In order to screen a prompt or a response, the recent guardrail methods generate a chain-of-thought (CoT) before they issue a verdict. This design follows a common belief that step-by-step reasoning improves a decision. However, CoT also makes the guard heavy and slow, because the model must generate many tokens before it decides. This may not match how guardrails are actually deployed. A guardrail sometimes should not be heavy and slow, and it often runs on-device, for example on an embodied robot. In this paper, we pose a question whether a safety guardrail really needs to reason. To answer this question, we train a lightweight bidirectional encoder and a reasoning guard on the same corpus, and we then remove only the reasoning while we keep everything else fixed. With this controlled same-base comparison, we show that the chain does not improve moderation accuracy. We name the resulting guard LeanGuard. A 395M label-only encoder reaches an average F1 of 82.90 $\pm$ 0.26 over public benchmarks. It matches a reasoning guard that is built on a much larger decoder, while it uses only a single forward pass over an input of at most 512 tokens. This is about a ~100x reduction in inference compute. We further show that this label-only encoder stays robust under training-label noise and retains far more recall at a strict false-positive rate than the reasoning guard, so a heavier reasoning guard is not the more robust choice either. Our finding suggests that the current guardrail benchmarks may not be hard enough to reward reasoning, and that the necessity of CoT for moderation is still not proven. We release all source codes and models including LeanGuard at https://github.com/ndb796/LeanGuard.
Exploring the Vulnerability of the Content Moderation Guardrail in Large Language Models via Intent Manipulation
Boise State University（博伊州立大学）；University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；University of Pittsburgh（匹兹堡大学）；New York University（纽约大学）；Florida International University（佛罗里达国际大学）
RigorLLM: Resilient Guardrails for Large Language Models against Undesired Content
University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；Virginia Tech（弗吉尼亚理工大学）；Salesforce Research（Salesforce研究院）；University of California Berkeley（加州大学伯克利分校）；University of Chicago（芝加哥大学）
ConsisGuard: Aligning Safety Deliberation with Policy Enforcement in LLM Guardrails
Alibaba Group（阿里巴巴集团）；Zhejiang University（浙江大学）；Huzhou Normal University（湖州师范学院）；Zhejiang Key Laboratory of Intelligent Education Technology and Application（浙江省智能教育技术与应用重点实验室）
Reflex-Guard: A Low-Latency Guardrail for LLM Prompt Safety Using Dense Semantic Embeddings
Graduate School of Informatics, Osaka Metropolitan University（大阪公立大学情报学研究科）；BRAC University（BRAC大学）；Bangladesh University of Engineering and Technology (BUET)（孟加拉工程技术大学）；New Mexico State University（新墨西哥州立大学）
From Judgment to Interference: Early Stopping LLM Harmful Outputs via Streaming Content Monitoring
Yang Li Media Synthesis and Forensics Lab, Institute of Computing Technology, Chinese Academy of Sciences University of Chinese Academy of Sciences（中国科学院计算技术研究所、中国科学院自动化研究所、中国科学院大学）；Qiang Sheng Media Synthesis and Forensics Lab, Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所、中国科学院自动化研究所）；Yehan Yang Media Synthesis and Forensics Lab, Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所、中国科学院自动化研究所）；Xueyao Zhang The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳））；Juan Cao Media Synthesis and Forensics Lab, Institute of Computing Technology, Chinese Academy of Sciences University of Chinese Academy of Sciences（中国科学院计算技术研究所、中国科学院自动化研究所、中国科学院大学）
PromptGuard: Soft Prompt-Guided Unsafe Content Moderation for Text-to-Image Models
Department of Computer Science, University of Maryland（计算机科学系，马里兰大学）；College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算机科学与数据科学学院）；Kahlert School of Computing, The University of Utah（犹他大学Kahlert计算学院）；Siebel School of Computing and Data Science, University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校Siebel计算与数据科学学院）
