DT-Guard: Intent-Driven Reasoning-Active Training for Reasoning-Free LLM Safety Guardrail

# DT-Guard: Intent-Driven Reasoning-Active Training for Reasoning-Free LLM Safety Guardrail
Source: [https://arxiv.org/html/2607.06326](https://arxiv.org/html/2607.06326)
\\reportnumber

00111footnotetext:Equal contribution\.22footnotetext:Corresponding to boyuan\.zb@antgroup\.com

Changtao Miao∗Xinjie Yang∗Tianle SongYin WuJunchi ChenBintao HeXinyuan ZhangBo Zhang†Shi YanWei LuWei WangDanyang XuJiansheng CaiZhe Li Ant Digital TechnologiesAnt Group

###### Abstract

Large language models deployed in open\-world applications require safety guardrails that are both robust to complex risks and efficient enough for low\-latency runtime moderation\. Existing guardrails face a practical trade\-off between lightweight classification\-based models, which are efficient but often struggle with concealed intent, ambiguous semantics, and borderline safety decisions, and reasoning\-based guards, which improve judgment quality but introduce additional token generation and inference latency\. We present DT\-Guard, a content safety guardrail model based on a Reasoning\-Active Training, Reasoning\-Free Inference paradigm\. The key idea is to use reasoning supervision during training while emitting only structured safety labels at inference time\. DT\-Guard formulates safety judgment as a progressive decision process, Intent → Category → Safety, and constructs an intent\-driven dataset with intent labels, risk categories, safety labels, and structured reasoning trajectories\. To further improve hard\-case robustness, we propose Rollout\-Guided Progressive Hard\-Case Optimization \(RG\-PHO\), which uses multi\-rollout consistency to identify stably mastered, persistently failed, and preference\-unstable samples, and applies targeted supervised and preference optimization accordingly\. At inference time, DT\-Guard directly generates structured labels without explicit reasoning traces, preserving deployment efficiency\. Experiments on prompt\-side and response\-side safety benchmarks show that DT\-Guard achieves average F1 scores of 0\.886 and 0\.870, respectively\. With only a 4B backbone, it reaches a dual\-side average F1 of 0\.878, outperforming strong 8B guardrail baselines\. These results demonstrate that reasoning supervision can be effectively internalized into low\-latency safety discrimination\.

![Refer to caption](https://arxiv.org/html/2607.06326v1/x1.png)Figure 1:DT\-Guard achieves the top F1 on representative safety benchmarks under reasoning\-free inference, outperforming strong guardrail baselines\.## 1Introduction

Large language models \(LLMs\) have achieved substantial progress in instruction following, knowledge\-intensive question answering, complex reasoning, and multi\-turn interaction, and are increasingly deployed in open\-ended real\-world applicationsqwen35blog;singh2026openaigpt5card;li2026lingring26technical\. As their deployment scope expands, LLMs must handle diverse user inputs and generate responses across safety\-sensitive scenarios\. User inputs may contain concealed harmful intent, adversarial jailbreak attempts, or ambiguous borderline requests, while model outputs may include unsafe, harmful, biased, or policy\-violating content under specific contextsgcg;autodan\. Safety guardrail modelsllamaguard;shieldgemma;qwen3guard;yufengxguardhave therefore become an important runtime safety layer for detecting and intercepting risks before user inputs are passed to the model or before model responses are returned to users\.

Existing guardrail models typically follow one of two inference paradigms\. Classification\-based guardrailsllamaguard;shieldgemma;aegis;wildguard;polyguarddirectly predict safety labels according to predefined taxonomies and are efficient for real\-time deployment\. However, they often struggle with concealed intent, ambiguous semantics, and adversarially framed requests, because complex safety judgments are compressed into flat label prediction\. Safety risk is not always determined by surface text alone\. Requests involving the same sensitive topic may correspond to benign educational inquiry, defensive analysis, risk exploration, or malicious exploitationintent\-ft;zhuang\. Without explicit intent modeling, guardrails may suffer from over\-refusal on benign requests or risk under\-detection on malicious ones\.

