{"id":"20366f7a-6c9b-4de2-aecb-6d2f0fdc1df5","arxiv_id":"2607.06326","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":3,"one_line_summary":"A 4B LLM safety guardrail trained with reasoning supervision but deployed with reasoning-free inference outperforms 8B baselines on safety benchmarks.","lead":"DT-Guard trains a 4B-parameter safety guardrail model using reasoning chains during training but emits only structured safety labels at inference, eliminating the latency of chain-of-thought generation. A smart generalist might read it to understand how to decouple training-time reasoning from deployment-time efficiency in content moderation.","discovery_kind":"unclear","skeptic_critique":{"model":"glm-5.2","headline":"The 4B-beats-8B claim is primarily enabled by the proprietary 811k dataset, not the reasoning-active training paradigm; Stage1-SFT-v0 (no intent, no CoT) already reaches 0.851, nearly matching Qwen3Guard-8B at 0.858.","rationale":"The reader's identified weakest assumption is exactly the right one. The ablation in Table 9 is internally consistent and shows clear incremental gains from each RG-PHO component, which is commendable. However, the framing of the headline claim conflates two separable achievements: (1) a strong proprietary dataset that enables a 4B model to nearly match 8B baselines even with vanilla SFT, and (2) a training paradigm that adds +2.7 F1 points on top. The paper's title and abstract emphasize (2), but the '4B beats 8B' headline is primarily enabled by (1). This is not an internal inconsistency — the ablations are honest and the gains are real — but it is a framing issue that affects how the contribution should be interpreted. The concern would be fully resolved by either (a) releasing the dataset for independent verification, (b) training v0 on a comparable public dataset to show the method works without the proprietary data advantage, or (c) training an 8B model with v0 on the same data to show the scale gap is real and RG-PHO closes it. The verdict remains CONDITIONAL because the method shows genuine incremental value in the ablations, but the headline claim is confounded by the data advantage and lack of release.","tokens_in":12816,"tokens_out":2447,"duration_ms":229447,"concrete_test":"Train Qwen3-4B and Qwen3-8B with identical Stage1-SFT-v0 configuration (binary SFT, no intent, no CoT) on the same 811k dataset. If 4B-v0 ≈ 8B-v0 (within ~1 point), then model scale is not the bottleneck and the dataset is the primary driver of the competitive result, weakening the '4B beats 8B' framing. If 8B-v0 significantly exceeds 4B-v0, then RG-PHO is genuinely closing a real scale gap. Additionally, training v0 on a public dataset of comparable scale (e.g., combining WildGuardMix + Aegis + BeaverTails, ~800k samples) would isolate whether the proprietary data or the method drives the gains.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The reader correctly identifies the central confound. Table 9 shows that Stage1-SFT-v0 — a plain Qwen3-4B fine-tuned on the 811k corpus with only binary safe/unsafe labels, no intent labels, no CoT, no RG-PHO — already achieves a dual-side average F1 of 0.851, which is within 0.7 points of Qwen3Guard-8B (0.858) and already exceeds YuFeng-XGuard-Reason-8B (0.845). The entire RG-PHO pipeline (intent labels, selective CoT, hard-case SFT, DPO) adds +2.7 points on top (0.851 → 0.878). This means roughly 70% of the gap to the best 8B baseline is closed by the dataset alone, and only the remaining ~2 points are attributable to the training paradigm the paper centers as its contribution. The headline framing — 'with only a 4B backbone, outperforming strong 8B guardrail baselines' — implicitly attributes the competitive result to the reasoning-active training method, but the ablation shows the dataset is the primary enabler. Furthermore, the baselines (Qwen3Guard, YuFeng-XGuard) are trained on their own proprietary data of unknown scale and quality, so the comparison conflates training data, model scale, and training method. Without knowing whether the 8B baselines had access to comparable data, the '4B beats 8B' claim cannot be cleanly attributed to either the dataset or the method. The paper does not release the dataset or code, making independent verification impossible.","agreement_with_reader":"agree"},"referee_report":{"model":"glm-5.2","summary":"The paper presents DT-Guard, a 4B-parameter safety guardrail model that uses reasoning supervision (intent labels, chain-of-thought trajectories, hard-case SFT, and rollout-contrastive DPO) during training while emitting only structured labels at inference time. The core idea is to internalize reasoning without incurring inference-time latency. The authors construct an 811k-sample intent-driven corpus and propose Rollout-Guided Progressive Hard-Case Optimization (RG-PHO), a three-stage pipeline that stratifies training samples by multi-rollout consistency and applies targeted SFT or DPO accordingly. Experiments on 10 prompt-side and 7 response-side benchmarks show DT-Guard achieving a dual-side average F1 of 0.878, outperforming 8B baselines. The progressive ablation (Table 9) demonstrates that each RG-PHO stage contributes incremental gains over the Stage1-SFT-v0 baseline.","tokens_in":13759,"tokens_out":1299,"duration_ms":322189,"significance":"The reasoning-active training, reasoning-free inference paradigm addresses a genuine practical tension in deployed guardrails. The progressive ablation in Table 9 is a commendable design choice that isolates each component's contribution. The rollout-consistency-based sample stratification (§4.2) is a principled mechanism for routing hard cases to the appropriate optimization objective. The intent-driven decision structure (Intent → Category → Safety) provides a clean intermediate supervision signal. However, the significance of the methodological contribution is partially obscured by the confound between the proprietary 811k dataset and the RG-PHO pipeline itself, which the ablation structure does not fully resolve. Neither the dataset nor the code is publicly available, which limits independent verification.","major_comments":[{"comment":"§5.2, final paragraph: The claim that 'the gain therefore comes primarily from intent-driven supervision and RG-PHO rather than model scale' is supported by the comparison against larger baselines, but the ablation in Table 9 reveals a more nuanced picture that the paper does not adequately address. Stage1-SFT-v0 (no intent, no CoT, no RG-PHO) already achieves a dual-side average F1 of 0.851, which exceeds YuFeng-XGuard-Reason-8B (0.845) and nearly matches Qwen3Guard-8B (0.858). The entire RG-PHO pipeline adds +2.7 points (0.851 → 0.878). This means a substantial portion of the competitive advantage over 8B baselines is attributable to the 811k proprietary dataset alone, not to the reasoning-active training paradigm that the paper centers as its primary contribution. The paper should explicitly acknowledge this decomposition and reframe the headline claim accordingly. As currently stated","section":null},{"comment":"§5.1–5.2, Tables 5–7: The baseline comparison conflates training data, model scale, and training method. The 8B baselines (Qwen3Guard-8B, YuFeng-XGuard-Reason-8B) are trained on their own proprietary data of unknown scale and quality. Without knowing whether these baselines had access to comparable data resources, the '4B beats 8B' framing cannot be cleanly attributed to either the dataset or the method. The paper should either (a) provide a baseline trained on the same 811k corpus with a comparable 8B backbone to isolate the method's contribution from data effects, or (b) explicitly state that the comparison conflates these factors and temper the attribution claims. This is load-bearing for the central claim that reasoning-active training is the primary driver of the competitive result.","section":null}],"minor_comments":[{"comment":"§4.2: The choice of K=3 rollouts is stated without justification. A brief discussion of why three rollouts suffice for reliable stratification, or a sensitivity analysis over K, would strengthen the rollout-consistency design.","section":null},{"comment":"§4.4, Eq. (3): The value of β (preference strength) is not specified. This and other hyperparameters (learning rate, batch size, number of epochs per stage) should be reported for reproducibility.","section":null},{"comment":"§3.2: The GLM-5.1 distillation prompts and the expert verification criteria are not described in detail. Providing the annotation schema or example prompts would aid reproducibility.","section":null},{"comment":"§3.3: The target Safe:Unsafe:Borderline ratio of 5.5:4:0.5 is stated without justification. Was this ratio selected empirically? A brief rationale or ablation over alternative ratios would help.","section":null},{"comment":"Figure 4: The diagram is dense and some labels are difficult to read. The flow of data through the three stages could be clarified by simplifying or enlarging the figure.","section":null},{"comment":"Table 5: The prompt-side F1 values for some benchmarks (e.g., SimpST, HarmB) show near-perfect scores (0.995–1.000) across multiple models. A brief discussion of ceiling effects on these benchmarks would help contextualize the average F1 comparisons.","section":null},{"comment":"The dataset and code are not publicly available. While proprietary constraints may prevent full release, providing evaluation scripts or a data sample would support independent verification of the reported results.","section":null}],"recommendation":"major_revision","confidential_remarks":"The reader's report correctly identifies the central confound: the ablation shows the dataset does most of the heavy lifting relative to 8B baselines, while RG-PHO adds a meaningful but smaller increment. This is not a fatal flaw — the +2.7 points from RG-PHO is a real contribution — but the paper's framing overstates the method's role. The authors should be asked to reframe the contribution claims and, if possible, add a same-data 8B baseline to disentangle data scale from method. The paper is within scope for the journal but needs honest attribution before publication."