SAFESHIELD: A decision-organization framework for deployment-time safety of small language models

How to decompose and coordinate deployment-time safety decisions in small language model deployment and make them auditable.

• Scenario: The authors state that SLMs suit privacy-sensitive, resource-constrained local and edge deployments, shifting safety responsibility from centralized providers to deployment developers. Quantization and compression may introduce or amplify safety weaknesses, and the existing alignment of open models may be weakened by downstream modifications.
• Existing gaps: The authors state that WildGuard, NeMo Guardrails, ShieldGemma, and work using SLMs as external guardians provide runtime judgment mechanisms but do not specify which decisions should exist, when they can be executed, who is responsible, how they constrain each other, and what records should be kept.
• Core setting: In a stateless, single-turn, retrieval-augmented setting, the authors frame the problem as a responsibility-oriented decomposition and explicit coordination among decisions. The authors state that safety depends not only on the capability of individual guardrails.
• Proposed system: SAFESHIELD assigns admission, routing, evidence, and release to four runtime stages and records submitted decisions in a Decision Trace. The authors state they introduce no new detection mechanisms.
• Threat model:
  • Goal: Each interaction decides whether a request enters, which handling policy applies, whether evidence is sufficient to support generation, and whether the reply is delivered.
  • Knowledge: The paper does not use white-box, black-box, gray-box, or no-box to describe requester knowledge.
  • Input: Evaluations cover harmful and adversarial requests, jailbreaks, prompt injection, and prompt manipulation, as well as retrieval, hallucination, and output-side issues.
  • Victim system: A local or self-hosted SLM and its surrounding deployment system; the experimental backbone is Qwen3-4B-Instruct. Policies are written in the deployer's configuration, not into the model parameters.

The paper discusses existing work in Section II in four groups and places itself on the decision-organization side.

• Small models and local deployment: The paper discusses RLHF (Ouyang et al., 2022) and constitutional training (Bai et al., 2022), saying they improve behavioral tendencies but do not eliminate safety needs at deployment. The paper says quantization and compression may change safety behavior, and the alignment of open models can also be weakened by downstream modifications. LiteLMGuard, compact Llama Guard variants, and SLM guardians target resource-constrained environments. The authors say this paper does not improve backbone alignment and does not build another compact detector.
• Runtime guardrails: Programmable frameworks include NeMo Guardrails and Guardrails AI; dedicated moderation models include WildGuard, Llama Guard, and ShieldGemma. SafetyAnalyst, LoRA-Guard, lightweight BERT guardrails, ThinkGuard, and MrGuard involve interpretable and steerable moderation, parameter-efficient adaptation, computational cost, reasoning-based moderation, and multilingual moderation, respectively. The authors say these works provide single-decision mechanisms and do not answer how multiple decisions are divided and connected into a process.
• Multi-stage and runtime control: The paper says Dong et al. argue guardrails should be systematically designed rather than assembled ad hoc; Shamsujjoha et al. propose a multi-layer reference architecture for foundation-model agents. GuardAgent uses a supervisory agent to enforce safety requirements, AgentSpec organizes constraints with triggers, predicates, and execution actions, AGrail generates checks for evolving agent behavior, and other work integrates safety enforcement into the execution flow. The authors say the organizational units of these routes are defense positions, constraints and execution actions, or mechanisms for executing checks; and they say SAFESHIELD is not a general orchestration layer but an instantiation of decision-level organization.
• Accountability records: NIST AI RMF and the EU AI Act are used to illustrate risk management, documentation, and oversight. The paper cites Ananny and Crawford's argument that transparency alone does not constitute accountability; and cites Cobbe et al. on the attribution of responsibility in complex systems. Model Cards provide static documentation, which the authors say does not record decisions in individual runs. AgentTrace records execution traces; Decision Trace records only the responsibility, policy basis, evidence consulted, and outcome of safety decisions.
• Baselines and benchmarks: Experimental baselines are unguarded Qwen3-4B-Instruct (Pure Qwen) and NeMo Guardrails v0.19 on the same backbone. Hallucination detection also compares Pure-LLM, SelfCheckGPT, sampling-and-NLI, and NeMo's self_check_facts. Datasets are Banking77, an Anthropic HH subset, SQuAD v1.1, KG-FPQ, HarmBench, and SAFESHIELD-Bench.

