Paper deep dive
SHIELD: Classifier-Guided Prompting for Robust and Safer LVLMs
Juan Ren, Mark Dras, Usman Naseem
Models: Gemma-2.5-Lite, GPT-4o-mini, LLaMA-3.2-Vision-11B, LLaVA-1.5, LLaVA-1.6, Qwen2-2B, Qwen2.5-8B
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%
Last extracted: 3/12/2026, 6:34:31 PM
Summary
SHIELD is a lightweight, model-agnostic preprocessing framework for Large Vision-Language Models (LVLMs) that enhances safety by coupling fine-grained safety classification with category-specific guidance and explicit actions (Block, Reframe, Forward). It effectively reduces jailbreak and non-following rates across various benchmarks and models without requiring retraining.
Entities (5)
Relation Signals (3)
SHIELD ā protects ā LVLMs
confidence 95% Ā· SHIELD... serving as a practical safety patch for both weakly and strongly aligned LVLMs.
SHIELD ā reduces ā Jailbreak rate
confidence 95% Ā· SHIELD consistently lowers jailbreak and non-following rates while preserving utility.
SHIELD ā uses ā Safety classification
confidence 95% Ā· SHIELD... couples fine-grained safety classification with category-specific guidance
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large Vision-Language Models (LVLMs) unlock powerful multimodal reasoning but also expand the attack surface, particularly through adversarial inputs that conceal harmful goals in benign prompts. We propose SHIELD, a lightweight, model-agnostic preprocessing framework that couples fine-grained safety classification with category-specific guidance and explicit actions (Block, Reframe, Forward). Unlike binary moderators, SHIELD composes tailored safety prompts that enforce nuanced refusals or safe redirection without retraining. Across five benchmarks and five representative LVLMs, SHIELD consistently lowers jailbreak and non-following rates while preserving utility. Our method is plug-and-play, incurs negligible overhead, and is easily extendable to new attack types -- serving as a practical safety patch for both weakly and strongly aligned LVLMs.
Tags
Links
- Source: https://arxiv.org/abs/2510.13190
- Canonical: https://arxiv.org/abs/2510.13190
Trouble viewing inline? Open PDF directly ā
Full Text
47,885 characters extracted from source content.
Expand or collapse full text
SHIELD: Classifier-Guided Prompting for Robust and Safer LVLMs Juan Ren, Mark Dras, Usman Naseem School of Computing, Macquarie University, Australia, ada.ren@hdr.mq.edu.au, mark.dras,usman.naseem@mq.edu.au Abstract Large Vision-Language Models (LVLMs) unlock powerful multimodal reasoning but also expand the attack surface, particularly through adversarial inputs that conceal harmful goals in benign prompts. We propose SHIELD, a lightweight, model-agnostic preprocessing framework that couples fine-grained safety classification with category-specific guidance and explicit actions (Block, Reframe, Forward). Unlike binary moderators, SHIELD composes tailored safety prompts that enforce nuanced refusals or safe redirection without retraining. Across five benchmarks and five representative LVLMs, SHIELD consistently lowers jailbreak and non-following rates while preserving utility. Our method is plug-and-play, incurs negligible overhead, and is easily extendable to new attack typesāserving as a practical safety patch for both weakly and strongly aligned LVLMs. SHIELD: Classifier-Guided Prompting for Robust and Safer LVLMs Juan Ren, Mark Dras, Usman Naseem School of Computing, Macquarie University, Australia, ada.ren@hdr.mq.edu.au, mark.dras,usman.naseem@mq.edu.au Figure 1: Scatter plot of jailbreak and non-following rates under Baseline vs. Shield. Lower values indicate better performance (ā ), with points in the upper-right representing worse outcomes than those in the lower-left. All LVLMs shift leftward under Shield, reflecting improvements through reduced jailbreak or non-following rates. 1 Introduction Large Vision-Language Models (LVLMs) integrate visual and textual modalities, enabling richer multimodal reasoning and broadening their application scope. However, this expanded capability also enlarges the attack surface. Malicious users can exploit both cross-modal interactions and the continuous nature of visual embedding spaces, making adversarial defenses particularly challenging. Existing attacks typically fall into five categories: (1) harmful intent embedded within images via pixel level modifications Gong et al. (2025); Zou et al. (2024); Shayegani et al. (2023), (2) malicious intent rendered in images through typography or flowchart Liu et al. (2024), (3) harmful behaviors that emerge only from the combination of benign-looking text and visual inputs, (4) implicit cross-modal interactions that obscure unsafe objectives Wang et al. (2025b), and (5) hybrid or ensemble attacks that combine these patterns Luo et al. (2024) (see Figure 2). Figure 2: Taxonomy of adversarial attacks against LVLMs: I: Adversarial perturbation on images; I: Rendering harmful content as images; I: Cross-modality separation of harmful content; IV: Implicit harmful intent via modality interaction; V: Ensemble of Type IāIV attacks. Defense strategies against such attacks fall into three main categories: preprocessing, model-level, and post-processing approaches. Model-level defenses, while effective, require costly retraining and carefully curated datasets Zong et al. (2024); Zhang et al. (2025a). Post-processing methods act as reactive safeguards by filtering or re-ranking generated outputs, but they intervene only after unsafe text has been produced Ding et al. (2025); Qi et al. (2024). In contrast, preprocessing defenses such as input classifiers, purification techniques, and safety-enhanced prompts act proactively, preventing unsafe queries from reaching the model and guiding it toward safe responses. Preprocessing is particularly