},"author_rebuttal":{"model":"glm-5.2","summary":"We thank the referee for a careful and constructive review. The referee raises two related points about attribution: (1) the Stage1-SFT-v0 baseline already achieves strong performance, suggesting the 811k dataset contributes substantially to the competitive advantage over 8B baselines, and (2) the baseline comparison conflates training data, model scale, and training method, making it impossible to cleanly attribute the '4B beats 8B' result to the reasoning-active training paradigm. Both points are well-taken. We agree that the current framing overstates the attribution to RG-PHO and does not adequately acknowledge the role of the dataset. We will revise the manuscript to explicitly decompose the contribution and temper the headline claim. We cannot fully resolve the data-scale confound with 8B baselines because we lack access to their proprietary training corpora, but we will state this limitation transparently.","responses":[{"response":"The referee is correct. The decomposition is as follows: Stage1-SFT-v0, which uses the 811k corpus with standard SFT and no intent labels, CoT, or RG-PHO, already achieves 0.851 dual-side average F1, exceeding YuFeng-XGuard-Reason-8B (0.845) and nearly matching Qwen3Guard-8B (0.858). The full RG-PHO pipeline then adds +2.7 points on top of this baseline (0.851 → 0.878). This means the competitive advantage over 8B baselines has two distinct sources: (a) the 811k intent-driven dataset, which accounts for the bulk of the gap relative to 8B baselines, and (b) the reasoning-active training paradigm (intent labels, selective CoT, hard-case SFT, rollout-contrastive DPO), which provides an additional +2.7 points. The current claim that the gain comes 'primarily from intent-driven supervision and RG-PHO rather than model scale' is imprecise because it does not distinguish between the dataset contribution and the method contribution. We will revise §5.2 to explicitly present this decomposition, acknowledge that a substantial portion of the competitive advantage over 8B baselines is attributable to the dataset, and reframe the headline claim to state that RG-PHO provides a meaningful incremental improvement on top of an already strong data-driven baseline. We will also add a sentence in the abstract and introduction clarifying that the 4B-vs-8B advantage reflects both data quality and training methodology.","revision_made":"yes","referee_comment":"§5.2, final paragraph: The claim that 'the gain therefore comes primarily from intent-driven supervision and RG-PHO rather than model scale' is supported by the comparison against larger baselines, but the ablation in Table 9 reveals a more nuanced picture that the paper does not adequately address. Stage1-SFT-v0 (no intent, no CoT, no RG-PHO) already achieves a dual-side average F1 of 0.851, which exceeds YuFeng-XGuard-Reason-8B (0.845) and nearly matches Qwen3Guard-8B (0.858). The entire RG-PHO pipeline adds +2.7 points (0.851 → 0.878). This means a substantial portion of the competitive advantage over 8B baselines is attributable to the 811k proprietary dataset alone, not to the reasoning-active training paradigm that the paper centers as its primary contribution. The paper should explicitly acknowledge this decomposition and reframe the headline claim accordingly."},{"response":"The referee is correct that the baseline comparison conflates training data, model scale, and training method. The 8B baselines (Qwen3Guard-8B, YuFeng-XGuard-Reason-8B) are trained on their own proprietary corpora, whose scale and quality we cannot inspect. Without controlling for training data, the '4B beats 8B' result cannot be cleanly attributed to either the dataset or the method. Regarding option (a): we considered training an 8B backbone on the same 811k corpus to isolate the method's contribution from data effects. However, this experiment requires computational resources beyond what is available for this revision cycle, and we cannot honestly report results we have not yet obtained. We therefore adopt option (b): we will explicitly state in §5.1–5.2 that the baseline comparison conflates training data, model scale, and training method, and that the '4B beats 8B' framing reflects the combined effect of our data pipeline and