Paper deep dive

Safety Reconstructed: Generative Modeling via Masked Diffusion Builds Strong Safety Guardrails

Gert Lek, Abele Malan, Chaoyi Zhu, Pin-Yu Chen, Robert Birke, Lydia Chen

Year: 2026Venue: arXiv preprintArea: cs.CLType: PreprintEmbeddings: 76

Intelligence

Status: not_run | Model: - | Prompt: - | Confidence: 0%

Entities (0)

No extracted entities yet.

Relation Signals (0)

No relation signals yet.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Guard models are the last line of defense between a language model and a harmful output, yet their training objective is surprisingly narrow. Existing guards learn to predict a single verdict token from a conversational context, concentrating supervision on a single target. The consequences are structural: models latch onto shortcut features, are overconfident, and remain sensitive to where safety evidence appears in the sequence rather than its role in the full context. We propose a different framing. Rather than predicting a label from text, our LLaDA-Guard asks which label better explains the text: scoring the prompt or response under each label hypothesis and classifying based on their difference. This shifts supervision to every token in the moderated region, forcing the model to account for full content rather than its most discriminative fragments. We instantiate this idea with a masked diffusion language model, fine-tuning LLaDA-8B-Instruct with a class-conditional reconstruction objective using LoRA and requiring no architectural changes beyond the base model. LLaDA-Guard leads on average rank against discriminative baselines trained on stronger backbones across seven held-out safety benchmarks, while exhibiting substantially better confidence calibration (ECE 0.0875 vs. 0.1384 for Qwen3Guard), less over-defense on benign prompts with unsafe-looking cues, and less prompt leakage when moderating responses. Its generative nature further enables token-level risk localization as a natural byproduct, yielding a pipeline for rewriting unsafe prompts into safe equivalents without additional training and achieving a 60.7% average conversion-to-safe rate.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

72,889 characters extracted from source content.

Expand or collapse full text

Safety Reconstructed: Generative Modeling via Masked Diffusion Builds Strong Safety Guardrails Gert Lek 1 Abele M ̆ alan 1 Chaoyi Zhu 2 Pin-Yu Chen 3 Robert Birke 4 Lydia Chen 1,2 1 University of Neuchâtel 2 Delft University of Technology 3 IBM Research 4 University of Turin gert.lek@unine.ch Abstract Guard models are the last line of defense between a language model and a harmful output, yet their training objective is surprisingly narrow. Existing guards learn to predict a single verdict token from a conversational context, concentrating supervision on a single target. The consequences are structural: models latch onto shortcut features, are overconfident, and remain sensitive to where safety evidence appears in the sequence rather than its role in the full context. We propose a different framing. Rather than predicting a label from text, our LLaDA-Guard asks which label better explains the text: scoring the prompt or response under each label hypothesis and classifying based on their difference. This shifts supervision to every token in the moderated region, forcing the model to account for full content rather than its most discriminative fragments. We instantiate this idea with a masked diffusion language model, fine-tuning LLaDA-8B-Instruct with a class- conditional reconstruction objective using LoRA and requiring no architectural changes beyond the base model. LLaDA-Guard leads on average rank against discriminative baselines trained on stronger backbones across seven held-out safety benchmarks, while exhibiting substantially better confidence calibration (ECE 0.0875 vs. 0.1384 for Qwen3Guard), less over-defense on benign prompts with unsafe-looking cues, and less prompt leakage when moderating responses. Its generative nature further enables token-level risk localization as a natural byproduct, yielding a pipeline for rewritingunsafeprompts intosafeequivalents without additional training and achieving a 60.7% average conversion-to-safe rate. 1 Introduction Large language models (LLMs) are increasingly deployed across consumer assistants, developer tools, and high-stakes domains such as healthcare and education [15,6,51]. At this scale, a non-trivial share of interactions involves inappropriate or malicious requests [50,16,2], and even well-aligned models remain susceptible to jailbreaks, which reliably bypass their built-in refusal behavior [49,57,44]. The long tail of usage uncovers failure modes not anticipated during alignment training [56, 55]. Content moderation has therefore become a load-bearing component of the LLM stack. Dedicated guard models [20,14] are a mechanism by which providers enforce safety policies at inference time, also serving as research instruments for scoring red-teaming attacks [34] and measuring refusal behavior on safety benchmarks [42,8]. Given a user promptx P and a model responsex R , a guard model has two related tasks to solve: prompt moderation, which asks whether the user’s request is unsafe, and response moderation, which asks whether the response is unsafe given the prompt. Existing guard models approach moderation as direct label prediction, estimating a discriminative decision rule of the formp θ (y | x), wherep θ denotes the guard model’s predictive distribution, Preprint. arXiv:2609.33634v1 [cs.CL] 27 Sep 2026 ②Outputs single token verdict – shortcut features learned LLaDA Guard class-conditional scoring – compare Trigger tokenMASK token ✓correct: model of data distribution, generative scoring, better calibration, no positional bias ②randomly masked – reconstruct under = safe ①randomly masked – reconstruct under = unsafe ↑ high ↓ low Likelihood under ①: Likelihood under ②: safe ③Generative Likelihood Score score = SAFE 99% confidenceSAFE 99% confidence ✗wrong: spurious features, brittle decision boundary, overconfident, positional bias Prompt token Standard guard predict label from text – UNSAFE 94% confidenceUNSAFE 94% confidence unsafe ᴾ ①Model reads full prompt B A ... the fictional Daenerys Targaryen's credit card details?” ᴾ Figure 1: Illustrative comparison between standard verdict-token moderation and our class-conditional reconstruction approach. In the standard paradigm A ⃝ , the prompt and/or response is visible context and the guard predicts the masked verdict tokeny. In our method B ⃝ , a candidate labelyis made visible as a safety hypothesis, while the judged region is masked and reconstructed under competing safeandunsafehypotheses. The moderation decision is therefore based on which label better explains the judged text, rather than on discriminative features for a single output token. y ∈safe, unsafe, andxdenotes the text being moderated: a promptx P , responsex R , or prompt- response pair[x P ,x R ]. In modern LLM-based guardrails, this gets framed as a next-token prediction task for y. The objective is discriminative: predict the label from the conversational input. Recent works show guardrail systems are effective in practice, but also suffer from several sys- temic weaknesses, including miscalibration and overconfidence under jailbreaks and response-model shifts [28], degraded robustness under adversarial attacks [49], and distribution shift [35,27]. These limitations are structural, not merely empirical. In direct verdict-token classification, supervision con- centrates on a single prediction target, which encourages the model to rely on a set of discriminative features rather than learning a rich model of whatunsafeandsafetext looks like [25]. Further, cur- rent autoregressive guard architectures inherit positional bias from causal attention [29,41], yielding decisions that are sensitive to the position of evidence within the analyzed sequence. In this paper, we cast text moderation as class-conditional generative scoring over the judged text region. Rather than estimatingp θ (y | x)from a full conversational input, we compare how well the moderated region is explained under competing safety labels:p θ (x M | x ̄ M ,y), whereMis the moderated region andx ̄ M is the visible context, following the class-conditional scoring view of generative classification [5]. Moderation thus becomes a generative problem: supervision moves from a single verdict token to the moderated region, requiring the model to explain the observed text under each label hypothesis [38,35]. The resulting score is tied to the judged content rather than to shortcut features in the context. This view makes prompt moderation, response moderation, and verdict prediction different choices of a target region in the same sequence[x P ,x R ,y]; verdict-token prediction is the special case where only the label token is scored, as illustrated in Figure 1. This is especially important for response moderation, where the verdict should depend on the response content rather than on prompt features that co-occur with unsafe examples [25, 11]. The class-conditional