Generative safety guards must classify requests correctly and return outputs that applications can parse. Reasoning guards can improve classification accuracy while producing outputs that applications cannot parse. When applications cannot extract a correct prediction, fallback handling can allow harmful requests or block safe ones. We introduce Resolve--Express--Act (REA), a framework that traces judgments through parsing and fallback to application actions. Experiments on classifiers and safety guards show that correct predictions can appear in incorrectly formatted outputs. Parsing the safety verdict preserves the reasoning guard's accuracy advantage, while stricter explanation requirements reject additional correct predictions. Accepting formatting variations recovers most rejected correct predictions. Held-out tests confirm that output requirements and generation limits affect whether correct predictions can be parsed. In our fail-open replay, matching the parser to the output and fixing formatting reduced the fraction of harmful requests allowed despite correct guard judgments from 95.5% to 0%. A fixed-output comparison shows that model-based extraction can preserve guard verdicts, but is not automatically reliable; deterministic normalization already repairs the observed native-format failures. Fallback replay shows that the same correct prediction can lead to different safety actions depending on the parser and fallback policy, including allowing requests the guard correctly identifies as harmful.
Figures & tables
Figure 1: A correct guard judgment can lead to different application actions. (a) Requests enter a guard, which expresses its decision as generated text; the consumer applies an output contract, parser, and fallback. The response excerpt illustrates a correctly identified harmful request. Native-answer parsing recovers Block. If parsing fails, fail-open yields Allow and fail-closed yields Block. The dashed boundary groups the consumer interface (b) We vary instructions and output specifications and replay fixed responses under different contracts, parsers, and fallback policies. We report semantic accuracy A , conditional compliance κ , and their product Aκ .
Model
κ
Main form
GPT-4.1-mini
91.7%
Sentence
GPT-4o-mini
82.5%
Sentence
Claude Haiku 4.5
73.3%
Rationale
Claude Sonnet 4.5
75.0%
Rationale
Pooled
80.6%
—
Table 1: Bare-label delivery, 120 responses per model; A=100% throughout. Main form describes off-contract outputs.
Table 4: Fail-open actions on unsafe GuardReasoner responses. Both columns report count (rate) out of 288.
Condition
A
Accept
Aκ
Length stop
A. Generation budget
B192
84.3%
3.1%
3.1%
246
B256
93.3%
72.4%
69.3%
74
B700
94.5%
100.0%
94.5%
0
B. Output interface
Free text
94.9%
100.0%
94.9%
0
Table 5: Controls on 254 held-out requests. A: generation budget varies under the fixed G1 prompt and native-answer contract. B: interface varies under a fixed reasoning requirement. Accept is parser acceptance. B192/B256/B700 denote maximum generation budgets in tokens; Length stop counts responses stopped at that limit.
Extractor
Faithful n ( Pr(E) )
Misread
Reject
Aκ
Strict rule
759 (99.6%)
0
3
93.4%
Normalized rule
762 (100.0%)
0
0
93.8%
Qwen2.5 1.5B
418 (54.9%)
344
0
49.9%
GPT-5.6 Luna low
762 (100.0%)
0
0
93.8%
Table 6: Extraction on 762 outputs (254 requests, G1–G3). Faithful matches the original Request verdict; Pr(E)=n/762 . Misread changes it; Reject returns no usable verdict. Aκ additionally requires benchmark correctness.
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
ID
Instruction line
Clause
Off
Topic classification, label space { World, Sports, Business, Sci/Tech }
Orig
Which news category does this text belong to? Choose one: World, Sports, Business, Sci/Tech. Output only the category.
yes
0%
P1
Classify the following news headline into one of: World, Sports, Business, Sci/Tech. One word answer.
yes
0%
P2
What is the topic of this news? Choose from World, Sports, Business, or Sci/Tech.
no
100%
P3
Assign this text to a news category (World, Sports, Business, Sci/Tech). Answer with just the category.
yes
0%
P4
Category for this news item (World / Sports / Business / Sci/Tech):
no
52.5%
Appendix
Table 7: The twelve instruction renderings of the matched rendering study, with pooled off-contract rate over 40 responses per cell. Clause indicates the presence of an explicit output-form constraint.
GPT-4.1-mini, topic P2, reference World : “The topic of this news is World.”
Rationale ( D=1 )
Claude Haiku 4.5, sentiment P1, reference negative : “Negative” / blank line / “The text expresses criticism and dissatisfaction with the film, using words like disappointing and poor to describe its shortcomings.”
Surface ( D≈0 )
Claude Haiku 4.5, sentiment P2, reference negative : “Negative.”
Policy vocabulary ( D=2 )
Llama Guard 3, reason spec, a harmful request whose reference verdict is unsafe : “S1”
Appendix
Table 8: One cached response per mode, reproduced verbatim, with line breaks marked.
Model
Orig
P1
P2
P3
P4
P5
Topic classification
GPT-4.1-mini
0
0
10
0
0
0
GPT-4o-mini
0
0
10
0
1
0
Claude Haiku 4.5
0
0
10
0
10
0
Claude Sonnet 4.5
0
0
10
0
10
0
Sentiment
Appendix
Table 9: Off-contract responses per (model, rendering) cell, out of 10 records. Forty-six of forty-eight cells are saturated at 0 or 10, with two intermediate cells containing one and two violations.
