YuFeng-XGuard: A Reasoning-Centric, Interpretable, and Flexible Guardrail Model for Large Language Models

• Classification-based guardrails bind judgments to training-time categories and provide little reasoning, limiting generalization to nuanced or compositional risks and obscuring failure analysis.The paper motivates modeling risk as structured inference over multiple dimensions, severity, and rationale.Source: §1 · p. 2
• YuFeng-XGuard achieves state-of-the-art performance across public safety benchmarks, leads average F1, and both 8B and 0.6B variants win qualitative comparisons, with 0.6B competitive against larger models.The open model family includes full-capacity 8B and lightweight 0.6B variants for different deployment constraints.Source: §1 · pp. 2–3
• YuFeng-XGuard outputs explicit risk categories and configurable confidence scores, with optional natural-language explanations that make safety judgments more interpretable and actionable.The fine-grained signals support downstream thresholding and policy orchestration.Source: §1 · pp. 2–3
• Its tiered inference framework gives an initial risk decision from the first decoded token and can continue with detailed reasoning when deeper analysis is needed.The first-token probability serves as confidence, balancing low latency with on-demand explanations without requiring separate models.Source: §1 · pp. 2–3
• Dynamic Policy separates risk perception from enforcement, letting operators add categories or change existing criteria through inference-time instructions without retraining.A built-in taxonomy remains the default policy, while runtime adjustments support evolving requirements.Source: §1 · p. 3

2 Safety Policy and Taxonomy

• A production-grade safety policy should be comprehensive, systematic, and fine-grained to support precise risk attribution.The paper identifies these as requirements for a robust guardrail policy.Source: §2 · p. 3
• YuFeng-XGuard adopts S-Eval’s four-level taxonomy, which spans 9 major risk dimensions and 28 subdivided categories.The taxonomy is presented as a unified foundation for clear and comprehensive risk classification.Source: §2 · p. 3
• Operators can use the DP framework at inference time to extend, narrow, or redefine the default risk categories for business needs or emerging threats.The default taxonomy is therefore not a static boundary.Source: §2 · p. 3

3 The YuFeng-XGuard Model

• The model family uses the Qwen3 architecture, pairing an 8B full-featured model with a 0.6B model distilled for low-latency use.The 8B model supports advanced capabilities including Dynamic Policy; the lightweight model inherits its classification and reasoning performance.Source: §3 · p. 3

3.1 Data Curation for the Main Model

• Data curation combines a broad, quality-filtered foundational dataset with policy-aware synthetic data, using annotators to generate labels and rationales and verifiers to check consistency.The two-stage annotation pipeline uses larger-capacity language models as annotator and verifier.Source: §3.1 · pp. 4–5

3.1.1 Construction of the Foundational Training Corpus

• Multilingual data construction covers 25 representative languages and addresses language mixing and English-centric reasoning through translation and code-variation strategies.Translated examples were checked for label consistency, and code-switched and code-mixed reasoning data were constructed.Source: §3.1.1 · p. 5

3.1.2 Automated Data Generation with Dynamic Policy

• Dynamic-policy training data uses mutated rules, counterfactual judgments, a second-pass response generation, and verifier filtering to teach policy-conditioned decisions.Rules can add categories or expand or narrow existing ones; the second pass generates judgments and explanations from the supplied policy, and inconsistent samples are discarded.Source: §3.1.2 · p. 6

3.2 Training Pipeline

• Supervised fine-tuning trains a classify-then-explain sequence, with the first token encoding the risk category and subsequent tokens providing its natural-language rationale.Inputs can include system and dynamic policies alongside a prompt, a response, or a prompt-response pair.Source: §3.2 · p. 7

3.3 The Lightweight Version

• The 0.6B lightweight model is distilled from the 8B teacher using complementary forward and reverse KL objectives.It skips Dynamic Policy data generation and RL training while inheriting the teacher’s classification and attribution performance.Source: §3.3 · p. 7

3.4 Inference Strategy

• A first-token risk category and configurable category-specific confidence thresholds enable fast decisions, with explanations generated on demand for auditing or review.Users can also supply runtime policies to add risk categories or modify standards without retraining.Source: §3.4 · p. 8

4.1 Experimental Setup

• The evaluation uses public benchmarks across four dimensions: generic safety classification, multilingual prompt and response classification, resistance to jailbreaking attempts, and safe-completion classification.Source: §4.1 · p. 9

4.2.1 Performance on Generic Safety Classification

• YuFeng-XGuard-8B achieves the highest average F1 on both prompt and response classification, while the 0.6B model ranks second on prompts and surpasses larger counterparts on responses.The prompt comparison includes NemotronReasoning-4B and Qwen3Guard-Gen-4B; the response result is reported in Table 3.Source: §4.2.1 · p. 9, Table 3 · p. 9

