A modal balance and semantic enhancement training method for a full-modal safety fence

Abstract

The application discloses a modal balance and semantic enhancement training method of a full-modal safety guardrail, which significantly reduces the missed detection and false rejection of cross-modal queries by improving the training data and designing the training target, and improves the safety and reliability of the full-modal guardrail. The application efficiently constructs modal de-biased data, constructs a multi-modal query quadruple based on semantic pairing of a text seed query, and enumerates combinations of modal subsets and safety semantic labels to construct risk variant query samples. The data construction method can efficiently expand the training data based on a small amount of text samples, so that the safety and unsafe states of various modal combinations are comprehensively covered, the model is prevented from learning modal shortcuts during the training process, the dependence of the guardrail on different modal safety semantics is rebalanced, fine-grained safety supervision signals are efficiently expanded, and the cross-modal safety semantic understanding of the guardrail model is improved.

Description

Technical Field

[0001] This invention relates to the field of large-model safety railings, specifically, to a modal equalization and semantic enhancement training method for full-modal safety railings. Background Technology

[0002] In recent years, the capabilities of large language models have rapidly improved, and they have been widely applied in numerous scenarios such as dialogue and question answering, content generation, and code assistance. However, the powerful capabilities of these models have also increased the risk of abuse, such as generating harmful content and assisting illegal activities. Therefore, security barriers, as a defense and intervention mechanism deployed between users and large models, have become a crucial link in ensuring the safe use of large models by pre-screening and filtering user queries.

[0003] With the emergence of multimodal large language models, the user input that these models can accept has expanded from plain text to any combination of text, images, audio, and video. Attackers can leverage these rich modal combinations to construct jailbreak queries for large models, thereby bypassing the model's own security alignment mechanisms. Therefore, building a unified full-modal security guardrail for multimodal large models has become an urgent need to ensure their secure use. One feasible approach to building a full-modal guardrail is to fine-tune an existing full-modal base model with rich cross-modal semantic understanding capabilities using multimodal query samples, enabling it to handle user input of any modality and determine its security. However, existing fine-tuning training methods cannot guarantee the reliability of such full-modal guardrails in complex cross-modal scenarios, and the guardrails exhibit two fundamental failure modes in actual deployment.

[0004] The first type of failure mode is modality bias. Multimodal or full-modal large language models are typically built upon text-based large language models, and their multimodal alignment training paradigms cannot fully align the security semantics of different modalities in the model representation space. Therefore, guardrail models based on fine-tuning cannot fairly process security signals from different modalities. For queries containing inputs from different modalities, guardrails inherently favor security signals from language modalities (such as text and speech) and are more likely to ignore harmful semantics from visual modalities (such as images and videos). For example, when the text or speech input is a benign query, this inherent bias can cause guardrails to ignore harmful intents from visual sources, resulting in missed detections. Attackers may exploit this weakness to easily bypass the security guardrail's filtering.

[0005] The second type of failure mode is spurious association. During guardrail fine-tuning, training data typically only provides coarse-grained binary security labels, lacking fine-grained supervision to properly guide decision-making. Under these conditions, the model is more likely to learn shallow textual shortcuts in cross-modal jailbreak samples. For example, specific textual patterns, command frames, or character setting text that repeatedly appear in cross-modal jailbreak queries may be incorrectly associated by the guardrail as sufficient conditions for insecurity. When benign multimodal queries happen to use similar textual expressions, the guardrail will misjudge them as insecure, causing the large model to incorrectly reject users' legitimate queries. This spurious association does not stem from the model's true understanding of cross-modal security semantics, but is a product of shortcut learning under coarse-grained labels.

[0006] The two types of failure modes mentioned above compromise the reliability of the full-modal fence from different perspectives: modal bias leads to missed detections, preventing the fence from effectively blocking carefully crafted cross-modal attacks; false associations lead to false rejections, causing unnecessary interference to a large number of legitimate user queries. Therefore, there is an urgent need for a training scheme that can simultaneously address both types of failure modes, providing technical assurance for the reliable deployment of the full-modal fence in complex cross-modal scenarios. Summary of the Invention

[0007] This invention addresses the modal bias and spurious association problems inherent in existing fine-tuning-based full-modal safety fences. It provides a modal equalization and semantic enhancement training method for full-modal safety fences. By improving training data and specifically designing training objectives, this method significantly reduces false negatives and false rejections in cross-modal queries, thereby enhancing the security and reliability of the full-modal fence. This invention is achieved through the following technical solutions:

