You can deploy this model and start earning money today!

zrwang1211/
SafeAtlas-Guard-2B

Name: SafeAtlas-Guard-2B
Availability: InStock

multimodal-safety

vision-language

ordinal-classification

safety-moderation

Qwen/Qwen3-VL-2B-Instruct

finetune

Views

No views yet

SafeAtlas Guard 2B

SafeAtlas Guard 2B is a target-conditioned multimodal safety model introduced in SafeAtlas-VL: Beyond Binary Multimodal Safety with Large-Scale Data and Guard Models. It evaluates image content, image-grounded user requests, and assistant responses.

The model returns:

one of five ordered safety levels;
a continuous risk score from 0 to 100;
three auxiliary safety-judge predictions for request and response targets.

Resources

Paper: SafeAtlas-VL
Code: github.com/zrwang1211/SafeAtlas-VL
Dataset: zrwang1211/SafeAtlas-VL
Model collection: SafeAtlas Guard

Installation

bash

git clone https://github.com/zrwang1211/SafeAtlas-VL.git
cd SafeAtlas-VL
pip install -e .

Quickstart

python

from ordinal_safety_vlm import SafetyPredictor

predictor = SafetyPredictor(
    "zrwang1211/SafeAtlas-Guard-2B",
    device_map="auto",
    dtype="bfloat16",
)

result = predictor.predict(
    image="examples/example.jpg",
    target_name="response",
    request="What fruit is shown in the image?",
    response="The image shows a red apple.",
)

print(result.safety_label)  # safe core
print(f"{result.risk_score:.2f}")
print(result.teacher_predictions)  # {'judge1': 'safe', 'judge2': 'safe', 'judge3': 'safe'}

The image may be a local path, pathlib.Path, or PIL.Image.Image.

Prediction fields

Field	Description
`safety_label`	Predicted five-level safety label.
`risk_score`	Expected ordinal level mapped linearly to 0–100.
`z`	Scalar latent risk value before the learned thresholds.
`thresholds`	Four learned monotonic ordinal thresholds.
`ordinal_probs`	Cumulative probabilities of exceeding each ordinal threshold.
`class_probs`	Probability distribution over the five levels.
`category`	Predicted harm category or `none`.
`category_probs`	Probability distribution over 16 category labels.
`teacher_predictions`	Auxiliary teacher-head predictions.
`teacher_probs`	Auxiliary teacher-head probability distributions.

The five ordered labels are safe core, safe leaning disputed, boundary uncertain, unsafe leaning disputed, and unsafe core. Teacher-head outputs are defined for request and response targets.

Model architecture and training

SafeAtlas Guard 2B uses Qwen3-VL-2B-Instruct as its multimodal backbone.

Training has two stages. Stage 1 performs full-parameter multimodal instruction tuning so the backbone learns structured, target-conditioned safety judgments. Stage 2 freezes the instruction-tuned backbone and trains the five-level cumulative ordinal head, the 16-way harm-category head, and three teacher-simulation heads. The ordinal stage uses Gaussian-smoothed targets and learned monotonic thresholds.

model.safetensors contains the instruction-tuned backbone. ordinal_heads.safetensors contains the prediction heads and learned thresholds. ordinal_config.json defines their architecture, labels, score range, and prompt files.

The backbone tensors are stored in BF16. All prediction-head tensors, including the four trainable ordinal threshold parameters, are stored in FP32.

External benchmark results

F1 denotes unsafe-class F1 in percentage points.

Benchmark	Target	Threshold	F1
BeaverTails-V	Multimodal request	15	89.93
BeaverTails-V	Multimodal response	25	78.38
SPA-VL	Multimodal request	35	79.82
SPA-VL	Multimodal response	30	74.41
VLGuard	Multimodal request	15	95.42
HarmImageTest	Image	25	66.99
LLaVAGuard	Image	30	72.86
Multimodal average (7)			79.69
HarmBench Prompt	Text request	15	100.00
HarmBench Response	Text response	35	83.23
OpenAI Moderation	Text request	65	73.23
SafeRLHF	Text response	20	70.46
Overall average (11)			80.43

Sensitive content and intended use

SafeAtlas Guard is intended for multimodal safety moderation, ordinal risk assessment, red-teaming, evaluation, and safety alignment research. Its training and evaluation data necessarily include unsafe, offensive, sensitive, and potentially disturbing material. The model and associated resources must not be used to facilitate harmful activity or to target individuals or protected groups.

Predictions are context- and policy-dependent. Performance can vary across languages, cultures, domains, image quality, and previously unseen harm types. The model should be evaluated in the intended deployment setting and should not be the sole basis for high-impact decisions.

Citation

bibtex

@misc{wang2026safeatlasvlbinarymultimodalsafety,
  title={SafeAtlas-VL: Beyond Binary Multimodal Safety with Large-Scale Data and Guard Models},
  author={Zongrui Wang and Xiangyang Zhu and Sicheng Wang and Han Wang and Dingyi Rong and Zeyu Zhang and Chunyi Li and Yue Shi and Kaiwei Zhang and Zicheng Zhang and Yuan Tian and Qi Jia and Yan Teng and Wei Sun and Ning Liu and Guangtao Zhai},
  year={2026},
  eprint={2608.29098},
  archivePrefix={arXiv},
  primaryClass={cs.AI},
  url={https://arxiv.org/abs/2608.29098},
}