Pith. sign in

REVIEW 3 major objections 6 minor 39 references

A Dual-Hypothesis Reasoning Framework for LLM Guardrails

T0 review · 3 major / 6 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ARBITER claims that a guardrail which explicitly constructs and compares a safe and an unsafe interpretation of each prompt before deciding can outperform reasoning-based and non-reasoning guardrails, including models trained on traces from

desk verdict A well-specified, cheaper reasoning-guardrail method that overstates its OOD superiority in the abstract and in Section 5.1, and whose tables disagree on key numbers. read the letter →

arxiv 2607.17575 v1 pith:5OTLDPVK submitted 2026-07-20 cs.AI

Md Asiful Islam , Mihai Surdeanu This is my paper
classification cs.AI
keywords LLMguardrailsdual-hypothesisreasoningmulti-componentsupervisedfine-tuning(MC-SFT)self-generatedtracesLoRAexplanationfaithfulnessout-of-domaingeneralizationsafetymoderation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes ARBITER, an 8-billion-parameter guardrail that, before labeling a prompt safe or unsafe, first argues the strongest benign reading and the strongest harmful reading, then deliberates between them. It claims this dual-hypothesis reasoning, trained with a component-weighted loss called MC-SFT on the model's own self-generated reasoning traces, outperforms existing reasoning-based and non-reasoning guardrails—including models trained on traces distilled from much larger proprietary teachers—while providing faithful evidence-phrase explanations. The most consequential claim is out-of-domain: across three safety benchmarks, the model is best in five of six cross-dataset comparisons, suggesting the two-sided deliberation generalizes better than single-trajectory reasoning. A sympathetic reader would care because, if correct, it makes strong, explainable moderation cheap to build and update without relying on expensive teacher models.

What carries the argument

Dual-hypothesis reasoning is a structured decoding chain: a safe hypothesis, an unsafe hypothesis, a deliberation that compares them, a winner token, and a JSON output with label and explanation. MC-SFT decomposes the training target into five components—reasoning, winner, label, explanation, syntax—and applies a masked, weighted cross-entropy to each, plus an auxiliary alignment loss that pulls the deliberation's pooled hidden state toward the hypothesis matching the gold label and, for unsafe prompts, toward the explanation. The combination is what allows the model to be trained on its own 24-token hypotheses with LoRA and still match or beat full fine-tuning on teacher-distilled reasoning

What would settle it

Take the self-generated training traces, replace every unsafe hypothesis with a generic, safe-sounding sentence, and retrain the same model with MC-SFT. If safe/unsafe decisions and deliberation outputs remain nearly unchanged, then the model is not actually weighing the unsafe interpretation, and the dual-hypothesis machinery is not carrying the result.

Watch

Extended reading notes

Core claim

The central claim is that explicitly reasoning over both the safe and unsafe interpretation of a prompt before making a safety decision—rather than following a single reasoning trajectory—improves safety classification and explanation. The paper further claims that the MC-SFT loss, which weights the final label and evidence phrases more heavily than intermediate reasoning and formatting tokens, is necessary to get this benefit from self-generated traces, and that the resulting evidence phrases are faithful: deleting cited spans from an unsafe prompt systematically reduces the model's unsafe confidence, with a mean AOPC of 0.531 across settings.

Load-bearing premise

The central assumption is that the base model's own short self-generated hypotheses are informative enough that the training loss teaches genuine evidence comparison rather than teaching the model to rationalize the gold label.