Reasoning\-enhanced guardrails provide another direction\. By generating explicit chain\-of\-thought reasoning or explanatory traces, such methods can analyze context more carefully and improve robustness on difficult safety casesliu2025guardreasoner;yufengxguard\. Nevertheless, requiring complete reasoning traces or detailed explanations at inference time introduces additional token\-generation overhead and response latency, which makes deployment challenging in high\-throughput and low\-latency industrial systemsqwen3guard\. These limitations highlight the need for a guardrail training paradigm that can benefit from reasoning supervision while preserving reasoning\-free inference\.

To address this challenge, we proposeDT\-Guard, a content safety guardrail model following theReasoning\-Active Training, Reasoning\-Free Inferenceparadigm\. Instead of treating explicit reasoning as a mandatory deployment\-time output, DT\-Guard uses reasoning trajectories as supervision signals during training and directly generates structured safety labels during inference\. We formulate safety judgment as a progressive decision process,Intent→\\rightarrowCategory→\\rightarrowSafety\. The model first identifies the underlying interaction intent, then attributes the relevant risk categories, and finally predicts the safety level\. Compared with directly mapping text to a safety label, this structure provides clearer intermediate supervision for difficult cases where surface\-level cues alone are unreliable\.

Based on this formulation, we construct an intent\-driven safety dataset containing prompts, responses, intent labels, risk categories, safety labels, and structured reasoning trajectories\. We further introduceRollout\-Guided Progressive Hard\-Case Optimization\(RG\-PHO\), which uses multi\-rollout consistency to identify different types of residual errors\. Persistently failed samples are optimized with stronger supervised correction, while preference\-unstable samples are optimized through contrastive preference learning over correct and incorrect rollouts\. In this way, explicit reasoning signals are transferred into more stable label\-level safety judgment without requiring reasoning\-chain generation at inference time\.

Experiments on multiple prompt\-side and response\-side safety benchmarks demonstrate the effectiveness of DT\-Guard under Reasoning\-Free inference\. On 10 prompt\-side benchmarks, DT\-Guard achieves an averageF1F\_\{1\}score of0\.8860\.886, improving over Qwen3Guard\-8B \(0\.8520\.852\) by3\.43\.4points\. On 7 response\-side benchmarks, it achieves an averageF1F\_\{1\}score of0\.8700\.870\. Overall, with only a 4B backbone, DT\-Guard reaches a dual\-side averageF1F\_\{1\}score of0\.8780\.878, outperforming strong 8B guardrail baselines\. These results show that reasoning supervision can be internalized during training and converted into efficient safety discrimination at inference time\.

Our main contributions are summarized as follows:

- •We proposeDT\-Guard, a safety guardrail model following theReasoning\-Active Training, Reasoning\-Free Inferenceparadigm, which internalizes complex safety reasoning without emitting explicit reasoning chains during deployment\.
- •We construct an intent\-driven safety judgment framework and dataset, and introduceRG\-PHO, a progressive hard\-case optimization strategy\. It organizes safety discrimination asIntent→\\rightarrowCategory→\\rightarrowSafety, stratifies hard cases via rollout consistency, and applies Hard\-Case SFT and Hard\-Case DPO for targeted optimization\.
- •We conduct multiple experiments on input risk detection and response safety moderation, providing an effective training path that balances reasoning capability and deployment efficiency for low\-latency safety guardrails\.

## 2Related Work

### 2\.1Safety Alignment

The rapid development and deployment of large language models \(LLMs\) have made safety alignment a central research topic\. Existing methods aim to align model behavior with human preferences and safety requirements during training\. RLHFrlhfoptimizes LLMs with reward models trained from human preference data, while Constitutional AIconaiimproves harmlessness through self\-critique and revision based on predefined principles\. DPOdpofurther simplifies preference optimization by directly learning from preference pairs\. Although these methods improve intrinsic model safety, alignment alone remains insufficient for reliable open\-world deployment\. Automated jailbreak methods such as GCGgcgand AutoDANautodanshow that aligned models can still be induced to generate unsafe or policy\-violating responses\. These limitations motivate runtime safety mechanisms that monitor and regulate LLM interactions beyond model\-level alignment\.

