Opir: Encoder-Based LLM Safety Filtering

Updated 4 July 2026

Opir is an encoder-based guardrail model family that offers low-latency, multi-task moderation using a three-level taxonomy with 996 categories.
It employs a GLiClass architecture to jointly encode text and candidate labels for binary safe/unsafe classification, multi-label toxicity, jailbreak detection, and multilingual operations.
The model outperforms decoder-based systems by reducing deployment cost and latency while addressing over-refusal and calibration challenges in real-world safety applications.

Opir is a family of encoder-based guardrail models for large-language-model safety filtering, introduced as a low-latency alternative to decoder-only moderation systems while retaining support for binary safe/unsafe classification, multi-label toxicity and jailbreak detection, unsafe prompt and response classification, multilingual moderation, and zero-shot label-conditioned categorization (Stepanov et al., 28 May 2026). It is built on the GLiClass architecture and organized around a three-level safety taxonomy with 996 categories across 16 top-level labels, 126 mid-level labels, and 854 leaf labels. The name should be distinguished from OPIR, a task-aware inverse-operator image-restoration method (Gao et al., 15 Jan 2026), and OIPR, an operator-interest evaluation framework for time-series anomaly detection (Jing et al., 3 Mar 2025).

1. Concept and historical position

Opir was proposed for a setting in which moderation must operate on user prompts, assistant responses, and sometimes prompt–response pairs under stringent deployment constraints. The motivating problem is that many existing guardrail systems are decoder-only 7B–22B autoregressive models, so each moderation decision requires one or more extra generative forward passes. In the formulation given for Opir, this produces an undesirable combination of latency, deployment cost, and limited granularity, especially when production systems require more than a binary safe/unsafe verdict (Stepanov et al., 28 May 2026).

The system is positioned as addressing three linked deficiencies in prior LLM guardrails: deployment cost and latency, insufficient granularity of binary-only filtering, and poor discrimination between genuinely harmful content and benign sensitive content. That last point is central to the paper’s framing of over-refusal: a safety model should distinguish covert harmful content from educational discussion, counterspeech, harm prevention, defensive cybersecurity, general medical information, and proper refusal or redirection, rather than collapsing all safety-adjacent language into the unsafe class (Stepanov et al., 28 May 2026).

This positioning also defines the scope of Opir. It is not merely a toxicity classifier, and it is not limited to prompt screening. It is intended as a multi-task moderation family covering binary safety filtering, taxonomy-grounded category attribution, jailbreak-sensitive detection, and multilingual deployments. A plausible implication is that Opir should be understood less as a single benchmark model than as a deployable safety-classification stack with multiple operating regimes.

2. Architecture and inference mechanics

At the architectural level, Opir is built on GLiClass, a bidirectional encoder that jointly encodes an input text and a supplied set of candidate labels. Given text $t$ and candidate labels $L=\{\ell_1,\dots,\ell_k\}$ , the encoder computes

$H = E_\theta(t, L).$

Text and label representations are pooled to obtain $z_t$ and $z_{\ell_i}$ , and the model then scores each candidate label with

$a_i = g_\theta(z_t, z_{\ell_i}).$

This design avoids token-by-token generation and supports both fixed-schema and label-conditioned classification (Stepanov et al., 28 May 2026).

Inference depends on task type. For multi-label tasks such as toxicity, jailbreaks, or taxonomy-category prediction, logits are mapped independently with a sigmoid,

$p_i = \sigma(a_i), \qquad \hat{y}_i = \mathbb{I}[p_i \ge \tau].$

For single-label tasks such as the binary safe/unsafe evaluation view, logits are normalized by softmax,

$p_i = \mathrm{softmax}(a)_i, \qquad \hat{y} = \arg\max_i p_i.$

The evaluator defaults to threshold $\tau=0.5$ for zero-shot classification. This architecture therefore supports a shared moderation backbone whose output behavior changes with the supplied label schema rather than with wholly separate output towers (Stepanov et al., 28 May 2026).

The model family comprises four variants:

Variant	Backbone	Role
Opir-multitask-large	DeBERTaV3-large	Main high-accuracy English multitask classifier
Opir-multitask-multilang	mDeBERTaV3-base	Multilingual multitask classifier
Opir-edge	Ettin-encoder-32m	Lightweight English binary classifier
Opir-edge-multilang	mmBERT-small	Lightweight multilingual binary classifier

The initialization checkpoints are gliclass-instruct-large-v1.0, gliclass-x-base, gliclass-edge-v3.0, and gliclass-multilang-edge. The edge models are explicitly described as having fewer than 100M parameters, and the smallest edge model uses a 32M-parameter backbone intended for sub-10 ms inference (Stepanov et al., 28 May 2026).

