💻 computer science

GLiNER Guard: Unified Encoder Family for Production LLM Safety and Privacy

GLiNER Guard (GLiGuard) is a unified encoder family that simultaneously performs safety classification and PII detection in a single forward pass, offering a high-throughput, low-latency, and cost-effective alternative to traditional autoregressive moderators for production LLM systems.

Original authors: Bogdan Minko, Sabrina Sadiekh, Evgeniy Kokuykin

Published 2026-05-08

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Bogdan Minko, Sabrina Sadiekh, Evgeniy Kokuykin

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you run a massive, bustling digital city where people (users) chat with giant, super-smart robots (LLMs) to get answers, write stories, or solve problems. Before these conversations reach the big robots, they need to pass through a security checkpoint.

This checkpoint has two very important jobs:

Safety Guard: Stop bad guys from trying to hack the system, trick the robot, or say mean things.
Privacy Guard: Spot and hide personal secrets like credit card numbers, home addresses, or phone numbers before they get leaked.

The Problem: The "Slow Giant" vs. The "Fast Sniffer"

Until now, city planners had to choose between two types of guards, and neither was perfect:

The Slow Giants (Autoregressive Models): These are like giant, highly educated security guards who read every single word of a request carefully, thinking deeply about context. They are incredibly accurate at catching bad stuff, but they are slow and expensive to hire. If you have millions of people trying to enter the city every second, hiring enough of these giants to check everyone would bankrupt the city and cause massive traffic jams.
The Fast Sniffers (Lightweight Encoders): These are like quick, trained dogs that sniff for specific smells (like "toxic words" or "email addresses"). They are fast and cheap, but they are narrow-minded. They might miss a clever trick or fail to spot a complex personal secret because they aren't "thinking" deeply enough.

The Solution: The "Super-Sniffer" (GLiNER Guard)

The authors of this paper, HiveTraceLab, built a new kind of guard called GLiNER Guard (GLiGuard). Think of it as a super-sniffer that can also think like a detective, all in one package.

Instead of hiring a slow giant and a fast sniffer (which requires two separate checks), GLiGuard does both jobs in a single, lightning-fast pass.

Here is how they built it:

The Brain: They took a smart, compact brain (based on a model called GLiNER2) and taught it to look for two things at once: "Is this request dangerous?" and "Does this contain a secret?"
The Variants: They built three versions of this guard for different needs:
1. The Compact Guard (Uni/Bi-Encoder): A tiny, super-fast version designed to handle massive crowds. It's so efficient it can check nearly 200 people per second on a single computer chip, with almost zero delay.
2. The Omni Guard: A slightly larger, smarter version. It's a bit slower than the compact one, but it's better at understanding complex situations and can adapt to new, weird rules without needing to be retrained from scratch.

The Results: Speed Meets Smarts

The paper tested these new guards in a simulated city (using benchmarks like Aegis and StrongReject) and found some impressive things:

Speed: The Compact Guard is a speed demon. On a powerful computer chip (an A100), it processed requests 1.6 times faster than the previous best lightweight guard, while keeping the "tail latency" (the time it takes for the slowest requests) under 1 second.
Accuracy: Even though it's small, it's surprisingly strong. On safety tests, the "Omni" version scored higher than much larger, slower models. It proved you don't need a 20-billion-parameter "giant" to catch most bad actors; a smart, 200-million-parameter "sniffer" does the job just fine for the first line of defense.
Privacy: It didn't just stop bad words; it successfully found personal secrets (like names and addresses) in the text, proving it can replace the need for a separate "privacy scanner."

The Strategy: The "Tiered" City

The paper suggests a smart way to run this city: Use GLiGuard as the main gate.

Because GLiGuard is so fast and cheap, you can put it in front of everyone. It catches the obvious bad guys and hides the obvious secrets instantly.

