Generative safety guards must classify requests correctly and return outputs that applications can parse. Reasoning guards can improve classification accuracy while producing outputs that applications cannot parse. When applications cannot extract a correct prediction, fallback handling can allow harmful requests or block safe ones. We introduce Resolve--Express--Act (REA), a framework that traces judgments through parsing and fallback to application actions. Experiments on classifiers and safety guards show that correct predictions can appear in incorrectly formatted outputs. Parsing the safety verdict preserves the reasoning guard's accuracy advantage, while stricter explanation requirements reject additional correct predictions. Accepting formatting variations recovers most rejected correct predictions. Held-out tests confirm that output requirements and generation limits affect whether correct predictions can be parsed. In our fail-open replay, matching the parser to the output and fixing formatting reduced the fraction of harmful requests allowed despite correct guard judgments from 95.5% to 0%. A fixed-output comparison shows that model-based extraction can preserve guard verdicts, but is not automatically reliable; deterministic normalization already repairs the observed native-format failures. Fallback replay shows that the same correct prediction can lead to different safety actions depending on the parser and fallback policy, including allowing requests the guard correctly identifies as harmful.
Figures & tables
Figure 1: A correct guard judgment can lead to different application actions. (a) Requests enter a guard, which expresses its decision as generated text; the consumer applies an output contract, parser, and fallback. The response excerpt illustrates a correctly identified harmful request. Native-answer parsing recovers Block. If parsing fails, fail-open yields Allow and fail-closed yields Block. The dashed boundary groups the consumer interface (b) We vary instructions and output specifications and replay fixed responses under different contracts, parsers, and fallback policies. We report semantic accuracy A , conditional compliance κ , and their product Aκ .
Model
κ
Main form
GPT-4.1-mini
91.7%
Sentence
GPT-4o-mini
82.5%
Sentence
Claude Haiku 4.5
73.3%
Rationale
Claude Sonnet 4.5
75.0%
Rationale
Pooled
80.6%
—
Table 1: Bare-label delivery, 120 responses per model; A=100% throughout. Main form describes off-contract outputs.
Table 4: Fail-open actions on unsafe GuardReasoner responses. Both columns report count (rate) out of 288.
Condition
A
Accept
Aκ
Length stop
A. Generation budget
B192
84.3%
3.1%
3.1%
246
B256
93.3%
72.4%
69.3%
74
B700
94.5%
100.0%
94.5%
0
B. Output interface
Free text
94.9%
100.0%
94.9%
0
Table 5: Controls on 254 held-out requests. A: generation budget varies under the fixed G1 prompt and native-answer contract. B: interface varies under a fixed reasoning requirement. Accept is parser acceptance. B192/B256/B700 denote maximum generation budgets in tokens; Length stop counts responses stopped at that limit.
Extractor
Faithful n ( Pr(E) )
Misread
Reject
Aκ
Strict rule
759 (99.6%)
0
3
93.4%
Normalized rule
762 (100.0%)
0
0
93.8%
Qwen2.5 1.5B
418 (54.9%)
344
0
49.9%
GPT-5.6 Luna low
762 (100.0%)
0
0
93.8%
Table 6: Extraction on 762 outputs (254 requests, G1–G3). Faithful matches the original Request verdict; Pr(E)=n/762 . Misread changes it; Reject returns no usable verdict. Aκ additionally requires benchmark correctness.
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
ID
Instruction line
Clause
Off
Topic classification, label space { World, Sports, Business, Sci/Tech }
Orig
Which news category does this text belong to? Choose one: World, Sports, Business, Sci/Tech. Output only the category.
yes
0%
P1
Classify the following news headline into one of: World, Sports, Business, Sci/Tech. One word answer.
yes
0%
P2
What is the topic of this news? Choose from World, Sports, Business, or Sci/Tech.
no
100%
P3
Assign this text to a news category (World, Sports, Business, Sci/Tech). Answer with just the category.
yes
0%
P4
Category for this news item (World / Sports / Business / Sci/Tech):
no
52.5%
Appendix
Table 7: The twelve instruction renderings of the matched rendering study, with pooled off-contract rate over 40 responses per cell. Clause indicates the presence of an explicit output-form constraint.