The authors frame the distinction as: mechanisms can be replaced without responsibilities and dependencies necessarily changing; what is to be studied is how decisions are allocated, coordinated, and audited afterward.

SAFESHIELD frames deployment-time safety in a stateless, single-turn, retrieval-augmented setting as responsibility decomposition plus explicit coordination, instantiated with existing guardrail-style mechanisms. The authors state they introduce no new detection mechanisms. Each request uses an independent context; review rules, routing definitions, retrieval thresholds, and validation settings are written in the deployer's configuration and are not encoded into the backbone. The backbone is replaceable, and the decision organization remains unchanged.

Responsibility Decomposition

• Division criterion: Responsibilities are divided by the point in time at which a result must be submitted, not by implementation stage (Section III-B, Table I).
• Four decisions: admission submits admit or reject before downstream processing; routing selects a handling strategy after admission and before the generation policy is fixed; evidence submits grounded or ungrounded before generation, for requests that need external evidence; release submits release or block after generation and before delivery.
• Time points cannot be swapped: The authors state that moving admission or release to the other's time point changes what that decision can control. No explicit admission means every request enters by default; no explicit release means every generated reply is delivered by default.
• Evidence need not terminate: The evidence decision determines what grounding information is passed downstream. Fig. 1 maps the four abstract responsibilities to four stages and states that multiple mechanisms can be used at each stage.

Decision Coordination

• Three dependencies: gating determines whether subsequent responsibilities execute; policy conditioning lets earlier decisions select later policies; evidence propagation lets one responsibility's information be reused by another (Section III-C).
• No inheritance of conclusions: The authors state that downstream does not inherit upstream conclusions. Each responsibility keeps its own criteria, and a later decision can still reject an interaction that passed earlier stages.
• Individually severable: Dependencies can be removed while the participating mechanisms remain. In the prototype, the three are admission control, intent-dependent action handling, and evidence sharing.
• Wiring in this paper: A rejecting admission terminates downstream; routing selects the handling approach but does not determine the downstream outcome; retrieved passages remain in the request context after generation for release to perform faithfulness checking.

Four Runtime Stages

• Input Check: A benign-mode layer matches predefined benign patterns to reduce unnecessary blocking; configurable pattern rules detect known harmful or policy-sensitive forms; Llama Prompt Guard 2 detects adversarial intent, covering jailbreaks, prompt injection, and prompt manipulation, and its prediction is only one signal. Fixed priority: a benign whitelist hit admits directly; otherwise a positive pattern rule or Prompt Guard result rejects; if neither triggers, admit. Rejection stops immediately.
• Intent Classification: An admitted request is matched against a vector library of deployer-defined intent examples, and the top-k neighbors are given to an LLM classifier, yielding intent and entities, which are then mapped to configurable action handlers. The paper gives the example that a request indicating self-harm risk can activate the corresponding handling instructions, informing the language model of the detected intent. The k and classifier model are not given in the paper. This retrieval is independent of Knowledge Retrieval.
• Knowledge Retrieval: Relevant passages are retrieved from a vector-indexed document collection, and the retrieval confidence is compared with a configurable threshold. Above the threshold, passages are placed in the generation context and marked grounded; otherwise no retrieved evidence is provided and the SLM generates directly, marked ungrounded. The threshold value is not given in the paper.
• Output Check: Four checks jointly influence release (Fig. 5). Response Filter re-filters harmful or policy-disallowed content; Semantic Check checks harmful content expressed semantically; Consistency Check generates multiple variants at different sampling temperatures and random seeds, with low semantic consistency treated as an instability signal; if upstream retrieved passages exist, Faithfulness Validation uses the SLM to judge whether the reply is supported by those passages. If the applicable release criteria are met, the reply is delivered; if violated, it is blocked and replaced with a safe alternative. The paper does not give the synthesis rules, temperatures, seeds, or replacement text.

