PolicyShiftGuard：策略自适应图像防护机制的基准测试与改进

摘要

图像护栏通常在固定的安全策略下进行训练和评估，这隐含地将安全性视为图像的固有属性。然而实际部署场景中的情况有所不同：同一张图像可能在一个产品中被允许、在另一个产品中被限制，而当策略边界发生变化时，还可能被新禁止。我们研究策略自适应的图像护栏，要求模型能够判断图像是否违反当前提供的策略，并泛化至未见过的策略定义。我们提出PolicyShiftBench——一个包含265张图像、2000个策略判别实例的综合性基准测试集，每张图像平均配有7.55个策略条件化提示，用于测试模型是否根据当前生效的策略进行响应，而非依赖图像层面的安全先验知识。随后我们提出PolicyShiftGuard——一种紧凑的策略条件化护栏，采用两阶段训练方案：结合随机化策略监督微调（RP-SFT）与边界对策略自适应（BP-Adapt）。BP-Adapt针对同一图像和风险类别，通过标准标签监督和成对比较损失函数训练匹配提示，该损失函数将阻止策略与通过策略区分开来。实验表明，现有视觉语言模型和专用护栏在策略迁移下仍显脆弱，而PolicyShiftGuard显著提升了策略敏感性能。7B模型在PolicyShiftBench上达到76.9平均F1分数和72.1平均策略敏感分数（PSS）的当前最优性能，在UnSafeBench和SafeEditBench上表现出良好迁移性，并通过简洁输出格式优化了延迟-性能平衡。消融实验证实，匹配的通过/阻止边界对是实现稳定策略适应的关键要素。

English

Image guardrails are typically trained and evaluated under a fixed safety policy, implicitly treating safety as an intrinsic property of an image. Real deployments are different: the same image may be allowed in one product, restricted in another, and newly disallowed when a policy boundary changes. We study policy-adaptive image guardrailing, where a model must decide whether an image violates the currently supplied policy and generalize to held-out policy definitions. We introduce PolicyShiftBench, a comprehensive benchmark with 2,000 policy-discriminative instances over 265 images, where each image is paired with 7.55 policy-conditioned prompts on average to test whether models adapt to the active policy rather than relying on image-level safety priors. We then propose PolicyShiftGuard, a compact policy-conditioned guardrail trained with a two-stage training recipe that combines Randomized Policy SFT (RP-SFT) with Boundary-Pair Policy Adaptation (BP-Adapt). BP-Adapt trains matched prompts for the same image and risk category using standard label supervision and a pairwise comparison loss that separates blocking policies from passing policies. Experiments show that existing VLMs and specialized guardrails remain brittle under policy shifts, while PolicyShiftGuard substantially improves policy-sensitive performance. The 7B model achieves SOTA performance of 76.9 Avg. F1 and 72.1 Avg. PSS on PolicyShiftBench, transfers well to UnSafeBench and SafeEditBench, and improves the latency-performance trade-off with a concise output format. Ablations confirm that matched pass/block boundary pairs are essential for stable policy adaptation.