HiveTraceLab
arXiv:2605.05277v1 [cs.CR] 6 May 2026
GLiNER Guard: Unified Encoder Family for Production LLM Safety and Privacy Bogdan Minko∗ Sabrina Sadiekh† Evgeniy Kokuykin‡
Abstract Production LLM systems require both safety moderation and PII detection under strict latency and cost constraints. This creates a trade-off: autoregressive moderators are accurate but expensive, while lightweight encoders are faster but less capable. We present GLiNER Guard (GLiGuard), a unified encoder that performs safety classification and PII detection in a single forward pass, simplifying safety pipelines. We introduce three variants: compact uni- and biencoders (145–147M) for high-throughput serving, and GLiGuard Omni (209M) for stronger moderation quality. Under dynamic batching on a single A100, the compact model reaches 193 requests/sec with P99 latency below 1s, achieving 1.6× higher throughput than GLiNER2. Omni remains competitive with much larger moderators on public safety benchmarks. We also release PII-Bench, a spanlevel benchmark for evaluating PII detection in end-to-end pipelines. Overall, encoder-based guardrails offer a practical low-cost alternative for always-on moderation. Models and benchmarks are released on HuggingFace4 5 .
1
Introduction
In production environments, malicious LLM requests, prompt injection, hacking attempts, and user-provided personal data create operational and compliance risks. As a result, requests often need to be screened before reaching downstream systems. Moderation and personal data detection therefore become core components of the first stage of LLM deployment. ∗
Corresponding author: [email protected]. [email protected] ‡ [email protected] 4 Models: https://huggingface.co/collections/hivetrace/gliner-guard-v1 5 PII-Bench: https://huggingface.co/datasets/hivetrace/pii-bench †
Many of the strongest open guardrails are autoregressive models such as LlamaGuard [7, 13], WildGuard [4], ShieldGemma [24], and GPT-OSS-SafeGuard [16]. These systems can provide high-quality moderation, but their inference cost and latency make always-on deployment expensive at scale. Lightweight encoder models are substantially faster, but existing encoder-based guardrails are typically narrower in scope (e.g., prompt injection only or binary toxicity only) and often less capable. A similar fragmentation exists in privacy pipelines, where production systems frequently rely on a separate NER stack alongside moderation models. This raises a practical systems question: can a compact model provide efficient first-stage protection that combines strong moderation quality and multi-task functionality in a single deployable unit? We answer this question with GLiNER Guard, a unified multi-task guardrail built on top of GLiNER2 [23] for safety classification and PII detection in a single forward pass. We study three deployment-oriented variants: (1) a compact uni-encoder, (2) a shared-weight bi-encoder with label caching support, and (3) GLiNER Guard Omni, a larger variant initialized from GLiNER2 Multi to improve transfer and broader generalization. Our central contribution is not only adapting GLiNER-style architectures to safety supervision, but showing that a single schema-driven encoder can replace multiple first-stage moderation components under realistic serving constraints. Our contributions are: • We introduce GLiNER Guard (GLiGuard), a unified encoder for joint safety classification and PII detection. • We propose compact uni-encoder and shared-weight bi-encoder variants optimized for high-throughput serving. • We present GLiNER Guard Omni, which improves transfer performance while retaining strong moderation quality. • We provide a production-oriented evaluation covering moderation quality, PII detection, generalization, cascading, and serving efficiency. Our results show that compact encoder-based guardrails occupy a practical middle tier between narrow classifiers and large autoregressive moderators, offering strong utility under production latency constraints. This work is a production-oriented technical report. Our focus is practical deployment trade-offs, serving efficiency, and unified first-stage moderation.
