HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety

2026-07-02 · Source: Computation and Language · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

HaloGuard 1.0 is an open-weights constitutional classifier designed for AI input safety, achieving state-of-the-art performance on English and multilingual prompt-safety benchmarks. This model is significantly smaller, roughly one-tenth the size of current leading open guard models. Its core is a natural-language constitution comprising 46 policies and 2,940 subcategories, which drives synthetic data generation using exhaustive one-to-one paired counterfactuals. The system employs a two-tier harmless design to target both boundary and baseline false positives and features balanced multilingual materialization across 46 languages. HaloGuard 1.0-0.8B achieved an average F1 of 90.9, with a false-positive rate (FPR) of 4.3 and a false-negative rate (FNR) of 9.5, outperforming baselines up to 27B parameters. The 4B variant reached an average F1 of 92.1 and an FPR of 3.5, prioritizing precision. An always-on adversarial red-teaming protocol continuously hardens the guard.

Key takeaway

For AI Security Engineers implementing multilingual AI safety, HaloGuard 1.0 offers a compelling open-weights solution. You can achieve state-of-the-art prompt safety with models significantly smaller than current alternatives, reducing deployment costs and complexity. Consider integrating this constitutional classifier, particularly its 0.8B or 4B variants, to enhance your system's defense against content-level and agentic attacks across 46 languages, while benefiting from its continuous adversarial hardening.

Key insights

HaloGuard 1.0 offers a small, open-weights constitutional classifier achieving state-of-the-art multilingual AI input safety through synthetic data and red-teaming.

Principles

• Constitutional classifiers can achieve high safety with smaller models.
• Synthetic counterfactual data generation improves robustness.
• Multilingual safety requires treating language as a surface form.

Method

Generate synthetic data using a 46-policy, 2,940-subcategory constitution with paired counterfactuals. Apply a two-tier harmless design and balanced multilingual materialization. Continuously harden with adversarial red-teaming.

In practice

• Deploy 0.8B parameter models for high-performance safety.
• Use open-weights constitutional classifiers for multilingual input safety.
• Implement adversarial red-teaming for continuous hardening.

Topics

• HaloGuard 1.0
• Constitutional Classifier
• AI Safety
• Multilingual AI
• Prompt Safety
• Open Weights Models

Best for: AI Engineer, NLP Engineer, CTO, AI Scientist, AI Security Engineer, Machine Learning Engineer

Related on AIssential

• RedVox: Safety and Fairness Gaps in Speech Models Across Languages — Speech models exhibit significant safety and fairness vulnerabilities, especially in non-English languages and with spoken input.
• OSGuard: A Benchmark for Safety in Computer-Use Agents — OSGuard's dual-granularity benchmark reveals current guardrails excel locally but fail to ensure end-to-end safety in computer-use agents.
• CHILLGuard: Towards Fine-Grained Chinese LLM Safety Guardrail with Scalable Data Construction and Model-aware Preference Alignment — CHILLGuard offers a fine-grained Chinese LLM safety guardrail via scalable data construction and model-aware preference alignment.
• The Multilingual AI Gap Is Not Closing. It Is Being Rebranded. — Linguistic inclusion in AI requires community control and governance, not just more data or better benchmark scores.
• Fastino Labs Open-Sources GLiGuard: A 300M Parameter Safety Moderation Model That Matches or Exceeds Accuracy of Models 23–90x Its Size — GLiGuard redefines safety moderation by using a small encoder for fast, multi-task text classification.
• Global Standards, Local Ground Truths: Piloting Multilingual, Multimodal AI Safety Understanding in APAC — AI safety and appropriateness are culturally subjective, necessitating localized ground truths and multimodal understanding.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Computation and Language.