### 2\.2Guardrail Models

Safety guardrails serve as runtime safety layers for moderating user inputs and model outputs\. Existing guardrail models usually formulate safety detection as an instruction\-following or classification task based on predefined taxonomies\. Llama Guardllamaguardtrains a dedicated LLM to classify user inputs and model responses according to safety policies\. ShieldGemmashieldgemmaimproves configurability through customizable policy instructions\. Aegisaegisintroduces fine\-grained risk categories, while WildGuardwildguardunifies safety risk detection, jailbreak detection, and refusal detection\. PolyGuardpolyguardfurther extends guardrails to multilingual safety moderation\. Despite their effectiveness, these methods mainly rely on direct label prediction, providing limited modeling of latent intent and complex decision processes in ambiguous or deceptive cases\.

### 2\.3Guardrail Reasoning

Recent studies have explored reasoning\-enhanced guardrails to improve robustness and interpretability\. GuardReasonerliu2025guardreasonerexplicitly models the reasoning process behind safety judgments, while YuFeng\-XGuardyufengxguardemphasizes reasoning\-centric and interpretable risk perception\. However, generating reasoning traces at inference time introduces additional token cost and response latency, making such methods less practical for latency\-sensitive applications\. To improve deployment efficiency, Qwen3Guardqwen3guardenables token\-level real\-time monitoring through streaming detection\. Nevertheless, existing guardrails still face a tension between reasoning\-enhanced judgment and efficient inference\. Our DT\-Guard addresses this gap by using reasoning and intent supervision during training while preserving reasoning\-free structured\-label inference during deployment\.

## 3Intent\-Driven Safety Data Construction

![Refer to caption](https://arxiv.org/html/2607.06326v1/x2.png)Figure 2:Intent\-driven data construction pipeline: heterogeneous safety sources are distilled, filtered by voting, and expert\-verified into structured CoT and label supervision\.We build an intent\-driven safety corpus for training DT\-Guard, as shown in Figure[2](https://arxiv.org/html/2607.06326#S3.F2)\. Starting from heterogeneous safety resources, we normalize all samples into a unified prompt\-response\-label format and enrich each instance with chain\-of\-thought \(CoT\), intent, risk\-category, and safety annotations\. This converts safety moderation from flat label prediction into a structured decision path,Intent→\\rightarrowCategory→\\rightarrowSafety\. To reduce annotation noise and expose boundary cases, we combine GLM\-5\.1 distillation, multi\-round voting, and expert verification: agreement cases are retained, confirmed relabels are kept, erroneous cases are filtered, and inconsistent cases are assigned toBorderline\. The final 811,897\-sample corpus provides both structured\-label supervision for reasoning\-free inference and reasoning trajectories for subsequent RG\-PHO training\.

### 3\.1Data Sources

We aggregate 1,918,565 raw samples from six safety domains, covering red–blue teaming, jailbreak attacks, alignment data, toxicity, bias, and domain\-specific risks\. The raw pool contains 949,050 prompt\-level samples \(49\.46%\) for input\-side risk detection and 969,515 response\-level samples \(50\.54%\) for output\-side safety assessment\. After filtering and balancing, the final corpus remains dual\-sided, with 450,437 prompt\-level samples and 361,460 response\-level samples \(Table[1](https://arxiv.org/html/2607.06326#S3.T1)\), enabling comparable supervision for both guardrail entry points\.

Table 1:Final corpus scale by task side after filtering and balancing\.Table 2:Intent taxonomy and final distribution, separating normal use, risky content, and adversarial attack intent\.![Refer to caption](https://arxiv.org/html/2607.06326v1/x3.png)Figure 3:Distribution of unsafe risk categories\.Table 3:Final safety\-label distribution, retaining safe, unsafe, and borderline cases for boundary\-risk learning\.
### 3\.2Data Processing and Training Set Construction

We use a two\-stage pipeline to expand annotation dimensions and control label quality\.

LLM\-based Distillation and Quality Filtering\.Public safety datasets differ in label spaces, risk granularity, and annotation criteria\. We therefore use GLM\-5\.1 as an automatic annotator and require a fixed output schema containing CoT,Intent,Category, andSafety\. The intent label follows Table[2](https://arxiv.org/html/2607.06326#S3.T2); the category label is selected from the nine risk types in Figure[3](https://arxiv.org/html/2607.06326#S3.F3); and the safety label is one ofSafe,Unsafe, orBorderline\(Table[3](https://arxiv.org/html/2607.06326#S3.T3)\)\. The annotation order explicitly followsIntent→\\rightarrowCategory→\\rightarrowSafety, encouraging consistency between interaction motivation, risk attribution, and final adjudication\.

