FlagThis

Abstract

Large language models (LLMs) are increasingly moving beyond chat interfaces to agentic use cases where attack surfaces are exponentially bigger and downstream failures are catastrophically expensive. A practical defence-in-depth solution requires multiple layers with a pre-generation input guard serving as the first line of defense. The hard problem is not just raising obviously harmful requests but the boundary cases or the false-positive/false-negative (FP/FN) frontier. A guard must catch unsafe intent without over-refusing the legitimate prompts that may share the same safetysensitive vocabulary. We introduce HaloGuard 1.0, an open-weight family of constitutional input classifiers (0.8B and 4B, built on Qwen3.5 and trained as generative classifiers) designed exactly around that frontier. It draws inspiration from Anthropics Constitutional Classifiers (CCs) and is the first open weights implementation of that paradigm. HaloGuard 1.0 achieves state-of-the-art performance on English and multilingual prompt-safety benchmarks, with just one-tenth the model size of current leading open guard models. It makes the safety constitution the organising structure of the corpus, a natural language constitution of 46 constitutional policies and 2,940 subcategories which drives synthetic generation, with exhaustive 1:1 paired counterfactuals that hold topic and vocabulary fixed while flipping intent, a two-tier harmless design that separately targets boundary and baseline FPs, and a balanced multilingual materialisation across 46 languages that treats language as a surface form appearing on both sides of the boundary rather than as an adversarial signal. Across seven prompt-safety benchmarks, HaloGuard 1.0-0.8B attains the best average F1 (90.9) of any open guard we evaluate, outperforming baselines up to 27B parameters (over 30 times larger) while holding FP rate (FPR) to 4.3 and FN rate (FNR) to 9.5. The HaloGuard 1.0-4B variant pushes average F1 to 92.0 and FPR to 3.5, spending its extra capacity on precision rather than recall. A structured adjudication of the remaining failures indicates that most apparent missed-harm cases are benchmark mislabels rather than genuine model misses. An always-on adversarial red-teaming protocol continuously hardens the guard against both content-level and agentic attacks. We release this as open weights models.