2
Related Work
2.1
LLM Safety Guardrails
Autoregressive guardrails. Many of the strongest open safety moderators are autoregressive models trained with safety supervision, including LlamaGuard [7], Llama 4 Guard [13], WildGuard [4], ShieldGemma [24], NemotronGuard [15], 2
PolyGuard [9], and GPT-OSS-SafeGuard [16]. These systems often perform strongly on response-level moderation, multilingual settings, and longer-context inputs. Their main limitation is serving cost: autoregressive decoding introduces substantially higher latency and inference cost than encoder-only alternatives, making always-on deployment expensive at scale. Encoder-based guardrails. A smaller line of work explores encoder-only models for narrower safety tasks. For example, PromptGuard 26 focuses on prompt injection and jailbreak detection, Longformer-harmful-ro7 applies Longformer [1] to binary harmful-content classification, and DeBERTa-v3-base-prompt-injection-v28 uses DeBERTa-v3 [6] for prompt injection detection. Such models are efficient, but they are typically narrow in scope, rely on task-specific fine-tuning, and do not unify moderation with structured extraction tasks such as PII detection.
2.2
Schema-Driven Information Extraction
GLiNER [22] introduced a schema-driven alternative to conventional NER: instead of generating labels as text, it scores candidate spans against natural-language entity descriptions, enabling open-label extraction with a compact encoder. GLiClass [19] extended the same principle to classification tasks. GLiNER2 [23] further unified named entity recognition, relation extraction, and classification within a single encoder architecture conditioned on dynamically defined schemas. However, prior GLiNER-based systems were not designed for safety domains and did not explicitly model adversarial prompts, jailbreak behavior, or moderation taxonomies. Bi-encoder scalability. A bi-encoder variant was later introduced for the original GLiNER by Stepanov et al. [20]. By encoding labels independently and caching their embeddings, it scales more efficiently as label spaces grow. This is particularly attractive for guardrail deployment, where policy schemas may be fixed, large, tenant-specific, or frequently updated. However, prior bi-encoder work focused on single-task NER and relied on two separate encoder towers rather than a shared multitask design.
2.3
PII Detection
PII detection is commonly approached through three paradigms. Rule-based systems such as Presidio [14] are highly precise for structured patterns (emails, phone numbers, identifiers) but weaker on context-dependent entities such as names or freeform addresses. Fine-tuned token classifiers based on encoders such as DeBERTav3 [6] can achieve strong in-domain performance, but typically depend on labeled data and fixed ontologies. LLM-based extraction approaches such as Llama-36
https://huggingface.co/meta-llama/Prompt-Guard-2 https://huggingface.co/LibrAI/longformer-harmful-ro 8 https://huggingface.co/ProtectAI/deberta-v3-base-prompt-injection-v2 7
3
70B [3] support open-vocabulary extraction, but incur substantially higher inference cost. Despite strong progress, PII detection is still often deployed as a separate subsystem alongside moderation models. This increases pipeline complexity, maintenance overhead, and latency. A unified model that shares representations across moderation and span extraction offers a simpler systems alternative. Unified gap and our approach. Taken together, prior work reveals three connected limitations: (1) autoregressive guardrails provide strong moderation quality but remain costly for always-on first-stage deployment, (2) existing encoder guardrails are efficient but narrow in scope, and (3) moderation and PII detection are often implemented as separate systems. GLiNER Guard addresses these limitations with a unified schema-driven encoder family that performs safety classification and PII detection in a single forward pass. We introduce compact uni-/bi-encoder variants for high-throughput serving, a sharedweight bi-encoder with label caching for scalable deployment, and GLiNER Guard Omni for stronger transfer and broader downstream generalization.
3
Method
3.1
Overview
GLiNER Guard is motivated by a simple observation: safety moderation and PII detection are distinct tasks, but both depend on contextual understanding of the same input text. Built on top of GLiNER2 [23], the model unifies safety classification and span-level privacy extraction within a single encoder architecture. The system consists of three components: (1) a shared text encoder, (2) span-scoring heads for extraction tasks, and (3) classification heads for label prediction. Unlike autoregressive guardrails, inference requires no decoding or token generation. Given an input text x and a dynamically defined schema of labels {li }K i=1 , the model predicts classification labels (e.g., safety categories, attack types, intents) and extracts entity spans in a single forward pass.
