In recent years, multimodal large models have continued to improve on general benchmarks. However, in real-world content moderation and adversarial settings, mainstream models still suffer from degraded generalization and catastrophic forgetting because of limited fine-grained visual perception and insufficient modeling of long-tail noise. In this paper, we present Xuanwu VL-2B as a case study of how general multimodal models can be developed into an industrial-grade foundation model for content ecosystems. The model adopts a compact InternViT-300M + MLP + Qwen3 1.7B architecture, balancing fine-grained visual perception, language-semantic alignment, and deployment cost within an approximately 2B-parameter budget. To balance business specialization with the retention of general capabilities, we developed a data iteration and curation mechanism and trained the model through a progressive three-stage pipeline: pre-training, mid-training, and post-training. Ablation studies and offline business evaluations show that Xuanwu VL-2B achieves an average score of 67.90 across seven OpenCompass multimodal metrics (vs. 64.27 for InternVL 3.5 2B), an average recall of 94.38% over seven independent business moderation tasks, and a weighted overall recall of 82.82% on policy-violating text in challenging adversarial OCR scenarios, outperforming Gemini-2.5-Pro (76.72%). These results show that, under a limited parameter budget, Xuanwu VL-2B achieves a practical balance among business alignment, visual perception, general capability retention, and deployment cost.
Figures & tables
Content Moderation Safety and compliance judgment Violation attribution
Both layers depend on a unified multimodal representation
Content Understanding Provides image-text alignment, OCR perception, spatial reasoning, and general world knowledge representations
Figure 1: Capability layering of the Xuanwu industrial multimodal foundation. The lower layer provides unified multimodal representations, while the upper layers address moderation and adversarial defense.
Figure 2: Core architecture of Xuanwu VL-2B: InternViT-300M serves as the visual backbone and Qwen3 1.7B serves as the language backbone, connected by an MLP projector.
Configurations
InternViT-300M
MLP Projector
Qwen3-1.7B
Architecture Type
ViT-L/14
2-Layer Perceptron
Transformer Decoder
Hidden Size
1024
1024 → 2048
2048
Num Heads
16
-
16 (Q) / 8 (KV)
Num Layers
24
2
28
Parameters
∼ 304M
∼ 4M
∼ 1.7B
Table 1: Detailed Hyperparameter Configurations for Xuanwu VL-2B Core Architecture
Stage
Sub-stage
Trainable Modules
Data Type
Scale
Optimization Config
Pre-Training
Modality Alignment
MLP projector
High-quality caption alignment data
1.3M
LR = 1×10−3 , Batch = 256
Pre-Training
General Knowledge Learning
Full Model
General image-text paired data
17.33M
LR = 1×10−3 , Batch = 256
Mid-Training
Business Knowledge Learning
Full Model
Base-retention + instruction-following enhancement + moderation + SPAM adversarial data
2.8M
LR = 2×10−5 , Batch = 128
Post-Training
Instruction Tuning
Full Model
High-fidelity SFT data
8.408M
LR = 1×10−5
Post-Training
RL Alignment
Full Model
GRPO alignment data / adversarial OCR alignment samples
810k
LR = 1×10−6
Table 2: Overview of the Three-Stage, Five-Step Training Recipe
Benchmark
InternVL 3.0 2B
InternVL 3.5 2B
Xuanwu VL-2B
HallusionBench
43.32
46.78
47.32
AI2D
77.75
77.95
82.19
MMStar
58.73
56.20
60.47
OCRBench
81.80
83.10
89.80
MMBench v1.1
79.41
75.08
79.02
MMMU (val)
45.89
50.51
48.11
Table 3: Comparison of General Multimodal Capabilities (%)
Benchmark
InternVL 3.0 2B
