CompAgent: An Agentic Framework for Visual Compliance Verification

AI summary

Overview

Research area: Computer vision, specifically automated visual content moderation and compliance verification, using multimodal large language models (MLLMs) and agentic tool orchestration.

Technical level: Intermediate. The paper assumes familiarity with MLLMs, prompting, and computer vision detectors, but the core architecture is explained conceptually.

Scope: The paper proposes CompAgent, an agent-based system that selects vision tools dynamically according to a compliance policy and reasons over their outputs with an MLLM to decide whether an image is Safe or Unsafe.

What This Paper Is About

Checking whether images comply with content policies (nudity, violence, hate symbols, and so on) is currently done either by training bespoke classifiers on hand-labeled data or by prompting multimodal LLMs directly. Both approaches are limited: the first is expensive and goes stale as policies change, and the second misses fine-grained visual detail and struggles to apply structured rules. CompAgent addresses this by decomposing the task into a planning step that decides which specialized tools to run, and a verification step that combines tool outputs, the image, and the policy text into a single reasoned judgment.

Key Contributions

1. An agentic compliance framework. The authors describe CompAgent as the first agent-based system for visual compliance verification (as per their knowledge at the time the work was done), dynamically orchestrating vision tools such as face detection and object detection according to compliance rules.
2. Policy-aware agents. A Planning Agent parses the compliance policy to identify applicable rules and selects the most relevant tools, replacing manual tool-to-rule mapping; a Compliance Verification Agent (CVAgent) then reasons jointly over the image, policy, and accumulated tool evidence.
3. Training-free and cost-efficient design. The method requires no labeled data and no fine-tuning, which the authors argue makes it adaptable to evolving policies and practical for deployment.
4. Multi-tool evidence suite. The system packages summarization, face/object/text detection, content moderation, LlavaGuard, Safe-CLIP, and ICM Assistant into a modular suite where tools can be added, removed, or replaced without retraining.

Main Findings

• Headline benchmark results: CompAgent reaches an Unsafe F1 of 0.93 on the LlavaGuard dataset and 0.76 on UnsafeBench, with precision 0.90 / recall 0.96 / accuracy 0.93 / macro F1 0.93 on LlavaGuard and 0.82 / 0.70 / 0.87 / 0.81 on UnsafeBench. The abstract reports up to 76% F1 and a 10% improvement over the state-of-the-art on UnsafeBench.
• Zero-shot MLLMs underperform: The best zero-shot baseline is Llama 4 Maverick with Unsafe F1 of 0.55 on LlavaGuard and 0.71 on UnsafeBench, indicating that raw MLLM prompting is insufficient.
• Fine-tuned models degrade across datasets: LlavaGuard achieves 0.91 F1 with its native policy on LlavaGuard but only 0.66 on UnsafeBench with the UnsafeBench policy. SafeVision is reported at 0.81 F1 on LlavaGuard (from the original paper) but 0.50 on UnsafeBench. ImageGuard reaches 0.68 on UnsafeBench.
• Static routing is weaker than dynamic planning: The category-based routing baseline, which sends images to one of five predefined tool clusters, scores 0.61 (LlavaGuard) and 0.63 (UnsafeBench) Unsafe F1.
• Policy responsiveness favors CompAgent: On PER, BA, and PES respectively, CompAgent scores 93.98%, 94.61%, and 94.29% versus LlavaGuard's 93.38%, 92.87%, and 93.13%. The larger gains are in O7 Self-Harm BA (85.94% vs. 81.77%), O8 Animal Cruelty (91.61% vs. 85.36%), and O2 Violence (91.31% vs. 87.54%); O3 Sexual Content is identical at PES 88.32% for both.
• Policy wording matters: CompAgent's accuracy across policy versions is 93.67% (Original), 87.22% (v2), 98.50% (v3_a), 98.50% (v3_b), and 97.74% (v3_c), suggesting sensitivity to how clearly a policy is authored.
• Tools are used selectively, not exhaustively: Unsafe content escalates to safety-specialized tools (ICM Assistant 28.8% to 68.0%, Safe-CLIP 27.9% to 55.3%) while object detection drops from 89.9% to 56.7%. Unsafe images skip object detection far more often than safe ones: 43.3% vs. 10.1% on LlavaGuard and 68.4% vs. 30.7% on UnsafeBench, a 4.3x difference.
• Diverse decision paths: The framework produced 95 distinct tool usage patterns on LlavaGuard and 147 trajectories on UnsafeBench. Common paths include summary to object detection to moderation to LlavaGuard (29.9% of safe cases) and summary to object detection to LlavaGuard to ICM Assistant (14.5% of unsafe cases), with 8.2% fast-tracking through summary, LlavaGuard, Safe-CLIP, ICM Assistant.
• Ablations show every tool group matters: Removing Summarization tools drops Unsafe F1 to 0.68 (-25%), Content Detection to 0.71 (-22%), LlavaGuard to 0.67 (-26%), Safe-CLIP to 0.78 (-15%), and ICM Assistant to 0.75 (-18%).
• Newer LLMs are not automatically better: With Claude Sonnet 3.5 v2 as the agent model, Unsafe F1 is 0.93; Claude Sonnet 3.7 gives 0.91, Claude Sonnet 4 gives 0.85 (-8%), Llama 4 Scout gives 0.79 (-14%), and Claude Opus 4 gives 0.74 (-19%). The authors attribute the gap to reduced recall in newer models and argue that tool orchestration ability matters more than raw model capability.
• Qualitative failures are policy-aware: In case studies the authors flag an artistic image of a woman running between large hands as Unsafe while ground truth is Safe, and a segregation-era "COLORED WAITING ROOM" sign as Safe under the policy's educational-content exception while ground truth is Unsafe.

