mlsanityData to 14 Oct 2026

Qwen3Guard Technical Report

arXiv 2510.14276 ↗First posted 16 Oct 2025cs.CLcited by 155

On the map: LLM safety and security → Safety alignment, refusal and guardrails

Abstract (arXiv)

As large language models (LLMs) become more capable and widely used, ensuring the safety of their outputs is increasingly critical. Existing guardrail models, though useful in static evaluation settings, face two major limitations in real-world applications: (1) they typically output only binary "safe/unsafe" labels, which can be interpreted inconsistently across diverse safety policies, rendering them incapable of accommodating varying safety tolerances across domains; and (2) they require complete model outputs before performing safety checks, making them fundamentally incompatible with streaming LLM inference, thereby preventing timely intervention during generation and increasing exposure to harmful partial outputs. To address these challenges, we present Qwen3Guard, a series of multilingual safety guardrail models with two specialized variants: Generative Qwen3Guard, which casts safety classification as an instruction-following task to enable fine-grained tri-class judgments (safe, controversial, unsafe); and Stream Qwen3Guard, which introduces a token-level classification head for real-time safety monitoring during incremental text generation. Both variants are available in three sizes (0.6B, 4B, and 8B parameters) and support up to 119 languages and dialects, providing comprehensive, scalable, and low-latency safety moderation for global LLM deployments. Evaluated across English, Chinese, and multilingual benchmarks, Qwen3Guard achieves state-of-the-art performance in both prompt and response safety classification. All models are released under the Apache 2.0 license for public use.

Key facts. Cited by 155 papers in the map (data through 14 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 42 of its 50 references that are in the map. First posted on arXiv 16 Oct 2025.

Builds on

42 of 50 references.

Closest ancestors · 9

Same direction, newest first

  1. 2025CARE: Decoding Time Safety Alignment via Rollback and Introspection Intervention1 Sep
  2. 2025From Judgment to Interference: Early Stopping LLM Harmful Outputs via Streaming Content Monitoring11 Jun
  3. 2025OMNIGUARD: An Efficient Approach for AI Safety Moderation Across Languages and Modalities29 May
  4. 2025X-Guard: Multilingual Guard Agent for Content Moderation11 Apr
  5. 2025Enhancing LLM Safety Through a Theoretical Minimax Game Lens7 Feb
  6. 2025GuardReasoner: Towards Reasoning-based LLM Safeguards30 Jan
  7. 2025Aegis2.0: A Diverse AI Safety Dataset and Risks Taxonomy for Alignment of LLM Guardrails15 Jan
  8. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs26 Jun
  9. 2024PKU-SafeRLHF: Towards Multi-Level Safety Alignment for LLMs with Human Preference20 Jun

Other references · 33

  1. 2025Qwen3 Technical Reportcited by 8,820
  2. 2024Qwen2.5 Technical Reportcited by 4,942
  3. 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,796
  4. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  5. 2023Qwen Technical Reportcited by 3,344
  6. 2023GPQA: A Graduate-Level Google-Proof Q&A Benchmarkcited by 2,879
  7. 2022Self-Instruct: Aligning Language Models with Self-Generated Instructionscited by 2,724
  8. 2024LiveCodeBench: Holistic and Contamination Free Evaluation of Large Language Models for Codecited by 2,004
  9. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  10. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  11. 2024Qwen2.5-Coder Technical Reportcited by 1,203
  12. 2024DeepSeek-V2: A Strong, Economical, and Efficient Mixture-of-Experts Language Modelcited by 1,135
21 more
  1. 2024Qwen2.5-Math Technical Report: Toward Mathematical Expert Model via Self-Improvementcited by 1,090
  2. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
  3. 2025Group Sequence Policy Optimizationcited by 835
  4. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  5. 2024From Crowdsourced Data to High-Quality Benchmarks: Arena-Hard and BenchBuilder Pipelinecited by 500
  6. 2025The Lessons of Developing Process Reward Models in Mathematical Reasoningcited by 415
  7. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 356
  8. 2024ShieldGemma: Generative AI Content Moderation Based on Gemmacited by 243
  9. 2023ToxicChat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User-AI Conversationcited by 231
  10. 2024WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Modelscited by 223
  11. 2025Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teamingcited by 181
  12. 2025Qwen2.5-1M Technical Reportcited by 164
  13. 2024AEGIS: Online Adaptive AI Content Safety Moderation with Ensemble of LLM Expertscited by 136
  14. 2023SimpleSafetyTests: a Test Suite for Identifying Critical Safety Risks in Large Language Modelscited by 76
  15. 2025PolyGuard: A Multilingual Safety Moderation Tool for 17 Languagescited by 59
  16. 2024ShieldLM: Empowering LLMs as Aligned, Customizable and Explainable Safety Detectorscited by 51
  17. 2024RTP-LX: Can LLMs Evaluate Toxicity in Multilingual Scenarios?cited by 36
  18. 2024MLLMGuard: A Multi-dimensional Safety Evaluation Suite for Multimodal Large Language Modelscited by 34
  19. 2024Safety-Aware Fine-Tuning of Large Language Modelscited by 34
  20. 2025WorldPM: Scaling Human Preference Modelingcited by 13
  21. 2025SecurityLingua: Efficient Defense of LLM Jailbreak Attacks via Security-Aware Prompt Compressioncited by 13

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 9; 2026: 146.

155 papers.