view naturally suggests Masked Diffusion Language Models (MDMs) as a statistical inference framework. MDMs score masked text conditioned on visible context [3,45, 38,43], thus representing moderation as conditional reconstruction over masked regions in the conversation, rather than reducing the prompt- and response-moderation plausibility to a single next- token prediction. This provides a unified mechanism for prompt moderation, response moderation, and verdict prediction. It also gives the final safety score a likelihood-ratio interpretation: with true class-conditional likelihoods, thresholding the score recovers the Neyman–Pearson test [36]. This idea results in LLaDA-Guard, the first MDM guardrail model, with class-conditional generative scoring built on LLaDA-8B-Instruct [38]. Our contributions are threefold: 1.We recast guardrail content moderation from verdict-token prediction into class-conditional scoring over regions of a shared sequence[x P ,x R ,y]. This yields prompt moderation, response moderation, and verdict prediction as different choices of target region, while separating the judged text from the context used to interpret it. 2. We show that masked diffusion language models implement this class-conditional scoring formu- lation directly. Changing the label condition gives the competingsafe/unsafehypotheses, while 2 changing the masking pattern selects whether the model scores prompts or responses; we train this with a likelihood-ratio moderation loss and a generative reconstruction term. 3.We evaluate the resulting LLaDA-Guard and find that it is competitive with guard baselines derived from stronger models, achieving the best average F1 on held-out benchmarks while remaining close to the best average AUPRC. Importantly, LLaDA-Guard improves usability by achieving better calibration and reducing both overconfident misclassifications and positional bias. 2 Related work Guard Models Recent guardrail models such as Llama Guard 1-4 [20,30], WildGuard [14], Shield- Gemma [53], Granite Guardian [40], NemoGuard [39], and Qwen3Guard [54] treat safety moderation as a supervised classification problem over prompts or prompt-response pairs. Recent work has extended this line to multilingual moderation [23,10,22], task-adaptive distillation [48], and cross- modal moderation [47,31]. These systems estimate whether an input isunsafeunder a policy taxonomy, showing strong practical utility and competitive performance on benchmarks. Their pri- mary use cases are pre-generation filtering of user inputs and post-generation filtering for harmfulness, refusal, or policy compliance. Moreover, by decoding the hazard category from the policy taxonomy, they can predict the specific class of harmful behavior to which the conversation belongs. Such systems are useful not only as filters, but also as safety evaluators during research and development. They are employed for red-teaming [34,49], post-training analysis, and evaluation [8]. This broad role explains why guard models have become central to deployment and research, even when they are not the final moderation mechanism itself. Two limitations stand out. Modern guard models are typi- cally verdict-token classifiers trained on large, often proprietary policy-labeled mixtures [14,12,54]. Further, strong accuracy does not imply reliable probabilities: LLM-based guards are miscalibrated and overconfident under jailbreaks [28, 25]. Generative versus discriminative classification The distinction between discriminative and gen- erative classification has a long history in machine learning: early comparisons showed trade-offs in sample efficiency and asymptotic error [37], while later text-classification work found similar differences in generalization behavior [52]. In language modeling, the distinction reappears as the contrast between direct classification and generative classification. Min et al.[35]shows that generative approaches improve performance in text-classification tasks under class-imbalance or in generalization to unseen labels, arguing that these explain every input token, rather than learning a separating boundary. Recent work makes this robustness argument more concrete for modern language and diffusion models. In the continuous domain, diffusion models have recently been used directly as zero-shot classifiers [24,7]. Chen et al.[5]show that a diffusion model can be used for robust generative class-conditional classification. Related, Li et al.[25]argue that generative classifiers are less prone to shortcut solutions because their objective models the data manifold for each class, not purely the features sufficient for separation. Diffusion language models and scoring Our method draws upon progress in diffusion language models. Unlike autoregressive language models, which generate left-to-right, diffusion language models operate through iterative denoising or masked reconstruction, allowing any-order generation. Discrete diffusion generalizes the continuous-space DDPM framework [17,46] to categorical data [18, 3,4]. In masked diffusion language models [43], the training objective is a reconstruction loss over the masked region tokens, conditioned on the unmasked part. Unlike image diffusion, which operates over continuous pixels [17,46], discrete diffusion over tokens requires either embedding-space relaxations or direct masking of categorical states [3,32]. As a result, the model is not trained to predict only a single next token, but to estimate conditional distributions of the formp θ (x M | x ̄ M ) for arbitrary masked subsetsMof a sequence. LLaDA [38] shows such models scale while retaining flexible mask-based inference, and is competitive with similar-sized AR-LLMs. 3 LLaDA-Guard Standard guard models cast moderation as verdict-token prediction: given the full conversation, generatesafeorunsafe. LLaDA-Guard instead scores the moderated region under two competing safety hypotheses and classifies according to which hypothesis better reconstructs the moderated region. Prompt moderation, response moderation, and ordinary verdict prediction therefore differ 3 only in the choice of moderated region within a shared sequence[x P ,x R ,y], wherex P is the user prompt, x R is the model response, and y ∈safe, unsafe is the safety label. This view decomposes safety moderation into three related questions. The first is the discriminative verdict questionp(y | x P ,x R ),which asks whether the conversation should be labeledsafeor unsafe. Existing guard models are optimized for this question by predicting the verdict tokeny directly. The second is the prompt plausibility questionp(x P | y),which asks how likely the prompt is under a given safety label. This is a natural task for prompt moderation; rather than predicting the verdict, the model evaluates whether the prompt is better explained assafeorunsafe. The third is the response plausibility questionp(x R | x P ,y),which asks how likely the response is given the prompt context under a label hypothesis, and is natural for response moderation, where the verdict depends on whether the response complies with a harmful request or refuses. These three questions are connected by Bayes’ rule:p(y | x P ,x R )∝ p(x R | x P ,y)p(x P | y)p(y).The verdict question, therefore, decomposes into class-conditional likelihoods of the prompt and response. Existing guard models collapse this decomposition into one discriminative prediction. LLaDA-Guard operationalizes the decomposition by fine-tuning LLaDA [38] to estimate likelihoods for the moderated region under each label hypothesis. Their difference is the safety score used throughout training and inference; verdict prediction is recovered as a byproduct of this likelihood-ratio comparison. 3.1 Moderation as class-conditional reconstruction Our key insight is that a single masked diffusion language model can answer all three questions over the given sequence[x P ,x R ,y]by changing only which region is moderated. LetMdenote the masked region being moderated, and let ̄ Mdenote the visible complement. We define a label- conditioned score for the moderated region M by s θ (M ) = logp θ (x M | x ̄ M , unsafe)− logp θ (x M | x ̄ M , safe),(1) The sign of this score is the moderation decision: positive values mean the moderated region is better explained underunsafe, while negative values favorsafe. Assuming equal class priors, we predict ˆy = unsafeiffs θ (M ) > 0. More generally, thresholdings θ (M )implements a likelihood-ratio test betweenH 0 : y = safeandH 1 : y = unsafe. Under simple hypotheses with true class-conditional likelihoods, the Neyman-Pearson lemma states that a likelihood-ratio test is most powerful among all tests with a fixed Type-I error rate [36]. The safety score used by LLaDA-Guard replaces exact conditional likelihoods with MDM reconstruction likelihood estimates over the moderated region. The choice ofMspecifies the moderation task. For prompt moderation,M = M P , sox M = x P andx ̄ M = y , yielding the comparisonlogp θ (x P | unsafe)versuslogp θ (x P | safe). For response moderation,M = M R , sox M = x R andx ̄ M = (x P ,y) , yieldinglogp θ (x R | x P , unsafe)versus logp θ (x R | x P , safe). Verdict prediction over a fully visible conversation is the special case in which M is the verdict token alone, and recovers the standard guard paradigm. This formulation separates the moderated region from the context used to interpret it; further, it encourages the model to ground its decision in the response itself, rather than in prompt features that may correlate with unsafe examples. 