用预测未来危害代替检测安全边界，实现低延迟大模型输出安全防护。
Predict, Don't React: Value-Based Safety Forecasting for LLM Streaming
- 将流式输出安全判断转化为对后续内容危害值的预测，避免依赖精确边界标注。
- 在8B模型上流式输出调和F1提升至81.9，误漏率从7.9%降至4.9%。
- 方法可跨分词器和模型迁移，小模型也能达到98.2的流式防护准确率。
在实际大模型部署中，单一防护机制常同时用于提示与响应的审核。提示审核基于完整文本，而流式响应审核需在部分生成时做出安全判断。现有文本流式防护多将问题视为边界检测，训练模型识别最早不安全前缀。本文提出StreamGuard，一种统一的、模型无关的流式防护机制，将审核任务转化为预测：给定部分前缀，模型预判未来可能的有害程度。通过蒙特卡洛回溯进行监督，实现早期干预，无需精确的逐标记边界注释。在标准安全基准测试中，StreamGuard在输入审核与流式输出审核上表现优异。8B规模下，输入审核F1由86.7升至88.2，流式输出审核F1由80.4升至81.9，优于Qwen3Guard-Stream-8B-strict。在QWENGUARDTEST响应定位测试中，达97.5 F1、95.1召回率、92.6%及时干预率，误漏率从7.9%降至4.9%。此外，基于预测的监督可有效跨分词器与模型族迁移：使用转移目标后，Gemma3-StreamGuard-1B实现81.3响应审核F1、98.2流式F1及3.5%误漏率。结果表明，无需精确边界标签即可实现强端到端流式防护，预测未来风险是低延迟安全干预的有效策略。
原文摘要 · Abstract (English)
In many practical LLM deployments, a single guardrail is used for both prompt and response moderation. Prompt moderation operates on fully observed text, whereas streaming response moderation requires safety decisions to be made over partial generations. Existing text-based streaming guardrails commonly frame this output-side problem as boundary detection, training models to identify the earliest prefix at which a response has already become unsafe. In this work, we introduce StreamGuard, a unified model-agnostic streaming guardrail that instead formulates moderation as a forecasting problem: given a partial prefix, the model predicts the expected harmfulness of likely future continuations. We supervise this prediction using Monte Carlo rollouts, which enables early intervention without requiring exact token-level boundary annotations. Across standard safety benchmarks, StreamGuard performs strongly both for input moderation and for streaming output moderation. At the 8B scale, StreamGuard improves aggregated input-moderation F1 from 86.7 to 88.2 and aggregated streaming output-moderation F1 from 80.4 to 81.9 relative to Qwen3Guard-Stream-8B-strict. On the QWENGUARDTEST response_loc streaming benchmark, StreamGuard reaches 97.5 F1, 95.1 recall, and 92.6% on-time intervention, compared to 95.9 F1, 92.1 recall, and 89.9% for Qwen3Guard-Stream-8B-stric, while reducing the miss rate from 7.9% to 4.9%. We further show that forecasting-based supervision transfers effectively across tokenizers and model families: with transferred targets, Gemma3-StreamGuard-1B reaches 81.3 response-moderation F1, 98.2 streaming F1, and a 3.5% miss rate. These results show that strong end-to-end streaming moderation can be obtained without exact boundary labels, and that forecasting future risk is an effective supervision strategy for low-latency safety intervention.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。