AI 安全與推論系統
ResponseGuard Blocks Harmful Multimodal Responses with a Single Forward Pass, Delivering About 150× Lower Latency Than Reasoning-Based Guardrails
ResponseGuard reframes multimodal response moderation as binary classification and evaluates responses sentence by sentence during streaming without generating a chain of thought. The authors’ tests show better response detection than a 3B reasoning-based baseline, but the model weights, training code, and data splits have not yet been released.
The newly proposed ResponseGuard challenges the assumption that safety models also need step-by-step reasoning. Built on Qwen3-VL-Embedding-2B, the system freezes the vision encoder and uses LoRA, two sets of safe/harmful reference vectors, and a small classification head to aggregate representations of the user prompt, image, and response generated so far. It outputs a single probability of harmfulness without decoding a rationale or label token, so each check requires only one forward pass. In deployment, the response can be rescored after each sentence is completed, with generation terminated when the score exceeds a threshold.
Under identical conditions using a single RTX A6000, BF16, and a warm cache, the authors measured a median decision latency of 67.6 milliseconds for ResponseGuard-2B. GuardReasoner-VL-3B generated an average of about 238 reasoning tokens and took 10.12 seconds. On a multimodal response harmfulness benchmark, their weighted F1 scores were 77.31 and 76.56, respectively. Resampling the reasoning chain changed only 2.5% of text judgments and 7.8% of image judgments, while chain length showed almost no correlation with accuracy. These results support the view that some safety reasoning may amount to post hoc explanation.
In a streaming simulation, a threshold of 0.5 intercepted 95% of harmful responses before completion and concealed 87.7% of harmful text, at the cost of incorrectly stopping 28.5% of benign responses. Images remain a weakness: the reasoning-based baseline performed better overall in prompt moderation, while ResponseGuard’s uncertainty was concentrated in image-only cases. More importantly, the repository currently contains documentation only; the weights, training and evaluation notebooks, streaming tools, and preprocessing splits are still marked “coming soon.” Engineering teams should wait for runnable artifacts and recalibrate the system using their own languages, image categories, and acceptable false-blocking rates rather than adopting the paper’s threshold directly.