QwenSafe: Multimodal CRD Classifier

• QwenSafe is a vision-language model that identifies Apple-defined CRDs in mobile apps by jointly analyzing metadata and screenshots.
• It leverages the metadata2CRD pipeline to synthesize descriptor-aligned QA pairs, enhancing training with evidence-grounded supervision.
• The system outperforms baselines with significant improvements in positive-class recall through descriptor-aware fine-tuning and DPO alignment.

QwenSafe is a Vision-LLM (VLM) for automatic identification of Apple-defined content rating descriptors (CRDs) in mobile apps through joint reasoning over app metadata and screenshots. It addresses a moderation and compliance problem in which the relevant evidence is intrinsically multimodal, and it does so by adapting Qwen3-VL-8B with supervised fine-tuning followed by Direct Preference Optimization (DPO) on descriptor-aligned question-answer data synthesized by the metadata2CRD pipeline. The system is evaluated on 12 Apple-defined descriptors and is reported to consistently outperform Qwen3-VL, LLaVA-1.6, and Gemini-2.5-Flash in binary CRD classification, with improvements in positive-class recall of 111.8%, 36.1%, and 2.1%, respectively (Denipitiyage et al., 20 May 2026).

1. Problem Formulation and Scope

QwenSafe targets the problem of identifying whether a mobile app exhibits Apple-defined CRDs such as “Gambling,” “Violence,” and “Mature Content.” In the formulation described for the model, app-store content rating is not treated as a text-only or image-only classification task. Instead, the problem is explicitly multimodal: the relevant evidence may appear in app descriptions, titles, and screenshots, and the model is designed to reason across these sources jointly (Denipitiyage et al., 20 May 2026).

The motivation is regulatory and operational. Mobile app marketplaces require developers to disclose standardized CRDs so that users are informed about potentially sensitive or restricted content. The paper frames inaccurate or inconsistent disclosure as a practical problem because manual review is difficult to scale and because the evidence for a descriptor may be distributed across textual metadata and visual interface elements rather than localized in a single modality (Denipitiyage et al., 20 May 2026).

A central implication of this framing is that CRD identification is descriptor-specific rather than generic safety classification. QwenSafe is not described as a broad unsafe-content detector; it is described as a model for identifying the presence of 12 Apple-defined descriptors using descriptor definitions, app metadata, and screenshots as the joint input context (Denipitiyage et al., 20 May 2026).

2. Descriptor-Aware Multimodal Reasoning

The model adapts the Qwen3-VL-8B backbone and takes as input a pair $(M, I)$, where $M$ denotes app metadata and $I$ denotes a set of screenshots. Its outputs are descriptor-specific predictions accompanied by natural-language explanations and evidence grounding. This design uses the VLM backbone’s capacity to fuse and attend over text and images for fine-grained content analysis (Denipitiyage et al., 20 May 2026).

A defining feature of the approach is “descriptor awareness.” For each CRD, the prompt includes the formal descriptor definition together with the app’s textual and visual data. The model is then asked whether the app contains content matching that descriptor and, if so, to cite evidence from the description and screenshots. The reported output format consists of a binary label indicating descriptor presence and a natural-language explanation that ties the prediction to specific elements in the input, such as terms in the description or visible objects and interface elements in screenshots (Denipitiyage et al., 20 May 2026).

This design directly addresses a common reduction of content-rating tasks to unimodal heuristics. The paper’s task construction assumes that descriptors often manifest in both text and visuals; for example, visual depictions such as slot machines or weapons may complement textual mentions such as “casino games” or “adult chat.” The model is therefore aligned not only to predict a label, but also to articulate why that label follows from multimodal evidence (Denipitiyage et al., 20 May 2026).

3. metadata2CRD: Synthetic Training Data Construction

Because large-scale multimodal CRD-labeled corpora are not readily available, the paper introduces metadata2CRD, a data-construction pipeline that synthesizes descriptor-aligned question-answer pairs from app descriptions, screenshots, and formal descriptor definitions. The pipeline begins with collected app metadata and associated screenshots, then fuses these inputs with the definition of each Apple CRD to construct multimodal QA instances (Denipitiyage et al., 20 May 2026).

For positive cases, the constructed QA pairs describe apps whose metadata or screenshots exhibit evidence for a descriptor; for negative cases, apps without the descriptor are explicitly sampled. The instructional format includes the descriptor definition together with the app data, which is intended to make the training instances descriptor-aware rather than merely label-supervised. The result is a synthetic but task-structured dataset of positive and negative examples for each of the 12 descriptors (Denipitiyage et al., 20 May 2026).

The significance of metadata2CRD lies in how it shifts the supervision signal. Instead of learning only from coarse binary labels, the model is exposed to descriptor-specific questions and answers that pair labels with explanations. This suggests that the synthetic pipeline is meant to operationalize a more semantically explicit training signal: not just whether a descriptor applies, but how the relevant evidence should be grounded across modalities. The paper presents this as a key enabler of scalable training for the task (Denipitiyage et al., 20 May 2026).