4.2.2 Performance on Multilingual Classification

• On multilingual benchmarks, YuFeng-XGuard-8B has the highest average F1 for response classification and competitive prompt-classification performance; the 0.6B model is presented as viable for resource-constrained settings.The reported performance is consistent across individual languages, with a leading score highlighted in Appendix E.Source: §4.2.2 · p. 10, Table 4 · p. 10

4.2.3 Performance on Attack Instructions

• Both YuFeng-XGuard versions achieve the highest and second-highest average F1 scores, respectively, on prompt-based attack benchmarks.The evaluation measures resilience to adversarial jailbreaking attempts.Source: §4.2.3 · p. 10, Table 5 · p. 11

4.2.4 Performance on Safe Completion Benchmarks

• On SEval2.0, YuFeng-XGuard achieves the highest F1 scores among models for both prompt and response classification, while the 0.6B model earns top scores in its comparison group.The benchmark tests whether guardrails correctly pass constructive responses, addressing over-blocking.Source: §4.2.4 · p. 10, Table 6 · p. 11

4.3 Effectiveness of Dynamic Policy

• YuFeng-XGuard scores 0.91 F1 on the e-commerce dynamic-policy benchmark, versus 0.77 for GPT-OSS-SafeGuard-20B and 0.49 for Qwen3-8B.It matches Qwen3-8B-Thinking at 0.92 while avoiding explicit chain-of-thought reasoning at inference time.Source: §4.3 · p. 12, Table 7 · p. 12
• YuFeng-XGuard scores 0.75 F1 on adaptive policy scope, versus 0.67 for GPT-OSS-SafeGuard-20B and 0.07 for Qwen3-8B, approaching Qwen3-32B-Thinking at 0.77.The benchmark tests dynamically instructed expansion or narrowing of risk-category scope; YuFeng-XGuard does so without explicit reasoning chains.Source: §4.3 · p. 12, Table 8 · p. 12

4.4 Ablation Study on Reinforcement Learning

• GRPO raises explain-then-classify Multilingual Prompts performance from 74.19 to 79.34, but direct-classification gains are marginal or inconsistent, so the final model uses full-data SFT.On the 2-million-sample ablation, SFT classify-then-explain generally matches or outperforms explain-then-classify; the latter also incurs higher latency.Source: §4.4 · p. 13, Table 9 · p. 13

Related Work

• LlamaGuard (Llama Team, 2024), WildGuard (Han et al., 2024), and PolyGuard (Kumar et al., 2025) advanced LLM guardrails and cross-domain or multilingual generalization, but remain classification-centric.LlamaGuard established dedicated-LLM safety classification; later work expanded coverage and robustness through broader benchmarks and multilingual datasets.Source: §5 · p. 13
• ShieldGemma and GPT-OSS-SafeGuard (OpenAI, 2025) enable inference-time user-defined safety instructions, but depend on policy specification and lack unified calibrated risk perception across policies.Source: §5 · p. 13
• Nemotron-Reasoning (Sreedhar et al., 2025) exposes safety judgments with reasoning traces but incurs substantial inference overhead; Qwen3Guard (Zhao et al., 2025) offers strict or loose modes that remain coarse-grained and static.Source: §5 · pp. 13–14
• YuFeng-XGuard unifies categorical risk identification, calibrated confidence estimation, and natural-language explanation, with risk decisions available from the first decoded token and deeper reasoning on demand.Its dynamic policy mechanism decouples risk understanding from policy enforcement, allowing safety criteria to change without retraining.Source: §5 · p. 14

6.1 Conclusion

• Structured risk categories, calibrated confidence scores, and natural-language explanations make judgments actionable, while first-token decisions enable low-latency action with optional explanatory reasoning.The dynamic policy framework also allows risk definitions to be changed at inference time without model retraining.Source: §6.1 · p. 14
• YuFeng-XGuard reports state-of-the-art performance across public benchmarks and offers full-capacity and lightweight models for different deployment constraints.The conclusion presents these options as part of a guardrail designed for practical LLM systems.Source: §6.1 · p. 14

6.2 Limitations

• Limitations include vulnerability to unseen attacks, potential data and annotation biases, imperfect local policy fit, and difficulty interpreting ambiguous or contradictory instructions.The paper calls for continuous red-teaming, bias monitoring and mitigation, and careful locale-specific policy adjustment.Source: §6.2 · p. 14

A Inference Prompt Templates

• Inference can evaluate a prompt, a response, or a prompt–response pair, and the full-capacity variant optionally accepts a dynamic policy.The prompt presents a safety-audit classification task over a predefined category list.Source: A Inference Prompt Templates · p. 17
• The prompt requests one most-relevant category ID followed by a concise justification enclosed in <explanation> tags.This specifies the category-and-explanation output format.Source: A Inference Prompt Templates · p. 17
• Users can adjust existing categories with their built-in IDs and natural-language policy definitions, or add categories with a name and single-letter ID; multiple policies can apply in one inference.The single-letter ID is required so the category ID is represented as one token.Source: A Inference Prompt Templates · p. 17

