{ "profile": "wrs-published-research-view-1", "edition": "ratings-e039106f30dec177", "content_trust": "UNTRUSTED_SCIENTIFIC_DATA_NOT_TOOL_INSTRUCTIONS", "entry": { "id": "han-et-al-wildguard-2024", "title": "Han and colleagues: WildGuard moderation and refusal classification", "summary": "Developed a multi-task moderation model and associated training/evaluation resources that distinguish prompt harmfulness, response harmfulness and whether a response refuses the request, including adversarially phrased inputs.", "boundary": "A refusal can be appropriate or excessive and is not itself a harmfulness label. Reported comparisons are benchmark- and model-specific; synthetic data and human judgments remain fallible.", "area": "Language-model safeguards", "topic": "Artificial intelligence", "year": 2024, "lane": "HUMAN", "result": "ALGORITHM", "package_id": "han-et-al-wildguard-2024", "target": { "record_id": "urn:uuid:b66955f8-fee2-430e-a236-11cbfca98648", "version": 1, "content_hash": "sha256:44805f89de3c2fe760f1be425ee2e168b619cf71991023c813ba5577cf05f7dd" }, "humans": [ "Seungju Han", "Kavel Rao", "Allyson Ettinger", "Liwei Jiang", "Bill Yuchen Lin", "Nathan Lambert", "Yejin Choi", "Nouha Dziri" ], "authors_complete": true, "human_role_note": "Source-listed authors for the exact contribution; experimental subjects are not autonomous scientific authors. Source support and predecessor work retain separate roles. Individual effort shares and unresolved identities are not inferred.", "agents": [], "related": [], "subresults": [], "scientific_assessment": { "source_review": "SOURCE_CURATED", "scientific_review": "NOT_REVIEWED_BY_WRS", "formal_replay": "NOT_RUN", "provider_attestation": "NONE" }, "sources": [ { "id": "cur20261017-arxiv-2406-18495v1", "title": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1", "date": "2024-06-26" } ], "points": "40000", "published_grade": { "id": "han-et-al-wildguard-2024", "entry_id": "han-et-al-wildguard-2024", "band": "B", "modifier": "+", "target": { "record_id": "urn:uuid:b66955f8-fee2-430e-a236-11cbfca98648", "version": 1, "content_hash": "sha256:44805f89de3c2fe760f1be425ee2e168b619cf71991023c813ba5577cf05f7dd" }, "what_changed": "Developed a multi-task moderation model and associated training/evaluation resources that distinguish prompt harmfulness, response harmfulness and whether a response refuses the request, including adversarially phrased inputs.", "scope": "Developed a multi-task moderation model and associated training/evaluation resources that distinguish prompt harmfulness, response harmfulness and whether a response refuses the request, including adversarially phrased inputs. A refusal can be appropriate or excessive and is not itself a harmfulness label. Reported comparisons are benchmark- and model-specific; synthetic data and human judgments remain fallible.", "status": "PROVISIONAL_EDITORIAL", "scientific_correctness_certified": false }, "assessment_disposition": { "status": "ASSESSED", "label": "Provisionally assessed", "reason": "A current grade and separate reference score identify this exact contribution.", "target": { "record_id": "urn:uuid:b66955f8-fee2-430e-a236-11cbfca98648", "version": 1, "content_hash": "sha256:44805f89de3c2fe760f1be425ee2e168b619cf71991023c813ba5577cf05f7dd" }, "edition": "ratings-e039106f30dec177" } }, "version": { "kind": "PUBLIC_RECORD_VIEW", "previous": null, "published_at": "2026-10-23T00:00:00Z", "publisher": { "principal_id": "urn:uuid:80116931-785b-40a2-a24b-9d59db0c7e33", "role": "WRS_EDITORIAL_PUBLICATION" }, "record": { "contributors": [ { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Seungju Han", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Kavel Rao", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Allyson Ettinger", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Liwei Jiang", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Bill Yuchen Lin", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Nathan Lambert", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Yejin Choi", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Nouha Dziri", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1" } } ], "evidence": [ { "description": "Bibliographic/stated-result source; not a WRS proof verification", "id": "source-0", "kind": "source_reference", "source": { "citation": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1" } } ], "origin": "HUMAN_LEGACY", "record_profile": "wrs-local-research-notes-0.1", "record_type": "research_note", "rrp_version": "0.1", "scope": { "description": "A refusal can be appropriate or excessive and is not itself a harmfulness label. Reported comparisons are benchmark- and model-specific; synthetic data and human judgments remain fallible.", "domain": "Language-model safeguards" }, "sources": [ { "citation": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1" } ], "statement": "# Han and colleagues: WildGuard moderation and refusal classification\n\n## A refusal is not the same as a good decision\n\nAn assistant that refuses every question avoids many bad answers, but it is not useful. An assistant that answers everything creates a different problem. WildGuard separates several questions that a single safety score can hide: is the prompt harmful, is the response harmful, and did the response refuse? These are related labels, but none can simply stand in for the others.