Multi\-round Voting and Expert Verification\.We next compare the distilledSafetylabel with the original label\. Matched samples are retained directly\. For mismatched samples, GLM\-5\.1 performs three additional independent rollouts\. Unanimous relabeling results are sent to expert verification; confirmed corrections are kept, and rejected cases are removed\. Non\-unanimous results \(2:1 or 1:2\) are treated as annotation\-unstable boundary cases and relabeled asBorderline\. This procedure corrects both false positives that cause over\-refusal and false negatives that cause risk under\-detection\. It retains 1,121,574 high\-quality samples from the raw corpus, with a 58\.46% retention rate\.

Training Set Construction\.Each retained sample contains dialogue content, CoT reasoning, intent labels, risk categories, and safety labels, providing aligned supervision for intent recognition, risk localization, and safety classification\.

### 3\.3Data Balancing

Starting from the 1,121,574 retained samples, we balance the final training distribution along safety labels and risk categories\.

Safety Label Balancing\.We target aSafe:Unsafe:Borderlineratio of approximately 5\.5:4:0\.5\. This preserves sufficient unsafe supervision, keeps enough safe samples to reduce over\-refusal, and explicitly maintains boundary cases for ambiguity modeling\. The final corpus contains 450,000Safesamples \(55\.43%\), 317,134Unsafesamples \(39\.06%\), and 44,763Borderlinesamples \(5\.51%\), as shown in Table[3](https://arxiv.org/html/2607.06326#S3.T3)\.

Risk Category Balancing\.We also perform category\-aware sampling over the nine risk types to limit head\-category dominance and preserve long\-tail coverage\. The final distribution covers frequent risks such asPrejudice and DiscriminationandIllegal Activities, while retaining sparse but deployment\-critical categories such asPolitically Sensitive ContentandOthers\(Figure[3](https://arxiv.org/html/2607.06326#S3.F3)\)\.

After applying both balancing strategies, the final dataset contains 811,897 samples, corresponding to an overall retention rate of 42\.32% relative to the original corpus\.

## 4Rollout\-Guided Progressive Hard\-Case Optimization

DT\-Guard aims to internalize reasoning supervision while keeping inference as structured\-label generation\. As shown in Figure[4](https://arxiv.org/html/2607.06326#S4.F4), directly fine\-tuning on CoT\-heavy targets can create a train–test format mismatch: the model learns to depend on explicit reasoning chains, but deployment requires Reasoning\-Free outputs\. We address this withRollout\-Guided Progressive Hard\-Case Optimization\(RG\-PHO\), which uses rollout consistency to estimate sample difficulty and assigns each difficulty pattern to a matching optimization objective\.

RG\-PHO has three stages\.Intent\-Guided Mixed\-Mode SFTfirst learns theIntent→\\rightarrowCategory→\\rightarrowSafetydecision structure from both structured\-label and CoT outputs\. The trained model is then rolled out multiple times on training samples to separate stably mastered, persistently failed, and preference\-unstable cases\.Failure\-Driven Hard\-Case SFTrepairs persistently failed samples with stronger supervision, whileRollout\-Contrastive Hard\-Case DPObuilds chosen–rejected pairs from correct and incorrect rollouts of preference\-unstable samples\. This pipeline converts explicit reasoning signals into stable label\-level safety judgment\.

### 4\.1Intent\-Guided Mixed\-Mode SFT

The first stage establishes intent\-aware safety discrimination\. Using the structured taxonomy in Section 3, the model maps each input toIntent,Category, andSafety\.Intentcaptures interaction motivation,Categorylocalize risk types, andSafetygives the final decision\.

Unlike standard SFT, this stage mixes two output formats\. Borderline and fine\-grained cases retain CoT reasoning trajectories to expose intermediate decision logic, while clear safe or unsafe cases more often use compact structured\-label outputs\. The mixed format injects reasoning supervision without forcing all training samples into an inference\-mismatched CoT style\.