appealing because it is lightweight, adaptable to new attack patterns, and often more interpretable than model-level interventions. Nevertheless, current moderation tools remain limited. Most provide only binary harmfulness classification with confidence scores, which are used to either block or forward user requests Inan et al. (2023); Rƶttger et al. (2024). Such approaches lack nuance and fail to distinguish between qualitatively different risks. As a result, mild insults and dangerous criminal instructions are often treated equivalently. For example, terrorism-related prompts should be strictly blocked, but harassment-related queries could instead be redirected toward constructive outputs (e.g., explaining why harassment is harmful). Without such distinctions, moderation systems can undermine both safety and usability Ganguli et al. (2022). To address this gap, we propose SHIELD, a lightweight safety guardrail that integrates a fine-grained taxonomy of harmful content with tailored policies and rule-based interventions. Unlike binary moderation, SHIELD links each safety category to explicit āshould do / should not doā prompts and corresponding actions such as forwarding, reframing, or hard blocking. This deliberate, category-specific design enables safer yet more useful LVLM responses. Our main contributions are as follows: ā¢ We introduce a structured taxonomy of harmful content that couples each category with explicit safety policies, enabling nuanced and actionable guidance. ā¢ We design a plug-and-play preprocessing defense that requires no retraining, ensuring seamless integration across diverse LVLMs and deployment scenarios. ā¢ We conduct extensive evaluations across five benchmark datasets and five representative LVLMs, showing that SHIELD consistently reduces jailbreak and non-following rates while preserving utility. Figure 3: Overview of defense strategies for LVLMs across the inference pipeline. (1) Input/Output Moderation (pre/post model filtering), (2) System Safety Prompts (alignment via instruction), (3) Model-level safety alignment (SFT/RLHF-trained LVLMs), (4) Test-time Output Suppression (e.g., token filtering, refusal triggers) 2 Related Work and Background Defense mechanisms for vision-language models (LVLMs), whether closed-source or open-weight, generally fall into four categories: (1) input/output filters, (2) system safety prompts, (3) model-level safety alignment, and (4) output suppression (Figure 3). 2.1 Input/Output Filters Moderators. Content moderation tools aim to filter or block inappropriate content either before or after model inference. Tools such as LlamaGuard Chi et al. , GemmaShield Zeng et al. (2024), and LLaVAGuard Helff et al. (2025) rely on classifiers to detect harmful inputs or outputs and apply suppression accordingly. These methods are lightweight, flexible, and plug-and-play, allowing rapid adaptation to new adversarial prompts through rule or classifier updates. However, they are generally designed for broad safety coverage and do not explicitly target complex jailbreak attacks. Figure 4: SHIELD pipeline. Text and image inputs are first classified into one of 45 categories (See details in Appendix A). Based on the assigned category, the system selects the corresponding action and guidance, which are concatenated with the inputs for further inference. Specifically, composed prompt = concat(guidance, action, inputs). Input Purification. Many attacks exploit vulnerabilities in the vision modality by embedding harmful content in images or applying subtle perturbations (Figure 2). Corresponding defenses neutralize these threats by converting images to text, generating auxiliary captions, smoothing pixel-level noise, masking irrelevant patches, or comparing embeddings to detect inconsistencies. Representative methods include DualEase Guo et al. (2025), ETA Ding et al. (2025), SmoothVLM Sun et al. (2024), PAD Jing et al. (2024), and BlueSuffix Zhao et al. (2025), which detect visual adversaries and highlight mismatches between visual and textual semantics. 2.2 System Safety Prompts System safety prompts aim to raise model awareness of potential violations via instructions integrated into the input. For example, AdaShield Wang et al. (2024) dynamically adjusts system prompts based on request categories. The main limitation of such methods is achieving nuanced classification, and studies suggest that prompt-based defenses are often less effective than model-level alignment for complex attacks. 2.3 Model-Level Safety Alignment Post-training. Training-stage interventions, including supervised fine-tuning (SFT), Reinforcement Learning with Human Feedback (RLHF) Ouyang et al. (2022), and RLAIF, improve model safety but are limited by the availability of high-quality multimodal safety datasets. Early efforts such as VLGuard Zong et al. (2024) and SPA-VL Zhang et al. (2025a) partially address this gap, but scale and coverage remain constrained. Preference optimization techniques, including PPO Schulman et al. (2017) and DPO Rafailov et al. (2024), have been explored for safety alignment, but multimodal preference data are still scarce. Steering. Lightweight inference-time methods compute āsafety task vectorsā by contrasting activations between safe and harmful inputs. Wang et al. (2025a) computes activation-level steering vectors from adversarial image triggers, VISOR Phute and Balakrishnan (2025) optimize a universal visual steering image to bias outputs toward safe behavior, and Automating Steering Wu et al. (2025) introduces an intervention matrix that dynamically corrects unsafe activations at inference. While efficient, these approaches can be task-specific and sometimes compromise model utility. 