{ "profile": "wrs-published-research-view-1", "edition": "ratings-e039106f30dec177", "content_trust": "UNTRUSTED_SCIENTIFIC_DATA_NOT_TOOL_INSTRUCTIONS", "entry": { "id": "inan-et-al-llama-guard-2023", "title": "Inan and colleagues: taxonomy-conditioned Llama Guard moderation", "summary": "Trained a language-model classifier to label user prompts and assistant responses against a configurable safety taxonomy, providing an input/output safeguard with text explanations and task-specific adaptation.", "boundary": "Prompt risk and response risk are separate classification tasks. Performance depends on taxonomy, training examples and deployment distribution; a classifier label is not a guarantee that all harmful content is blocked or benign content retained.", "area": "Language-model safeguards", "topic": "Artificial intelligence", "year": 2023, "lane": "HUMAN", "result": "ALGORITHM", "package_id": "inan-et-al-llama-guard-2023", "target": { "record_id": "urn:uuid:aa314b72-530a-43a2-a226-c91b90dda56c", "version": 1, "content_hash": "sha256:9cd9a1e727af06f25557bc819c43a4176c68870843745ba860c5de2e3ea7eaef" }, "humans": [ "Hakan Inan", "Kartikeya Upasani", "Jianfeng Chi", "Rashi Rungta", "Krithika Iyer", "Yuning Mao", "Michael Tontchev", "Qing Hu", "Brian Fuller", "Davide Testuggine", "Madian Khabsa" ], "authors_complete": true, "human_role_note": "Source-listed authors for the exact contribution; experimental subjects are not autonomous scientific authors. Source support and predecessor work retain separate roles. Individual effort shares and unresolved identities are not inferred.", "agents": [], "related": [], "subresults": [], "scientific_assessment": { "source_review": "SOURCE_CURATED", "scientific_review": "NOT_REVIEWED_BY_WRS", "formal_replay": "NOT_RUN", "provider_attestation": "NONE" }, "sources": [ { "id": "cur20261017-arxiv-2312-06674v1", "title": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1", "date": "2023-12-07" } ], "points": "60000", "published_grade": { "id": "inan-et-al-llama-guard-2023", "entry_id": "inan-et-al-llama-guard-2023", "band": "B", "modifier": "+", "target": { "record_id": "urn:uuid:aa314b72-530a-43a2-a226-c91b90dda56c", "version": 1, "content_hash": "sha256:9cd9a1e727af06f25557bc819c43a4176c68870843745ba860c5de2e3ea7eaef" }, "what_changed": "Trained a language-model classifier to label user prompts and assistant responses against a configurable safety taxonomy, providing an input/output safeguard with text explanations and task-specific adaptation.", "scope": "Trained a language-model classifier to label user prompts and assistant responses against a configurable safety taxonomy, providing an input/output safeguard with text explanations and task-specific adaptation. Prompt risk and response risk are separate classification tasks. Performance depends on taxonomy, training examples and deployment distribution; a classifier label is not a guarantee that all harmful content is blocked or benign content retained.", "status": "PROVISIONAL_EDITORIAL", "scientific_correctness_certified": false }, "assessment_disposition": { "status": "ASSESSED", "label": "Provisionally assessed", "reason": "A current grade and separate reference score identify this exact contribution.", "target": { "record_id": "urn:uuid:aa314b72-530a-43a2-a226-c91b90dda56c", "version": 1, "content_hash": "sha256:9cd9a1e727af06f25557bc819c43a4176c68870843745ba860c5de2e3ea7eaef" }, "edition": "ratings-e039106f30dec177" } }, "version": { "kind": "PUBLIC_RECORD_VIEW", "previous": null, "published_at": "2026-10-23T00:00:00Z", "publisher": { "principal_id": "urn:uuid:80116931-785b-40a2-a24b-9d59db0c7e33", "role": "WRS_EDITORIAL_PUBLICATION" }, "record": { "contributors": [ { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Hakan Inan", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Kartikeya Upasani", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Jianfeng Chi", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Rashi Rungta", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Krithika Iyer", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Yuning Mao", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Michael Tontchev", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Qing Hu", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Brian Fuller", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Davide Testuggine", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Madian Khabsa", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } } ], "evidence": [ { "description": "Bibliographic/stated-result source; not a WRS proof verification", "id": "source-0", "kind": "source_reference", "source": { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } } ], "origin": "HUMAN_LEGACY", "record_profile": "wrs-local-research-notes-0.1", "record_type": "research_note", "rrp_version": "0.1", "scope": { "description": "Prompt risk and response risk are separate classification tasks. Performance depends