Technical Summary: Yuvion LLM

Problem Statement

The paper argues that the fundamental limitation of current Large Language Model (LLM) safety systems is their fragility under human adversarial behavior. While existing safety systems mitigate many risks, they often fail when faced with strategic attempts to evade policies through euphemisms, symbolic substitution, cross-lingual mixing, or multi-turn jailbreaks. The authors posit that safety failures in deployment arise not merely from natural inputs but from adaptive, strategic evasion. Furthermore, existing safety-oriented models are largely confined to single-turn judgment and lack the "agentic capabilities" (planning, tool use, multi-step reasoning) required for complex, real-world safety scenarios such as trademark infringement detection or multi-modal evidence synthesis. Consequently, measured safety performance on standard benchmarks often overestimates real-world deployment robustness.

Methodology

To address these gaps, the authors present Yuvion LLM, a model designed with adversarial robustness and agentic capability as first-class objectives. The development follows a progressive safety training paradigm consisting of three distinct stages:

1. Knowledge-Enhanced Continued Pretraining:

   • The model undergoes continued pretraining on a corpus explicitly constructed to internalize safety-domain knowledge.
   • This includes structured knowledge derived from policy documents, risk taxonomies, violation patterns, and long-tail adversarial expressions.
   • The data is organized at multiple granularities (structured triples, sentence-level descriptions) to anchor semantic relations while preserving general language competence through mixed training with general-domain data.

2. Policy-Grounded Multi-Task Safety Post-Training:

   • Risk-Aware Supervised Fine-Tuning (SFT): The model is trained on a multi-task instruction dataset to learn risk understanding, fine-grained categorization, and policy-grounded explanations. Crucially, this stage incorporates adversarial augmentation (euphemisms, cross-lingual variants, role-play) to encourage judgments based on latent intent rather than superficial lexical patterns.
   • Reinforcement Learning (RL) Policy Optimization: Using Group Relative Policy Optimization (GRPO), the model is refined on ambiguous cases and adversarial attacks. The reward function evaluates decision correctness, policy consistency, reasoning quality, and robustness, optimizing behavior where single-reference targets are insufficient.

3. Safety-Aware Agentic Reinforcement Learning:

   • This stage extends the model from single-turn classification to trajectory-level reasoning and action in structured workflows.
   • Tool-Integrated Reasoning: The model learns to invoke external tools (e.g., image detectors, classifiers) and follow strict output formats. Rewards are decomposed into format compliance and correctness of tool calls.
   • Search-Augmented Reasoning: The model is trained to iteratively search for external evidence, evaluate retrieved information, and synthesize grounded decisions. Rewards are based on execution success and factual correctness of the final answer.

Evaluation Framework: Yuvion LLM RiskEval (YLRE)

The authors introduce a four-level progressive evaluation framework covering 93 benchmarks to assess the model from general capability to real-world deployment:

• Level 1 (Open-source General): Measures retention of general language competence (knowledge, reasoning, agentic benchmarks like API-Bank and Seal-0).
• Level 2 (Open-source Safety): Evaluates public safety performance on standard content safety and guard benchmarks (e.g., ToxiGen, SEval).
• Level 3 (Adversarial Robustness): A self-constructed benchmark featuring static and dynamic (evolving) adversarial attacks across five risk categories (advertising, gambling, abuse, porn, spam).
• Level 4 (Industrial Deployment): In-house benchmarks derived from real commercial workflows, assessing domain capability (risk attribution, policy understanding) and business utility (UGC moderation, AIGC safety).

Key Results

• General Capability Retention: Yuvion-32B maintains broad general competence, achieving an average accuracy of 0.7988 across 33 general benchmarks, comparable to same-scale general-purpose models like Qwen3-32B.
• Safety Performance: Yuvion-32B achieves a Macro F1 of 78.2% on open-source content safety benchmarks, outperforming significantly larger proprietary models like GPT-5.4 (72.2%) and Qwen3-Max (73.9%).
• Adversarial Robustness: On the self-constructed dynamic adversarial benchmark, Yuvion-32B achieves the lowest combined score (20.6%), indicating superior robustness against evasion compared to GPT-5.4 (22.3%) and Qwen3-Max (24.4%).
• Agentic Capability: Yuvion-32B scores 90.45% on API-Bank and 40.54% on Seal-0, outperforming its base model and matching or exceeding much larger proprietary models.
• Industrial Deployment: Yuvion-32B achieves the highest composite scores on in-house domain (85.78) and business (86.34) benchmarks, surpassing all evaluated open-weight and proprietary baselines.
• Scale Efficiency: Yuvion-8B, despite being smaller, surpasses most state-of-the-art baselines, including GPT-5.4 and Qwen3-MAX, on several safety tasks, suggesting that targeted adversarial and agentic training can be more impactful than raw model scale alone.
• Guard Model Comparison: While Yuvion-32B ranks second in pairwise win rates against dedicated guard models, the paper notes that a specialized variant (Yuvion-Guard-8B) trained with a narrower focus achieves the highest win rate (85.6%), confirming that the general Yuvion model prioritizes comprehensive competence over narrow guard-specific classification.

Significance and Claims

The paper claims that content safety should be treated as an inherently adversarial problem requiring a specialized foundation-model domain with its own training paradigm and evaluation methodology. The authors argue that:

1. Adversarial Robustness and Agentic Capability must be built-in: Safety cannot be merely a post-hoc patch; it requires integrating adversarial awareness and agentic workflows into the core model development.
2. Targeted Training Outperforms Scale: The results demonstrate that targeted safety-domain training can yield state-of-the-art performance that surpasses substantially larger general-purpose models, challenging the notion that scale alone is the primary driver of safety.
3. Limitations of Guard Models: The near-zero performance of dedicated guard models on in-house business benchmarks highlights a gap between generic safety filtering and the fine-grained, policy-grounded competence required for real-world deployment.
4. Closed-Loop Evolution: The paper proposes a closed-loop iteration framework where models continuously evolve through knowledge injection, adversarial game-playing, and deployment-driven feedback to keep pace with the "arms race" of evasion strategies.

The authors conclude that Yuvion LLM serves as a reference for future research in risk governance, demonstrating that it is possible to preserve broad general utility while achieving robust, policy-consistent safety in complex, adversarial environments.