Ensuring safe, policy-compliant outputs from large language models requires real-time content moderation that can scale across multiple safety dimensions. However, state-of-the-art guardrail models rely on autoregressive decoders with 7B--27B parameters, reformulating what is fundamentally a classification problem as sequential text generation, a design choice that incurs high latency and scales poorly to multi-aspect evaluation. In this work, we introduce \textbf{GLiGuard}, a 0.3B-parameter schema-conditioned bidirectional encoder adapted from GLiNER2 for LLM content moderation. The key idea is to encode task definitions and label semantics directly into the input sequence as structured token schemas, enabling simultaneous evaluation of prompt safety, response safety, refusal detection, 14 fine-grained harm categories, and 11 jailbreak strategies in a single non-autoregressive forward pass. This schema-conditioned design lets supported task and label blocks be composed directly in the input schema at inference time. Across nine established safety benchmarks, GLiGuard achieves F1 scores competitive with 7B--27B decoder-based guards despite being 23--90$\times$ smaller, while delivering up to 16$\times$ higher throughput and 17$\times$ lower latency. These results suggest that compact bidirectional encoders can approach the accuracy of much larger guard models while drastically reducing inference cost. Code and models are available at https://github.com/fastino-ai/GLiGuard.

翻译：[translated abstract in Chinese] 确保大语言模型的安全、符合策略输出需要进行实时内容审核，该审核需能扩展至多个安全维度。然而，现有最先进的防护模型依赖具有7B至27B参数的自回归解码器，将本质上属于分类问题简化为序列文本生成，这种设计选择导致高延迟并难以扩展至多维度评估。本文提出 \textbf{GLiGuard}——一种基于GLiNER2改进的0.3B参数模式条件双向编码器，用于大语言模型内容审核。核心思路是将任务定义与标签语义直接编码至输入序列作为结构化标记模式，使其能在单次非自回归前向传播中同时评估提示安全性、响应安全性、拒绝检测、14个细粒度危害类别及11种越狱策略。这种模式条件设计使得支持的任务和标签模块可在推理时直接组合至输入模式中。在九个成熟安全基准测试中，尽管GLiGuard体积仅有7B至27B解码器防护模型的23至90分之一，其F1分数与之相当，同时吞吐量提升高达16倍、延迟降低17倍。结果表明紧凑型双向编码器可在显著降低推理成本的同时，达到与更大规模防护模型相当的准确率。代码与模型已发布于https://github.com/fastino-ai/GLiGuard。