training methodology rather than the training method alone. We will also temper the attribution claims throughout the paper, including in the abstract, introduction, and conclusion, to avoid implying that reasoning-active training is the sole or primary driver of the competitive result. The within-method ablation in Table 9 (which controls for data by holding the corpus fixed and varying only the training procedure) does provide a clean estimate of RG-PHO's contribution (+2.7 points), and we will foreground this as the primary evidence for the method's effectiveness rather than the cross-baseline comparison.","revision_made":"yes","referee_comment":"§5.1–5.2, Tables 5–7: The baseline comparison conflates training data, model scale, and training method. The 8B baselines (Qwen3Guard-8B, YuFeng-XGuard-Reason-8B) are trained on their own proprietary data of unknown scale and quality. Without knowing whether these baselines had access to comparable data resources, the '4B beats 8B' framing cannot be cleanly attributed to either the dataset or the method. The paper should either (a) provide a baseline trained on the same 811k corpus with a comparable 8B backbone to isolate the method's contribution from data effects, or (b) explicitly state that the comparison conflates these factors and temper the attribution claims. This is load-bearing for the central claim that reasoning-active training is the primary driver of the competitive result."}],"tokens_in":12778,"tokens_out":1262,"duration_ms":202148,"standing_objections":[]},"desk_editor":{"model":"glm-5.2","letter":"The core idea here is simple and practical: train a safety guardrail with chain-of-thought and intent supervision, then at inference time emit only structured labels — no reasoning traces. That sidesteps the latency problem that makes reasoning-based guards hard to deploy. The RG-PHO pipeline — rollout consistency to stratify hard cases, then targeted SFT for persistent failures and DPO for preference-unstable ones — is a reasonable, well-motivated design. The ablations in Table 9 are genuinely informative: full CoT training actually hurts (-2.3 F1) when CoT is disabled at inference, while selective CoT on borderline samples helps (+0.9). That's a useful finding for anyone building guardrails. The rollout-consistency stratification is a clean idea — using model behavior to route samples to the right optimization objective rather than treating all errors uniformly. Credit for that. The progressive ablation from v0 through Stage3-DPO is the right experimental structure, and the paper reports it honestly. Now the soft spot, and it's a real one. Stage1-SFT-v0 — plain Qwen3-4B fine-tuned on the 811k corpus with binary labels, no intent, no CoT, no RG-PHO — already hits 0.851 dual-side average F1. That's within 0.7 points of Qwen3Guard-8B (0.858). The entire RG-PHO pipeline adds +2.7 points on top. So roughly 70% of the gap to the best 8B baseline is closed by the dataset alone. The headline framing — '4B beats 8B' — implicitly credits the training method, but the ablation shows the proprietary 811k dataset is the primary enabler. The baselines are trained on their own proprietary data of unknown scale, so the comparison conflates data, model size, and method. Without a controlled data comparison, you can't cleanly attribute the competitive result to the reasoning-active paradigm. No code or data is released, which limits verification. The reader's concern about this confound is correct and lands squarely. That said, the +2.7 from RG-PHO is not nothing — it's a real, measured gain with a sensible mechanism behind it. The paper is for practitioners building low-latency safety guardrails who want to know whether reasoning supervision can be internalized. The answer is yes, with caveats about how much of the gain comes from the method versus the data. It deserves a serious referee who can push on the data confound and ask for at least a controlled comparison holding data constant.","headline":"Train with reasoning, infer without: a solid guardrail pipeline where the dataset does more heavy lifting than the method","tokens_in":13910,"tokens_out":605,"would_cite":false,"duration_ms":126599,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"glm-5.2","headline":"4B guardrail beats 8B rivals by reasoning at training, not inference","keywords":["safety guardrail","reasoning internalization","chain-of-thought","direct preference optimization","content moderation","rollout consistency","hard-case optimization"],"falsifier":"If a model trained on the same 811k dataset with standard SFT and no reasoning supervision, intent labels, or RG-PHO stages achieved comparable F1 scores, the core claim that reasoning internalization drives the improvement would be undermined.","tokens_in":12964,"feed_emoji":"🛡️","tokens_out":795,"duration_ms":164434,"temperature":0.7,"pith_summary":"DT-Guard