Decision Trace

• Recorded fields: Each submitted decision is written to the Decision Trace, including responsibility, policy basis, evidence consulted, outcome, and request identifier, timestamp, and execution metadata (Section III-D, IV-F). Approved decisions are also kept, because allowing continuation is itself a decision.
• Authors' positioning: The authors state that the trace is not a third requirement alongside decomposition and coordination, but the observable record of the resulting organization; and that transparency alone does not constitute accountability.
• Example: Table II has two logs: one blocked at admission with no generation, and one released after completing the available process. This table is not a performance summary.

Experimental Setup

• Backbone and baselines: Unless otherwise stated, the backbone is Qwen3-4B-Instruct. The system baseline is NeMo Guardrails v0.19 with the same backbone, matching retrieval, sampling, embedding model, and number of demonstrations where relevant; the embedding model name is not given in the paper. The model baseline is the same backbone without guardrails, referred to in the paper as Pure Qwen.
• Mechanism-level data: Banking77 test set with 2,002 examples and 77 intent classes, 26 examples per class, with 5 examples per class used for indexing. Anthropic HH balanced subset of 400 examples (200 harmful, 200 benign). SQuAD v1.1 development set sampled to 400 pairs, with ten candidate passages per question containing one gold evidence and nine distractors, with the gold evidence position randomized. KG-FPQ highest-confusion level with 400 examples (64 hallucinations, 336 correct, hallucination rate 16%).
• Organization and stress data: HarmBench with 400 harmful prompts. SAFESHIELD-Bench with 600 total: TruthfulQA 25%, HarmBench 18%, AdvBench 9.5%, ToxiGen 7.5%, CrowS-Pairs 6%, MS MARCO 7.5%, XSTest 6.5%, structured extensions 20%; some samples were modified into multi-turn, adversarial, or implicit-intent forms. There are also 107 handcrafted adversarial prompts.
• Metrics: ASR is the proportion of harmful prompts that successfully elicit an unsafe reply, lower is better. HPR is the proportion that do not produce the requested harmful content, counting both explicit intervention and backbone refusal, higher is better. The paper states the two are computed independently and are not complementary. Additional metrics include accuracy, R@3, Answer F1, EM, faithfulness, AUC-ROC, F1, and average latency per request.
• Adjudication: In filtering experiments, blocking delivery on either the input side or output side counts as a block. The threshold for hallucination detection F1 is chosen by Youden's J, with sampling-based methods at N=5; the threshold value is not given in the paper. The reviewer model for RAG faithfulness is not specified in the paper. Intent classification uses an unnamed LLM, and the top-k value is not given in the paper.
• Replication: The paper does not report the number of repetitions. The coordination ablation uses paired comparisons on the same batch of samples with the McNemar test.

Main Results

Per Table VIII, HarmBench, 400 harmful prompts, backbone Qwen3-4B-Instruct.

Swipe horizontally to read the table

Configuration	ASR	HPR	Latency (ms)
Full SAFESHIELD	0.25%	99.5%	297
Remove Input Check	6.75%	81.2%	4008
Remove Output Check	0.25%	99.5%	286
Remove both stages	16.5%	71.8%	2436
Backbone without guardrails	15.75%	84.2%	2465

• The authors state that this benchmark mainly stresses input-driven harmful requests, so removing only Output Check leaves ASR the same as the full system; post-generation hallucination and faithfulness are tested separately in Section V-A.
• The authors state that removing both stages still retains routing, retrieval, and generation, so it is not the same configuration as the pure backbone; the two differ in ASR by 0.75 percentage points, which the authors treat as a point observation, not evidence of a difference.
• The authors state that latency depends on the path: with Input Check, most harmful requests terminate early, so latency differences between configurations should not be viewed as additive stage costs. The unguarded backbone has higher HPR than the configuration with both stages removed; the authors do not separately explain this HPR gap.