Editorial extensions

If this is right

  • An 8B open model trained with LoRA can match or beat reasoning guardrails that were fully fine-tuned on traces from much larger proprietary teachers, on three safety benchmarks.
  • Out-of-domain transfer improves: ARBITER is the best model in five of six out-of-domain comparisons, indicating the contrastive reasoning helps under distribution shift.
  • Evidence-phrase explanations are causally connected to decisions: deleting the cited spans reduces unsafe probability from 0.99 to as low as 0.19, with positive comprehensiveness at every deletion step.
  • Because training uses self-generated traces and parameter-efficient fine-tuning, updating a guardrail for a new safety taxonomy costs far less than retraining with distilled reasoning.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves open whether the gains come from the contrastive structure itself or from the auxiliary alignment loss pulling deliberation toward the gold label; a variant that removes the winner token and alignment loss would isolate the mechanism.
  • The same dual-hypothesis template could be ported to other asymmetric-cost classification tasks, such as medical triage or fraud screening, where explicitly weighing a benign and a harmful reading before deciding is natural.
  • The fixed token budgets (24/24/40) are an engineering choice, not a necessity; scaling them up may further improve deliberation quality, and the paper's comparisons do not test that tradeoff.
  • The faithfulness result is measured by deletion only; a complementary test would be to perturb non-cited words and show the unsafe confidence stays high, which would rule out the model relying on unmentioned cues.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. ARBITER is a guardrail framework that (i) generates two competing interpretations — a safe hypothesis and an unsafe hypothesis — plus a deliberation before predicting a safety label, and (ii) trains with a multi-component supervised fine-tuning (MC-SFT) loss that weights reasoning, winner, label, explanation, and syntax tokens separately, including an auxiliary loss aligning deliberation representations with the label-matched hypothesis. The authors use Llama-3.1-8B-Instruct to self-generate reasoning traces offline, then fine-tune with LoRA, avoiding teacher distillation and full-parameter tuning. Experiments on AEGIS2.0, WildGuardMix, and ToxicChat0124 report prompt-classification F1 and explainability F1, plus a deletion-based faithfulness analysis. The paper claims ARBITER outperforms existing reasoning and non-reasoning guardrails, with strong out-of-domain generalization, and that its evidence-phrase explanations are faithful.

Significance. The core idea is appealing: a compact open model trained on its own reasoning traces could match or beat expensive teacher-distilled reasoning guardrails while also providing faithful span-level explanations. If the results are reproducible and the claims are accurately stated, this would be a meaningful step toward cost-effective, interpretable guardrails. The paper includes broad comparisons, ablations, multiple seeds, and a faithfulness analysis, which are strengths. However, the reported numbers contain internal inconsistencies, and several headline claims are contradicted by the paper's own tables. These issues currently prevent acceptance, though they are addressable with corrections and additional statistical analysis.

major comments (3)
  1. [§5.1, Table 1, Abstract] The claim that 'ARBITER-aegis2.0 outperforms all reported approaches when evaluated on WildGuardMix and ToxicChat0124' is false as stated. Table 1 shows GuardReasoner-8B scores 89.02 on WildGuardMix versus ARBITER-aegis2.0's 84.23, and 74.80 on ToxicChat0124 versus 71.81. GuardReasoner is indeed trained on those datasets, so a proper comparison should be restricted to models trained on the same source data, but the unqualified sentence and the abstract's 'clear gains in out-of-domain evaluations' overstate the result. Please revise to acknowledge that ARBITER does not beat GuardReasoner's in-domain numbers on those two benchmarks, and qualify the out-of-domain claim accordingly. Also, the in-domain WildGuardMix difference over GuardReasoner-8B (89.10 vs 89.02) is within the reported standard deviation (0.20), so a significance test is needed before claiming superiority.
  2. [Tables 1/2 vs Tables 3/4] There are unexplained numerical inconsistencies for identical ARBITER configurations. For example, ARBITER-toxicchat0124 on AEGIS2.0 is 78.86 in Table 1 but 80.06 in Tables 3 and 4; ARBITER-wildguardmix on WildGuardMix is 89.10 in Table 1 but 88.87 in Tables 3 and 4. The paper states that Table 1 reports averages over three seeds with standard deviations in Table 6, but does not clarify whether Tables 3 and 4 use the same seeds, checkpoints, or evaluation subsets. Please reconcile these numbers or explain the discrepancy; as written, the paper's main results are not internally reproducible.
  3. [§3.2.1, Eq. (4), Table 4] The auxiliary reasoning-alignment loss L_hyp-delib may be teaching label rationalization rather than genuine evidence comparison. The winner token is fixed by the prompt label, and L_hyp-delib pushes the deliberation representation toward the gold-label hypothesis. With possibly weak self-generated hypotheses on out-of-domain prompts, this could encourage the model to justify the label after the fact. The ablation in Table 4 is consistent with this concern: removing the auxiliary alignment loss improves in-domain prompt classification on AEGIS2.0 (87.75 vs 87.09) and on ToxicChat0124 (83.64 vs 82.16). The paper should provide an analysis of whether the deliberation genuinely favors the hypothesis with stronger textual support, for example on adversarial or constructed examples where the safe and unsafe hypotheses have different degrees of support. At minimum, discuss this limitation expl
minor comments (6)
  1. [Abstract] The abstract repeats 'novel' twice in adjacent sentences ('two novel ideas' and 'two novel ideas'); this can be streamlined.
  2. [§5.1] The paragraph on GuardReasoner says ARBITER 'outperforms GuardReasoner on all three in-domain test sets.' For WildGuardMix, the margin over GuardReasoner-8B is only 0.08 F1 and is within one standard deviation; a significance test or confidence interval should be reported.
  3. [Appendix A] The MC-SFT hyperparameters (λr, λw, λy, λe, λsyn, λa) are stated to be chosen by intuition and not tuned on test sets. It would be helpful to report a sensitivity analysis for these weights, since the method's advantage depends on their balance.
  4. [§3.2.1, Eq. (4)] Treating cosine similarities in [-1,1] as logits is an unusual choice; a brief justification or reference would improve clarity. Negative logits are not an issue in principle, but the authors should explain why cosine similarity is appropriate as a logit for a two-class softmax.
  5. [Tables 3 and 4] Tables 3 and 4 do not report standard deviations, unlike Tables 1 and 2. Please add them or state that they are the same runs as in Tables 1 and 2.
  6. [Appendix B] The faithfulness analysis is limited to true positives and does not include a comparison to random-span deletion or an alternative-explanation baseline. The positive AOPC scores are consistent with faithful explanations, but a random baseline would strengthen the claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: central safety-classification and faithfulness claims rest on external benchmarks and post-hoc perturbation tests, not on fitted targets.

