PGuard Models

Introduction

PGuard is a native, streaming, and plug-in guardrail built on a frozen foundation model backbone. It leverages the backbone's intermediate representations for token-level safety detection, without altering its original inference pathway or generation behavior.

This release provides EMA, GRU, and Lasttok safety head checkpoints for Qwen backbones, covering text and multimodal safety monitoring.

Available Models

Checkpoints follow the naming convention PGuard-{Head}-{Backbone}:

Backbone	Lasttok	EMA	GRU	Input
Qwen3.5-9B	PGuard-Lasttok-Qwen3.5-9B	PGuard-EMA-Qwen3.5-9B	PGuard-GRU-Qwen3.5-9B	Image-text
Qwen3.5-35B-A3B	PGuard-Lasttok-Qwen3.5-35B-A3B	PGuard-EMA-Qwen3.5-35B-A3B	PGuard-GRU-Qwen3.5-35B-A3B	Image-text
Qwen3.5-122B-A10B	PGuard-Lasttok-Qwen3.5-122B-A10B	PGuard-EMA-Qwen3.5-122B-A10B	PGuard-GRU-Qwen3.5-122B-A10B	Image-text

Head	Modeling	Training version	SGLang variant
Lasttok	Stateless token classification	lasttok	stateless
EMA	Multi-scale causal EMA-attention	ema	seq
GRU	Prompt summarization and recurrent response modeling	gru	cfc

Quick Start

• Training and Offline Inference: Train safety heads or score conversations with a checkpoint and its corresponding backbone.
• SGLang Deployment: Serve PGuard alongside the backbone and return risk scores with generated tokens.

Evaluation

Head	Text queries	Text responses	Multimodal queries	Multimodal responses
PGuard-Lasttok-Qwen3.5-9B	0.822	0.795	0.635	0.644
PGuard-EMA-Qwen3.5-9B	0.836	0.833	0.741	0.772
PGuard-GRU-Qwen3.5-9B	0.836	0.860	0.735	0.798

See the technical report for an overview of evaluation.

Risk Definitions

Risk dimension	Risk categories
Crimes & Illegal Activities	Pornographic Contraband · Drug Crimes · Dangerous Weapons · Property Infringement · Economic Crimes
Hate Speech	Abusive Curses · Defamation · Threats & Intimidation · Cyberbullying
Physical & Mental Health	Personal Safety · Mental Health
Ethics & Morality	Social Ethics · Science & Tech Ethics
Data Privacy	Personal Privacy · Commercial Secret
Cybersecurity	Access Control · Malicious Code · Hacker Attack · Physical Security · Social Engineering, Phishing
Extremism	Violent Terrorist Activities · Social Disruption · Extremist Ideological Trends
Inappropriate Suggestions	Finance · Medicine · Law
Risks Involving Minors	Corruption of Minors · Minor Abuse & Exploitation · Minor Delinquency

Citation

@article{lin2026pguardnativestreamingplugin,
      title={PGuard: A Native, Streaming, and Plug-in Guardrail for Multimodal Large Language Models}, 
      author={Junyu Lin and Mengjie Wu and Yonghao Dong and Yuchuan Fu and Jinfeng Li and Xiaodan Li and Xiaohan Yuan and Yicheng Liu and Yuefeng Chen and Hui Xue and Jingyi Wang and Yitong Yang and Jiyuan Fu and Qiang He},
      year={2026},
      eprint={2611.02791},
      archivePrefix={arXiv},
      primaryClass={cs.CL},
      url={https://arxiv.org/abs/2611.02791}, 
}

Disclaimer

PGuard supports content safety detection and risk governance for language models. Its predictions may include false positives and false negatives. Users should evaluate the models for their intended applications and are responsible for downstream behavior and compliance with applicable requirements. Use the models for research and lawful purposes. The project authors and affiliated organizations accept no liability for losses arising from their use.

License

The PGuard model checkpoints are released under the Apache License 2.0.