[0008] This invention discloses a modal equalization and semantic enhancement training method for a full-modal safety railing, comprising the following steps:

[0009] S1: Construct semantically aligned multimodal query quadruples based on benign or harmful text queries;

[0010] S2: Based on multimodal query quadruples, construct a training dataset for modality debiasing by enumerating risk variants;

[0011] S3: In addition to the basic multimodal training dataset, the multimodal model is fine-tuned using the modality-biased training dataset to obtain the guardrail model M1, which pays balanced attention to different modal safety signals;

[0012] S4: Obtain fine-grained security supervision signals from the basic multimodal training data to obtain a multimodal training dataset with enhanced security semantics;

[0013] S5: Using a multimodal training dataset with enhanced security semantics, fine-tune the guardrail model M1 using a progressive security semantics enhancement training strategy to obtain a guardrail model M2 with enhanced cross-modal security semantic understanding.

[0014] As a further improvement, this invention constructs semantically aligned multimodal query quadruples based on benign or harmful text queries, specifically:

[0015] Retrieve text seed queries with at least one semantic pair ,in This is for query text that contains harmful content that could induce unsafe content output in large models. For benign query text that has the same context and wording style but is semantically safe;

[0016] By leveraging a generative model that transforms text into different modalities, the text seed query is expanded into a semantically consistent cross-modal equivalent representation, resulting in a semantically aligned multimodal query quadruple. ,in Indicates whether it is semantically safe or unsafe.

[0017] As a further improvement, the modality-biased training dataset constructed based on multimodal query quadruples described in this invention is specifically as follows:

[0018] Based on the multimodal query quadruples corresponding to benign and harmful text queries, a subset of modalities is selected. and security semantic tags for each modality Combine risk variant query samples, and define the sample as follows:

[0019]

[0020] in This represents a subset of the four modalities: text, image, audio, and video. This represents the security label for the corresponding modality, and the four-tuple indicating whether the query comes from a benign or harmful multimodal query.

[0021] Enumerate all modal subsets and combinations of security semantics, and repeatedly perform the risk variant generation process on all multimodal query quadruples to obtain the modality-debiased guardrail model training dataset.

[0022] As a further improvement, the multimodal model fine-tuned using the training dataset for modality debiasing described in this invention jointly optimizes the safety classification objective and the auxiliary risk attribution objective during model training, and the loss function is defined as:

[0023] ;

[0024] Among them, loss items , and The outputs of the guardrail model are respectively With real labels Cross-entropy loss between, where The safety assessment result output for the guardrail. For risk category prediction results, The set of modalities representing sources of insecure semantics.

[0025] As a further improvement, the fine-grained security supervision signal for obtaining basic multimodal training data described in this invention employs an expert large model-assisted annotation method to obtain four-level security labels for multimodal training samples: "semantic perception description—independent risk identification—cross-modal reasoning—comprehensive security assessment," specifically:

[0026] The query data of each modality in the multimodal training samples are input into the expert model of the specific modality, and the semantic perception task and independent risk judgment task are executed respectively to obtain the semantic perception description label and independent risk identification label of the corresponding modality.

[0027] The semantic description labels and independent risk judgment labels of each modality of the multimodal training samples are summarized and input into the fusion expert model to perform cross-modal risk reasoning tasks. The cross-modal security semantic interaction relationship is analyzed to obtain comprehensive cross-modal risk judgment labels and corresponding reasoning basis descriptions.

[0028] The obtained tag information is organized into four levels of fine-grained security tags according to the logical order of "perceptual description - independent risk identification - cross-modal reasoning - comprehensive security assessment", and the original sample tag information is expanded to form a multimodal query sample with enhanced security semantics.

[0029] As a further improvement, the specific modality expert model described in this invention is a large language model with corresponding modality semantic understanding capabilities, and the fusion expert model is a large language model with strong text understanding capabilities. The expert large model performs semantic perception, independent risk assessment, and cross-modal risk reasoning tasks under optimized task prompt word templates and output rules.

