CHILLGuardTrain: Chinese LLM Safety Dataset

• CHILLGuardTrain is a large-scale Chinese dataset for training LLM safety guardrails, featuring a detailed 5 macro and 31 micro risk taxonomy.
• It employs a multi-stage construction pipeline including retrieval-augmented generation, prompt-engineering rewrites, and model-aware direct preference optimization.
• The dataset’s balanced safe/unsafe sample composition and Chinese-specific rewriting strategies result in significant F1 score improvements in risk detection.

Searching arXiv for the primary paper and closely related guardrail papers to ground the article in current research. arxiv_search(query="^^^^^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^^^^^"Towards Fine-Grained Chinese LLM Safety Guardrail\"^^^^^^^^2 OR \2^^^^^^^^"CHILLGuardTrain\"", max_results=^^^^2 OR \2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^) CHILLGuardTrain is the large-scale training dataset used to build CHILLGuard, a Chinese LLM content safety guardrail designed for fine-grained risk classification under Chinese regulatory policies, cultural context, and linguistic nuance. In the CHILLGuard framework, CHILLGuardTrain serves as the seed training dataset PRESERVED_PLACEHOLDER_^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ for a generator–classifier collaborative pipeline, supports both binary safe/unsafe detection and 3^^^^2 OR \2^^^^-way micro-category supervision, and provides the source material from which later rewritten samples and preference pairs are derived. The dataset contains 4^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^5,^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^7 Chinese samples and is paired with CHILLGuardTest, a held-out annotated test set with 5^^^^2 OR \2^^^^,745 samples (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

^^^^2 OR \2^^^^. Definition within the CHILLGuard framework

CHILLGuardTrain is defined as the training corpus underlying CHILLGuard, a dedicated Chinese LLM safety guardrail introduced in "CHILLGuard: Towards Fine-Grained Chinese LLM Safety Guardrail with Scalable Data Construction and Model-aware Preference Alignment" (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&). Its immediate function is classifier training: the classifier is first supervised on CHILLGuardTrain through full-parameter SFT on Qwen3 backbones at ^^^^2 OR \2^^^^.7B, 4B, and 8B, learning both binary safe/unsafe judgments and fine-grained micro-category labels. The same dataset also functions as the seed corpus for the generator in later iterations of the training loop.

Within the paper’s notation, CHILLGuardTrain is PRESERVED_PLACEHOLDER_^^^^2 OR \2^^^^. Iteration ^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ trains the classifier on this seed set; Iteration ^^^^2 OR \2^^^^ and Iteration 2 augment it with generator-produced rewrites to form $\mathcal{D}_{\text{train}}^{(1)}$ and $\mathcal{D}_{\text{train}}^{(2)}$. The paper therefore treats CHILLGuardTrain not merely as a static moderation benchmark, but as the foundation of an iterative data-generation and preference-alignment regime (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

A key contextual point is that CHILLGuardTrain is paired with CHILLGuardTest under the same risk taxonomy and label scheme, but external multilingual safety datasets appear only in CHILLGuardTrain and never in CHILLGuardTest. This separation is important for interpreting the reported benchmark gains: it indicates that training incorporates external Chinese and translated multilingual safety resources, whereas evaluation is deliberately more constrained (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

2. Risk taxonomy and supervision targets

CHILLGuardTrain is annotated under a Chinese-specific harm taxonomy comprising 5 macro categories and 3^^^^2 OR \2^^^^ micro categories. The macro categories are: violations of core socialist values, discriminatory content, commercial violations and non-compliance, infringement of legitimate rights and interests, and failure to meet safety demands of specific services. Unsafe samples receive micro-category labels A^^^^2 OR \2^^^^–A8, B^^^^2 OR \2^^^^–B9, C^^^^2 OR \2^^^^–C5, D^^^^2 OR \2^^^^–D7, or E^^^^2 OR \2^^^^–E2, while the classifier is also trained to make a binary safe/unsafe decision (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

Macro-category A, "违反社会主义核心价值观的内容," covers content such as inciting subversion of state power or overthrow of the socialist system, endangering national security and interests, inciting separatism, promoting terrorism or extremism, promoting ethnic hatred, promoting violence or pornography, disseminating false and harmful information, and other content prohibited by laws and regulations. The paper characterizes this group as the highest moderation priority because it focuses on content that threatens national security, social stability, and core socialist values (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