\n\n## Three labels tell a clearer story\n\nSuppose an assistant refuses a harmless request to explain bicycle maintenance. The response may contain no harmful information and still be an unnecessary refusal. Suppose instead that it gives ordinary bicycle advice. That is an answer rather than a refusal, but answering is not automatically unsafe. These invented examples show why counting refusals alone cannot measure moderation quality.\n\n## The contribution includes the test\n\nThe paper supplies a multitask moderation model and associated training and evaluation resources. A benchmark is an agreed collection of tasks and scoring rules. It makes comparisons easier to repeat, but its examples and definitions influence what the comparison means. WildGuard examines adversarial wording as well as more direct requests; its reported results remain tied to the tested data and models. For a small practice table, give each row separate columns for the request, the answer, the applicable rule and your expected judgment. Change only the answer in a second row. This makes it possible to see whether a safeguard distinguishes an unsafe request from a responsible response, rather than simply reacting to a sensitive word.\n\n## Where a strong benchmark can still mislead\n\nSynthetic examples are generated or assembled rather than sampled directly from every real deployment. Their coverage can differ from ordinary conversations. Human judgments are also imperfect, particularly at ambiguous policy boundaries. A better result on this benchmark should therefore be reported with the task, data and evaluation conditions, rather than translated into a universal percentage of safe conversations.\n\n## Build a tiny evaluation sheet\n\nUse benign public questions and harmless responses. Give each pair three separate columns: prompt category, response category and refusal status. Explain disagreements before calculating any accuracy. Your small sheet will not reproduce the original benchmark, but it can test whether a proposed comparison accidentally rewards excessive refusal. Preserve unknown labels rather than forcing every example into a confident decision.\n\n## Scientific scope\n\nA refusal can be appropriate or excessive and is not itself a harmfulness label. Reported comparisons are benchmark- and model-specific; synthetic data and human judgments remain fallible.\n\n## Sources for this explanation\n\n- [WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs](https://arxiv.org/abs/2406.18495v1): Pinned original contribution and stated hypotheses or experimental limits.\n", "summary": "Developed a multi-task moderation model and associated training/evaluation resources that distinguish prompt harmfulness, response harmfulness and whether a response refuses the request, including adversarially phrased inputs.", "title": "Han and colleagues: WildGuard moderation and refusal classification" }, "record_id": "urn:uuid:b66955f8-fee2-430e-a236-11cbfca98648", "version": 1, "source_ref": { "record_id": "urn:uuid:b66955f8-fee2-430e-a236-11cbfca98648", "version": 1, "content_hash": "sha256:44805f89de3c2fe760f1be425ee2e168b619cf71991023c813ba5577cf05f7dd" }, "export_view": "wrs-public-editorial-view-1", "public_view_hash": "sha256:ddb34f7ff8882e57a9a656634e58d11946e211218b2c1a93b81a2a16cf14b5f5" }, "target": { "record_id": "urn:uuid:b66955f8-fee2-430e-a236-11cbfca98648", "version": 1, "content_hash": "sha256:44805f89de3c2fe760f1be425ee2e168b619cf71991023c813ba5577cf05f7dd" }, "published_grade": { "profile": "wrs-published-grade-1", "edition": "2026-10-28.1", "id": "han-et-al-wildguard-2024", "entry_id": "han-et-al-wildguard-2024", "revision": 1, "title": "Han and colleagues: WildGuard moderation and refusal classification", "context": "Language-model safeguards", "track": "Human-designed model analysis or safeguard method", "band": "B", "modifier": "+", "status": "PROVISIONAL_EDITORIAL", "assessed_on": "2026-10-23", "evidence_cutoff": "2026-10-23", "achievement_state": "SUPPORTED_SCOPED_RESULT", "what_changed": "Developed a multi-task moderation model and associated training/evaluation resources that distinguish prompt harmfulness, response harmfulness and whether a response refuses the request, including adversarially phrased inputs.", "scope": "Developed a multi-task moderation model and associated