---
title: 'SingGuard-Bench: Multimodal Safety Benchmark'
url: https://www.emergentmind.com/topics/singguard-bench
type: topic
---

# SingGuard-Bench: Multimodal Safety Benchmark

Searching arXiv for SingGuard-Bench and closely related benchmark papers.
SingGuard-Bench is a policy-conditioned multimodal safety benchmark introduced alongside the SingGuard guardrail model family to evaluate safety assessment under active, runtime-specified policies rather than under a single fixed moderation taxonomy [2606.22873]. It is designed for multimodal conversations and normalizes each instance into a common guardrail interface with target content, an active policy, a safety label, and a fine-grained risk category or rule title. In the reported formulation, the benchmark contains **56,340 test examples** spanning image moderation, multimodal moderation, adversarial attack evaluation, and dynamic-rule evaluation, with **80+ fine-grained risk types** organized under a three-level taxonomy [2606.22873].

## 1. Benchmark definition and design objective

SingGuard-Bench is presented as the benchmark counterpart to SingGuard: the model family takes content together with an active policy and predicts a binary safety judgment, the triggered rule or category, and optionally a policy-grounded reasoning trace [2606.22873]. The benchmark is constructed to test precisely those capabilities. Its core claim is that multimodal guardrail evaluation should not be limited to static labels, because deployed systems may face changing product rules, region-specific policy variants, and multimodal compositions in which unsafe intent emerges only from the joint reading of text and image [2606.22873].

The benchmark is introduced to address four gaps attributed to prior multimodal safety benchmarks: insufficient fine-grained structure, poor precision testing on benign-sensitive content, lack of dynamic policy evaluation, and weak coverage of strict cross-modal hidden intent [2606.22873]. Accordingly, SingGuard-Bench is not merely an image-safety or multimodal toxicity dataset. It is a benchmark for **policy-following**, **rule grounding**, **attack robustness**, and **cross-modal composition reasoning** under a unified evaluation interface [2606.22873].

In the paper’s formal task definition, multimodal input is written as
$$
x = (q, I, a),
$$
where \(q\) is the user query, \(I\) denotes zero or more images, and \(a\) is the assistant response when response-level moderation is required. The policy-conditioned prediction target is
$$
f_\theta(x, P) \rightarrow (y, z, c),
$$
where \(y \in \{safe, unsafe\}\), \(z\) is an optional reasoning trace, and \(c \in \mathcal{T}(P)\cup\{Safe\}\) is the triggered category or rule title [2606.22873]. This formulation makes the benchmark explicitly conditional on the active policy \(P\), not only on the content itself.

## 2. Corpus composition and benchmark structure

The benchmark contains **56,340 test examples** in total [2606.22873]. The paper reports this as **54,340 samples** in the image and multimodal subsets together, plus **2,000 dynamic-rule samples**, yielding **56,340 total** [2606.22873].

### Benchmark-level statistics

| Subset | Count | Notes |
|---|---:|---|
| Image | 40,663 | 10,697 unsafe; 29,966 benign-sensitive |
| Multimodal | 13,677 | 6,487 unsafe; 7,190 benign-sensitive |
| Dynamic-rule | 2,000 | 4 policy-shift configurations, 500 each |
| Total | 56,340 | Full SingGuard-Bench |

The **image subset** contains **10,697 unsafe images** and **29,966 benign-sensitive images**, with the latter intended to stress precision rather than raw harmful-content recall [2606.22873]. The **multimodal subset** contains **6,487 unsafe** and **7,190 benign-sensitive** examples and focuses on image-text composition and adversarial cross-modal intent [2606.22873]. The **dynamic-rule subset** contains **2,000 examples**, split evenly across four policy-shift configurations [2606.22873].

The benchmark’s internal organization is tied to a hierarchical safety taxonomy. The paper describes a three-level taxonomy with **8 primary dimensions**, **27 secondary categories**, and **80+ fine-grained risk types** [2606.22873]. In the appendix-style construction statistics, this is further associated with **78 leaf nodes** and a keyword pool of **2,124 keywords per language** [2606.22873]. The paper does not explicitly reconcile the “80+ fine-grained risk types” count and the “78 leaf nodes” count, but both are reported as parts of the benchmark’s construction and taxonomy description [2606.22873].

## 3. Safety taxonomy and policy representation

SingGuard-Bench uses the same unified taxonomy as the SingGuard framework [2606.22873]. The **8 primary dimensions** are:

1. **A. Sexual Content Risk**
2. **B. Real-World Crime and Public Safety**
3. **C. Unethical Behavior**
4. **D. Cybersecurity and Information Manipulation**
5. **E. Agent Safety**
6. **F. Politically Sensitive Content**
7. **G. Animal Abuse**
8. **H. Benign** [2606.22873]

The **27 secondary categories** include, in the paper’s summary form, adult sexual content, sexual crimes and exploitation, violent crime, non-violent crime, weapons, WMD, hate, harassment, manipulation, self-harm, horror, misinformation, privacy leakage, intrusion, abuse/manipulation, copyright, prompt leakage, model behavior manipulation, rumors, subversion, unrest, historical distortion, public figures, protected animals, non-protected animals, entertainment abuse, and no risk [2606.22873].