InternVL 3.5 2B
Xuanwu VL-2B
IFEval
49.07
69.88
76.35
GPQA Diamond
29.80
34.34
32.83
GSM8K
73.09
74.07
73.92
MMLU
61.74
65.51
62.94
C-Eval
73.12
63.66
62.18
BBH
51.89
62.85
59.68
Table 4: Comparison of Text-Only Capabilities (%)
Category
InternVL 3.0 2B
InternVL 3.5 2B
Xuanwu VL-2B
ad
70.61
88.39
99.38
high-risk
4.50
7.93
97.99
illegal
1.38
12.93
92.19
porn
40.80
61.80
97.15
vulgar
21.63
25.72
79.08
other
4.09
47.50
94.89
Table 5: Business Content Moderation Recall for Independent Binary Decisions (%)
Category
InternVL 3.0 2B
InternVL 3.5 2B
Gemini-2.5-Pro
Xuanwu VL-2B
aigc
16.21
14.34
26.06
32.83
combination
60.60
58.05
74.31
74.62
handwriting
80.99
80.17
89.53
88.86
long
59.87
57.28
80.15
79.22
noise
58.77
55.14
73.27
79.09
small
69.99
77.29
92.82
91.76
Table 6: Business Adversarial OCR Recall Comparison (%)
Table 8: Vision encoder selection comparison after mid-training. Multimodal = average-7; text = average-9; content moderation and adversarial OCR are reported as recall (%).
Stage
Metric
Single
Seq. Fusion
Channel Fusion
Pretrain
HallusionBench
17.84
18.28
17.43
Pretrain
AI2D
36.27
38.60
35.75
Pretrain
MMStar
31.47
30.87
29.50
Pretrain
OCRBench
32.50
32.70
34.50
Pretrain
average-4
29.52
30.11
29.30
SFT
HallusionBench
21.48
26.13
25.04
Table 9: Ablation results for dual-encoder visual fusion. Sequence fusion concatenates the two streams along the visual-token dimension; channel fusion keeps the token count unchanged and concatenates along the feature dimension.
Model Configuration
Weighted Overall (%)
False Positive Rate (FP, %)
Xuanwu VL-2B (Full Pipeline)
82.82
0.08
w/o GRPO
76.42
0.12
w/o SFT Data Curation
79.35
0.31
Table 10: Ablation Studies on Adversarial-Set
Appendix figures & tables17 assets
Supplementary material from the paper’s appendix.
Appendix
Category
#Datasets
#Samples
Captioning & Knowledge
13
3,956,963
Chart & Table
16
1,968,589
General VQA
34
3,266,107
Grounding & Counting
7
1,464,624
Mathematics
7
567,529
Naive OCR
26
2,232,976
Appendix
Table 11: Category-level statistics of the raw source data for the Pretrain stage
Table 12: Top-level summary of the raw source data for the Pretrain stage and dataset references
Training Stage
Data Block
Scale
Description
Mid-Training
General data
1.898M
1.75M samples are sampled at 10% from the pretraining corpus to preserve the model’s general representations. Another 148k instruction-following enhancement samples, built from AutoIF-Instruct [ 28 ] , IFEval-like Data [ 29 ] , and Tulu-3 Personas [ 30 ] , are used to improve complex instruction understanding and output-format compliance.
Mid-Training
Content moderation
646k
Positive and negative image/text moderation data contribute 598k samples, including 418k image samples and 180k text samples, covering both positive and negative moderation cases. Another 48k OCR and caption annotation samples are used to supplement OCR and caption capability in dynamic-image scenarios.
Mid-Training
Content adversarial
257k
Synthetic SPAM adversarial data contribute 50k samples, primarily built from watermark-distorted OCR images. Human-annotated SPAM adversarial data contribute 40k samples for adversarial recognition. LLM-assisted SPAM adversarial data contribute 167k samples and are all manually reviewed.
Appendix
Table 13: Training data composition of the Mid-Training stage
Training Stage
Data Block
Scale
Description
SFT
General data
8.01M
Composed of 5.14M multimodal samples and 2.87M text-only samples, used to build the foundation for general dialogue, instruction following, OCR/document understanding, and multimodal reasoning.
