💬 NLP

GLiGuard: Schema-Conditioned Classification for LLM Safeguard

GLiGuard is a compact 0.3B-parameter schema-conditioned bidirectional encoder that achieves competitive safety classification accuracy with significantly lower latency and higher throughput than large autoregressive guard models by encoding task definitions and label semantics directly into the input for simultaneous multi-aspect evaluation.

Original authors: Urchade Zaratiana, Mary Newhauser, George Hurn-Maloney, Ash Lewis

Published 2026-05-11

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Urchade Zaratiana, Mary Newhauser, George Hurn-Maloney, Ash Lewis

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart, very chatty robot (a Large Language Model) that you want to hire to write stories, answer questions, or help with code. But you're worried it might accidentally say something mean, illegal, or dangerous.

Traditionally, to keep this robot in check, companies use a "security guard" that is also a giant, super-complex robot. These guards are like 27-story skyscrapers (7 billion to 27 billion parameters). To check if a message is safe, the guard has to read the message, think about it, and then "speak" its verdict word-by-word, like a slow, cautious librarian checking a book one page at a time. It's accurate, but it's heavy, slow, and expensive to run.

GLiGuard is the paper's new solution. It's a tiny, nimble security guard (only 0.3 billion parameters) that works completely differently.

Here is how GLiGuard works, using simple analogies:

1. The "Menu" Instead of the "Script"

Most security guards are trained to only look for specific things. If you want them to check for "violence" and "hate speech" and "jailbreaks," you usually need to retrain them or run them multiple times.

GLiGuard is different. It comes with a dynamic menu (called a "schema").

The Old Way: You have a guard who only knows how to check for "fire." If you want to check for "floods" later, you have to fire the guard and hire a new one.
The GLiGuard Way: You hand the guard a piece of paper (the schema) that lists exactly what you want to check right now. You can write: "Check for Fire, Flood, and Earthquakes." The guard reads this list, understands the definitions of those words, and checks for all of them simultaneously.

2. The "Group Photo" vs. The "Line"

The Old Way (Autoregressive): Imagine a security guard who has to stand in a single-file line. They look at the first word, then the second, then the third, making a decision as they go. If the message is long, the line gets long, and the wait time gets huge.
The GLiGuard Way (Bidirectional): Imagine the guard takes a group photo of the entire message and the safety rules all at once. Because they can see the beginning, middle, and end of the sentence simultaneously, they understand the context instantly. They don't have to wait for the next word to arrive; they see the whole picture in one flash.

3. The "Swiss Army Knife" Efficiency

The paper claims that while GLiGuard is 23 to 90 times smaller than the giant skyscraper guards, it is just as good at catching bad content.

Speed: Because it doesn't have to "speak" its answer word-by-word, it is 16 times faster (higher throughput) and 17 times lower latency (faster response time).
Versatility: It can check for 14 different types of harm (like violence, privacy leaks, or hate speech) and 11 different types of "jailbreak" tricks (ways people try to trick the AI) all in a single pass.

4. The "Hard Rules"

GLiGuard doesn't just guess; it follows a strict logic flow:

It reads your message and the "menu" of safety rules.
It checks: "Is this prompt safe?" "Is the response safe?" "Did the user try to trick the system?" "Is there hate speech?"
It combines these answers. If any of the specific checks (like "Jailbreak Detected") turn red, the whole message is blocked immediately, regardless of what the general safety check said.

The Bottom Line

The paper argues that you don't need a massive, slow, expensive "super-brain" to act as a safety filter. You can use a compact, smart, and flexible tool that reads the safety rules as part of the input, checks everything in one go, and does it much faster and cheaper than the current industry standards, without losing accuracy.

In short: GLiGuard is like swapping a slow, heavy tank for a fast, agile drone that can change its mission mid-flight just by reading a new set of instructions.

Technical Summary: GLiGuard: Schema-Conditioned Classification for LLM Safeguard

Problem Statement

The widespread deployment of Large Language Models (LLMs) necessitates robust, real-time content moderation systems to prevent the generation of harmful, illegal, or misleading content. Current state-of-the-art guardrail models (e.g., LlamaGuard, ShieldGemma, WildGuard) predominantly rely on autoregressive decoder architectures (7B–27B parameters). These models reformulate safety classification as a sequential text generation task. This design choice introduces fundamental inefficiencies:

High Latency: Generating classification outputs token-by-token scales with output length.
Poor Parallelism: They struggle to evaluate multiple safety dimensions simultaneously.
Resource Intensity: They employ billions of parameters for a task that is fundamentally classification, not generation.

The paper posits that reformulating safety moderation as a schema-conditioned classification problem using a compact bidirectional encoder can achieve competitive accuracy with significantly reduced inference costs.

Methodology

GLiGuard is a 0.3B-parameter schema-conditioned bidirectional encoder, adapted from the GLiNER2 architecture (Zaratiana et al., 2025). Unlike autoregressive guards that treat safety as instruction-following generation, GLiGuard treats it as a multi-aspect classification task where task definitions and label semantics are encoded directly into the input sequence.