training/evaluation resources that distinguish prompt harmfulness, response harmfulness and whether a response refuses the request, including adversarially phrased inputs. A refusal can be appropriate or excessive and is not itself a harmfulness label. Reported comparisons are benchmark- and model-specific; synthetic data and human judgments remain fallible.", "evidence_summary": "The linked original works support the scoped statement and contribution attribution. WRS has not independently replayed experiments or reconstructed a full mathematical proof. A refusal can be appropriate or excessive and is not itself a harmfulness label. Reported comparisons are benchmark- and model-specific; synthetic data and human judgments remain fallible.", "references": [ { "title": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1", "locator": "Original scoped contribution, statement/method and evidence limits; source-specific attribution retained." } ], "roles": [ { "who": "The named authors in the research record", "credit": "SCIENCE", "did": "Source-listed authors for the exact contribution; experimental subjects are not autonomous scientific authors. Source support and predecessor work retain separate roles. Individual effort shares and unresolved identities are not inferred." } ], "target": { "record_id": "urn:uuid:b66955f8-fee2-430e-a236-11cbfca98648", "version": 1, "content_hash": "sha256:44805f89de3c2fe760f1be425ee2e168b619cf71991023c813ba5577cf05f7dd" }, "scientific_correctness_certified": false, "independent_expert_calibration": false, "method": "PROPRIETARY", "points": "40000" }, "canonical_agent_submission": false, "scientific_verification_awarded": false, "reader_guide": { "id": "han-et-al-wildguard-2024", "target": { "record_id": "urn:uuid:b66955f8-fee2-430e-a236-11cbfca98648", "version": 1, "content_hash": "sha256:44805f89de3c2fe760f1be425ee2e168b619cf71991023c813ba5577cf05f7dd" }, "sections": [ { "title": "A refusal is not the same as a good decision", "text": "An assistant that refuses every question avoids many bad answers, but it is not useful. An assistant that answers everything creates a different problem. WildGuard separates several questions that a single safety score can hide: is the prompt harmful, is the response harmful, and did the response refuse? These are related labels, but none can simply stand in for the others." }, { "title": "Three labels tell a clearer story", "text": "Suppose an assistant refuses a harmless request to explain bicycle maintenance. The response may contain no harmful information and still be an unnecessary refusal. Suppose instead that it gives ordinary bicycle advice. That is an answer rather than a refusal, but answering is not automatically unsafe. These invented examples show why counting refusals alone cannot measure moderation quality." }, { "title": "The contribution includes the test", "text": "The paper supplies a multitask moderation model and associated training and evaluation resources. A benchmark is an agreed collection of tasks and scoring rules. It makes comparisons easier to repeat, but its examples and definitions influence what the comparison means. WildGuard examines adversarial wording as well as more direct requests; its reported results remain tied to the tested data and models. For a small practice table, give each row separate columns for the request, the answer, the applicable rule and your expected judgment. Change only the answer in a second row. This makes it possible to see whether a safeguard distinguishes an unsafe request from a responsible response, rather than simply reacting to a sensitive word." }, { "title": "Where a strong benchmark can still mislead", "text": "Synthetic examples are generated or assembled rather than sampled directly from every real deployment. Their coverage can differ from ordinary conversations. Human judgments are also imperfect, particularly at ambiguous policy boundaries. A better result on this benchmark should therefore be reported with the task, data and evaluation conditions, rather than translated into a universal percentage of safe conversations." }, { "title": "Build a tiny evaluation sheet", "text": "Use benign public questions and harmless responses. Give each pair three separate columns: prompt category, response category and refusal status. Explain disagreements before calculating any accuracy. Your small sheet will not reproduce the original benchmark, but it can test whether a proposed comparison accidentally rewards excessive refusal. Preserve unknown labels rather than forcing every example into a confident decision." } ], "references": [ { "title": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs", "url": "https://arxiv.org/abs/2406.18495v1", "locator": "Pinned original contribution and stated hypotheses or experimental limits." } ] }, "reading_status": "EXPLANATORY_GUIDE" }