SFT
Content moderation
359k
Content-safety and moderation-classification data, used to strengthen content safety, moderation classification, and policy consistency.
SFT
Content adversarial
39k
Includes caption, full-image OCR, and violating-text OCR data, used to improve OCR perception and violating-text recognition in real business scenarios.
RL
Content adversarial
810k
Composed of spam-classification and OCR violating-text alignment data, used to further improve task accuracy and robustness in business settings.
Appendix
Table 14: Overall composition of post-training data
General-purpose models often struggle to reliably identify and understand real-world multimodal risks, largely due to the inherent multimodal adversarial nature of content and AI safety. We present Yuvion VL, a family of multimodal large language models purpose-built for content and AI safety, with both instruction-tuned and reasoning-oriented variants. Yuvion VL addresses this gap by treating safety as an inherently adversarial and multimodal problem and designing the entire pipeline around adversarial robustness. For data construction, we develop an automated pipeline integrating adversarial-aware data synthesis with multi-stage quality control, producing large-scale, high-quality multimodal samples augmented with domain knowledge and reasoning annotations. For training, we adopt a three-stage pipeline that includes continued pretraining for risk-concept cross-modal alignment, instruct post-training for production-grade safety tasks, and reasoning post-training for enhanced interpretability and performance in complex tasks. We further introduce Confuse-then-Contrast Fine-Tuning, a contrastive framework that mines model-specific confusions and constructs multi-image contrastive groups to enforce explicit discrimination of fine-grained visual-semantic elements, enabling the model to distinguish between visually similar cases with different safety implications in adversarial safety tasks. To support rigorous evaluation, we further introduce Yuvion VL RiskEval (YVRE), a collection of benchmarks covering diverse open and internal evaluations, with a focus on content and AI safety, adversarial robustness, and real-world capability requirements. Experiments show that Yuvion VL-32B achieves industry-leading safety performance, surpassing comparably sized open-source models and best closed-source commercial models, while maintaining comparable general capabilities.
The growing complexity of content moderation policies presents a critical challenge for their consistent operationalization. While foundation models possess the basic capabilities needed to confront this challenge, whether they can reliably moderate online content remains an unanswered question. In this paper, we systematically compare two competing paradigms for Vision-Language Model (VLM) guidance: an instruction-driven approach where models reason from policy precepts, and an example-driven approach where they generalize from prior precedents. We ground this investigation in ModerationBench, a new benchmark of 4,000 manually annotated, in-the-wild posts from the Bluesky platform. Our experiments reveal that foundation models can substantially outperform Bluesky's deployed moderation system, nearly tripling its F1 score (0.60 vs. 0.22) on Random Posts in the benchmark, with both instruction- and example-driven paradigms achieving comparable peak effectiveness. Our findings thus chart a path toward reliable and adaptable policy operationalization at scale.
Ayan Majumdar, Shounak Paul, Pushpdeep Singh +6
MPI-SWS, Germany · Saarland University, Germany · INRIA, France
Large Multimodal Models (LMMs) exhibit shortfalls when interpreting images and, by some measures, have poorer spatial cognition than young children or animals. Despite this, they attain high scores on many popular visual benchmarks, with headroom rapidly eroded by model progress. This creates a need for difficult benchmarks that remain relevant for longer. We introduce ZeroBench - a lightweight visual reasoning benchmark curated using adversarial filtering to be "impossible" for frontier LMMs at its original release, with initial SotA scores of 0% pass@1 and pass^5. We track progress on ZeroBench over the subsequent year, observing SotA reaching 6% pass^5 and 19% pass@5, indicating the potential longevity of the benchmark. We evaluate 46 LMMs on ZeroBench, compare performance to a human baseline, analyse strengths and weaknesses, chart a year of progress in visual capabilities, and publicly release ZeroBench at https://zerobench.github.io.
Jonathan Roberts, Mohammad Reza Taesiri, Ansh Sharma +31