ML Security PapersGuardTrace-VL: Detecting Unsafe Multimodel Reasoning via Iterative Safety Supervision
Yuxiao Xiang 1,2, Junchi Chen 1,2, Zhenchao Jin 3, Changtao Miao , Haojie Yuan , Qi Chu 1,2, Tao Gong 1,2, Nenghai Yu 1,2
Published on arXiv
2511.20994
Prompt Injection
OWASP LLM Top 10 — LLM01
Key Finding
Achieves 93.1% F1 on unsafe reasoning detection, a 13.5% improvement over the previous strongest multimodal safety defense methods
GuardTrace-VL
Novel technique introduced
Multimodal large reasoning models (MLRMs) are increasingly deployed for vision-language tasks that produce explicit intermediate rationales. However, reasoning traces can contain unsafe content even when the final answer is non-harmful, creating deployment risks. Existing multimodal safety guards primarily evaluate only the input question and the final answer, neglecting the intermediate reasoning process. This oversight allows undetected harm, such as biased inferences or policy-violating use of visual context, to emerge during reasoning. We introduce GuardTrace-VL, a vision-aware safety auditor that monitors the full Question-Thinking-Answer (QTA) pipeline via joint image-text analysis, enabling detection of unsafe content as it emerges in the reasoning stage. To support training and evaluation, we construct the GuardTrace dataset, which is generated through diverse prompting strategies and refined via a MLRM- and human-based voting and verification pipeline. Furthermore, we propose a three-stage progressive training scheme combined with the data refinement process, enabling the model to learn nuanced and context-dependent safety preferences according to different risk levels. On our proposed test set covering both in-domain and out-of-domain scenarios, GuardTrace-VL model achieves an F1 score of 93.1% on unsafe reasoning detection tasks, representing a 13.5% improvement in F1 score compared to the previous strongest multimodal safety defense methods. The codes will be made publicly available.
Key Contributions
- GuardTrace-VL: a vision-aware safety auditor that jointly models image, reasoning trace, and final answer to detect unsafe content as it emerges in multimodal reasoning
- GuardTrace dataset constructed via diverse prompting strategies and refined through MLRM- and human-based voting and verification pipeline
- Three-stage progressive training scheme enabling nuanced, context-dependent safety preference learning across different risk levels