Alibaba Security AGI Unveils Three LLMs, 8B Model Beats GPT‑5.4 on Multiple Safety Metrics

Model Release Overview

Alibaba Security AGI Lab’s “Yuvion” team released three large language models (LLMs) built on the Qwen‑3 series: Yuvion‑8B (80 billion parameters, lightweight), Yuvion‑32B (320 billion parameters, flagship), and Yuvion‑32B (Agent) which adds an Agent‑RL stage for enhanced business capability.

Yuvion LLMs claim comprehensive superiority in AI safety and content‑security dimensions, including open‑source security tests, static and dynamic adversarial evaluations, and industrial‑grade deployment assessments. The 32B model is reported to rank first across these metrics, surpassing larger models such as GPT‑5.4 and Qwen‑3‑Max, while the 8B model remains competitive against many higher‑parameter baselines.

1. Security as Adversarial Capability

Security is described as the “back side” of general intelligence: stronger models present greater risk of misuse. Attackers exploit emojis, homophones, and character manipulation to evade detection, and conventional filters struggle with deliberately crafted obfuscations.

Yuvion adopts the principle “adversarial = intelligence” and builds two layers of defense:

Base‑model adversarial robustness : ability to recognize disguised, obfuscated, semantically rewritten, and cross‑language malicious intents at the input level.

Generalized Agent adversarial capability : extending protection from input classification to task planning, tool‑chain interaction, and execution flow, making the Agent itself a comprehensive adversarial component.

2. Data System – Five Data Types Forming the Safety Foundation

The training data follows a “garbage‑in, garbage‑out” principle, emphasizing structured, attack‑focused datasets. Yuvion constructs five data categories:

General data – preserves basic language abilities (instruction following, QA, reasoning, reading comprehension).

Security‑domain data – builds core security cognition and discrimination, including risk understanding, fine‑grained safety categories, and response strategies.

Adversarial data – teaches the model to spot “masked risks” by mimicking real attacks that rewrite, confuse, or disguise harmful intent without changing the underlying risk.

Agent data – supports multi‑step security workflows involving reasoning, retrieval, and tool interaction, such as tool‑use traces and retrieval‑augmented decision making.

Synthetic and expert‑crafted data – expands long‑tail coverage with high‑quality supervision for complex tasks, structured reasoning samples, and preference data.

3. Training Paradigm – Three‑Stage Progressive Safety Training

Stage 1: Knowledge‑enhanced Continued Pre‑training

Before task specialization, safety concepts, rules, and relationships are “internalized” into the model distribution using triples, sentences, and knowledge‑derived texts covering content‑moderation standards, risk knowledge bases, violation patterns, and long‑tail adversarial expressions.

Stage 2: Policy‑Grounded Multi‑Task Safety Fine‑tuning

This stage addresses whether the model can reliably act under crafted attacks. It comprises:

Risk‑Aware SFT – supervised fine‑tuning on a mix of natural‑distribution data and adversarial data, training the model to judge intent, context, and audit standards rather than surface risk tokens.

GRPO‑based Policy Optimization – Group Relative Policy Optimization normalizes advantage estimates across candidate output groups. Rewards consider final decision correctness, policy consistency, attribution quality, and robustness under adversarial or structurally complex inputs.

GRPO is argued to be more suitable than standard SFT for maintaining stable strategies under ambiguity, distribution shift, and adversarial pressure.

Stage 3: Safety‑aware Agentic RL Training

Many security tasks require multi‑step processes involving external knowledge bases, retrieval, tool calls, and workflow execution. The Agent stage trains the model to retain safe decision‑making throughout the entire chain.

Two sub‑directions are explored:

Tool‑integration reasoning – the model generates outputs that include reasoning steps, tool calls, and full execution traces, supervised by format and correctness rewards.

Search‑enhanced reasoning – for tasks beyond the model’s parametric knowledge, the model learns when and how to retrieve information, with combined result and execution rewards.

A case study on trademark‑infringement review shows that the pre‑Agent model would simply “finish” with textual reasoning, whereas the Agent‑RL model correctly invokes a “check_image_tool” to perform image‑based trademark detection, following an evidence‑first workflow.

4. Evaluation Framework – YLRE Four‑Level Benchmark Suite

The Yuvion LLM RiskEval (YLRE) comprises 93 test sets across four levels:

Level 1: General Capability

30+ benchmarks (MMLU, C‑Eval, GSM8K, BBH) verify that safety specialization does not significantly degrade language ability. Yuvion‑32B scores 79.88 % average, only ~1 % lower than the non‑specialized Qwen‑3‑32B (80.99 %).

Level 2: Open‑Source Content Safety

Macro F1 78.2 % – 4.3 pts ahead of the runner‑up.

ChineseHarm F1 97.9 % – 12.6 pts ahead of industry models.

False‑positive rate 0.18 % – 16× lower than the 2.91 % of generic models.

Level 3: Self‑Constructed Adversarial Tests

Static adversarial benchmarks show Yuvion‑32B achieving the highest scores across four major categories.

Dynamic adversarial tests report an effective attack rate of 20.6 %, the lowest among evaluated models, improving 1.7‑3.8 percentage points over the best competitors.

Level 4: Internal Capability and Business Evaluation

Domain capability – Yuvion‑32B attains a composite score of 85.78, surpassing GPT‑5.4 (80.73) by 5.05 points and Qwen‑3‑Max (81.41) by 4.37 points. General Guard models perform poorly in this dimension, highlighting a gap between generic safety and fine‑grained business needs.

Business evaluation – Yuvion‑32B scores 86.34, outpacing GPT‑5.4 (80.40) by nearly 6 points. The Agent version further improves scores in both domain and business tests, confirming quantifiable gains from Agent capabilities.

References

https://arxiv.org/abs/2606.27632
Yuvion LLM: An Adversarially‑Aware Large Language Model for Content And AI Safety
https://hf-mirror.com/Alibaba-AAIG/YuFeng-XGuard-Reason-8B