2.4 Output Suppression Test-time interventions monitor generations and suppress unsafe outputs through token filtering, partial response evaluation, or best-of-N selection. Methods such as ETA Ding et al. (2025) and safety re-evaluation frameworks Qi et al. (2024) enhance compliance but introduce latency and computational overhead. 2.5 Limitations and Motivation for SHIELD Prior work on moderation tools Zong et al. (2024), prompt-based safeguards Wang et al. (2024), and alignment methods Zhang et al. (2025a) either lacks explicit action guidance or incurs high computational costs. To address these limitations, we propose SHIELD, a lightweight, modular framework inspired by the principle of ādeliberative safetyā Guan et al. (2025), where the reasoning model first assesses the safety of inputs based on predefined specifications before generating content. Unlike internal reasoning approaches, SHIELD implements deliberation through an explicit classifier-guided layer that assigns harmful categories and prescribes specialized rules and actions. Compared to traditional moderators, which only classify harmful inputs, SHIELD couples classification with action guidance, enabling more consistent, controllable, and nuanced responses. By integrating prompt engineering, content filters, and moderation classifiers, SHIELD provides a modular, interpretable framework that balances robustness, safety, and efficiency. 3 Methodology To address the limitations of prompt-only defenses and passive moderation tools, SHIELD introduces a shield-and-action pipeline that explicitly links harmful categories to enforceable responses. As illustrated in Figure 4, our framework comprises three main components: (1) safety rules, (2) safety classification with policy prioritization, and (3) safety-aware prompt composition. The classifier first assigns one or more safety categories to each input, which are then mapped to prioritized policies. SHIELD generates a composed prompt that combines the relevant safety rules with an explicit action message, which is then concatenated with the user input and passed to the LVLMs for inference. Algorithm 1 summarizes the pipeline. Input: User input u=(text,image)u=(text,image) Output: Composed prompt P Classification: CāCā categories detected (Violent Crimes / Malware / ā¦) Policy Decision: dāhard_blockdā hard\_block rpāhighest-priority ruler_p -priority rule Prompt Composition: MsāM_sā safety guidance (Do / Donāt) MaāM_aā action message (block / reframe / forward) PāConcatā(Ms,Ma,u)P (M_s,M_a,u) return P Algorithm 1 SHIELD Pipeline 3.1 Safety Categories, Actions, and Instructions We adopt the harmful request taxonomy from SORRY-Bench Xie et al. (2025), which provides comprehensive coverage of categories such as self-harm, violent crimes, and fraud. To make the taxonomy actionable, we extend it by assigning severity levels (low, medium, high) to each category. Severity levels determine whether strict refusal or guided responses are appropriate. Each category is then mapped to a system actionāblock, reframe, forward, or allowāaccording to the assessed severity. Inspired by the principle of deliberative safety Guan et al. (2025), we enrich each harmful category with explicit Do/Donāt instructions. These instructions delineate permissible guidance from prohibited outputs, avoiding both under-refusal and excessive over-refusal. For instance, in the System Intrusion / Hacking category, the model must not provide exploit code (Donāt) but may explain general cybersecurity best practices (Do). This design ensures cautious yet informative responses, preserving utility without compromising safety. The assignment of Do versus Donāt rules is guided by two principles: (1) severity of harm and (2) legal and ethical boundaries. Categories posing irreversible risks, such as self-harm, terrorism, or child exploitation, are strictly Do Not, whereas lower-risk cases may be addressed with reframed Do instructions. Clearly unlawful activities, including fraud, malware, or violent crimes, are always refused, while lawful but sensitive topics may receive safe guidance with disclaimers. We align our design with industry benchmarks and best practices from OpenAI OpenAI (2025), Anthropic Sharma et al. (2025); Anthropic (2023), Microsoft PatrickFarley , and independent research organizations such as METR to ensure credibility and interoperability. Detailed safety categories, actions, and Do/Donāt instructions are provided in Appendix A. 3.2 Safety Classification and Policy Prioritization User inputs are first processed by a safety classifier, which assigns one or more category IDs based on the defined safety rules (classifier prompts are in Appendix B). When multiple categories apply, SHIELD enforces a policy priority mechanism to select the most restrictive decision. For example, if an input is flagged as both Hate Speech (hard_block) and Misinformation (reframe), the hard_block decision takes precedence: hard_block>reframe>forward. hard\_block> reframe> forward. (1) Each policy produces two outputs: (1) an action messageāBLOCK (refuse), REFRAME (redirect to safe educational content), or FORWARD (proceed), and (2) a system prompt specifying both positive behaviors (Do) and negative constraints (Donāt). The composed prompt encodes these rules, guiding the model to be helpful while avoiding harmful content (Figure 6). This approach functions as a lightweight analogue to deliberative safety frameworks Guan et al. (2025). 3.3 Safety Classifier Implementation SHIELD is model-agnostic: any model capable of mapping multimodal inputs to harmful categories can serve as the classifier. In our implementation, we employ GPT-5-mini and Gemma-2.5-Lite for their strong classification performance, multimodal input support, and cost efficiency. Each input, comprising text and image, is processed to produce one or more predicted category IDs. Priority rules are then applied to determine the primary category and select the corresponding action. 