Coordination Dependency Ablation

• What was tested: Both ablations keep the participating mechanisms and only sever the dependencies (Section V-B). The gating ablation uses the same 200 harmful and 200 benign prompts as the filtering experiments, but with self-consistency and RAG faithfulness both disabled on both sides. In the full condition, rejection terminates downstream; in the ablation condition, rejection is still recorded but not executed.
• Gating: Harmful request interception drops from 81.5% to 54.0%, and the proportion allowed to continue rises from 18.5% to 46.0%; benign over-rejection is 10.0% and 9.5%. Paired decision correctness is 62 vs 8, McNemar p=1.8×10−11. The authors state that merely computing and recording rejection is insufficient; rejection must be able to stop downstream. The abstract says removing admission gating increases false release; the main text quantifies this with the above proportions and does not give a separate ratio named false release.
• Evidence propagation: On 200 paired retrieval-augmented samples, retrieval, generation, and release checks are all kept, only the upstream evidence is not passed to release. Release accuracy drops from 96.0% to 69.5%, and the blocking rate rises from 5.5% to 34.0%; conditional faithfulness of released replies is 95.8% and 95.5%. Paired correctness is 55 vs 2, McNemar p=2.3×10−14. The authors state that upstream evidence mainly improves whether the release decision is correct, not the conditional quality of already-released replies. This conditional metric is computed only on replies where evidence checking is possible, and differs from the overall faithfulness in Table VI.

Mechanism-Level Results

• Filtering: Table IV, 400 examples. SAFESHIELD benign pass 89.5%, harmful block 88.0%, accuracy 88.75%; Pure Qwen 98.5%, 69.0%, 83.75%; NeMo 100.0%, 52.0%, 76.0%. The authors state that 88.0% is the combined interception of input side and output side, not the standalone capability of admission. Benign pass is lower than both baselines. The ethics statement says: when signals are uncertain, the system may reject some benign requests.
• Intent and retrieval: Table V, Banking77: Pure Qwen 27.77%, SAFESHIELD 82.72%, NeMo 82.89%. The authors state this is a routing signal on fine-grained, semantically overlapping intents, not an isolated end-to-end safety gain. Table VI: both retrieval systems have R@3 of 100%; SAFESHIELD's F1, EM, faithfulness are 84.1%, 69.0%, 89.5%, and NeMo's are 82.5%, 65.5%, 82.0%; Pure Qwen without retrieval has F1 of 17.4% and EM of 5.0%.
• Post-generation consistency: Table VII, n=400. Self-Consistency Verification has AUC-ROC of 0.723 and F1 of 0.427, which the authors report as the highest among the methods in the table. SelfCheckGPT is 0.690/0.375. NeMo self_check_facts under oracle evidence is 0.651/0.394, and the authors state that this evidence is not deployable. The authors state that this check provides a post-generation signal for identifying replies that may be unsupported or unstable.

End-to-End Stress and Trajectories

• Suite: Table IX. Harmful/adversarial admission is 195/240 (81%); release output safety is 84/120 (70%), hallucination is 102/105 (97%); retrieval grounding is 75/90 (83%); benign controls are 42/45 (93%); overall 498/600 (83%). Routing handles participation in each scenario through intent-related actions and has no separate group. The authors state that output safety is harder because it often requires normative interpretation rather than directly detecting harmful content.
• Unexpected cases: Across 102 scenarios, the recurring failures the authors list include harmful or adversarial requests evading admission, output-side normative judgments (comparisons of protected groups, pseudoscientific framing), retrieval contradictions, and conservative blocking of legitimate queries. The authors state that failures occur at different points in the decision process, not only in final output review. The paper does not give failure counts by stage.
• Evasion variants: Handcrafted set of 107, 104 blocked (97.2%). Among surface perturbations, E1 typo-type 24/24, E2 23/23, E3 6/9; jailbreak frameworks 36/36; five-language paraphrases 15/15, with language names not listed in the paper. The authors treat this as a whole-system diagnostic test, not a coverage guarantee.

