HaloGuard 2.0: An Open-Weights Constitutional Output Guard for Multilingual Response Safety

Ashmiya Lenin; Navaneeth Sangameswaran; Preetham S

cs.CLNov 1, 2026

HaloGuard 2.0: An Open-Weights Constitutional Output Guard for Multilingual Response Safety

Authors: Ashmiya Lenin, Navaneeth Sangameswaran, Preetham S

Organizations: Astroware AI, Delaware, USA · Karunya Institute of Technology and Sciences, Coimbatore, India

Abstract

An input guard decides whether a request reaches the model, but never sees what the model says. Harm that emerges during generation, because a jailbreak passed the input layer or a benign request drifted into operational detail, is visible only on the output side and only as tokens arrive. We present HaloGuard 2.0, an open-weight streaming output guard that assigns a safe/unsafe probability to every response token in a single forward pass, so a deployment can stop the stream once harm is confirmed. The guard reuses the constitution of HaloGuard 1.0, our input guard, to organise a 478,532-response training corpus, and supervises each token from the point where the response becomes harmful. We find that a guard trained on conventionally shaped data learns a shortcut specific to streaming: it judges the prompt instead of the response, and handles only 13.9% of matched safe/unsafe response pairs correctly. We correct this with a second phase on 106,043 counterfactual responses built around the base guard's own failure modes, and release the equal-weight average of the base and corrective models. On six English response-safety benchmarks, HaloGuard 2.0-0.8B reaches a macro F1 of 83.6 (83.3 on held-out halves of the decision-rule search), up from 72.8, with 38% fewer false positives. It matches the strongest full-response guards with 5-10x fewer parameters and is 2.6 points above the strongest streaming guard, Qwen3Guard-Stream-4B. A multilingual variant, HaloGuard 2.0-Poly-0.8B, trained on PolyGuardMix, reaches 83.1 F1 on the response labels of PolyGuardPrompts across 17 languages, 5.0 points above the strongest baseline. On one H100 the guard costs 0.37 ms per token per stream when moderating 64 concurrent responses. Both guards are hardened continuously through the weekly red-teaming protocol of HaloGuard 1.0, extended here to the output layer.

Figures & tables

Model	Training data	Scored	Streaming	Token supervision
LlamaGuard [ 13 ]	collected + annotated	full response	no	–
WildGuard [ 7 ]	collected + synthetic	full response	no	–
ShieldGemma [ 8 ]	synthetic	full response	no	–
PolyGuard [ 2 ]	collected + translated	full response	no	–
Qwen3Guard-Stream [ 3 ]	collected + synthetic	every token	yes, open	first unsafe token, from rollouts + LLM judge
CCs [ 14 ]	constitution $\to$ synthetic	every token	yes, closed	prefixes trained toward the full-response label

Table 1: Positioning of HaloGuard 2.0 relative to prior output guards.

Panel of Figure 1 — Figure 1: HaloGuard 1.0 screens the request; HaloGuard 2.0 scores the response as it is generated and stops the stream once harm is confirmed. Both guards are built from the same constitution.

Corpus	Slice	Responses	Share
Phase 1 (base)	Harmful pool	264,059	55.2%
	Harmless-boundary pool	180,301	37.7%
	Shared-harmless pool	34,172	7.1%
	Total	478,532
Phase 1, by behaviour	Complied	350,646	73.3%
	Refused	94,455	19.7%

Table 2: Training data. Pools follow the HaloGuard 1.0 constitution; † Of 144,721 unsafe Phase 1 responses, 141,599 are harmful from the first token. Pool and behaviour shares are over all Phase 1 responses.

Figure 2: Almost every unsafe response in the Phase 1 corpus is harmful from its first token; half of the Phase 2 corpus turns harmful mid-response.

