arXiv cs.CL· Junyu Lin, Mengjie Wu, Yonghao Dong, Yuchuan Fu, Jinfeng Li, Xiaodan Li, Xiaohan Yuan, Yicheng Liu, Yuefeng Chen, Hui Xue, Jingyi Wang, Yitong Yang, Jiyuan Fu, Qiang He·· 11 小时前AI 评分38
PGuard：面向多模态大语言模型的原生流式即插即用护栏
PGuard: A Native, Streaming, and Plug-in Guardrail for Multimodal Large Language Models
AI 导读
PGuard 是一种原生、流式、即插即用的多模态大语言模型护栏，直接利用骨干模型的中间表示做 token 级安全检测，不改变原推理路径与生成行为。在 SGLang 服务的 Qwen3.5-122B-A10B 上，其端到端额外开销仅 0.82-2.26%；在 Qwen3.5-9B 的文本查询上平均 F1 达 0.836，接近专用外部护栏，并在 30 多个基准上取得原生护栏中的 SOTA 表现。
正文 · 原文
Authors:Junyu Lin, Mengjie Wu, Yonghao Dong, Yuchuan Fu, Jinfeng Li, Xiaodan Li, Xiaohan Yuan, Yicheng Liu, Yuefeng Chen, Hui Xue, Jingyi Wang, Yitong Yang, Jiyuan Fu, Qiang He
Abstract:As streaming generation becomes the dominant serving paradigm for both text-only and multimodal large language models, ensuring safety throughout the generation process has become a critical challenge. We introduce PGuard, a native, streaming, and plug-in guardrail that transforms safety monitoring from an external serving dependency into an integrated capability of the backbone model. PGuard directly leverages the backbone's intermediate representations for token-level safety detection, without altering its original inference pathway or generation behavior. Specifically, dynamic layer gating selectively aggregates residual-stream representations across layers to extract safety-relevant signals during both prefill and autoregressive decoding. To balance detection accuracy and computational efficiency, PGuard supports multiple representation-modeling architectures, including a lightweight stateless variant and sequence-aware variants built on multi-scale causal EMA-attention and GRU-based recurrent modules. Its design also accounts for the execution characteristics of LLM serving frameworks, such as SGLang, optimizing computation and data access to minimize additional runtime and synchronization overhead. As a result, PGuard incurs only 0.82-2.26% end-to-end overhead on the hundred-billion-parameter backbone Qwen3.5-122B-A10B served by SGLang. Extensive evaluations across more than 30 benchmarks spanning text and multimodal safety, jailbreaks, cyber and CBRN risks, multilingual scenarios, and real-world traffic demonstrate state-of-the-art performance among native guardrails. On text queries with Qwen3.5-9B, PGuard achieves an average F1 score of 0.836, approaching dedicated external guardrails, while supporting deployment-time configuration of category-specific thresholds and enforcement actions.
| Subjects: | Computation and Language (cs.CL) |
| Cite as: | arXiv:2611.02791 [cs.CL] |
| (or arXiv:2611.02791v2 [cs.CL] for this version) | |
| https://doi.org/10.48550/arXiv.2611.02791 arXiv-issued DOI via DataCite |
Submission history
From: Junyu Lin [view email]
[v1]
Mon, 2 Nov 2026 09:03:39 UTC (1,259 KB)
[v2]
Tue, 3 Nov 2026 06:41:39 UTC (1,259 KB)
来源：arXiv cs.CL · arxiv.org