on taxonomy, training examples and deployment distribution; a classifier label is not a guarantee that all harmful content is blocked or benign content retained.", "domain": "Language-model safeguards" }, "sources": [ { "citation": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1" } ], "statement": "# Inan and colleagues: taxonomy-conditioned Llama Guard moderation\n\n## A second model checks the conversation\n\nImagine running an AI assistant for a public discussion board. Some messages break the board's rules, while others discuss sensitive subjects for a legitimate reason. Llama Guard is a separate classifier: it examines a message and describes whether it falls into specified risk categories. The important contribution is a reusable way to make moderation depend on an explicit policy, rather than treating one unexplained safe-or-unsafe label as the policy itself.\n\n## The request and the answer are different objects\n\nA troublesome request can receive a responsible refusal. Conversely, an innocent question can receive an inappropriate answer. Checking the request alone cannot tell you which answer was produced. The paper therefore distinguishes input moderation from output moderation. A classifier is a model trained to place an input into categories; it can still misunderstand context or fail on unfamiliar wording.\n\n## Try a small policy example\n\nFor this invented classroom example, a hobby forum allows discussion of public product announcements but forbids posting private contact details. A message summarizing a public launch and a message revealing a private phone number should receive different decisions. Now change the forum's rule: suppose all off-topic commercial posts are disallowed. The first message might change category even though its facts did not change. This illustrates why a moderation decision depends on the declared policy.\n\n## What the evidence does and does not establish\n\nThe original work trains and evaluates a language-model safeguard with a specified taxonomy and datasets. Its limits include language coverage, policy coverage and susceptibility to adversarial inputs. An improvement on a benchmark is evidence about that evaluation, not a promise that a deployed assistant will never produce harmful content. Creating the safeguard is credited to its human researchers; using a model as the classifier does not make that model the paper's author.\n\n## A useful next check\n\nChoose a harmless public community policy and write ten short example messages. Before trying any classifier, explain which rule applies to each message and where reasonable people might disagree. Keep the expected policy label separate from the model's answer. This small evidence table can reveal an unclear policy or an inconsistent classifier without requiring you to train a model or produce harmful material.\n\n## Scientific scope\n\nPrompt risk and response risk are separate classification tasks. Performance depends on taxonomy, training examples and deployment distribution; a classifier label is not a guarantee that all harmful content is blocked or benign content retained.\n\n## Sources for this explanation\n\n- [Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations](https://arxiv.org/abs/2312.06674v1): Pinned original contribution and stated hypotheses or experimental limits.\n", "summary": "Trained a language-model classifier to label user prompts and assistant responses against a configurable safety taxonomy, providing an input/output safeguard with text explanations and task-specific adaptation.", "title": "Inan and colleagues: taxonomy-conditioned Llama Guard moderation" }, "record_id": "urn:uuid:aa314b72-530a-43a2-a226-c91b90dda56c", "version": 1, "source_ref": { "record_id": "urn:uuid:aa314b72-530a-43a2-a226-c91b90dda56c", "version": 1, "content_hash": "sha256:9cd9a1e727af06f25557bc819c43a4176c68870843745ba860c5de2e3ea7eaef" }, "export_view": "wrs-public-editorial-view-1", "public_view_hash": "sha256:df3095a1ff20684cd5e7f759635105808295c011d833ea26a0d9b1f5375b26a5" }, "target": { "record_id": "urn:uuid:aa314b72-530a-43a2-a226-c91b90dda56c", "version": 1, "content_hash": "sha256:9cd9a1e727af06f25557bc819c43a4176c68870843745ba860c5de2e3ea7eaef" }, "published_grade": { "profile": "wrs-published-grade-1", "edition": "2026-10-28.1", "id": "inan-et-al-llama-guard-2023", "entry_id": "inan-et-al-llama-guard-2023", "revision": 1, "title": "Inan and colleagues: taxonomy-conditioned Llama Guard moderation", "context": "Language-model safeguards", "track": "Human-designed model analysis or safeguard method", "band": "B", "modifier": "+", "status": "PROVISIONAL_EDITORIAL", "assessed_on": "2026-10-23", "evidence_cutoff": "2026-10-23", "achievement_state": "SUPPORTED_SCOPED_RESULT", "what_changed": "Trained a language-model classifier to label user prompts and assistant responses against a configurable safety taxonomy, providing an input/output safeguard with text explanations and