Opir: Efficient Multi-Task Safety Classification for Toxicity, Jailbreaks, Hate Speech, and Harmful Content

Abstract: Real-time safety filtering for LLM applications requires classifiers that can detect unsafe prompts, toxic language, jailbreak attempts, and unsafe responses without the cost profile of large guardrail models, and that can distinguish benign sensitive text from genuinely covert harmful content. In this paper, we introduce Opir, a family of encoder-based guardrail models built on the GLiClass architecture. Opir includes multi-task models for binary safe/unsafe classification, multi-label toxicity classification, jailbreak classification, and zero-shot unsafe prompt and response categorization. We also release edge variants with fewer than 100M parameters dedicated to binary safe/unsafe categorization. The models are trained on a three-level taxonomy containing 996 categories across 16 top-level labels, 126 mid-level labels, and 854 leaf labels. Opir's training data combines taxonomy-grounded unsafe prompts, adversarially mined hard negatives, benign safety-preserving examples, generated response examples, multilingual translations, and portions of the Aegis2 and WildGuard training subsets. We also open-sourced an evaluation harness that supports GLiClass and GLiNER2 backends as well as decoder-based models, and covers binary safety classification, multi-label categorization, toxicity, jailbreak detection, prompt safety, response safety, response refusal, and prompt subcategory views across public benchmark families. Across an expanded comparison spanning 12 safety-classification tasks and 17 category tasks against eight contemporary guardrail systems -- including both GLiNER2-based and generative guardrail models -- Opir variants are competitive on or ahead of the strongest open-weight baselines on the majority of benchmark datasets while operating with a substantially smaller deployment footprint.

• The paper introduces an efficient encoder-based multi-task moderation model that significantly reduces latency while maintaining high accuracy in detecting diverse harmful content.
• It employs a comprehensive taxonomy of 996 labels across 16 categories and leverages a GLiClass framework with hybrid loss for precise classification tasks.
• Empirical evaluations across 29 datasets demonstrate that Opir outperforms decoder-based guardrails by achieving 10–30× faster inference with competitive accuracy.

Opir: Efficient Encoder-Based Multi-Task Safety Classification for LLM Moderation

Motivation and Context

Robust real-time safety filtering for LLM-driven applications is a critical requirement as these systems scale into agentic, open-ended, and multi-user environments. Moderation layers must detect a wide spectrum of harmful content—ranging from toxicity and hate speech to jailbreaks and prompt-injection adversarial attacks—while minimizing latency and operational footprint. Existing guardrails, such as Llama Guard, WildGuard, PolyGuard, and Nemotron Safety Guard, frequently rely on large decoder-only models with high inference costs, often emphasizing binary safe/unsafe classification and offering limited granularity or multilingual robustness.

Opir addresses these challenges by introducing an encoder-centric, GLiClass-based model family, explicitly designed for multi-task safety classification with broad taxonomic coverage and deployment efficiency. The work situates itself at the intersection of classical moderation, LLM-specific attack detection, multilingual safety, and the next generation of low-latency encoder architectures.

Task Formulation and Prediction Architecture

Opir models support four principal moderation tasks: binary safe/unsafe classification, multi-label toxicity detection, multi-label jailbreak recognition, and zero-shot taxonomy-based unsafe categorization. Task views are driven by configurable label schemas, allowing explicit binary and fine-grained outputs on both prompts and responses.

Figure 1: Overview of Opir prediction tasks. Safe/unsafe classification is modeled as binary classification, while toxicity, jailbreak, and unsafe-category prediction are modeled as multi-label classification heads over task-specific label schemas.

The architecture leverages GLiClass, extending the GLiNER zero-shot NER framework. Input text and candidate labels are jointly encoded via a bidirectional encoder; task-specific pooling and scoring heads compute logits for each moderation subtask. This enables low-cost batch processing and zero-shot extensibility without reranking per label-instance pair, and reduces both inference complexity and deployment friction.

Figure 2: Model architecture of Opir. Candidate labels and the input text are jointly encoded by a GLiClass-style bidirectional encoder. Task-specific pooling and scoring modules then produce logits for safe/unsafe classification, toxicity detection, jailbreak detection, and taxonomy-category prediction.

Safety Taxonomy and Dataset Construction

Opir is grounded in a three-level taxonomy comprising 996 labels across 16 top-level categories, including violence, self-harm, sexual content, child safety, privacy, cybersecurity, criminal activity, regulated goods, medical and environmental harm, weapons of mass destruction, information integrity, AI system security, bias and fairness, uncertain domains, and explicit safe/benign content. This taxonomic structure is exploited throughout the data construction pipeline, permitting nuanced modeling of both unsafe phenomena and safety-preserving contexts to mitigate over-refusal and false positives.