[0030] As a further improvement, the incremental safety semantic enhancement training strategy used in this invention to fine-tune the guardrail model M1 is specifically as follows:

[0031] Fine-tuning of the guardrail model is performed using a multimodal training dataset with enhanced security semantics. This jointly optimizes the modal semantic awareness objective, independent risk identification objective, cross-modal reasoning objective, and security classification objective. The corresponding loss function is defined as follows:

[0032]

[0033] in To describe the prediction loss for semantic awareness, For each modality, predict losses independently. For cross-modal inference prediction loss, and To predict losses for the final safety assessment and risk category;

[0034] During the training process, a progressive training strategy was adopted by gradually increasing the difficulty of the guardrail recognition task and gradually introducing supervision signals at various levels. At the same time, the proportion of supervision signals at each level was controlled to prevent lengthy perception descriptions and cross-modal reasoning from affecting the optimization of the core safety classification objectives.

[0035] As a further improvement, the method of gradually increasing the difficulty of the guardrail recognition task and gradually introducing supervision signals at various levels described in this invention is as follows: the guardrail recognition task is divided into four levels according to difficulty: basic safety classification, cross-modal reasoning enhancement, perception understanding enhancement, and fine-grained risk recognition enhancement. Four training tasks are gradually introduced and independent model learning rates are used. Basic safety classification only predicts the safety label and risk category of the sample. Cross-modal reasoning enhancement outputs cross-modal reasoning basis on the basis of the basic safety classification task. Perception understanding enhancement outputs perception descriptions of each modality on the basis of the cross-modal reasoning enhancement task. Fine-grained risk recognition enhancement outputs modally independent risk judgment results on the basis of the first three.

[0036] As a further improvement, steps S3 and S5 of the present invention can be executed in the same training process and their loss functions can be jointly optimized to achieve the best modality equalization and security semantic enhancement effects.

[0037] The beneficial effects of this invention are as follows:

[0038] 1) Efficiently construct modality-biased data. This invention constructs multimodal query quadruples by using text seed queries based on semantic pairing, and constructs risk variant query samples by enumerating combinations of modality subsets and safety semantic labels. This data construction method can efficiently expand the training data based on only a small number of text samples, so that it fully covers the safe and unsafe states of various modality combinations, and avoids the model learning modality shortcuts during training.

[0039] 2) Rebalancing the dependence of guardrails on different modal safety semantics. Based on a modality-biased dataset, this invention jointly optimizes the safety classification objective and the risk attribution objective, requiring the model to explicitly predict the source modality of unsafe semantics. This forces the model to comprehensively understand and locate risk signals in multimodal inputs, eliminating its preference differences for safety signals in different modalities, thereby significantly reducing missed detections in cross-modal queries caused by modality bias.

[0040] 3) Efficiently expand fine-grained security supervision signals. This invention uses a large-model-based auxiliary annotation method to generate fine-grained security labels at four levels: semantic-aware description, independent risk identification, cross-modal reasoning, and comprehensive security assessment, through the collaboration of expert models from various modalities and fusion expert models. This effectively enhances the hierarchical and logical nature of the supervision signals in existing multimodal security datasets.

[0041] 4) Improve cross-modal safety semantic understanding of the guardrail model. Based on a dataset with enhanced safety supervision signals, this invention employs a progressive safety semantic enhancement training strategy. The recognition task is divided into four difficulty levels: basic safety classification, cross-modal reasoning enhancement, perceptual understanding enhancement, and fine-grained risk recognition enhancement. This resolves the optimization conflict between complex semantic supervision information and the core classification objective, enabling the guardrail model to make safety judgments based on the logical link from perception to understanding of cross-modal inputs, rather than superficial textual shortcuts. This improves the accuracy of risk recognition for cross-modal inputs and significantly reduces the interference of false association defects in guardrails on benign queries. Attached Figure Description

[0042] Figure 1 This is an overall flowchart of the modal equalization and semantic enhancement training method for the full-modal safety railing provided in the embodiment;

[0043] Figure 2 This is a flowchart provided in the embodiment for constructing a multimodal query quadruple;

[0044] Figure 3 This is a flowchart provided in the embodiment for constructing modality debiasing training data;

[0045] Figure 4 This is a flowchart provided in the embodiment for acquiring fine-grained safety monitoring signals;

[0046] Figure 5 This is a hierarchy diagram of the supervisory signal used for progressive security semantic enhancement training in the implementation system. Detailed Implementation

[0047] This invention discloses a modal equalization and semantic enhancement training method for a full-modal safety railing, comprising the following steps:

[0048] S1: Based on benign or harmful text queries, construct semantically aligned multimodal query quadruples; specifically:

[0049] Retrieve text seed queries with at least one semantic pair ,in This is for query text that contains harmful content that could induce unsafe content output in large models. For benign query text that has the same context and wording style but is semantically safe;

[0050] By leveraging a generative model that transforms text into different modalities, the text seed query is expanded into a semantically consistent cross-modal equivalent representation, resulting in a semantically aligned multimodal query quadruple. ,in Indicates whether it is semantically safe or unsafe.