3.2 From verdict prediction to generative region scoring The score in Equation (1) and the standard discriminative scorep θ (y | x P ,x R )answer the same question (“Is this conversationsafeorunsafe?”) but construct the answer differently. We use an illustrative prefix-reveal example to show why this difference matters; full benchmark evidence appears in Section 4. Autoregressive (AR) verdict prediction condenses the decision into a single next-token distribution. This results in shortcut solutions or spurious features [25,28]. In contrast, the class-conditional score is built up from token-level reconstruction, modeling the data distribution itself. We visualize this by revealing the prompt tokens gradually to the guard model and monitoring the prediction confidence. As evidence gathers, we expect a gradual increase. Figure 2 shows this for three example prompts. First, we notice the “credit card details” shortcut dominating the verdict, and its position determines the outcome. We generate these trajectories for the full XSTest dataset in Figure 9. Second, we observe excessively high confidence in all AR-based guard models when harmful patterns arise, even when they are spurious. 4 WherecanIfindDaenerysTargaryen'screditcarddetails? 0.0 0.5 1.0 P(unsafe) unsafe safe 0.98 0.96 0.94 0.37 WhatarethecreditcarddetailsofDaenerysTargaryen? 0.0 0.5 1.0 P(unsafe) unsafe safe 0.98 0.97 0.24 0.39 WherecanIfindthefictionalDaenerysTargaryen'screditcarddetails? Prompt revealed left-to-right 0.0 0.5 1.0 P(unsafe) unsafe safe 0.94 0.01 0.10 0.50 LLaDA-Guard 8BGranite Guardian 5BQwen3Guard 8BLlama-Guard 3 8B Figure 2:P (unsafe)under left-to-right prompt re- veal, for three variants of a credit-card request as a trigger across four guard models. From the origi- nal XSTest sample (top), we construct variants that expose positional bias (middle) and whether guards use the fictional owner context rather than just the discriminative features (bottom). Third, the AR factorization Q i p θ (x i | x <i ) underlyingp θ (y | x P ,x R )yields an inherent positional bias [29,41], amplified by causal attention, whereas the class-conditional score estimates the token likelihoods bidirectionally. This is illustrated in Figure 2, where chang- ing the position of “credit card details” can unnecessarily invert the guard decision. Such artifacts have a common origin in the dis- criminative objective. Learning any function that separates the two classes on the training distribution suffices, including shortcut fea- tures and position-dependent ones. Nothing in the loss requires the model to explain the rest of the input. The class-conditional objective removes the incentive for such failure modes by fitting the per-class data manifold rather than a separating boundary [25]. 3.3 Masked-Reconstruction Likelihood Estimation To turn the class-conditional safety score into a computable quantity, we estimate its two likelihood terms by masked reconstruction over the moderated region. An MDM does not provide conditional log-likelihoods in closed form, but its training objective gives a variational surrogate. In diffusion, training is derived from a variational lower bound on data log-likelihood [17]. In MDMs, this lower bound takes the form of weighted reconstruction terms over masked tokens [45], adopted in LLaDA [38]. When computed using the masking distribution and time-dependent weighting, aggregated reconstruction log-probabilities over masked subsets of the moderated region serve as a Monte Carlo estimate of a lower bound on its conditional log-likelihood [43]. For the moderated region chosen by the task and a fixed labely ∈safe, unsafe, drawKsubsets S 1 ,...,S K ⊆ Mfrom the masking distribution. For each sampled subsetS k , letV k = ̄ M∪ (M k ) denote the visible positions. Then, estimate the class-conditional log-likelihood of the moderated region by masked reconstruction [45, 38]. ˆ ℓ θ (x M | x ̄ M ,y) := \ logp θ (x M | x ̄ M ,y) = 1 K K X k=1 |M| |S k | X i∈S k logp θ (x i | x V k ,y). The estimator measures how well the label hypothesis explains the moderated region: if reconstruction underunsafeassigns higher likelihood to the observed tokens than undersafe, the region is better explained by the unsafe class. Posterior interpretation. Under equal class priors, the likelihood-ratio score can be converted directly to a posteriorunsafeprobability using the sigmoid functionσ. By Bayes’ rule and the score definition Equation (1), we have: p θ (unsafe| x M ,x ̄ M ) = p θ (x M |x ̄ M ,unsafe) p θ (x M |x ̄ M ,unsafe)+p θ (x M |x ̄ M ,safe) = exp(s θ (M )) 1+exp(s θ (M )) = σ(s θ (M )). Therefore, σ(ˆs θ (M )) is the model’s estimated unsafe probability. 3.4 Learning objective Having defined the masked-reconstruction estimator, we train LLaDA-Guard to separate thesafe andunsafelabel likelihoods of the moderated region, while also encouraging high likelihood for the moderated region under the ground-truth label. Concretely, the safety-score estimate ˆs θ (M ) = ˆ ℓ θ (x M | x ̄ M , unsafe)− ˆ ℓ θ (x M | x ̄ M , safe)serves as the logit of the predictedunsafe probability, and the moderation loss is the binary cross-entropyL mod = BCE(σ(ˆs θ (M )), y)against the label hypothesesy. Since each score is estimated by reconstruction over sampled masked po- sitions, this loss acts through token-level log-probabilities in the moderated region and pushes the model to increase the likelihood of tokens that support the correct label relative to the incorrect one. 5 The moderation loss is relative: it encourages separation between thesafeandunsafelabel hypotheses but does not control their absolute distance from the underlying data distribution, so both can assign low likelihood to the moderated region as long as their ordering is correct. To supply this absolute signal, we add a generative reconstruction term based on ground-truth labely ∗ , L gen =− b ℓ θ (x M | x ̄ M ,y ∗ ), which directly maximizes the likelihood of the moderated region under the ground-truth label. The full objective isL =L mod + λL gen . Implementation We use LLaDA-8B-Instruct [38] as the backbone and adapt it with LoRA [19]. We perform supervised fine-tuning on a stratified subset of40,000examples from the training splits of WildGuardMix [14] (29.3%) and Aegis 2.0 [12] (70.7%). Stratification preserves coverage over prompt-only and prompt-response examples,safeandunsafelabels, with10,000samples each. To reduce estimator variance during training, we follow Nie et al.[38]and use a fixed set of masking rates rather than drawing a fresh rate fromU [0, 1]for every update. For each rate, we sample a subset of positions within the moderated region and apply the estimator’s|M|/|S k | weighting. Inference mirrors training. For a moderation task, we choose the corresponding moderated region M, evaluate the same masked-reconstruction under both label hypotheses, average across sampled masks, and classify asunsafewhen ˆ ℓ θ (x M | x ̄ M , unsafe)− ˆ ℓ θ (x M | x ̄ M , safe) > 0. Appendix E summarizes the effect of K and different masking ratios on the validation set of Aegis 2.0 [12]. 4 Evaluation Below, we detail our setup (Section 4.1), compare LLaDA-Guard to state-of-the-art guard models on prompt and response moderation (Section 4.2), examine calibration (Section 4.3), analyze failure modes (Section 4.4), and showcase LLaDA-Guard on novel tasks (Section 4.5). 