1. Schema-Conditioned Architecture

The core innovation is the schema-conditioned input representation. Instead of hard-coding output heads, the model receives a linearized token sequence at inference time comprising:

Schema Prefix: A structured sequence of task definitions ( $\tau_k$ ) and their candidate labels ( $Y_k$ ).
Input Text: The user prompt or model response to be moderated.
Special Tokens: [P] (task delimiter), [L] (label prefix), and [SEP] (schema/text separator).

The input sequence is constructed as:
$z = T(\tau_1, Y_1) \dots T(\tau_K, Y_K) \text{ [SEP] } w_1 \dots w_N$
Where each task block $T(\tau_k, Y_k)$ is serialized as [P] $\phi(\tau_k)$ [L] $l_1$ [L] $l_2$ ...

2. Bidirectional Encoding and Label Extraction

The token sequence is processed by a pretrained bidirectional transformer encoder (e.g., DeBERTa, ModernBERT). Key features include:

Full Self-Attention: The encoder attends bidirectionally to both the schema tokens and the input text. This allows the model to build "label-aware text representations" and "text-aware label representations" simultaneously.
Contextualized Label Embeddings: Hidden states at the positions of the [L] tokens are extracted. These embeddings are informed by the entire input text and all other labels in the schema, providing rich context for classification.
Shared Classification Head: A lightweight, shared two-layer MLP classifier is applied independently to each label embedding to produce logits.
- Single-label tasks (e.g., Safety, Refusal) use Softmax.
- Multi-label tasks (e.g., Harm Categories, Jailbreak Strategies) use Sigmoid.

3. Unified Multi-Task Moderation

GLiGuard supports four distinct moderation tasks, which can be composed into a single schema for a single non-autoregressive forward pass:

Safety Classification: Binary classification (Safe/Unsafe) for prompts and responses.
Refusal Detection: Binary classification (Compliance/Refusal) for responses.
Harm Category Classification: Multi-label classification into 14 fine-grained harm categories (e.g., Violence, PII, Hate).
Jailbreak Strategy Detection: Multi-label classification into 11 adversarial attack strategies (e.g., Prompt Injection, Roleplay Bypass).

4. Inference Pipeline and Decision Rules

The inference pipeline involves schema serialization, a single encoder pass, and parallel decoding. The final safety verdict is determined by hard decision rules that compose predictions from auxiliary tasks:

Prompt Safety: If the Safety classifier predicts Unsafe OR if any Harm Category or Jailbreak Strategy (other than BENIGN) is detected, the verdict is UNSAFE.
Response Safety: If the Safety classifier predicts Unsafe, the verdict is UNSAFE. However, if a Refusal is detected, the verdict is overridden to SAFE (to prevent over-refusal penalties).

Key Contributions

Schema-Conditioned Architecture: Adapting GLiNER2 to moderation, allowing task and label blocks to be composed dynamically at inference time without retraining or prompt redesign.
Unified Multi-Task Framework: A single forward pass that simultaneously evaluates prompt/response safety, 14 harm categories, and 11 jailbreak strategies.
Competitive Accuracy at Small Scale: Demonstrating that a 0.3B encoder can remain competitive with 7B–27B decoder-based guards.
Inference Efficiency: Achieving drastically lower latency and higher throughput due to the non-autoregressive nature of the model.

Experimental Results

The authors evaluated GLiGuard on nine established safety benchmarks (e.g., OpenAI Moderation, Aegis 2.0, HarmBench, WildGuardTest) against six state-of-the-art autoregressive guard models (ranging from 7B to 27B parameters).

Accuracy:
- Prompt Harmfulness: GLiGuard achieved an average F1 of 87.7, within 1.7 points of the best baseline (PolyGuard-Qwen-7B at 89.4) and outperforming several larger models like LlamaGuard4-12B (82.5) and ShieldGemma-27B (69.6).
- Response Harmfulness: GLiGuard achieved an average F1 of 82.7, the second-best among compared models, trailing only Qwen3Guard-8B-Gen (84.1) and outperforming WildGuard-7B (82.4).
Efficiency:
- Throughput: GLiGuard delivered up to 16.2× higher throughput (133 samples/s vs. 8.2 samples/s for a 8B model at batch size 4).
- Latency: GLiGuard achieved up to 17× lower latency (26 ms vs. 426 ms for an 8B model at sequence length 64).
Pareto Efficiency: The model occupies a Pareto-competitive region, offering comparable F1 scores to much larger models with 23–90× fewer parameters.

Significance and Claims

The paper claims that compact bidirectional encoders can approach the accuracy of much larger guard models while drastically reducing inference costs. The authors argue that for content moderation, data quality, training strategy, and model specialization are more critical than scale alone, as evidenced by larger models (e.g., ShieldGemma-27B) underperforming smaller, specialized alternatives.

GLiGuard is presented as a solution for latency- and memory-constrained settings, enabling real-time gatekeeping without the bottlenecks associated with autoregressive generation. The work suggests that reformulating safety as a schema-conditioned classification problem is a viable and efficient alternative to the current paradigm of using large generative models for guardrails.

Note: The paper acknowledges limitations, including sensitivity to surface-level trigger words in benign contexts (false positives) and challenges with adversarial jailbreaks embedded in elaborate fictional narratives (false negatives). Future work is suggested to address these specific robustness issues.