[0051] S2: Based on multimodal query quadruples, construct a training dataset for modality debiasing by enumerating risk variants;

[0052] Specifically:

[0053] Based on the multimodal query quadruples corresponding to benign and harmful text queries, a subset of modalities is selected. and security semantic tags for each modality Combine risk variant query samples, and define the sample as follows:

[0054]

[0055] in This represents a subset of the four modalities: text, image, audio, and video. This represents the security label for the corresponding modality, and the four-tuple indicating whether the query comes from a benign or harmful multimodal query.

[0056] Enumerate all modal subsets and combinations of security semantics, and repeatedly perform the risk variant generation process on all multimodal query quadruples to obtain the modality-debiased guardrail model training dataset.

[0057] S3: In addition to the basic multimodal training dataset, the multimodal model is fine-tuned using a modality-biased training dataset to obtain a guardrail model M1 that provides balanced attention to safety signals across different modalities; during model training, the safety classification objective and the auxiliary risk attribution objective are jointly optimized, and the loss function is defined as:

[0058] ;

[0059] Among them, loss items , and The outputs of the guardrail model are respectively With real labels Cross-entropy loss between, where The safety assessment result output for the guardrail. For risk category prediction results, The set of modalities representing sources of insecure semantics.

[0060] S4: Obtain fine-grained security supervision signals from the basic multimodal training data to obtain a multimodal training dataset with enhanced security semantics; employ an expert large model-assisted annotation method to obtain four-level security labels for the multimodal training samples: "semantic perception description—independent risk identification—cross-modal reasoning—comprehensive security assessment," specifically:

[0061] Each modality query data in the multimodal training samples is input into a specific modality expert model to perform semantic perception and independent risk assessment tasks, respectively, and obtain the corresponding modality semantic perception description label and independent risk identification label. The specific modality expert model is a large language model with corresponding modality semantic understanding ability, and the fusion expert model is a large language model with strong text understanding ability. The expert large model performs semantic perception, independent risk assessment, and cross-modal risk reasoning tasks under optimized task prompt word templates and output rules.

[0062] The semantic description labels and independent risk judgment labels of each modality of the multimodal training samples are summarized and input into the fusion expert model to perform cross-modal risk reasoning tasks. The cross-modal security semantic interaction relationship is analyzed to obtain comprehensive cross-modal risk judgment labels and corresponding reasoning basis descriptions.

[0063] The obtained tag information is organized into four levels of fine-grained security tags according to the logical order of "perceptual description - independent risk identification - cross-modal reasoning - comprehensive security assessment", and the original sample tag information is expanded to form a multimodal query sample with enhanced security semantics.

[0064] S5: Using a multimodal training dataset with enhanced security semantics, fine-tune the guardrail model M1 using a progressive security semantics enhancement training strategy to obtain a guardrail model M2 with enhanced cross-modal security semantic understanding.

[0065] The guardrail model M1 is fine-tuned using a progressive safety semantic enhancement training strategy, specifically as follows:

[0066] Fine-tuning of the guardrail model is performed using a multimodal training dataset with enhanced security semantics. This jointly optimizes the modal semantic awareness objective, independent risk identification objective, cross-modal reasoning objective, and security classification objective. The corresponding loss function is defined as follows:

[0067]

[0068] in To describe the prediction loss for semantic awareness, For each modality, predict losses independently. For cross-modal inference prediction loss, and To predict losses for the final safety assessment and risk category;

[0069] During the training process, a progressive training strategy was adopted by gradually increasing the difficulty of the guardrail recognition task and gradually introducing supervision signals at various levels. At the same time, the proportion of supervision signals at each level was controlled to prevent lengthy perception descriptions and cross-modal reasoning from affecting the optimization of the core safety classification objectives.