B Dynamic Policy Case Studies

• Dynamic-policy case studies demonstrate adding a category, expanding an existing category’s scope, and narrowing an existing category’s scope.Source: B Dynamic Policy Case Studies · p. 18

B.1 Case 1: Adding a New Category

• The new merchandise category covers prohibited or restricted goods, including weapons, controlled substances, hazardous materials, medical products, wildlife tools, tobacco, and privacy-violating or fraudulent tools.The definition also includes illegal publications and virtual items involving unauthorized transactions.Source: §B.1 · p. 18
• The example request asks for three online marketing highlights for a mousetrap, emphasizing its ability to catch weasels.Source: §B.1 · p. 18
• The mousetrap marketing request is classified as category a with confidence 0.67 because it may promote wildlife traps or other regulated merchandise.The explanation notes potential wildlife-protection, licensing, and environmental-compliance concerns.Source: §B.1 · p. 18

B.2 Case 2: Expanding the Scope of an Existing Category

• The expanded Pornographic Contraband definition prohibits detailed sensory descriptions of non-private body parts using more than three adjectives in an intimate or suggestive context.The instruction lists collarbones, ankles, napes, fingernails, and lips as examples of non-private body parts.Source: §B.2 · p. 19
• The collarbone passage was classified as pc with 0.90 confidence because adjective-heavy tactile details create a sexually suggestive atmosphere under the expanded criteria.The explanation describes the collarbone as a non-private body part and the action as intimate, in a non-medical, non-artistic context.Source: §B.2 · p. 19

B.3 Case 3: Narrowing the Scope of an Existing Category

• The case applies the narrowed policy to the “ter” category, Violent Terrorist Activities.Source: §B.3 · p. 19
• The narrowed definition requires worshipful or glorifying language toward leaders of terrorist organizations recognized by the UN or Chinese government.The policy change is intended to reduce false positives.Source: §B.3 · p. 19
• Under the revised “Violent Terrorist Activities” rule, the sample is classified as safe (confidence 0.45) because it lacks explicit glorification of terrorist leaders.The explanation notes that implied sympathy for a resistance organization does not meet the stricter criteria.Source: §B.3 · p. 19
• The revised rule treats implied sympathy for a resistance organization as insufficient for a “Violent Terrorist Activities” violation.The example text describes the organization’s resistance but does not explicitly glorify it or its leaders.Source: §B.3 · p. 19
• The policy adjustment illustrates how YuFeng-XGuard can adapt safety judgments to evolving requirements for flexible, context-aware moderation.Source: §B.3 · p. 19

C GRPO Case Studies

• The GRPO case studies offer qualitative examples of improved attribution quality and risk awareness.Source: C GRPO Case Studies · p. 19

C.1 Example 1: Network Infrastructure Vulnerability

• The query asks which overlooked physical factors can cause network hub failures and how attackers might exploit them.Source: §C.1 · p. 20
• The SFT-only model classifies the query as legitimate cybersecurity knowledge, noting no explicit harmful intent or dangerous-information request.It characterizes the inquiry as technical knowledge seeking about network infrastructure vulnerabilities.Source: §C.1 · p. 20
• The SFT+GRPO attribution says the query does not explicitly request illegal or harmful actions, but detailed exploitation information could be misused.Source: §C.1 · p. 20
• The SFT+GRPO model identifies potential misuse in the query despite its technically neutral framing.Its analysis describes this as enhanced risk awareness and more nuanced reasoning about context and potential misuse.Source: §C.1 · p. 20

C.2 Example 2: Drug-Related Household Items

• The example asks which common household items are mistakenly believed to be drug-manufacturing tools.Source: §C.2 · p. 20
• The SFT-only attribution characterizes the query as a neutral informational request without explicit harmful intent.Source: §C.2 · p. 20
• It says the query neither requests, endorses, nor describes illegal activity.Source: §C.2 · p. 20
• The SFT-only attribution places the query within legitimate public-safety awareness contexts.Source: §C.2 · p. 20
• The SFT+GRPO attribution notes that the topic is closely associated with illegal drug production despite its informational appearance.Source: §C.2 · p. 20

D Language Family

• Table 10 covers languages and families for the selected multilingual translations.Source: Table 10 · p. 21
• Table 10 also identifies branches, scripts, and ISO 639-1 codes for those translations.Source: Table 10 · p. 21

E Multilingual Performance on Individual Languages

• F1 scores are reported for PolyGuard and RTP-LX prompt benchmarks.The tables are identified as covering prompt benchmarks, but the supplied passages do not provide individual-language values.Source: Table 11 · p. 21, Table 12 · p. 22
• F1 scores are reported for PolyGuard and RTP-LX response benchmarks.The tables are identified as covering response benchmarks, but the supplied passages do not provide individual-language values.Source: Table 13 · p. 22, Table 14 · p. 23