Technical Summary: HaloGuard 1.0

1. Problem Statement

Large Language Models (LLMs) are transitioning from chat interfaces to agentic workflows, expanding attack surfaces and increasing the cost of safety failures. While existing guardrails exist, they face a critical "False Positive (FP) / False Negative (FN) frontier." The primary challenge is not detecting obviously harmful prompts, but distinguishing between unsafe intent and legitimate use cases that share the same safety-sensitive vocabulary (e.g., educational discussions of weapons, defensive cybersecurity, or historical analysis of violence).

Current open-weight guard models often rely on coarse taxonomies or collected moderation datasets that reflect source labeling policies rather than target deployment policies. This leads to two specific failure modes:

1. Over-refusal (High FPR): Blocking benign prompts that are lexically similar to harmful ones (e.g., blocking a request for "how to make chlorine gas" for a history class).
2. Missed Harm (High FNR): Failing to detect harmful intent hidden behind adversarial framing or in non-English languages where decision boundaries are unbalanced.

Furthermore, many synthetic datasets lack "hard negatives"—benign prompts that are structurally and lexically close to harmful ones but differ only in intent.

2. Methodology

HaloGuard 1.0 introduces a Constitutional Input Classifier approach, shifting from labeling collected data to using a natural language constitution as the generative specification for the entire training distribution.

2.1 The Constitutional Framework

Instead of a flat taxonomy, the system utilizes a hierarchical HaloGuard Constitution comprising:

• 46 Constitutional Policies: 29 harmful and 17 shared-harmless policies.
• 2,940 Subcategories: The atomic unit for data generation and coverage accounting.
• Risk Tiers: Four tiers (Critical, High, Moderate, Sensitive) that dictate the width of the harmless boundary and data composition strategies.

The constitution explicitly defines not only prohibited behaviors but also legitimate adjacent uses (e.g., forensic analysis, victim support, legal review) for every harmful category.

2.2 Synthetic Data Pipeline

The training corpus (1.26M records) is generated synthetically based on the constitution, employing several key mechanisms:

• Paired Counterfactuals: For every harmful subcategory, a 1:1 benign mirror is generated. These pairs hold the topic and harm-adjacent vocabulary fixed while flipping the intent (e.g., from "how to build a bomb" to "historical analysis of the 1995 Tokyo sarin attack"). This forces the model to learn intent rather than keyword shortcuts.
• Two-Tier Harmless Design:
  • Harmless-Boundary Data: Constitution-local safe examples that sit close to specific harmful boundaries (targeting boundary FPs).
  • Shared-Harmless Data: Broadly benign examples (e.g., creative writing, general knowledge) to anchor the model against baseline FPs.
• Style-Anchored Generation: Prompts are generated by anchoring them to real-world registers (from sources like WildGuard, Aegis, and ToxicChat) to prevent the model from learning synthetic artifacts.
• Surface Augmentation: Includes attack-pattern overlays (roleplay, payload splitting) and deterministic transforms (encodings, formatting) applied to both harmful and benign sides to ensure robustness against obfuscation.

2.3 Multilingual Materialization

The pipeline extends to 46 languages across six typological groups. Crucially, it treats language as a surface form rather than an adversarial signal.

• Balanced Generation: Both harmful and benign prompts are translated, ensuring class balance per language.
• Register Preservation: A two-stage process preserves the source register (tone, formality) to prevent the model from associating specific scripts with safety scores.
• Quality Gates: Includes semantic refusal detection (to catch model refusals in translation) and intent-preservation verification.

2.4 Model Architecture

HaloGuard 1.0 is released as two Qwen3.5-based generative classifiers:

• HaloGuard 1.0-0.8B: Optimized for low-latency, inline filtering.
• HaloGuard 1.0-4B: Optimized for higher capacity and better boundary discrimination.
  Both models are trained via autoregressive next-token prediction to emit constitution-attributed labels (e.g., UNSAFE + Cyber) rather than using a fixed classification head.

3. Key Contributions

1. First Open-Weight Constitutional Classifier: Unlike previous Constitutional Classifiers (CCs) which were closed systems, HaloGuard 1.0 is the first deployable, open-weight implementation of the CC paradigm, using a constitution to drive synthetic data generation.
2. Fine-Grained Taxonomy: A 2,940-subcategory taxonomy that serves as the unit of generation, enabling the construction of tight hard negatives and precise failure diagnosis, far exceeding the ~14 flat categories of prior open guards.
3. Boundary-Focused Data Construction: The systematic use of paired counterfactuals and two-tier harmless data specifically targets the FP/FN frontier, separating boundary errors from baseline errors.
4. Balanced Multilingual Coverage: A pipeline that generates balanced harmful/benign data across 46 languages, treating language as a surface form to avoid spurious correlations between script and safety scores.
5. Continuous Hardening: An always-on adversarial red-teaming protocol is integrated to continuously update the guard against content-level and agentic attacks.

4. Results

Evaluated across seven prompt-safety benchmarks (OpenAI Moderation, Aegis, Aegis 2.0, ToxicChat, SimpleSafetyTests, HarmBench, WildGuardTest):

• Performance:
  • HaloGuard 1.0-0.8B: Achieves an average F1 of 90.9, outperforming baselines up to 27B parameters (e.g., ShieldGemma, PolyGuard-Qwen) while using ~30x fewer parameters. It maintains a False Positive Rate (FPR) of 4.3% and False Negative Rate (FNR) of 9.5%.
  • HaloGuard 1.0-4B: Achieves an average F1 of 92.1, with an FPR of 3.5% and FNR of 7.7%, demonstrating improved precision and recall.
• Benchmark Analysis: The models show particular strength on benchmarks involving conversational toxicity and adversarial prompts (ToxicChat, WildGuard), where keyword shortcuts often cause failures in other models.
• De-noised Metrics: After a structured adjudication of benchmark failures, the authors found that 51.5% of apparent False Negatives were actually benchmark mislabels (benign prompts incorrectly labeled as harmful). The de-noised FNR for the 0.8B model drops to 3.1%, suggesting the model's actual missed-harm rate is significantly lower than raw benchmarks indicate.
• Multilingual Performance: The models achieve strong generalization on the PolyGuardPrompts benchmark (86.1 F1 for 0.8B, 88.0 F1 for 4B), though over-refusal (FPR) remains a challenge for Indic and Southeast Asian language groups due to thinner safety coverage in the training data.

5. Significance and Claims

The paper claims that HaloGuard 1.0 establishes a new state-of-the-art point for open-weight input guards, proving that a smaller model (0.8B) can outperform significantly larger baselines (up to 27B) when the training data is constructed around a fine-grained constitutional boundary.

The core significance lies in the shift from keyword detection to intent discrimination. By treating the constitution as a generative specification rather than a static label list, the authors demonstrate that it is possible to construct a dataset that explicitly teaches the model to distinguish between unsafe requests and safe discussions of sensitive topics.

The authors emphasize that the guard is a first-layer defense designed to sit alongside other safety mechanisms (output moderation, tool permissioning, human review). They explicitly state that the current release focuses on input classification and does not yet cover response monitoring or agentic execution traces, positioning the work as a foundational step toward a comprehensive, defense-in-depth safety architecture. The release of the constitution and the synthetic pipeline allows the community to audit, reproduce, and extend the safety boundary, moving beyond "black box" moderation.