Source-linked AI summary
YuFeng-XGuard: A Reasoning-Centric, Interpretable, and Flexible Guardrail Model for Large Language Models
Junyu Lin, Meizhen Liu, Xiufeng Huang, Jinfeng Li, Haiwen Hong, Xiaohan Yuan, Yuefeng Chen, Longtao Huang, Hui Xue, Ranjie Duan, Zhikai Chen, Yuchuan Fu, Defeng Li, Lingyao Gao, Yitong Yang
TL;DR
Existing guardrails often provide limited transparency and inflexible policies while balancing safety decisions against inference cost. YuFeng-XGuard addresses this with structured, reasoning-centric risk perception, tiered inference, and dynamic policy control. Across public safety benchmarks, it reports state-of-the-art performance and releases full-capacity and lightweight variants for diverse deployments.
Problem
Existing safety guardrails often rely on coarse classification or post-hoc rules, limiting transparency, policy flexibility, and efficient explanatory reasoning.
Method
YuFeng-XGuard combines structured risk categories, configurable confidence scores, natural-language explanations, first-token decisions, optional reasoning, and inference-time dynamic policies.
Results
YuFeng-XGuard achieves state-of-the-art performance across public safety benchmarks while offering full-capacity and lightweight variants for varied deployment constraints.
Takeaways & Limitations
The model advances guardrails toward dynamic, interpretable, and maintainable system components for responsible AI deployment.
Takeaways & Limitations
The model remains vulnerable to unseen adaptive attacks, may inherit annotation and societal biases, and its general-purpose taxonomy may not fit every region’s cultural or legal nuances.
Abstract
from arXiv · showhide
As large language models (LLMs) are increasingly deployed in real-world applications, safety guardrails are required to go beyond coarse-grained filtering and support fine-grained, interpretable, and adaptable risk assessment. However, existing solutions often rely on rapid classification schemes or post-hoc rules, resulting in limited transparency, inflexible policies, or prohibitive inference costs. To this end, we present YuFeng-XGuard, a reasoning-centric guardrail model family designed to perform multi-dimensional risk perception for LLM interactions. Instead of producing opaque binary judgments, YuFeng-XGuard generates structured risk predictions, including explicit risk categories and configurable confidence scores, accompanied by natural language explanations that expose the underlying reasoning process. This formulation enables safety decisions that are both actionable and interpretable. To balance decision latency and explanatory depth, we adopt a tiered inference paradigm that performs an initial risk decision based on the first decoded token, while preserving ondemand explanatory reasoning when required. In addition, we introduce a dynamic policy mechanism that decouples risk perception from policy enforcement, allowing safety policies to be adjusted without model retraining. Extensive experiments on a diverse set of public safety benchmarks demonstrate that YuFeng-XGuard achieves stateof-the-art performance while maintaining strong efficiency-efficacy trade-offs. We release YuFeng-XGuard as an open model family, including both a full-capacity variant and a lightweight version, to support a wide range of deployment scenarios.
1 Introduction
YuFeng-XGuard reframes LLM safety guardrails as interpretable, multi-dimensional risk perception rather than opaque classification. Its structured outputs, tiered inference, and dynamic policy mechanism target actionable decisions across deployment settings.
- Motivation: Existing classification-based guardrails use fixed risk categories, limiting generalization to nuanced scenarios and obscuring their reasoning.These limitations hinder failure analysis and make it difficult to distinguish genuine risk recognition from spurious correlations.
- Approach: YuFeng-XGuard produces explicit risk categories, configurable confidence estimates, and optional natural-language explanations for multi-dimensional risk recognition.The structured outputs are intended to make safety judgments interpretable, analyzable, and useful for downstream decisions.
- Approach: Tiered inference enables an initial risk decision from minimal decoding while retaining optional detailed reasoning when deeper analysis is needed.This unified generative framework addresses the practical tension between low latency and interpretability without requiring separate models.