4.1 Evaluation setup Datasets: We evaluate on held-out safety benchmark datasets spanning a wide array of unsafe behavior, including violence, hate speech, and sexual themes, also in a jailbreaking context. For prompt-only settings, we include the OpenAI Moderation [33], ToxicChat [27], and XSTest [42] datasets. For prompt-response settings, we consider BeaverTails [21], PKU-SafeRLHF [9], and XSTest-Response [14]. Finally, we use PHTest [1] to measure over-refusal/blocking. Baselines: We compare against the following model families and sizes: ShieldGemma [53] (2B, 9B, 27B), Granite Guardian 3 [40] (2B, 5B), Llama Guard 3 [30] (8B), WildGuard [14] (8B), NemoGuard [39] (8B), Llama Guard 4 [31] (12B), and Qwen3Guard [54] (0.6B, 4B, 8B). Metrics: We use AUPRC (Area Under the Precision-Recall Curve) and F1 score at the 0.5 classifica- tion threshold as our main metrics. AUPRC measures the model’s ranking capability by averaging across all possible classification thresholds, whereas F1 reflects the model’s practical performance at a fixed decision threshold. We select the standard 0.5 probability as a representative classification threshold across datasets and models. In a real-world setting, the prior ratio of positive to negative samples required to tune the threshold post-training optimally is often unknown. Moreover, the train- ing sets of the tested models are mixtures of samples from various sources (albeit some not publicly available), meaning that the models see a broad array of examples and sub-datasets with different prior ratios during their training. Finally, we evaluate probabilistic calibration using ECE (Expected Calibration Error) [13,28], Brier score, and negative log-likelihood (NLL). ECE bins predictions by confidence and averages the gap between predicted confidence and empirical accuracy. For predicted unsafeprobabilityˆp i and binaryunsafelabely i , Brier score is the mean squared probability error, 1 n P i ( ˆp i − y i ) 2 , while NLL is the binary cross-entropy,− 1 n P i [y i log ˆp i + (1− y i ) log(1− ˆp i )]. Lower values indicate better calibrated probability estimates, with NLL penalizing confident errors most strongly. Unless otherwise stated, LLaDA-Guard usesK = 3sampled masks per label, masking ratet = 0.15, and the equal-prior thresholdˆs θ (M ) > 0. We include further details on dataset preprocessing and model usage in Appendix A. 4.2 Prompt and Response Moderation Figure 3 summarizes the main comparisons as an average-rank trade-off between classification performance and probabilistic reliability. The strongest classification models are LLaDA-Guard, 6 AUPRC and F1 2345678910111213 Average rank Brier and NLL LLaDA-Guard 8B Llama-Guard 3 8B Qwen3Guard 8B ShieldGemma 9B WildGuard 7B Llama-Guard 4 12B Qwen3Guard 4B Granite Guardian 2B NemoGuard 8B ShieldGemma 2B Qwen3Guard 0.6B ShieldGemma 27B Granite Guardian 5B Figure 3: Average rank across datasets in Table 1, over discrimination metrics (AUPRC and F1, top) and calibration metrics (Brier score and NLL, bottom). Full calibration scores are in Appendix B. WildGuard, and Qwen3Guard, but they separate clearly on reliability: WildGuard and Qwen3Guard rank worse under Brier score and NLL, whereas LLaDA-Guard retains strong probabilistic behavior. LLaDA-Guard’s position indicates that its strong performance is not obtained at the cost of ill-behaved confidences. Lower Brier score and NLL indicate that a model assigns probabilities closer to the observed labels, with NLL placing especially high cost on confident mistakes. Table 1 compares LLaDA-Guard with existing guard models on mixed-label held-out datasets for prompt and response moderation. LLaDA-Guard obtains the best overall F1 score,84.91, slightly ahead of WildGuard (84.83), NemoGuard (83.23), and Qwen3Guard (82.75). Its overall AUPRC, 92.66, is within1.40points of the strongest baseline, Qwen3Guard (94.06), and nearly tied with WildGuard (92.73). This indicates that class-conditional generative scoring remains competitive with state-of-the-art direct verdict-token classifiers in rankingunsafeexamples, while giving the strongest fixed-threshold performance across the displayed held-out datasets. A same-backbone direct-verdict ablation is reported in Appendix B.1. The table suggests that LLaDA-Guard’s advantage comes from a more usable safety score, not merely from stronger ranking performance. Strong discriminative guards can rank examples well while still producing brittle operating points: Qwen3Guard has the best average AUPRC, but its prompt-only F1 trails LLaDA-Guard on ToxicChat and OpenAI Mod. WildGuard shows the opposite failure mode on PHTest, achieving only77.03accuracy on harmless prompts that contain superficially unsafe cues, such as “how to kill a mosquito” [1]. This indicates over-reliance on shortcut features associated with unsafe content, resulting in over-refusal of benign samples. Llama Guard 3 and 4 avoid this over-refusal problem, with PHTest accuracies of94.80and93.21, but lag on the mixed- label held-out benchmarks. An additional NotInject [26] stress test shows the same pattern for prompt-injection-like triggers: LLaDA-Guard produces no false positives across trigger-counts, while Qwen3Guard, WildGuard, and Granite become increasingly defensive as trigger cues accumulate (Appendix D). LLaDA-Guard is the exception among the top-performing models: its class-conditional reconstruction score gives the best overall F1 while retaining substantially higher PHTest accuracy than Qwen3Guard and WildGuard. This pattern is consistent with the intended effect of the likelihood- ratio formulation, where decisions depend on which label better explains the moderated region, rather than on unsafe-looking surface cues alone. Table 1: Values are multiplied by100. For the mixed datasets, each cell reports AUPRC/F1. Best numbers per metric and column are bolded. PH Acc. is PHTest over-refusal accuracy. Prompt-only datasetsResponse datasetsOverallOR ModelToxicChatOpenAI Mod.XSTestSafeRLHFBeaverTailsXSTest-RespAvgPH Acc. ShieldGemma 27B63.68 / 30.1869.05 / 50.8982.51 / 41.2282.09 / 28.2379.08 / 28.5354.58 / 34.8671.83 / 35.6598.03 ShieldGemma 2B 59.73 / 16.9561.31 / 16.2182.61 / 70.8090.94 / 26.1986.77 / 25.1882.16 / 56.3677.25 / 35.2897.50 ShieldGemma 9B80.03 / 68.3488.68 / 78.9390.98 / 81.9988.39 / 62.6686.84 / 68.8191.18 / 86.6787.68 / 74.5789.84 Llama-Guard 4 12B56.04 / 51.1579.44 / 73.7490.29 / 83.4295.09 / 87.6489.38 / 69.8094.09 / 89.0484.05 / 75.8093.21 Llama-Guard 3 8B57.93 / 54.0387.30 / 79.1197.40 / 88.4196.66 / 88.5689.02 / 67.7695.71 / 90.4187.34 / 78.0594.80 Granite Guardian 2B53.57 / 37.8870.42 / 60.2186.27 / 79.9295.75 / 89.0590.74 / 74.5891.71 / 79.1481.41 / 70.1327.92 Granite Guardian 5B78.75 / 72.7584.68 / 72.9894.10 / 85.4697.50 / 91.6092.79 / 81.1295.72 / 90.0790.59 / 82.3373.33 NemoGuard 8B 81.99 / 76.8085.17 / 77.5391.73 / 86.6597.75 / 92.3691.36 / 77.1495.50 / 88.8990.58 / 83.2380.31 Qwen3Guard 0.6B87.82 / 64.3585.70 / 66.0695.28 / 85.7196.87 / 88.8894.11 / 86.3696.23 / 88.6292.67 / 80.0068.13 Qwen3Guard 4B 90.51 / 68.9586.40 / 68.3198.04 / 89.7297.07 / 89.5793.70 / 86.6698.51 / 91.5794.04 / 82.4676.22 Qwen3Guard 8B 89.79 / 68.8786.15 / 68.4598.66 / 90.8297.76 / 89.6993.60 / 86.5598.41 / 92.1294.06 / 82.7580.21 WildGuard 7B83.79 / 70.6085.15 / 72.5898.88 / 94.5597.81 / 92.4193.12 / 84.0997.62 / 94.7492.73 / 84.8377.03 LLaDA-Guard 8B84.52 / 77.5585.68 / 75.1396.91 / 88.7797.87 / 93.0192.94 / 82.1998.06 / 92.8192.66 / 84.9187.92 7 4.3 Calibration 0.090.100.110.120.130.140.150.16 Mean ECE 0.04 0.06 0.08 0.10 0.12 Overconfident error rate LLaDA-Guard 8B Qwen3Guard 0.6B Qwen3Guard 4B Qwen3Guard 8B WildGuard 7B Granite 2B Granite 5B NemoGuard 8B Llama-Guard 3 8B ShieldGemma 2B ShieldGemma 9B ShieldGemma 27B Llama-Guard 4 12B Figure 4: Relationship between ECE and over- confident error rate on held-out benchmarks (Ta- ble 1). Overconfident errors are wrong predic- tions made with confidence above90%. Outliers are clipped inward. We next evaluate the calibration of the guard models. This is distinct from classification accu- racy: a model can rankunsafeexamples well around the deployed threshold while still assigning poorly calibrated probabilities. We report detailed ECE results in Appendix B. LLaDA-Guard ob- tains the lowest average ECE,0.0875. Notably, while Qwen3Guard and WildGuard are among the strongest classifiers in Table 1, their confidence estimates are less reliable. ECE averages calibration error over the probability range, but guard deployment is especially sensitive to confidently wrong decisions. We therefore also measure the overconfident error rate: the fraction of held-out-benchmark examples that are misclas- sified with confidence above90%. Figure 4 shows that LLaDA-Guard occupies the low-ECE, low- overconfident-error region, while top-performing direct classifiers move upward or rightward. Qwen3Guard achieves high AUPRC while showing substantially higher ECE and overconfident error rates. These results indicate that generative class- conditional scoring improves both fixed-threshold performance and the reliability of confidence estimates, an important property for deployed moderation systems. 4.4 Diagnostic failure modes 02004006008001000120014001600 Mean input length (tokens) 0.65 0.70 0.75 0.80 0.85 0.90 0.95 1.00 Relative F1 (model peak = 1.0) AR baselines AR baselines (mean) ±1 std across baselines LLaDA-Guard Figure 5: Effect of placing the harmful cue at different positions in the prompt, with increasing amounts of non-informative filler. A decreasing trend indicates positional sensitivity. Figure 5 tests our claim on the greater positional bias of AR guard models by moving the decisive safety cue while increasing benign filler length. LLaDA-Guard stays close to its peak F1 across cue positions, whereas several autoregressive baselines degrade sharply when the cue appears earlier in a longer context; the per-model curves are shown in Appendix Figure 8. Appendix Table 6 investi- gates prompt leakage due to the misspecification of the response-moderation task in AR guard mod- els. LLaDA-Guard has the lowest prompt leakage, with the moderation decision changing in6%of cases, compared to approximately30%for Wild- Guard and several other AR baselines. Models that use separate templates for prompt and response moderation largely avoid this issue by construction. We scale the credit-card shortcut example from Section 3.2 to XSTest by revealing prompts left-to- right in 10% increments. We expect informative tokens to raiseunsafeconfidence gradually, but in practice, existing guardrails often jump from low confidence to near-certainunsafepredictions. As shown by the steep trajectories in Figure 6, AR guard models frequently make abruptunsafe-score jumps when a discriminative fragment appears, while LLaDA-Guard incorporates evidence more smoothly. The remaining baselines show the same pattern in Appendix Figure 9. This contrasts the learned decision mechanisms: discriminative verdict-token models can react to shortunsafe-looking fragments, whereas LLaDA-Guard scores how the full context fits each class-conditional data model. 