When Are Reasoning-Based Guardrails Not Efficient? ResponseGuard: A Fast Vision-Language Guard for Real-Time Moderation

• URL: http://arxiv.org/abs/2607.21401v1
• Date: Thu, 23 Jul 2026 15:02:24 GMT
• Title: When Are Reasoning-Based Guardrails Not Efficient? ResponseGuard: A Fast Vision-Language Guard for Real-Time Moderation
• Abstract summary: A vision-language AI assistant returns its answer as a stream of generated tokens.<n>A safety guard that watches that answer has to keep up with the stream and stop a harmful reply before a user reads it.<n>Recent vision-language guardrails instead generate a chain of thought before they issue a verdict.
• Score: 9.68749971398651
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: A vision-language AI assistant returns its answer as a stream of generated tokens. Therefore, a safety guard that watches that answer has to keep up with the stream and stop a harmful reply before a user reads it. Recent vision-language guardrails instead generate a chain of thought before they issue a verdict. They believe that step-by-step reasoning yields a safer guard. This design makes the guard heavy and slow, since the model must decode many tokens for harmfulness detection. We pose the question of whether a vision-language guard really needs to reason in order to screen a response. We answer with a guard that has no chain. ResponseGuard reads a harmful verdict from a single pooled representation of the request, the response, and the image in one forward pass. Across a standard multimodal guardrail benchmark, our 2B ResponseGuard outperforms a recent 3B reasoning-based vision-language guard on response harmfulness detection, without any reasoning and at about 150 times lower time cost. On request harmfulness the reasoning guard retains an overall lead, and the remaining gap on both tracks sits on the image-only cells. We observe that the gap may stem from the frozen vision encoders that both designs use rather than from the missing chain. We have also found the reasoning guard directs almost none of its verdict attention to the image. Based on a single-pass detection, ResponseGuard can screen an answer sentence by sentence as it streams and stop a harmful answer before it finishes. For guarding the response of a vision-language model, a calibrated single-pass label may provide a sufficient safety signal. We fully release all source code, trained models, and datasets at https://github.com/ndb796/ResponseGuard.

Related papers

• Whose Refusal Is It? The Unmeasured Contribution of Black-Box Multimodal Guardrails [24.794304039477495]
  We show that the guardrail's actual share of the safety credited to it runs from none of it to essentially all of it.<n>The split is recoverable at no extra cost, because a guard block replaces the model's response.
  arXiv  Detail & Related papers  (2026-08-09T11:19:30Z)
• Recover, Decode, Reguard: Guard-Agnostic Defense Amplification againstEncoded VLM Jailbreaks [7.287314790466206]
  We build a guard-agnostic recover-and-decode amplifier for vision-language models.<n>We evaluate it against an ensemble of eleven attacks, scoring a behavior as broken if any succeeds.<n>This exposes our central finding: an empirical safety-utility ceiling for the non-iterative recovery defenses we evaluate.
  arXiv  Detail & Related papers  (2026-07-29T07:53:35Z)
• Do Safety Guardrails Need to Reason? LeanGuard: A Fast and Light Approach for Robust Moderation [9.68749971398651]
  We train a lightweight bidirectional encoder and a reasoning guard on the same corpus.<n>We show that the chain does not improve moderation accuracy.<n>A 395M label-only encoder reaches an average F1 of 82.90 $pm$ 0.26 over public benchmarks.
  arXiv  Detail & Related papers  (2026-06-25T07:15:33Z)
• SentGuard: Sentence-Level Streaming Guardrails for Large Language Models [40.00517152303363]
  We propose SentGuard, a sentence-level streaming guardrail that operates in parallel with generation.<n>A benchmark with structured per-sentence annotations captures the evolution of safety risks across both reasoning and response segments.<n>Experiments show that SentGuard outperforms existing baselines, detecting 90.5% of unsafe cases within two sentences while maintaining a low streaming false-positive rate of 7.41%.
  arXiv  Detail & Related papers  (2026-06-01T10:30:08Z)
• Exploring and Developing a Pre-Model Safeguard with Draft Models [21.47104074821029]
  Large Language Model (LLM) alignment remains vulnerable to jailbreak attacks.<n>Pre-model guards audit the safety of prompts before invoking target models.<n>Post-model guards address this issue by auditing both the user prompt and the target model's response.
  arXiv  Detail & Related papers  (2026-05-19T04:01:36Z)
• One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue [55.98008208209856]
  Hidden malicious intent in multi-turn dialogue poses a growing threat to large language models (LLMs)<n>Recent studies show that even modern commercial models with advanced guardrails remain vulnerable to such attacks despite advances in safety alignment and external guardrails.<n>In this work, we address this challenge by detecting the earliest turn at which delivering the candidate response would make the accumulated interaction sufficient to enable harmful action.
  arXiv  Detail & Related papers  (2026-05-07T03:35:31Z)
• Guardian-as-an-Advisor: Advancing Next-Generation Guardian Models for Trustworthy LLMs [70.81495077853673]
  Hard-gated safety checkers often over-refuse and misalign with a vendor's model spec.<n>This work introduces Guardian-as-an-Advisor (GaaA), a soft-gating pipeline where a guardian predicts a binary risk label and prepends this advice to the original query for re-inference.<n>Overall, GaaA steers models to comply with the model spec, maintaining safety while reducing over-refusal.
  arXiv  Detail & Related papers  (2026-04-08T23:47:29Z)
• Bag of Tricks for Subverting Reasoning-based Safety Guardrails [62.139297207938036]
  We present a bag of jailbreak methods that subvert the reasoning-based guardrails.<n>Our attacks span white-, gray-, and black-box settings and range from effortless template manipulations to fully automated optimization.
  arXiv  Detail & Related papers  (2025-10-13T16:16:44Z)
• Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs [54.90315421117162]
  We propose a novel poisoning method via completely harmless data.<n>Inspired by the causal reasoning in auto-regressive LLMs, we aim to establish robust associations between triggers and an affirmative response prefix.<n>We observe an interesting resistance phenomenon where the LLM initially appears to agree but subsequently refuses to answer.
  arXiv  Detail & Related papers  (2025-05-23T08:13:59Z)
• Steering Dialogue Dynamics for Robustness against Multi-turn Jailbreaking Attacks [59.300698230887114]
  Large language models (LLMs) are shown to be vulnerable to jailbreaking attacks where adversarial prompts are designed to elicit harmful responses.<n>We propose a safety steering framework grounded in safe control theory, ensuring invariant safety in multi-turn dialogues.
  arXiv  Detail & Related papers  (2025-02-28T21:10:03Z)
• GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning [79.07152553060601]
  We propose GuardAgent, the first guardrail agent to protect target agents by dynamically checking whether their actions satisfy given safety guard requests.<n>Specifically, GuardAgent first analyzes the safety guard requests to generate a task plan, and then maps this plan into guardrail code for execution.<n>We show that GuardAgent effectively moderates the violation actions for different types of agents on two benchmarks with over 98% and 83% guardrail accuracies, respectively.
  arXiv  Detail & Related papers  (2024-06-13T14:49:26Z)
• TextGuard: Provable Defense against Backdoor Attacks on Text Classification [83.94014844485291]
  We propose TextGuard, the first provable defense against backdoor attacks on text classification. In particular, TextGuard divides the (backdoored) training data into sub-training sets, achieved by splitting each training sentence into sub-sentences. In our evaluation, we demonstrate the effectiveness of TextGuard on three benchmark text classification tasks.
  arXiv  Detail & Related papers  (2023-11-19T04:42:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.