Qwen3Guard Release: Real-time Safety Guardrails for LLMs

Qwen has released Qwen3Guard, the first safety guardrail model family within the Qwen ecosystem. Built on Qwen3 foundation models and fine-tuned for safety classification, Qwen3Guard provides precise detection of risks in both user prompts and model responses, assigning risk levels and categorized classifications to facilitate accurate content moderation.

Real-Time Streaming Safety Detection

Qwen3Guard-Stream enables low-latency, on-the-fly moderation during the token generation process. Unlike traditional guard models that evaluate text after it is fully generated, Qwen3Guard-Stream utilizes two lightweight classification heads attached to the transformer’s final layer. This architecture allows the model to process the response token-by-token as it is generated, outputting safety classifications instantly at each step to ensure safety without sacrificing responsiveness.

Model Variants and Deployment Options

Qwen3Guard is available in two specialized variants, each offered in 0.6B, 4B, and 8B parameter sizes to accommodate various resource constraints:

  • Qwen3Guard-Gen: A generative model designed to accept full user prompts and model responses. It is optimized for offline safety annotation, dataset filtering, and providing safety-based rewards for reinforcement learning (RL).
  • Qwen3Guard-Stream: A specialized model for real-time streaming safety detection during active response generation.

Three-Tier Severity Classification

To provide more flexibility than binary "Safe" or "Unsafe" labels, Qwen3Guard introduces a Controversial label. This three-tier system allows developers to implement dynamic safety policies based on their specific use case:

  • Strict Mode: Controversial instances can be reclassified as Unsafe.
  • Loose Mode: Controversial instances can be reclassified as Safe.

This design allows Qwen3Guard to maintain robust performance across different dataset standards that typically conflict under binary labeling constraints.

Multilingual Support and Global Reach

Qwen3Guard supports 119 languages and dialects, ensuring consistent safety performance across diverse linguistic environments. Supported language families include:

  • Indo-European: Including English, Spanish, French, German, Russian, Hindi, and Bengali.
  • Sino-Tibetan: Including Simplified Chinese, Traditional Chinese, Cantonese, and Burmese.
  • Afro-Asiatic: Including various Arabic dialects and Hebrew.
  • Austronesian: Including Indonesian, Malay, and Tagalog.
  • Dravidian: Including Tamil, Telugu, Kannada, and Malayalam.
  • Turkic: Including Turkish, Kazakh, and Uzbek.
  • Tai-Kadai: Thai and Lao.
  • Uralic: Finnish, Estonian, and Hungarian.
  • Austroasiatic: Vietnamese and Khmer.
  • Other: Including Japanese, Korean, Georgian, and Swahili.

Technical Implementation and Applications

Qwen3Guard-Gen Workflow

Qwen3Guard-Gen uses a chat template optimized for safety classification. It generates structured outputs that identify the safety label (Safe, Unsafe, or Controversial) and the specific risk category (e.g., Violent, PII, Sexual Content, or Copyright Violation). For response moderation, it also identifies if the model provided a refusal.

Qwen3Guard-Stream Workflow

Qwen3Guard-Stream operates in a two-stage process:

  1. Prompt-Level Check: The user's input is assessed immediately. If the prompt is deemed unsafe, the system can halt the conversation before the LLM begins generating a response.
  2. Token-Level Moderation: If the conversation proceeds, each token generated by the LLM is forwarded to Qwen3Guard-Stream in real time, allowing for dynamic risk mitigation throughout the generation process.

Advanced Use Cases

Beyond direct moderation, Qwen3Guard is used for:

  • Safety RL: Using Qwen3Guard-Gen to enhance model safety while maintaining helpfulness.
  • On-the-fly Intervention: Using Qwen3Guard-Stream to ensure safe outputs without requiring the underlying model to be re-trained.

Sources