PGuard safeguards multimodal large language models during streaming generation
PGuard: A Native, Streaming, and Plug-in Guardrail for Multimodal Large Language Models
Computation and Language
Summary
Ensuring AI models behave safely while generating text or images as they work is hard. The authors created PGuard, a system that watches the model’s own internal steps to spot unsafe content quickly and without slowing it down much. This lets the model stop or change output in real-time instead of relying on separate external checks. Tests show PGuard works well across many languages and types of content, nearly matching dedicated safety tools while being more integrated.
What this means in practice
- •For ai developers: Integrate native, token-level safety checks directly into large multimodal models for real-time generation monitoring without affecting model behavior.
- •For ai service operators: Deploy scalable guardrails in live AI model serving environments to detect and prevent unsafe or harmful output with minimal runtime overhead.
Authors
Junyu Lin, Mengjie Wu, Yonghao Dong, Yuchuan Fu, Jinfeng Li, Xiaodan Li, Xiaohan Yuan, Yicheng Liu, Yuefeng Chen, Hui Xue, Jingyi Wang, Yitong Yang, Jiyuan Fu, Qinga He
Abstract
As streaming generation becomes the dominant serving paradigm for both text-only and multimodal large language models, ensuring safety throughout the generation process has become a critical challenge. We introduce PGuard, a native, streaming, and plug-in guardrail that transforms safety monitoring from an external serving dependency into an integrated capability of the backbone model. PGuard directly leverages the backbone's intermediate representations for token-level safety detection, without altering its original inference pathway or generation behavior. Specifically, dynamic layer gating selectively aggregates residual-stream representations across layers to extract safety-relevant signals during both prefill and autoregressive decoding. To balance detection accuracy and computational efficiency, PGuard supports multiple representation-modeling architectures, including a lightweight stateless variant and sequence-aware variants built on multi-scale causal EMA-attention and GRU-based recurrent modules. Its design also accounts for the execution characteristics of LLM serving frameworks, such as SGLang, optimizing computation and data access to minimize additional runtime and synchronization overhead. As a result, PGuard incurs only 0.82-2.26% end-to-end overhead on the hundred-billion-parameter backbone Qwen3.5-122B-A10B served by SGLang. Extensive evaluations across more than 30 benchmarks spanning text and multimodal safety, jailbreaks, cyber and CBRN risks, multilingual scenarios, and real-world traffic demonstrate state-of-the-art performance among native guardrails. On text queries with Qwen3.5-9B, PGuard achieves an average F1 score of 0.836, approaching dedicated external guardrails, while supporting deployment-time configuration of category-specific thresholds and enforcement actions.