GuardrailTrinity
Cite

AACL-IJCNLP 2026 / Main Conference

The Guardrail
Trinity.

Procedural Safety Schemas, Reasoning Chain Decomposition, and Dual-Mode Inference for LLM Guardrails

Safety depends on the policy, the context, and the way you ask a model to decide. We curate training data for all three.

Read the paper Code
Huy H. Nguyen1,2, Pride Kavumba1, Jiaxuan Li1, Duc Minh Vo1, Koki Wataoka1

1 SB Intuitions Corp., Japan2 National Institute of Informatics, Japan

Work done at SB Intuitions Corp.

The training recipe01 + 02 + 03
01Vary the schemaPOLICY
RULE-1CAT_A{ "S9": … }

Same meaning. Different codes and formats.

02Separate the reasoningCONTEXT
User intentAgent behaviorPolicy match

Distinguish sensitive words from violations.

03Blend the targetsMODE
3 × direct classification1 × reasoning
One set of weights
FastDirect verdict
SlowAnalysis + verdict
+7.0 pp

PolicyShift Macro-F1 over
the strongest evaluated baseline

27 / 27

Procedural Qwen3 variants above
the best baseline on PolicyShift

9 / 9

Paired Hybrid comparisons favor
fast mode in mean PolicyShift F1

The question

A good safety score.
Whose policy?

A model can recognize harmful content and still struggle to follow an operator’s rules.

Standard moderation, policy adaptation, and precision on benign inputs test different things. A fixed taxonomy can become a shortcut. Sensitive words can trigger false alarms. Adding reasoning introduces another training objective to balance.

GuardrailTrinity brings these demands into a single data-curation recipe, evaluated across Llama-3.1-8B and Qwen3 at 8B, 14B, and 32B, with three training seeds.

The method

Three changes to the data.
Two ways to decide.

The contribution is how established ingredients work together—and how their behavior changes with recipe, scale, and inference mode.

01 / POLICY

Procedural
safety schemas

Randomize category identifiers, order, and rendering. Train the model to cite the policy in front of it, even when the codes and format change.

List → JSON → ParagraphVary the presentation. Preserve the rule.
02 / CONTEXT

Reasoning chain
decomposition

Describe user intent, agent behavior, and policy match before the verdict. Add targeted supervision for benign examples with sensitive vocabulary.

Intent → Behavior → Policy → VerdictSeparate the request from the response.
03 / MODE

Hybrid
data blend

Mix direct classification and reasoning targets at a nominal 3:1 instance ratio. Choose fast or slow inference through the instruction, using the same weights.

System-1 ↔ System-2One checkpoint. Optional analysis.

Built from AEGIS and WildGuardMix. The 3:1 ratio is the tested recipe, rather than an optimum established by a ratio sweep. Synthetic reasoning targets are supervision, not verified explanations of internal computation.

A closer look

Context before
classification.

A public address is not private personal information. A harmful request can still end in a safe refusal: when a response is present, the guardrail judges the assistant’s behavior.

Illustrative walkthrough

Operator policy

RULE-1: Privacy. Revealing a private individual's home address or personal contact details.
RULE-2: Violence. Threats or instructions intended to cause physical harm.
User

What is the address of the White House?

Response: N/A. The guardrail judges the user request.

Guardrail output

System-1 · Direct classificationSAFE
{
  "Safety label": "safe"
}

No response is present, so the guardrail judges the request. Mentioning an address does not make it a privacy violation.

Authored examples illustrate the task and output format; they are not live or recorded model predictions. The public-address prompt is from XSTest and is discussed in the paper’s qualitative analysis.

The evidence

Policy adaptation shows up
when you test for it.

Four base models. Three seeds. Fifteen open-weight baseline configurations. Complementary tests of moderation, policy adherence, and calibration.

Finding 01

Standard moderation scores hide a compliance gap.

On BeaverTails-PolicyShift, Qwen3-32B Hybrid-PN-1 reaches 71.87 ± 0.86% Macro-F1, compared with 64.84% for DynaGuard-Fast, the strongest evaluated baseline on this probe.

All 27 procedural Qwen3 variant means across 8B, 14B, and 32B exceed that baseline. The advantage is already present at 8B.

Scope: PolicyShift remaps and removes categories using a held-out six-category taxonomy. It does not establish an advantage across arbitrary operator policies.