3.2
Architecture
Backbone. The compact GLiGuard variants use mmBERT-small [12] as the backbone, a multilingual adaptation of ModernBERT [21] with 22 transformer layers, 384-dimensional hidden states, and rotary positional embeddings, supporting 100+ languages. We study three deployment-oriented variants: uni-encoder (147M), bi-encoder (145M) and omni (209M). Uni-Encoder (147M). This variant follows the standard GLiNER2 design: input text and schema labels are concatenated and processed jointly with full bidirectional 4
attention. This provides the richest interaction between text and labels, but requires re-encoding the schema for every request.
Shared-Weight Bi-Encoder (145M). Text and labels are encoded separately and projected into a shared embedding space for matching. Unlike prior GLiNER biencoders [20], which use two independent heads for NER only, our design shares a single backbone across both branches and extends the approach to the multi-task GLiNER2 setting. Because label representations are independent of the input text, they can be precomputed and cached when schemas are fixed. This is useful in production deployments with stable or tenant-specific policy taxonomies.
GLiNER Guard Omni (209M). The compact uni-/bi-encoder variants are trained from scratch for safety-focused deployment. GLiNER Guard Omni instead starts from GLiNER2 Multi [23] and is fine-tuned on the same supervision. This preserves more of the base model’s general-domain transfer ability while adding guardrail capabilities. Omni is intended for scenarios where broader task coverage or custompolicy support is more important than maximum throughput.
3.3
Training
We train all variants on 467,273 multi-task examples, using a 95/5 split between training and held-out validation data. Each sample may contain up to six supervision signals: span extraction, safety classification, adversarial attack detection, harmfulcontent categorization, intent recognition, and tone classification. This multi-task setup encourages shared representations across related moderation and extraction objectives. The training mixture is dominated by classification supervision, while span-level NER annotations are substantially less frequent due to the lower availability of high-quality labeled PII data. In total, 108,702 examples contain span extraction labels covering 32 entity types. For all public datasets, only designated training splits were used. No validation or test examples from evaluation benchmarks were included in training.
4
Experimental Setup
Our experiments are designed to answer five practical questions: (q1) how well does the model perform on safety moderation, (q2) what quality–efficiency trade-off does it achieve relative to larger guardrails, (q3) can the same model also support PII detection, (q4) does the Omni variant retain broader transfer beyond safety, and (q5) how efficiently can the system serve requests under realistic load. 5
4.1
Evaluation Tracks
To address these questions, we organize evaluation into three complementary tracks: • Safety moderation: harmful-content detection, adversarial robustness, and multilingual moderation quality. • PII detection: span-level detection of sensitive entities in realistic text. • Generalization and serving: transfer beyond the safety domain and productionoriented inference efficiency. This structure reflects the intended role of a first-stage production guardrail: it must be effective on safety tasks, useful for PII handling, and efficient enough for always-on deployment.
4.2
Benchmarks
Safety benchmarks.
We use three public guardrail benchmarks:
• Aegis 2.0 [2]: safety classification for prompts and responses. • StrongReject [18]: detection of strongly harmful requests. • PolyGuard [9]: multilingual safety classification with prompt and response splits. For these datasets, we report F1 on the harmful/unsafe class and summarize results with the average score across safety benchmarks (F1avg ). PII benchmarks.
