Fastino releases GLiGuard, a 300M-parameter guardrail model

Fastino has released GLiGuard, a 300-million-parameter encoder model for content moderation and safety classification. The weights are on the Hugging Face Hub under the Apache 2.0 license.

According to the post by Mary Newhauser and Urchade Zaratiana, current open-source guardrail models range from about 7 billion to 27 billion parameters. These decoder models produce their safety verdicts one token at a time and typically assess each safety dimension in sequence, so latency grows as more checks are added. GLiGuard instead encodes the input text and the candidate labels together, then scores every label in a single forward pass. The authors say adding more safety dimensions therefore adds no latency.

The model handles four tasks at once on both user prompts and model responses:

• safe/unsafe classification
• detection of 11 jailbreak strategies, including prompt injection, roleplay bypass and social engineering
• detection of 14 harm categories, including violence, hate speech, PII exposure and child safety, with multiple categories allowed per input
• refusal detection, intended to measure over-refusal and false compliance

Fastino reports that across nine safety benchmarks, GLiGuard's accuracy matches or exceeds models 23 to 90 times its size. The excerpt does not include the per-benchmark results or the hardware behind the speed figures.

GLiGuard is a full fine-tune of the GLiNER2-base-v1 checkpoint, trained for 20 epochs with AdamW. Labels for prompt safety, response safety and refusal come from WildGuardTrain, a set of 87,000 human-annotated examples. GPT-4.1 generated the harm-category and jailbreak labels, and Fastino's Fine-Tuning Agent added synthetic edge cases to help the model tell similar categories apart. The company says full details are in an accompanying paper.