Qwen3Guard Technical Report

TL;DR

Qwen3Guard tackles the challenge of flexible and real-time safety moderation for multilingual LLMs by introducing two complementary guardrails: Generative Qwen3Guard, which frames safety classification as an instruction-following tri-class task (safe, controversial, unsafe), and Stream Qwen3Guard, which adds token-level streaming defenses for real-time intervention. The authors build large multilingual, instruction-tuned datasets, employ a multi-stage labeling pipeline including controversial-label handling and distillation, and demonstrate state-of-the-art performance on prompts and responses across English, Chinese, and multilingual benchmarks. They further validate practical utility through Safety RL using guard-based rewards and real-time CARE integrations, achieving high safety without sacrificing quality. The work also analyzes policy inconsistencies across benchmarks, provides ablations, and discusses limitations such as adversarial vulnerability and cultural biases, offering a robust, scalable path toward global, dynamic AI safety moderation.

Abstract

As large language models (LLMs) become more capable and widely used, ensuring the safety of their outputs is increasingly critical. Existing guardrail models, though useful in static evaluation settings, face two major limitations in real-world applications: (1) they typically output only binary "safe/unsafe" labels, which can be interpreted inconsistently across diverse safety policies, rendering them incapable of accommodating varying safety tolerances across domains; and (2) they require complete model outputs before performing safety checks, making them fundamentally incompatible with streaming LLM inference, thereby preventing timely intervention during generation and increasing exposure to harmful partial outputs. To address these challenges, we present Qwen3Guard, a series of multilingual safety guardrail models with two specialized variants: Generative Qwen3Guard, which casts safety classification as an instruction-following task to enable fine-grained tri-class judgments (safe, controversial, unsafe); and Stream Qwen3Guard, which introduces a token-level classification head for real-time safety monitoring during incremental text generation. Both variants are available in three sizes (0.6B, 4B, and 8B parameters) and support up to 119 languages and dialects, providing comprehensive, scalable, and low-latency safety moderation for global LLM deployments. Evaluated across English, Chinese, and multilingual benchmarks, Qwen3Guard achieves state-of-the-art performance in both prompt and response safety classification. All models are released under the Apache 2.0 license for public use.

Figures (13)

• Figure 1: Average F1 scores of Qwen3Guard-Gen vs. existing guard models across safety classification benchmarks for Prompts and Responses in English, Chinese, and Multilingual datasets.
• Figure 2: The Instructions of Generative Qwen3Guard for Prompt and Response Assessment. These sections primarily include the following components: task definition, safety policies, safety categories, refusal criteria (response only), dialogue context, and output formatting specifications.
• Figure 3: The Process of Building Controversial Label. The training data is split into two parts. For each part, two models trained with reweighted samples to yield Loose and Strict predictions, are applied to annotate the other part. Final labels are assigned via voting where conflicting predictions are marked as Controversial.
• Figure 4: Precision and Recall for Prompt Classification (Aegis and OpenAIMod) and Response Classification (SafeRLHF and XSTest). Results reveal inconsistency in safety policy across datasets and guard models. For instance, WildGuard-7B aligns well with the Aegis dataset but proves overly restrictive on OpenAIMod.
• Figure 5: Confusion matrices of Qwen3Guard-4B-Gen for categorizing unsafe prompts and responses. Non-Violent=Non-Violent Illegal Acts. PII=Personal Identifiable Information. Political=Political Sensitive Topics.