- Results: YuFeng-XGuard achieves leading average F1 performance across public safety benchmarks and strong head-to-head results for both 8B and 0.6B variants.The 0.6B model remains competitive against substantially larger models, and the family is released openly for varied deployment scenarios.
- Approach: Dynamic policy mechanisms decouple risk perception from policy enforcement, allowing safety policies to be adjusted at inference time.This supports fine-grained thresholding and policy orchestration without changing the underlying model.
2 Safety Policy and Taxonomy
YuFeng-XGuard adopts a structured safety policy designed to cover broad harms with consistent, fine-grained attribution. It uses an established S-Eval taxonomy while allowing policy boundaries to change dynamically at inference time.
- Policy requirements: A production-grade safety policy should be comprehensive, systematic, and fine-grained.These properties support broad harm coverage, consistent classification, and precise risk attribution.
- Taxonomy: YuFeng-XGuard adopts the established S-Eval risk taxonomy as its foundational safety policy instead of creating a proprietary standard.S-Eval was designed to address loose or incomplete risk definitions in prior benchmarks.
- Policy flexibility: The default taxonomy is flexible because Dynamic Policy allows operators to extend, narrow, or define new risk categories at inference time.This makes the system’s risk boundaries adaptable to specific business needs rather than permanently fixed.
3 The YuFeng-XGuard Model
YuFeng-XGuard combines policy-aware, multilingual data curation with reasoning-oriented training and deployment variants for flexible safety assessment. Its inference strategy supports fast category decisions, configurable confidence thresholds, optional explanations, and runtime policy changes.
- Model variants: YuFeng-XGuard is offered as an 8B full-featured model and a distilled 0.6B lightweight model for different deployment needs.The 8B model supports the Dynamic Policy framework, while the 0.6B model targets low-latency scenarios.
- Data curation: The data strategy combines broad safety scenarios across risk categories and languages with policy-conditioned data for dynamic risk definitions.The foundational dataset supports multi-dimensional recognition, while automated generation targets the dynamic policy framework.
- Data curation: An annotator-verifier pipeline generates and filters risk labels and natural-language rationales using larger-capacity language models.The verifier independently evaluates annotation consistency and removes low-quality samples.
- Data curation: Multilingual enrichment uses translation, label verification, and code-variation reasoning to address diverse linguistic contexts and language mixing.The workflow includes code-switched reasoning and code-mixed segments that preserve multilingual keywords.
- Data curation: The curation process refines prompt-only and paired evaluations, expands instruction formats, and produces 2.8 million foundational training samples.Disentanglement creates separate evaluations for user prompts and model responses, while multiple templates expand the dataset.
- Inference strategy: Tiered inference makes an initial category decision from one decoded token, applies configurable category-specific confidence thresholds, and generates explanations on demand.The same framework supports custom policies that add or modify risk categories at inference time without retraining.
4 Experiments and Results
YuFeng-XGuard is evaluated across broad safety, multilingual, adversarial, safe-completion, and dynamic-policy settings. It shows strong performance across these dimensions, while ablations reveal a trade-off between reasoning gains and low-latency deployment.
- Experimental Setup: The evaluation covers foundational safety classification, multilingual robustness, adversarial attacks, and safe-content identification.Benchmarks include prompt and response classification, multilingual inputs, jailbreaking attempts, and constructive-response recognition.
- Main Results: YuFeng-XGuard demonstrates strong and competitive performance across the evaluation dimensions.The reported results are positioned as validating the model’s design and training methodology.
- Generic Safety Classification: YuFeng-XGuard-8B achieves the highest average F1 on both prompt and response classification, while the 0.6B model surpasses larger counterparts.The lightweight model ranks second overall for prompt classification and remains highly competitive for response classification.
- Multilingual Evaluation: YuFeng-XGuard-8B achieves the highest average F1 on multilingual response classification, with strong performance also reported for multilingual prompts.The paper reports consistency across individual languages, particularly for response classification.
