Yuvion VL: Adversarial-Safety Vision-Language Models

• Yuvion VL is a family of multimodal vision-language models designed specifically for AI and content safety through adversarial training and risk-concept alignment.
• The system employs a three-stage training pipeline including Confuse-then-Contrast Fine-Tuning to precisely distinguish subtle visual risks and enhance moderation accuracy.
• It demonstrates industry-leading performance on benchmarks like HOD and MM-SafetyBench, outperforming comparably sized models on diverse safety and governance tasks.

Yuvion VL is a family of multimodal LLMs for content and AI safety that treats safety as an inherently adversarial and multimodal problem rather than as a by-product of general-purpose vision-language modeling. The family comprises 8B and 32B dense variants, each offered in Instruct and Reasoning forms, and is designed for images plus text across multimodal moderation, risk classification and attribution, AI-generated or manipulated image detection, adversarial robustness, e-commerce governance, and interactive guardrails and policy-following. The system is presented together with a safety-oriented data pipeline, a three-stage training recipe, a contrastive fine-tuning method termed Confuse-then-Contrast Fine-Tuning, and an evaluation suite called Yuvion VL RiskEval (Qiu et al., 23 Jun 2026).

1. Problem formulation and model family

The paper defines content and AI safety as a setting in which harmful material often hides in images, in text-image combinations, and in frequent policy shifts. The motivating examples include tiny watermarks, occluded symbols, stylized extremist emblems, memes, and misleading captions. On this account, safety systems must make fine-grained distinctions between visually similar cases that carry different safety implications, while remaining robust to continuously evolving evasion tactics (Qiu et al., 23 Jun 2026).

Yuvion VL is introduced as a safety-first family of vision-LLMs engineered around adversarial robustness. The family has two sizes, 8B and 32B dense variants, and two behavioral modes: Instruct, aimed at production-grade tasks, and Reasoning, aimed at chain-of-thought and verifiable reasoning. Its stated task coverage includes multimodal moderation; risk classification and attribution; AI-generated or manipulated image detection; adversarial robustness; e-commerce governance involving logos, brands, products, and prices; and interactive guardrails and policy-following.

The problem framing also specifies why generic VLMs struggle in this domain. The paper attributes the difficulty to four requirements that are insufficiently met by broad-coverage models: high-resolution, fine-grained perception; domain knowledge such as laws, regulations, and cultural or political context; robustness to adversarial manipulations and policy changes; and auditable reasoning to justify decisions. A central implication is that Yuvion VL is not merely a general VLM adapted to moderation, but a system whose data construction, optimization strategy, and evaluation protocol are all organized around adversarial safety.

2. Architecture and risk-concept alignment

Yuvion VL is built on the Qwen3-VL framework and comprises three components: a ViT vision encoder that converts images to dense visual tokens, an MLP cross-modal connector that projects visual tokens into the LLM embedding space, and a Qwen-series language backbone that processes interleaved visual and textual tokens and generates responses (Qiu et al., 23 Jun 2026). Multimodal fusion is performed by interleaving projected visual tokens with textual tokens in the LLM. For multi-image supervision, token sequences are concatenated so that self-attention can compare across images directly.

A core architectural objective is what the paper calls risk-concept cross-modal alignment. This alignment explicitly couples visual risk cues to textual safety concepts such as pornographic elements, violent or terrorist imagery, extremist symbols, sensitive persons, flags and logos, counterfeit signals, prohibited goods, and fraud. The alignment strategy uses continued pretraining on mixed general captions and risk-concept captions derived from domain knowledge. During this stage, the vision encoder is frozen while the MLP connector and the LLM are updated, so that risk semantics are learned without eroding general visual features.

The optimization target for this stage is standard next-token cross-entropy over caption-style targets conditioned on images and knowledge prompts. With image $x$, target text $y$, and parameters $\theta$, the objective is

$$L_{\mathrm{CE}}(\theta; x, y) = -\sum_t \log p_\theta(y_t \mid y_{<t}, x).$$

The paper’s formulation makes the alignment stage conceptually important: it does not attempt to relearn vision from scratch, but instead re-parameterizes the language-facing part of the system so that visual evidence becomes legible in a safety ontology.