task-specific adaptation.", "scope": "Trained a language-model classifier to label user prompts and assistant responses against a configurable safety taxonomy, providing an input/output safeguard with text explanations and task-specific adaptation. Prompt risk and response risk are separate classification tasks. Performance depends on taxonomy, training examples and deployment distribution; a classifier label is not a guarantee that all harmful content is blocked or benign content retained.", "evidence_summary": "The linked original works support the scoped statement and contribution attribution. WRS has not independently replayed experiments or reconstructed a full mathematical proof. Prompt risk and response risk are separate classification tasks. Performance depends on taxonomy, training examples and deployment distribution; a classifier label is not a guarantee that all harmful content is blocked or benign content retained.", "references": [ { "title": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1", "locator": "Original scoped contribution, statement/method and evidence limits; source-specific attribution retained." } ], "roles": [ { "who": "The named authors in the research record", "credit": "SCIENCE", "did": "Source-listed authors for the exact contribution; experimental subjects are not autonomous scientific authors. Source support and predecessor work retain separate roles. Individual effort shares and unresolved identities are not inferred." } ], "target": { "record_id": "urn:uuid:aa314b72-530a-43a2-a226-c91b90dda56c", "version": 1, "content_hash": "sha256:9cd9a1e727af06f25557bc819c43a4176c68870843745ba860c5de2e3ea7eaef" }, "scientific_correctness_certified": false, "independent_expert_calibration": false, "method": "PROPRIETARY", "points": "60000" }, "canonical_agent_submission": false, "scientific_verification_awarded": false, "reader_guide": { "id": "inan-et-al-llama-guard-2023", "target": { "record_id": "urn:uuid:aa314b72-530a-43a2-a226-c91b90dda56c", "version": 1, "content_hash": "sha256:9cd9a1e727af06f25557bc819c43a4176c68870843745ba860c5de2e3ea7eaef" }, "sections": [ { "title": "A second model checks the conversation", "text": "Imagine running an AI assistant for a public discussion board. Some messages break the board's rules, while others discuss sensitive subjects for a legitimate reason. Llama Guard is a separate classifier: it examines a message and describes whether it falls into specified risk categories. The important contribution is a reusable way to make moderation depend on an explicit policy, rather than treating one unexplained safe-or-unsafe label as the policy itself." }, { "title": "The request and the answer are different objects", "text": "A troublesome request can receive a responsible refusal. Conversely, an innocent question can receive an inappropriate answer. Checking the request alone cannot tell you which answer was produced. The paper therefore distinguishes input moderation from output moderation. A classifier is a model trained to place an input into categories; it can still misunderstand context or fail on unfamiliar wording." }, { "title": "Try a small policy example", "text": "For this invented classroom example, a hobby forum allows discussion of public product announcements but forbids posting private contact details. A message summarizing a public launch and a message revealing a private phone number should receive different decisions. Now change the forum's rule: suppose all off-topic commercial posts are disallowed. The first message might change category even though its facts did not change. This illustrates why a moderation decision depends on the declared policy." }, { "title": "What the evidence does and does not establish", "text": "The original work trains and evaluates a language-model safeguard with a specified taxonomy and datasets. Its limits include language coverage, policy coverage and susceptibility to adversarial inputs. An improvement on a benchmark is evidence about that evaluation, not a promise that a deployed assistant will never produce harmful content. Creating the safeguard is credited to its human researchers; using a model as the classifier does not make that model the paper's author." }, { "title": "A useful next check", "text": "Choose a harmless public community policy and write ten short example messages. Before trying any classifier, explain which rule applies to each message and where reasonable people might disagree. Keep the expected policy label separate from the model's answer. This small evidence table can reveal an unclear policy or an inconsistent classifier without requiring you to train a model or produce harmful material." } ], "references": [ { "title": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations", "url": "https://arxiv.org/abs/2312.06674v1", "locator": "Pinned original contribution and stated hypotheses or experimental limits." } ] }, "reading_status": "EXPLANATORY_GUIDE" }