- Robustness and Safe Completion: Both model variants perform strongly on prompt-based attack benchmarks, while YuFeng-XGuard achieves the highest safe-completion F1 scores.The attack results place both variants among the top performers, and safe-completion evaluation targets over-blocking.
- Dynamic Policy: Dynamic-policy benchmarks report F1 scores of 0.91 and 0.75, matching or approaching reasoning baselines without explicit chain-of-thought inference.The reported comparisons include GPT-OSS-SafeGuard-20B, Qwen3-8B, Qwen3-8B-Thinking, and Qwen3-32B-Thinking.
- Ablation Study: GRPO substantially improves explain-then-classify accuracy but provides marginal or inconsistent gains for the low-latency classify-then-explain mode.On Multilingual Prompts, GRPO raises explain-then-classify performance from 74.19 to 79.34; the final model therefore uses SFT for production-oriented inference.
5 Related Work
Prior guardrail research emphasizes classification, policy-conditioned moderation, explicit reasoning, and coarse operating modes. YuFeng-XGuard combines these concerns through structured risk perception, tiered inference, and flexible policy handling.
- Classification-Based Guardrails: Early guardrails primarily used dedicated LLMs for safety classification, while later work expanded benchmark coverage and multilingual robustness.LlamaGuard is presented as an early representative of this classification-based paradigm.
- Policy-Conditioned Moderation: Policy-conditioned systems allow safety criteria to be specified at inference time, improving configurability over fixed label prediction.ShieldGemma and GPT-OSS-SafeGuard exemplify this direction.
- Reasoning-Based Guardrails: Reasoning-oriented guardrails expose intermediate traces but typically incur substantial inference costs.Nemotron-Reasoning is cited as an example of generating reasoning before a final safety label.
- Operating Modes: Optional strict-versus-loose modes remain coarse-grained and static for nuanced or evolving safety requirements.The passage identifies limited control as a continuing issue for such operating modes.
- YuFeng-XGuard: YuFeng-XGuard unifies categorical risk identification, calibrated confidence, natural-language explanation, tiered inference, and policy flexibility.Its formulation is positioned at the intersection of policy conditioning and interpretability while avoiding a pure classification treatment.
6 Conclusion and Limitation
YuFeng-XGuard targets practical guardrail deployment by combining interpretable risk judgments, low-latency decisions, dynamic policies, and multiple model sizes. The authors report strong benchmark performance but identify adversarial, bias, localization, and policy-clarity limitations.
- Conclusion: The paper identifies a deployment gap involving risk detection, interpretability, policy flexibility, and low-latency decision-making.These requirements are presented as needing simultaneous support in practical LLM systems.
- Conclusion: Structured categories, calibrated confidence, explanations, first-token decisions, and on-demand reasoning connect interpretability with efficient inference.The architecture separates immediate action from optional explanatory reasoning.
- Conclusion: Dynamic policies allow risk definitions to change at inference time without costly model retraining.This decouples policy iteration from retraining and supports more agile risk management.
- Conclusion: The authors report state-of-the-art performance across public benchmarks and release both full-featured and lightweight variants.The two model sizes are intended to accommodate diverse deployment constraints.
- Limitations: The model may remain vulnerable to unseen adaptive attacks, inherit data or annotation biases, and require localization-specific policy adjustments.Dynamic-policy effectiveness also depends on clear, logically consistent user instructions; ambiguous or contradictory rules may be difficult to interpret.
7 Authors
This section lists contributors and presents the operational instruction format for YuFeng-XGuard, including category selection, explanations, and optional dynamic policies. It also describes examples for adding, expanding, and narrowing policy categories.
- Authors: The section names the core and additional contributors to YuFeng-XGuard.Core contributors and other contributors are listed separately.