Mode	Failure pattern	Data response
Boundary	A legitimate response near a policy edge is flagged for its topic or vocabulary.	Harmless-boundary pool spread across information depth (Phase 1); safe twins of harmful responses (Phase 2).
Baseline (lexical)	An ordinary response is flagged for a harm-adjacent word used innocently.	Shared-harmless pool (Phase 1); lexical-collision responses with innocuous referents (Phase 2).
Prompt-driven	A safe response to a harmful-sounding prompt is flagged before it says anything harmful.	Matched safe/unsafe responses to the same prompt; unsafe responses with a safe lead-in and a late onset (Phase 2).

Table 3: The three FP modes targeted by HaloGuard 2.0. The third is specific to streaming output guards.

Error source	Share of 3,107 errors
Genuine model error	66.6%
Benchmark mislabel	19.4%
Policy disagreement	18.1%

Table 4: Adjudicated benchmark errors for an intermediate model. The shares exceed 100% because certain errors are attributed to two causes.

Corpus	Language	Responses	Unsafe	Unsafe share	Onset $>0$
Phase 1: Constitutional	English	478,532	144,721	30.2%	2.2%
Phase 2: Corrective-constitutional	English	106,043	53,282	50.2%	51.2%
English total		584,575	198,003	33.9%
PolyGuardMix (multilingual)	17	1,055,192	251,791	23.9%	n/a
Total		1,639,767	449,794	27.4%

Table 5: Training data by corpus and language. Onset

>0

is the share of unsafe responses that open with safe text before the harm. PolyGuardMix contributes the 1,080,192 of its 1,910,372 rows that contain a response; 5,000 are held out for validation and 20,000 as a development pool, leaving 1,055,192 for training. It shares no prompt–response pair with PolyGuardPrompts.

Model	Sizes	Training data	Languages	Streaming
Qwen3Guard-Gen [ 3 ]	0.6B, 4B, 8B	$>$ 1.19M (58.8% responses)	119	no
Qwen3Guard-Stream [ 3 ]	0.6B, 4B, 8B	derived from Gen pool	119	token-level
Shieldstral [ 4 ]	3B	54.1M (45.2M text, 4.4M synthetic, 4.5M image)	multilingual	no
HaloGuard 2.0-0.8B	0.8B	584.6K En	English	token-level
HaloGuard 2.0-Poly-0.8B	0.8B	PolyGuardMix + corrective	17	token-level

Table 6: Training data and scope relative to the two closest open guards.

Figure 3: Two-phase training of HaloGuard 2.0-0.8B. Phase 1 trains a base guard on the constitution-organised response corpus. Phase 2 analyses the base guard’s errors, builds a corrective corpus of matched responses, fine-tunes a copy of the base guard on it, and releases the equal-weight average of the two models (the

\frac{1}{2}+\frac{1}{2}

node, Equation 6 ).

Setting	Phase 1: Base Training	Phase 2: Corrective fine-tuning
Initialisation	Qwen3.5-0.8B; head zero-init	Phase 1 base guard
Head	linear, $1024\!\to\!2$	inherited
Training responses	478,532	106,043
Epochs / steps	2 / 29,910	3 / 9,942 (released: step 9,000)
Learning rate	$3\!\times\!10^{-5}$ , head $10\times$	$3\!\times\!10^{-5}$ , head $10\times$ ; 3% warm-up, linear decay
Effective batch	32 (8 $\times$ 2 accum. $\times$ 2 GPUs)	32

Table 7: Training and serving configuration of HaloGuard 2.0-0.8B.

Benchmark	Responses	Unsafe	Notes
HarmBench [ 20 ]	400	50.0%	judged completions to harmful behaviours
SafeRLHF [ 22 ]	5,978	55.2%	test split, response safety
BeaverTails [ 21 ]	3,021	57.4%	test split, QA pairs
WildGuardTest [ 7 ]	1,689	16.7%	response harmfulness
Aegis 2.0 [ 9 ]	813	48.5%	response-labelled test split
XSTest-Response [ 23 , 7 ]	446	17.5%	responses to XSTest prompts

Table 8: Response-safety evaluation suite.