The training corpus integrates synthetic taxonomy-guided prompt generation, hard-negative adversarial mining, contrastive benign-sensitive examples, LLM-generated responses, multilingual translation, and selective inclusion of benchmark training splits (Aegis2, WildGuardMix). Unsafe prompts are validated by panels of LLM judges to ameliorate single-model bias and ensure label fidelity.

Figure 3: Data construction pipeline for Opir. Taxonomy nodes seed unsafe prompt generation, hard-negative mining, benign-sensitive contrast construction, response generation and judging, multilingual translation, and final task-view formatting for training and evaluation.

Model Variants and Training Protocol

The Opir suite consists of multi-task large and multilingual variants (based on DeBERTaV3-large and mDeBERTaV3-base), as well as edge-oriented binary models (Ettin-encoder-32M and mmBERT-small), facilitating both cloud-scale moderation and edge deployment with sub-100M parameter footprints. All variants are initially seeded from generic GLiClass checkpoints and undergo safety-specific fine-tuning.

Training employs a hybrid loss with focal loss regularization and label shuffling, extensive prompt-label augmentation, and optional online EWC for future continual learning scenarios. Data is split 90/10 for train/eval with additional post-training on augmented samples, and models are optimized with a cosine scheduler and moderate dropout to reinforce robustness across changing taxonomies and few-shot contexts.

Empirical Evaluation: Task Accuracy and Latency

Extensive evaluation spans 29 datasets (12 safety, 17 categorization) and 11 contemporary guardrail systems, including both encoder and decoder models. Opir-multitask-large achieves the second-highest macro F1 average on binary safety benchmarks and wins two individual datasets; Opir-edge-multilang leads on additional splits with order-of-magnitude lower latency. Encoder-based Opir variants outperformed or matched 7B–8B decoder guardrails with only a fraction of the operational overhead, validating the architectural trade-offs.

On categorization tasks, Opir-multitask-large wins 11 of 17 benchmarks, attaining significant accuracy gains versus encoder baselines and demonstrating robustness across taxonomy-matched evaluation. Notably, calibration on over-refusal diagnostics (e.g., OR-Bench, XSTest) is an identified area for further improvement.

Latency analysis confirms the efficiency claim: Opir-multitask-large achieves 25.65 ms p50 latency per sample at 1024 tokens, and Opir-edge attains 9.25 ms, compared to 97.63 ms for Nemotron Safety Guard and over 300 ms for PolyGuard-Qwen. Binary encoder variants are at least 10–30× faster than mainstream decoder-based guardrails, supporting scalable moderation and agentic workloads.

Figure 4: Latency--macro-F1 efficiency comparison. The figure summarizes the trade-off between classification quality and serving cost across Opir variants and baseline guardrail systems.

Limitations and Responsible Use

The paper recognizes limitations inherent in policy-dependent label subjectivity, LLM-generated and judged data bias, translation-induced multilingual variance, and evolving threat landscapes. The authors specify that Opir should not be deployed as the sole basis for high-impact decision-making in legal, employment, or educational contexts absent human and policy oversight.

Implications and Future Directions

Opir establishes a practical design point for real-time, multi-task LLM moderation, allowing applications to scale agentic computation without incurring prohibitive latency or sacrificing categorization granularity. The encoder-oriented architecture is validated for both cloud and edge scenarios, and provides explicit taxonomic extensibility for new risks and domains.

Further developments may include: improved calibration on over-refusal cases via augmented benign-sensitive coverage, continual taxonomy updates to capture emergent agentic and adversarial behaviors, broadening multilingual generalization, and integration of explicit chain-of-thought safety reasoning, as exemplified by recent Nemotron-Content-Safety-Reasoning models.

Conclusion

Opir advances the state-of-the-art in LLM moderation through an efficient, encoder-based multi-task architecture with broad taxonomic coverage and deployment flexibility. Strong empirical results demonstrate competitive or superior accuracy at drastically lower latency relative to contemporary decoder-based guardrails. The approach has significant implications for practical safety moderation in agentic and conversational AI, particularly where latency and fine-grained categorization are critical. Opir's open-source evaluation harness and taxonomy dynamics also set the stage for continued research on moderation efficiency, robustness, and reasoning in evolving AI ecosystems (2605.29659).