We evaluate span extraction on two datasets:
• PII-Bench: our Russian-language benchmark for span-level PII detection. Because publicly available Russian-language PII benchmarks are limited, we construct a synthetic but human-verified benchmark designed for realistic deployment scenarios. It contains 1,810 examples across 13 entity types and 9 domains. Full benchmark details are provided in Appendix C. • SPY [17]: a public PII benchmark covering legal and medical domains. Out-of-domain generalization. To test whether safety fine-tuning preserves broader capabilities, we evaluate on tasks outside the safety domain: • CrossNER [11]: multi-domain named entity recognition. • SST-2: sentiment classification. • Banking77: intent classification. None of these tasks are included in the safety training data. 6
4.3
Baselines
We compare against three baseline families: guardrail baselines, architectural baselines, and PII baselines. Guardrail baselines. We evaluate autoregressive moderators including LlamaGuard 3 [7], Llama 4 Guard [13], WildGuard [4], ShieldGemma [24], NemotronGuardV2 [15], GPT-OSS-SafeGuard [16], and YuFeng-XGuard [10]. We also include prior encoder-only guardrails: PromptGuard 2, Longformer-harmful-ro, and DeBERTa-v3-base-prompt-injection-v2. Architectural baselines. To isolate the effect of safety-specific adaptation, we compare against models from the same schema-driven family: GLiNER2 Multi v1 [23] and GLiClass Instruct Base v1.0 [19]. PII baselines. For PII detection, we compare against Presidio [14] (rule-based), Llama-3-70B [3] (prompted extraction), and DeBERTa-v3 [6] fine-tuned on SPY.
4.4
Metrics
Quality metrics. For safety benchmarks, we report F1 on the harmful/unsafe class. For span extraction (PII-Bench and CrossNER), we use strict span matching: a prediction is counted as correct only when the start offset, end offset, and entity type exactly match the reference span. For SPY, we report recall following prior work. For SST-2 and Banking77, we report accuracy. As a parameter-efficiency proxy, we use normalized F1 defined as F1avg / log2 P , where P is the number of model parameters. Serving metrics.
To evaluate deployment readiness, we report:
• Throughput (RPS): sustained requests per second under concurrent load. • Latency: P50, P95, and P99 request latency. • Error rate: fraction of failed or timed-out requests. These metrics complement benchmark quality by capturing practical serving constraints.
5
Results
This section is organized around the five practical questions introduced in Section 4. We first evaluate moderation quality and quality–efficiency trade-offs, then test unified PII capability, broader transfer in Omni, and serving efficiency under realistic deployment load. 7
5.1
Q1–Q2: Safety Quality and Quality–Efficiency Trade-off
Table 1 compares GLiGuard against autoregressive guardrails, prior encoder baselines, and architecture-matched schema-driven models. GLiGuard is strongly competitive on safety moderation despite its compact size. GLiGuard Omni achieves the best overall encoder result with 76.9 F1avg , improving over GLiNER2 Multi (66.6) by 10.3 points and GLiClass (64.9) by 12.0 points. On prompt-level moderation, the compact variants remain highly competitive: on Aegis 2.0 prompts, both uni-/bi-encoders reach 80.2 F1, within 1.3 points of WildGuard (81.5), while outperforming LlamaGuard 3 (77.2) and Llama 4 Guard (71.5). On StrongReject, the uni-encoder reaches 98.5 F1 and Omni 99.7, placing both near the top of the comparison set. GLiGuard also provides a particularly favorable quality–efficiency trade-off. All variants lead the full comparison set on parameter-normalized efficiency (F1avg / log2 P ), indicating that strong moderation quality is achieved without relying on larger model scale. Figure 1 visualizes this comparison, with Omni achieving the highest normalized score (2.78). Table 2 provides a complementary single-request view of inference efficiency. Under batch-size-1 evaluation on A100, compact GLiGuard variants remain the fastest encoder models, reaching 54 and 51 requests per second for the bi- and uni-encoder respectively. They also substantially outperform larger autoregressive moderators in latency, for example 0.019 seconds per request for the bi-encoder versus 0.744 for WildGuard. The largest remaining gap appears in response-level and multilingual moderation, where larger autoregressive models continue to lead. This is consistent with the limitations of compact encoders with fixed context windows and non-autoregressive inference. We address this gap through a cascade design that routes only uncertain cases to a stronger second-stage moderator (Section D.3). Extended serving diagnostics under concurrent load are provided in Appendix D.
