arXiv cs.CL· Ashmiya Lenin, Navaneeth Sangameswaran, Preetham S·· 11 小时前AI 评分44
HaloGuard 2.0：开源权重的中文多语言响应安全输出护栏
HaloGuard 2.0: An Open-Weights Constitutional Output Guard for Multilingual Response Safety
AI 导读
HaloGuard 2.0 是一个开放权重的流式输出护栏，对每个响应 token 单次前向传播给出安全/不安全概率，可在确认有害时中断流。其 0.8B 版本在六个英文响应安全基准上宏 F1 达 83.6（较 72.8 提升），误报减少 38%，参数量比最强全响应护栏少 5-10 倍，并高出最强流式护栏 Qwen3Guard-Stream-4B 2.6 分。
正文 · 原文
Abstract:An input guard decides whether a request reaches the model, but never sees what the model says. Harm that emerges during generation, because a jailbreak passed the input layer or a benign request drifted into operational detail, is visible only on the output side and only as tokens arrive. We present HaloGuard 2.0, an open-weight streaming output guard that assigns a safe/unsafe probability to every response token in a single forward pass, so a deployment can stop the stream once harm is confirmed. The guard reuses the constitution of HaloGuard 1.0, our input guard, to organise a 478,532-response training corpus, and supervises each token from the point where the response becomes harmful. We find that a guard trained on conventionally shaped data learns a shortcut specific to streaming: it judges the prompt instead of the response, and handles only 13.9% of matched safe/unsafe response pairs correctly. We correct this with a second phase on 106,043 counterfactual responses built around the base guard's own failure modes, and release the equal-weight average of the base and corrective models. On six English response-safety benchmarks, HaloGuard 2.0-0.8B reaches a macro F1 of 83.6 (83.3 on held-out halves of the decision-rule search), up from 72.8, with 38% fewer false positives. It matches the strongest full-response guards with 5-10x fewer parameters and is 2.6 points above the strongest streaming guard, Qwen3Guard-Stream-4B. A multilingual variant, HaloGuard 2.0-Poly-0.8B, trained on PolyGuardMix, reaches 83.1 F1 on the response labels of PolyGuardPrompts across 17 languages, 5.0 points above the strongest baseline. On one H100 the guard costs 0.37 ms per token per stream when moderating 64 concurrent responses. Both guards are hardened continuously through the weekly red-teaming protocol of HaloGuard 1.0, extended here to the output layer.
| Comments: | 23 pages, 6 figures, 16 tables |
| Subjects: | Computation and Language (cs.CL); Cryptography and Security (cs.CR) |
| ACM classes: | I.2.7 |
| Cite as: | arXiv:2611.02134 [cs.CL] |
| (or arXiv:2611.02134v1 [cs.CL] for this version) | |
| https://doi.org/10.48550/arXiv.2611.02134 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Ashmiya Lenin [view email]
[v1]
Sun, 1 Nov 2026 19:09:12 UTC (181 KB)
来源：arXiv cs.CL · arxiv.org