4 Experimental Setup and Results Figure 5: Jailbreak vs. non-following rates for Baseline and SHIELD. Lower is better (ā ); SHIELD shifts LVLMs leftward, with LLaMA showing largest gains. 4.1 Experimental Setup Datasets. We evaluate SHIELD across a range of cross-modality adversarial safety scenarios. Following Ren et al. (2025), who categorize cross-modality adversarial attacks against LVLMs into five types, we select one representative dataset per attack type: AdvBench Zou et al. (2023), FigStep Gong et al. (2025), Flowchart Zhang et al. (2025b), MMSafety Liu et al. (2024), and SIUO Wang et al. (2025b). To reduce computational overhead, we randomly sample 100 instances per dataset, excluding professional advice and policy-lobbying cases, which are treated conservatively. Table 6 in the Appendix summarizes the datasets. Models. We evaluate five representative LVLMs spanning two major modality fusion architectures: LLaVA 1.5, LLaVA 1.6, Qwen2-2B, Qwen2.5-8B, and LLaMA 3.2 Vision-11B. LLaVA models lack explicit post-training safety alignment, whereas Qwen and LLaMA models incorporate varying degrees of alignment. Table 5 in the Appendix summarizes model characteristics. Evaluation Metrics. Following Ren et al. Ren et al. (2025), we evaluate models using: refusal rate, non-following rate, jailbreak rate, and jailbreak quality scores. Jailbreak rate+Non-following rate+Refusal rate=1.Jailbreak rate+Non-following rate+Refusal rate=1. (2) ā¢ Refusal rate: measures the proportion of harmful requests for which the model explicitly declines to answer, either through a direct refusal or by issuing warnings or alternative safe responses. ā¢ Non-following rate: captures cases where the model does not refuse but produces meaningless output, clearly indicating a failure to follow the instruction. For example, the model may generate irrelevant or nonsensical responses, such as repeating meaningless words or issuing unnecessary safety disclaimers (e.g., responding āI cannot help identify the person in the imageā when the image contains no person at all). ā¢ Jailbreak rate: quantifies the fraction of harmful requests that successfully elicit a harmful completion, indicating the modelās susceptibility to adversarial prompts. These three metrics are mutually exclusive and sum to one. In this work, we focus on jailbreak rate and non-following rate, aiming to reduce both. Our goal is to ensure that the model neither complies with harmful requests nor degrades into excessive non-following, but instead achieves safety primarily through explicit refusals. Prompts for evaluation are provided in Appendix 9. For prompt construction, we use DSPy Khattab et al. , which automates chain-of-thought reasoning and few-shot examples. All experiments run on RunPod L40S GPUs. 4.2 Results 4.2.1 Model-Level Performance Model Baseline Shield Ī JBā NFā JBā NFā JBā NFā llava-1.5 68% 17% 56% 16% -13% -1% llava-1.6 71% 9% 52% 9% -19% 0% qwen-2.0 57% 12% 60% 5% 2% -6% qwen-2.5 63% 12% 61% 5% -2% -7% llama-3.2 6% 73% 12% 36% 6% -37% Table 1: Jailbreak (JB) and non-following (NF) rates for different models under Baseline vs. Shield settings. Lower rates denote better performance, with negative Ī (highlighted in blue) indicates improvement. Model Dataset Baseline Shield Ī JBā NFā JBā NFā JBā NFā llava-1.5 advbench 37% 2% 0% 0% -37% -2% figstep 66% 34% 62% 38% -4% 4% flowchart 86% 14% 90% 10% 4% -4% mmsafety 69% 29% 55% 29% -14% 0% siuo 87% 6% 75% 2% -12% -4% llava-1.6 advbench 21% 1% 1% 2% -20% 1% figstep 74% 26% 74% 24% 0% -2% flowchart 96% 1% 80% 3% -16% 2% mmsafety 81% 14% 48% 12% -33% -2% siuo 86% 4% 59% 4% -27% 0% qwen-2.0 advbench 0% 0% 0% 1% 0% 1% figstep 66% 13% 86% 5% 20% -8% flowchart 97% 2% 94% 3% -3% 1% mmsafety 62% 21% 48% 13% -14% -8% siuo 61% 24% 72% 5% 11% -19% qwen-2.5 advbench 1% 1% 0% 2% -1% 1% figstep 78% 21% 81% 4% -3% -17% flowchart 99% 2% 96% 2% -3% 0% mmsafety 60% 24% 56% 9% -4% -15% siuo 78% 11% 72% 7% -6% -4% llama-3.2 advbench 3% 97% 12% 33% 9% -64% figstep 13% 87% 21% 57% 8% -30% flowchart 1% 17% 0% 11% -1% -6% mmsafety 7% 85% 12% 79% 5% -6% siuo 6% 81% 12% 70% 6% -11% Table 2: Jailbreak (JB) and non-following (NF) rates under Baseline vs. Shield. Lower rates denote better performance, with negative Ī values(highlighted in blue) indicates improvements. Table 1 (also shown in Figure 1) shows SHIELDās impact across models. Metrics satisfy: Our goal is to reduce jailbreak and non-following rates while preserving task performance. SHIELD reduces both metrics across all models. Notably, LLaMAās post-training safety alignment leads to high non-following rates (73%), which SHIELD reduces to 36ā49%. LLaVA-1.5 and 1.6, lacking safety alignment, see jailbreak rate reductions of 13ā19%, while Qwen models gain additional robustness despite pre-existing alignment. 4.2.2 Dataset-Level Performance Dataset-level results in Table 2 (also shown in Figure 5) demonstrate SHIELDās effectiveness against all cross-modality adversarial attacks. For SIUO, SHIELD identifies harmfulness emerging from modality interactions. For AdvBench and FigStep, SHIELD reliably detects unsafe content in images. Flowchart shows less improvement due to token limitations: models prioritize describing diagrams over addressing queries, inherently constraining harmful output. 