HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety

🕒 Published (v1): 2026-07-02 12:21 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

HaloGuard 1.0 is a family of open-weight constitutional input-prompt safety classifiers (0.8B and 4B parameters, built on Qwen3.5) that serve as pre-generation guards for LLM deployments. It is the first open-weight implementation of the Constitutional Classifiers (CC) paradigm, using a 46-policy, 2,940-subcategory safety constitution to drive synthetic data generation and hard-negative construction. The 0.8B variant achieves state-of-the-art average F1 of 90.9 across seven benchmarks, outperforming open guards up to 27B parameters.

Problem

Existing open guard models suffer from four compounding gaps: (1) coarse safety taxonomies (9–14 flat categories) that impede long-tail coverage and failure diagnosis; (2) training distributions that reflect source-dataset labeling policy rather than deployment policy; (3) insufficient benign hard negatives — prompts lexically identical to harmful requests but differing only in intent — causing excessive over-refusal; and (4) multilingual datasets that treat language/script as an adversarial signal rather than a balanced surface form, introducing spurious correlations. Constitutional Classifiers (Sharma et al., 2025) addressed some of these via natural-language constitutions but were never released as open weights.

Method

HaloGuard 1.0 treats the safety constitution as the organizing structure of the training corpus rather than a post-hoc label taxonomy. The pipeline proceeds as follows:

1. Constitution definition: 46 top-level constitutional policies (29 harmful, 17 shared harmless) and 2,940 subcategories form the unit of data generation and coverage accounting; subcategories roll up to 490 categories and \(K=75\) composite verdict–category labels used as generation targets.

2. Synthetic data pipeline: Style-anchored generation produces harmful examples grounded in real corpus registers. For every harmful subcategory a paired counterfactual (benign mirror) is synthesized that preserves topic and harm-adjacent vocabulary while flipping only user intent or framing — directly targeting the keyword-shortcut failure mode. Harmless data is decomposed into boundary hard negatives (constitution-local) and shared harmless baseline examples, each targeting a distinct FP mode. Quality control uses an iterative regenerate-then-audit loop with length-band drift control, source stratification, and direction-of-intent gating.

3. Multilingual materialization: Class-balanced expansion across 46 languages, treating language as a surface form that appears on both sides of the safe/unsafe boundary.

4. Model architecture: Decoder-based generative classifiers (Qwen3.5 backbone) that emit a composite safety verdict and constitution category via \(\ell^*(x) = \arg\max_{\ell \in L} p_\theta(\ell \mid x)\), collapsing to a binary verdict \(y(x) \in \{\text{SAFE}, \text{UNSAFE}\}\) for downstream use. Constitution-attributed output is also returned: \(\text{Output}(x) = (\hat{y}, \hat{c}, s_{\hat{c}}, C)\).

5. Continuous red-teaming: Rolling adversarial protocol covering both content-level and agentic attack modes.

Key Contributions

• First open-weight, deployable implementation of the Constitutional Classifiers paradigm for input-prompt safety.
• A fine-grained safety constitution with 46 policies and 2,940 subcategories used as the generative specification of the training distribution (>2 orders of magnitude finer than prior open guards' 9–14 categories).
• A boundary-focused synthetic data pipeline centered on exhaustive paired counterfactuals, decomposed harmless hard-negative sets, and a quality-control audit loop.
• Class-balanced multilingual materialization across 46 languages that avoids treating language as an adversarial signal.
• A continuously refreshed adversarial red-teaming protocol that explicitly covers agentic attack surfaces.
• Open release of model weights, enabling auditable and policy-adaptable deployment.

Results

• HaloGuard 1.0-0.8B: average F1 = 90.9, FPR = 4.3, FNR = 9.5 across seven benchmarks — best average F1 among evaluated open guards, including models up to 27B parameters (>30× larger).
• HaloGuard 1.0-4B: average F1 = 92.0, FPR = 3.5; extra capacity is spent on improved precision rather than recall.
• Evaluated on: OpenAI Moderation (OAI), Aegis, Aegis 2.0, ToxicChat, SimpleSafetyTests, HarmBench, WildGuardTest.
• Baselines compared: LlamaGuard4, WildGuard, ShieldGemma, NemoGuard, PolyGuard-Qwen, Qwen3Guard-Gen.
• Structured adjudication of remaining failures indicates most apparent missed-harm cases are benchmark mislabels rather than genuine model errors.

Limitations

• Input-only scope: HaloGuard 1.0 covers pre-generation input classification only; response classification and streaming output moderation are not yet implemented.
• Synthetic distribution gap: Despite style-anchoring, synthetic training data may still not fully capture real deployment prompt distributions.
• Benchmark label noise: Apparent FN cases are partially attributable to mislabeled benchmark examples rather than model failure, complicating clean evaluation.
• Downstream enforcement not included: The model provides safety signals; actual blocking/routing decisions are left to the application, creating a policy-enforcement gap in the reported system.
• Agentic attack coverage is ongoing: The red-teaming protocol for agentic failure modes is described as continuous and evolving, implying current coverage is incomplete.

Relevance to Agentic AI / LLM Agents

As LLMs are deployed in agentic settings — where a user prompt can trigger tool calls, workflow automation, or access to external APIs — the blast radius of an unsafe prompt grows dramatically: a single jailbreak can now cascade into downstream actions rather than producing only an unsafe text response. HaloGuard 1.0 is explicitly designed for this threat model, positioning itself as a pre-generation input guard in agent pipelines (User Prompt → HaloGuard 1.0 → Gating/Routing → Downstream LLM / Agent) and including agentic attack modes in its continuous red-teaming protocol. Its constitution-attributed output (category + confidence) supports practical agentic safety architectures that need to route flagged prompts to different handlers (block, escalate, or pass to a higher-capacity classifier) rather than applying a single universal enforcement rule. The open-weight release at sub-1B scale makes it tractable to embed directly into latency-sensitive agentic pipelines.