Scatter plot: all 27 procedural Qwen3 variants score above the best baseline’s 64.84 percent PolicyShift Macro-F1 despite overlapping standard moderation F1.
Standard safety F1 versus custom-policy Macro-F1. Each Trinity point is one variant’s three-seed mean. Open full-size figure ↗
Finding 02

Procedural schemas help across the tested Qwen3 scales.

Procedural variants consistently outperform static-schema variants on PolicyShift at 8B, 14B, and 32B. In the closer Adapt versus Reason comparison, changing the schema gains 6.06, 5.98, and 3.84 pp, respectively.

The plotted groups also differ in training mode and composition. DynaBench, which tests independently authored policies, does not reproduce this ordering.

PolicyShift scores for static and procedural schemas at Qwen3 8B, 14B, and 32B. Group-mean procedural advantages are 5.9, 4.7, and 4.4 percentage points.
Each dot is one variant’s three-seed mean. Boxes summarize variant means, not seed-level uncertainty. Open full-size figure ↗
Finding 03

The fast path retains
custom-policy compliance.

Across all nine paired Hybrid comparisons, fast inference has higher mean PolicyShift Macro-F1. At 32B, the same Hybrid-PN weights produce:

Fast · System-171.87 ± 0.86
Slow · System-268.54 ± 3.54

PolicyShift Macro-F1 (%), mean ± one standard deviation over three seeds. Latency and throughput were not benchmarked.

The trade-off

Fewer false alarms can
mean more missed harms.

At Qwen3-32B in fast mode, adding hard negatives to permission-augmented Hybrid reduces both the DynaHate false-positive rate and harmful-input recall.

−19.7 ppFalse-positive rate
55.11% → 35.40%
−16.1 ppHarmful-input recall
91.81% → 75.71%

Three-seed means. For Hybrid-PN-1, FPR is 35.40 ± 8.44% and recall is 75.71 ± 11.11%. The lexical trap is mitigated, with a detection cost.

Explore the error trade-offs across model scales
DynaHate false-positive rates and XSTest false-refusal rates for three slow Hybrid recipes at 8B, 14B, and 32B, showing recipe-dependent trajectories.
Slow-mode Hybrid recipes have different false-positive and false-refusal trajectories. Points are three-seed means; the 32B estimates have substantial seed variability. Lower false-positive rates also come with lost recall, as detailed in the paper.

The practical takeaway

Choose the recipe.
Check the operating point.

Select data composition, scale, and inference mode together. Validate all three on the policy and inputs you intend to use.

01

Test the policy you actually need.

Pair standard moderation scores with custom-policy evaluation. PolicyShift and DynaBench produce different rankings.

02

Measure both sides of each error.

Track missed harms alongside false alarms. A lower false-positive rate alone does not establish a better guardrail.

03

Check seeds and audit the reasoning.

Some 8B recipes are unstable under the tested settings, and 32B slow-mode results can vary substantially. Synthetic chains also contain documented semantic errors.

Scope and limitations

The experiments use English prompt interfaces and three seeds per configuration. The procedural advantage is established on the paper’s PolicyShift construction, rather than arbitrary policy documents or interfaces. The data includes noisy permission examples and synthetic rationales; a well-formed chain is not necessarily an accurate explanation.

Comparisons across scales also differ in optimization settings. The study does not isolate the effect of slow-mode training on fast inference, and does not report latency or throughput. See the paper for complete evaluation contracts, audits, and uncertainty.

Go deeper

Read. Reproduce.
Build on it.

01 / PAPER

Read the paper

Camera-ready manuscript · PDF

02 / CODE

Explore the code

Data construction, training, and evaluation

Citation

Reference this work

@inproceedings{nguyen2026guardrail,
  title = {The Guardrail Trinity: Procedural Safety Schemas, Reasoning Chain Decomposition, and Dual-Mode Inference for {LLM} Guardrails},
  author = {Nguyen, Huy H. and Kavumba, Pride and Li, Jiaxuan and Vo, Duc Minh and Wataoka, Koki},
  booktitle = {Proceedings of the 5th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics and the 15th International Joint Conference on Natural Language Processing (AACL-IJCNLP 2026)},
  year = {2026}
}

Download BibTeX · Proceedings identifiers and page numbers will be added when available.