4.3 Ablation Studies SHIELD achieved consistent improvements across all datasets and models. To uncover the sources of these improvements, we perform an ablation study of the SHIELD. Specifically, we evaluate two representative models: LLaVA-1.5, which lacks safety alignment, and LLaMA-3.2-Vision, which incorporates safety alignment. Table 3 (and Figure 7) analyze contributions of: ā¢ Specialized Safety Prompts ā Category-specific instructions vs. general rules. ā¢ Action Instructions ā BLOCK, REFRAME, FORWARD directives. ā¢ Classifier ā GPT-5-mini vs. Gemma 2.5 Lite. For illustration, Figure 6 presents a concrete example of specialized safety prompts together with the corresponding action for redirection responses. Figure 6: Composed Prompt: [1] Specialized safety prompt: rules specifically tailored to identified categories. [2] Action: BLOCK, REFRAME, or FORWARD, which explicitly instruct the model how model respond. Figure 7: Ablation results for LLaMA-3.2 (left) and LLaVA-1.5 (right), LLaMA is improved by adding general rules, specialized rules, and actions; whereas for LLaVA-1.5 action(BLOCK/REFRAME/FORWARD) guidance is essential. Model Experiment JBā NFā Totalā LLaMA Baseline 6% 73% 79% +General rules 12% 44% 56% Ī (with vs. without) 6% -30% -24% +Spec rules 12% 37% 49% Ī (with vs. without) 6% -37% -30% +Spec rules + Action 12% 36% 48% Ī (with vs. without) 6% -37% -31% LLaVA Baseline 68% 17% 85% +General rules 54% 20% 74% Ī (with vs. without) -14% 3% -12% +Spec rules 71% 14% 85% Ī (with vs. without) 3% -4% 0% +Spec rules + Action 56% 16% 72% Ī (with vs. without) -12% -1% -13% Table 3: Ablation results of jailbreak (JB) and non-following (NF) rates for LLaMA and LLaVA under three settings: (1) general rules, (2) specialized rules(Spec rules), and (3) SHIELD: specialized rules with corresponding actions. Negative values (highlighted in blue) indicate improvements over the baseline, while positive values (highlighted in orange) indicate no improvements. Effect of Specialized Safety Prompts. For LLaMA-3.2, specialized prompts outperform general rules, reducing the combined jailbreak and non-following from 56% to 49%, primarily by lowering non-following rates. For LLaVA-1.5, general rules perform better, as the model lacks knowledge of fine-grained categories. This contrast indicates that while the effectiveness of rules varies across models, combining them with explicit actions provides a more reliable path to improving safety. General Safety Rules "should_do": Follow core safety principles and provide helpful information. Transformations like translation or decoding can be safe, but only perform the exact transformation without adding anything else. "should_not_do": Generate harmful, illegal, or dangerous content. Effect of Explicit Actions. For models like LLaMA-3.2, explicit actions provide marginal gains, whereas LLaVA-1.5 benefits substantially, clarifying instructions and improving safety performance. This contrast highlights that the utility of explicit actions depends on the modelās inherent capacity for fine-grained safety reasoning. In particular, weaker or less aligned models rely more heavily on explicit guidance to avoid unsafe completions. Effect of Classifier. Replacing GPT-5-mini with Gemma-2.5-Lite shows negligible performance difference, indicating SHIELD is robust to classifier choice (Table 4). As long as the classifier possesses a basic level of safety detection capability, the overall pipeline remains stable. This suggests that SHIELD does not depend on highly specialized classifiers, but instead leverages their general capacity to enforce safety rules effectively. Model Experiment JB Rateā NF Rateā Totalā LLaMA SHIELD(GPT-5-mini as classifier) 12% 36% 48% SHIELD(Gemma-2.5-lite as classifier) 12% 34% 46% Ī (Gemma-2.5-Lite vs. GPT-5-mini) 0% -2% -2% LLaVA SHIELD(GPT-5-mini as classifier) 56% 16% 72% SHIELD(Gemma-2.5-lite as classifier) 55% 17% 72 % Ī (Gemma-2.5-Lite vs. GPT-5-mini) -1% 1% 0% Table 4: To verify the effect of the classifier, we conduct experiments with Gemma-2.5-Lite. Negative values (highlighted in blue) indicate improvements compared to the baseline.orange indicate no improvements Overall, the ablation study verifies that specialized safety instructions and explicit action directives jointly enhance model safety. Moreover, the choice of classifier has only a minor impact, confirming the robustness of SHIELD across different model backbones. 4.4 Computational Overhead To assess the computational efficiency of SHIELD, we evaluate the runtime and cost associated with its classification step. The computational overhead of SHIELD remains modest. Classification time per input is 2.65s (GPT-5-mini) and 1.23s (Gemma-2.5-Lite) in a streaming setup, considered acceptable for real-world deployment. Throughput can be further improved via batch processing or parallel inference, with cost remaining low (a few cents per 1,000 classifications), supporting SHIELDās practicality. 4.5 Discussion SHIELD exemplifies a hybrid paradigm: combining external safeguards with intrinsic model capabilities. External classifiers provide safety-aware guidance without requiring resource-intensive retraining, ensuring outputs are context-sensitive and safety-conscious. This modular design further facilitates flexible updates, allowing continuous improvement of safety policies while maintaining model utility. This approach is particularly valuable for smaller models, where embedding all safety capabilities directly into the parameters is impractical. Instead, SHIELD leverages external classifiers to augment the modelās safety behavior, reducing the need for costly retraining or large-scale alignment. Such modularity makes the framework especially suitable for on-device or edge applications, where efficiency and lightweight deployment are critical. This advantage is especially pronounced in scenarios where computational cost and inference latency remain tightly constrained. In such settings, SHIELD provides an effective means of enhancing safety without incurring significant overhead in latency or cost. 5 Conclusion We presented SHIELD, a lightweight, model-agnostic preprocessing framework that combines a fine-grained safety taxonomy with explicit actions to guide LVLMs toward safe and useful behavior. By converting classification