---
title: 'CHILLGuardTrain: Chinese LLM Safety Dataset'
url: https://www.emergentmind.com/topics/chillguardtrain
type: topic
---

# CHILLGuardTrain: Chinese LLM Safety Dataset

Searching arXiv for the primary paper and closely related guardrail papers to ground the article in current research.
arxiv_search(query="2606.15396 OR CHILLGuard OR \"Towards Fine-Grained Chinese LLM Safety Guardrail\" OR \"CHILLGuardTrain\"", max_results=10)
CHILLGuardTrain is the large-scale training dataset used to build CHILLGuard, a Chinese LLM content safety guardrail designed for fine-grained risk classification under Chinese regulatory policies, cultural context, and linguistic nuance. In the CHILLGuard framework, CHILLGuardTrain serves as the seed training dataset $\mathcal{D}_{\text{train}}^{(0)}$ for a generator–classifier collaborative pipeline, supports both binary safe/unsafe detection and 31-way micro-category supervision, and provides the source material from which later rewritten samples and preference pairs are derived. The dataset contains 405,007 Chinese samples and is paired with CHILLGuardTest, a held-out annotated test set with 51,745 samples [2606.15396].

## 1. Definition within the CHILLGuard framework

CHILLGuardTrain is defined as the training corpus underlying CHILLGuard, a dedicated Chinese LLM safety guardrail introduced in "CHILLGuard: Towards Fine-Grained Chinese LLM Safety Guardrail with Scalable Data Construction and Model-aware Preference Alignment" [2606.15396]. Its immediate function is classifier training: the classifier is first supervised on CHILLGuardTrain through full-parameter SFT on Qwen3 backbones at 1.7B, 4B, and 8B, learning both binary safe/unsafe judgments and fine-grained micro-category labels. The same dataset also functions as the seed corpus for the generator in later iterations of the training loop.

Within the paper’s notation, CHILLGuardTrain is $\mathcal{D}_{\text{train}}^{(0)}$. Iteration 0 trains the classifier on this seed set; Iteration 1 and Iteration 2 augment it with generator-produced rewrites to form $\mathcal{D}_{\text{train}}^{(1)}$ and $\mathcal{D}_{\text{train}}^{(2)}$. The paper therefore treats CHILLGuardTrain not merely as a static moderation benchmark, but as the foundation of an iterative data-generation and preference-alignment regime [2606.15396].

A key contextual point is that CHILLGuardTrain is paired with CHILLGuardTest under the same risk taxonomy and label scheme, but external multilingual safety datasets appear only in CHILLGuardTrain and never in CHILLGuardTest. This separation is important for interpreting the reported benchmark gains: it indicates that training incorporates external Chinese and translated multilingual safety resources, whereas evaluation is deliberately more constrained [2606.15396].

## 2. Risk taxonomy and supervision targets

CHILLGuardTrain is annotated under a Chinese-specific harm taxonomy comprising 5 macro categories and 31 micro categories. The macro categories are: violations of core socialist values, discriminatory content, commercial violations and non-compliance, infringement of legitimate rights and interests, and failure to meet safety demands of specific services. Unsafe samples receive micro-category labels A1–A8, B1–B9, C1–C5, D1–D7, or E1–E2, while the classifier is also trained to make a binary safe/unsafe decision [2606.15396].

Macro-category A, "违反社会主义核心价值观的内容," covers content such as inciting subversion of state power or overthrow of the socialist system, endangering national security and interests, inciting separatism, promoting terrorism or extremism, promoting ethnic hatred, promoting violence or pornography, disseminating false and harmful information, and other content prohibited by laws and regulations. The paper characterizes this group as the highest moderation priority because it focuses on content that threatens national security, social stability, and core socialist values [2606.15396].

