PolicyShiftGuard：政策自適應圖像護欄的基準評測與改進

摘要

圖像安全防護（image guardrails）通常在固定的安全策略下進行訓練與評測，隱含地將安全性視為圖像的內在屬性。然而實際部署情況截然不同：同一張圖像可能在某個產品中被允許，在另一個產品中卻被限制，而當策略邊界改變時，甚至可能被新規則禁止。我們研究策略適應性圖像安全防護（policy-adaptive image guardrailing），要求模型判斷圖像是否違反當前提供的策略，並推廣至未被見過的策略定義。我們提出 PolicyShiftBench，一個綜合基準，包含 265 張圖像上的 2,000 個策略判別性實例，平均每張圖像配備 7.55 個策略條件提示，用以測試模型是否能適應當前生效的策略，而非依賴於圖像層級的安全性先驗。接著我們提出 PolicyShiftGuard，一個緊湊的策略條件護欄，採用兩階段訓練方法，結合隨機策略 SFT（RP-SFT）與邊界配對策略適應（BP-Adapt）。BP-Adapt 針對同一圖像與風險類別，使用標準標籤監督與成對比較損失（pairwise comparison loss）來訓練配對提示，藉此區分阻擋策略與通過策略。實驗顯示，現有視覺語言模型（VLM）與專用安全防護在策略變動下仍顯脆弱，而 PolicyShiftGuard 則顯著提升了策略敏感性表現。該 7B 模型在 PolicyShiftBench 上達到平均 F1 為 76.9、平均 PSS 為 72.1 的最新技術水準，且能良好遷移至 UnSafeBench 與 SafeEditBench，並透過簡潔的輸出格式改善了延遲與性能的權衡。消融實驗證實，配對的通過/阻擋邊界對是穩定策略適應的關鍵。

English

Image guardrails are typically trained and evaluated under a fixed safety policy, implicitly treating safety as an intrinsic property of an image. Real deployments are different: the same image may be allowed in one product, restricted in another, and newly disallowed when a policy boundary changes. We study policy-adaptive image guardrailing, where a model must decide whether an image violates the currently supplied policy and generalize to held-out policy definitions. We introduce PolicyShiftBench, a comprehensive benchmark with 2,000 policy-discriminative instances over 265 images, where each image is paired with 7.55 policy-conditioned prompts on average to test whether models adapt to the active policy rather than relying on image-level safety priors. We then propose PolicyShiftGuard, a compact policy-conditioned guardrail trained with a two-stage training recipe that combines Randomized Policy SFT (RP-SFT) with Boundary-Pair Policy Adaptation (BP-Adapt). BP-Adapt trains matched prompts for the same image and risk category using standard label supervision and a pairwise comparison loss that separates blocking policies from passing policies. Experiments show that existing VLMs and specialized guardrails remain brittle under policy shifts, while PolicyShiftGuard substantially improves policy-sensitive performance. The 7B model achieves SOTA performance of 76.9 Avg. F1 and 72.1 Avg. PSS on PolicyShiftBench, transfers well to UnSafeBench and SafeEditBench, and improves the latency-performance trade-off with a concise output format. Ablations confirm that matched pass/block boundary pairs are essential for stable policy adaptation.