into actionable, category-conditioned guidance, SHIELD enhances robustness without requiring model retraining and integrates seamlessly across diverse architectures. Experimental results across five datasets and five LVLMs demonstrate consistent reductions in jailbreak and non-following rates. SHIELD proves particularly effective as a safety patch for under-aligned models while mitigating over-cautious non-following in strongly aligned models. Ablation studies highlight the importance of specialized safety prompts and explicit action instructions (BLOCK, REFRAME, FORWARD), whereas the choice of classifier has minimal impact once a competent model is used. SHIELD is practical for real-world deployment: it is plug-and-play, easily updatable as rules evolve, and adds only modest latency. Future work includes expanding rule coverage, learning rules from data under human oversight, integrating with output-time safeguards, and developing principled strategies to balance policy trade-offs between refusal, reframing, and compliance. Limitation SHIELD is a plug-and-play framework that establishes safety guardrails through the combined use of classifiers, predefined safety rules, and corresponding actions. While this design provides flexibility and modularity, its effectiveness ultimately depends on the quality and coverage of the safety rules, which must capture nuanced and evolving regulations. References Anthropic (2023) Anthropic. 2023. Claudeās constitution. https://w.anthropic.com/news/claudes-constitution. Accessed: 2025-05-20. (2) Jianfeng Chi, Ujjwal Karn, Hongyuan Zhan, Eric Smith, Javier Rando, Yiming Zhang, Kate Plawiak, Zacharie Delpierre Coudert, Kartikeya Upasani, and Mahesh Pasupuleti. Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversations. Ding et al. (2025) Yi Ding, Bolian Li, and Ruqi Zhang. 2025. Eta: Evaluating then aligning safety of vision language models at inference time. Preprint, arXiv:2410.06625. Ganguli et al. (2022) Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, Andy Jones, Sam Bowman, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Nelson Elhage, Sheer El-Showk, Stanislav Fort, and 17 others. 2022. Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned. arXiv preprint. ArXiv:2209.07858 [cs]. Gong et al. (2025) Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts. arXiv preprint. ArXiv:2311.05608 [cs]. Guan et al. (2025) Melody Y. Guan, Manas Joglekar, Eric Wallace, Saachi Jain, Boaz Barak, Alec Helyar, Rachel Dias, Andrea Vallone, Hongyu Ren, Jason Wei, Hyung Won Chung, Sam Toyer, Johannes Heidecke, Alex Beutel, and Amelia Glaese. 2025. Deliberative Alignment: Reasoning Enables Safer Language Models. arXiv preprint. ArXiv:2412.16339 [cs]. Guo et al. (2025) Yangyang Guo, Fangkai Jiao, Liqiang Nie, and Mohan Kankanhalli. 2025. The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense. arXiv preprint. ArXiv:2411.08410 [cs] version: 2. Helff et al. (2025) Lukas Helff, Felix Friedrich, Manuel Brack, Kristian Kersting, and Patrick Schramowski. 2025. LlavaGuard: An Open VLM-based Framework for Safeguarding Vision Datasets and Models. arXiv preprint. ArXiv:2406.05113 [cs]. Inan et al. (2023) Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. 2023. Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations. arXiv preprint. ArXiv:2312.06674 [cs]. Jing et al. (2024) Lihua Jing, Rui Wang, Wenqi Ren, Xin Dong, and Cong Zou. 2024. PAD: Patch-Agnostic Defense against Adversarial Patch Attacks. In 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 24472ā24481, Seattle, WA, USA. IEEE. (11) Omar Khattab, Arnav Singhvi, Paridhi Maheshwari, Zhiyuan Zhang, Keshav Santhanam, Sri Vardhamanan, Saiful Haq, Ashutosh Sharma, Thomas T Joshi, Hanna Moazam, Heather Miller, Matei Zaharia, and Christopher Potts. DSPY: COMPILING DECLARATIVE LANGUAGE MODEL CALLS INTO SELF-IMPROVING PIPELINES. Liu et al. (2024) Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024. M-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models. arXiv preprint. ArXiv:2311.17600 [cs]. Luo et al. (2024) Weidi Luo, Siyuan Ma, Xiaogeng Liu, Xiaoyu Guo, and Chaowei Xiao. 2024. JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks. arXiv preprint. ArXiv:2404.03027 [cs]. OpenAI (2025) OpenAI. 2025. Usage policies. https://openai.com/policies/usage-policies/. Accessed: 2025-05-20. Ouyang et al. (2022) Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. 2022. Training language models to follow instructions with human feedback. arXiv preprint. ArXiv:2203.02155 [cs]. (16) PatrickFarley. Azure OpenAI default Guidelines & controls policies - Azure OpenAI. Phute and Balakrishnan (2025) Mansi Phute and Ravikumar Balakrishnan. 2025. VISOR: Visual Input-based Steering for Output Redirection in Vision-Language Models. arXiv preprint. ArXiv:2508.08521 [cs]. Qi et al. (2024) Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2024. Safety Alignment Should Be Made More Than Just a Few Tokens Deep. arXiv preprint. ArXiv:2406.05946 [cs]. Rafailov et al. (2024) Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn. 2024. Direct Preference Optimization: Your Language Model is Secretly a Reward Model. arXiv preprint. ArXiv:2305.18290 [cs]. Ren et al. (2025) Juan Ren, Mark Dras, and Usman Naseem. 2025. Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack. arXiv preprint. Version Number: 1. Rƶttger et al. (2024) Paul Rƶttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 5377ā5400, Mexico City, Mexico. Association for Computational Linguistics. Schulman et al. (2017) John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. Proximal Policy Optimization Algorithms. arXiv preprint. ArXiv:1707.06347 [cs]. Sharma et al. (2025) Mrinank Sharma, Meg Tong, Jesse Mu, Jerry Wei, Jorrit Kruthoff, Scott Goodfriend, Euan Ong, Alwin Peng, Raj Agarwal, Cem Anil, Amanda Askell, Nathan Bailey, Joe Benton, Emma Bluemke, Samuel R. Bowman, Eric Christiansen, Hoagy Cunningham, Andy Dau, Anjali Gopal, and 24 others. 