Abstract
In many practical LLM deployments, a single guardrail is used for both prompt and response moderation. Prompt moderation operates on fully observed text, whereas streaming response moderation requires safety decisions to be made over partial generations. Existing text-based streaming guardrails commonly frame this output-side problem as boundary detection, training models to identify the earliest prefix at which a response has already become unsafe. In this work, we introduce StreamGuard, a unified model-agnostic streaming guardrail that instead formulates moderation as a forecasting problem: given a partial prefix, the model predicts the expected harmfulness of likely future continuations. We supervise this prediction using Monte Carlo rollouts, which enables early intervention without requiring exact token-level boundary annotations. Across standard safety benchmarks, StreamGuard performs strongly both for input moderation and for streaming output moderation. At the 8B scale, StreamGuard improves aggregated input-moderation F1 from 86.7 to 88.2 and aggregated streaming output-moderation F1 from 80.4 to 81.9 relative to Qwen3Guard-Stream-8B-strict. On the QWENGUARDTEST response_loc streaming benchmark, StreamGuard reaches 97.5 F1, 95.1 recall, and 92.6% on-time intervention, compared to 95.9 F1, 92.1 recall, and 89.9% for Qwen3Guard-Stream-8B-stric, while reducing the miss rate from 7.9% to 4.9%. We further show that forecasting-based supervision transfers effectively across tokenizers and model families: with transferred targets, Gemma3-StreamGuard-1B reaches 81.3 response-moderation F1, 98.2 streaming F1, and a 3.5% miss rate. These results show that strong end-to-end streaming moderation can be obtained without exact boundary labels, and that forecasting future risk is an effective supervision strategy for low-latency safety intervention.
Abstract (translated)
在许多实际的LLM部署中，单一防护栏同时用于输入提示和输出响应的审核。提示审核作用于完全可见的文本，而流式响应审核则需基于部分生成内容做出安全决策。现有基于文本的流式防护栏通常将输出端问题框架为边界检测，训练模型识别响应已变得不安全的最早前缀。本研究提出StreamGuard，一种统一的模型无关流式防护栏，它将审核重新定义为预测问题：给定部分前缀，模型预测未来可能延续内容的预期危害性。我们使用蒙特卡洛推演对该预测进行监督，无需精确的标记级边界标注即可实现早期干预。在标准安全基准测试中，StreamGuard在输入审核和流式输出审核两方面均表现强劲。在8B规模下，相较于Qwen3Guard-Stream-8B-strict，StreamGuard将综合输入审核F1值从86.7提升至88.2，综合流式输出审核F1值从80.4提升至81.9。在QWENGUARDTEST的response_loc流式基准测试中，StreamGuard达到97.5的F1值、95.1的召回率和92.6%的及时干预率，而Qwen3Guard-Stream-8B-strict对应指标为95.9 F1、92.1召回率和89.9%，同时将漏报率从7.9%降至4.9%。我们进一步证明，基于预测的监督能有效跨分词器和模型族迁移：使用迁移目标，Gemma3-StreamGuard-1B达到81.3的响应审核F1值、98.2的流式F1值和3.5%的漏报率。这些结果表明，无需精确边界标签即可获得强大的端到端流式审核能力，且预测未来风险是低延迟安全干预的有效监督策略。
URL
https://arxiv.org/abs/2604.03962