The fine-grained taxonomy includes leaf-level risks such as explicit sexual depiction and pornography, child sexual abuse and grooming, violent crime planning, drug/property/financial crimes, weapon manufacturing/modification, chemical/biological/radiological/nuclear weapons, identity-based attacks, organized harassment, systematic manipulation methods, suicide instruction, gore and dismemberment, health/financial/public-safety misinformation, biometric or communication-record leaks, surveillance and unauthorized access, fake traffic generation and coordinated inauthentic behavior, piracy and paywall bypass, system prompt extraction, jailbreak and policy-violating induction, political rumors and subversive advocacy, historical distortion, attacks on political figures, and multiple forms of animal cruelty [2606.22873].

A distinctive feature of SingGuard-Bench is that benchmark instances may include **active policy rules expressed in natural language** [2606.22873]. The framework supports active policies represented as the full default taxonomy, a subset of categories, rewritten or merged rules, title-only rules, or entirely new domain-specific rules [2606.22873]. The prompt template described in the paper specifies that if `{policy}` is provided, it replaces the default policy, and the `<answer>` field must contain one active rule title from `{policy}`, or `Safe` [2606.22873]. This means the benchmark tests not only binary safe/unsafe classification, but also the system’s ability to attribute a decision to the currently active rule set.

This design distinguishes SingGuard-Bench from capability-oriented domain benchmarks such as SecBench, which is explicitly framed as a benchmark of cybersecurity knowledge retention and logical reasoning rather than of guardrail behavior, refusal, or policy adherence under adversarial conditions [2412.20787]. SingGuard-Bench instead targets behavioral safety and policy-conditioned moderation [2606.22873].

## 4. Task settings and cross-modal risk modeling

The benchmark covers several distinct settings [2606.22873].

First, it includes **image moderation**, which evaluates pure image safety classification and emphasizes “bottom-line visual risks and benign-sensitive precision” [2606.22873]. Second, it includes **multimodal moderation**, where safety must be inferred from image-text combinations and, in the broader SingGuard interface, may also involve assistant responses [2606.22873]. Third, it includes **adversarial attack evaluation**, with attack-style prompts such as typographic, semantic-isomorphic, narrative, and role-play attacks, as well as transformations such as **Typography** and **Patch Shuffle** [2606.22873]. Fourth, it includes **dynamic-rule evaluation**, in which the same content can be paired with different active policies and therefore receive different labels [2606.22873].

The benchmark places particular emphasis on **cross-modal hidden-intent** or **cross-modal joint-risk** cases [2606.22873]. These are examples where the image alone is benign and the text alone is benign, but the combination is unsafe [2606.22873]. The construction process starts from a harmful intent and then splits the evidence across image and text so that each modality appears harmless in isolation while their composition reveals unsafe intent [2606.22873]. The paper characterizes these as often requiring multi-hop or domain-knowledge clues [2606.22873].

The multimodal subset also carries an additional subtype label identifying where the unsafe signal resides. The reported subtypes are **IUTS** (Image-Unsafe / Text-Safe), **ISTU** (Image-Safe / Text-Unsafe), **IUTU** (Image-Unsafe / Text-Unsafe), **Image-Safe / Text-Safe with unsafe intent**, and anchoring cases including **I** and **ISTS** [2606.22873]. This suggests that the benchmark is designed not only to measure whether a system flags risk, but also whether it can localize the source or composition of the risk.

## 5. Dynamic-rule evaluation and runtime policy shifts

Dynamic-rule evaluation is one of the benchmark’s central innovations [2606.22873]. In this setting, labels are not fixed solely by content. Instead, the same sample may be safe or unsafe depending on the active rule set. The benchmark simulates runtime policy changes by pairing samples with combinations of matching base rules, non-matching base rules, matching dynamic rules, and non-matching dynamic rules [2606.22873].

### Dynamic-rule configurations

| Case | Expected verdict | Samples |
|---|---|---:|
| unsafe→unsafe | Unsafe | 500 |
| safe→safe | Safe | 500 |
| unsafe→safe | Safe | 500 |
| safe→unsafe | Unsafe | 500 |

The paper specifies the four cases as follows [2606.22873]. In **unsafe→unsafe**, the active policy includes **0 matching base rules**, **1–2 non-matching base rules**, **1 matching dynamic rule**, and **1–2 non-matching dynamic rules**; the expected verdict is unsafe. In **safe→safe**, there are **1–2 non-matching base rules**, **0 matching dynamic rules**, and **1–2 non-matching dynamic rules**; the expected verdict is safe. In **unsafe→safe**, there are **0 matching base rules**, **1–2 non-matching base rules**, **0 matching dynamic rules**, and **1–2 non-matching dynamic rules**; the expected verdict is safe. In **safe→unsafe**, there are **1–2 non-matching base rules**, **1 matching dynamic rule**, and **1–2 non-matching dynamic rules**; the expected verdict is unsafe [2606.22873].

