SaFeR-ToolKit: Structured Reasoning via Virtual Tool Calling for Multimodal Safety

Zixuan Xu; Tiancheng He; Huahui Yi; Kun Wang; Xi Chen; Gongli Xi; Qiankun Li; Kang Li

cs.LGMar 3, 2026

SaFeR-ToolKit: Structured Reasoning via Virtual Tool Calling for Multimodal Safety

Authors: Zixuan Xu, Tiancheng He, Huahui Yi, Kun Wang, Xi Chen, Gongli Xi, Qiankun Li, Kang Li,

Organizations: Huazhong University of Science and Technology · Beijing University of Posts and Telecommunications · West China Hospital, Sichuan University · Nanyang Technological University

Abstract

Vision-language models remain susceptible to multimodal jailbreaks and over-refusal because safety hinges on both visual evidence and user intent, while many alignment pipelines supervise only the final response. To address this, we present SaFeR-ToolKit, which formalizes safety decision-making as a checkable protocol. Concretely, a planner specifies a persona, a Perception $\to$ Reasoning $\to$ Decision tool set, and a constrained transition graph, while a responder outputs a typed key-value tool trace before the final answer. To make the protocol reliably followed in practice, we train a single policy with a three-stage curriculum (SFT $\to$ DPO $\to$ GRPO), where GRPO directly supervises tool usage beyond answer-level feedback. Our contributions are two-fold: I. Dataset. The first tool-based safety reasoning dataset, comprising 31,654 examples (SFT 6k, DPO 18.6k, GRPO 6k) plus 1k held-out evaluation. II. Experiments. On Qwen2.5-VL, SaFeR-ToolKit significantly improves Safety/Helpfulness/Reasoning Rigor on 3B (29.39/45.04/4.98 $\to$ 84.40/71.13/78.87) and 7B (53.21/52.92/19.26 $\to$ 86.34/80.79/85.34), while preserving general capabilities (3B: 58.67 $\to$ 59.21; 7B: 66.39 $\to$ 66.81). Codes are available at https://github.com/Duebassx/SaFeR_ToolKit.

Figures & tables

Figure 1: Overview of SaFeR-ToolKit. (a) Motivating Example: Unlike baseline refusals, SaFeR-ToolKit uses dynamic ToolKit thinking (Perception $\rightarrow$ Reasoning $\rightarrow$ Decision) to generate safe and educational responses. (b) Data Statistics: Dataset distribution across training stages (SFT, DPO, GRPO) and tool categories. (c) Evaluation: Ablation studies demonstrating stage-wise improvements (left) and performance comparisons with SOTA baselines (right).

Figure 2: SaFeR-ToolKit overview and training pipeline. Given an image-question input, a planner selects a persona, a virtual tool subset, and a topology (linear/tree/mesh/shield/loop); the responder then produces a structured tool trace and final answer. SFT learns the trace format and basic tool usage, DPO improves tool selection and execution, and GRPO refines deeper tool-based reasoning.

Method	BeaverTails-V			MM-SafetyBench			MSSBench			SPA-VL			ToolkitBench			Avg.
	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$
Qwen2.5-VL-3B	37.80	65.76	6.78	20.42	51.79	4.17	11.33	34.08	0.71	46.60	54.53	11.89	30.81	19.04	1.33	29.39	45.04	4.98
+ ECSO	36.61	56.27	6.27	20.71	45.30	4.82	12.35	27.35	0.31	39.13	45.18	11.53	25.03	17.16	1.02	26.77	38.25	4.79
+ SIA	31.02	39.66	4.75	20.84	32.00	4.36	26.02	20.31	0.82	36.79	25.09	7.17	21.96	15.42	1.74	27.33	26.50	3.77
+ TIS	87.46	58.81	78.64	80.06	50.54	72.14	71.33	42.35	42.45	80.19	56.98	69.25	43.72	17.67	23.49	72.55	45.27	57.19
+ VLGuard	79.66	8.81	17.80	76.73	4.11	24.40	74.80	10.92	11.12	70.94	6.60	15.28	29.32	5.21	4.49	66.29	7.13	14.62

Table 1: Comparison of SaFeR-ToolKit with existing methods across five benchmarks. We report top-score percentages for Safety (Safe), Helpfulness (Help), and Reasoning Rigor (Reas). The best and second-best results are highlighted.