proposes a safety guardrail model that uses reasoning supervision during training while emitting only structured labels at inference time. The core claim is that explicit chain-of-thought reasoning, when used as a training signal rather than a deployment-time output, can be internalized into a smaller model to improve safety discrimination without adding latency. The paper formulates safety judgment as a progressive decision process—Intent → Category → Safety—and introduces a three-stage training pipeline called RG-PHO that uses multi-rollout consistency to identify stably mastered, persistently failed, and preference-unstable samples, then applies targeted supervised fine-tuning or contrastive preference optimization to each group. With a 4B-parameter backbone, DT-Guard achieves average F1 scores of 0.886 on prompt-side and 0.870 on response-side safety benchmarks, outperforming 8B guardrail baselines while requiring no reasoning-chain generation at deployment.","feed_headline":"4B guardrail beats 8B rivals by reasoning at training, not inference","feed_subtitle":"DT-Guard internalizes chain-of-thought supervision during training, then emits only structured safety labels at deployment—halving model","key_machinery":"Reasoning-Active Training, Reasoning-Free Inference","core_discovery":"The central mechanism is the separation of reasoning supervision from reasoning inference. During training, DT-Guard mixes chain-of-thought outputs with structured-label outputs, selectively assigning CoT to borderline and ambiguous cases while using compact labels for clear cases. After initial training, the model is rolled out three times per sample: samples that are correct 3/3 times are set aside, samples correct 0/3 times receive supervised correction with CoT, and samples correct 1/3 or 2/3 times become preference pairs for DPO. This rollout-consistency-based stratification routes each residual error to the optimization method best matched to its failure type. At inference, the model直接","pith_inferences":[],"forward_implications":["Smaller guardrail models trained with internalized reasoning could replace larger or slower reasoning-based guards in latency-sensitive production systems, reducing both compute cost and response time for real-time content moderation.","The rollout-consistency stratification method is domain-agnostic: it could be applied to any classification task where a model produces variable outputs across repeated generations, such as medical triage, legal risk assessment, or fraud detection.","The finding that selective CoT allocation to borderline cases outperforms both full-CoT and no-CoT training suggests that reasoning supervision is most valuable exactly where decision boundaries are ambiguous, not uniformly across all samples."],"fun_headline_variants":["DT-Guard internalizes reasoning during training to skip it at inference","A 4B safety guardrail beats 8B models by training with reasoning","Training with reasoning, skipping it at inference yields better guardrails","DT-Guard uses reasoning in training but not inference for safety labels","4B guardrail drops inference-time reasoning to match 8B safety models"],"cache_read_input_tokens":0,"weakest_assumption_plain":"The paper attributes its performance gains to the reasoning-active training paradigm and the RG-PHO pipeline, but the 811k-sample proprietary training dataset—built via distillation from a large model and expert verification—may itself be the primary driver. The ablation shows the baseline variant without intent or CoT already achieves a dual-side average F1 of 0.851, close to the 0.858 of an 8B baseline, making it difficult to isolate how much of the final 0.878 comes from","fun_headline_variants_meta":{"raw":{"variants":["DT-Guard internalizes reasoning during training to skip it at inference","A 4B safety guardrail beats 8B models by training with reasoning","Training with reasoning, skipping it at inference yields better guardrails","DT-Guard uses reasoning in training but not inference for safety labels","4B guardrail drops inference-time reasoning to match 8B safety models"]},"model":"glm-5.2","effort":"high","cost_usd":0.0,"raw_usage":{"total_tokens":1064,"prompt_tokens":639,"completion_tokens":425,"prompt_tokens_details":null},"tokens_in":639,"tokens_out":425,"duration_ms":19064,"temperature":1.0,"reasoning_tokens":331,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-08T09:39:26.707387+00:00","model_set":{"reader":"glm-5.2"},"falsifier":"If a model trained on the same 811k dataset with standard SFT and no reasoning supervision, intent labels, or RG-PHO stages achieved comparable F1 scores, the core claim that reasoning internalization drives the improvement would be undermined.","supporting_citations":[],"review_version":1}