Visual Compliance via Executable Safety Rule Entailment
Jisoo Kim (Sungkyunkwan University), TaeYoon Kwack (Sungkyunkwan University), Jinwoo Jang (Sungkyunkwan University), Honguk Woo (Sungkyunkwan University)
cs.AI
Quick verdict
GUARDEN turns safety rules into executable, scene-graph-grounded logic; impressive gains on its own benchmark, but external validity and statistical rigor remain unproven.
Summary
The paper proposes GUARDEN, a training-free safeguard that reframes visual safety assessment as rule entailment: deciding whether an image violates a written safety rule. Safety-Rule Compilation uses a decomposer-verifier loop to break a rule into atomic visual propositions (object states and pairwise relations) arranged in an executable tree of AND/OR/NOT operators. At test time, Scene-Grounded Execution builds a scene graph - a selector VLM proposes detection targets, then SAM 3, SigLIP 2, Depth Anything 3, and OCR ground them - and substitutes grounded truth values into the tree. A closed-loop keyword-substitution mechanism (Tool-Aware Visual Grounding) recovers detections that the open-vocabulary detector misses. On SafetyVisionBench, a 34K-image benchmark the authors build from FDA Food Code, NYC Building Code, Meta Community Standards, and UK CAP Code sources (images generated with Imagen 4/Gemini, labels inherited from source records), GUARDEN reaches 78.7 average F1 with Gemma 4 26B, +9.8 over the strongest baseline (ETA), +17.9 average Robustness Index, and >80% reduction in visual- and rule-induced spurious violations versus direct prompting. Gains persist across four backbones and exceed LoRA fine-tuning of the same model. Main limitations: evaluation centers on the authors' own generated benchmark - on external LlavaGuard the margin over CLUE is only 0.3 F1; statistics are limited to three-run means and standard deviations; labels rest on author verification; latency is 8.6-11.6 s/image.
Review complete
Assessment at a glance
6
risk flags identified
● high 0
● medium 4
● low 2
4 strengths · 5 weaknesses · 5 author questions
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Decomposing safety rules into executable proposition trees and grounding atomic propositions via scene graphs improves average visual compliance F1 by 9.8 points over the strongest baseline (ETA, 68.9 average) across four regulatory domains with Gemma 4 26B.
- Preserving the rule's logical composition yields higher robustness to rule complexity (+17.9 average Robustness Index) and reduces visual-cue- and rule-induced spurious violations by over 80% relative to Direct Prompting (15.5% to 3.2% and 12.1% to 2.0%).
- GUARDEN adapts to revised safety rules by recompilation without retraining, and outperforms LoRA fine-tuning of the same backbone (Food 88.7 vs 81.2 F1; Construction 91.1 vs 89.1 F1).
- Gains persist across four inference backbones (best F1 in all 16 backbone-domain combinations) and transfer, with sharply reduced margins, to external settings (LlavaGuard 71.1 vs CLUE 70.8 F1; MM-SafetyBench SD+TYPO 82.3 vs CompAgent 75.1 F1).
Strengths
Problem formulation matches the ablation evidence
Section 3.1 splits entailment into two capabilities - representing logical composition (Phi) and judging atomic propositions - and the ablation (Table 10) confirms both matter: removing relation grounding drops average F1 by 30.1% and the verifier loop by 27.4%, directly validating the two-part decomposition the method is built on.
Unusually complete implementation disclosure
Decomposer, verifier, selection, and keyword-substitution prompts are reproduced verbatim (Figs 17-20), the nine grounding predicates are tabulated with their evidence sources (Table 7), and the paper reports deployment cost (Table 14: 8.6-11.6 s/image with token and tool-call counts), tau-sensitivity (Table 13), and cache amortization curves (Fig 11) - rare transparency for a systems paper.
Broad and candid empirical coverage
Bias analysis is a substantive contribution beyond accuracy
Weaknesses
External validity hinges on one self-built benchmark
Thin statistical support for headline claims
Robustness Index is partially circular
Ground-truth validity of the generated benchmark
Adaptability claim rests on a single anecdote; no error-propagation analysis
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is GuardEn (executable safety rule entailment)?
GuardEn is a training-free framework that checks whether an image violates a written safety rule. It first compiles the rule into a tree of atomic visual checks (object states and object relations) joined by AND/OR/NOT logic; at test time it grounds each check in the image using object detection, OCR, and depth estimation, then evaluates the tree to return a violation verdict with an inspectable, step-by-step chain of evidence.
What is SafetyVisionBench?
A benchmark introduced in this paper with roughly 24,000 unsafe and 10,000 'hard safe' images built from four real regulatory sources: the US FDA Food Code, the NYC Building Code, Meta's Community Standards, and the UK CAP advertising code. Images are AI-generated (Imagen 4 / Gemini) from real violation records and carry clause-level violation labels; most are released under CC BY 4.0, except the platform-content images, for which only the construction pipeline is disclosed.
How does GuardEn differ from Llama Guard and other end-to-end VLM safety filters?
End-to-end safeguards judge an image holistically and typically need retraining or new labeled data when safety rules change. GuardEn keeps the rule external and explicit: adapting to a new rule version only requires recompiling that rule into executable logic, and because every verdict decomposes into grounded atomic checks, the paper shows far fewer false violations triggered by provocative imagery or by normatively framed rule text (about 80% fewer spurious violations than direct prompting).
How well does GuardEn perform, and what does it cost to run?
On SafetyVisionBench with Gemma 4 26B it averages 78.7 F1, about 9.8 points above the strongest baseline, and wins all four domains, though on the external LlavaGuard benchmark its edge over the best baseline shrinks to 0.3 F1. It is comparatively expensive for online use: 8.6 to 11.6 seconds and up to roughly 16K tokens per image, partially offset by parallel grounding and a cache of detector keyword substitutes.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- All figures are present only as captions in the extracted text; qualitative evidence (Figs 1-2, 4, 7-12) and few-shot prompt exemplars could not be visually inspected.
- Equations are partially garbled by extraction (e.g., Eq. 6 and the Robustness Index in Eq. 14); interpretations were cross-checked against reported numbers where possible (RI and ablation percentages recompute correctly from Tables 8 and 10).
- Table counts could not be fully reconciled from text alone (434 platform-content violation images stated in C.2 vs 477 implied by Table 23); assumed to reflect an images-versus-cases distinction.
- Review covers arXiv v1 (2609.18328, 16 Sep 2026); the verifier scoring rubric and saturation criterion (B.2) are summarized in the main text but their full specification was not verifiable.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.