Macro-category B, "歧视性内容," spans nine forms of discrimination: ethnic, religious or belief-based, national-origin, regional, gender, age, occupational, health-based, and other discrimination. Macro-category C, "商业违法违规," addresses intellectual property infringement, business-ethics violations, trade-secret leakage, monopoly or unfair competition via algorithmic or platform advantages, and other illegal or non-compliant commercial activities. Macro-category D, "侵犯他人合法权益," covers harms against physical or mental health, portrait rights, reputation rights, honor rights, privacy rights, personal information rights, and other legitimate rights. Macro-category E, "无法满足特定服务类型的安全需求," is reserved for inaccurate content that severely contradicts scientific common sense or mainstream cognition and for unreliable content that fails to provide meaningful assistance (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

This label design places CHILLGuardTrain in a broader line of fine-grained guardrail research that favors structured risk spaces over coarse binary moderation. A plausible implication is that the dataset was intended not only for blocking decisions but also for deployment settings where downstream systems need category-specific routing, explanation, or policy differentiation. That interpretation is consistent with contemporaneous guardrail work emphasizing fine-grained, interpretable, and policy-flexible risk assessment, such as YuFeng-XGuard (Lin et al., 22 Jan 2026).

3. Data scale, source composition, and balancing

CHILLGuardTrain contains 4^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^5,^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^7 samples, of which 273,^^^^2 OR \2 OR \2^^^^6 are safe and ^^^^2 OR \2^^^^32,89^^^^2 OR \2^^^^ are unsafe. This corresponds to 67.43% safe and 32.57% unsafe. The paper describes this as a dataset that is moderately imbalanced toward safe content, while still containing more than ^^^^2 OR \2CHILLGuard: Towards Fine-Grained Chinese LLM Safety Guardrail with Scalable Data Construction and Model-aware Preference Alignment2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^k unsafe instances (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

Its training split is assembled from five sources: PolyGuard$_{\text{CN}}$, OpenGuardrails, RAG-Generated data, PE-Rewritten data, and Original Real-world prompts. PolyGuard$_{\text{CN}}$ contributes 2^^^^2 OR \2^^^^3,3^^^^2 OR \2^^^^5 samples; OpenGuardrails contributes 7^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^,9^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^8; RAG-Generated contributes 4^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^,92^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^; PE-Rewritten contributes 77,35^^^^2 OR \2^^^^; and Original Real-world contributes 2,5^^^^2 OR \2^^^^3. The source mixture combines translated or relabeled multilingual safety corpora, synthetic retrieval-conditioned prompts, prompt-engineering rewrites, and a small quantity of unmodified production data (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

Source	Total	Safe / Unsafe
PolyGuard$_{\text{CN}}$	2^^^^2 OR \2^^^^3,3^^^^2 OR \2^^^^5	^^^^2 OR \2^^^^79,^^^^2 OR \2^^^^84 / 34,^^^^2 OR \2CHILLGuard: Towards Fine-Grained Chinese LLM Safety Guardrail with Scalable Data Construction and Model-aware Preference Alignment2 OR \2^^^^
OpenGuardrails	7^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^,9^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^8	3^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^,84^^^^2 OR \2^^^^ / 4^^^^2 OR \2^^^^,^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^67
RAG-Generated	4^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^,92^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^	^^^^2 OR \2^^^^7,67^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ / 23,25^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^
PE-Rewritten	77,35^^^^2 OR \2^^^^	43,25^^^^2 OR \2^^^^ / 34,^^^^2 OR \2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^
Original Real-world	2,5^^^^2 OR \2^^^^3	2,^^^^2 OR \2侵犯他人合法权益,2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ / 343

Although the paper does not provide a full frequency table over all 3^^^^2 OR \2^^^^ micro categories, it explicitly states that stratified sampling is enforced across all 3^^^^2 OR \2^^^^ micro categories to maintain roughly uniform class distribution and prevent the model from being biased toward over-represented harmful types during training. This means that the final composition is not simply inherited from raw source proportions; it is also shaped by taxonomy-level balancing (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

The dataset is primarily a classification corpus. Inputs are Chinese prompt-like texts constructed to resemble real user queries, and labels include the binary safety label and the micro-category for unsafe content. The paper is explicit that CHILLGuardTrain itself does not contain preference pairs; those are created later from generator outputs plus classifier feedback inside the MDPO stage (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

4. Multi-stage construction pipeline

The paper describes a three-stage construction pipeline for CHILLGuardTrain: multi-source corpus expansion via retrieval-augmented generation, implicit harmful sample generation through prompt-engineering rewriting, and label refinement through multi-model voting-based calibration (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