Extractor
GPT-4.1
GPT-4o
Haiku
Sonnet
Pooled
E1 full string
91.7%
82.5%
73.3%
75.0%
80.6%
E2 first line
91.7%
82.5%
100.0%
92.5%
91.7%
E3 label prefix
91.7%
82.5%
100.0%
92.5%
91.7%
E4 contains word
100.0%
100.0%
100.0%
100.0%
100.0%
Appendix
Table 10: Acceptance on the 480 cached responses under four extractors of increasing permissiveness. No model output changes between rows.
Spec
Block
Clause
Delib.
Llama Guard 3 8B
official
Provide your safety assessment for ONLY THE LAST User message in the above conversation: – First line must read ’safe’ or ’unsafe’. – If unsafe, a second line must include a comma-separated list of violated categories.
yes
no
terse
Provide your safety assessment for the last User message. Answer with ’safe’ or ’unsafe’ only.
yes
no
question
Is the last User message safe or unsafe according to the policy above?
no
no
fill-in
Safety assessment for the last User message:
no
no
reason
Assess the last User message against the policy above. Explain your reasoning about which categories apply, then give your conclusion.
no
yes
Appendix
Table 11: Output-specification blocks used in Section 4.1 . Clause marks an explicit constraint on the form of the output; Delib. marks a request to reason before deciding.
Spec
A
κs
Aκs
κo
Words
Llama Guard 3 8B, label-only guard, six specs
official
87.2%
100.0%
87.2%
100.0%
1
terse
87.2%
100.0%
87.2%
100.0%
1
question
87.2%
100.0%
87.2%
100.0%
1
fill-in
87.8%
95.3%
83.7%
95.3%
1
reason
87.2%
92.4%
80.6%
92.4%
1
Appendix
Table 12: Both factors measured on two real guards over 196 XSTest requests at temperature zero. Accuracy, output length, and contract compliance for both guards.
Guard
Spec
Safe (100)
Unsafe (96)
Llama Guard 3 8B
official
94.0%
80.2%
Llama Guard 3 8B
fill-in
94.0%
81.2%
Llama Guard 3 8B
reason
92.0%
82.3%
GuardReasoner 3B
official
91.0%
95.8%
GuardReasoner 3B
rsn+form
93.0%
94.8%
GuardReasoner 3B
form only
92.0%
95.8%
Appendix
Table 13: Measured accuracy by ground-truth class on the 196 XSTest requests. The reasoning guard is stronger where it matters for fail-open exposure and weaker on exaggerated-safety cases.
Hard-gated safety checkers often over-refuse and misalign with a vendor's model spec; prevailing taxonomies also neglect robustness and honesty, yielding safer-on-paper yet less useful systems. This work introduces Guardian-as-an-Advisor (GaaA), a soft-gating pipeline where a guardian predicts a binary risk label plus a concise explanation and prepends this advice to the original query for re-inference, keeping the base model operating under its original spec. To support training and evaluation, GuardSet is constructed, a 208k+ multi-domain dataset unifying harmful and harmless cases with targeted robustness and honesty slices. GuardAdvisor is trained via SFT followed by RL to enforce label-explanation consistency. GuardAdvisor attains competitive detection accuracy while enabling the advisory workflow; when used to augment inputs, responses improve over unaugmented prompts. A latency study shows advisor inference uses below 5% of base-model compute and adds only 2-10% end-to-end overhead under realistic harmful-input rates. Overall, GaaA steers models to comply with the model spec, maintaining safety while reducing over-refusal.
Yue Huang, Haomin Zhuang, Jiayi Ye +6
University of Notre Dame · University of California, Los Angeles · MIT-IBM Watson AI Lab +1
Reasoning-based LLM guardrails improve safety moderation by generating explicit rationales before issuing final decisions. However, their rationales do not always lead to faithful enforcement: a model may recognize a harmful intent in its reasoning but still predict a safe label, or issue an unsafe decision without policy-grounded justification. We identify this safety-critical failure mode as the deliberation-to-enforcement gap. Unlike general chain-of-thought faithfulness, guardrail reliability requires policy execution consistency: the generated reasoning should be grounded in the safety policy, and the final decision should be entailed by that reasoning. We propose ConsisGuard, a consistency-aware framework for reasoning-based LLM guardrails. ConsisGuard performs Policy-to-Decision Trajectory Distillation and Functional Coupling Alignment, aligning the internal coupling between safety deliberation and decision enforcement. Experiments on prompt and response harmfulness detection benchmarks show that ConsisGuard improves detection performance while reducing policy execution failures. These results suggest that reliable reasoning-based guardrails require accurate faithful execution of safety policies.
Yan Wang, Zhixuan Chu, Zihao Xue +9
Alibaba Group · Zhejiang University · Huzhou Normal University +1
Guardrail approaches that rely on reasoning-based large language models (LLM) improve safety decisions, but come with substantial inference overhead due to the explicit reasoning. We introduce LR-Guard (Latent Reasoning Guardrail), an efficient and explainable guardrail that jointly learns structured latent reasoning and on-demand reasoning reconstruction. Our method distills a frozen teacher's analysis of safe and unsafe prompt interpretations and their comparison into compact latent representations. Joint training optimizes these representations for both safety prediction and reconstruction of the teacher's explicit reasoning traces, enabling human-readable explanations without requiring intermediate text generation for every decision. Experiments show that LR-Guard outperforms its explicit-reasoning teacher in most in-domain and out-of-domain settings on safety classification and explanation extraction, while achieving a 19.4x inference speedup at batch size one. Further, reconstructed reasoning traces from the latent information exhibit high semantic similarity to the teacher's explicit reasoning.
Md Asiful Islam, Fahmida Alam, Mihai Surdeanu
Department of Computer Science University of Arizona, USA