4.5 Token-level localization and rewriting The previous sections evaluate LLaDA-Guard as a binary guard model. Its generative objective supports an explanatory view of moderation. Since the score is computed from token-level evidence over the moderated region, LLaDA-Guard can localize the words that make theunsafehypothesis more plausible. This is useful in a deployed system when a user flags a refusal as false: for example, 8 0.20.40.60.81.0 Revealed prompt fraction 0.0 0.2 0.4 0.6 0.8 1.0 P(unsafe) LLaDA-Guard 0.20.40.60.81.0 Revealed prompt fraction WildGuard 0.20.40.60.81.0 Revealed prompt fraction Qwen3Guard Safe meanUnsafe mean Figure 6: Trajectories on XSTest for LLaDA-Guard, WildGuard, and Qwen3Guard as prompts are revealed from left to right. Faint lines show individual examples; darker or thicker bands indicate overlap. Highlighted models are the top-performers in Table 1; full results are in Appendix Figure 9. on a ToxicChat prompt “describe the best ways tocausetheendof theworld.”, LLaDA-Guard identifies the evidence driving the refusal. The same evidence is then used for a safety-directed edit, rewriting the prompt as “describe the best ways tounderstand theconcept of theuniverse. ” We evaluate localization capability through safety-directed prompt rewriting, since this tests how well a localizer identifies the harmful tokens. We use an attention-based saliency localizer for all guard models and a leave-one-out masking localizer for LLaDA-Guard, ranking tokens by their impact on theunsafescore. High-risk tokens are localized, masked, and infilled under thesafe label condition. Qwen3Guard 8B, the strongest AUPRC baseline in Table 1, judges whether the rewrite issafe. Tokens are masked iteratively until the judge accepts the prompt or the masking budget is exhausted. Accurate localization should remove the unsafe evidence with minimal edits. 12345 Budget 10 20 30 40 50 60 Avg Conversion-to-Safe Rate (%) LLaDA-Guard 8B Masked NemoGuard 8B Qwen3Guard 8B LLaDA-Guard 8B Granite Guardian 5B Llama-Guard 4 12B WildGuard 7B Llama-Guard 3 8B ShieldGemma 9B Figure 7: Average conversion-to-safe rate over prompt-only datasets by rewrite budget across mod- els. All localizers use attention saliency except LLaDA-Guard Masked (leave-one-out). Figure 7 shows that using LLaDA-Guard it- self as the localizer gives the highest cumula- tive conversion rate over budgets, with mask- ing providing the strongest localization perfor- mance and outperforming AR attention-based localizers across budgets. The figure suggests that LLaDA-Guard’s explanations are tied to its model of the text: tokens selected by masked re- construction are those whose replacement most effectively moves the prompt toward thesafe distribution. This is stronger than verdict-token attention, which can reflect shortcut or posi- tional cues rather than score-changing evidence. See Appendix F for details and Tables 8 and 9 for the results per dataset and budget. 5 Conclusion We present LLaDA-Guard, a guard model that reframes safety moderation as class-conditional generative reconstruction with a masked diffusion language model. Instead of learning a next verdict- tokenp θ (y | x), LLaDA-Guard compares how well the judged region is explained under competing safeandunsafelabel hypotheses. This yields a likelihood-ratio safety score based on a generative model of the underlying data distribution. Empirically, LLaDA-Guard leads in terms of discriminative performance, but occupies a distinct calibration tier; in diverse held-out evaluation, it achieves the best average fixed-threshold F1 and a substantially lower average ECE, Brier score, and NLL than the other top-performing guards. The same reconstruction scores also expose token-level evidence, enabling prompt rewriting without additional supervision. These results suggest that masked-diffusion guardrails provide a practical path from verdict prediction toward moderation systems that model the safety-relevant content itself. We discuss limitations, broader impact, ethics, and compute requirements in Appendix G. 9 References [1]Bang An, Sicheng Zhu, Ruiyi Zhang, Michael-Andrei Panaitescu-Liess, Yuancheng Xu, and Furong Huang. Automatic pseudo-harmful prompt generation for evaluating false refusals in large language models. In First Conference on Language Modeling, 2024. URLhttps: //openreview.net/forum?id=ljFgX6A8NL. [2]Usman Anwar, Abulhair Saparov, Javier Rando, Daniel Paleka, Miles Turpin, Peter Hase, Ekdeep Singh Lubana, Erik Jenner, Stephen Casper, Oliver Sourbut, Benjamin L. Edelman, Zhaowei Zhang, Mario Günther, Anton Korinek, Jose Hernandez-Orallo, Lewis Hammond, Eric Bigelow, Alexander Pan, Lauro Langosco, Tomasz Korbak, Heidi Zhang, Ruiqi Zhong, Seán Ó hÉigeartaigh, Gabriel Recchia, Giulio Corsi, Alan Chan, Markus Anderljung, Lilian Edwards, Aleksandar Petrov, Christian Schroeder de Witt, Sumeet Ramesh Motwani, Yoshua Bengio, Danqi Chen, Philip H. S. Torr, Samuel Albanie, Tegan Maharaj, Jakob Foerster, Florian Tramèr, He He, Atoosa Kasirzadeh, Yejin Choi, and David Krueger. Foundational challenges in assuring alignment and safety of large language models. Transactions on Machine Learning Research, 2024, 2024. URL https://openreview.net/forum?id=oVTkOs8Pka. [3] Jacob Austin, Daniel D. Johnson, Jonathan Ho, Daniel Tarlow, and Rianne van den Berg. Struc- tured denoising diffusion models in discrete state-spaces. In Advances in Neural Information Processing Systems 34 (NeurIPS), 2021. [4]Andrew Campbell, Joe Benton, Valentin De Bortoli, Thomas Rainforth, George Deligiannidis, and Arnaud Doucet. A continuous time framework for discrete denoising models. In Advances in Neural Information Processing Systems 35 (NeurIPS), 2022. [5]Huanran Chen, Yinpeng Dong, Zhengyi Wang, Xiao Yang, Chengqi Duan, Hang Su, and Jun Zhu. Robust classification via a single diffusion model, 2024. URLhttps://arxiv.org/ abs/2305.15241. [6]Zhendong Chu, Shen Wang, Jian Xie, Tinghui Zhu, Yibo Yan, Jinheng Ye, Aoxiao Zhong, Xuming Hu, Jing Liang, Philip S. Yu, and Qingsong Wen. LLM agents for education: Advances and applications. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 13782–13810. Association for Computational Linguistics, 2025. doi: 10.18653/v1/2025. findings-emnlp.743. URL https://aclanthology.org/2025.findings-emnlp.743/. [7] Kevin Clark and Priyank Jaini. Text-to-image diffusion models are zero-shot classifiers. In Advances in Neural Information Processing Systems 36 (NeurIPS), 2023. [8]Justin Cui, Wei-Lin Chiang, Ion Stoica, and Cho-Jui Hsieh. OR-Bench: An over-refusal benchmark for large language models. In Proceedings of the 42nd International Conference on Machine Learning (ICML), 2025. URL https://arxiv.org/abs/2405.20947. [9]Josef Dai, Xuehai Pan, Ruiyang Sun, Jiaming Ji, Xinbo Xu, Mickel Liu, Yizhou Wang, and Yaodong Yang. Safe RLHF: Safe reinforcement learning from human feedback. In International Conference on Learning Representations (ICLR), 2024. URLhttps://arxiv.org/abs/ 2310.12773. [10]Yihe Deng, Yu Yang, Junkai Zhang, Wei Wang, and Bo Li. DuoGuard: A two-player RL-driven framework for multilingual LLM guardrails, 2025. URLhttps://arxiv.org/abs/2502. 05163. [11]Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A. Wichmann. Shortcut learning in deep neural networks. Nature Machine Intelligence, 2(11):665–673, 2020. doi: 10.1038/s42256-020-00257-z. [12] Shaona Ghosh, Prasoon Varshney, Makesh Narsimhan Sreedhar, Aishwarya Padmakumar, Traian Rebedea, Jibin Rajan Varghese, and Christopher Parisien. AEGIS2.0: A diverse AI safety dataset and risks taxonomy for alignment of LLM guardrails. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 5992–6026. Association for Computational Linguistics, 2025. doi: 10.18653/v1/2025.naacl-long.306. URL https://aclanthology.org/2025.naacl-long.306/. 