3. Safety-oriented data construction

The data pipeline is organized by capability rather than by a single monolithic corpus. The general multimodal component includes captioning, VQA, multi-turn dialogue, math reasoning, and OCR or document understanding, and is used to preserve broad competence. The domain knowledge component covers perception tasks such as sensitive faces, flags and symbols, logos, and risk OCR, together with knowledge alignment for organizations and logos, flags, protected species, and regulated media, formatted as multimodal QA (Qiu et al., 23 Jun 2026).

The domain safety component contains large-scale business-grade samples across political sensitivity, pornography, violence or terrorism, fraud, illegal finance, gambling, harassment, hate speech, and misinformation. Labels include hierarchies, evidence attribution, and policy references. The adversarial component targets small-text or watermark evasion, logo or symbol mutations through distortion, color changes, and partial rendering, occlusion or concealment, AI-generated adversarial content, and contextual disguise such as educational, news, or artistic framing. A data flywheel continually mines deployment failures and synthesizes targeted variants.

The pipeline also includes text-only safety corpora with hierarchical labels and adversarial text such as homophones and structure obfuscation, plus general text to preserve language skills. For reasoning, the paper describes automated visual chain-of-thought generation with strict posterior checks, cross-validation and arbitration, and quality assurance on efficiency, consistency, and factuality.

The curation emphasis is on adversarially meaningful edge cases rather than generic image-text pairs. The paper lists near-duplicate images with different implications, subtle cues such as tiny emblems and counterfeit tells, misleading captions and memes, multi-image traps, small-font watermarks, and AI-manipulated or synthetic visuals. This suggests that the corpus is intended not only to broaden coverage but also to densify the decision boundary in regions where safety judgments are brittle.

4. Three-stage training pipeline and C2FT

Training proceeds in three stages. Stage 1 is knowledge-enhanced continued pretraining for risk-concept alignment, using general-purpose captions plus knowledge alignment captions from domain knowledge sets. In this stage, the vision encoder is frozen and the MLP connector and LLM are updated under standard generative cross-entropy to tie visual features to safety concepts. Stage 2 is instruct post-training for production-grade tasks through supervised fine-tuning on diverse safety tasks. Inputs include many instruction templates, and outputs include binary and hierarchical labels, free-text reasoning with evidence citation, structured JSON for system integration, and multi-turn clarifications and policy-following. In this stage, the full model is updated. Stage 3 is reasoning post-training for interpretability and complex tasks, combining reasoning SFT with reasoning RL (Qiu et al., 23 Jun 2026).

The reasoning SFT stage replays high-quality continued-pretraining data, emphasizes complex structured outputs, and injects fine-grained visual CoT. The reasoning RL stage uses rejection sampling and curriculum learning to focus optimization on boundary and canonical samples with high reward inconsistency. The procedure includes multi-round pre-sampling with $N=5$ per prompt, selection of high-inconsistency samples to target cognitive blind spots, and a curriculum from medium-difficulty samples with $\le 80\%$ inconsistency to high-difficulty samples with $>80\%$ inconsistency. Task-specific rewards include accuracy for decisions, IoU for grounding, CoT–final-answer consistency, schema validity for structured outputs, and semantic similarity for subjective tasks, together with a global CoT–answer consistency term.

Confuse-then-Contrast Fine-Tuning, abbreviated C2FT and also described as CTCFT, is integrated into Stage 2. Its goal is explicit discrimination among visually similar cases with different safety labels by mining model-specific confusions and optimizing over multi-image groups. In the confuse phase, for an anchor $(x_a, y_a)$, confusion scores are computed over candidate categories $c$ through similarity between the model’s predicted embedding and each category’s ground-truth embedding:

$$S_{\mathrm{confuse}}(c \mid x_a) = \mathrm{Sim}(e_{\mathrm{pred}}, e_{\mathrm{gt}}^{c}).$$

The top-scoring categories form the dynamic confusion set $y$0. Feature-based retrieval and teacher-forcing verification are then used to retain a sample $y$1 from class $y$2 as a verified hard negative when

$y$3

Hard positives are found by joint image-text similarity to the anchor.

