Research map / Large language models / Retrieval and knowledge

$R^2$-Guard: Robust Reasoning Enabled LLM Guardrail via Knowledge-Enhanced Logical Reasoning

ICLR 2025 · Large language models › Retrieval and knowledge · approach: Knowledge graph reasoning with LLMs · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes R²-Guard, an LLM safety guardrail that combines category-specific unsafety classifiers with probabilistic graphical model reasoning (Markov logic networks or probabilistic circuits) over first-order safety-category rules, and introduces the TwinSafety benchmark.

Problem

Existing LLM guardrail models treat safety categories independently and learn safety knowledge implicitly, causing ineffectiveness on correlated long-tail categories, vulnerability to jailbreaks, and inflexibility to new categories.

Approach

Encode inter-category safety knowledge as weighted first-order logical rules compiled into a probabilistic graphical model (MLN or layered probabilistic circuit), which takes per-category unsafety probabilities from data-driven classifiers and outputs a calibrated overall unsafety probability; rule weights are learned by pseudo-learning on simulated scores or real learning on labeled data.

Key results

• R²-Guard (MLN) reaches average AUPRC 0.869 across six datasets versus 0.816 for the best baseline (Ensemble), and 0.903 vs 0.885 on ToxicChat for the top baseline.
• Against four jailbreak attacks on AdvBench, R²-Guard keeps UDR near 1.0 for GCG variants and 0.945-0.948 on AutoDAN, with average UDR 0.987 versus 0.747 for Ensemble.
• PC reasoning matches MLN average AUPRC (0.869) while using about 6% of MLN reasoning time (0.0062 s vs 0.1123 s per instance).

Measured effects reported in the paper

Surprising findings

• Under PAIR and TAP attacks, R²-Guard's detection rate drops substantially (to about 0.58 and 0.37), which the authors attribute partly to attack prompts becoming semantically less harmful.
• Pseudo-learning of knowledge weights, using only simulated scores, performs on par with real learning on in-distribution data.

Limitations

• Requires manual specification of safety categories and first-order knowledge rules, which takes human effort.
• Performance on TwinSafety remains lower (AUPRC 0.758), indicating the benchmark remains challenging.
• PAIR and TAP attacks reduce robustness, and the evaluation of these attacks may be unfair since prompts are reformulated to be less harmful.

Experimental setup

Datasets: OpenAI Mod ToxicChat XSTest Overkill BeaverTails AdvBench

Benchmarks: OpenAI Mod ToxicChat XSTest Overkill BeaverTails TwinSafety AdvBench

Metrics: AUPRC unsafety detection rate runtime per instance

Baselines: Detoxify Perspective Azure OpenAI Mod LlamaGuard ToxicChat-T5 CoT Ensemble

Builds on: Markov logic networks probabilistic circuits LlamaGuard ToxicChat-T5

Closest papers by meaning

• RSafe: Incentivizing proactive reasoning to build robust and adaptive LLM safeguards (NeurIPS 2025 · similarity 0.91)
• Reasoning as an Adaptive Defense for Safety (NeurIPS 2025 · similarity 0.89)
• UpSafe℃: Upcycling for Controllable Safety in Large Language Models (NeurIPS 2026 · similarity 0.89)
• Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models (ICLR 2025 · similarity 0.88)
• Safety Recovery in Reasoning Models Is Only a Few Early Steering Steps Away (ICML 2026 · similarity 0.88)
• GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning (NeurIPS 2025 · similarity 0.88)