---
license: apache-2.0
library_name: pytorch
tags:
- text-to-image
- safety
- guardrail
- content-moderation
- pytorch
base_model:
- Tongyi-MAI/Z-Image-Turbo
- Qwen/Qwen-Image-2512
- hunyuanvideo-community/HunyuanImage-2.1-Diffusers
- black-forest-labs/FLUX.2-klein-base-9B
- InternVL-U/InternVL-U
---

# InGuard Released Weights

This repository contains the released guardrail heads for
[InGuard](https://github.com/Alibaba-AAIG/InGuard), an in-pipeline safety
framework for text-to-image generation. It does not contain the five base
text-to-image models.

For each supported model, the release provides:

- a PE-MLP classifier operating on text-encoder embeddings; and
- a ConvNeXt-Base detector operating on an intermediate latent estimate.

## Supported models

| Model key | PE-MLP input dimension | Latent channels | Detection step |
|---|---:|---:|---:|
| `z-image-turbo` | 2560 | 16 | 3 |
| `qwen-image-2512` | 3584 | 16 | 4 |
| `hunyuan-image-2_1` | 3584 | 64 | 4 |
| `flux2-klein-base-9b` | 12288 | 32 | 4 |
| `internvl-u` | 4096 | 16 | 8 |

`Detection step` uses zero-based indexing and refers to the default deployed
configuration in the InGuard code repository.

## Repository layout

```text
.
├── latent_detector/
│   └── <model>/
│       ├── model.pth
│       └── config.json
├── pe_mlp/
│   └── <model>/
│       └── model.pth
└── manifest.json
```

The PE-MLP checkpoints contain `input_dim`, `hidden_dim`, `num_layers`, and
`dropout` together with `model_state_dict`; no separate PE-MLP config file is
required. Training optimizer states have been removed from all released
checkpoints.

## Download and verify

```bash
git clone https://github.com/Alibaba-AAIG/InGuard.git
cd InGuard
hf download Alibaba-AAIG/InGuard --local-dir weights
pip install -r requirements.txt
python scripts/verify_pipeline.py \
  --model z-image-turbo \
  --stage components \
  --device cpu
```

Use `--stage quick` for file and manifest checks. End-to-end generation also
requires the corresponding base model and a suitable GPU; see the main
InGuard README for complete instructions.

## Intended use

These weights are intended for research on generation-time safety screening,
prompt-embedding enhancement, and intermediate-latent risk detection with the
supported base models.

They are not a standalone image-generation model and must not be treated as a
complete content-safety solution. Performance can vary across prompts,
languages, model revisions, sampling settings, and content outside the
released evaluation distribution. Users remain responsible for downstream
validation and compliance with applicable law and platform policy.

## Base-model terms

The supported base models are not redistributed here. Download them from their
respective providers and comply with their individual licenses and access
terms.

## License

The InGuard guardrail weights are released under the Apache License 2.0. See
`LICENSE` for details.

## Citation

```bibtex
@article{wang2026inguard,
  title   = {InGuard: Towards Generalized Inner Guardrail for
             Safe Text-to-Image Generation},
  author  = {Wang, Zeyu and Li, Xiaodan and Li, Zhiwen and
             Chen, Yuefeng and Xue, Hui},
  journal = {arXiv preprint arXiv:2609.27620},
  year    = {2026},
  doi     = {10.48550/arXiv.2609.27620},
  url     = {https://arxiv.org/abs/2609.27620}
}
```