3. Task coverage and the safety taxonomy

The defining representational object in Opir is its three-level taxonomy. The 16 Level-1 categories are toxicity, violence_and_physical_harm, self_harm_and_suicide, sexual_content, child_safety, personal_information_privacy_and_intellectual_property, cybersecurity, criminal_and_illegal_activity, regulated_goods_and_advice, biological_medical_and_environmental_harm, weapons_of_mass_destruction, information_integrity_and_manipulation, ai_system_security_and_reliability, bias_fairness_and_representation, other_or_uncertain, and safe_and_benign (Stepanov et al., 28 May 2026).

This taxonomy is used simultaneously for data generation, model training, zero-shot classification, and deployment-time label selection. Because the candidate label set is supplied at inference time, the same trained encoder can operate over top-level screening with 16 labels, mid-level routing with 126 labels, fine-grained leaf assignment with 854 labels, or restricted task-specific subsets such as jailbreak-only or toxicity-only label sets. This suggests that Opir’s notion of “multi-task” is fundamentally label-schema-conditioned rather than a collection of unrelated heads.

The task suite supported by Opir includes binary safe/unsafe classification, multi-label toxicity classification, multi-label jailbreak classification, unsafe prompt classification, unsafe response classification, zero-shot categorization, and evaluation settings involving response refusal (Stepanov et al., 28 May 2026). Toxicity is modeled as multi-label and explicitly includes hate speech through the hate_and_discrimination branch, with representative leaves such as protected_class_slurs, identity_based_abuse, dehumanization, discriminatory_stereotypes, exclusionary_hate, supremacist_claims, and identity_based_threats. Jailbreak-sensitive coverage includes instruction-hierarchy attacks, secret or context exfiltration, tool and connector abuse, obfuscation and prompt smuggling, social-engineering attacks, indirect prompt injection, automation abuse, unsafe autonomy, tool-use risk, and monitoring failures.

A distinctive design choice is the explicit inclusion of the safe_and_benign branch. The paper treats this branch as a mechanism for reducing false positives by representing safety-sensitive but non-harmful content such as counterspeech, harm prevention, defensive cybersecurity, general medical information, and appropriate refusal or redirection (Stepanov et al., 28 May 2026). A common misconception is therefore that Opir is a conventional unsafe-content detector trained only on harm categories; in fact, its taxonomy explicitly encodes benign-sensitive classes as first-class labels.

4. Data construction, multilingual extension, and training regime

The training pipeline combines taxonomy-grounded synthesis, adversarial mining, response generation, multilingual translation, and external datasets. For each node in the taxonomy, the authors generate 30 unsafe prompts using an LLM-as-author pipeline. Hard negatives are mined by evolutionarily modifying initial prompts to bypass safety models, inspired by Evol-Instruct, automated red teaming, and tree-of-attacks methods, and then validated by an LLM judge panel consisting of DeepSeek-V3.1, MiniMax-M2.5, and Meta-Llama-3.3-70B-Instruct (Stepanov et al., 28 May 2026).

Generated response examples are obtained by fine-tuning Qwen3-4B on Aegis2, using it to generate responses for generated prompts, and then classifying those responses for safety with another LLM-as-a-judge pipeline. External training data includes portions of Aegis2 and WildGuardMix. Training also extends the safety data with knowledgator/gliclass-v3-logic-dataset, which is described as replay-based continual learning.

The multilingual dataset is produced by translating prompts and responses with DeepSeek-V3.1 into 23 languages: Swedish, Norwegian, Czech, Polish, Lithuanian, Estonian, Latvian, Spanish, Finnish, English, German, French, Romanian, Italian, Portuguese, Dutch, Ukrainian, Russian, Hindi, Chinese, Japanese, Korean, and Arabic (Stepanov et al., 28 May 2026). The paper is explicit that this multilingual capacity is translation-based rather than derived from independently curated native datasets.

The released dataset files have the following reported sizes: gliclass_safety_multi.json with 531,007 examples, gliclass_safety_en.json with 213,809 examples, gliclass_full_multi.json with 1,106,635 examples, gliclass_full_en.json with 426,356 examples, and gliclass_post_training.json with 18,000 examples (Stepanov et al., 28 May 2026). gliclass_full_* is used for the multitask models, while gliclass_safety_* is used for the edge models.

Training is performed in two stages: initial training on the main dataset for 3 epochs, followed by post-training on a 10% sample of examples after augmentation. The concrete hyperparameters reported are multi_label_classification, uni-encoder, average pooling, first-token class-token pooling, maximum sequence length 1024, batch size 8, gradient accumulation steps 1, encoder learning rate $1\times10^{-6}$ , head learning rate $L=\{\ell_1,\dots,\ell_k\}$ 0, weight decay 0.01, cosine scheduler, warmup ratio 0.05, dropout 0.3, label shuffling enabled, and bf16=True; fp16=False (Stepanov et al., 28 May 2026). The paper also notes a discrepancy between a conceptual statement that the task formulation uses 4096 tokens and the actual training table, which reports 1024; the training table is presented as the authoritative practical configuration.

