GLiGuard: Schema-Conditioned Classification for LLM Safeguard

Abstract: Ensuring safe, policy-compliant outputs from LLMs requires real-time content moderation that can scale across multiple safety dimensions. However, state-of-the-art guardrail models rely on autoregressive decoders with 7B--27B parameters, reformulating what is fundamentally a classification problem as sequential text generation, a design choice that incurs high latency and scales poorly to multi-aspect evaluation. In this work, we introduce \textbf{GLiGuard}, a 0.3B-parameter schema-conditioned bidirectional encoder adapted from GLiNER2 for LLM content moderation. The key idea is to encode task definitions and label semantics directly into the input sequence as structured token schemas, enabling simultaneous evaluation of prompt safety, response safety, refusal detection, 14 fine-grained harm categories, and 11 jailbreak strategies in a single non-autoregressive forward pass. This schema-conditioned design lets supported task and label blocks be composed directly in the input schema at inference time. Across nine established safety benchmarks, GLiGuard achieves F1 scores competitive with 7B--27B decoder-based guards despite being 23--90$\times$ smaller, while delivering up to 16$\times$ higher throughput and 17$\times$ lower latency. These results suggest that compact bidirectional encoders can approach the accuracy of much larger guard models while drastically reducing inference cost. Code and models are available at https://github.com/fastino-ai/GLiGuard.

• The paper introduces a schema-conditioned encoder that reframes LLM moderation as a multi-task classification problem, enabling single-pass evaluation.
• It achieves competitive harmfulness detection with an average prompt F1 near top baselines while reducing latency and increasing throughput by up to 16×.
• The results suggest that encoder-centric guardrails offer a scalable, flexible alternative to large autoregressive models for real-time moderation.

Schema-Conditioned Guardrail Modeling for Efficient Multi-Aspect LLM Moderation

Motivation and Context

Ensuring policy-compliant output from LLMs is critical for real-world deployment, especially given their propensity to generate unsafe, misleading, or adversarial content. Existing guardrail systems, such as LlamaGuard, WildGuard, ShieldGemma, PolyGuard, and Qwen3Guard, approach moderation as instruction-following classification using large autoregressive decoder models. These architectures inherently reformulate classification as sequential generation, leading to heightened latency, scaling inefficiency for multi-aspect moderation, and substantial inference costs due to multi-billion parameter footprints. Despite extensive parameterization, these models demonstrate diminishing returns in accuracy at increased scale and struggle to offer real-time moderation across diverse safety taxonomies.

GLiGuard addresses these fundamental inefficiencies by recasting LLM moderation as a multi-task, schema-conditioned classification problem using a compact 0.3B bidirectional encoder adapted from GLiNER2. The schema-conditioned design enables flexible, simultaneous evaluation of prompt safety, response safety, harm categorization (14 categories), jailbreak detection (11 strategies), and refusal detection, all in one non-autoregressive forward pass. Label semantics and task definitions are dynamically encoded in the input, enabling composable moderation schemas at inference and full context-aware multi-aspect filtering without prompt engineering or output head redesign.

Figure 1: GLiGuard multi-task moderation overview. Given a text (prompt or response) and a user-specified task schema, GLiGuard produces predictions for all selected tasks in a single forward pass.

Model Architecture

GLiGuard's architecture is built around an encoder-centric schema composition. Task and label blocks, including natural-language label descriptions, are concatenated into a unified token sequence along with the input text. Special tokens ([P], [L], [SEP]) delimit tasks and labels, enabling extraction of contextualized embeddings for each label during encoding.

The model leverages a pretrained DeBERTa-based transformer encoder, processing the entire schema-text sequence under full bidirectional attention. Label embeddings are extracted at the positions of [L] tokens—these contextualized vectors are jointly informed by the moderation schema and text features. A shared MLP head scores each candidate label per task, applying softmax for single-label tasks (safety, refusal) and sigmoid for multi-label tasks (harm category, jailbreak strategy).