		English		Multilingual (PolyGuardPrompts)
Model	Size	Prompt	Response	Prompt	Response
LlamaGuard3	8B	79.4	70.5	68.0	65.7
LlamaGuard4	12B	75.9	68.9	62.1 §	53.4
ShieldGemma	27B	70.0	65.6	–	50.4
WildGuard	7B	85.8	81.4	73.0 §	63.5
NemoGuard	8B	82.9	78.1	–	69.5

Table 9: The HaloGuard family across tasks (F1). English prompt: average over the seven prompt benchmarks of HaloGuard 1.0 (OAI, Aegis, Aegis 2.0, ToxicChat, SimpleSafetyTests, HarmBench, WildGuardTest). English response: average over the six benchmarks of Table 10 . Multilingual: PolyGuardPrompts, 17 languages. – marks a task the model does not perform or a score no source reports. Bold marks the best score per column; in the English response column HaloGuard 2.0-0.8B leads at two decimals (83.63 against 83.57 for Qwen3Guard-Gen-4B and -8B, Table 10 ) with 5–10

\times

fewer parameters. English baselines as reported in Sangameswaran et al. [1] and the Qwen3Guard report [ 3 ] (Tables 2, 3 and 11; Qwen3Guard in strict mode). Multilingual baselines as reported in the PolyGuard paper [ 2 ] (Table 1) and the Qwen3Guard report (Tables 6 and 15), which agree to within 0.1 where they overlap. ‡ Mean of the seven per-benchmark scores reported by Calvi et al. [4] (Figure 5); that paper’s scores for WildGuard, LlamaGuard4 and Qwen3Guard-8B on the same benchmarks are within 0.5 of the values above. § PolyGuard F1 as reported by Calvi et al. [4] (Figure 5) on its own 29,240-sample split, with Qwen3Guard averaged over its strict and loose modes, so indicative only ( Section 6.3 ). On prompts, PolyGuard-Qwen is the only model scored under both protocols, and the two differ by 1.2 (85.9 against 87.1); on responses, five models overlap ( Section 6.3 ).

Model	Size	HarmB	SafeRLHF	BeaverTails	XSTest-R	Aegis 2.0	WildG	Avg .
LlamaGuard3 †	8B	84.5	45.2	67.9	89.8	66.1	69.5	70.50
LlamaGuard4 †	12B	83.3	42.5	68.6	88.9	63.7	66.4	68.90
WildGuard †	7B	86.3	64.2	84.4	94.7	83.2	75.4	81.37
ShieldGemma †	9B	60.4	44.2	62.4	86.3	70.8	49.9	62.33
ShieldGemma †	27B	62.9	52.6	67.6	83.0	74.9	52.4	65.57
NemoGuard †	8B	81.4	57.6	78.5	86.2	87.6	77.5	78.13

Table 10: Response-harmfulness F1 on six English benchmarks. HaloGuard 2.0 is scored by its streaming verdict under one global decision rule; the released model’s held-out average is 83.3. The base guard is shown at its own best global rule. Best score per column in bold. The Avg. column is given to two decimals because the top three averages are within 0.06: HaloGuard 2.0-0.8B (83.63, 0.8B) and Qwen3Guard-Gen-4B and -8B (83.57). Baseline averages are the mean of the reported per-benchmark scores. † As reported by Qwen Team [3] (Qwen3Guard models in strict mode). ‡ As reported by Calvi et al. [4] . Qwen3Guard’s Think column is not part of our suite.

	Base guard (Phase 1)		HaloGuard 2.0-0.8B
Benchmark	FPR $\downarrow$	FNR $\downarrow$	FPR $\downarrow$	FNR $\downarrow$
HarmB	0.0	15.5	0.0	7.0
SafeRLHF	28.5	31.2	17.7	21.1
BeaverTails	26.0	32.5	18.3	19.4
XSTest-R	14.1	14.1	5.4	6.4
Aegis 2.0	27.7	23.9	27.0	7.9

Table 11: FPR and FNR (%) per benchmark for the base guard and the released HaloGuard 2.0-0.8B, each under its own decision rule (base guard:

\max_{t}p_{t}\geq 0.91

or three consecutive

p_{t}\geq 0.86

). Pooled rates for both are in Table 14 .

