Yuvion VL: A Multimodal Foundation Model for Adversarial Content and AI Safety

Abstract: General-purpose models often struggle to reliably identify and understand real-world multimodal risks, largely due to the inherent multimodal adversarial nature of content and AI safety. We present Yuvion VL, a family of multimodal LLMs purpose-built for content and AI safety, with both instruction-tuned and reasoning-oriented variants. Yuvion VL addresses this gap by treating safety as an inherently adversarial and multimodal problem and designing the entire pipeline around adversarial robustness. For data construction, we develop an automated pipeline integrating adversarial-aware data synthesis with multi-stage quality control, producing large-scale, high-quality multimodal samples augmented with domain knowledge and reasoning annotations. For training, we adopt a three-stage pipeline that includes continued pretraining for risk-concept cross-modal alignment, instruct post-training for production-grade safety tasks, and reasoning post-training for enhanced interpretability and performance in complex tasks. We further introduce Confuse-then-Contrast Fine-Tuning, a contrastive framework that mines model-specific confusions and constructs multi-image contrastive groups to enforce explicit discrimination of fine-grained visual-semantic elements, enabling the model to distinguish between visually similar cases with different safety implications in adversarial safety tasks. To support rigorous evaluation, we further introduce Yuvion VL RiskEval (YVRE), a collection of benchmarks covering diverse open and internal evaluations, with a focus on content and AI safety, adversarial robustness, and real-world capability requirements. Experiments show that Yuvion VL-32B achieves industry-leading safety performance, surpassing comparably sized open-source models and best closed-source commercial models, while maintaining comparable general capabilities.

• The paper presents a multimodal model engineered for adversarial content and AI safety, achieving state-of-the-art performance on safety benchmarks.
• It employs a three-stage training pipeline, integrating knowledge-enhanced pretraining, instruct post-training with Confuse-then-Contrast Fine-Tuning, and reinforcement learning.
• Results show significant safety gains, with smaller models outperforming larger commercial models by up to 40 percentage points in critical tasks.

Yuvion VL: A Multimodal Foundation Model for Adversarial Content and AI Safety

Motivation and Problem Framing

Yuvion VL is introduced as a dedicated family of multimodal LLMs (MLLMs) targeting adversarial content and AI safety, areas where general-purpose models have shown systemic deficiencies. Unlike canonical vision-LLMs (VLMs), Yuvion VL is developed end-to-end with adversarial robustness as a foundational design goal, reflecting the dynamic arms race of real-world moderation where adversaries continually engineer novel evasion techniques involving multimodal and semantic-level perturbations. Existing MLLMs—optimized primarily for semantic understanding and generic instruction following—lack the domain expertise, fine-grained visual discrimination, and adversarial resilience required for content safety, especially in high-stakes, regulation-governed domains.

Safety-Oriented Data System and Pipeline

Yuvion VL’s data system is stratified for maximal capability yield, incorporating both extensive general-purpose corpora and diverse safety-specific datasets. The data architecture comprises six primary categories: general multimodal data for modality competence retention; domain knowledge data (covering fine-grained perception such as symbol, flag, and adversarial OCR recognition); real-world safety business data (richly annotated for hierarchical policy compliance); adversarial data (curated to model semantic-level evasion strategies such as watermarking, stylized logo mutations, AI-generated forgeries, and contextual disguise); safety-focused text corpora; and reasoning-annotated data, constructed through an automated, multi-stage chain-of-thought (CoT) pipeline governed by strict posterior constraints to ensure logical fidelity and data quality.

Figure 1: Overview of the Visual Chain-of-Thought (CoT) data production and quality-inspection pipeline for risk-domain data in Yuvion VL.

Initial general-domain corpora are processed through rigorous filtering, deduplication, and CoT normalization, while the adversarial subset is continuously expanded via a data flywheel mechanism that mines failure cases from both off-line evaluations and production deployments, ensuring agility against new evasion tactics.

Model Architecture and Staged Training Paradigm

Yuvion VL is based on the Qwen3-VL architectural backbone, combining a Vision Transformer encoder, MLP connector, and transformer-based LLM backbone. Two dense variants—8B and 32B—are available, each open-sourced and each further subdivided into instruct and reasoning configurations.

The training pipeline unfolds in three sequential stages:

1. Knowledge-Enhanced Continued Pretraining: On risk-concept cross-modal datasets, updating only the connector and LLM to align visual risk cues (e.g., sensitive faces, policy-signaling symbols) with semantic meaning, preserving generic visual features in the frozen visual encoder.
2. Instruct Post-Training: Full-model supervised fine-tuning (SFT), incorporating domain safety data with high supervision diversity (binary, hierarchical, structured JSON, and multi-turn tasks), and introducing Confuse-then-Contrast Fine-Tuning (C2FT) for explicit hard-case mining and contrastive discrimination on visually similar but semantically distinct cases.
3. Reasoning Post-Training: A two-stage process of reasoning SFT and reinforcement learning (RL), the latter leveraging sample rejection and progressive curriculum, tuned on cognitive blind spots to ensure both coverage and sample efficiency.

