Structured self-captioning
The policy LVLM generates a caption before its final answer, explicitly exposing the visual evidence it uses.
REINFORCEMENT LEARNING FOR LVLM SAFETY
SafeCap
Improving LVLM Safety with
Image Captioning Reinforcement Learning
A learned self-captioning path that surfaces safety-relevant visual evidence before an LVLM commits to its answer.
AUTHORS & AFFILIATIONS
Caoyuan Ma1,2, Liuwenpu2,4, Weichu Xie2,4, Tian Gu3,5, Shilei Zhao3, Lingxi Min3, Shuai Dong2,6, Yuqi Xu2,4, Ji Zhao2, Ziyue Wang2,4, Wenzheng Chang2,7, Taiqiang Wu2,8, Yongfu Zhu2, Wenqi Shao2,‡, Yinqiang Zheng1,†
1 UTokyo2 JD3 WHU4 PKU5 Shanghai AI Lab6 SII7 SJTU8 HKU† Corresponding author‡ Project leader
ABSTRACT
SafeCap aligns LVLMs through learned self-captioning.
Large vision-language models remain vulnerable to jailbreaks that exploit visual inputs. SafeCap trains a policy model to first generate a safety-relevant caption and then answer the question. Caption quality is optimized by whether it enables a frozen language model to reach a safety-aligned decision, while a direct reward keeps the final answer safe and useful.
METHOD
A full path from
image to aligned answer.
SafeCap jointly learns structured generation, caption-mediated evaluation, and answer-level evaluation - all in a single reinforcement-learning loop.
Figure 1. SafeCap's latest training pipeline: structured captioning, dual evaluation, and reward aggregation.
Dual evaluation
A frozen LLM evaluates whether the caption supports aligned reasoning, alongside direct evaluation of the answer.
Safety with utility
Component-wise reward normalization balances safe behavior with retained visual understanding.
RESULTS
Strong safety,
steady utility.
On the matched Qwen3.5-4B-Base setting, SafeCap reaches the strongest DirectCap safety result while retaining similar vision utility.
55.06DirectCap Safety Avg.
Figure 2. SafeCap compared with SFT, DPO, and SafeGRPO under matched conditions.
| Method | S-Avg ↑ | V-Avg ↑ |
|---|---|---|
| Zero-training | 40.43 | 53.13 |
| SafeGRPO | 41.27 | 50.56 |
| SafeCap | 55.06 | 51.34 |
SAFE VISION-LANGUAGE MODELS