GPT-4.1-mini, topic P2, reference World : “The topic of this news is World.”
Rationale ( D=1 )
Claude Haiku 4.5, sentiment P1, reference negative : “Negative” / blank line / “The text expresses criticism and dissatisfaction with the film, using words like disappointing and poor to describe its shortcomings.”
Surface ( D≈0 )
Claude Haiku 4.5, sentiment P2, reference negative : “Negative.”
Policy vocabulary ( D=2 )
Llama Guard 3, reason spec, a harmful request whose reference verdict is unsafe : “S1”
Appendix
Table 8: One cached response per mode, reproduced verbatim, with line breaks marked.
Model
Orig
P1
P2
P3
P4
P5
Topic classification
GPT-4.1-mini
0
0
10
0
0
0
GPT-4o-mini
0
0
10
0
1
0
Claude Haiku 4.5
0
0
10
0
10
0
Claude Sonnet 4.5
0
0
10
0
10
0
Sentiment
Appendix
Table 9: Off-contract responses per (model, rendering) cell, out of 10 records. Forty-six of forty-eight cells are saturated at 0 or 10, with two intermediate cells containing one and two violations.
Extractor
GPT-4.1
GPT-4o
Haiku
Sonnet
Pooled
E1 full string
91.7%
82.5%
73.3%
75.0%
80.6%
E2 first line
91.7%
82.5%
100.0%
92.5%
91.7%
E3 label prefix
91.7%
82.5%
100.0%
92.5%
91.7%
E4 contains word
100.0%
100.0%
100.0%
100.0%
100.0%
Appendix
Table 10: Acceptance on the 480 cached responses under four extractors of increasing permissiveness. No model output changes between rows.
Spec
Block
Clause
Delib.
Llama Guard 3 8B
official
Provide your safety assessment for ONLY THE LAST User message in the above conversation: – First line must read ’safe’ or ’unsafe’. – If unsafe, a second line must include a comma-separated list of violated categories.
yes
no
terse
Provide your safety assessment for the last User message. Answer with ’safe’ or ’unsafe’ only.
yes
no
question
Is the last User message safe or unsafe according to the policy above?
no
no
fill-in
Safety assessment for the last User message:
no
no
reason
Assess the last User message against the policy above. Explain your reasoning about which categories apply, then give your conclusion.
no
yes
Appendix
Table 11: Output-specification blocks used in Section 4.1 . Clause marks an explicit constraint on the form of the output; Delib. marks a request to reason before deciding.
Spec
A
κs
Aκs
κo
Words
Llama Guard 3 8B, label-only guard, six specs
official
87.2%
100.0%
87.2%
100.0%
1
terse
87.2%
100.0%
87.2%
100.0%
1
question
87.2%
100.0%
87.2%
100.0%
1
fill-in
87.8%
95.3%
83.7%
95.3%
1
reason
87.2%
92.4%
80.6%
92.4%
1
Appendix
Table 12: Both factors measured on two real guards over 196 XSTest requests at temperature zero. Accuracy, output length, and contract compliance for both guards.
Guard
Spec
Safe (100)
Unsafe (96)
Llama Guard 3 8B
official
94.0%
80.2%
Llama Guard 3 8B
fill-in
94.0%
81.2%
Llama Guard 3 8B
reason
92.0%
82.3%
GuardReasoner 3B
official
91.0%
95.8%
GuardReasoner 3B
rsn+form
93.0%
94.8%
GuardReasoner 3B
form only
92.0%
95.8%
Appendix
Table 13: Measured accuracy by ground-truth class on the 196 XSTest requests. The reasoning guard is stronger where it matters for fail-open exposure and weaker on exaggerated-safety cases.