerun with different random seeds, demonstrating that performance variations remain within a narrow band.

Section E.2 breaks down accuracy per policy category, revealing that some bundles (e.g., content‑filtering) benefit more from the two‑stage recipe than others (e.g., style‑adjustment).

Section E.3 provides additional result tables that complement the main paper, such as ablations on the number of policy‑discriminative examples.

The implementation details in the “Additional Implementation Details” subsection clarify hyper‑parameter choices, hardware settings, and software libraries required to reproduce the experiments.

The “Think PRM‑RL diagnostic” (F.1) describes a reinforcement‑learning‑style probe that measures how quickly a model’s policy predictions converge after a policy shift.

Quality control is split between an automatic pipeline (G.1) that flags out‑of‑distribution outputs and a human auditing protocol (G.2) that reviews flagged instances using a standardized prompt (G.3).

Auditors employ a label‑quality audit prompt (G.4) to assess consistency, followed by an interpretation step (G.5) that records rationales for each decision, and finally a set of audit‑detail metrics (G.6) such as agreement rate and false‑positive frequency.

Qualitative results showcase representative model outputs before and after policy adaptation, illustrating concrete improvements in safety‑critical scenarios.

Compute‑resource accounting lists GPU hours, memory footprints, and wall‑clock time for each training stage, enabling practitioners to estimate deployment costs.

The ethics and responsible‑release subsection (J.1‑J.3) outlines the authors’ risk‑assessment framework, the conditions under which the model may be released, and mitigation strategies for misuse.

Finally, the data‑and‑code availability note confirms that all datasets are described using Croissant and RAI metadata standards and that a full disclosure of LLM usage is provided.

Training Augmentation Details

Appendix I details the benchmark’s policy coverage and voting statistics.

Appendix I reports the policy composition of the benchmark and the aggregation of attribute‑level votes used to construct the evaluation splits.

Fourteen training‑only augmentation policies, two per risk category, are added solely for the BP‑Adapt stage and never appear in the Adaptive or Shift test splits.

**Table 9.** Policy coverage summary. The benchmark is factorized into seven risk categories, each defined by atomic attributes and deterministic policy rules. Augmentation policies are used only for BP-Adapt training.

**Table 10.** Attribute-level vote statistics. Counts are computed over the canonical three-model common metadata with 8,973 image records. The rates are attribute-decision rates, not image-level rates.

The catalog defines each category by triggers (evidence) and exemptions (context); the executable rule $f_{c,p}$ evaluates the attribute vector $A_c$(x) to produce a binary category flag.

An auxiliary set of augmentation policies (tag AUG.) expands every category with textual rephrasings, yielding 1,908 boundary groups (3,816 training rows) that are balanced between block and pass labels for BP‑Adapt.

Category 01 (Nudity & Sexual Content) lists triggers such as `Has_Exposed_Genitalia_Or_Nipples` and exemptions like `Is_Medical_Educational`; the policy logic combines these to decide whether the image is blocked or allowed.

Policy Catalog: General Standards

Appendix lists the policy placeholders, category rules, and trigger definitions used in the benchmark.

Policy A (General Safe / Social Media Standard) is an adaptive policy for a broad social‑media context; its principle is “Public Decency & Absolute Minor Protection”.

It blocks any sexualization of minors, sex toys and BDSM gear, sexually suggestive actions, visually disturbing tissue, and exposed genitalia or female nipples unless the content is artistic, cultural, or medical.

Allowed content includes classical‑art nudity, cultural or sport‑related nudity, bikini/swimwear, deep kissing, medical/educational material, and male bare chest; the executable rule combines these conditions into a single IF‑BLOCK expression.

Policy B (Strict Puritan / Family Safe) targets an extremely conservative family audience; its principle is “Zero Tolerance”.

It blocks any sexualization of minors, sex toys, exposed genitalia or nipples (no exemptions), bikini/swimwear, sexually suggestive actions, deep kissing, visually disturbing tissue, and cultural or sport‑related nudity.

Only content that triggers none of the blocked conditions is allowed; the rule is a straightforward OR of all prohibited predicates.

Policy C (Medical & Educational / Scientific Reference) serves medical‑research contexts; its principle is “Scientific Relevance”.

It blocks sexualization of minors (unless in medical/educational context), sex toys, sexually suggestive actions, deep kissing, and exposed genitalia or nipples outside medical/educational settings.

Allowed material includes medical/educational nudity, bikini/swimwear, cultural or sport nudity, and disturbing tissue when presented scientifically; the executable rule adds a NOT `Is_Medical_Educational` guard where needed.

Read the original paper

Open the simplified reader on Paperglide

Browse all simplified papers