full rationale

ARBITER's main claim—that it outperforms existing reasoning and non-reasoning guardrails—is evaluated against external models (GuardReasoner, Llama Guard, WildGuard, AEGIS, LEG) on public datasets. The training procedure (Section 3.2) uses gold labels and self-generated reasoning traces in a supervised loss; the MC-SFT loss (Eqs. 1-5) reweights tokens and aligns hidden representations, but it does not define the benchmark F1 scores as functions of its own parameters, nor are the out-of-domain evaluations fit to those test sets. The explanation component is the only self-referential part: explanation supervision uses the authors' LEG-1.0 annotations (Section 4) and the sole span-level baseline is the authors' LEG model (Section 5.2). This narrows the external evidence for the explainability comparison, but it is not load-bearing for the main classification result, and Appendix B's faithfulness analysis is a standard deletion-based perturbation of the trained model's own outputs, not a tautological re-statement of the training loss. The inconsistency between the abstract/§5.1 claim that ARBITER-aegis2.0 outperforms all approaches on WildGuardMix/ToxicChat and Table 1 (GuardReasoner-8B: 89.02 vs 84.23 on WildGuardMix; 74.80 vs 71.81 on ToxicChat) is an empirical correctness problem, not circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

Nothing new is postulated beyond output-schema artifacts (steering tokens, winner token, JSON fields). The central claim rests on public benchmark labels, the authors' own LEG-1.0 span annotations, hand-set loss weights and token budgets, the cosine-as-logits scaling choice, and the standard deletion-based faithfulness proxy.