Figure 4: F1 per benchmark, base guard vs. HaloGuard 2.0-0.8B, with the change above each pair. The largest gains are on the two benchmarks dominated by safe responses, XSTest-R and WildG.

Model	Size	OAI	Aegis	Aegis 2.0	ToxiC	SimpST	HarmB	WildG	Avg.
LlamaGuard4	12B	73.5	67.8	70.6	51.3	98.0	97.2	73.0	75.9
WildGuard	7B	72.1	89.4	80.7	70.8	99.5	98.9	88.9	85.8
ShieldGemma	27B	80.5	69.0	71.6	72.9	84.4	57.3	54.3	70.0
NemoGuard	8B	81.0	81.4	86.8	75.6	98.5	75.2	81.6	82.9
PolyGuard-Qwen	7B	74.1	90.3	86.3	71.5	100.0	98.7	88.1	87.0
Qwen3Guard-Gen	0.6B	66.5	90.8	85.0	65.1	99.0	98.7	87.7	84.7

Table 12: Prompt harmfulness (F1) of the input guard, HaloGuard 1.0, across seven safety benchmarks: OpenAI Moderation (OAI), Aegis, Aegis 2.0, ToxicChat (ToxiC), SimpleSafetyTests (SimpST), HarmB and WildG. All values as reported in Sangameswaran et al. [1] (Table 14). Best per column in bold.

Figure 5: Smaller model, higher average. Response F1 against model size (log scale). (a) Average over the six English benchmarks of Table 10 ; HaloGuard 2.0-0.8B has the highest average (83.63, against 83.57 for Qwen3Guard-Gen-4B and -8B) at 5–10

\times

smaller size, and is the highest-scoring streaming guard. Hollow markers are streaming guards. (b) PolyGuardPrompts response F1 ( Section 6.3 ); baselines on the same labels as reported by Kumar et al. [2] and Qwen Team [3] . The dashed line is the Pareto frontier: no model is both smaller and more accurate than a model on it.

Model	Size	Response F1
Same response labels
ShieldGemma b	9B	46.8
MD-Judge [ 27 ] a	7B	49.12
ShieldGemma b	27B	50.4
LlamaGuard4 b	12B	53.4
WildGuard b	7B	63.5

Table 13: PolyGuardPrompts response harmfulness F1 (17 languages), sorted by score. Upper block: same response labels as HaloGuard 2.0-Poly-0.8B; a as reported in the PolyGuard paper [ 2 ] (Table 1), b as reported in the Qwen3Guard report [ 3 ] (Tables 6 and 15; Qwen3Guard at its reported mode). Scores are given at the precision each source reports. § Lower block: PolyGuard scores as reported by Calvi et al. [4] (Figure 5, response panel) for models with no same-label score, on 29,240 samples, so these rows are indicative only.

	English (6 benchmarks, 12,347)		Multilingual (PolyGuardPrompts, 29,053)
Metric	Base guard	HaloGuard 2.0-0.8B	Base guard	HaloGuard 2.0-Poly-0.8B
Macro F1 $\uparrow$	72.8	83.6	64.9	83.1
Precision $\uparrow$	74.0	84.1	62.4	75.5
Recall $\uparrow$	69.8	80.5	68.3	92.5
FPR $\downarrow$	23.0	14.3	8.3	6.1
FNR $\downarrow$	30.2	19.5	31.7	7.5

Table 14: Operating points of the two released models and their Phase 1 base guards, each at its own decision rule. Macro F1 is averaged over the six benchmarks (English) or the 17 languages (multilingual). Precision, recall, FPR and FNR are pooled over all responses for English and macro-averaged over languages for the multilingual models; PolyGuardPrompts is balanced across languages, so its pooled and macro values differ by at most 0.4.