If GLiGuard is unsure about a request (maybe it's a tricky, long, or multilingual message), it can pass that specific request to a "Slow Giant" (a larger AI model) for a second, deeper look.
This way, you only pay the expensive price for the hard cases, while the fast, cheap guard handles 99% of the traffic.

The New Map (PII-Bench)

To prove their privacy skills, the authors also created a new map called PII-Bench. It's a test specifically designed to see how well a guard can find personal secrets in Russian-language conversations. They found that their new guard was excellent at this, especially when combined with simple rule-checkers (like a spell-checker for phone numbers).

Summary

In short, GLiNER Guard is a practical, all-in-one security guard for AI systems. It solves the old trade-off between speed and safety by offering a model that is fast enough to handle millions of requests but smart enough to catch safety violations and personal secrets in a single glance. It allows companies to keep their AI systems safe and private without breaking the bank or slowing down their users.

Technical Summary: GLiNER Guard (GLiGuard)

Problem Statement

Production Large Language Model (LLM) systems face a critical trade-off between safety moderation quality and operational efficiency. Current state-of-the-art guardrails are predominantly autoregressive models (e.g., LlamaGuard, WildGuard, ShieldGemma). While these models offer high-quality moderation and robustness against adversarial prompts, their inference costs and latencies make "always-on" deployment at scale prohibitively expensive. Conversely, lightweight encoder-based models are significantly faster but typically suffer from narrow scope (e.g., detecting only prompt injection or binary toxicity) and lack the capability to perform structured extraction tasks like Personal Identifiable Information (PII) detection.

Furthermore, production pipelines often rely on fragmented architectures, deploying separate models for safety moderation and PII detection. This separation increases pipeline complexity, maintenance overhead, and cumulative latency. The paper addresses the question: Can a compact, unified encoder provide efficient first-stage protection that combines strong moderation quality with multi-task functionality (safety classification and PII detection) in a single deployable unit?

Methodology

The authors introduce GLiNER Guard (GLiGuard), a unified encoder family built upon the GLiNER2 architecture. Unlike autoregressive guardrails that generate text tokens, GLiGuard performs safety classification and span-level PII extraction in a single forward pass without decoding.

Architecture Variants

The paper proposes three deployment-oriented variants:

Compact Uni-Encoder (147M parameters): Follows the standard GLiNER2 design where input text and schema labels are concatenated and processed with full bidirectional attention. This offers rich text-label interaction but requires re-encoding labels for every request.
Shared-Weight Bi-Encoder (145M parameters): Encodes text and labels separately into a shared embedding space. Crucially, label representations are independent of input text, allowing them to be precomputed and cached. This variant is optimized for scenarios with large, fixed, or tenant-specific policy taxonomies.
GLiNER Guard Omni (209M parameters): Initialized from GLiNER2 Multi rather than trained from scratch. This variant preserves broader general-domain transfer capabilities while adding guardrail-specific supervision, making it suitable for deployments requiring custom schemas or broader task coverage.

Training Strategy

All variants are trained on 467,273 multi-task examples using a 95/5 train/validation split. The training mixture includes up to six simultaneous supervision signals:

Span extraction (NER)
Safety classification
Adversarial attack detection
Harmful-content categorization
Intent recognition
Tone classification

The dataset combines public safety datasets (e.g., Aegis 2.0, WildGuardMix) with internal Russian-language safety data and synthetic PII corpora. Notably, the training mixture is dominated by classification tasks, with span-level PII annotations being less frequent due to data scarcity.

Key Contributions

Unified Guardrail Architecture: The introduction of GLiGuard, a single encoder capable of performing safety classification and PII detection simultaneously, replacing the need for separate moderation and NER stacks.
Optimized Variants for Production: The development of compact uni- and bi-encoder variants specifically tuned for high-throughput serving, including a shared-weight bi-encoder design that supports label caching for scalable deployment.
GLiNER Guard Omni: A larger variant that demonstrates improved transfer performance and broader generalization while maintaining strong moderation quality.
PII-Bench: The release of a new span-level benchmark for evaluating PII detection in end-to-end pipelines. This benchmark focuses on Russian-language data (due to a lack of public resources) and includes 1,810 human-verified examples across 13 entity types and 9 domains, distinguishing between raw model extraction and full pipeline performance (including rule-based post-processing).
Production-Oriented Evaluation: A comprehensive evaluation covering moderation quality, PII detection, zero-shot generalization, and serving efficiency under realistic load conditions.