Methodology in Plain English

The system works in three parts. First, a Planning Agent receives the compliance policy, a description of every available tool, and instructions to alternate between reasoning ("Thought"), choosing a tool ("Action"), and reading its output ("Observation"). It runs this loop until it decides to stop, capping reasoning at 10 steps. Tool selection is not a fixed routing table: the agent reasons in context about which policy clauses still lack evidence, what each tool can and cannot do, and what has already been gathered. For example, an age-restriction policy triggers face detection, while a text-based violation policy prioritizes text detection. The implementation uses LangGraph with a ReAct prompt template and Claude Sonnet 3.5 v2 as the backbone, with no task-specific fine-tuning.

Second, a Tool Suite supplies evidence. Summarization tools produce natural-language scene descriptions. Content detection tools cover facial attributes (age range, expression, emotion, without identity recognition), object localization with bounding boxes and confidence scores, word-level OCR text extraction, and content moderation with severity labels. Specialized compliance tools include LlavaGuard (a fine-tuned MLLM giving safety ratings, categories, and rationales), Safe-CLIP (zero-shot toxic content detection across seven categories via CLIP embeddings), and ICM Assistant (template-based structured safety assessments). Each tool exposes a natural-language description and returns structured JSON.

Third, after the planning loop concludes, the Compliance Verification Agent (CVAgent)—an MLLM—receives the image, the policy, and the full evidence chain. It examines the image directly, weighs each tool output and cross-tool agreement, maps combined evidence onto specific policy clauses, and produces a binary Safe/Unsafe rating, a violation category, and a rationale. Cross-validation is central: if the summarization describes a benign scene but content moderation flags violence, the CVAgent looks at the image to adjudicate.