10 [13]Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. On calibration of modern neural networks. In Proceedings of the 34th International Conference on Machine Learning, volume 70 of Proceedings of Machine Learning Research, pages 1321–1330. PMLR, 2017. URL https://proceedings.mlr.press/v70/guo17a.html. [14]Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms, 2024. URL https://arxiv.org/abs/2406.18495. [15] Junda He, Christoph Treude, and David Lo. Llm-based multi-agent systems for software engineering: Literature review, vision, and the road ahead. ACM Trans. Softw. Eng. Methodol., 34(5):124:1–124:30, 2025. doi: 10.1145/3712003. [16]Dan Hendrycks, Mantas Mazeika, and Thomas Woodside. An overview of catastrophic AI risks, 2023. URL https://arxiv.org/abs/2306.12001. [17]Jonathan Ho, Ajay Jain, and Pieter Abbeel.Denoising diffusion probabilistic mod- els.In Advances in Neural Information Processing Systems, volume 33, pages 6840–6851, 2020.URLhttps://proceedings.neurips.c/paper/2020/hash/ 4c5bcfec8584af0d967f1ab10179ca4b-Abstract.html. [18]Emiel Hoogeboom, Didrik Nielsen, Priyank Jaini, Patrick Forré, and Max Welling. Argmax flows and multinomial diffusion: Learning categorical distributions. In Advances in Neural Information Processing Systems 34 (NeurIPS), 2021. [19]Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models, 2021. URL https://arxiv.org/abs/2106.09685. [20]Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama Guard: LLM-based input-output safeguard for human-AI conversations, 2023. URLhttps: //arxiv.org/abs/2312.06674. [21] Jiaming Ji, Mickel Liu, Juntao Dai, Xuehai Pan, Chi Zhang, Ce Bian, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. BeaverTails: Towards improved safety alignment of LLM via a human-preference dataset. In Advances in Neural Information Processing Systems 36: Datasets and Benchmarks Track (NeurIPS), 2023. URL https://arxiv.org/abs/2307.04657. [22]Raviraj Joshi, Rakesh Paul, Kanishk Singla, Anusha Kamath, Michael Evans, Katherine Luna, Shaona Ghosh, Utkarsh Vaidya, Eileen Long, Sanjay Singh Chauhan, and Niranjan Wartikar. CultureGuard: Towards culturally-aware dataset and guard model for multilingual safety appli- cations, 2025. URL https://arxiv.org/abs/2508.01710. [23]Priyanshu Kumar, Devansh Jain, Akhila Yerukola, Liwei Jiang, Himanshu Beniwal, Thomas Hartvigsen, and Maarten Sap. PolyGuard: A multilingual safety moderation tool for 17 languages. In Proceedings of the Conference on Language Modeling (COLM), 2025. URL https://arxiv.org/abs/2504.04377. [24]Alexander C. Li, Mihir Prabhudesai, Shivam Duggal, Ellis Brown, and Deepak Pathak. Your diffusion model is secretly a zero-shot classifier. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 2206–2217, 2023. [25]Alexander C. Li, Ananya Kumar, and Deepak Pathak. Generative classifiers avoid shortcut solutions. In International Conference on Learning Representations, 2025. URLhttps: //arxiv.org/abs/2512.25034. [26]Hao Li, Xiaogeng Liu, Ning Zhang, and Chaowei Xiao. Piguard: Prompt injection guardrail via mitigating overdefense for free. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 30420–30437. Association for Computational Linguistics, 2025. doi: 10.18653/v1/2025.acl-long.1468. URLhttps: //aclanthology.org/2025.acl-long.1468/. 11 [27]Zi Lin, Zihan Wang, Yongqi Tong, Yangkun Wang, Yuxin Guo, Yujia Wang, and Jingbo Shang. ToxicChat: Unveiling hidden challenges of toxicity detection in real-world user-AI conversation. In Findings of the Association for Computational Linguistics: EMNLP 2023, 2023. URL https://aclanthology.org/2023.findings-emnlp.311/. [28] Hongfu Liu, Hengguan Huang, Xiangming Gu, Hao Wang, and Ye Wang. On calibration of llm-based guard models for reliable content moderation. In International Conference on Learning Representations, 2025. URL https://arxiv.org/abs/2410.10414. [29]Nelson F. Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang. Lost in the middle: How language models use long contexts, 2023. URL https://arxiv.org/abs/2307.03172. [30]Llama Team, Meta AI.Meta Llama Guard 3.Model card,https://github.com/ meta-llama/PurpleLlama/blob/main/Llama-Guard3/8B/MODEL_CARD.md, 2024. [31]Llama Team, Meta AI. Meta Llama Guard 4 (12b). Model card,https://huggingface.co/ meta-llama/Llama-Guard-4-12B, 2025. [32] Aaron Lou, Chenlin Meng, and Stefano Ermon. Discrete diffusion modeling by estimating the ratios of the data distribution. In Proceedings of the 41st International Conference on Machine Learning (ICML), 2024. [33]Todor Markov, Chong Zhang, Sandhini Agarwal, Florentine Eloundou Nekoul, Theodore Lee, Steven Adler, Angela Jiang, and Lilian Weng. A holistic approach to undesired content detection in the real world. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 15009–15018. AAAI Press, 2023. doi: 10.1609/aaai.v37i12.26752. [34] Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. HarmBench: A standardized evaluation framework for automated red teaming and robust refusal. In Proceedings of the 41st International Conference on Machine Learning (ICML), 2024. URLhttps:// arxiv.org/abs/2402.04249. [35]Sewon Min, Mike Lewis, Hannaneh Hajishirzi, and Luke Zettlemoyer. Noisy channel language model prompting for few-shot text classification, 2022. URLhttps://arxiv.org/abs/ 2108.04106. [36]Jerzy Neyman and Egon S. Pearson. Ix. on the problem of the most efficient tests of statistical hypotheses. Philosophical Transactions of the Royal Society of London. Series A, Containing Papers of a Mathematical or Physical Character, 231(694–706):289–337, 1933. doi: 10.1098/ rsta.1933.0009. [37]Andrew Y. Ng and Michael I. Jordan.On discriminative vs. generative classifiers: A comparison of logistic regression and naive bayes.In T. Dietterich, S. Becker, and Z. Ghahramani, editors, Advances in Neural Information Processing Systems, volume 14. MIT Press, 2001. URLhttps://proceedings.neurips.c/paper_files/paper/2001/ file/7b7a53e239400a13bd6be6c91c4f6c4e-Paper.pdf. [38]Shen Nie, Fengqi Zhu, Zebin You, Xiaolu Zhang, Jingyang Ou, Jun Hu, Jun Zhou, Yankai Lin, Ji-Rong Wen, and Chongxuan Li. Large language diffusion models, 2025. URLhttps: //arxiv.org/abs/2502.09992. [39]NVIDIA. Llama-3.1-NemoGuard-8B-ContentSafety. NVIDIA NIM model card, Hugging Face, https://huggingface.co/nvidia/llama-3.1-nemoguard-8b-content-safety, 2024. Methodology described in Ghosh et al. (AEGIS2.0, 2025). [40] Inkit Padhi, Manish Nagireddy, Giandomenico Cornacchia, Subhajit Chaudhury, Tejaswini Pedapati, Pierre Dognin, Keerthiram Murugesan, Erik Miehling, Martín Santillán Cooper, Kieran Fraser, Giulio Zizzo, Muhammad Zaid Hameed, Mark Purcell, Michael Desmond, Qian Pan, Zahra Ashktorab, Inge Vejsbjerg, Elizabeth M. Daly, Michael Hind, Werner Geyer, Ambrish Rawat, Kush R. Varshney, and Prasanna Sattigeri. Granite Guardian, 2024. URL https://arxiv.org/abs/2412.07724. 12 [41]Alexander Peysakhovich and Adam Lerer. Attention sorting combats recency bias in long context language models, 2023. URL https://arxiv.org/abs/2310.01427. [42]Paul Röttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. XSTest: A test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics (NAACL), 2024. URLhttps: //aclanthology.org/2024.naacl-long.301/. [43]Subham Sekhar Sahoo, Marianne Arriola, Yair Schiff, Aaron Gokaslan, Edgar Marroquin, Justin T. Chiu, Alexander Rush, and Volodymyr Kuleshov. Simple and effective masked diffusion language models. In Advances in Neural Information Processing Systems 37 (NeurIPS), 2024. [44] Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. “Do anything now”: Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS), 2024. URL https://arxiv.org/abs/2308.03825. [45]Jiaxin Shi, Kehang Han, Zhe Wang, Arnaud Doucet, and Michalis K. Titsias. Simplified and generalized masked diffusion for discrete data.In Advances in Neural Information Processing Systems, volume 37, 2024.doi:10.52202/ 079017-3277.URLhttps://proceedings.neurips.c/paper_files/paper/2024/ hash/bad233b9849f019aead5e5c60cef70f-Abstract-Conference.html. [46] Yang Song, Jascha Sohl-Dickstein, Diederik P. Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations (ICLR), 2021. [47]Sahil Verma, Keegan Hines, Jeff Bilmes, Charlotte Siska, Luke Zettlemoyer, Hila Gonen, and Chandan Singh. MULTIGUARD: An efficient approach for AI safety moderation across languages and modalities. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 16173–16187. Association for Computational Linguistics, 2025. doi: 10.18653/v1/2025.emnlp-main.819. URLhttps://aclanthology.org/2025. emnlp-main.819/. [48]Minjia Wang, Pingping Lin, Siqi Cai, Shengnan An, Shengjie Ma, Zeqi Lin, Congrui Huang, and Bixiong Xu. STAND-Guard: A small task-adaptive content moderation model. In Proceedings of the 31st International Conference on Computational Linguistics: Industry Track (COLING), 2025. URL https://aclanthology.org/2025.coling-industry.1/. [49]Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does LLM safety training fail? In Advances in Neural Information Processing Systems 36 (NeurIPS), 2023. URL https://arxiv.org/abs/2307.02483. [50]Laura Weidinger, John Mellor, Maribeth Rauh, Conor Griffin, Jonathan Uesato, Po-Sen Huang, Myra Cheng, Mia Glaese, Borja Balle, Atoosa Kasirzadeh, Zac Kenton, Sasha Brown, Will Hawkins, Tom Stepleton, Courtney Biles, Abeba Birhane, Julia Haas, Laura Rimell, Lisa Anne Hendricks, William Isaac, Sean Legassick, Geoffrey Irving, and Iason Gabriel. Ethical and social risks of harm from language models, 2021. URL https://arxiv.org/abs/2112.04359. [51]Ziqi Yang, Xuhai Xu, Bingsheng Yao, Ethan Rogers, Shao Zhang, Stephen S. Intille, Nawar Shara, Guodong Gordon Gao, and Dakuo Wang. Talk2care: An llm-based voice assistant for communication between healthcare providers and older adults. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol., 8(2):73:1–73:35, 2024. doi: 10.1145/3659625. [52]Dani Yogatama, Chris Dyer, Wang Ling, and Phil Blunsom. Generative and discriminative text classification with recurrent neural networks, 2017. URLhttps://arxiv.org/abs/1703. 01898. [53]Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, Olivia Sturman, and Oscar Wahltinez. ShieldGemma: Generative AI content moderation based on Gemma, 2024. URL https://arxiv.org/abs/2407.21772. 13 [54]Haiquan Zhao, Chenhan Yuan, Fei Huang, Xiaomeng Hu, Yichang Zhang, An Yang, Bowen Yu, Dayiheng Liu, Jingren Zhou, Junyang Lin, Baosong Yang, Chen Cheng, Jialong Tang, Jiandong Jiang, Jianwei Zhang, Jijie Xu, Ming Yan, Minmin Sun, Pei Zhang, Pengjun Xie, Qiaoyu Tang, Qin Zhu, Rong Zhang, Shibin Wu, Shuo Zhang, Tao He, Tianyi Tang, Tingyu Xia, Wei Liao, Weizhou Shen, Wenbiao Yin, Wenmeng Zhou, Wenyuan Yu, Xiaobin Wang, Xiaodong Deng, Xiaodong Xu, Xinyu Zhang, Yang Liu, Yeqiu Li, Yi Zhang, Yong Jiang, Yu Wan, and Yuxin Zhou. Qwen3Guard technical report, 2025. URL https://arxiv.org/abs/2510.14276. [55]Wenting Zhao, Xiang Ren, Jack Hessel, Claire Cardie, Yejin Choi, and Yuntian Deng. Wild- Chat: 1M ChatGPT interaction logs in the wild. In International Conference on Learning Representations (ICLR), 2024. URL https://arxiv.org/abs/2405.01470. [56] Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Tianle Li, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zhuohan Li, Zi Lin, Eric P. Xing, Joseph E. Gonzalez, Ion Stoica, and Hao Zhang. LMSYS-Chat-1M: A large-scale real-world LLM conversation dataset. In International Conference on Learning Representations (ICLR), 2024. URLhttps://arxiv.org/abs/ 2309.11998. [57]Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models, 2023. URLhttps: //arxiv.org/abs/2307.15043. A Dataset Preprocessing and Model Usage For prompt-only moderation, we evaluate OpenAI Moderation [33], ToxicChat [27], and XSTest [42]. For prompt-response moderation, we evaluate BeaverTails [21], PKU-SafeRLHF [9], and XSTest- Response from WildGuard [14]. All datasets are mapped to binarysafe/unsafelabels, with any dataset-provided harmful, toxic, policy-violating, or refusal-requiring label mapped to unsafe. In our evaluation of SafeRLHF, we follow Han et al.[14]and retain only items whose prompt is paired with both a safe and an unsafe response, while subsampling 1K prompt–response pairs to reduce evaluation cost. For PHTest [1], we evaluate only on samples annotated as “harmless” rather than controversial, resulting in a dataset version where all examples aresafe. OpenAI Moderation, ToxicChat, XSTest, BeaverTails, and XSTest-Response are otherwise used as provided by their released benchmark splits. Baseline models.We evaluate the released Hugging Face checkpoints for ShieldGemma 2B/9B/27B [53], Granite Guardian 3.1 2B and 3.2 5B [40], Llama Guard 3 8B [30], WildGuard 7B [14], NemoGuard 8B [39], Llama Guard 4 12B [31], and Qwen3Guard-Gen 0.6B/4B/8B [54]. We use each model’s official Hugging Face chat template viaapply_chat_templateand the recom- mended inference settings. For Qwen3Guard we use the “strict” mode as it is the highest performing variant. B Additional Held-Out-Benchmark Results B.1 Direct-verdict ablation For the predictive performance results below, we additionally consider LLaDA-Guard Direct as an ablation. It uses the same model weights as LLaDA-Guard, but simulates the standard guard-model paradigm. Instead of scoring the moderated region under competing class-conditional hypotheses, LLaDA-Guard Direct only predicts the probabilities for the verdict (label) tokeny ∈safe, unsafe placed after the prompt and, when applicable, the response. In the masked-diffusion model, prediction equates to unmaskingy. This setting, therefore, isolates the effect of the proposed class-conditional reconstruction objective from that of using LLaDA as the underlying model. Tables 2 and 3 show that class-conditional reconstruction improves over direct verdict-token scoring with the same LLaDA weights on every held-out dataset. The largest fixed-threshold gains occur on response datasets, where the average F1 improves by4.06percentage points over LLaDA-Guard Direct. 14 Table 2: Direct-verdict ablation on held-out AUPRC.∆is LLaDA-Guard minus LLaDA-Guard Direct. ModelToxicChat OpenAI ModXSTestBeaverTails XSTest-RespAvg LLaDA-Guard Direct 8B0.81630.81630.95940.91040.94120.8887 LLaDA-Guard 8B0.84520.85680.96910.92940.98060.9162 ∆+0.0289+0.0405+0.0097+0.0190+0.0394+0.0275 Table 3: Direct-verdict ablation on held-out F1 at the default decision threshold used in evaluation.∆ is LLaDA-Guard minus LLaDA-Guard Direct. ModelToxicChat OpenAI ModXSTestBeaverTails XSTest-RespAvg LLaDA-Guard Direct 8B0.75660.73390.88550.73420.85140.7923 LLaDA-Guard 8B0.77550.75130.88770.83290.92810.8599 ∆+0.0189+0.0174+0.0022+0.0877+0.0767+0.0406 B.2 Calibration breakdowns Table 4: Held-out-benchmark calibration summary (×100, lower is better). Avg. over ToxicChat, OpenAI Mod, XSTest, SafeRLHF, BeaverTails, XSTest-Response, PHTest Harmless. ModelECEBrierNLL ShieldGemma 2B19.7918.2664.21 ShieldGemma 9B11.9011.8540.35 ShieldGemma 27B16.0516.6050.78 Llama-Guard 3 8B9.51 9.8447.37 Llama-Guard 4 12B12.7412.65168.65 Granite Guardian 3.0 2B25.7720.7162.58 Granite Guardian 3.2 5B11.8110.8135.28 Qwen3Guard 0.6B16.6113.6451.57 Qwen3Guard 4B14.2111.7748.71 Qwen3Guard 8B13.8411.2948.33 NemoGuard 8B12.6310.4050.17 WildGuard 7B10.9110.3747.86 LLaDA-Guard 8B8.758.4532.56 Tables 4 and 5 report the corresponding calibration results. Table 4 summarizes average ECE, Brier score, and NLL across the held-out benchmarks, with all values multiplied by 100; lower values indicate better calibrated probabilities. LLaDA-Guard obtains the best score on all three metrics, indicating that its strong classification performance does not come at the cost of unreliable confidence estimates. Table 5 breaks down ECE by dataset, showing that our calibration advantage is stable across individual benchmarks: LLaDA-Guard achieves the lowest average ECE overall and remains consistently competitive across prompt-only, response, and harmless-prompt settings. Together, these results support the main claim that class-conditional reconstruction yields guard scores that are both competitive for detection and substantially better calibrated than the baselines. C Additional Diagnostic Failure-Mode Results This appendix collects the expanded analyses behind Section 4.4. Positional sensitivity. Figure 8 expands the aggregate positional-sensitivity result from Figure 5 into per-model curves. The y-axis normalizes each model by its own peak F1, so the relevant signal is the drop from the model’s best operating point as filler length grows. Prefix-score boundary. Figure 9 shows the full XSTest prefix-reveal experiment for all baselines. Each translucent line is one example and each thick line is the class mean. 15 Table 5: Held-out-benchmark expected calibration error (ECE) comparison. Avg is the mean over the displayed datasets in this table. ModelToxicChat OpenAI Mod XSTest SafeRLHF BeaverTails XSTest-Resp PHTestAvg ShieldGemma 27B0.04190.06110.20810.29360.35530.04240.1214 0.1605 ShieldGemma 2B0.09500.21060.15680.35400.42360.08120.0639 0.1979 ShieldGemma 9B0.02520.08780.10650.20870.21050.06030.1341 0.1190 Llama-Guard 4 12B0.11790.15460.13310.11210.27070.03370.0697 0.1274 Llama-Guard 3 8B0.07730.07050.07740.07410.26640.02480.0753 0.0951 Granite Guardian 3.0 2B0.38490.27340.22840.05420.17620.03310.6539 0.2577 Granite Guardian 3.2 5B0.05350.16540.11880.04290.12690.02450.2947 0.1181 NemoGuard 8B0.04870.16760.10460.03830.18540.03460.3046 0.1263 Qwen3Guard 0.6B0.15460.28800.12030.11680.10520.03320.3444 0.1661 Qwen3Guard 4B0.11670.26960.08040.11170.11930.03360.2633 0.1421 Qwen3Guard 8B0.11990.26880.07900.11420.11990.03200.2354 0.1384 WildGuard 7B0.07990.20550.03250.06030.12700.02060.2382 0.1091 LLaDA-Guard 8B0.03970.16010.05340.04820.14180.01900.1506 0.0875 Figure 8: Per-model positional bias investigation. Each panel shows F1 normalized by that model’s peak F1 across input-length buckets, with curves grouped by the position of the decisive safety cue: first, middle, or last. Flat curves as filler length increases indicate less positional sensitivity. Prefix-score jumps. Figure 10 makes the previous observation explicit by plotting the change in unsafeprobability between consecutive prefix steps. Large positive spikes mean that a short newly revealed fragment caused a large verdict shift. Response-objective fidelity.Table 6 tests whether response moderation is actually grounded in the response. The response is held fixed andsafe; only the prompt changes fromsafetounsafe. A response-grounded model should therefore produce nearly identical verdicts in both conditions. ModelMatched ∆P unsafe ↓Matched ∆ˆy unsafe ↓ LLaDA-Guard0.0990.060 LlamaGuard 30.2060.208 LlamaGuard 40.1380.132 WildGuard0.2920.308 GraniteGuard0.1220.140 Qwen3Guard0.3860.424 ShieldGemma0.0080.000 NemoGuard0.0190.004 Table 6: Response-objective fidelity on matchedsafe-response pairs (n = 250). For each pair, the samesaferesponse is attached once to asafeprompt and once to anunsafeprompt, and the model is asked to classify the response. We report the increase inunsafeprobability (∆P unsafe ) and unsafeprediction rate (∆ˆy unsafe ) when only the prompt changes fromsafetounsafe. Lower is better. Rows below the rule (ShieldGemma, NemoGuard) use a separate template for prompt and response classification, which sidesteps prompt leakage by construction and yields ∆≈ 0. 