Research map / Large language models / Reasoning and chain of thought

LPG: Balancing Efficiency and Policy Reasoning in Latent Policy Guardrails

NeurIPS 2026 · Large language models › Reasoning and chain of thought · approach: Efficient and adaptive thinking · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes LPG, a policy-aware guardrail that compresses intent and policy-risk deliberation into 10 continuous latent tokens on Qwen3-4B, trained with teacher hidden-state distillation and summary reconstruction, achieving near-reasoning accuracy at ~11x lower latency than Qwen3-4B-Thinking.

Problem

Dynamic policy-aware safety guardrails must reason over user-supplied policy lists at inference time, but non-reasoning guardrails are brittle to policy ordering and counterfactual edits while explicit reasoning guardrails are too slow for real-time moderation.

Approach

Replace explicit intent and policy-analysis reasoning with stage-aligned continuous latent slots supervised by (i) teacher summary reconstruction routed through the base LM, (ii) answer-position all-layer hidden-state distillation and stage-boundary distillation, plus clause-anchored verdicts.

Key results

• LPG-4B reaches 84.52% average safety accuracy and 77.85 F1 across GuardSet-X and DynaBench (Aug), with 748 ms average latency versus 9747 ms for Qwen3-4B-Thinking on GuardSet-X.
• LPG-4B scores 96.44 F1 on HarmBench and 84.09 F1 on WildGuardTest, the best among models for which those benchmarks are out-of-distribution.
• Removing the answer-position distillation sub-loss costs nearly 20 accuracy points; 10 latent tokens approach explicit reasoning accuracy at about 5x lower latency.

Surprising findings

• DynaGuard-8B's flip-to-safe rate under counterfactual removal of violated policies (36%) falls below its own full-policy verdict correctness.
• Qwen3-4B-Thinking's policy-order consistency rate rises from 79.6% to 89.1% with explicit reasoning, but shuffling still causes large verdict variance.

Limitations

• Latency gains are measured with single-sample batch-1 inference on one GPU type, and the paper reports narrow absolute gains on DynaBench (Aug) (72.19 vs 71.82 for DynaGuard-8B).
• Out-of-distribution benchmarks use synthesized policy lists for HarmBench and WildGuardTest, which may not reflect real deployment policies.
• Training depends on a Qwen3-32B teacher and teacher-generated rationales conditioned on gold labels.

Experimental setup

Datasets: DynaBench GuardSet-X BeaverTails Aegis-AI Content Safety v2 SaladBench Toxic-Chat XSTest v2 HarmBench WildGuardTest PolicyGuardBench

Benchmarks: GuardSet-X DynaBench (Aug) DynaBench (Original) HarmBench WildGuardTest PolicyGuardBench

Metrics: safety accuracy safety F1 latency (ms) consistency rate

Baselines: Qwen3-4B Qwen3-4B-Thinking DynaGuard-4B DynaGuard-8B GuardReasoner-3B GuardReasoner-8B GPT-4o LlamaGuard3-8B ShieldGemma-9B

Builds on: COCONUT CODI DynaGuard Qwen3

Closest papers by meaning

• LiSA: Lifelong Safety Adaptation via Conservative Policy Induction (NeurIPS 2026 · similarity 0.88)
• DynaGuard: A Dynamic Guardian Model With User-Defined Policies (ICLR 2026 · similarity 0.86)
• ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning (ICML 2025 · similarity 0.86)
• SafeWatch: An Efficient Safety-Policy Following Video Guardrail Model with Transparent Explanations (ICLR 2025 · similarity 0.86)
• GuardAgent: Safeguard LLM Agents via Knowledge-Enabled Reasoning (ICML 2025 · similarity 0.86)
• $R^2$-Guard: Robust Reasoning Enabled LLM Guardrail via Knowledge-Enhanced Logical Reasoning (ICLR 2025 · similarity 0.86)