AI 安全
LatentGuard Compresses Safety Reasoning into Continuous States, Cutting the Critical Path from 268.56 Text Tokens to 1.60
Rather than generating a complete safety rationale for every review, LatentGuard uses staged training to compress rationales into a small number of latent states and output decisions directly. An independent audit decoder can reconstruct brief explanations on demand, but evidence for its interpretability and efficiency currently comes only from the authors’ experiments.
Safety guard models with reasoning capabilities typically generate a risk analysis before deciding whether an input or output should be allowed. Such explicit rationales help with complex-case decisions and audits, but they require decoding hundreds of additional tokens for every request. For a content moderation layer positioned before and after every model call, this directly increases latency, GPU utilization, and serving costs.
LatentGuard attempts to move safety reasoning out of the text space. It first trains the model on task-aligned textual rationales, then uses a staged curriculum to progressively compress that reasoning into continuous latent states, ultimately predicting safety decisions directly from those states. Unlike simply omitting rationales, the framework includes an isolated auxiliary decoder. It remains inactive for ordinary requests and converts latent representations into concise review materials only during audits or spot checks. This separation allows the online critical path to prioritize low cost while preserving an interface for post hoc review.
The paper reports that LatentGuard-8B achieves an average weighted F1 score of 84.91, exceeding GuardReasoner-8B’s 83.95. Meanwhile, reasoning on the critical path falls from an average of 268.56 generated rationale tokens to 1.60 latent reasoning tokens. The authors also report an audit utility score of 85.75 for the audit decoder. If these results are reproducible, content filters may no longer have to choose between “complete rationales” and “low-latency classifiers,” making the approach particularly suitable for high-throughput model gateways and authorization layers for agent tools.
However, continuous states are not inherently interpretable, and the audit text is still produced by a separate generator, so it may not faithfully reflect the actual basis for a decision. Deployers must also validate performance against out-of-distribution attacks, mixed-language inputs, long contexts, and novel jailbreaks, while measuring latency and memory gains on real hardware. The paper has not yet released public weights or code, so LatentGuard should currently be viewed as a promising architectural result rather than a mature component ready to replace existing guard services.