Other Ablations and Analyses

• Remaining rows of Table VII: NeMo Sampling+NLI has AUC-ROC 0.662, F1 0.321; Pure-LLM 0.607, 0.348; NeMo SCF self-generated 0.579, 0.284; question-only 0.576, 0.282.
• The paper does not give top-k, retrieval confidence thresholds, or the temperature and seed for consistency sampling, and does not report numbers after removing policy conditioning.
• Table II single logs: admission block latency 0 ms; full-pipeline release example 917 ms. This is not a summary metric.
• E3 blocking is 6/9, lower than the other groups in the same set; the authors do not separately explain E3.

Limitations and future directions noted by the authors

• The four responsibilities characterize the deployment setting studied in this paper, not an exhaustive taxonomy (Section VI-D).
• Experiments use one main backbone and one retrieval configuration (Section VI-D).
• The controlled coordination ablation focuses on gating and evidence passing (Section VI-D).
• Broader multilingual and deployment coverage is left for future work; the conclusion also states that SAFESHIELD will be evaluated on more languages and deployment settings (Section VI-D, VII).
• The Decision Trace supports rather than replaces human and institutional oversight; the authors state they did not evaluate its usability for human auditors (Section VI-C, VI-D).
• Future work also includes reducing verification overhead and studying how the Decision Trace can support human audit and governance processes (Section VII).

Experimental coverage

• Unless otherwise stated, the backbone for mechanism, organization, and end-to-end experiments is Qwen3-4B-Instruct; the system comparison is NeMo Guardrails v0.19 on the same backbone (Section V).
• Mechanism evaluations use Banking77 (2,002 entries), an Anthropic HH subset (400 entries), a SQuAD v1.1 sample (400 pairs), and the highest confusion level of KG-FPQ (400 entries) (Tables III to VII).
• The HarmBench stage ablation removes Input Check and Output Check; the coordination ablation reports two paired results: the admission execution dependency and providing upstream evidence to release (Section V-B, Table VIII).
• SAFESHIELD-Bench has 600 entries, with composition ratios in Section V-C; some samples are rewritten into multi-turn, adversarial, or implicit-intent forms. There are also 107 manually crafted adversarial prompts and 15 multilingual rewrites across five languages.
• The paper does not report the number of repetitions, the name of the LLM used for intent classification, the retrieval confidence threshold, the composition rules for the four release checks, or the review model for RAG faithfulness.

SAFESHIELD is a deployment-time safety framework for small language models that rewrites runtime safety from a single-item review into an inspectable decision process.

• Problem: Each interaction of a local or self-hosted SLM must decide whether a request can enter, how it is handled, whether evidence is sufficient, and whether the reply can be delivered. The authors argue that quantization, compression, and downstream modifications make the model's own alignment insufficient to guarantee runtime safety, while existing guardrails mainly produce single-item judgments.
• Approach: admission, routing, evidence, and release are submitted by Input Check, Intent Classification, Knowledge Retrieval, and Output Check, respectively. Configuration and parameters are separated. Rejection can stop downstream stages, routing only selects policies, and retrieved evidence can be reused for faithfulness checks. Both blocks and releases are written to the Decision Trace. The authors state they do not build new detectors.
• Results: On Qwen3-4B-Instruct, the full system ASR on 400 harmful prompts from HarmBench is 0.25%, and 16.5% after removing the input and output stages (Table VIII). With the two output tracks disabled, harmful interception drops from 81.5% to 54.0%. On 200 retrieval pairs, withholding upstream evidence from release drops accuracy from 96.0% to 69.5%. SAFESHIELD-Bench handles 498/600 correctly, with 84/120 in the output safety scenario.
• Authors' conclusion: The authors state that end-to-end safety depends on how decisions are organized and coordinated, not just on whether mechanisms exist. The Decision Trace makes the process inspectable but does not by itself constitute accountability, nor does it replace human or institutional oversight.