Vision-language models (VLMs) can comply with harmful requests delivered through images, even when their LLM backbones would refuse the same content in text. While prior work characterizes these jailbreaks empirically or at the representation level, how visual inputs perturb safety pathways at the neuron level remains uncharted. We close this gap with a causal, neuron-level analysis of safety mechanisms in 10 VLMs. We propose a two-stage detection pipeline with iterative ablation that accounts for self-repair, and introduce two modality-isolated benchmarks, ViSafe-Detect and ViSafe-Eval, which decouple visual and textual safety signals.

Our analysis reveals: (i) Text safety in VLMs is localizable: ~88 neurons (<0.01%) whose targeted ablation substantially reduces refusal. (ii) Text safety neurons constitute the dominant refusal pathway: ablating them is the only intervention that consistently and substantially reduces refusal across all models. (iii) Visual safety is high-dimensional and diffuse at the single-neuron level: text safety concentrates in ~5 subspace directions while visual safety requires ≥50. This gap holds across architectures, explaining why current alignment has not closed the visual safety gap. Project page is at: https://jiaxuan-li.github.io/vlm-safety-neuron/.

Warning: this paper may include examples of harmful content.

Effective LLM safety guardrails must balance adversarial robustness, custom-policy adaptability, and precision on benign prompts with sensitive vocabulary. We introduce the Guardrail Trinity, a data-curation recipe combining procedural safety schemas, reasoning chain decomposition with hard-negative supervision, and a hybrid data blend for fast and slow inference. Experiments across Llama-3.1 and Qwen3 models yield three practical insights. First, strong standard moderation scores can conceal a custom-policy compliance gap; procedural schema variation improves adaptation on our held-out policy-shift probe. Second, augmentation must be matched to model scale and training recipe: smaller models can exhibit training instability, while hard negatives at larger scales can reduce false alarms at a cost to harmful-input recall. Third, hybrid training supports both direct classification and reasoning, with the fast mode retaining strong custom-policy compliance without generating a chain. Together, these findings motivate a deployment playbook that selects data composition, inference mode, and scale jointly, and validates both policy adherence and the trade-off between missed harms and false alarms.