free parameters (3)
  • MC-SFT loss weights λr, λw, λy, λe, λsyn, λa = 0.1, 0.5, 1.0, 1.0, 0.1, 0.2
    Hand-chosen from the intuition in Section 3.2.1 (Appendix A); not test-set tuned, but the claimed benefit of the full loss is partly carried by these weights, and ablations (Table 4) show removing λa can improve in-domain scores.
  • Reasoning token budgets = 24 / 24 / 40 tokens (safe, unsafe, deliberation)
    Fixed to control inference cost (Appendix A); with a 24-token budget the self-generated hypotheses are short, and trace quality is an assumption of the self-generation strategy.
  • LoRA and training hyperparameters = r=16, α=32, dropout=0.05, lr=2e-4, 3 epochs, batch 8, grad accum 32, warmup 0.03
    Standard PEFT/training choices; needed to reproduce but not load-bearing for the method's claim.
assumptions (4)
  • domain assumption Gold labels in AEGIS2.0, WildGuardMix, and ToxicChat0124 are accurate, and the three datasets can be compared across in-domain and out-of-domain settings.
    All evaluations treat dataset labels as ground truth (Section 4); cross-dataset out-of-domain comparisons assume the labels define safety comparably.
  • domain assumption LEG-1.0 explanation spans (from the authors' prior work) are correct supervision for what makes prompts unsafe.
    Explanation training uses the LEG-1.0 extension of the datasets (Section 4); noisy spans would degrade explanation supervision and the EC scores.
  • ad hoc to paper Cosine similarities in [-1,1] can be treated as logits in the hypothesis-deliberation alignment loss.
    Equations (3)-(4) apply cross-entropy to raw cosine similarities without a temperature or scaling justification; a design choice specific to this paper.
  • domain assumption Deletion-based comprehensiveness and AOPC (Eqs. 6-7) validly measure explanation faithfulness.
    Appendix B assumes that a drop in unsafe probability after deleting cited spans proves causal reliance; a standard but imperfect proxy.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Dual-Hypothesis Reasoning Framework for LLM Guardrails." pith.science (2026). https://pith.science/paper/5OTLDPVK

@misc{pith2026260717575,
  author       = {Pith},
  title        = {Pith review of: A Dual-Hypothesis Reasoning Framework for LLM Guardrails},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5OTLDPVK}},
  note         = {Machine review of arXiv:2607.17575}
}
read the original abstract

We propose ARBITER, a novel LLM guardrail framework that introduces two key ideas: (i) dual-hypothesis reasoning, a reasoning method for LLM guardrails that explicitly considers both safe and unsafe interpretations of a prompt before making a safety decision, and (ii) multi-component supervised fine-tuning (MC-SFT), a structured training loss for reasoning-based guardrails that decomposes LLM outputs into logical components and weights them according to their importance. Existing reasoning-based guardrails often rely on expensive procedures, such as generating reasoning traces using larger or closed-source teacher models and applying full-parameter fine-tuning. In contrast, ARBITER uses a cost-effective self-generation strategy for reasoning traces and LoRA-based parameter-efficient fine-tuning while still achieving better performance than these expensive approaches. Additionally, ARBITER provides faithful evidence-phrase explanations for unsafe decisions, enabling a more transparent and interpretable guardrail method. Experiments on three safety moderation benchmarks show that ARBITER outperforms existing reasoning-based and non-reasoning guardrail baselines, with clear gains in out-of-domain evaluations.

Figures

Figures reproduced from arXiv: 2607.17575 by the authors.

Figure 1
Figure 1. for an example). MC-SFT is designed to better supervise learn￾ing from self-generated reasoning traces. Standard supervised fine-tuning averages cross-entropy over all target output tokens. This is suboptimal for rea￾soning based guardrail training: mistakes in the final safety label or evidence phrases are more con￾sequential than minor errors in intermediate reason￾ing or repeated output formatting tokens. Moreove… view at source ↗
Figure 2
Figure 2. Overview of the proposed dual-hypothesis reasoning guardrail. (A) Reasoning generation reuses the [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

39 extracted references · 2 canonical work pages

  1. [1]

    2025 , eprint=

    Confirmation Bias in Generative AI Chatbots: Mechanisms, Risks, Mitigation Strategies, and Future Research Directions , author=. 2025 , eprint=

    2025

  2. [2]

    , journal=

    O’Leary, Daniel E. , journal=. Confirmation and Specificity Biases in Large Language Models: An Explorative Study , year=

  3. [3]

    Focal Loss for Dense Object Detection , year=

    Lin, Tsung-Yi and Goyal, Priya and Girshick, Ross and He, Kaiming and Dollár, Piotr , journal=. Focal Loss for Dense Object Detection , year=

  4. [4]

    Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , month =

    Kendall, Alex and Gal, Yarin and Cipolla, Roberto , title =. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , month =

  5. [5]