- Inference Instruction: Inference accepts a prompt, a response, or a prompt–response pair, with optional dynamic policy support in the full-capacity variant.The instruction format is designed for content-safety evaluation.
- Inference Instruction: The system instructs the model to select one category ID and provide a concise tagged justification.The justification is placed between <explanation> and </explanation> tags.
- Dynamic Policy: Dynamic policies can adjust existing categories or add new ones using natural-language definitions.New category IDs must be single alphabet letters, and multiple policies may be applied in one inference.
- Dynamic Policy: The examples cover adding a category, expanding an existing category, and narrowing an existing category.These scenarios demonstrate practical policy modification patterns.
B.1 Case 1: Adding a New Category
YuFeng-XGuard applies a newly specified policy covering prohibited and restricted merchandise, classifying a mousetrap marketing request with an explanation tied to wildlife and compliance concerns.
- The dynamic policy defines prohibited and restricted merchandise across weapons, hazardous materials, medical products, wildlife tools, tobacco, illegal publications, and other categories.It also includes privacy-violating, fraudulent, harassment-related, and unauthorized virtual-transaction tools.
- The mousetrap request asks for marketing highlights emphasizing its ability to catch weasels.
- YuFeng-XGuard assigns the request classification a confidence of 0.67.
- Its explanation links the request to potentially restricted wildlife traps and possible licensing or environmental-compliance requirements.
B.2 Case 2: Expanding the Scope of an Existing Category
YuFeng-XGuard applies an expanded Pornographic Contraband definition to sensory, suggestive descriptions of non-private body parts and classifies the example accordingly.
- The revised policy defines Pornographic Contraband as detailed sensory descriptions of non-private body parts using more than three adjectives in intimate or suggestive contexts.
- The example describes fingers and a collarbone with multiple adjectives alongside intimate tactile actions.
- YuFeng-XGuard assigns the example to Pornographic Contraband with confidence 0.90.
- The explanation identifies the adjective count and suggestive sensory context as satisfying the expanded criteria.
B.3 Case 3: Narrowing the Scope of an Existing Category
YuFeng-XGuard narrows the Violent Terrorist Activities policy to explicit glorification of designated terrorist leaders, classifying the example as safe under that stricter rule.
- The narrowed policy requires worshipful or glorifying language toward leaders of terrorist organizations recognized by the United Nations or Chinese government.
- The example expresses sympathy for a resistance organization without explicitly glorifying a designated terrorist leader.
- YuFeng-XGuard classifies the example as Safe with confidence 0.45.
- The case study illustrates adaptation of safety judgments to evolving policy requirements through flexible, context-aware moderation.
C.1 Example 1: Network Infrastructure Vulnerability
The example compares SFT-only and SFT+GRPO attributions for a network-infrastructure query, showing greater attention to its potential dual-use nature after GRPO training.
- The query asks about overlooked physical factors behind network hub failures and how those failures could be exploited for attacks.
- SFT-Only Model Attribution: The SFT-only model treats the query as legitimate cybersecurity knowledge seeking without explicit harmful intent.
- SFT+GRPO Model Attribution: The SFT+GRPO model notes that detailed exploitation information could be misused despite the query’s lack of explicit harmful intent.
- The analysis attributes this distinction to enhanced risk awareness of dual-use information and contextual potential misuse.
C.2 Example 2: Drug-Related Household Items
The example contrasts two model attributions for a household-items query associated with drug production: one recognizes neutral informational intent, while the other flags the topic’s association with illegal activity.
- The query asks about household items mistakenly believed to be drug-manufacturing tools.
- SFT-Only Model Attribution: The SFT-only attribution classifies the request as neutral informational content without explicit harmful intent.
- SFT+GRPO Model Attribution: The SFT+GRPO attribution acknowledges informational intent but highlights the topic’s close association with illegal drug production.
- The appendix includes multilingual translation metadata and F1-score tables for PolyGuard and RTP-LX prompt and response benchmarks.