InGuard Released Weights

This repository contains the released guardrail heads for InGuard, an in-pipeline safety framework for text-to-image generation. It does not contain the five base text-to-image models.

For each supported model, the release provides:

• a PE-MLP classifier operating on text-encoder embeddings; and
• a ConvNeXt-Base detector operating on an intermediate latent estimate.

Supported models

Model key	PE-MLP input dimension	Latent channels	Detection step
z-image-turbo	2560	16	3
qwen-image-2512	3584	16	4
hunyuan-image-2_1	3584	64	4
flux2-klein-base-9b	12288	32	4
internvl-u	4096	16	8

Detection step uses zero-based indexing and refers to the default deployed configuration in the InGuard code repository.

Repository layout

.
├── latent_detector/
│   └── <model>/
│       ├── model.pth
│       └── config.json
├── pe_mlp/
│   └── <model>/
│       └── model.pth
└── manifest.json

The PE-MLP checkpoints contain input_dim, hidden_dim, num_layers, and dropout together with model_state_dict; no separate PE-MLP config file is required. Training optimizer states have been removed from all released checkpoints.

Download and verify

git clone https://github.com/Alibaba-AAIG/InGuard.git
cd InGuard
hf download Alibaba-AAIG/InGuard --local-dir weights
pip install -r requirements.txt
python scripts/verify_pipeline.py \
  --model z-image-turbo \
  --stage components \
  --device cpu

Use --stage quick for file and manifest checks. End-to-end generation also requires the corresponding base model and a suitable GPU; see the main InGuard README for complete instructions.

Intended use

These weights are intended for research on generation-time safety screening, prompt-embedding enhancement, and intermediate-latent risk detection with the supported base models.

They are not a standalone image-generation model and must not be treated as a complete content-safety solution. Performance can vary across prompts, languages, model revisions, sampling settings, and content outside the released evaluation distribution. Users remain responsible for downstream validation and compliance with applicable law and platform policy.

Base-model terms

The supported base models are not redistributed here. Download them from their respective providers and comply with their individual licenses and access terms.

License

The InGuard guardrail weights are released under the Apache License 2.0. See LICENSE for details.

Citation

@article{wang2026inguard,
  title   = {InGuard: Towards Generalized Inner Guardrail for
             Safe Text-to-Image Generation},
  author  = {Wang, Zeyu and Li, Xiaodan and Li, Zhiwen and
             Chen, Yuefeng and Xue, Hui},
  journal = {arXiv preprint arXiv:2609.27620},
  year    = {2026},
  doi     = {10.48550/arXiv.2609.27620},
  url     = {https://arxiv.org/abs/2609.27620}
}