In the contrast phase, grouped multi-image supervision is applied by concatenating tokens,

$y$4

where $y$5 are visual tokens from each image in the group and $y$6 are textual tokens. The contrastive grouped objective is

$y$7

and the mixed-format training loss is

$y$8

with $y$9. Progressive Anti-Shortcut Training stabilizes this regime by randomly shuffling image order to remove positional shortcuts and by mixing multi-image and single-image samples to preserve instruction-following behavior. The paper explicitly notes that, although conceptually related to InfoNCE, the implementation uses grouped cross-entropy over multi-image inputs rather than a separate embedding-level InfoNCE.

Ablation results are reported for fine-grained recognition and reasoning. Full C2FT yields GLD 84.72 and GQA 70.16. Removing C2M in favor of random contrasts reduces the average by 4.28 points, while removing PAT reduces the average by 15.41 points. The reported takeaway is that model-specific mining matters, teacher-forcing verification improves negative quality, and PAT is essential to avoid shortcutting and preserve instruction-following.

5. Evaluation protocol and empirical performance

Yuvion VL RiskEval, abbreviated YVRE, is a collection of 58 benchmarks spanning three levels. Level 1 covers general multimodal capability and includes MMMU, MathVista, AI2D, MMBench, MME, MMStar, SEED, ScienceQA, A-Bench, Q-Bench, HallusionBench, BLINK, CountBenchQA, plus text-only Chinese, commonsense, math, and knowledge sets. Level 2 covers open safety and e-commerce governance, including Hateful Memes, MMHS, HOD, LLaVA-Guard, ProGuard, MM-SafetyBench, UnsafeBench, EVADE-Bench, and governance tasks for logo recognition, brand recognition, product category recognition, and product price recognition. Level 3 covers in-house capability and business tasks, including domain knowledge, visual perception, AI-generated image detection, dynamic policy instruction following in Chinese and English for image-text and text-only settings, adversarial robustness, and full-stack moderation combining classification, attribution, and CoT. Reported metrics are Accuracy and Macro F1 for safety classification, plus task-standard metrics such as IoU for grounding; AI-generated detection is reported as Macro F1 (Qiu et al., 23 Jun 2026).

The headline claim is that Yuvion VL-32B achieves “industry-leading safety performance,” surpassing comparably sized open-source models by 9.9 points on average and the best closed-source commercial baselines by 6.7 points on average on safety tasks. On the 12-benchmark open safety and governance average, Yuvion VL-32B Instruct scores 76.9 and Reasoning 76.7, compared with GPT-5.4 at 70.1, Qwen3.5-Plus at 71.4, K2.5 at 69.8, and Opus-4.6 at 69.3. The paper also reports strong per-benchmark leads: HOD by 42 points versus the best ultra-large model, MM-SafetyBench by 36 points, LLaVA-Guard by about 10 points for the Instruct variant, ProGuard by 12 points in the Reasoning variant, and EVADE-Bench by 5 points in the Reasoning variant.

On the 21-benchmark in-house capability and business average, Yuvion VL-32B Instruct scores 82.8 and Reasoning 82.6, compared with GPT-5.4 at 75.9, Qwen3.5-Plus at 74.9, K2.5 at 64.1, and GLM-5 at 58.7. The largest gains are reported on Security Audit, with +58 for Instruct versus base and +45 for Reasoning versus base, on Metaphor ID with +26 for Reasoning versus base, and on Text IF in Chinese and English with +10 to +15 in multiple settings.