Tool Config	BeaverTails-V			MM-SafetyBench			MSSBench			SPA-VL			ToolkitBench			Avg.
Tool Config	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$
$\varnothing$ (No tools)	51.36	70.24	5.27	47.82	69.43	8.96	19.69	28.67	0.10	53.31	58.98	4.54	28.19	27.68	1.74	40.08	51.00	4.12
D only	60.34	70.34	22.71	59.40	59.58	12.44	15.71	28.57	0.41	63.77	61.51	19.06	30.13	25.94	1.74	45.87	49.19	11.27
P only	53.56	57.80	19.49	47.50	69.58	8.69	19.90	33.27	1.12	53.77	54.72	5.85	34.73	26.66	2.76	41.89	48.40	7.58
R only	70.68	66.78	42.03	60.18	63.39	34.29	14.90	34.49	0.61	63.40	58.87	35.66	30.03	25.33	4.80	47.84	49.77	23.48
P + D	81.02	62.71	65.25	73.04	46.01	57.50	36.53	42.96	28.78	74.34	60.00	63.21	42.19	24.51	14.10	61.42	47.24	45.77

Table 3: Tool category ablation. We report the percentage of top-rated samples for Safety (Safe), Helpfulness (Help), and Reasoning Rigor (Reas) under different tool configurations. P=Perception, R=Reasoning, D=Decision. Best and second-best highlighted.

Figure 4: Qualitative safety comparison. Left: Bullying scenario; Right: Deception scenario. Qwen2.5-VL-7B provides harmful instructions, while SaFeR-ToolKit employs tool-mediated reasoning to detect risks, refuse safely, and pivot to constructive guidance.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

	High Empathy	Low Empathy
High Safety	Compassionate Guide	Firm Guardian
Low Safety	Creative Collaborator	Objective Analyst

Appendix

Table 4: Persona library as a 2

\times

2 safety-empathy quadrant matrix.

Layer	Subcategory	Tool Name
$\mathcal{T}^{\mathrm{P}}$	Visual	VISUAL-VERIFY , VISUAL-DETAIL-SCAN , OBJECT-DETECTOR , SCENE-CONTEXT , SYMBOL-RECOGNIZER
	Text	TEXT-OCR-SCAN , SEMANTIC-PARSER , TONE-DETECTOR , KEYWORD-FLAGGING
	Bridge	CROSS-MODAL-SYNC , MODALITY-CONFLICT , VISUAL-TEXT-ALIGN
$\mathcal{T}^{\mathrm{R}}$	Intent	INTENT-RADAR , INTENT-CLASSIFIER , MOTIVE-ANALYZER , GOAL-INFERENCE , DUAL-USE-DETECTOR
	Emotion	SENTIMENT-PROBE , URGENCY-GAUGE , DISTRESS-SIGNAL , EMOTION-SPECTRUM
	Safety	RISK-SCORER , HARM-PREDICTOR , POLICY-MATCHER , VULNERABILITY-MAP , ATTACK-PATTERN

Appendix

Table 5: Complete tool library (

|\mathcal{T}|=60

) organized by layer and subcategory.

Panel of Figure 5 — Figure 5: GRPO judge model prompt for scoring task success, safety, helpfulness, and tool quality.

Training Configuration
Parameter	Symbol	Value
Learning rate	$\eta$	$1\times 10^{-6}$
Batch size	–	256
Mini-batch size	–	32
KL coefficient	$\lambda$	$1\times 10^{-2}$
Rollouts per prompt	$n$	4

Appendix

Table 6: GRPO training hyperparameters.

Gating Thresholds
Parameter	Symbol	Value
Safety threshold	$\tau_{\text{safe}}$	0.60
Task threshold	$\tau_{\text{task}}$	0.60
Success Path Weights $(\mathbf{w}_{\mathrm{suc}})$
Task weight	$w_{\text{task}}$	0.40
Safety weight	$w_{\text{safe}}$	0.20

Appendix

Table 7: Semantic reward

R_{\mathrm{sem}}

hyperparameters.