5. Evaluation, empirical behavior, and deployment characteristics

The evaluation harness released with Opir supports GLiClass, GLiNER2, and vLLM backends and covers binary safety classification, multi-label categorization, toxicity, jailbreak detection, prompt safety, response safety, response refusal, and prompt subcategory views (Stepanov et al., 28 May 2026). Benchmarks include OpenAI moderation, Aegis and Aegis2, SimpleSafetyTests, HarmBench, PKU-SafeRLHF, BeaverTails, XSTest, OR-Bench, ToxicChat, WildGuardMix, PolyGuardPrompts, JBB-Behaviors, and PAN12 predator.

Across 12 binary safety datasets, the paper reports row-average macro F1 of 0.8045 for Opir-multitask-large, compared with 0.8061 for Nemotron Safety Guard v3, 0.7898 for PolyGuard-Qwen, and 0.7647 for WildGuard (Stepanov et al., 28 May 2026). Opir-multitask-large wins specific binary rows including WildGuard prompt safety at 0.9791 and JBB-Behaviors safety at 0.8932. On ToxicChat toxicity it scores 0.8325, second only to Nemotron’s 0.8517, and on ToxicChat jailbreaking it scores 0.6634, second to Gliner-Guard-Omni’s 0.7054.

The strongest empirical separation appears in category attribution. Across 17 dataset or category splits, row-average accuracy is 0.5432 for Opir-multitask-large and 0.5230 for Opir-multitask-multilang, compared with 0.4073 for Gliner-Guard-Omni and 0.3987 for GLiGuard-300M (Stepanov et al., 28 May 2026). Opir-multitask-large wins 11 of 17 rows, including Aegis categories at 0.6284, HarmBench prompts at 0.5432, WildGuard prompt subcategory at 0.8335, and JBB-Behaviors category at 0.4178. The paper highlights margins of +0.38 over GLiGuard on Aegis categories, +0.37 on HarmBench prompts, +0.44 on WildGuard prompt subcategory, and +0.21 over GLiGuard on JBB category.

Latency is one of the principal deployment claims. At sequence length 1024, Opir-multitask-large runs at 50.51 samples/s with 25.65 ms p50 latency and 26.09 ms p95; Opir-multitask-multilang reaches 123.67 samples/s with 13.30 ms p50; Opir-edge reaches 499.49 samples/s with 9.25 ms p50 and 9.52 ms p95; and Opir-edge-multilang reaches 306.81 samples/s with 15.60 ms p50 (Stepanov et al., 28 May 2026). In the same table, decoder baselines are substantially slower, including Nemotron Safety Guard v3 at 97.63 ms p50, Qwen3Guard-Gen-8B at 91.30 ms, WildGuard at 243.00 ms, and PolyGuard-Qwen at 308.59 ms. The paper therefore characterizes all four Opir variants as at least an order of magnitude faster in p50 latency than the strongest decoder-based guardrail in the table.

6. Limitations, controversies, and broader significance

The paper is explicit that Opir does not solve moderation in any absolute sense. Safety labels remain policy-dependent, especially for benign sensitive content, counterspeech, quoted harmful content, and educational discussion of dangerous topics (Stepanov et al., 28 May 2026). Over-refusal is not eliminated: although the safe_and_benign branch improves discrimination on XSTest-style cases, OR-Bench remains the principal categorization failure mode, and the authors attribute this to a calibration problem in which Opir maps many OR-Bench prompts to broader benign-sensitive categories or abstains more often.

Several methodological constraints follow directly from the data pipeline. Because much of the training corpus is synthetic and validated through LLM judges, the system may inherit both generation bias and judge bias. Because multilingual data is translation-generated, performance may vary across language, dialect, code-switching, and cultural context. Because real-world safety policy and attack strategies change over time, temporal drift remains a standing problem (Stepanov et al., 28 May 2026).

The paper also gives a high-impact use warning. Opir should not be the sole basis for legal, employment, credit, housing, education, law-enforcement, or other high-impact decisions; it should be used with policy design, logging, appeals, human review, and abuse monitoring (Stepanov et al., 28 May 2026). This positions Opir as a production-friendly moderation component rather than a self-sufficient governance mechanism.

In the broader evolution of LLM safety systems, Opir’s main significance lies in showing that a GLiClass-style label-conditioned encoder can approach the average binary safety performance of much larger generative guardrails while substantially exceeding encoder baselines on fine-grained categorization and operating with a much smaller latency and footprint (Stepanov et al., 28 May 2026). A plausible implication is that its most durable contribution may be architectural rather than merely benchmark-specific: the combination of joint text–label encoding, taxonomy-grounded training, explicit benign-sensitive categories, and edge-scale deployment points toward a class of safety systems in which moderation is treated as structured multi-label inference rather than prompt engineering over a decoder model.