4. Adaptation of Qwen3-VL-8B and Preference Alignment

QwenSafe is built by adapting Qwen3-VL-8B through a two-stage training procedure. In the first stage, supervised fine-tuning is performed on metadata2CRD-constructed examples. The training task is to predict whether a given descriptor is present for an input consisting of metadata, screenshots, and the descriptor definition, while also producing a supporting explanation using both modalities (Denipitiyage et al., 20 May 2026).

In the second stage, the system is further aligned with DPO. The role of DPO in the paper is not merely to improve binary correctness, but to align the model toward preferred outputs that are descriptor-grounded and evidence-specific across visual and textual modalities. The reported implementation presents pairs of candidate outputs and favors responses that are more accurate and more tightly grounded in the correct multimodal evidence (Denipitiyage et al., 20 May 2026).

This two-stage sequence is presented as important because standard VL models may produce answers that are loosely correct yet insufficiently justified. The preference-alignment stage is intended to force the model toward explanations that connect the final label to the relevant screenshot regions and metadata cues. In that sense, QwenSafe is framed as an explainable classifier rather than a pure decision function: the preferred output is one that both classifies correctly and justifies the decision with descriptor-specific evidence (Denipitiyage et al., 20 May 2026).

5. Evaluation Protocol and Empirical Results

The evaluation focuses on binary CRD classification over 12 Apple-defined descriptors. The reported metrics are binary classification accuracy and positive-class recall, with recall emphasized because false negatives can create user-safety and regulatory risks. The paper compares QwenSafe with Qwen3-VL-8B, LLaVA-1.6, and Gemini-2.5-Flash (Denipitiyage et al., 20 May 2026).

QwenSafe is reported to achieve the highest recall among all models tested, across all 12 CRDs. In the abstract-level summary, the gains are expressed as improvements in positive-class recall of 111.8% over Qwen3-VL-8B, 36.1% over LLaVA-1.6, and 2.1% over Gemini-2.5-Flash. The paper also states that QwenSafe consistently outperforms all baselines in binary CRD classification (Denipitiyage et al., 20 May 2026).

Baseline model	Comparison role	Positive-class recall improvement reported for QwenSafe
Qwen3-VL-8B	Backbone baseline	111.8%
LLaVA-1.6	VLM baseline	36.1%
Gemini-2.5-Flash	VLM baseline	2.1%

The results are interpreted in the paper as evidence that descriptor-aware multimodal alignment materially improves automated content classification. A notable point is that the strongest relative gain is against the unadapted Qwen3-VL-8B backbone, which indicates that the improvement is not attributed only to model scale or general VL capability, but to the CRD-specific training and alignment procedure (Denipitiyage et al., 20 May 2026).

6. Implications, Limitations, and Position Within the Qwen Safety Literature

The paper attributes three broader implications to QwenSafe. First, it enables scalable descriptor checking for app marketplaces. Second, it provides descriptor-consistent and explainable classification by grounding predictions in multimodal evidence. Third, the descriptor-aware alignment and data-construction techniques could transfer to other rating frameworks, including ESRB, PEGI, and regional laws (Denipitiyage et al., 20 May 2026).

The limitations are equally explicit. Because metadata2CRD synthesizes QA pairs, the resulting supervision may miss some subtle or rare real-world edge cases. The paper also notes that performance may degrade on out-of-distribution apps or creative content not well represented in training data. For that reason, the system is presented as a tool to augment rather than fully replace human review, especially for ambiguous or borderline cases (Denipitiyage et al., 20 May 2026).

Within the broader Qwen safety literature, QwenSafe occupies a distinct niche. It is a marketplace-content-rating system rather than a general guardrail or agent-security model. Other Qwen-line works address different safety surfaces: "Qwen3Guard Technical Report" introduces multilingual guardrail models with generative and streaming variants for prompt and response safety classification (Zhao et al., 16 Oct 2025); "AgentSecBench" evaluates Qwen3-0.6B and Qwen3-1.7B on instruction-integrity, retrieval-confidentiality, and capability-integrity games for agent security (Alpay et al., 25 May 2026); "Smoothie-Qwen: Post-Hoc Smoothing to Reduce Language Bias in Multilingual LLMs" mitigates language confusion by selectively adjusting token-level output probabilities without retraining (Ji et al., 8 Jul 2025); "SAFEx: Analyzing Vulnerabilities of MoE-Based LLMs via Stable Safety-critical Expert Identification" studies positional vulnerability in Qwen3-MoE and reports that disabling 12 identified safety-critical experts can cause the refusal rate to drop by 22% (Lai et al., 20 Jun 2025); and "BraveGuard: From Open-World Threats to Safer Computer-Use Agents" retrains Qwen3-Guard backbones with trajectory-level supervision for computer-use agents (Feng et al., 31 May 2026).

Taken together, these works indicate that “QwenSafe” should be understood narrowly and precisely: not as a catch-all label for Qwen safety research, but as a specific preference-aligned VLM for automated identification of Apple-defined CRDs from app metadata and screenshots. Its contribution is the combination of descriptor-aware multimodal reasoning, synthetic QA construction via metadata2CRD, and DPO-based alignment toward evidence-grounded predictions in an app-marketplace moderation setting (Denipitiyage et al., 20 May 2026).