{"id":904,"date":"2026-05-14T04:41:13","date_gmt":"2026-05-13T20:41:13","guid":{"rendered":"https:\/\/connectword.dpdns.org\/?p=904"},"modified":"2026-05-14T04:41:13","modified_gmt":"2026-05-13T20:41:13","slug":"fastino-labs-open-sources-gliguard-a-300m-parameter-safety-moderation-model-that-matches-or-exceeds-accuracy-of-models-23-90x-its-size","status":"publish","type":"post","link":"https:\/\/connectword.dpdns.org\/?p=904","title":{"rendered":"Fastino Labs Open-Sources GLiGuard: A 300M Parameter Safety Moderation Model That Matches or Exceeds Accuracy of Models 23\u201390x Its Size"},"content":{"rendered":"

As LLM-powered applications move into production \u2014 and as AI agents take on more consequential tasks like browsing the web, writing and executing code, and interacting with external services \u2014 safety moderation has quietly become one of the most operationally expensive parts of the stack.<\/p>\n

Most developers who\u2019ve deployed a production LLM system know the problem: you need to evaluate every user prompt before it reaches the model, and every model response before it reaches the user. That means your guardrail model runs on every single request, at every turn of a conversation. The guardrail latency compounds. The cost compounds. And the current generation of open-source guardrail models \u2014 LlamaGuard4 (12B), WildGuard (7B), ShieldGemma (27B), NemoGuard (8B) \u2014 are all decoder-only models with billions of parameters, built for flexibility but not for speed.<\/p>\n

Fastino Labs released GLiGuard<\/a>, a 300 million parameter open-source safety moderation model designed to address this specific problem. GLiGuard evaluates multiple safety dimensions in a single pass, and across nine safety benchmarks, its accuracy matches or exceeds models that are 23 to 90 times its size while running up to 16 times faster.<\/p>\n

\n
\"\"
https:\/\/pioneer.ai\/blog\/gliguard-16x-faster-safety-moderation-with-a-small-language-model<\/figcaption><\/figure>\n<\/div>\n

Why Decoder LLMs May Not Be the Right Tool for Safety Moderation<\/strong><\/h2>\n

To understand what makes GLiGuard different, it helps to understand why existing guardrail models are slow. Most major guardrail models are built on decoder-only transformer architectures, they generate their safety verdicts autoregressively, one token at a time \u2014 the same way a large language model generates a response to a chat message.<\/p>\n

This design made sense when safety requirements were fluid. Decoder models can interpret natural language task descriptions and adapt to new safety policies without retraining. But autoregressive generation is inherently sequential, which makes it slow and computationally expensive.<\/p>\n

There\u2019s a compounding problem on top of that. Most guardrail models need to assess inputs across multiple safety dimensions: what type of harm is present, whether the user prompt is attempting to bypass safety training, whether the model\u2019s response is itself unsafe, and so on. Because decoder models generate output sequentially, these assessments are typically produced one after another, and latency compounds as more criteria are evaluated.<\/p>\n

In other words, the architecture that makes decoder models flexible is also the architecture that makes them the wrong tool for what is fundamentally a classification problem.<\/p>\n

What GLiGuard Actually Does<\/strong><\/h2>\n

GLiGuard is a small encoder-based model that reframes safety moderation as a text classification problem rather than a text generation problem. Encoder models process the entire input at once and output a single classification label for a set of fixed labels, whereas decoder models generate their output one token at a time, left to right.<\/p>\n

The key architectural insight is in how GLiGuard handles multiple tasks simultaneously. Instead of generating tokens, GLiGuard encodes both the input text and task definitions (labels) together. These are then fed to the model, which scores every label simultaneously in a single forward pass and returns the highest-scoring label for each task. Because all tasks and their candidate labels are part of the input itself, evaluating additional safety dimensions doesn\u2019t add latency; it simply means including more labels in the input.<\/p>\n

\n
\"\"
https:\/\/pioneer.ai\/blog\/gliguard-16x-faster-safety-moderation-with-a-small-language-model<\/figcaption><\/figure>\n<\/div>\n

GLiGuard runs four moderation tasks concurrently in one forward pass:<\/strong><\/p>\n

    \n
  1. Safety classification<\/strong> (safe \/ unsafe) \u2014 applied to both user prompts before generation and model responses after generation.<\/li>\n
  2. Jailbreak strategy detection<\/strong> across 11 strategies, including prompt injection, roleplay bypass, instruction override, and social engineering. If any jailbreak strategy is detected, the prompt is automatically flagged as unsafe.<\/li>\n
  3. Harm category detection<\/strong> across 14 categories \u2014 violence, sexual content, hate speech, PII exposure, misinformation, child safety, copyright violation, and others. A single input can trigger multiple categories at once.<\/li>\n
  4. Refusal detection<\/strong> (compliance \/ refusal), tracked separately to help measure over-refusal (when a model refuses safe requests) and detect false compliance (when a model appears to comply but doesn\u2019t). If a refusal is detected, the response is automatically marked as safe.<\/li>\n<\/ol>\n

    Training Data and Fine-Tuning<\/strong><\/h2>\n

    GLiGuard was trained on a mixture of human-annotated and synthetically generated training data. For prompt safety, response safety, and refusal detection, the team used WildGuardTrain, a dataset of 87,000 human-annotated examples. For harm category and jailbreak strategy detection, labels for the unsafe samples were generated using GPT-4.1.<\/p>\n

    During early training, the model struggled to distinguish between similar harm categories like toxic speech and violence, so the team used Pioneer to generate supplemental synthetic data with edge cases targeting these fine-grained distinctions.<\/p>\n

    On the architecture side, GLiGuard was trained via full fine-tuning of the GLiNER2-base-v1 checkpoint for 20 epochs using the AdamW optimizer. GLiNER2 is Fastino\u2019s own architecture for multi-task text classification \u2014 a natural starting point for a model designed to score multiple label sets in one pass.<\/p>\n

    \n
    \"\"
    https:\/\/pioneer.ai\/blog\/gliguard-16x-faster-safety-moderation-with-a-small-language-model<\/figcaption><\/figure>\n<\/div>\n

    Benchmark Results: Accuracy and Speed<\/strong><\/h2>\n

    The research team evaluated GLiGuard across nine established safety benchmarks. These benchmarks cover both prompt and response classification, testing whether a model can identify harmful content, withstand adversarial attacks, distinguish between different types of harm, and avoid over-flagging safe content. Results use macro-averaged F1, a standard metric that balances precision and recall.<\/p>\n

    On accuracy:<\/strong><\/p>\n