For AI-generated image detection, Macro F1 is 74.1 for Yuvion VL-32B, close to GPT-5.4 at 75.1 and above Qwen3.5-Plus at 69.6 and K2.5 at 65.8. Yuvion VL-8B reaches 73.6, exceeding Qwen3.5-Plus and K2.5. On 23 general benchmarks, the paper reports average drops of approximately 2–3 points relative to the Qwen3-VL backbones, while scaling to 32B recovers most of the gap, with Yuvion VL-32B Instruct at 81.0 and Reasoning at 82.3. HallusionBench is noted as a positive exception, with a gain of 11 points for 32B Reasoning. Training-stage ablations further indicate that reasoning RL, using only about 6% of the data via rejection sampling plus curriculum, matches full-data RL, adds 1.4% to safety averages, and shows cross-source generalization on VLM-Guard-style tasks.

The evaluation design also addresses a recurrent concern in safety specialization: the possibility that narrow safety optimization simply trades away general competence. The reported results do not eliminate that trade-off, but they bound it quantitatively within the paper’s setup.

6. Operational behavior, limitations, and release status

The production-oriented behavior of Yuvion VL is described in terms of moderation, risk attribution, guardrails, adversarial robustness, e-commerce governance, and AI-generated or manipulated image detection. The model can return binary or hierarchical risk classification, domain-specific categories, confidence, and evidence snippets; point to visual or textual cues such as embedded text, symbols, and objects; cite policies; provide audit-ready rationales; refuse or redirect unsafe requests; and adhere to injected dynamic policies in Chinese or English for multimodal and text-only settings (Qiu et al., 23 Jun 2026). In e-commerce governance, the paper highlights brand or logo recognition under occlusion and stylization, product category and price plausibility checks, and counterfeit or knock-off detection. For AI-generated detection, the expected output is a decision such as “synthetic” together with cues such as artifact patterns in skin or lighting and inconsistent text kerning.

The distinction between model variants is operationally explicit. The Instruct model is described as returning compact decisions and schema-conformant JSON, whereas the Reasoning model adds structured CoT, evidence grounding, and policy citations. Illustrative prompts include fine-grained symbol disambiguation over multiple images, detection of illegal gambling advertised through tiny semi-transparent overlays, dynamic policy-following under a revised policy version, and AI-generated image assessment.

The paper lists several limitations. Relative to Qwen3-VL backbones, there are small regressions on a subset of general and commonsense tasks, approximately 2–3 points on average. Residual vulnerabilities remain for novel unseen evasions and long-tail symbol variants, motivating a continued data flywheel. OCR-heavy multilingual tasks can remain challenging in some decoding modes, and the current modality coverage is limited to vision-language rather than video or audio. Sensitive data cannot be released, and some evaluations adapt public benchmarks to a unified protocol, so scores reflect that setup rather than the original task idiosyncrasies. The paper also notes the deployment risk that a model engaging directly with sensitive content and policies may be misused or misinterpreted without careful controls.

Future work is defined as expansion to video and audio, broader datasets and adversarial generators, broader policy jurisdictions with continuous updates, sharper verifiable reasoning and interpretability, and expanded tool use where applicable. On reproducibility and release, the paper states that open-sourcing is being assessed because of sensitivity. Selected checkpoints and benchmarks are planned for release where feasible, including public components of YVRE and self-constructed e-commerce governance sets. Training compute and infrastructure are not reported, and licensing remains to be determined pending legal and compliance review. The paper additionally states that early access inquiries may be directed to [email protected].

Within the scope defined by the paper, Yuvion VL is significant because it presents a full-stack safety system: adversarial-aware data construction, risk-concept alignment, instruction and reasoning post-training, contrastive supervision for hard visual distinctions, and evaluation across general, public-safety, governance, and internal business settings. The reported outcome is a model family that prioritizes adversarial multimodal safety while maintaining comparable general capabilities, with the 32B variant leading the reported safety results and the 8B variant exceeding much larger models on several safety tasks while using less than 2% of their parameters (Qiu et al., 23 Jun 2026).