yueliu1999/guardreasoner-vl[NeurIPS 2025] An official source code for paper "GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning".
Yue Liu, Shengfang Zhai, Mingzhe Du
Yulin Chen, Tri Cao, Hongcheng Gao, Cheng Wang
Xinfeng Li, Kun Wang, Junfeng Fang, Jiaheng Zhang, Bryan Hooi
1National University of Singapore, 2Nanyang Technological University
To enhance the safety of VLMs, this paper introduces a novel reasoning-based VLM guard model dubbed GuardReasoner-VL. The core idea is to incentivize the guard model to deliberatively reason before making moderation decisions via online RL. First, we construct GuardReasoner-VLTrain, a reasoning corpus with 123K samples and 631K reasoning steps, spanning text, image, and text-image inputs. Then, based on it, we cold-start our model's reasoning ability via SFT. In addition, we further enhance reasoning regarding moderation through online RL. Concretely, to enhance diversity and difficulty of samples, we conduct rejection sampling followed by data augmentation via the proposed safety-aware data concatenation. Besides, we use a dynamic clipping parameter to encourage exploration in early stages and exploitation in later stages. To balance performance and token efficiency, we design a length-aware safety reward that integrates accuracy, format, and token cost. Extensive experiments demonstrate the superiority of our model. Remarkably, it surpasses the runner-up by 19.27% F1 score on average.
Figure 1: Overview of GuardReasoner-VL.
To evaluate GuardReasoner-VL, run the following code.
python ./evaluate.py
The results are stored in the result.csv file.
Performance of GuardReasoner-VL (GuardReasoner-VL-7B):
ToxicChat ,HarmBenchPrompt ,OpenAIModeration ,AegisSafetyTest ,SimpleSafetyTests ,WildGuardTest ,Average (Text) ,HarmImageTest ,SPA-VL-Eval ,Average (All)
76.51 ,98.30 ,70.98 ,90.13 ,98.99 ,88.35 ,79.88 ,70.84 ,85.60 ,79.07
HarmBenchResponse ,SafeRLHF ,BeaverTails ,XSTestReponseHarmful,WildGuardTest ,Average (Text) ,SPA-VL-Eval ,Average (All)
87.22 ,66.37 ,84.76 ,92.72 ,79.04 ,79.42 ,73.22 ,77.58
Performance of GuardReasoner-VL (GuardReasoner-VL-Eco-7B):
ToxicChat ,HarmBenchPrompt ,OpenAIModeration ,AegisSafetyTest ,SimpleSafetyTests ,WildGuardTest ,Average (Text) ,HarmImageTest ,SPA-VL-Eval ,Average (All)
76.26 ,98.73 ,70.82 ,90.34 ,99.50 ,88.54 ,79.82 ,64.84 ,85.26 ,77.49
HarmBenchResponse ,SafeRLHF ,BeaverTails ,XSTestReponseHarmful,WildGuardTest ,Average (Text) ,SPA-VL-Eval ,Average (All)
86.22 ,66.15 ,85.51 ,93.33 ,78.60 ,79.51 ,70.81 ,76.94
Performance of GuardReasoner-VL (GuardReasoner-VL-3B):
ToxicChat ,HarmBenchPrompt ,OpenAIModeration ,AegisSafetyTest ,SimpleSafetyTests ,WildGuardTest ,Average (Text) ,HarmImageTest ,SPA-VL-Eval ,Average (All)
74.45 ,89.10 ,70.83 ,88.79 ,99.50 ,88.92 ,78.77 ,70.93 ,86.47 ,78.73
HarmBenchResponse ,SafeRLHF ,BeaverTails ,XSTestReponseHarmful,WildGuardTest ,Average (Text) ,SPA-VL-Eval ,Average (All)
85.76 ,66.37 ,85.16 ,93.08 ,76.07 ,78.83 ,71.19 ,76.56
Performance of GuardReasoner-VL (GuardReasoner-VL-Eco-3B):
ToxicChat ,HarmBenchPrompt ,OpenAIModeration ,AegisSafetyTest ,SimpleSafetyTests ,WildGuardTest ,Average (Text) ,HarmImageTest ,SPA-VL-Eval ,Average (All)
73.47 ,88.58 ,70.87 ,89.04 ,99.50 ,89.16 ,78.43 ,66.79 ,85.82 ,77.39
HarmBenchResponse ,SafeRLHF ,BeaverTails ,XSTestReponseHarmful,WildGuardTest ,Average (Text) ,SPA-VL-Eval ,Average (All)
84.72 ,66.96 ,85.39 ,93.59 ,77.39 ,79.31 ,72.01 ,77.14
Figure 2: Mean Performance of GuardReasoner-VL on Multi-modal Guardrail Benchmarks.
Table 1: Performance of Prompt Harmfulness Detection Task.
Table 2: Performance of Response Harmfulness Detection Task.
To reproduce the generation process of GuardReasoner-VL, run the following code.
bash test.sh
To use GuardReasoner-VL, run the following code.
CUDA_VISIBLE_DEVICES=0 python deploy.py
To reproduce the training process of GuardReasoner, see training pipeline.
Our method are partly based on the following resources. Thanks for their awesome works.
If you find this repository helpful, please cite our paper.
@article{GuardReasoner,
title={GuardReasoner: Towards Reasoning-based LLM Safeguards},
author={Liu, Yue and Gao, Hongcheng and Zhai, Shengfang and Jun, Xia and Wu, Tianyi and Xue, Zhiwei and Chen, Yulin and Kawaguchi, Kenji and Zhang, Jiaheng and Hooi, Bryan},
journal={arXiv preprint arXiv:2501.18492},
year={2025}
}
@article{GuardReasoner-VL,
title={GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning},
author={Liu, Yue and Zhai, Shengfang and Du, Mingzhe and Chen, Yulin and Cao, Tri and Gao, Hongcheng and Wang, Cheng and Li, Xinfeng and Wang, Kun and Fang, Junfeng and Zhang, Jiaheng and Hooi, Bryan},
journal={arXiv preprint arXiv:2505.11049},
year={2025}
}