Research map / Large language models / Instruction and fine-tuning

Safety Reconstructed: Generative Modeling via Masked Diffusion Builds Strong Safety Guardrails

NeurIPS 2026 · Large language models › Instruction and fine-tuning · approach: Safety alignment after fine-tuning · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes LLaDA-Guard, a guard model that fine-tunes the masked diffusion LLM LLaDA-8B-Instruct with LoRA to score moderated text under competing safe/unsafe label hypotheses via masked reconstruction, rather than predicting a verdict token.

Problem

Existing guard models predict a single verdict token from the conversation, which encourages shortcut features, overconfidence, miscalibration, and sensitivity to where safety evidence appears in the sequence.

Approach

Recast moderation as class-conditional generative scoring: the moderated region (prompt or response) is masked and reconstructed under unsafe vs. safe label conditions, and the log-likelihood-ratio gives the safety decision and a calibrated unsafe probability via sigmoid.

Key results

• Average F1 of 84.91 across mixed held-out datasets, best among compared guards (WildGuard 84.83, Qwen3Guard 8B 82.75), with AUPRC 92.66 vs. Qwen3Guard 8B 94.06.
• Average ECE 0.0875 vs. 0.1384 for Qwen3Guard 8B and 0.1091 for WildGuard.
• Prompt rewriting with masked localizer reaches 60.7% average conversion-to-safe rate at budget 5 vs. 52.1% best attention-based baseline (WildGuard).

Surprising findings

• Qwen3Guard has the highest average AUPRC yet trails on F1 and calibration, showing ranking strength does not imply usable fixed-threshold operating points.
• Same-weight direct-verdict ablation of LLaDA-Guard scores lower than the class-conditional scoring on all held-out datasets, with largest F1 gains on response datasets.

Limitations

• Evaluated only on English binary safe/unsafe benchmarks; no multilingual, multimodal, or policy-customized settings.
• Higher inference cost from multiple masked passes per label compared with single-token verdict guards.
• Calibration and robustness gains on tested benchmarks do not guarantee robustness to adaptive jailbreaks or distribution shift.

Experimental setup

Datasets: WildGuardMix Aegis 2.0

Benchmarks: ToxicChat OpenAI Moderation XSTest SafeRLHF BeaverTails XSTest-Response PHTest NotInject

Metrics: AUPRC F1 ECE Brier score NLL PHTest accuracy conversion-to-safe rate

Baselines: ShieldGemma Granite Guardian Llama Guard 3 Llama Guard 4 WildGuard NemoGuard Qwen3Guard

Builds on: LLaDA masked diffusion language models WildGuard

Closest papers by meaning

• On Prompt-Driven Safeguarding for Large Language Models (ICML 2024 · similarity 0.90)
• Navigating the Safety Landscape: Measuring Risks in Finetuning Large Language Models (NeurIPS 2024 · similarity 0.89)
• Safety Pretraining: Toward the Next Generation of Safe AI (NeurIPS 2025 · similarity 0.89)
• Representation Noising: A Defence Mechanism Against Harmful Finetuning (NeurIPS 2024 · similarity 0.88)
• Evolving Contextual Safety in Multi-Modal Large Language Models via Inference-Time Self-Reflective Memory (CVPR 2026 · similarity 0.88)
• HarmAug: Effective Data Augmentation for Knowledge Distillation of Safety Guard Models (ICLR 2025 · similarity 0.88)