Sort:

By area:

  1. 2026ATBench: A Diverse and Realistic Agent Trajectory Benchmark for Safety Evaluation and Diagnosiscited by 36
  2. 2026OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMscited by 21
  3. 2026YuFeng-XGuard: A Reasoning-Centric, Interpretable, and Flexible Guardrail Model for Large Language Modelscited by 19
  4. 2026AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agentscited by 18
  5. 2026Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agentscited by 14
  6. 2025GateBreaker: Gate-Guided Attacks on Mixture-of-Expert LLMscited by 11
  7. 2026When Safety Collides: Resolving Multi-Category Harmful Conflicts in Text-to-Image Diffusion via Adaptive Safety Guidancecited by 11
  8. 2026SafePro: Evaluating the Safety of Professional-Level AI Agentscited by 10
  9. 2026TAME: A Trustworthy Test-Time Evolution of Agent Memory with Systematic Benchmarkingcited by 10
  10. 2026ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correctioncited by 10
  11. 2026Learning When to Act or Refuse: Guarding Agentic Reasoning Models for Safe Multi-Step Tool Usecited by 8
  12. 2026MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safetycited by 8
38 more
  1. 2026On-Policy Self-Evolution via Failure Trajectories for Agentic Safety Alignmentcited by 8
  2. 2026AgentDoG 1.5: A Lightweight and Scalable Alignment Framework for AI Agent Safety and Securitycited by 8
  3. 2025The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Searchcited by 7
  4. 2026What Matters For Safety Alignment?cited by 7
  5. 2026Safety Testing LLM Agents at Scale: From Risk Discovery to Evidence-Grounded Verificationcited by 7
  6. 2026Multilingual Safety Alignment Via Sparse Weight Editingcited by 6
  7. 2026Benchmarks for Trajectory Safety Evaluation and Diagnosis in OpenClaw and Codex: ATBench-Claw and ATBench-Codexcited by 6
  8. 2026RouteHijack: Routing-Aware Attack on Mixture-of-Experts LLMscited by 6
  9. 2026From Chatbot to Digital Colleague: The Paradigm Shift Toward Persistent Autonomous AIcited by 6
  10. 2026SingGuard: A Policy-Adaptive Multimodal LLM Guardrail with Dynamic Reasoningcited by 6
  11. 2026DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protectioncited by 6
  12. 2026StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancingcited by 6
  13. 2026LPG: Balancing Efficiency and Policy Reasoning in Latent Policy Guardrailscited by 5
  14. 2025GuardTrace-VL: Detecting Unsafe Multimodel Reasoning via Iterative Safety Supervisioncited by 4
  15. 2026Expected Harm: Rethinking Safety Evaluation of (Mis)Aligned LLMscited by 4
  16. 2026NExT-Guard: Training-Free Streaming Safeguard without Token-Level Labelscited by 4
  17. 2026EvoDefense: Co-Evolving Black-Box Defense with Large Language Modelscited by 4
  18. 2026BraveGuard: From Open-World Threats to Safer Computer-Use Agentscited by 4
  19. 2025OpenGuardrails: A Configurable, Unified, and Scalable Guardrails Platform for Large Language Modelscited by 3
  20. 2025The Trojan Example: Jailbreaking LLMs through Template Filling and Unsafety Reasoningcited by 3
  21. 2026PII-VisBench: Evaluating Personally Identifiable Information Safety in Vision Language Models Along a Continuum of Visibilitycited by 3
  22. 2026Why Does the LLM Stop Computing: An Empirical Study of User-Reported Failures in Open-Source LLMscited by 3
  23. 2026LLMs Can Unlearn Refusal with Only 1,000 Benign Samplescited by 3
  24. 2026Semantic Consensus Decoding: Backdoor Defense for Verilog Code Generationcited by 3
  25. 2026Safety Recovery in Reasoning Models Is Only a Few Early Steering Steps Awaycited by 3
  26. 2026Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systemscited by 3
  27. 2026Preference Redirection via Attention Concentration: An Attack on Computer Use Agentscited by 3
  28. 2026Not All Turns Matter: Credit Assignment for Multi-Turn Jailbreakingcited by 3
  29. 2026Internalizing Safety Understanding in Large Reasoning Models via Verificationcited by 3
  30. 2026MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attackscited by 3
  31. 2026PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediationcited by 3
  32. 2026SafeMCP: Proactive Power Regulation for LLM Agent Defense via Environment-Grounded Look-Ahead Reasoningcited by 3
  33. 2026Do Thinking Tokens Help with Safety?cited by 3
  34. 2026K-EXAONE Technical Reportcited by 2
  35. 2026Lingua-SafetyBench: A Benchmark for Safety Evaluation of Multilingual Vision-Language Modelscited by 2
  36. 2026Bielik Guard: Efficient Polish Language Safety Classifiers for LLM Content Moderationcited by 2
  37. 2026When the Prompt Becomes Visual: Vision-Centric Jailbreak Attacks for Large Image Editing Modelscited by 2
  38. 2026Mitigating the Safety-utility Trade-off in LLM Alignment via Adaptive Safe Context Learningcited by 2

50 most cited of 155 All 155 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025The Problem with Safety Classification is not just the Models
  2. 2025Evaluating the Robustness of Large Language Model Safety Guardrails Against Adversarial Attacks
  3. 2025MrGuard: A Multilingual Reasoning Guardrail for Universal LLM Safety
  4. 2026CHILLGuard: Towards Fine-Grained Chinese LLM Safety Guardrail with Scalable Data Construction and Model-aware Preference Alignment
  5. 2025Auto-Tuning Safety Guardrails for Black-Box Large Language Models
  6. 2026ProbGuard: Calibrated Safety Risk Estimation from LLM Output Distributions
  7. 2024Lightweight Safety Guardrails Using Fine-tuned BERT Embeddings
  8. 2024Benchmarking LLM Guardrails in Handling Multilingual Toxicity