Method	BeaverTails-V			MM-SafetyBench			MSSBench			SPA-VL			ToolkitBench			Avg.
	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$	Safe $\uparrow$	Help $\uparrow$	Reas $\uparrow$
Qwen2.5-VL-3B	0.59	2.56	1.68	0.05	2.37	1.70	-0.11	1.98	1.31	1.38	2.35	1.73	1.57	1.74	1.18	0.70	2.20	1.52
+ ECSO	0.73	2.41	1.66	0.40	2.25	1.62	0.02	1.80	1.22	1.39	2.16	1.66	1.58	1.66	1.13	0.82	2.06	1.46
+ SIA	0.82	2.01	1.39	0.97	1.76	1.37	0.91	1.74	1.32	1.70	1.63	1.38	1.62	1.46	1.01	1.20	1.72	1.29
+ TIS	2.75	2.37	2.69	2.62	2.17	2.55	2.42	2.15	2.06	2.62	2.35	2.50	1.97	1.45	1.61	2.48	2.10	2.28
+ VLGuard	2.61	1.69	1.86	2.54	1.60	1.92	2.55	1.74	1.66	2.43	1.63	1.74	1.69	1.10	1.09	2.36	1.55	1.65

Appendix

Table 8: Average score comparison across five benchmarks. We report mean scores for Safety (

[-3,3]

), Helpfulness (

[0,3]

), and Reasoning Rigor (

[0,3]

). The best and second-best results are highlighted.

Figure 6: Distribution of tool invocation counts across training configurations on five benchmarks.

Cultural Safety Evaluation of VLMs

See all 14 papers

When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness?
May 27, 2026Yuan Tian, Bing Hu, Fang Wu +3VLM Robustness Tool Use in VLMs
Independent Researcher · Stanford University · Harvard University +2
When Reasoning Is Not Enough: Proactive Inquiry for Cross-Modal Safety in Multimodal Large Language Models
Oct 15, 2026Wei Cai, Jian Zhao, Yuchen Yuan +1Multimodal Multi-Turn Safety Alignment VLM Safety
Institute of Artificial Intelligence (TeleAI), China Telecom, P. R. China. · Peking University. · School of Artificial Intelligence, OPtics and ElectroNics (iOPEN), Northwestern Polytechnical University, Xi’an 710072, P. R. China.
Can Vision-Language Models Stay Helpful When Facing Implicit Risks? Intent-Privilege OPSD for Efficient Safety-Helpfulness Alignment
Sep 29, 2026Haotian Deng, Wenbin Xing, Gang Xu +5VLM Robustness Vision-Language Models
Southern University of Science and Technology · Sun Yat-sen University · Guangdong Laboratory of Artificial Intelligence and Digital Economy (SZ) +5

May 27, 2026J/K move · Enter open · S save

When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness?

Yuan Tian, Bing Hu, Fang Wu, Xiaomin Li+2

Independent Researcher · Stanford University · Harvard University+2

VLM Robustness Tool Use in VLMs Multimodal Jailbreak Attacks

Open paper AskPDF arXiv

Think-with-image reasoning is emerging as a new inference paradigm for large vision-language models, but its safety implications remain poorly understood. Existing systems already span multiple process designs, including direct response generation, text-only prior turn, visual-state manipulation, and explicit external image-tool invocation. In this paper, we ask which of these evaluated paradigms improves multimodal jailbreak robustness, and why. Across multiple vision-language models, explicit image-tool interaction yields the lowest attack success rates in our experiments, reducing jailbreak success by around 30% relative on average across the evaluated models. This finding is initially surprising: ASR remains low even when the returned image-tool output is manually overridden or itself unsafe-looking, but returns near direct-answering levels under text-only prior turn controls. These results indicate that the lower ASR is not explained by benign returned-image semantics or by the textual image-tool trace alone. To explain the pattern, we introduce an image-tool safety vector framework that models image-tool invocation as a residual shift in hidden representations toward a safety-relevant direction. Representation-level analyses and activation interventions support this account. Overall, our results suggest that explicit image-tool interaction is a promising design pattern for improving jailbreak robustness, while also motivating pipeline-specific safety evaluation.

Abstract

Cultural Safety Evaluation of VLMs

Explore similar work

When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness?

When Reasoning Is Not Enough: Proactive Inquiry for Cross-Modal Safety in Multimodal Large Language Models

Can Vision-Language Models Stay Helpful When Facing Implicit Risks? Intent-Privilege OPSD for Efficient Safety-Helpfulness Alignment