Evaluation uses two public benchmarks. LlavaGuard contains 1,290 test images (758 safe, 532 unsafe) across nine safety categories. UnsafeBench contains 2,037 images (1,260 safe, 777 unsafe) covering both real-world and AI-generated content across 11 categories. Metrics are Unsafe F1 (the primary metric), Unsafe precision, Unsafe recall, accuracy, and macro F1. Baselines include zero-shot prompting of Claude Opus 4, Claude Sonnet 4, Claude Sonnet 3.7, Claude Sonnet 3.5 v2, Llama 4 Scout, Llama 4 Maverick, and Pixtral Large; fine-tuned models ImageGuard, SafeVision, LlavaGuard, ICM Assistant, and Safe-CLIP; and a category-based routing baseline.

Why This Matters

Impact on research. The paper argues that agentic decomposition plus tool augmentation can beat both specialized classifiers and direct MLLM prompting without any labeled training data, and it introduces policy responsiveness metrics (PER, BA, PES) as a way to measure adaptation to policy changes rather than just static accuracy. It also opens an unexplored area: the authors state that autonomous agents had not previously been studied for visual compliance verification.

Real-world applications:

• Streaming and broadcast platforms that must screen thousands of images and videos daily against regional broadcasting codes and regulations such as GDPR and Ofcom.
• Advertising review pipelines, where creative assets must be checked against evolving, region-specific policy categories.
• Media and entertainment asset libraries, where historical or documentary material must be distinguished from promotional content under policy exceptions.
• Trust-and-safety moderation workflows that need interpretable rationales, not just binary labels, to support human reviewers and appeals.

Industry relevance. The paper notes that compliance breaches have incurred penalties up to $23 million, and that manual review is prohibitively slow at modern media scale. A training-free system that adapts when policies change—without collecting labeled data or retraining—directly addresses the cost and staleness problems the authors identify in current practice.

Future Directions

• Extension to video. The authors explicitly note that the current work covers only single-image verification and present the modular agentic design as a foundation for future video compliance verification.
• Policy authoring guidance. The gap between policy versions (v2 at 87.22% vs. v3 variants at roughly 98%) raises the question of what makes a policy machine-interpretable, and whether policy writers should be given structured authoring guidance.
• Better handling of ambiguous and artistic content. The framework over-flags a metaphorical illustration and under-flags a historical segregation sign relative to ground truth, so improved reasoning about artistic intent and historical documentation remains open.
• Model selection and robustness. Because newer Claude models performed worse than Sonnet 3.5 v2 in the agent roles, understanding why orchestration ability varies across models—and how to select agent backbones systematically—is an unresolved question.

Target Audience

Researchers and engineers working on content moderation, trust and safety, and multimodal agent systems; practitioners at streaming, media, and advertising companies who need scalable policy compliance; and readers interested in how tool-augmented LLM agents can replace task-specific classifiers in applied computer vision settings.

Note: the supplied paper text is truncated, so some supplementary material (including full prompt templates and additional qualitative traces) is only partially available. The paper carries a content warning about sensitive or disturbing imagery.

Authors’ abstract

Visual compliance verification is a critical yet underexplored problem in computer vision, especially in domains such as media, entertainment, and advertising where content must adhere to complex and evolving policy rules. Existing methods often rely on task-specific deep learning models trained on manually labeled datasets, which are costly to build and limited in generalizability. While recent Multimodal Large Language Models (MLLMs) offer broad real-world knowledge and policy understanding, they struggle to reason over fine-grained visual details and apply structured compliance rules effectively on their own. In this paper, we propose CompAgent, the first agentic framework for visual compliance verification. CompAgent augments MLLMs with a suite of visual tools-such as object detectors, face analyzers, NSFW detectors, and captioning models-and introduces a planning agent that dynamically selects appropriate tools based on the compliance policy. A compliance verification agent then integrates image, tool outputs, and policy context to perform multimodal reasoning. Experiments on public benchmarks show that CompAgent outperforms specialized classifiers, direct MLLM prompting, and curated routing baselines, achieving up to 76% F1 score and a 10% improvement over the state-of-the-art on the UnsafeBench dataset. Our results demonstrate the effectiveness of agentic planning and robust tool-augmented reasoning for scalable, accurate, and adaptable visual compliance verification.