Technical Summary: DT-Guard

Problem Statement

Large language models (LLMs) deployed in open-world applications require safety guardrails that balance robustness against complex risks with the efficiency needed for low-latency runtime moderation. Existing solutions face a practical trade-off:

• Classification-based guardrails are efficient but often fail on concealed intents, ambiguous semantics, and borderline safety decisions because they compress complex judgments into flat label predictions.
• Reasoning-based guardrails improve judgment quality by generating explicit chain-of-thought (CoT) traces but introduce significant token-generation overhead and inference latency, making them unsuitable for high-throughput industrial systems.

There is a need for a paradigm that leverages the quality improvements of reasoning supervision during training while maintaining the efficiency of reasoning-free inference during deployment.

Methodology

The authors propose DT-Guard, a content safety guardrail model based on a Reasoning-Active Training, Reasoning-Free Inference paradigm. The core idea is to use reasoning trajectories as supervision signals during training but emit only structured safety labels at inference time.

1. Intent-Driven Safety Framework

DT-Guard formulates safety judgment as a progressive decision process: Intent → Category → Safety.

• Intent: Identifies the underlying interaction motivation (e.g., benign inquiry vs. adversarial attack).
• Category: Attributes relevant risk types.
• Safety: Predicts the final safety level (Safe, Unsafe, or Borderline).
  This structure provides clearer intermediate supervision for difficult cases where surface-level cues are unreliable.

2. Data Construction

The authors constructed an intent-driven safety corpus of 811,897 samples covering both prompt-side (input) and response-side (output) risks.

• Sources: Aggregated from six safety domains (red-teaming, jailbreaks, alignment, toxicity, bias, etc.).
• Processing: A two-stage pipeline involving LLM-based distillation (using GLM-5.1) and multi-round voting with expert verification.
• Annotation: Samples are enriched with CoT, intent labels, risk categories, and safety labels. Borderline cases are explicitly identified to handle ambiguity.
• Balancing: The dataset is balanced across safety levels (Safe:Unsafe:Borderline ≈ 5.5:4:0.5) and risk categories to ensure coverage of both frequent and long-tail risks.

3. Rollout-Guided Progressive Hard-Case Optimization (RG-PHO)

To internalize reasoning without forcing it into inference, DT-Guard employs a three-stage training pipeline:

• Stage 1: Intent-Guided Mixed-Mode SFT. The model learns the Intent → Category → Safety structure using a mix of CoT outputs (for borderline/fine-grained cases) and compact structured labels (for clear cases). This injects reasoning supervision without creating a train-test format mismatch.
• Stage 2: Failure-Driven Hard-Case SFT. Using multi-rollout consistency, the system identifies "persistently failed" samples (where the model fails to predict correctly in all rollouts). These samples undergo targeted supervised correction with CoT to repair systematic failures.
• Stage 3: Rollout-Contrastive Hard-Case DPO. Samples identified as "preference-unstable" (where the model produces both correct and incorrect rollouts) are used to construct chosen-rejected pairs. Direct Preference Optimization (DPO) is applied to calibrate the model's selection behavior, reinforcing correct reasoning paths and safety decisions.

4. Reasoning-Free Inference

At deployment, DT-Guard generates only structured labels (Intent, Category, Safety) without emitting explicit reasoning traces. The reasoning capability is internalized during training, allowing for low-latency discrimination.

Key Contributions

1. DT-Guard Model: A safety guardrail that internalizes complex safety reasoning during training while maintaining reasoning-free inference, effectively decoupling reasoning quality from inference latency.
2. Intent-Driven Framework & Dataset: A structured decision path (Intent → Category → Safety) and a curated dataset of ~812k samples with intent, category, and CoT annotations.
3. RG-PHO Strategy: A progressive optimization method that stratifies hard cases by rollout consistency and applies targeted Hard-Case SFT (for persistent failures) and Hard-Case DPO (for preference instability).
4. Efficiency-Performance Balance: Demonstrates a training path that balances reasoning capability with deployment efficiency, achieving high performance with a smaller model footprint.

Experimental Results

Experiments were conducted on 10 prompt-side and 7 response-side safety benchmarks using a 4B parameter backbone (Qwen3-4B).

• Prompt-Side Performance: DT-Guard achieved an average F1 score of 0.886, outperforming the 8B baseline Qwen3Guard-8B-Gen (0.852) by 3.4 points and YuFeng-XGuard-Reason-8B (0.849).
• Response-Side Performance: DT-Guard achieved an average F1 score of 0.870, surpassing Qwen3Guard-8B-Gen (0.863) and YuFeng-XGuard-Reason-8B (0.841).
• Overall Performance: With only a 4B backbone, DT-Guard reached a dual-side average F1 of 0.878, outperforming strong 8B guardrail baselines.

Ablation Insights:

• Intent Supervision: Adding intent labels improved the prompt-side F1 by 0.8 points.
• CoT Allocation: Full CoT training degraded performance under reasoning-free inference (F1 dropped to 0.828). Selective CoT training (focusing on Borderline samples) yielded the best results (0.860).
• RG-PHO Stages: Hard-Case SFT provided a +1.3 F1 gain, while Hard-Case DPO provided the largest single-stage gain of +2.7 F1.

Significance

The paper claims that DT-Guard validates the hypothesis that reasoning supervision can be effectively internalized during training and converted into efficient safety discrimination at inference time. By separating the reasoning process (used for supervision) from the output format (structured labels), the model achieves the robustness of reasoning-enhanced guards without the latency penalties of generating reasoning traces. This approach allows a 4B model to outperform larger 8B baselines, offering a scalable solution for low-latency safety moderation in real-world applications.