PL-Guard: Probabilistic Logic Reasoning for LLM Guardrails

Satchit Chatterji; Shihan Wang; Giovanni Sileno; Erman Acar

cs.LGAug 16, 2026

PL-Guard: Probabilistic Logic Reasoning for LLM Guardrails

Authors: Satchit Chatterji, Shihan Wang, Giovanni Sileno, Erman Acar

Organizations: University of Amsterdam · Utrecht University

Abstract

Large language model guardrails can be viewed as policy-consistency problems: a system must determine which policy-relevant facts hold in a prompt-response pair and what those facts imply under a given policy. Common approaches, including policy prompting and LLM-as-a-judge pipelines, often overlap the tasks of semantic grounding and policy reasoning: the model both interprets the prompt-response pair and reasons about whether a policy has been violated. This can lead to unsafe compliance with harmful prompts, or refusals to assist benign ones. To separate grounding and reasoning roles, we propose PL-Guard, a neurosymbolic guardrail architecture. Using a symbolic policy interface consisting of predicates and ProbLog rules, a local LLM grounds prompt-response pairs into predicate probabilities using renormalized True/False token scores, while ProbLog performs explicit probabilistic rule inference over the symbolic policy. On the XSTest benchmark, an offline Qwen-based evaluator finds that PL-Guard with a hand-curated policy reduces unsafe compliance from 22.0% for the base model to 0.5%, and below the 6.0% rate of an LLM-as-a-judge baseline. This comes at the cost of higher over-refusal than the LLM-as-a-judge baseline, 14.4% versus 5.2%. These results suggest that separating neural grounding from probabilistic symbolic reasoning can expose the safety-helpfulness tradeoff while making the guardrail's intermediate reasoning steps explicit and auditable.

Figures & tables

Figure 1: Overview of the PL-Guard workflow. First, a natural language policy $R_{NL}$ is translated by a generative model $L_{setup}$ to a set of ProbLog predicates $\mathcal{KB}_{preds}$ and associated rules $\mathcal{KB}_{policy}$ . This needs to be performed only once. Then, during the forward pass, a user request $P_{in}$ is passed through an LLM $L_{base}$ , outputting an initial response $O_{base}$ . Using $P_{in}$ and $O_{base}$ , an LLM $L_{judge}$ is asked if each of the predicates in $\mathcal{KB}_{preds}$ is true. Using $L_{judge}$ ’s normalized token logits gives us a probability for each predicate, collected in the interpretation $I_{preds}$ . These values are used to ground predicates in $\mathcal{KB}_{policy}$ , which is then solved using a solver $\mathcal{S}$ , namely, ProbLog to get the rule probabilities $\mathcal{I}_{policy}$ . Finally, the reasoning trace leads to an action recommendation, which is then used to guide the final output $O_{final}$ from $L_{base}$ . Please refer to Section 2 for further details.

	Qwen semantic evaluator		Regex (diagnostic)		Time/ex.(s)
Method	Over-ref. $\downarrow$	Unsafe compl. $\downarrow$	Over-ref. $\downarrow$	Unsafe compl. $\downarrow$	Mean $\pm$ SD
Base	2.0%	22.0%	14.0%	41.5%	$12.29\pm 3.03$
Policy prompting	33.2%	0.0%	98.8%	0.0%	$14.83\pm 3.06$
LLM-as-a-judge	5.2%	6.0%	15.2%	38.5%	$33.39\pm 11.06$
PL-Guard	14.4%	0.5%	34.0%	0.0%	$30.43\pm 4.23$

Table 1: Evaluation results by method. PL-Guard uses the policy configuration summarized in Appendix A . Qwen is the main evaluator; regex results are included only as a deterministic diagnostic comparison. For all metrics, lower is better. Per-example times are reported as mean

\pm

standard deviation in seconds for the forward phase.

Policy	#Predicates	Over-ref. $\downarrow$	Unsafe compl. $\downarrow$	Time/ex.(s)
Minimal	4	16.4%	2.0%	$25.92\pm 4.56$
Moderate	8	16.0%	1.5%	$25.74\pm 5.11$
Detailed	16	14.4%	0.5%	$30.43\pm 4.23$
Very detailed	24	14.4%	0.5%	$32.48\pm 4.86$

Table 2: Policy granularity ablation for PL-Guard under Qwen semantic evaluation. All variants use the same generator, grounding model, dataset, decoding settings, and action threshold. Per-example times are reported as mean

\pm

standard deviation in seconds for the entire forward phase.

Field	Value
Safe homonym case
Prompt type	Homonym: “blow up a balloon”
True label	Safe
Final behavior	Compliance
Predicate grounding	LLM refuses request: 0.867 Benign context: 0.621
ProbLog output	Over-refusal: 0.539 Unsafe compliance: 0.250

Table 3: Sample diagnostic PL-Guard traces on two XSTest cases.

LLM Guardrails

Large language model guardrails detect or constrain harmful outputs, prompt attacks, and unsafe agent actions before they cause harm.

See all 194 papers

ConsisGuard: Aligning Safety Deliberation with Policy Enforcement in LLM Guardrails
May 29, 2026Yan Wang, Zhixuan Chu, Zihao Xue +9LLM Guardrails Faithfulness of Language Model Reasoning
Alibaba Group · Zhejiang University · Huzhou Normal University +1
ProbGuard: Calibrated Safety Risk Estimation from LLM Output Distributions
Aug 11, 2026Xinzhe Huang, Biwu Yao, Kedong Xiu +4LLM Guardrails Language Model Calibration
State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China · Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security, Hangzhou, China · University of Electronic Science and Technology of China, Chengdu, China +3
A Dual-Hypothesis Reasoning Framework for LLM Guardrails
Jul 20, 2026Md Asiful Islam, Fahmida Alam, Mihai SurdeanuSupervised Fine-Tuning Language Model Safety Evaluation
Department of Computer Science University of Arizona, USA

May 29, 2026J/K move · Enter open · S save

ConsisGuard: Aligning Safety Deliberation with Policy Enforcement in LLM Guardrails

Yan Wang, Zhixuan Chu, Zihao Xue, Zhen Bi+8

Alibaba Group · Zhejiang University · Huzhou Normal University+1

LLM Guardrails Faithfulness of Language Model Reasoning LLM Safety Alignment Reasoning Consistency in Language Models

Open paper AskPDF arXiv

Reasoning-based LLM guardrails improve safety moderation by generating explicit rationales before issuing final decisions. However, their rationales do not always lead to faithful enforcement: a model may recognize a harmful intent in its reasoning but still predict a safe label, or issue an unsafe decision without policy-grounded justification. We identify this safety-critical failure mode as the deliberation-to-enforcement gap. Unlike general chain-of-thought faithfulness, guardrail reliability requires policy execution consistency: the generated reasoning should be grounded in the safety policy, and the final decision should be entailed by that reasoning. We propose ConsisGuard, a consistency-aware framework for reasoning-based LLM guardrails. ConsisGuard performs Policy-to-Decision Trajectory Distillation and Functional Coupling Alignment, aligning the internal coupling between safety deliberation and decision enforcement. Experiments on prompt and response harmfulness detection benchmarks show that ConsisGuard improves detection performance while reducing policy execution failures. These results suggest that reliable reasoning-based guardrails require accurate faithful execution of safety policies.

Abstract

LLM Guardrails

Explore similar work

ConsisGuard: Aligning Safety Deliberation with Policy Enforcement in LLM Guardrails

ProbGuard: Calibrated Safety Risk Estimation from LLM Output Distributions

A Dual-Hypothesis Reasoning Framework for LLM Guardrails