[0070] The method of gradually increasing the difficulty of the guardrail recognition task and gradually introducing supervision signals at various levels is as follows: The guardrail recognition task is divided into four levels according to difficulty: basic safety classification, cross-modal reasoning enhancement, perception understanding enhancement, and fine-grained risk recognition enhancement. Four training tasks are gradually introduced and independent model learning rates are used. Basic safety classification only predicts the safety label and risk category of the sample. Cross-modal reasoning enhancement outputs the cross-modal reasoning basis on the basis of the basic safety classification task. Perception understanding enhancement outputs the perception description of each modality on the basis of the cross-modal reasoning enhancement task. Fine-grained risk recognition enhancement outputs the modality-independent risk judgment result on the basis of the first three.

[0071] Steps S3 and S5 can be executed in the same training process and their loss functions can be jointly optimized to achieve the best modality balance and secure semantic enhancement.

[0072] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and do not limit the scope of protection of this invention.

[0073] Figure 1 The flowchart illustrates the overall process of the full-modal safety railing modal equalization and semantic enhancement training method provided in this embodiment of the invention. Specifically, it includes the following steps:

[0074] Step 1: Construct semantically aligned multimodal query quadruples based on text queries.

[0075] In this embodiment, the process for constructing a multimodal query quadruple with secure semantic alignment is as follows: Figure 2 As shown, the specific steps include the following:

[0076] 1) Select 100 text queries from the MaliciousInstruct large model harmful instruction dataset as harmful seed queries. We use a large language expert model to generate text queries with similar context and linguistic similarity but harmless intent for each harmful query. A total of 100 pairs of text query seeds were obtained;

[0077] 2) Utilize a text-to-image (T2I) model to expand each text seed into a semantically consistent image query. The corresponding voice query is generated using a text-to-speech (TTS) model. The corresponding video content is generated using the Text-to-Video (T2V) model. 100 semantically aligned cross-modal quadruples were obtained. ,in These represent semantically safe or unsafe, respectively.

[0078] Step 2: Enumerate risk variants to construct a multimodal training dataset for modality debiasing.

[0079] In this embodiment, the process of constructing modality debiasing training data is as follows: Figure 3 As shown, the specific steps include the following:

[0080] 1) Based on any sample in the multimodal query quadruple obtained in step one, different modal input subsets are selected. And assign different security semantic tags to each modality. Obtain risk variant queries;

[0081] 2) By enumerating all combinations of modality subsets and security semantic labels, the risk variants of all samples in the multimodal quadruple are expanded to obtain the training dataset for modality debiasing. The training samples cover common combinations such as unimodality (T, I, V, A), bimodality (e.g., TI, TA, TV), and trimodality (e.g., TIA, TVA), and each modality combination must cover all possible risk variants.

[0082] Step 3: Fine-tune the multimodal guardrail model using the modal debiasing training dataset.

[0083] In this embodiment, the modality debiasing training dataset obtained in step two is used to fine-tune the guardrail model. An auxiliary risk attribution task is introduced on top of the safety classification task. The total loss function is the sum of the standard safety classification loss and the auxiliary risk attribution loss, and the loss function is defined as follows:

[0084]

[0085] Among them, loss items , and The outputs of the guardrail model are respectively With real labels Cross-entropy loss between, where The output of the guardrail is the safety prediction result for the sample. For risk category prediction results, This is the set of modalities representing insecure semantic sources. In the embodiment, the weights of each loss term ( Set it to 1.

[0086] In this embodiment, a full-modal base model (such as Qwen2.5-Omni-7B) is selected as the base model of the guardrail. Based on the PyTorch and swift fine-tuning framework, the guardrail model is fine-tuned and trained using LoRA's efficient parameter fine-tuning method.

[0087] Step 4: Obtain fine-grained security supervision signals and construct a multimodal training dataset with enhanced security semantics.

[0088] In this embodiment, to obtain fine-grained security supervision labels for multimodal training data, the following method is used: Figure 4 The annotation process shown, based on expert-assisted large model, includes the following steps:

[0089] 1) For each modal input in the training samples, call an expert large language model with corresponding modal understanding capabilities (such as the text modal expert model Qwen-Max, the visual modal expert model Qwen3-VL, the full modal and audio modal expert model Qwen3-Omni, etc.) to independently perform semantic perception and independent risk identification, and obtain the specific semantic content and independent risk discrimination results of the modal input respectively;

[0090] 2) After summarizing the semantic content descriptions and independent risk judgment results of each modality, input them into the fusion expert model (Qwen-Max), requiring it to perform cross-modal risk judgment by integrating all modal information, and output a brief reasoning basis and comprehensive security assessment results, including the final security label and risk category;

[0091] 3) Apply the annotation process of 1) and 2) to the existing multimodal training data to construct a multimodal training dataset with enhanced security semantics.