Figure 2: The Yuvion VL training pipeline implements a three-stage structure: continued pretraining, instruct post-training (with C2FT), and reasoning post-training (SFT + RLVR).

Confuse-then-Contrast Fine-Tuning (C2FT)

C2FT is a core innovation, addressing the persistent challenge in safety—differentiating adversarial near-misses (e.g., subtle logo mutations, occluded symbols) from benign instances. C2FT employs dynamic hard negative mining (using model-centric confusion analysis and feature-space similarity, with negatives validated by Teacher Forcing prediction probabilities) and joint multi-image contrastive attention within the transformer. The mixed single/multi-instruction loss balances discrimination with instruction-following integrity.

Figure 3: C2FT framework: dynamic construction of semantic confusion sets, hard contrastive mining, and multi-image optimization for fine-grained visual perception.

Evaluation Framework and Results

A three-level evaluation system, Yuvion VL RiskEval (YVRE), is implemented:

1. Level 1: General multimodal benchmarks—guardrails for base capability preservation.
2. Level 2: Open-source and in-house safety and adversarial robustness benchmarks, including public datasets (Hateful Memes, MMHS, HOD, LlavaGuard, MM-SafetyBench, UnsafeBench, ProGuard, EVADE-Bench) and proprietary e-commerce governance tasks (logo, brand, product category, price recognition).
3. Level 3: In-house, production-derived business and capability benchmarks spanning domain knowledge, visual perception, instruction-following under policy drift, adversarial robustness, AI-generated image detection, and operational end-to-end safety tasks.

Figure 4: Yuvion VL RiskEval (YVRE) framework, structuring progressive evaluation from capability retention to real-world deployment readiness.

Numerical Highlights

• Yuvion VL-32B surpasses comparably sized open-source models by an average of 9.9 points, as well as outperforming closed-source models (GPT-5.4, Qwen3.5-Plus) by 6.7 points on safety tasks.
• Yuvion VL-8B outperforms most baselines—including models more than 50x its parameter count—across key safety metrics.
• On open multimodal content and AI safety benchmarks, Yuvion VL models outstrip all ultra-large models (GPT-5.4, Kimi-2.5, etc.) in nearly all safety scenarios, with relative gains on high-salience tasks (e.g., HOD, MM-SafetyBench, LlavaGuard) exceeding 10–40 percentage points.
• In in-house, production-aligned evaluations, both Yuvion VL-32B-Instruct and -Reasoning variants achieve average scores above 82, sharply ahead of all base and ultra-large commercial models.

Figure 5: Yuvion VL exhibits superior performance over all baselines, including larger closed- and open-source models, across both open-source safety and production benchmarks.

Qualitative Analysis

Yuvion VL demonstrates systematic superiority in adversarial, fine-grained, and disguised risk scenarios, effectively flagging micro-scale or contextually occluded violations that generalist VLMs reliably overlook:

Figure 6: Qualitative case studies. Yuvion VL accurately identifies diverse subtle risk cues—including hidden symbols, contextually disguised contraband, and adversarially crafted images—missed by general-purpose models.

Ablations and Component Analysis

Component ablation confirms the necessity of both dynamic confusion mining and anti-shortcut mechanisms in C2FT; removal of either degrades fine-grained discrimination by 4–15 points (on GLD and GQA). For RL, rejection sampling and curriculum learning maintain or exceed performance while greatly reducing data requirements and sample inefficiency.

Implications and Future Directions

Practical Implications

Yuvion VL establishes the operational viability of multimodal safety-specialized foundation models, demonstrating that targeted design and training pipelines can deliver marked advances over both scale-centric and generic instruction-tuned paradigms. The model’s pipeline provides a template for future deployment-ready, interpretable, and robust content safety systems on dynamic user-generated content platforms, with significant cost and inference efficiency improvements through scale reduction and domain adaptation.

Theoretical and Research Consequences

Yuvion VL’s methodology—specifically adversarial-aware data curation, automated reasoning trace generation, and contrastive attention-based fine-tuning—reframes multimodal safety as a unique ML problem requiring explicit, dynamic boundary modeling and continual stress-testing. This motivates further exploration in:

• Efficient, continuously adaptive data flywheels for adversarial content mining
• Generalizable contrastive learning schemes for other domains with fine-grained conceptual boundaries
• Multi-objective, schema-adaptive RL pipelines for handling structured output and reward sparsity in real-world settings

Moreover, the YVRE evaluation scheme will likely become an industry standard for systematic safety and robustness assessment.

Conclusion

Yuvion VL demonstrates that adversarial-awareness, fine-grained contrastive discrimination, and domain-embedded reasoning are essential to closing the multimodal AI safety gap. Its unified, rigorously engineered pipeline achieves new state-of-the-art results, elucidating mechanisms necessary for real-world AI risk governance (2606.25034). The toolkit of data architecture, C2FT, and staged reasoning RL is broadly extensible, providing a foundation for future secure, interpretable, and robust MLLMs.