The dynamic-rule examples are created by adding rules, deleting active rules, broadening or narrowing rule scope, adding exemptions, changing evidence or intent requirements, adjusting rule priority, and generating entirely new rules outside the base taxonomy [2606.22873]. Non-matching dynamic rules function as distractors, so the evaluation tests whether a model actually follows the semantics of the active rule text rather than defaulting to memorized category priors [2606.22873].

This emphasis on runtime rule shifts places SingGuard-Bench in a different category from localized but static moderation benchmarks such as RabakBench, which evaluates guardrail classifiers on Singapore-localized multilingual safety data but does not center evaluation on labels that flip under changing runtime policies [2507.05980]. SingGuard-Bench extends guardrail benchmarking from localized safety classification to explicit policy adaptation [2606.22873].

## 6. Construction pipeline, evaluation protocol, and reported results

The benchmark is built through what the paper calls a **quality-oriented synthesis and filtering pipeline**, summarized as **keyword generation and association → data supplementation → quality filtering** [2606.22873]. The construction uses a keyword pool with **78 leaf nodes** and **2,124 keywords per language** in English and Chinese, aligned one-to-one [2606.22873]. After deduplication, the paper reports **1,842 unique English keywords**, **1,857 unique Chinese keywords**, and **11.1% cross-node overlap** retained intentionally [2606.22873].

The collection process begins with LLM-generated seed keywords for each leaf rule, expands them through a knowledge graph across multiple rounds, associates existing safety data to the keyword set, and then searches open-source datasets and the public web for under-covered keywords [2606.22873]. Quality control then uses strict multi-model filtering with label consistency checks, category consistency checks, and explanation consistency checks [2606.22873]. The re-annotation and filtering pipeline is reported to use models such as **Qwen3.5-397B-A17B**, **KIMI-K2.6**, and **GLM4.5V** [2606.22873]. Samples failing the **L0** binary safe/unsafe consistency check are discarded, while **L1** category-level failures are rerouted as hard cases or synthesis seeds [2606.22873]. On an internal human-annotated validation set, the ensemble annotation pipeline is reported to achieve **over 0.9 accuracy on safety-level labels** [2606.22873].

Every benchmark instance is normalized to a common interface with target content, active policy, safety label, and fine-grained risk category or rule title [2606.22873]. For static benchmark families, the paper reports **binary F1 per dataset** and macro-average F1 across datasets within each axis [2606.22873]. For the dynamic-policy family, it reports **accuracy** [2606.22873]. For SingGuard-Bench’s image, multimodal, and attack splits, the reported metrics are **Accuracy**, **Precision**, **Recall**, and **F1**, computed on the unsafe class [2606.22873].

On SingGuard-Bench, the best reported **image-split F1** is **0.8759** from **SingGuard-4B** [2606.22873]. The best **multimodal-split F1** is **0.9943** from **SingGuard-8B** [2606.22873]. The best **attack-split F1** is **0.9164** from **SingGuard-2B** [2606.22873]. For dynamic-policy evaluation, **SingGuard-slow** attains the best average accuracy of **0.7415**, compared with **0.6465** for **Qwen3-VL-8B** [2606.22873]. The paper specifically highlights improvement on **safe2unsafe**, from **0.3800** to **0.5700**, as evidence of stronger enforcement of newly introduced restrictions [2606.22873].

More broadly, the paper states that across **six benchmark families spanning 35 datasets**, SingGuard achieves state-of-the-art average F1 in every family, and that dynamic-rule evaluation shows improved policy-following accuracy from **0.6465 to 0.7415** under runtime policy shifts [2606.22873]. This suggests that SingGuard-Bench is intended not only as an internal benchmark for one model family, but as a testbed for policy-adaptive multimodal guardrails more generally.

The benchmark’s limitations are also stated. The paper notes long-tail incompleteness, dependence on synthetic and model-assisted data, policy ambiguity and cultural variation, the need for continuous updates and human review, and confidence calibration issues for hybrid early exit under distribution shift [2606.22873]. A plausible implication is that SingGuard-Bench is best read as a deployment-oriented benchmark for policy-adaptive multimodal safety, but not as an exhaustive enumeration of all future safety policies or abuse patterns.

Source: https://www.emergentmind.com/topics/singguard-bench