The RAG stage begins with 2^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ seed keywords per micro category across 3^^^^2 OR \2^^^^ categories, yielding 62^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ seed keywords, which are then expanded using Gemini 3.^^^^2 OR \2^^^^ Pro to approximately 8^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ keywords per subcategory, for roughly 2,48^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ keywords in total. Related text is crawled from Quora, X (Twitter), and Weibo using both Chinese keywords and their English translations, resulting in approximately 48^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^,^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ real-world Internet text samples. These multilingual texts are embedded with bge-m3 and stored in a vector database. For each harmful subcategory, retrieval queries are built from the macro-category label, the micro-category label, and randomly sampled subcategory keywords; top-^^^^2 OR \2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ candidate texts are retrieved and 5 instances are uniformly sampled. A Chinese system prompt then instructs the model to minimally rewrite retrieved snippets into natural user prompts while preserving semantic intent and category alignment, and Dolphin-Mistral-24B-Venice-Edition is used as the generation model. This stage produces 59,52^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ RAG-generated samples overall, of which 4^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^,92^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ enter CHILLGuardTrain (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

The prompt-engineering stage targets implicit, obfuscated, and adversarially phrased Chinese harmful content. It uses 46,742 real user prompts from production environments of authoritative institutions in China as seeds after deduplication and manual filtering. Safe rewriting templates generate diverse but still harmless variants through paraphrasing, detail enrichment, tense transformation, topic-preserving rewrites, and related operations, all under explicit constraints of legality and harmlessness. Unsafe rewriting templates are macro-category-specific. For macro categories A and B, the paper lists techniques such as symbolic and morphemic mutation, homophones, similar characters, pinyin abbreviations, number homophones, emojis, circle codes, cultural mapping, historical allusion, rhetorical irony, semantic nesting, compliance wrapping, and leading-question formulations. For macro categories C, D, and E, the listed strategies include actor and relationship restructuring, motive weakening, gray-area compliance language, process fragmentation, hypothetical transfer, justification packaging, third-party retelling, joking tones, pseudo-scientific structure imitation, concept mismatch, mixed true-and-false information, vague authority invocation, and non-actionable safe-sounding content. The result is 77,35^^^^2 OR \2^^^^ PE-rewritten samples in CHILLGuardTrain, including 43,25^^^^2 OR \2^^^^ safe and 34,^^^^2 OR \2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ unsafe samples (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

The final calibration stage standardizes labels across heterogeneous sources. English content is translated to Chinese via opus-mt-en-zh, followed by exact deduplication, length filtering, and cleaning. Binary safety labels are then assigned by majority vote over Qwen3-3^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^B-Instruct, GLM-4.7-3^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^B-Flash, InternVL3.5-38B-Instruct, and Yi-^^^^2 OR \2^^^^.5-34B-Chat; DeepSeek-V3.2-685B acts as the tie-break adjudicator. Fine-grained micro-category labels are assigned by DeepSeek-V3.2-685B. The paper presents this multi-model voting and adjudication process as the mechanism that yields a consistent taxonomy across PolyGuard$_{\text{CN}}$, OpenGuardrails, RAG-generated samples, prompt-engineered rewrites, and real-world data (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

5. Role in generator–classifier collaboration and MDPO

CHILLGuardTrain is central to the full training loop, not only to the initial SFT step. In Iteration ^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^, the classifier $C^{(0)}$ is trained on $\mathcal{D}_{\text{train}}^{(0)}$, that is, CHILLGuardTrain itself. In Iteration ^^^^2 OR \2^^^^, a generator PRESERVED_PLACEHOLDER_^^^^2 OR \2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ rewrites each seed sample with PRESERVED_PLACEHOLDER_^^^^2 OR \2 OR \2^^^^ rewrites, forming PRESERVED_PLACEHOLDER_^^^^2 OR \22^^^^, and the updated training set becomes PRESERVED_PLACEHOLDER_^^^^2 OR \2^^^^3. A new classifier PRESERVED_PLACEHOLDER_^^^^2 OR \2^^^^4 is then trained on this merged set (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

Iteration 2 introduces Model-aware Direct Preference Optimization. For each generated prompt PRESERVED_PLACEHOLDER_^^^^2 OR \2^^^^5, the classifier prediction PRESERVED_PLACEHOLDER_^^^^2 OR \2^^^^6 is compared with the seed label PRESERVED_PLACEHOLDER_^^^^2 OR \2^^^^7, and the generator assigns a quality score PRESERVED_PLACEHOLDER_^^^^2 OR \2^^^^8. The paper defines four difficulty levels:

PRESERVED_PLACEHOLDER_^^^^2 OR \2^^^^9

Preference pairs are then constructed with the ranking $\mathcal{D}_{\text{train}}^{(1)}$^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^, while $\mathcal{D}_{\text{train}}^{(1)}$^^^^2 OR \2^^^^ is excluded. These pairs form $\mathcal{D}_{\text{train}}^{(1)}$2, on which the generator is fine-tuned by MDPO to produce $\mathcal{D}_{\text{train}}^{(1)}$3; the refined generator then creates $\mathcal{D}_{\text{train}}^{(1)}$4, and the final training set becomes $\mathcal{D}_{\text{train}}^{(1)}$5 (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

The MDPO formulation modifies standard DPO by making the effective KL penalty batch-adaptive. The paper defines an instance-level reward gap $\mathcal{D}_{\text{train}}^{(1)}$6, normalizes it by a moving global mean $\mathcal{D}_{\text{train}}^{(1)}$7, filters outliers via a mask $\mathcal{D}_{\text{train}}^{(1)}$8, computes a filtered mean gap $\mathcal{D}_{\text{train}}^{(1)}$9, and then scales the penalty through $\mathcal{D}_{\text{train}}^{(2)}$^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ so that $\mathcal{D}_{\text{train}}^{(2)}$^^^^2 OR \2^^^^. When the current model already distinguishes a pair well, the KL penalty becomes larger; when the pair is hard, the penalty becomes smaller. In this design, CHILLGuardTrain supplies the seed labels and gold references needed to transform generator outputs into difficulty-ranked preference pairs (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

This training logic places CHILLGuardTrain alongside a broader set of guardrail-training paradigms that use richer supervision than conventional label-only moderation. Related research includes critique-augmented supervision in ThinkGuard (&&&2^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&), dynamic-policy reasoning in YuFeng-XGuard (Lin et al., 22 Jan 2026), latent-reasoning internalization in COLAGUARD (Sai et al., 27 May 2026), and compressed multi-turn guardrail training in Defensive M2S (Kim, 1 Jan 2026). The common theme is that the training corpus is treated as an active component in model shaping rather than a passive store of labels.

6. Chinese-specific design, empirical importance, and practical significance

CHILLGuardTrain is explicitly constructed for Chinese LLM safety rather than as a direct translation of English moderation corpora. Its macro-category A maps to Chinese online-content regulation through categories such as subversion, separatism, terrorism, pornography, and other legally prohibited content. Its prompt-engineering templates encode Chinese-specific evasion patterns, including homophones, pinyin abbreviations, number codes, Chinese–English mixing, accidental typos, classical allusions, irony, and indirect rhetorical packaging. Macro-category E further incorporates content accuracy and reliability into the safety formulation, treating severe contradiction of scientific common sense or mainstream cognition and failure to provide useful assistance as safety-relevant phenomena (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

The paper attributes measured performance gains to this dataset design. In the ablation over the training framework, the 8B classifier trained only on Iteration ^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^ SFT over CHILLGuardTrain, denoted CHILLGuard$\mathcal{D}_{\text{train}}^{(2)}$2, achieves an overall F^^^^2 OR \2^^^^ of 78.87 on CHILLGuardTest. One round of generator–classifier collaboration raises this to 84.42, two rounds with standard DPO yield 88.85, and the full framework with MDPO reaches 89.77. The same section reports that PE-rewritten samples are especially consequential: for the 8B model, removing PE lowers overall F^^^^2 OR \2^^^^ from 89.77 to 85.3^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^, with larger degradation on macro categories A, B, and E (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

The headline benchmark comparison is that CHILLGuard reports a ^^^^2 OR \2^^^^5.92% improvement of F^^^^2 OR \2^^^^ score over Qwen3Guard-8B-Strict on the paper’s benchmark. Because CHILLGuardTrain is the seed dataset of the entire system, the paper positions that result as evidence that Chinese-specific taxonomy design, scalable data construction, and model-aware preference alignment jointly matter for fine-grained Chinese moderation (&&&^^^^2(Yu et al., 13 Jun 2026) OR CHILLGuard OR \2^^^^&&&).

A plausible implication is that CHILLGuardTrain should be understood not only as a dataset artifact but as an operational template for localized safety-data engineering. Its construction choices—jurisdiction-specific taxonomy, platform-specific adversarial rewriting, calibrated relabeling, and iterative generator feedback—suggest a general recipe for building guardrails in domains where multilingual safety corpora are insufficiently aligned with local policy, culture, or linguistic behavior.