Results

Safety Moderation Quality

GLiGuard achieves competitive results on public safety benchmarks (Aegis 2.0, StrongReject, PolyGuard) despite its compact size:

GLiGuard Omni achieves the best overall encoder result with an average F1 of 76.9, outperforming GLiNER2 Multi (66.6) and GLiClass (64.9).
On prompt-level moderation (Aegis 2.0), the compact variants reach 80.2 F1, surpassing LlamaGuard 3 (77.2) and Llama 4 Guard (71.5), and approaching WildGuard (81.5).
On StrongReject, the uni-encoder reaches 98.5 F1 and Omni reaches 99.7 F1.
Parameter Efficiency: All GLiGuard variants lead the comparison set in parameter-normalized efficiency ( $F1_{avg} / \log_2 P$ ), with Omni achieving a score of 2.78.

PII Detection

The paper distinguishes between raw model extraction and full pipeline performance:

Raw Extraction: GLiNER2 Multi and Omni show strong raw extraction capabilities for context-dependent entities like names.
Pipeline Performance: After integrating rule-based components and span merging, the compact GLiGuard variants achieve superior final pipeline results. The uni-encoder reaches 75.7 F1 on NAME extraction, outperforming GLiNER2 Multi (60.6) by 15.1 points. The bi-encoder achieves the strongest ADDRESS result at 68.7 F1.
This demonstrates that the unified model effectively handles the context-dependent entities that rule-based systems miss, while the pipeline handles structured entities.

Serving Efficiency

Evaluated on a single NVIDIA A100 GPU under dynamic batching:

Throughput: The compact models reach 193 requests/sec (ONNX TensorRT) with P99 latency below 1 second.
Comparison: This represents a 1.6× higher throughput than GLiNER2 Multi (122.6 RPS) and significantly outperforms autoregressive moderators (e.g., WildGuard at 1.3 RPS).
Latency: The bi-encoder achieves 0.019 seconds per request, compared to 0.744 seconds for WildGuard.
Stability: GLiGuard maintained a 0% error rate across all tested backends, whereas GLiNER2 Multi exhibited a 12.95% error rate under PyTorch load.

Generalization

Specialization vs. Transfer: The compact uni- and bi-encoders are highly specialized for safety tasks and show poor generalization to non-safety tasks (e.g., 0.08 accuracy on Banking77).
Omni's Transfer: The Omni variant retains significant zero-shot transfer ability from its GLiNER2 Multi initialization, achieving 0.74 accuracy on SST-2 and 0.59 on Banking77, making it suitable for deployments requiring broader schema support.

Significance and Claims

The paper positions GLiNER Guard as a practical middle tier for LLM safety systems. It argues that production environments do not need to choose exclusively between weak, narrow classifiers and expensive, high-latency autoregressive moderators.

Cost-Effective Always-On Moderation: GLiGuard offers a low-cost alternative for "always-on" first-stage filtering, capable of handling high-volume traffic with sub-second latency.
System Simplification: By unifying safety classification and PII detection, it reduces pipeline complexity and operational overhead.
Tiered Architecture: The authors acknowledge that larger autoregressive models still hold advantages in response-level moderation and multilingual reasoning. Consequently, they propose a tiered architecture where GLiGuard handles routine traffic, and uncertain or complex cases are escalated to stronger LLM-based moderators (demonstrated via a cascade strategy that improves F1 while reducing LLM call rates).

The work concludes that unified encoder guardrails are a viable foundation for modern safety systems, balancing speed, cost, and multi-task capability without relying solely on expensive LLM-only solutions.