Do Safety Guardrails Need to Reason? LeanGuard: A Fast and Light Approach for Robust Moderation

• URL: http://arxiv.org/abs/2606.26686v1
• Date: Thu, 25 Jun 2026 07:15:33 GMT
• Title: Do Safety Guardrails Need to Reason? LeanGuard: A Fast and Light Approach for Robust Moderation
• Abstract summary: We train a lightweight bidirectional encoder and a reasoning guard on the same corpus.<n>We show that the chain does not improve moderation accuracy.<n>A 395M label-only encoder reaches an average F1 of 82.90 $pm$ 0.26 over public benchmarks.
• Score: 9.68749971398651
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: In order to screen a prompt or a response, the recent guardrail methods generate a chain-of-thought (CoT) before they issue a verdict. This design follows a common belief that step-by-step reasoning improves a decision. However, CoT also makes the guard heavy and slow, because the model must generate many tokens before it decides. This may not match how guardrails are actually deployed. A guardrail sometimes should not be heavy and slow, and it often runs on-device, for example on an embodied robot. In this paper, we pose a question whether a safety guardrail really needs to reason. To answer this question, we train a lightweight bidirectional encoder and a reasoning guard on the same corpus, and we then remove only the reasoning while we keep everything else fixed. With this controlled same-base comparison, we show that the chain does not improve moderation accuracy. We name the resulting guard LeanGuard. A 395M label-only encoder reaches an average F1 of 82.90 $\pm$ 0.26 over public benchmarks. It matches a reasoning guard that is built on a much larger decoder, while it uses only a single forward pass over an input of at most 512 tokens. This is about a ~100x reduction in inference compute. We further show that this label-only encoder stays robust under training-label noise and retains far more recall at a strict false-positive rate than the reasoning guard, so a heavier reasoning guard is not the more robust choice either. Our finding suggests that the current guardrail benchmarks may not be hard enough to reward reasoning, and that the necessity of CoT for moderation is still not proven. We release all source codes and models including LeanGuard at https://github.com/ndb796/LeanGuard.

Related papers

• LongGuard: Mechanistic Analysis and Training-Free Mitigation of Long-Context Failure in Safety Guardrails [21.90973380292976]
  LongGuard is a framework that evaluates, mechanistically analyzes, and mitigates long-context guardrail failure.<n>We formulate the task as Safety Needle-in-a-Haystack (SafetyNIAH) over a 0.25k-32k length grid.<n>Across 15 mainstream guardrails, unsafe recall drops monotonically by more than 50% on average, and a paired Benign-Fill vs. Needle-Repeat design attributes the failure to proportional dilution of the unsafe needle rather than to absolute length.
  arXiv  Detail & Related papers  (2026-08-27T18:07:25Z)
• When Are Reasoning-Based Guardrails Not Efficient? ResponseGuard: A Fast Vision-Language Guard for Real-Time Moderation [9.68749971398651]
  A vision-language AI assistant returns its answer as a stream of generated tokens.<n>A safety guard that watches that answer has to keep up with the stream and stop a harmful reply before a user reads it.<n>Recent vision-language guardrails instead generate a chain of thought before they issue a verdict.
  arXiv  Detail & Related papers  (2026-07-23T15:02:24Z)
• GLiGuard: Schema-Conditioned Classification for LLM Safeguard [5.918280835312565]
  We introduce textbfGLiGuard, a bidirectional encoder adapted from GLiNER2 for LLM content moderation.<n>The key idea is to encode task definitions and label semantics directly into the input sequence as structured token schemas.<n>GLiGuard achieves F1 scores competitive with 7B--27B decoder-based guards despite being 23--90$times$ smaller.
  arXiv  Detail & Related papers  (2026-05-08T16:44:07Z)
• Guardian-as-an-Advisor: Advancing Next-Generation Guardian Models for Trustworthy LLMs [70.81495077853673]
  Hard-gated safety checkers often over-refuse and misalign with a vendor's model spec.<n>This work introduces Guardian-as-an-Advisor (GaaA), a soft-gating pipeline where a guardian predicts a binary risk label and prepends this advice to the original query for re-inference.<n>Overall, GaaA steers models to comply with the model spec, maintaining safety while reducing over-refusal.
  arXiv  Detail & Related papers  (2026-04-08T23:47:29Z)
• THINKSAFE: Self-Generated Safety Alignment for Reasoning Models [60.10077024249373]
  We propose ThinkSafe, a framework that restores safety alignment without external teachers.<n>Our key insight is that while compliance suppresses safety mechanisms, models often retain latent knowledge to identify harm.<n> Experiments on DeepSeek-R1-Distill and Qwen3 show ThinkSafe significantly improves safety while preserving reasoning proficiency.
  arXiv  Detail & Related papers  (2026-01-30T16:31:02Z)
• Bag of Tricks for Subverting Reasoning-based Safety Guardrails [62.139297207938036]
  We present a bag of jailbreak methods that subvert the reasoning-based guardrails.<n>Our attacks span white-, gray-, and black-box settings and range from effortless template manipulations to fully automated optimization.
  arXiv  Detail & Related papers  (2025-10-13T16:16:44Z)
• Beyond Linear Probes: Dynamic Safety Monitoring for Language Models [67.15793594651609]
  Traditional safety monitors require the same amount of compute for every query.<n>We introduce Truncated Polynomials (TPCs), a natural extension of linear probes for dynamic activation monitoring.<n>Our key insight is that TPCs can be trained and evaluated progressively, term-by-term.
  arXiv  Detail & Related papers  (2025-09-30T13:32:59Z)
• MARCOS: Deep Thinking by Markov Chain of Continuous Thoughts [82.46857666702924]
  We present a new paradigm for reasoning in large language models (LLMs)<n>Instead of autoregressively generating tokens, we model reasoning as a hidden Markov chain of continuous, high-dimensional "thoughts"<n>For the first time, MARCOS achieves performance comparable to token-based CoT, even surpassing it by 4.7% on GSM8K with up to 15.7x speedup in inference.
  arXiv  Detail & Related papers  (2025-09-29T16:44:22Z)
• No Free Lunch with Guardrails [0.0]
  We evaluate whether current guardrails effectively prevent misuse while maintaining practical utility.<n>Our findings confirm that there is no free lunch with guardrails; strengthening security often comes at the cost of usability.<n>We propose a blueprint for designing better guardrails that minimize risk while maintaining usability.
  arXiv  Detail & Related papers  (2025-04-01T05:46:54Z)
• GuardReasoner: Towards Reasoning-based LLM Safeguards [100.85955697211323]
  This paper proposes GuardReasoner, a new safeguard for LLMs.<n>We first create the GuardReasonerTrain dataset, which consists of 127K samples with 460K detailed reasoning steps.<n>Then, we introduce reasoning SFT to unlock the reasoning capability of guard models.<n>In this manner, GuardReasoner achieves better performance, explainability, and generalizability.
  arXiv  Detail & Related papers  (2025-01-30T17:06:06Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.