Macro-category B, "歧视性内容," spans nine forms of discrimination: ethnic, religious or belief-based, national-origin, regional, gender, age, occupational, health-based, and other discrimination. Macro-category C, "商业违法违规," addresses intellectual property infringement, business-ethics violations, trade-secret leakage, monopoly or unfair competition via algorithmic or platform advantages, and other illegal or non-compliant commercial activities. Macro-category D, "侵犯他人合法权益," covers harms against physical or mental health, portrait rights, reputation rights, honor rights, privacy rights, personal information rights, and other legitimate rights. Macro-category E, "无法满足特定服务类型的安全需求," is reserved for inaccurate content that severely contradicts scientific common sense or mainstream cognition and for unreliable content that fails to provide meaningful assistance [2606.15396].

This label design places CHILLGuardTrain in a broader line of fine-grained guardrail research that favors structured risk spaces over coarse binary moderation. A plausible implication is that the dataset was intended not only for blocking decisions but also for deployment settings where downstream systems need category-specific routing, explanation, or policy differentiation. That interpretation is consistent with contemporaneous guardrail work emphasizing fine-grained, interpretable, and policy-flexible risk assessment, such as YuFeng-XGuard [2601.15588].

## 3. Data scale, source composition, and balancing

CHILLGuardTrain contains 405,007 samples, of which 273,116 are safe and 132,891 are unsafe. This corresponds to 67.43% safe and 32.57% unsafe. The paper describes this as a dataset that is moderately imbalanced toward safe content, while still containing more than 130k unsafe instances [2606.15396].

Its training split is assembled from five sources: PolyGuard$_{\text{CN}}$, OpenGuardrails, RAG-Generated data, PE-Rewritten data, and Original Real-world prompts. PolyGuard$_{\text{CN}}$ contributes 213,315 samples; OpenGuardrails contributes 70,908; RAG-Generated contributes 40,920; PE-Rewritten contributes 77,351; and Original Real-world contributes 2,513. The source mixture combines translated or relabeled multilingual safety corpora, synthetic retrieval-conditioned prompts, prompt-engineering rewrites, and a small quantity of unmodified production data [2606.15396].

| Source | Total | Safe / Unsafe |
|---|---:|---:|
| PolyGuard$_{\text{CN}}$ | 213,315 | 179,184 / 34,131 |
| OpenGuardrails | 70,908 | 30,841 / 41,067 |
| RAG-Generated | 40,920 | 17,670 / 23,250 |
| PE-Rewritten | 77,351 | 43,251 / 34,100 |
| Original Real-world | 2,513 | 2,170 / 343 |

Although the paper does not provide a full frequency table over all 31 micro categories, it explicitly states that stratified sampling is enforced across all 31 micro categories to maintain roughly uniform class distribution and prevent the model from being biased toward over-represented harmful types during training. This means that the final composition is not simply inherited from raw source proportions; it is also shaped by taxonomy-level balancing [2606.15396].

The dataset is primarily a classification corpus. Inputs are Chinese prompt-like texts constructed to resemble real user queries, and labels include the binary safety label and the micro-category for unsafe content. The paper is explicit that CHILLGuardTrain itself does not contain preference pairs; those are created later from generator outputs plus classifier feedback inside the MDPO stage [2606.15396].

## 4. Multi-stage construction pipeline

The paper describes a three-stage construction pipeline for CHILLGuardTrain: multi-source corpus expansion via retrieval-augmented generation, implicit harmful sample generation through prompt-engineering rewriting, and label refinement through multi-model voting-based calibration [2606.15396].

The RAG stage begins with 20 seed keywords per micro category across 31 categories, yielding 620 seed keywords, which are then expanded using Gemini 3.1 Pro to approximately 80 keywords per subcategory, for roughly 2,480 keywords in total. Related text is crawled from Quora, X (Twitter), and Weibo using both Chinese keywords and their English translations, resulting in approximately 480,000 real-world Internet text samples. These multilingual texts are embedded with bge-m3 and stored in a vector database. For each harmful subcategory, retrieval queries are built from the macro-category label, the micro-category label, and randomly sampled subcategory keywords; top-100 candidate texts are retrieved and 5 instances are uniformly sampled. A Chinese system prompt then instructs the model to minimally rewrite retrieved snippets into natural user prompts while preserving semantic intent and category alignment, and Dolphin-Mistral-24B-Venice-Edition is used as the generation model. This stage produces 59,520 RAG-generated samples overall, of which 40,920 enter CHILLGuardTrain [2606.15396].