Multi-task training is conducted with per-task cross-entropy objectives, allowing arbitrary combinations of moderation tasks without architectural adjustment. The inference pipeline requires only one encoder pass plus K lightweight MLP evaluations for K moderation tasks, with hard decision rules composing the final safety verdict. Notably, auxiliary predictions (harm and jailbreak categories) act as monotonic recall-enhancing overrides to the binary safety classifier.

Figure 2: GLiGuard architecture. It jointly encodes a linearized task-label schema with the input text, then scores each label via a shared MLP classifier to perform multi-task safety classification in a single pass.

Empirical Results

GLiGuard is evaluated against six leading autoregressive decoder-based guardrail models spanning 7B–27B parameters over nine safety benchmarks, including OpenAI Moderation, Aegis2.0, SimpleSafetyTests, HarmBench, WildGuardTest, SafeRLHF, BeaverTails, and XSTest. Results are reported as macro F1, with final harmfulness verdicts composed via Safety + Harm decision rules, empirically yielding optimal recall–precision tradeoffs.

Accuracy

GLiGuard achieves average prompt harmfulness F1 of 87.7, within 1.7 points of the best baseline (PolyGuard-Qwen-7B, 89.4), outperforming LlamaGuard4-12B (82.5), ShieldGemma-27B (69.6), and NemoGuard-8B (84.6) despite being 23–90× smaller. On response harmfulness detection, it attains second-highest average F1 (82.7), besting all but Qwen3Guard-8B-Gen (84.1), with particularly strong performance on HarmBench (91.0) and SafeRLHF (84.5).

Latency and Throughput

GLiGuard delivers up to 16.2× higher throughput (133 vs. 8.2 samples/s at batch size 4) and 16.6× lower latency (26 ms vs. 426 ms at sequence length 64) compared with decoder-based guardrails, including Qwen3Guard-8B and ShieldGemma-27B. The efficiency improvement is consistent across batch sizes and sequence lengths, attributable to non-autoregressive sequential encoding and substantially reduced parameter count.

Scale–Performance Efficiency

Accuracy vs. scale plots demonstrate that increased parameterization among decoder guards does not guarantee elevated safety classification performance. GLiGuard occupies a Pareto-optimal region, attaining strong accuracy per parameter and superior deployment suitability in latency- or memory-constrained pipelines.

Figure 1: GLiGuard multi-task moderation overview. Given a text, the schema is composed at inference, enabling efficient multi-aspect evaluation.

Figure 2: GLiGuard architecture overview highlighting context-aware schema–text encoding and per-label scoring via shared MLP.

Practical and Theoretical Implications

GLiGuard sets a new paradigm for composing moderation frameworks: schema-conditioned encoders allow rapid, flexible evaluation of arbitrary safety policies and taxonomies at deployment, promoting modularity and generalization. The bidirectional context improves capture of long-range harm signals, including those manifesting late in a text or dependent on cross-task cues. The empirical latency improvements unlock real-time moderation for consumer-facing agents and enterprise APIs, where decoder-based models would be prohibitively slow or costly.

Theoretically, the results call into question the necessity of decoder-based instruction-following architectures for moderation settings. The diminishing accuracy returns with scale and the competitive performance from GLiGuard’s compact encoder reinforce that task formulation and data quality may supersede raw parameter count for safety-critical classification.

Limitations include sensitivity to benign trigger words (overflagging), reduced robustness to adversarial roleplay-wrapped harmful intent, and reliance on schema quality for optimal recall/precision balancing. Future directions involve benchmarking generalization to alternative moderation schemas, experimenting with context window expansion, and introducing explicit adversarial robustness mechanisms.

Conclusion

GLiGuard demonstrates that schema-conditioned bidirectional encoders can provide competitive multi-aspect LLM moderation performance at a fraction of the inference cost and latency relative to decoder-based guardrails. Flexible schema composition, robust accuracy–efficiency tradeoffs, and deployment-friendly throughput position GLiGuard as a scalable solution for real-time LLM safety moderation. The findings suggest a shift toward encoder-centric guardrails, with ongoing research required to improve robustness to subtle adversarial strategies and broaden schema adaptivity.

(2605.07982)