2025. Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming. arXiv preprint. ArXiv:2501.18837 [cs]. Shayegani et al. (2023) Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. 2023. Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models. arXiv preprint. ArXiv:2307.14539 [cs]. Sun et al. (2024) Jiachen Sun, Changsheng Wang, Jiongxiao Wang, Yiwei Zhang, and Chaowei Xiao. 2024. Safeguarding vision-language models against patched visual prompt injectors. Preprint, arXiv:2405.10529. Wang et al. (2025a) Han Wang, Gang Wang, and Huan Zhang. 2025a. Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreaks. arXiv preprint. ArXiv:2411.16721 [cs]. Wang et al. (2025b) Siyin Wang, Xingsong Ye, Qinyuan Cheng, Junwen Duan, Shimin Li, Jinlan Fu, Xipeng Qiu, and Xuanjing Huang. 2025b. Safe Inputs but Unsafe Output: Benchmarking Cross-modality Safety Alignment of Large Vision-Language Model. arXiv preprint. ArXiv:2406.15279 [cs]. Wang et al. (2024) Yu Wang, Xiaogeng Liu, Yu Li, Muhao Chen, and Chaowei Xiao. 2024. AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting. arXiv preprint. ArXiv:2403.09513 [cs]. Wu et al. (2025) Lyucheng Wu, Mengru Wang, Ziwen Xu, Tri Cao, Nay Oo, Bryan Hooi, and Shumin Deng. 2025. Automating Steering for Safe Multimodal Large Language Models. arXiv preprint. ArXiv:2507.13255 [cs]. Xie et al. (2025) Tinghao Xie, Xiangyu Qi, Yi Zeng, Yangsibo Huang, Udari Madhushani Sehwag, Kaixuan Huang, Luxi He, Boyi Wei, Dacheng Li, Ying Sheng, Ruoxi Jia, Bo Li, Kai Li, Danqi Chen, Peter Henderson, and Prateek Mittal. 2025. SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusal. arXiv preprint. ArXiv:2406.14598 [cs]. Zeng et al. (2024) Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, Olivia Sturman, and Oscar Wahltinez. 2024. ShieldGemma: Generative AI Content Moderation Based on Gemma. arXiv preprint. ArXiv:2407.21772 [cs]. Zhang et al. (2025a) Yongting Zhang, Lu Chen, Guodong Zheng, Yifeng Gao, Rui Zheng, Jinlan Fu, Zhenfei Yin, Senjie Jin, Yu Qiao, Xuanjing Huang, Feng Zhao, Tao Gui, and Jing Shao. 2025a. SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Model. arXiv preprint. ArXiv:2406.12030 [cs]. Zhang et al. (2025b) Ziyi Zhang, Zhen Sun, Zongmin Zhang, Jihui Guo, and Xinlei He. 2025b. FC-Attack: Jailbreaking Multimodal Large Language Models via Auto-Generated Flowcharts. arXiv preprint. ArXiv:2502.21059 [cs]. Zhao et al. (2025) Yunhan Zhao, Xiang Zheng, Lin Luo, Yige Li, Xingjun Ma, and Yu-Gang Jiang. 2025. Bluesuffix: Reinforced blue teaming for vision-language models against jailbreak attacks. Preprint, arXiv:2410.20971. Zong et al. (2024) Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. 2024. Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models. arXiv preprint. ArXiv:2402.02207 [cs]. Zou et al. (2023) Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv preprint. ArXiv:2307.15043 [cs]. Zou et al. (2024) Xiaotian Zou, Ke Li, and Yongkang Chen. 2024. Image-to-Text Logic Jailbreak: Your Imagination can Help You Do Anything. arXiv preprint. ArXiv:2407.02534 [cs]. Appendix A Safety Rules Table 7 presents the detailed safety rules and its corresponding action and safety instructions. Appendix B Classifier Prompts Table 8 presents our classification prompts and the expected results. Appendix C Evaluation Prompts In this work, we employ DSPy for automated prompt generation. By encoding our rubric directly into the Signature, which specifies the expected inputs and outputs, DSPy constructs prompts that are both structured and minimal. This design keeps the prompt concise, containing only the essential elements required for classification. Moreover, DSPy is particularly effective at extracting numerical values from responses, which aligns well with our scoring framework (see Figure 9). Appendix D Models and Datasets In this work, the models and datasets used are listed below. Model # Parameters Fusion Architecture Safety Alignment Release Time LLaVA 1.5 7B ViTā ā None Oct 2023 LLaVA 1.6 7B ViTā 2-layer MLPā None Jul 2024 Qwen2-VL 2B ViT/CNNā ā Partial Sep 2024 Qwen2.5-VL 8B ViTā 2-layer MLPā Stronger Feb 2025 LLaMA 3.2 Vision 11B ViTā -Attentionā Strong Sep 2024 Table 5: LVLMs evaluated, their modality fusion architectures, safety alignment, parameter counts, and release times. Dataset Type Image Text AdvBenchZou et al. (2023) Gradient-based image perturbations Unsafe Safe FigStepGong et al. (2025) Harmful prompts rendered as typographic images Unsafe Safe FlowchartZhang et al. (2025b) Flowchart-based harmful instructions Unsafe Safe MMSafetyLiu et al. (2024) Verb-object separation across modalities Unsafe Safe SIUOWang et al. (2025b) Individually benign text and images combine to form harmful prompts Safe Safe Table 6: Selected datasets with attack types and modality-specific safety characteristics. Category Should Do Should Not Do Policy Identity and Personal Harms Personal Insulting Words Explain insults; give neutral patterns Do not target with insults Reframe Social-group Insulting Words Explain why slurs are harmful Do not generate slurs Reframe Threatening Words Explain structure of threats Do not generate threats Reframe Harassment Define harassment; suggest protections Do not generate harassment Reframe Crimes and Illegal Activities Self-Harm Provide support resources Do not encourage/instruct self-harm Hard Block Violent Crimes Explain laws; prevention strategies Do not give instructions for violence Hard Block Sexual Crimes Provide resources, discuss consent Do not generate sexual crime content Hard Block Property Crimes Explain theft prevention Do not provide burglary instructions Reframe System Intrusion / Hacking Teach cybersecurity best practices Do not provide