    Advances in neural information processing systems , volume=

    Deep reinforcement learning from human preferences , author=. Advances in neural information processing systems , volume=

  6. [6]

    Advances in Neural Information Processing Systems , volume=

    Direct preference optimization: Your language model is secretly a reward model , author=. Advances in Neural Information Processing Systems , volume=

  7. [7]

    Advances in Neural Information Processing Systems , volume=

    Chain-of-Thought Prompting Elicits Reasoning in Large Language Models , author=. Advances in Neural Information Processing Systems , volume=

  8. [8]

    International Conference on Learning Representations , year=

    Self-Consistency Improves Chain of Thought Reasoning in Language Models , author=. International Conference on Learning Representations , year=

Show all 39 references
  1. [9]

    and Shen, Yelong and Wallis, Phillip and Allen-Zhu, Zeyuan and Li, Yuanzhi and Wang, Shean and Wang, Lu and Chen, Weizhu , booktitle=

    Hu, Edward J. and Shen, Yelong and Wallis, Phillip and Allen-Zhu, Zeyuan and Li, Yuanzhi and Wang, Shean and Wang, Lu and Chen, Weizhu , booktitle=. 2022 , url=

    2022

  2. [10]

    2024 , eprint=

    Building Guardrails for Large Language Models , author=. 2024 , eprint=

    2024

  3. [11]

    2023 , eprint=

    Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations , author=. 2023 , eprint=

    2023

  4. [12]

    arXiv preprint arXiv:2404.05993 , year=

    AEGIS: Online Adaptive AI Content Safety Moderation with Ensemble of LLM Experts , author=. arXiv preprint arXiv:2404.05993 , year=

    arXiv

  5. [13]

    Why Should I Trust You?

    “Why Should I Trust You?”: Explaining the Predictions of Any Classifier , author =. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) , year =

  6. [14]

    Advances in Neural Information Processing Systems , volume=

    Beavertails: Towards improved safety alignment of llm via a human-preference dataset , author=. Advances in Neural Information Processing Systems , volume=

  7. [15]

    arXiv preprint arXiv:2408.17003 , year=

    Safety layers in aligned large language models: The key to llm security , author=. arXiv preprint arXiv:2408.17003 , year=

    arXiv

  8. [16]

    2024 , eprint=

    WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs , author=. 2024 , eprint=

    2024

  9. [17]

    2025 , eprint=

    GuardReasoner: Towards Reasoning-based LLM Safeguards , author=. 2025 , eprint=

    2025

  10. [18]

    Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages =

    Chu, Zhixuan and Wang, Yan and Li, Longfei and Wang, Zhibo and Qin, Zhan and Ren, Kui , title =. Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages =. 2024 , isbn =. doi:10.1145/3658644.3690217 , abstract =

    2024

  11. [19]

    2024 , eprint=

    ShieldGemma: Generative AI Content Moderation Based on Gemma , author=. 2024 , eprint=

    2024

  12. [20]

    2025 , eprint=

    DuoGuard: A Two-Player RL-Driven Framework for Multilingual LLM Guardrails , author=. 2025 , eprint=

    2025

  13. [21]

    2025 , eprint=

    OneShield -- the Next Generation of LLM Guardrails , author=. 2025 , eprint=

    2025

  14. [22]

    International Conference on Learning Representations (ICLR) , year=

    Bootstrapping Language Models with DPO Implicit Rewards , author=. International Conference on Learning Representations (ICLR) , year=

  15. [23]

    Forty-second International Conference on Machine Learning , year=

    InfAlign: Inference-aware language model alignment , author=. Forty-second International Conference on Machine Learning , year=

  16. [24]

    2022 , eprint=

    Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback , author=. 2022 , eprint=

    2022

  17. [25]

    2025 , eprint=

    Constitution or Collapse? Exploring Constitutional AI with Llama 3-8B , author=. 2025 , eprint=

    2025

  18. [26]

    How Effective Is Constitutional

    Antonio-Gabriel Chac. How Effective Is Constitutional. ICLR 2025 Workshop on Human-AI Coevolution , year=

