HaloGuard 1.0: Building an Input Guard Around the Boundary, Not the Keyword

Guard models sit in front of an AI system and check each request before the system answers. The hard part is not the obvious cases. It is the requests that share words with harmful ones but mean something else.

This article summarises our paper, HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety, published on arXiv on 2 July 2026. HaloGuard 1.0 is a family of two input guards, with 0.8B and 4B parameters. It is a different model from HaloGuard EU, which is built to block output the EU AI Act bans or treats as high-risk. Everything below is what the paper reports.

01The hard cases sit on the boundary

A prompt can mention malware, weapons, fraud or self-harm and be entirely legitimate. It may come from defensive security work, journalism, legal analysis, historical research or support for victims. A guard that reacts to keywords blocks those people. A guard tuned to avoid that lets real harm through.

The paper treats this trade-off between false positives and false negatives as the central design problem.

02A constitution that specifies the data

Most guards are trained on a fixed list of categories, applied to data someone collected. HaloGuard 1.0 starts from a written constitution instead: 46 policies and 2,940 subcategories. For each area, the constitution says what to block and which legitimate contexts to keep, such as defensive analysis, historical and legal discussion, victim support, journalism, compliance review and high-level education.

The constitution then drives the rest: which examples are generated, how coverage is counted and how failures are analysed. The release holds 1,259,451 training records. The largest group, 602,769 records (47.9%), is harmless text that sits close to a harmful policy edge. It is there to teach the model what not to block.

The approach draws on Anthropic's Constitutional Classifiers, which showed that safety rules written in plain language can be used to generate training data (Sharma et al., 2025).

03Same words, opposite intent

The main tool is the paired counterfactual. For each harmful subcategory, the pipeline writes a benign mirror that keeps the topic and the sensitive vocabulary and changes only the intent. The mirror takes one of nine fixed angles: legal, historical, scientific, statistical, journalistic, policy, clinical or forensic, detection or enforcement, and etymological.

If a word such as "malware" or "firearm" appears on both sides of the line, the model cannot use the word to decide. It has to learn the intent.

The paper also separates two kinds of false positive. A boundary false positive is a safe prompt that sits near a harmful policy edge. A baseline false positive is an ordinary prompt that is blocked for no good reason. The corpus has separate data for each.

0446 languages, both sides of the line

The multilingual data is built in three steps. The English corpus comes first. The harmful examples and their benign mirrors are then translated into each target language. A release planner combines the pieces. Language is treated as a surface form that appears on both sides of the boundary, not as a sign of attack.

The paper states a limit: every translated record is in a single language, so mixed-language prompts are only partly covered.

05What the paper reports

Across seven prompt-safety benchmarks, the 0.8B model reaches an average F1 of 90.9, with a false-positive rate of 4.3% and a false-negative rate of 9.5%. The paper compares it with eight open guard models from 0.6B to 27B parameters, and reports the 0.8B model 3.9 points ahead of the strongest of them on average F1.

The 4B model reaches an average F1 of 92.1, with a false-positive rate of 4.7% and a false-negative rate of 7.7%, in the paper's results table.

These are measurements of prompt-level moderation on public benchmarks. The paper says they should not be read as evidence of end-to-end agent safety.

06What it does not do

HaloGuard 1.0 classifies the prompt before the model answers. It does not read responses, monitor streaming output or inspect tool calls. It does not enforce permissions, check retrieved documents or secure autonomous agents on its own.

The paper calls it one layer in a defence in depth, to sit alongside output monitoring, tool permissions, rate limiting, logging and human escalation.

07The red-teaming protocol

The paper also describes a red-teaming protocol that runs in rolling seven-day cycles. In a four-day window, an open group of red-teamers attacks a guarded agent that can use tools. In a three-day window, the successful attacks are curated and used to retrain the guard. The next cycle then starts against the updated guard.

The paper describes the protocol but does not yet report results from it. It lists a published "hardening curve" across successive guard versions as future work.

08Read the paper

HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety, arXiv, 2 July 2026.

Both HaloGuard 1.0 models are released as open weights on Hugging Face, under the Apache 2.0 licence.

Sharma et al., Constitutional classifiers: defending against universal jailbreaks across thousands of hours of red teaming, 2025.