轻量级安全过滤器不需推理也能高效准确，比传统方法快100倍。
Do Safety Guardrails Need to Reason? LeanGuard: A Fast and Light Approach for Robust Moderation
- 用仅含标签的轻量编码器替代复杂推理链，单次前向传播完成判断
- 395M模型在多个公开数据集上平均F1达82.90，媲美大模型推理系统
- 抗噪声能力强，严控误报率下召回率更高，适合设备端部署
为筛选提示或回复，现有安全防护方法在决策前生成思维链（CoT），认为逐步推理能提升判断质量。然而，这种设计使模型负担重、速度慢，且常需在设备端运行，如具身机器人。本文质疑：安全防护是否真需推理？通过在同一语料上训练轻量双向编码器与推理型防护模型，并仅移除推理部分，保持其余不变进行对比，发现思维链并未提升检测准确率。由此提出的轻量防护器名为LeanGuard。一个395M的仅标签编码器在多个公开基准上平均F1达82.90±0.26，性能相当于基于更大解码器的推理型防护，但仅需一次前向传播处理最多512个标记，推理计算量减少约100倍。此外，该编码器对训练标签噪声具有鲁棒性，在严格假阳性率下仍保持更高召回率，表明更重的推理模型并非更可靠。研究暗示当前评测基准可能不足以体现推理价值，且思维链在内容审核中的必要性尚未证实。项目代码与模型已开源。
原文摘要 · Abstract (English)
In order to screen a prompt or a response, the recent guardrail methods generate a chain-of-thought (CoT) before they issue a verdict. This design follows a common belief that step-by-step reasoning improves a decision. However, CoT also makes the guard heavy and slow, because the model must generate many tokens before it decides. This may not match how guardrails are actually deployed. A guardrail sometimes should not be heavy and slow, and it often runs on-device, for example on an embodied robot. In this paper, we pose a question whether a safety guardrail really needs to reason. To answer this question, we train a lightweight bidirectional encoder and a reasoning guard on the same corpus, and we then remove only the reasoning while we keep everything else fixed. With this controlled same-base comparison, we show that the chain does not improve moderation accuracy. We name the resulting guard LeanGuard. A 395M label-only encoder reaches an average F1 of 82.90 $\pm$ 0.26 over public benchmarks. It matches a reasoning guard that is built on a much larger decoder, while it uses only a single forward pass over an input of at most 512 tokens. This is about a ~100x reduction in inference compute. We further show that this label-only encoder stays robust under training-label noise and retains far more recall at a strict false-positive rate than the reasoning guard, so a heavier reasoning guard is not the more robust choice either. Our finding suggests that the current guardrail benchmarks may not be hard enough to reward reasoning, and that the necessity of CoT for moderation is still not proven. We release all source codes and models including LeanGuard at https://github.com/ndb796/LeanGuard.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。