![Refer to caption](https://arxiv.org/html/2607.06326v1/x4.png)Figure 4:RG\-PHO training pipeline: mixed\-mode SFT is followed by rollout\-based hard\-case stratification, hard\-case SFT, and rollout\-contrastive DPO\.The training objective is standard autoregressive supervised learning\. Given inputxxand target outputyy, the model minimizes the negative log\-likelihood:

ℒSFT=−∑t=1\|y\|log⁡pθ​\(yt∣x,y<t\)\.\\mathcal\{L\}\_\{\\mathrm\{SFT\}\}=\-\\sum\_\{t=1\}^\{\|y\|\}\\log p\_\{\\theta\}\(y\_\{t\}\\mid x,y\_\{<t\}\)\.\(1\)This stage yields the initial safety model used for rollout\-based hard\-case identification\.

### 4\.2Rollout\-Consistency\-Based Sample Stratification

After Stage 1, we estimate sample difficulty by prediction stability\. For each samplexix\_\{i\}, the model generatesKKindependent outputs and produces safety\-label predictions\. The rollout consistency score is:

si=∑k=1K𝟏​\[y^i\(k\)=yi\]\.s\_\{i\}=\\sum\_\{k=1\}^\{K\}\\mathbf\{1\}\\left\[\\hat\{y\}\_\{i\}^\{\(k\)\}=y\_\{i\}\\right\]\.\(2\)We use three rollouts in all experiments\. Samples with3/33/3correct predictions arestably mastered; samples with0/30/3correct predictions arepersistently failed; and samples with1/31/3or2/32/3correct predictions arepreference\-unstable\. These groups correspond to replay suppression, capability repair, and preference calibration, respectively\.

This behavior\-driven stratification prevents all residual errors from being optimized identically, and determines whether a sample should be skipped, supervised, or converted into preference pairs\.

### 4\.3Failure\-Driven Hard\-Case SFT

The second stage appliesFailure\-Driven Hard\-Case SFTto persistently failed samples\. Since the model produces no correct rollout for these cases, DPO lacks a naturally generated chosen response and is poorly matched to the error type\.

We therefore use CoT\-supervised correction to teach the missing path from text understanding to intent recognition, risk attribution, and safety adjudication\. Unlike Stage 1, this stage is not designed to expand coverage; it targets systematic failures that cause risk under\-detection or over\-refusal\.

After Failure\-Driven Hard\-Case SFT, the model receives new supervision on previously failed samples, providing a more stable initialization for subsequent preference optimization\.

### 4\.4Rollout\-Contrastive Hard\-Case DPO

The third stage appliesRollout\-Contrastive Hard\-Case DPOto preference\-unstable samples\. These samples already contain both correct and incorrect model\-generated outputs, making them natural candidates for preference learning\.

For each sample, rollouts consistent with the ground\-truth label are chosen responses, and inconsistent rollouts are rejected responses\. When multiple distinct incorrect outputs exist, we construct one\-to\-many preference pairs\. Since the outputs retain CoT trajectories, DPO optimizes both the reasoning path and the final safety decision\.

The DPO objective is:

ℒDPO=−𝔼\(x,y\+,y−\)​log⁡σ​\(β​\[log⁡pθ​\(y\+∣x\)pref​\(y\+∣x\)−log⁡pθ​\(y−∣x\)pref​\(y−∣x\)\]\),\\mathcal\{L\}\_\{\\mathrm\{DPO\}\}=\-\\mathbb\{E\}\_\{\(x,y^\{\+\},y^\{\-\}\)\}\\log\\sigma\\left\(\\beta\\left\[\\log\\frac\{p\_\{\\theta\}\(y^\{\+\}\\mid x\)\}\{p\_\{\\mathrm\{ref\}\}\(y^\{\+\}\\mid x\)\}\-\\log\\frac\{p\_\{\\theta\}\(y^\{\-\}\\mid x\)\}\{p\_\{\\mathrm\{ref\}\}\(y^\{\-\}\\mid x\)\}\\right\]\\right\),\(3\)wherey\+y^\{\+\}denotes the chosen output,y−y^\{\-\}denotes the rejected output,prefp\_\{\\mathrm\{ref\}\}is the reference model, andβ\\betacontrols preference strength\. The objective increases the relative probability of correct reasoning paths and safety labels over incorrect adjudications\.

Compared with further SFT, DPO is better suited to samples where the model can already generate a correct answer but selects it inconsistently\. The contrastive rollout pairs calibrate this selection behavior\.