The prompt-engineering stage targets implicit, obfuscated, and adversarially phrased Chinese harmful content. It uses 46,742 real user prompts from production environments of authoritative institutions in China as seeds after deduplication and manual filtering. Safe rewriting templates generate diverse but still harmless variants through paraphrasing, detail enrichment, tense transformation, topic-preserving rewrites, and related operations, all under explicit constraints of legality and harmlessness. Unsafe rewriting templates are macro-category-specific. For macro categories A and B, the paper lists techniques such as symbolic and morphemic mutation, homophones, similar characters, pinyin abbreviations, number homophones, emojis, circle codes, cultural mapping, historical allusion, rhetorical irony, semantic nesting, compliance wrapping, and leading-question formulations. For macro categories C, D, and E, the listed strategies include actor and relationship restructuring, motive weakening, gray-area compliance language, process fragmentation, hypothetical transfer, justification packaging, third-party retelling, joking tones, pseudo-scientific structure imitation, concept mismatch, mixed true-and-false information, vague authority invocation, and non-actionable safe-sounding content. The result is 77,351 PE-rewritten samples in CHILLGuardTrain, including 43,251 safe and 34,100 unsafe samples [2606.15396].

The final calibration stage standardizes labels across heterogeneous sources. English content is translated to Chinese via opus-mt-en-zh, followed by exact deduplication, length filtering, and cleaning. Binary safety labels are then assigned by majority vote over Qwen3-30B-Instruct, GLM-4.7-30B-Flash, InternVL3.5-38B-Instruct, and Yi-1.5-34B-Chat; DeepSeek-V3.2-685B acts as the tie-break adjudicator. Fine-grained micro-category labels are assigned by DeepSeek-V3.2-685B. The paper presents this multi-model voting and adjudication process as the mechanism that yields a consistent taxonomy across PolyGuard$_{\text{CN}}$, OpenGuardrails, RAG-generated samples, prompt-engineered rewrites, and real-world data [2606.15396].

## 5. Role in generator–classifier collaboration and MDPO

CHILLGuardTrain is central to the full training loop, not only to the initial SFT step. In Iteration 0, the classifier $C^{(0)}$ is trained on $\mathcal{D}_{\text{train}}^{(0)}$, that is, CHILLGuardTrain itself. In Iteration 1, a generator $G^{(0)}$ rewrites each seed sample with $k=4$ rewrites, forming $\mathcal{D}_{\text{gen}}^{(1)}$, and the updated training set becomes $\mathcal{D}_{\text{train}}^{(1)}=\mathcal{D}_{\text{train}}^{(0)} \cup \mathcal{D}_{\text{gen}}^{(1)}$. A new classifier $C^{(1)}$ is then trained on this merged set [2606.15396].

Iteration 2 introduces Model-aware Direct Preference Optimization. For each generated prompt $\text{GPrompt}_i \in \mathcal{D}_{\text{gen}}^{(1)}$, the classifier prediction $\hat{y}_i$ is compared with the seed label $y_i^*$, and the generator assigns a quality score $s_i \in [1,5]$. The paper defines four difficulty levels:
$$
L(\text{GPrompt}_i)= \begin{cases}
L_1,& \hat{y}_i \neq y_i^*,\; s_i \geq 3 \\
L_2,& \hat{y}_i \neq y_i^*,\; s_i < 3 \\
L_3,& \hat{y}_i = y_i^*,\; s_i < 3 \\
L_4,& \hat{y}_i = y_i^*,\; s_i \geq 3
\end{cases}.
$$
Preference pairs are then constructed with the ranking $\langle L_1,L_4\rangle \succ \langle L_1,L_3\rangle \succ \langle L_2,L_4\rangle$, while $\langle L_2,L_3\rangle$ is excluded. These pairs form $\mathcal{P}^{(2)}$, on which the generator is fine-tuned by MDPO to produce $G^{(1)}$; the refined generator then creates $\mathcal{D}_{\text{gen}}^{(2)}$, and the final training set becomes $\mathcal{D}_{\text{train}}^{(2)}=\mathcal{D}_{\text{train}}^{(0)} \cup \mathcal{D}_{\text{gen}}^{(2)}$ [2606.15396].

