DualGuard: Dual-Mode Quality Control for Logic-Preserving Data Augmentation

Reasoning-based large language model (LLM) safeguards improve safety classification accuracy by generating explicit rationales before making decisions. However, generating explicit rationales adds substantial decoding overhead to every safety decision, while readable explanations are needed only for on-demand audits. This mismatch motivates $\mathrm{R}{\scriptstyle\mathrm{EAL}}\mathrm{G}{\scriptstyle\mathrm{UARD}}$, a reliable, efficient, and auditable framework for LLM safeguards that decouples safety reasoning from rationale generation via latent reasoning. During training, a task-aligned curriculum progressively replaces explicit rationales with continuous latent reasoning under supervision from the remaining rationale text and final safety labels. In parallel, a lightweight audit decoder is trained to generate explanations conditioned on interaction text and latent states under supervision from condensed task-level rationales. At inference, the guard model makes safety decisions through continuous latent reasoning with adaptive stopping, while the audit decoder generates concise explanations when needed. Evaluations of 1B, 3B, and 8B models show that $\mathrm{R}{\scriptstyle\mathrm{EAL}}\mathrm{G}{\scriptstyle\mathrm{UARD}}$ improves mean F1 score by up to 1.76 points over GuardReasoner, with up to 15.7$\times$ speedups and up to 166.7$\times$ reductions in reasoning token usage during routine safety classification, while its audit decoder achieves up to 87.73% explanation acceptability under LLM-based evaluation.

Hard-gated safety checkers often over-refuse and misalign with a vendor's model spec; prevailing taxonomies also neglect robustness and honesty, yielding safer-on-paper yet less useful systems. This work introduces Guardian-as-an-Advisor (GaaA), a soft-gating pipeline where a guardian predicts a binary risk label plus a concise explanation and prepends this advice to the original query for re-inference, keeping the base model operating under its original spec. To support training and evaluation, GuardSet is constructed, a 208k+ multi-domain dataset unifying harmful and harmless cases with targeted robustness and honesty slices. GuardAdvisor is trained via SFT followed by RL to enforce label-explanation consistency. GuardAdvisor attains competitive detection accuracy while enabling the advisory workflow; when used to augment inputs, responses improve over unaugmented prompts. A latency study shows advisor inference uses below 5% of base-model compute and adds only 2-10% end-to-end overhead under realistic harmful-input rates. Overall, GaaA steers models to comply with the model spec, maintaining safety while reducing over-refusal.

Guard models are the last line of defense between a language model and a harmful output, yet their training objective is surprisingly narrow. Existing guards learn to predict a single verdict token from a conversational context, concentrating supervision on a single target. The consequences are structural: models latch onto shortcut features, are overconfident, and remain sensitive to where safety evidence appears in the sequence rather than its role in the full context. We propose a different framing. Rather than predicting a label from text, our LLaDA-Guard asks which label better explains the text: scoring the prompt or response under each label hypothesis and classifying based on their difference. This shifts supervision to every token in the moderated region, forcing the model to account for full content rather than its most discriminative fragments. We instantiate this idea with a masked diffusion language model, fine-tuning LLaDA-8B-Instruct with a class-conditional reconstruction objective using LoRA and requiring no architectural changes beyond the base model. LLaDA-Guard leads on average rank against discriminative baselines trained on stronger backbones across seven held-out safety benchmarks, while exhibiting substantially better confidence calibration (ECE 0.0875 vs. 0.1384 for Qwen3Guard), less over-defense on benign prompts with unsafe-looking cues, and less prompt leakage when moderating responses. Its generative nature further enables token-level risk localization as a natural byproduct, yielding a pipeline for rewriting unsafe prompts into safe equivalents without additional training and achieving a 60.7% average conversion-to-safe rate.