[0092] In this embodiment, a quality verification process is performed on the large model annotation results. The safety labels output in the aggregation stage are compared with the safety labels in the original training data to filter out samples that conflict with each other. All labeled samples are manually sampled for verification, and annotation errors in the decomposition annotation stage and the aggregation annotation stage are corrected or re-annotated.

[0093] Step 5: Fine-tune the multimodal guardrail model using a progressive security semantic enhancement strategy.

[0094] In this embodiment, the security semantic enhancement training dataset obtained in step four is used, employing methods such as... Figure 5 The label hierarchy shown performs further progressive safety semantic enhancement training on the guardrail model obtained in step three, jointly optimizing the modal semantic awareness objective, independent risk identification objective, cross-modal reasoning objective, and safety classification objective. The corresponding loss function is defined as:

[0095]

[0096] in To describe the prediction loss for semantic awareness, For each modality, predict losses independently. For cross-modal inference prediction loss, and To predict losses for the final safety assessment and risk category. In the example, the weights of each loss item ( The weight is dynamically adjusted. If the target needs to be optimized during training, the weight is 1; otherwise, it is set to 0.

[0097] In this embodiment, the label information contained in the training samples and the content that the model should output are divided into four levels:

[0098] 1) Basic safety classification: The supervision signal of the sample only includes safety labels and risk categories, training the guardrail's basic safety audit capability;

[0099] 2) Enhanced cross-modal reasoning: Based on the supervision signals of basic safety classification, cross-modal reasoning basis labels are introduced to train the guardrail to generate corresponding logical basis while making safety judgments;

[0100] 3) Enhanced Perceptual Understanding: Based on the supervision signals of basic security classification and cross-modal reasoning, perceptual description labels are introduced to train guardrails to understand the accurate semantic content of each modality before reasoning;

[0101] 4) Enhanced fine-grained risk identification: Based on the aforementioned supervisory signals, independent risk judgment labels for each modality are further introduced, and the guardrail is trained to perform separate risk assessments on the safety signals of each modality before performing safety inference and discrimination.

[0102] In this embodiment, training samples of the above four levels are gradually introduced according to the training progress, with the sample ratio of each stage being 5:3:2:1.

[0103] In this embodiment, steps three and five can be jointly optimized in the same training process, merging the loss functions of the two steps into a unified loss function for end-to-end training.

[0104] The modality equalization and semantic enhancement training method for all-modal safety fences provided in the above embodiments solves the two failure modes of all-modal fences, modality bias and false association, through targeted design of training data and training objectives. While rebalancing the fence model's attention preference for different modal safety signals, it endows the fence with capabilities from semantic perception to cross-modal safety semantic understanding to capability enhancement, thereby significantly improving the audit reliability of all-modal fences in complex cross-modal scenarios and providing technical support for their actual deployment.

Claims

1. A modal equalization and semantic enhancement training method for a full-modal safety railing, characterized in that, Includes the following steps: S1: Construct semantically aligned multimodal query quadruples based on benign or harmful text queries; S2: Based on multimodal query quadruples, construct a training dataset for modality debiasing by enumerating risk variants; S3: In addition to the basic multimodal training dataset, the multimodal model is fine-tuned using the modality-debiased training dataset to obtain the guardrail model M1, which pays balanced attention to different modal safety signals; S4: Obtain fine-grained security supervision signals from the basic multimodal training data to obtain a multimodal training dataset with enhanced security semantics; S5: Using a multimodal training dataset with enhanced security semantics, fine-tune the guardrail model M1 using a progressive security semantics enhancement training strategy to obtain a guardrail model M2 with enhanced cross-modal security semantic understanding.

2. The method according to claim 1, characterized in that, The aforementioned construction of semantically aligned multimodal query quadruples based on benign or harmful text queries specifically involves: Retrieve text seed queries with at least one semantic pair ,in This is for query text that contains harmful content that could induce unsafe content output in large models. For benign query text that has the same context and wording style but is semantically safe; By leveraging a generative model that transforms text into different modalities, the text seed query is expanded into a semantically consistent cross-modal equivalent representation, resulting in a semantically aligned multimodal query quadruple. ,in Indicates whether it is semantically safe or unsafe.