The MDPO formulation modifies standard DPO by making the effective KL penalty batch-adaptive. The paper defines an instance-level reward gap $\mathcal{R}_i$, normalizes it by a moving global mean $\overline{\mathcal{R}}$, filters outliers via a mask $\mathcal{M}$, computes a filtered mean gap $\overline{\mathcal{R}}_{|\mathcal{B}|}$, and then scales the penalty through $\alpha_M = \sigma(\overline{\mathcal{R}}_{|\mathcal{B}|})/\sigma(\overline{\mathcal{R}})$ so that $\beta_M = \beta \cdot \alpha_M$. When the current model already distinguishes a pair well, the KL penalty becomes larger; when the pair is hard, the penalty becomes smaller. In this design, CHILLGuardTrain supplies the seed labels and gold references needed to transform generator outputs into difficulty-ranked preference pairs [2606.15396].

This training logic places CHILLGuardTrain alongside a broader set of guardrail-training paradigms that use richer supervision than conventional label-only moderation. Related research includes critique-augmented supervision in ThinkGuard [2502.13458], dynamic-policy reasoning in YuFeng-XGuard [2601.15588], latent-reasoning internalization in COLAGUARD [2605.29068], and compressed multi-turn guardrail training in Defensive M2S [2601.00454]. The common theme is that the training corpus is treated as an active component in model shaping rather than a passive store of labels.

## 6. Chinese-specific design, empirical importance, and practical significance

CHILLGuardTrain is explicitly constructed for Chinese LLM safety rather than as a direct translation of English moderation corpora. Its macro-category A maps to Chinese online-content regulation through categories such as subversion, separatism, terrorism, pornography, and other legally prohibited content. Its prompt-engineering templates encode Chinese-specific evasion patterns, including homophones, pinyin abbreviations, number codes, Chinese–English mixing, accidental typos, classical allusions, irony, and indirect rhetorical packaging. Macro-category E further incorporates content accuracy and reliability into the safety formulation, treating severe contradiction of scientific common sense or mainstream cognition and failure to provide useful assistance as safety-relevant phenomena [2606.15396].

The paper attributes measured performance gains to this dataset design. In the ablation over the training framework, the 8B classifier trained only on Iteration 0 SFT over CHILLGuardTrain, denoted CHILLGuard$^*$, achieves an overall F1 of 78.87 on CHILLGuardTest. One round of generator–classifier collaboration raises this to 84.42, two rounds with standard DPO yield 88.85, and the full framework with MDPO reaches 89.77. The same section reports that PE-rewritten samples are especially consequential: for the 8B model, removing PE lowers overall F1 from 89.77 to 85.30, with larger degradation on macro categories A, B, and E [2606.15396].

The headline benchmark comparison is that CHILLGuard reports a 15.92% improvement of F1 score over Qwen3Guard-8B-Strict on the paper’s benchmark. Because CHILLGuardTrain is the seed dataset of the entire system, the paper positions that result as evidence that Chinese-specific taxonomy design, scalable data construction, and model-aware preference alignment jointly matter for fine-grained Chinese moderation [2606.15396].

A plausible implication is that CHILLGuardTrain should be understood not only as a dataset artifact but as an operational template for localized safety-data engineering. Its construction choices—jurisdiction-specific taxonomy, platform-specific adversarial rewriting, calibrated relabeling, and iterative generator feedback—suggest a general recipe for building guardrails in domains where multilingual safety corpora are insufficiently aligned with local policy, culture, or linguistic behavior.

Source: https://www.emergentmind.com/topics/chillguardtrain