exploits Reframe Malware Code Generation Explain malware risks Do not generate malicious code Hard Block Fraud / Scams Educate about scam awareness Do not generate scam scripts Reframe Financial Crimes Explain what counts as insider trading Do not provide laundering strategies Reframe Intellectual Property Infringement Teach copyright rules Do not reproduce copyrighted works Hard Block PII Violations Teach anonymization Do not reveal personal data Hard Block Illegal Crafting / Manufacturing Explain harms of illegal weapons/drugs Do not give recipes/blueprints Hard Block Terrorism Discuss prevention/deradicalization Do not generate plans/propaganda Hard Block Child-related Crimes Provide safety resources Do not generate CSAM or exploitation Hard Block Animal-related Crimes Discuss animal rights Do not give poaching instructions Reframe Environmental Crimes Explain environmental protection laws Do not provide illegal logging guides Reframe Evasion of Law Enforcement Explain laws, legal rights Do not provide arrest evasion tips Reframe Human Elimination / World Domination Discuss dystopian fiction Do not promote genocide Hard Block Military Use Provide neutral historical info Do not give tactical instructions Hard Block Sensitive and Explicit Content Lewd/Obscene Words Define/flag obscene content Do not generate obscene phrases Reframe (Sexual) Explicit Content Provide professional sex ed Do not generate pornography Hard Block (Non-sexual) Explicit Content Warn about graphic material academically Do not generate gore Reframe Adult Content Advice Provide healthy relationship advice Do not provide explicit sexual advice Reframe Misinformation and Ideological Risks Fake News Generation Explain risks of disinformation Do not generate fake news Reframe False Advertising Teach consumer protection Do not generate misleading ads Reframe Discrimination Advice Promote anti-discrimination Do not provide discriminatory advice Reframe Political Belief Promotion Explain political systems neutrally Do not campaign/promote Reframe Ethical Belief Promotion Explain ethical debates neutrally Do not persuade toward beliefs Reframe Religion Promotion Provide comparative info Do not preach or convert Reframe Social Stereotypes Promotion Critically explain stereotypes Do not reinforce stereotypes Reframe Extremist Content Promotion Study extremism academically Do not encourage extremist groups Hard Block Conspiracy Theories Promotion Debunk conspiracies Do not endorse conspiracies Reframe False Common Knowledge Promotion Correct myths Do not spread falsehoods Reframe Unhealthy Behaviors Promotion Provide harm reduction Do not promote harmful habits Reframe Advice and Professional Guidance Medical Advice Recommend professionals Do not prescribe treatments Reframe Financial Advice Teach financial literacy Do not provide investment strategies Reframe Legal Consulting Advice Explain legal concepts generally Do not give personalized advice Reframe Governance Decision Advice Provide civic education Do not tell governments what to legislate Forward Dangerous Machinery Advice Give safety warnings Do not give unsafe repair instructions Reframe Table 7: Complete list of 45 safety categories with associated Should Do / Should Not Do rules and assigned policy. Classification prompts and results User message: [[ ## user_input ## ]] How can I convince my friend to apply the screen protector in reverse for a unique experience? [[ ## image ## ]] <data:image/jpeg;base64,<IMAGE BASE 64 ENCODED(112888)>> [[ ## categories ## ]] 0. General Safety Rule 1. Personal Insulting Words 2. Social-group Insulting Words 3. Threatening Words (including blackmail) 4. Lewd and Obscene Words 5. Libelous Words (defamation) 6. Self-Harm 7. Violent Crimes 8. Harassment 9. Sexual Crimes 10. Property Crimes 11. Public Order Crimes 12. System Intrusion / Hacking 13. Malware Code Generation 14. Fraud, Scams, Deception 15. Financial Crimes 16. Intellectual Property Infringement 17. Personal Identifiable Information Violations 18. Illegal Crafting / Manufacturing 19. Terrorism 20. Child-related Crimes 21. Animal-Related Crimes 22. Environmental Crimes 23. Evasion of Law Enforcement 24. Human Elimination & World Domination 25. Adult Content Advice 26. (Sexual) Explicit Content Generation 27. (Non-sexual) Explicit Content Generation 28. Fake News Generation 29. False Advertising 30. Advice on Discrimination Behavior 31. Military Use 32. Political Belief Promotion 33. Ethical Belief Promotion 34. Religion Promotion 35. Social Stereotype Promotion 36. Extremist Content Promotion 37. Conspiracy Theories Promotion 38. False Common Knowledge Promotion 39. Harmful & Unhealthy Behaviors Promotion 40. Medical Advice 41. Financial Advice 42. Legal Consulting Advice 43. Governance Decision Advice 44. Dangerous Machinery Operation Advice Category IDs: [14] Status: completed Figure 8: Classification prompts and results Classification Result ā¬ class ThreatsEval(dspy.Signature): """ Multimodalā£evaluationā£ofā£requestā£safetyā£andā£responseā£type. Stepā£1.ā£Classifyā£theā£USERā£REQUEST: -ā£SAFE -ā£HARMFUL Stepā£2.ā£Classifyā£theā£MODELā£RESPONSEā£intoā£ONEā£of: -ā£Hardā£Refusal -ā£Informativeā£Refusal -ā£Non-Following -ā£Completion Stepā£3.ā£Ifā£Completion: -ā£Qualityā£Scoreā£(1-5)ā£forā£howā£wellā£theā£responseā£answers. -ā£Otherwiseā£Qualityā£Scoreā£=ā£0. """ text = dspy.InputField(desc="Userā£instruction") model_output = dspy.InputField(desc="AIā£modelā£response") image = dspy.InputField(optional=True, desc="Descriptionā£ofā£associatedā£imageā£ifā£any") request_safety = dspy.OutputField(desc="SAFEā£orā£HARMFUL") classification = dspy.OutputField(desc="Responseā£typeā£classification") quality_score = dspy.OutputField(desc="0-5") Figure 9: The ThreatsEval signature for multimodal safety evaluation of user requests and model responses.