Language group	FPR $\downarrow$	FNR $\downarrow$	F1 $\uparrow$
English (reference)	4.7	4.6	87.1
CJK	6.0	7.5	83.1
Indic	12.8	22.2	64.2
Arabic-script	6.2	7.4	82.7
European	5.2	5.8	85.5
Southeast Asian	10.0	12.0	73.9

Table 15: HaloGuard 2.0-Poly-0.8B on PolyGuardPrompts by language group (%). Groups follow HaloGuard 1.0 [ 1 ] : CJK is Chinese, Japanese and Korean; Indic is Hindi; Arabic-script is Arabic; Southeast Asian is Thai; European is the remaining ten languages. The macro average over all 17 languages is in Table 14 ; it is not the mean of these six rows.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Language	F1	Language	F1
Spanish	88.4	Chinese	83.5
English	87.1	Japanese	83.4
Italian	86.6	Russian	83.3
Swedish	86.2	Arabic	82.7
French	86.0	Korean	82.5
Polish	85.9	Czech	82.1

Appendix

Table 16: PolyGuardPrompts response F1 of HaloGuard 2.0-Poly-0.8B per language.

Panel of Figure 6 — Figure 6: The continuous red-teaming loop with both guards active. Each successful attack is attributed to the layer that should have stopped it and becomes training data for that guard in the next cycle.

LLM Guardrails

Large language model guardrails detect or constrain harmful outputs, prompt attacks, and unsafe agent actions before they cause harm.

See all 202 papers

HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety
Jul 2, 2026Navaneeth Sangameswaran, Preetham S, Ashmiya LeninLLM Safety Benchmarks Language Model Safety Evaluation
Astroware AI, Delaware, USA · Karunya Institute of Technology and Sciences, Coimbatore, India
SentGuard: Sentence-Level Streaming Guardrails for Large Language Models
Jun 1, 2026Jiaqi Yu, Xin Wang, Yixu Wang +4Language Model Safety Evaluation LLM Guardrails
1Fudan University · 2Shanghai AI Laboratory
Predict, Don't React: Value-Based Safety Forecasting for LLM Streaming
Apr 5, 2026Pride Kavumba, Koki Wataoka, Huy H. Nguyen +2LLM Guardrails LLM Safety Monitoring
SB Intuitions Corp.

Jul 2, 2026J/K move · Enter open · S save

HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety

Navaneeth Sangameswaran, Preetham S, Ashmiya Lenin

Astroware AI, Delaware, USA · Karunya Institute of Technology and Sciences, Coimbatore, India

LLM Safety Benchmarks Language Model Safety Evaluation LLM Guardrails Safety Filtering Adversarial Robustness of Language Models LLM Safety Monitoring

Open paper AskPDF arXiv

We present HaloGuard 1.0, an open-weights implementation of the constitutional-classifier paradigm for input safety. It achieves state-of-the-art performance on English and multilingual prompt-safety benchmarks at roughly one-tenth the model size of current leading open guard models. The safety constitution is the organising structure of the corpus: a natural-language constitution of 46 policies and 2,940 subcategories drives synthetic data generation, with exhaustive one-to-one paired counterfactuals that hold topic and vocabulary fixed while flipping intent, a two-tier harmless design that separately targets boundary and baseline false positives (FPs), and balanced multilingual materialisation across 46 languages that treats language as a surface form appearing on both sides of the boundary rather than as an adversarial signal. Across seven prompt-safety benchmarks, HaloGuard 1.0-0.8B attains the best average F1 (90.9) of any open guard we evaluate, outperforming baselines up to 27B parameters (over 30 times larger) while holding false-positive rate (FPR) to 4.3 and false-negative rate (FNR) to 9.5. The HaloGuard 1.0-4B variant reaches average F1 of 92.1 and FPR of 3.5, spending its extra capacity on precision rather than recall. A structured adjudication of the remaining failures indicates that most apparent missed-harm cases are benchmark mislabels rather than genuine model misses. An always-on adversarial red-teaming protocol continuously hardens the guard against both content-level and agentic attacks. We release the models as open weights.

Abstract

LLM Guardrails

Explore similar work

HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety

SentGuard: Sentence-Level Streaming Guardrails for Large Language Models

Predict, Don't React: Value-Based Safety Forecasting for LLM Streaming