DT-Guard: 4B-Parameter Model Outperforms 8B Guardrails by Separating Reasoning Supervision from Inference Speed

Safety guardrails for language models face a persistent architectural dilemma: systems that explicitly reason about safety decisions are robust but slow, while fast classifiers are efficient but brittle against carefully crafted attacks. In production environments this tradeoff limits deployment — you sacrifice either throughput or robustness. DT-Guard, developed by a research team of 15 authors, offers a solution that demands no compromise between these two options.

The Core Problem with Existing Safety Guardrails

Existing approaches fall into two categories with a clear tradeoff. CoT-based guardrails generate explicit reasoning about why a given prompt or response is harmful or safe — high robustness and resistance to circumvention, but the latency of generating chain-of-thought text is unacceptable for production environments with high throughput.

Direct classifiers do not carry this cost: they produce a binary or categorical label without intermediate steps, making them far faster. At the same time, they do not internalize the context of safety reasoning, making them vulnerable to prompts that carefully vary phrasing to bypass learned patterns. Both approaches share the same fundamental problem: explicit reasoning and low latency are mutually exclusive in a single architecture.

Why Reasoning Supervision in Training but Not in Inference?

DT-Guard separates these two requirements by execution phase. Training uses chain-of-thought supervision: the model is shown detailed reasoning trajectories about safety assessments — with the intent that the model internalizes patterns of safety thinking, not just learns to map input to a label. Inference then emits only structured safety labels without generating explicit CoT text.

This is conceptually related to knowledge distillation, applied to the reasoning process rather than the parameter distribution. The model learns how to think about safety through training, and applies the learned knowledge directly in classification without visible intermediate steps. The result is a guardrail that possesses the robustness of the CoT approach with the latency of a direct classifier — making it the first solution that does not choose between these two dimensions.

The Progressive Decision Path and RG-PHO Optimization

The safety assessment in DT-Guard is not a one-step flat classification but a structured three-level sequence: Intent → Category → Safety. The model first assesses the intent behind the query or generated response, then categorizes the type of risk, and finally makes the safety decision. Each level provides context that refines the next, outperforming approaches that directly skip to a binary safety label.

For identifying hard training examples, RG-PHO (Rollout-Guided Progressive Hard-Case Optimization) is used. The system generates multiple rollouts for the same query and uses inconsistency between rollouts — cases where different rollouts yield different labels — as a signal identifying examples on which the model is uncertain. Those examples receive amplified focus in training, systematically improving robustness on edge and ambiguous cases that are typically the most challenging for safety systems.

Results with the 4-Billion-Parameter Model

DT-Guard was evaluated on a benchmark testing both directions of safety assessment — evaluating user prompts and evaluating model responses. Results with a model of just 4B parameters:

• Prompt-side F1: 0.886 — precision of harmful prompt detection
• Response-side F1: 0.870 — precision of harmful response detection
• Dual-side average F1: 0.878

Particularly significant is that these results are achieved with a 4B-parameter model that outperforms 8B baseline models fine-tuned for safety. This ratio suggests that the internalization of reasoning supervision in training compensates for the parameter capacity deficit — knowledge about safety reasoning compresses into parameters more efficiently than it grows with model size under standard training.

For production this has concrete implications. A guardrail system with lower latency and smaller compute requirements can be deployed more aggressively in a pipeline — for example, on every API call without a noticeable impact on throughput. Larger, slower guardrails are often used selectively due to cost, leaving parts of the system unprotected. DT-Guard reduces that cost to the point where full coverage is also economically justified. The combination of low latency, high accuracy, and a smaller model makes it the first guardrail fulfilling all three production requirements without compromise.