14个开源安全模型实测，小模型反而更懂识别危险内容
Benchmarking Open-Source Safety Guard Models: A Comprehensive Evaluation
- 用8类安全风险数据集测试14个开源模型，聚焦真实有害内容
- 小模型Qwen Guard（4B）召回率达83.97%，大模型最高漏检75%
- 模型越大越保守，通用模型比专用模型更有效
随着大语言模型在安全关键场景中广泛应用，可靠的內容審核變得至關重要。本文對14個開源安全守衛模型進行全面評估，使用涵蓋8類NIST AI風險框架的79,331個樣本構建的專用基準測試集。該測試集整合四個多樣化數據集（HarmBench、StrongREJECT、RealToxicityPrompts、BeaverTails），並過濾僅保留與安全相關的內容（暴力、仇恨言論、騷擾、性內容、自殺/自殘、粗俗語、威脅、健康誤導信息）。結果顯示，召回率是安全應用中的關鍵指標，因漏檢有害內容比誤報風險更大。令人意外的是，參數量僅40億的Qwen Guard取得最高召回率（83.97%），而120億的Llama Guard和200億的GPT-OSS Safeguard表現保守，最多漏檢75%的不安全內容。研究證明模型規模與安全檢測性能無關，通用型守衛模型優於專用模型。這些發現為生產環境中選型提供實用指導。
原文摘要 · Abstract (English)
As Large Language Models (LLMs) are increasingly deployed in safety-critical applications, robust content moderation becomes essential. We present a comprehensive evaluation of 14 open-source safety guard models on a curated benchmark of 79,331 samples spanning 8 NIST AI Risk Framework safety categories. Our benchmark aggregates four diverse datasets (HarmBench, StrongREJECT, RealToxicityPrompts, and BeaverTails), filtered to focus exclusively on safety-relevant content (violence, hate speech, harassment, sexual content, suicide/self-harm, profanity, threats, and health misinformation). We find that recall is the critical metric for safety applications, as missing harmful content poses greater risk than false positives. Our evaluation reveals surprising results: Qwen Guard (4B parameters) achieves the highest recall (83.97%) while larger models like Llama Guard (12B) and GPT-OSS Safeguard (20B) exhibit conservative behavior, missing up to 75% of unsafe content. We demonstrate that model size does not correlate with safety detection performance and that general-purpose guard models outperform specialized ones. These findings provide practical guidance for selecting safety guard models in production deployments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。