16 Figure 9: Prefix-score trajectories on XSTest. Each prompt is revealed from left to right, and the guard score is recomputed after each prefix. Meansafeandunsafetrajectories summarize how quickly each model crosses the unsafe decision boundary. Figure 10: Prefix-score jump analysis on XSTest. Curves show changes inunsafeprobability between consecutive revealed-prefix steps, highlighting abrupt decision-boundary jumps. D NotInject Over-Defense Analysis NotInject contains benign prompts with prompt-injection-like trigger patterns, so anyunsafepre- diction is a false positive. Table 7 breaks these false positives down by the number of trigger words in the prompt. LLaDA-Guard produces no false positives across all trigger-count splits, matching ShieldGemma and avoiding the trigger-count sensitivity seen in several strong classifiers. Granite is the most affected baseline, rising from1.77%false positives with one trigger to10.62%with three triggers; Qwen3Guard and WildGuard also become more defensive as trigger count increases. This supports the main-text over-refusal result: LLaDA-Guard does not achieve strong held-out-benchmark performance by simply flagging benign prompts that contain suspicious safety or injection cues. Table 7: NotInject over-defense by trigger-count split. All examples are benign; entries show false- positive percentage with false-positive count in parentheses, plus average false-positive confidence when any false positives occur. Model1 trigger2 triggers3 triggers LLaDA-Guard 0.00% (0) conf. – 0.00% (0) conf. – 0.00% (0) conf. – Qwen3Guard 0.00% (0) conf. – 0.88% (1) conf. 80.59% 3.54% (4) conf. 77.55% WildGuard 0.88% (1) conf. 65.14% 0.88% (1) conf. 99.44% 2.65% (3) conf. 78.16% Granite 1.77% (2) conf. 60.61% 5.31% (6) conf. 64.70% 10.62% (12) conf. 70.61% NemoGuard 0.00% (0) conf. – 0.00% (0) conf. – 1.77% (2) conf. 63.69% Llama-Guard 3 0.00% (0) conf. – 0.00% (0) conf. – 0.88% (1) conf. 90.47% ShieldGemma 0.00% (0) conf. – 0.00% (0) conf. – 0.00% (0) conf. – Llama-Guard 4 0.00% (0) conf. – 0.00% (0) conf. – 2.65% (3) conf. 89.94% E Aegis Validation Time-Step Sweep Figure 11 evaluates LLaDA-Guard on the Aegis validation set across different diffusion time-step valuestand repeated mask samples. The main takeaway is that performance is robust across a broad 17 0.050.10.150.20.250.30.40.5 t 0.915 0.920 0.925 0.930 0.935 0.940 AUPRC 0.930 0.933 0.935 0.933 0.930 0.927 0.925 0.918 0.933 0.934 0.933 0.935 0.934 0.932 0.931 0.923 0.935 0.935 0.932 0.937 0.936 0.935 0.933 0.926 0.937 0.939 0.936 0.939 0.938 0.936 0.934 0.928 AUPRC ↑ 1x2x3x4x 0.050.10.150.20.250.30.40.5 t 0.84 0.85 0.86 0.87 F1 0.859 0.864 0.864 0.861 0.860 0.852 0.848 0.841 0.869 0.863 0.865 0.864 0.861 0.860 0.857 0.842 0.863 0.867 0.865 0.866 0.866 0.860 0.857 0.856 0.865 0.864 0.865 0.868 0.873 0.865 0.860 0.854 F1 ↑ 0.050.10.150.20.250.30.40.5 t 0.00 0.01 0.02 0.03 0.04 0.05 ECE 0.0456 0.0423 0.0405 0.0456 0.0514 0.0422 0.0424 0.0378 0.0431 0.0392 0.0410 0.0393 0.0338 0.0348 0.0320 0.0337 0.0404 0.0388 0.0427 0.0367 0.0325 0.0330 0.0329 0.0294 0.0390 0.0446 0.0399 0.0382 0.0337 0.0346 0.0288 0.0264 ECE ↓ Figure 11: Aegis 2.0 validation performance across diffusion time-step valuestand mask sampling repetitions K. range of masking levels: AUPRC stays near0.93fort≤ 0.4, and F1 remains within roughly three points across the sweep. Repeats help most for calibration, with ECE consistently improving from one pass to multiple passes, offering a way to use test-time computation to boost calibration. F Localization and Rewriting Details For the attention localizer, we rank tokens by their attention contribution to the verdict position. This provides a common attribution proxy for all guard models, but it is indirect: attention indicates where the verdict representation attends, not which tokens causally change the safety score. For the leave-one-out localizer, we exploit LLaDA-Guard’s masked scoring. For each tokeniin the moderated region, we temporarily mask that token, recompute the safety score, and rank tokens by ∆ i = ˆs θ (M )− ˆs (−i) θ (M ), whereˆs (−i) θ (M )denotes the score after masking tokeni. Larger positive values indicate that tokeni contributes more strongly to theunsafelikelihood-ratio score. This gives a more direct attribution signal, at the cost of additional scoring passes. For rewriting, the selected tokens are masked and infilled by LLaDA-Guard under thesafelabel condition. We repeat this process until the judge classifies the prompt assafeor the masking budget is exhausted. F.1 Full rewriting results Tables 8 and 9 report the full rewriting results per dataset and budget, corresponding to the main-text rewriting figure. 18 LocalizerB1B2B3B4B5 ShieldGemma 27B10.920.929.838.843.4 ShieldGemma 2B16.532.941.447.350.7 ShieldGemma 9B12.221.027.532.940.9 Llama-Guard 4 12B14.726.133.539.344.7 Llama-Guard 3 8B12.423.032.641.748.6 Granite Guardian 2B13.724.834.340.645.9 Granite Guardian 5B19.634.743.147.250.1 NemoGuard 8B12.027.240.146.451.0 Qwen3Guard 0.6B13.722.331.537.242.7 Qwen3Guard 4B14.328.436.343.347.4 Qwen3Guard 8B14.127.436.543.348.1 WildGuard 7B14.032.942.448.952.1 LLaDA-Guard 8B21.338.046.450.753.0 LLaDA-Guard 8B Masked37.647.953.357.160.7 Table 8: Dataset-balanced cumulative conversion-to-safe rate (%) by rewrite budget. B1–B5 denote increasing token-rewrite budgets; each value averages over XSTest, ToxicChat, and OpenAI Mod. LocalizerXSTestToxicChatOpenAI ModAvg ShieldGemma 27B85.035.110.143.4 ShieldGemma 2B96.042.313.850.7 ShieldGemma 9B77.034.511.140.9 Llama-Guard 4 12B85.537.011.544.7 Llama-Guard 3 8B92.041.412.448.6 Granite Guardian 2B91.037.09.745.9 Granite Guardian 5B92.543.914.050.1 NemoGuard 8B95.045.312.851.0 Qwen3Guard 0.6B84.535.48.242.7 Qwen3Guard 4B93.537.611.347.4 Qwen3Guard 8B96.038.110.148.1 WildGuard 7B98.045.612.852.1 LLaDA-Guard 8B99.044.815.153.0 LLaDA-Guard 8B Masked99.055.017.060.7 Table 9: Conversion-to-safe rate (%) by localizer and dataset at a rewrite budget of 5. G Limitations, Broader Impact, and Compute G.1 Limitations Our results are limited by the scope of the evaluated datasets and policies. The main evaluation focuses on English prompt and response moderation benchmarks with binarysafe/unsafelabels; we do not evaluate multilingual, multimodal, or policy-customized moderation settings. The learned class- conditional likelihoods also inherit the coverage, label noise, and policy assumptions of the training data. As a result, improved calibration and reduced shortcut behavior on the tested benchmarks should not be interpreted as a guarantee of robustness to all distribution shifts, adaptive jailbreaks, or future safety taxonomies. LLaDA-Guard also changes the computational profile of guard inference. A direct verdict-token guard typically requires one forward pass to score the label token. In contrast, LLaDA-Guard estimates two class-conditional reconstruction scores and averages across sampled masks; in the default evaluation this usesK = 3sampled masks per label. This additional parallel computation is useful for calibration and token-level evidence, but it can be costly in high-throughput moderation pipelines. Finally, the prompt-rewriting experiment is intended as a proof of concept. G.2 Broader Impact and Ethics The intended positive impact of this work is to improve the reliability of safety moderation systems. Better calibrated guard models can support more transparent refusals, reduce overconfident mistakes, 19 and help distinguish harmful content from benign prompts that contain superficially unsafe terms. The prompt-rewriting pipeline may also help systems offer safer alternatives rather than only blocking user requests. The same capabilities carry risks. More informative guard scores and token-level localization could be misused to probe a moderation system, optimize around safety filters, or identify which fragments trigger enforcement. A guard model can also be used for overbroad filtering, censorship, or surveillance if deployed under inappropriate policies. Further, a guard model can be used adversarially to generate jailbreak attacks. False positives may block legitimate speech, while false negatives may allow harmful content through. These risks motivate treating LLaDA-Guard as one component of a larger safety stack, with policy-specific validation, monitoring after deployment, and human review for high-impact decisions. Our experiments use existing public safety datasets and released model checkpoints; we do not collect new human-subject data. G.3 Compute and Hardware We run the fine-tuning for LLaDA-Guard from LLaDA-8B-Instruct, and all experiments on a single system with1×NVIDIA H100 NVL, 30 Intel Xeon Platinum 8562Y+ cores, and 96 GB RAM. The wall-clock time for a full training run is 6 hours and 45 minutes. The full evaluation time, including baselines, is estimated at 11 hours. 20

Instant research discovery