Introduction
Image guardrails are typically trained and evaluated under a fixed safety policy, implicitly treating safety as an intrinsic property of an image. However, in real deployments, the same image may be allowed in one product, restricted in another, and newly disallowed when a policy boundary changes.
Research Objective
We study policy-adaptive image guardrailing, where a model must decide whether an image violates the currently supplied policy and generalize to held-out policy definitions.
PolicyShiftBench
We introduce PolicyShiftBench, a comprehensive benchmark with 2,000 policy-discriminative instances over 265 images, where each image is paired with an average of 7.55 policy-conditioned prompts to test whether models adapt to the active policy rather than relying on image-level safety priors.
PolicyShiftGuard
We propose PolicyShiftGuard, a compact policy-conditioned guardrail trained with a two-stage training recipe that combines Randomized Policy SFT (RP-SFT) with Boundary-Pair Policy Adaptation (BP-Adapt). BP-Adapt trains matched prompts for the same image and risk category using standard label supervision and a pairwise comparison loss that separates blocking policies from passing policies.
Experimental Results
Experiments show that existing VLMs and specialized guardrails remain brittle under policy shifts, while PolicyShiftGuard substantially improves policy-sensitive performance. The 7B model achieves SOTA performance of 76.9 Avg. F1 and 72.1 Avg. PSS on PolicyShiftBench, transfers well to UnSafeBench and SafeEditBench, and improves the latency-performance trade-off with a concise output format. Ablations confirm that matched pass/block boundary pairs are essential for stable policy adaptation.
Blogger's Review: The introduction of PolicyShiftGuard offers a fresh perspective in the image guardrail domain, particularly in dynamic policy environments. This approach not only enhances model adaptability but also provides crucial benchmarks and insights for future research, showcasing significant practical application potential across multiple benchmarks.