### 4\.5Reasoning\-Free Inference

After training, DT\-Guard defaults to Reasoning\-Free inference\. It does not output CoT traces, and directly generatesIntent,Category, andSafety\. This matches the structured\-label format used in mixed\-mode training\.

Reasoning\-Free inference removes explicit reasoning generation, not the reasoning supervision learned during training\. RG\-PHO converts CoT samples, hard\-case SFT, and rollout\-contrastive DPO into label\-level discrimination capability without adding reasoning\-chain generation overhead\.

Table 4:Training variants for isolating intent labels, CoT allocation, hard\-case SFT, and rollout\-contrastive DPO\.

## 5Experiments and Analysis

This section evaluates DT\-Guard on prompt\-side risk detection and response\-side safety auditing\. We first define the evaluation protocol, then compare against strong guardrail baselines, and finally analyze the contribution of each training component under Reasoning\-Free inference\.

### 5\.1Experimental Setup

We use Qwen3\-4B as the backbone and compare with the Qwen3Guard and YuFeng\-XGuard model families\. Prompt\-side evaluation covers 10 benchmarks, including ToxicChat, OpenAIModeration, AegisSafety, AegisSafety2\.0, SimpleSafetyTests, HarmBench\-Prompt, WildGuard\-Prompt, SafetyEval, Sorry\-Bench, and XSTest\. Response\-side evaluation covers 7 benchmarks, including HarmBench\-Response, SafeRLHF, BeaverTails, XSTest\-Response, AegisSafety2\.0\-Response, WildGuard\-Response, and Think\.

All experiments report classificationF1F\_\{1\}\. We summarize prompt\-side average, response\-side average, and dual\-side averageF1F\_\{1\}\. For baselines with multiple decision settings, we report the best setting on each benchmark\.

Table 5:Prompt\-sideF1F\_\{1\}comparison on 10 safety benchmarks\. The best result in each column is highlighted in bold\.Table 6:Response\-sideF1F\_\{1\}comparison on 7 safety benchmarks\. The best result in each column is highlighted in bold\.Table 7:Overall averageF1F\_\{1\}comparison across prompt\-side and response\-side benchmarks\.
### 5\.2Main Results

Table[5](https://arxiv.org/html/2607.06326#S5.T5)and Table[6](https://arxiv.org/html/2607.06326#S5.T6)show that DT\-Guard improves both input\-side and output\-side safety classification\. On the prompt side, Stage3\-DPO reaches an averageF1F\_\{1\}of0\.8860\.886, outperforming Qwen3Guard\-8B\-Gen \(0\.8520\.852\) and YuFeng\-XGuard\-Reason\-8B \(0\.8490\.849\)\. On the response side, it reaches0\.8700\.870, exceeding Qwen3Guard\-8B\-Gen\(0\.8630\.863\) and YuFeng\-XGuard\-Reason\-8B \(0\.8410\.841\)\.

Across both task types, DT\-Guard obtains a dual\-side averageF1F\_\{1\}of0\.8780\.878\(Table[7](https://arxiv.org/html/2607.06326#S5.T7)\), surpassing Qwen3Guard\-8B\-Gen \(0\.8580\.858\) and YuFeng\-XGuard\-Reason\-8B \(0\.8450\.845\) with only a 4B backbone\. The gain therefore comes primarily from intent\-driven supervision and RG\-PHO rather than model scale\.

Table 8:CoT allocation ablation under Reasoning\-Free inference\. Selective CoT on Borderline samples gives the best averageF1F\_\{1\}\.Table 9:Progressive averageF1F\_\{1\}gains of DT\-Guard across the three\-stage training pipeline\. Gain is measured over Stage1\-SFT\-v0\.
### 5\.3Ablation Study and Training Analysis

We ablate intent labels, CoT allocation, hard\-case SFT, and DPO to isolate the contribution of each RG\-PHO component\. The results show that gains come from matching supervision type to sample difficulty, rather than from adding CoT uniformly\.

#### 5\.3\.1Effect of Intent Labels

Intent supervision models interaction motivation before the final safety decision\. Compared with Stage1\-SFT\-v0, addingIntentimproves prompt\-side averageF1F\_\{1\}from0\.8550\.855to0\.8630\.863, with a smaller but positive response\-side gain\.

