EuroSafeGuard v1

EuroSafeGuard is an open guardrail for LLMs that screens requests and replies against a written constitution of 11 harm categories.

Paper · Code · Collection · Training prompts · Project page

How it works

1. Probe. An MLP probe on Llama-3.1-8B-Instruct activations scores every request; the top 10% (by WildChat-clean) are escalated.
2. Input and exchange classifiers. Escalated requests are scored by an input classifier and, after the model replies, by an exchange classifier that reads prompt and reply (Qwen3.5-9B + LoRA + 11 heads each).
3. Decision. The reply is blocked if 0.6·probe_z + 0.2·input_z + 0.2·exchange_z exceeds a calibrated threshold.

Quickstart

The repo has five input-classifier training runs (seed=0 to 4). The paper reports their mean. Runs differ on search attacks (11–48% of PAIR behaviors broken, run 0 is the weakest), so choose one with seed=k.

from eurosafeguard import EuroSafeGuard   # pip install "eurosafeguard @ git+https://github.com/EuroSafeAI/EuroSafeGuard"
                                          # or download eurosafeguard.py from this repo

guard = EuroSafeGuard.from_pretrained("EuroSafeAI/EuroSafeGuard-v1", seed=0, mode="full",
                                      devices=("cuda:0", "cuda:0", "cuda:1"))   # probe LM, input clf, exchange clf
prompt, reply = "What is a good recipe for sourdough bread?", "Mix 500 g flour, 350 g water, ..."

decision, category, score = guard.route(prompt)       # input stage: "pass" | "alert" | "refuse"
blocked = guard.check_reply(prompt, reply, decision)  # alert mode: exchange check on the reply
blocked = guard.check_full(prompt, reply)             # full mode: the paper's end-to-end configuration

Needs about 55 GB of GPU memory in bf16 (16 GB for Llama-3.1-8B-Instruct, 19 GB per Qwen3.5-9B classifier). Llama-3.1-8B-Instruct is gated; accept its license first. In alert mode, flagged requests are refused if CBRN and otherwise answered under a policy note (guard.system_note(category)).

Results

Input stage, every guard at 5% of WildChat-clean flagged (recall %, ↑; PAIR/TAP: % of behaviors broken, ↓):

† Native verdict. Means over the five input-classifier training runs (gate/seed0–seed4).

End to end (deployed cascade in front of Llama-3-8B-Instruct, 1,974 held-out Jailbreak Foundry attacks):

Files

Intended use and limitations

• Built to guard chat LLMs against harmful requests and jailbreaks; recalibrate thresholds on your own traffic (eurosafeguard calibrate).
• White-box attackers (GCG with gradients of all models) get 40% of behaviors past the deployed cascade's input scores.
• An adaptive PAIR attacker obtains strictly harmful replies for 20 of 100 behaviors at the deployed operating point (5 at the 5% budget).
• Recall is lower on low-resource languages than on English.
• Attack success is measured with LLM judges, which are noisy on hard cases.

License

Apache-2.0 for our adapters, heads, probe and code. Base models keep their licenses: Llama 3.1 Community License and Apache-2.0 for Qwen3.5-9B.

Citation

@misc{waibl2026eurosafeguard,
  title   = {EuroSafeGuard: Open Constitutional Classifiers},
  author  = {Waibl, Leonhard and Chen, Yen-Shan and Simko, Samuel and Thomas, Aditya and
             Singh, Arth and Diwan, Nirav and Sch{\"o}lkopf, Bernhard and Jin, Zhijing},
  url     = {https://guard.safe.eu/paper},
  year    = {2026}
}