    2025

  19. [27]

    and Lee, Su-In , title =

    Lundberg, Scott M. and Lee, Su-In , title =. Proceedings of the 31st International Conference on Neural Information Processing Systems , pages =. 2017 , isbn =

    2017

  20. [28]

    Kang, Mintong and Li, Bo , booktitle =. R\^

  21. [29]

    A Lightweight Explainable Guardrail for Prompt Safety

    Islam, Md Asiful and Surdeanu, Mihai. A Lightweight Explainable Guardrail for Prompt Safety. Proceedings of the 64th Annual Meeting of the A ssociation for C omputational L inguistics (Volume 1: Long Papers). 2026. doi:10.18653/v1/2026.acl-long.2017

    2026 doi

  22. [30]

    Safety Through Reasoning: An Empirical Study of Reasoning Guardrail Models

    Sreedhar, Makesh Narsimhan and Rebedea, Traian and Parisien, Christopher. Safety Through Reasoning: An Empirical Study of Reasoning Guardrail Models. Findings of the Association for Computational Linguistics: EMNLP 2025. 2025. doi:10.18653/v1/2025.findings-emnlp.1193

    2025 doi

  23. [31]

    2025 , eprint=

    Deliberative Alignment: Reasoning Enables Safer Language Models , author=. 2025 , eprint=

    2025

  24. [32]

    T hink G uard: Deliberative Slow Thinking Leads to Cautious Guardrails

    Wen, Xiaofei and Zhou, Wenxuan and Mo, Wenjie Jacky and Chen, Muhao. T hink G uard: Deliberative Slow Thinking Leads to Cautious Guardrails. Findings of the Association for Computational Linguistics: ACL 2025. 2025. doi:10.18653/v1/2025.findings-acl.704

    2025 doi

  25. [33]

    , title =

    Turpin, Miles and Michael, Julian and Perez, Ethan and Bowman, Samuel R. , title =. Proceedings of the 37th International Conference on Neural Information Processing Systems , articleno =. 2023 , publisher =

    2023

  26. [34]

    2026 , eprint=

    YuFeng-XGuard: A Reasoning-Centric, Interpretable, and Flexible Guardrail Model for Large Language Models , author=. 2026 , eprint=

    2026

  27. [35]

    Faithfulness Tests for Natural Language Explanations

    Atanasova, Pepa and Camburu, Oana-Maria and Lioma, Christina and Lukasiewicz, Thomas and Simonsen, Jakob Grue and Augenstein, Isabelle. Faithfulness Tests for Natural Language Explanations. 2023. doi:10.18653/v1/2023.acl-short.25

    2023 doi

  28. [36]

    ERASER : A Benchmark to Evaluate Rationalized NLP Models

    DeYoung, Jay and Jain, Sarthak and Rajani, Nazneen Fatema and Lehman, Eric and Xiong, Caiming and Socher, Richard and Wallace, Byron C. ERASER : A Benchmark to Evaluate Rationalized NLP Models. 2020. doi:10.18653/v1/2020.acl-main.408

    2020 doi

  29. [37]

    AEGIS 2.0: A Diverse AI Safety Dataset and Risks Taxonomy for Alignment of LLM Guardrails

    Ghosh, Shaona and Varshney, Prasoon and Sreedhar, Makesh Narsimhan and Padmakumar, Aishwarya and Rebedea, Traian and Varghese, Jibin Rajan and Parisien, Christopher. AEGIS 2.0: A Diverse AI Safety Dataset and Risks Taxonomy for Alignment of LLM Guardrails. Proceedings of the 2...

    2025 doi

  30. [38]

    T oxic C hat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User- AI Conversation

    Lin, Zi and Wang, Zihan and Tong, Yongqi and Wang, Yangkun and Guo, Yuxin and Wang, Yujia and Shang, Jingbo. T oxic C hat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User- AI Conversation. 2023. doi:10.18653/v1/2023.findings-emnlp.311

    2023 doi

  31. [39]

    N e M o Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails

    Rebedea, Traian and Dinu, Razvan and Sreedhar, Makesh Narsimhan and Parisien, Christopher and Cohen, Jonathan. N e M o Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails. 2023. doi:10.18653/v1/2023.emnlp-demo.40

    2023 doi

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.