This gain is largest on prompt\-side tasks, where semantically similar requests may reflect normal use, risky exploration, or attack intent\. Intent labels provide an intermediate constraint before category attribution and safety prediction\.

#### 5\.3\.2Effect of CoT Training Strategy

Table[8](https://arxiv.org/html/2607.06326#S5.T8)shows that CoT supervision is useful only when allocated selectively\. Full CoT training reduces dual\-side averageF1F\_\{1\}from0\.8560\.856to0\.8280\.828, indicating a format mismatch between CoT\-heavy training and Reasoning\-Free inference\.

Random CoT/noCoT mixing partially alleviates the mismatch but remains below the noCoT baseline\. In contrast, assigning CoT to Borderline samples and mixing the remaining data improves the average to0\.8600\.860, supporting our selective reasoning\-supervision design\.

#### 5\.3\.3Rollout\-Consistency\-Based Sample Stratification

Rollout consistency separates residual errors by model behavior\. Stably mastered samples offer limited marginal value for replay; persistently failed samples lack a correct generated path and require supervised repair; preference\-unstable samples already contain correct and incorrect rollouts and are suitable for DPO\. This stratification is the routing mechanism that decides whether a sample contributes to Stage2\-SFT or Stage3\-DPO\.

#### 5\.3\.4Effect of Hard\-Case SFT

Failure\-Driven Hard\-Case SFT targets persistently failed samples instead of replaying the full dataset uniformly\. As shown in Table[9](https://arxiv.org/html/2607.06326#S5.T9), it improves the dual\-side averageF1F\_\{1\}from0\.8600\.860to0\.8640\.864\.

Although the gain is smaller than DPO, this stage creates a stronger initialization for preference optimization\. For samples without any correct rollout, supervised correction is more appropriate than preference ranking because no model\-generated chosen response exists\.

#### 5\.3\.5Effect of Hard\-Case DPO

Rollout\-Contrastive Hard\-Case DPO provides the largest single\-stage gain\. It constructs chosen–rejected pairs from correct and incorrect rollouts of preference\-unstable samples, encouraging the model to consistently select the correct adjudication path\.

As shown in Table[9](https://arxiv.org/html/2607.06326#S5.T9), DPO improves the dual\-side averageF1F\_\{1\}from0\.8640\.864to0\.8780\.878\. The prompt\-side average increases from0\.8650\.865to0\.8860\.886, indicating that preference optimization is especially effective for boundary requests, jailbreak\-style inputs, and over\-refusal control\.

### 5\.4Analysis of Reasoning\-Free Inference

All main results are obtained under Reasoning\-Free inference, where DT\-Guard outputs only structured safety labels\. Unlike explicit reasoning\-based guardrails, our model uses reasoning primarily as training supervision through mixed SFT, hard\-case SFT, and rollout\-contrastive DPO\.

The ablations support this asymmetry\. Full CoT training degrades when CoT inference is disabled, whereas selective CoT and RG\-PHO improve performance\. Reasoning enhancement therefore depends less on emitting reasoning chains at deployment, and more on aligning reasoning supervision with the Reasoning\-Free output format\.

## 6Conclusion

We presentDT\-Guard, a content safety guardrail model designed for low\-latency deployment\. Unlike guardrail methods that rely on explicit chain\-of\-thought or explanation generation during inference, DT\-Guard follows aReasoning\-Active Training, Reasoning\-Free Inferenceparadigm: explicit reasoning supervision is used during training, while inference outputs only structured safety labels\. This enables the model to internalize intent recognition, risk attribution, and safety adjudication required for complex safety judgment while preserving an efficient inference format\. To achieve this, we construct an intent\-driven safety data framework that organizes safety discrimination asIntent→\\rightarrowCategory→\\rightarrowSafety, and introduceRollout\-Guided Progressive Hard\-Case Optimization\. This training strategy uses multi\-rollout consistency to identify different types of hard cases, and improves the model’s judgment on persistently failed and preference\-unstable samples through Hard\-Case SFT and Hard\-Case DPO, respectively\. Experiments show that DT\-Guard achieves consistent gains on both prompt\-side and response\-side safety benchmarks, outperforming several 8B guardrail models with only 4B parameters\. These results validate that reasoning supervision during training can be effectively converted into low\-latency discrimination capability at inference time\.

## References