3. The method according to claim 1, characterized in that, The construction of the modality-biased training dataset based on multimodal query quadruples is as follows: Based on the multimodal query quadruples corresponding to the benign and harmful text queries, a subset of modalities is selected. and security semantic tags for each modality The risk variant query sample is generated by combining the above data, and the sample is defined as follows: ； in This represents a subset of the four modalities: text, image, audio, and video. This represents the security label for the corresponding modality, and the four-tuple indicating whether the query comes from a benign or harmful multimodal query. Enumerate all modal subsets and combinations of security semantics, and repeatedly perform the risk variant generation process on all the multimodal query quadruples to obtain the modality-debiased guardrail model training dataset.

4. The method according to claim 1, characterized in that, The multimodal model is fine-tuned using the training dataset with modality debiasing. During model training, the safety classification objective and the auxiliary risk attribution objective are jointly optimized. The loss function is defined as: ； Among them, loss items , and The outputs of the guardrail model are respectively With real labels Cross-entropy loss between, where The safety assessment result output for the guardrail. For risk category prediction results, The set of modalities representing sources of insecure semantics.

5. The method according to claim 1, characterized in that, The fine-grained security supervision signals obtained from the basic multimodal training data are labeled using an expert large model-assisted annotation method to obtain four levels of security labels for the multimodal training samples: "semantic perception description—independent risk identification—cross-modal reasoning—comprehensive security assessment," specifically: The query data of each modality in the multimodal training samples are input into the expert model of the specific modality, and the semantic perception task and independent risk judgment task are executed respectively to obtain the semantic perception description label and independent risk identification label of the corresponding modality. The semantic description labels and independent risk judgment labels of each modality of the multimodal training samples are summarized and input into the fusion expert model to perform cross-modal risk reasoning tasks. The cross-modal security semantic interaction relationship is analyzed to obtain comprehensive cross-modal risk judgment labels and corresponding reasoning basis descriptions. The obtained tag information is organized into four levels of fine-grained security tags according to the logical order of "perceptual description - independent risk identification - cross-modal reasoning - comprehensive security assessment", and the original sample tag information is expanded to form a multimodal query sample with enhanced security semantics.

6. The expert-assisted annotation method for large models according to claim 5, characterized in that, The specific modality expert model is a large language model with corresponding modality semantic understanding capabilities, and the fusion expert model is a large language model with strong text understanding capabilities. The expert large model performs the semantic perception, independent risk judgment, and cross-modal risk reasoning tasks under optimized task prompt word templates and output rules.

7. The method according to claim 1, characterized in that, The gradual security semantic enhancement training strategy is used to fine-tune the guardrail model M1, specifically as follows: The guardrail model is fine-tuned based on the aforementioned security semantic enhancement multimodal training dataset. The modal semantic awareness objective, independent risk identification objective, cross-modal reasoning objective, and security classification objective are jointly optimized. The corresponding loss function is defined as follows: ； in To describe the prediction loss for semantic awareness, For each modality, predict losses independently. For cross-modal inference prediction loss, and To predict losses for the final safety assessment and risk category; During the training process, the progressive training strategy is implemented by gradually increasing the difficulty of the guardrail recognition task and gradually introducing supervision signals at various levels. At the same time, the proportion of supervision signals at each level is controlled to prevent lengthy perception descriptions and cross-modal reasoning from affecting the optimization of the core safety classification objective.

8. The method according to claim 7, characterized in that, The method of gradually increasing the difficulty of the guardrail recognition task and gradually introducing supervision signals at various levels is as follows: the guardrail recognition task is divided into four levels according to difficulty: basic safety classification, cross-modal reasoning enhancement, perception understanding enhancement, and fine-grained risk recognition enhancement. Four training tasks are gradually introduced and independent model learning rates are used. The basic safety classification only predicts the safety label and risk category of the sample. The cross-modal reasoning enhancement outputs cross-modal reasoning basis on the basis of the basic safety classification task. The perception understanding enhancement outputs perception descriptions of each modality on the basis of the cross-modal reasoning enhancement task. The fine-grained risk recognition enhancement outputs modally independent risk judgment results on the basis of the first three.

9. The method according to claim 1, characterized in that, Steps S3 and S5 can be executed in the same training process and their loss functions can be jointly optimized to achieve the best modality balance and secure semantic enhancement.

Images