5.2
Q3: Unified Safety and PII Detection
We next evaluate whether the same deployed model can also support practical PII detection. We report results on PII-Bench in two settings: model-only inference and the full internal NER pipeline. This distinction is important because the deployed pipeline combines learned span extraction with deterministic pattern-matching rules and post-processing. In our pipeline, the model is responsible primarily for two context-dependent entity types: NAME and A DDRESS. Structured entities such as phone numbers, card numbers, tax identifiers, and tokens are detected by rule-based components regardless of the underlying model. For this reason, Table 3 focuses on NAME and A DDRESS, which isolate the model’s actual contribution. Full per-domain and per-entity results, including rule-based categories, are provided in Appendix D.1. 8
Model
Size
Task Aegis 2.0 StrongReject PolyGuard Avg Avg/log2 P P
R
P
R
s-cls 77.2 66.1 98.5 s-cls 71.5 64.7 95.3 s-cls 81.5 82.7 99.5 s-cls 79.9 74.2 90.0 s-cls 86.3 85.4 99.5 s-cls 82.2 77.5 99.2 s-cls 86.4 80.4 100.0 Encoder baselines
68.5 62.4 74.7 47.2 57.5 82.9 85.8
66.3 54.7 66.1 41.0 64.4 74.8 79.2
75.3 69.7 80.9 66.5 78.6 83.3 86.4
2.29 2.08 2.47 2.01 2.39 2.43 2.63
s-cls 52.3 49.8 s-cls 33.7 35.0 p-inj 33.9 34.8
32.5 23.2 47.9 44.3 49.3 35.7 43.5 49.8 32.5
1.76 1.35 1.18
91.3 95.7
57.6 37.1 64.9 60.3 29.9 66.6
2.39 2.41
97.7 98.5 99.7
69.5 49.9 74.3 66.2 48.5 73.8 71.7 58.9 76.9
2.74 2.72 2.78
Autoregressive Llama3Guard Llama4Guard WildGuard ShieldGemma NemotronGuardV2 GPT-OSS-SafeGuard YuFeng-XGuard
8B 12B 7B 9B 8B 20B 8B
Longformer-harmful-ro 149M PromptGuard 2∗ 86M DeBERTa-v3-base-PI 184M
81.7 16.4 0.6
Architecture baselines GLiClass Base v1.0 GLiNER2 Multi v1
150M 209M
cls 74.1 64.5 cls+IE 71.4 75.7 Ours
GLiGuard bi-enc GLiGuard uni-enc GLiGuard Omni
145M s-cls+IE 80.2 74.4 147M s-cls+IE 80.2 75.7 209M s-cls+IE 79.8 74.6
Table 1: Safety moderation results (F1, %) on Aegis 2.0, StrongReject, and PolyGuard. Avg is the unweighted mean over the five benchmark columns. Abbreviations: GLiGuard = GLiNER Guard, P = prompt, R = response.
The results reveal a clear split between raw extraction quality and final pipeline behavior. On model-only NAME extraction, GLiNER2 Multi (85.2 F1) and GLiGuard Omni (83.1) achieve the strongest scores, indicating that broader NER pretraining remains beneficial before post-processing. However, after label mapping and span consolidation, the compact GLiGuard variants achieve the best final pipeline results: the uni-encoder reaches 75.7 F1 on NAME, outperforming GLiNER2 Multi (60.6) by 15.1 points, while the bi-encoder achieves the strongest A DDRESS result at 68.7 F1, compared with 52.1 for GLiNER2 Multi. These gains are particularly important because they arise exactly on the context-dependent entity types that cannot be handled reliably by simple pattern matching. A consistent pattern is that raw A DDRESS scores are near zero across all models, whereas pipeline scores improve substantially after post-processing. This happens because the benchmark expects one consolidated A DDRESS span, while models often predict granular components such as city, street, and unit separately. The pipeline merges these fragments into a single span, making evaluation closer to real redaction behavior. 9
GLiGuard Omni 209M GLiGuard bi-Enc 145M GLiGuard uni-Enc 147M YuFeng-XGuard 8B
2.78 2.74 2.72 2.63
WildGuard 7B GPT-OSS-SafeGuard 20B GLiNER2 Multi 209M GLiClass 150M NemotronGuardV2 8B Llama3Guard 8B Llama4Guard 12B ShieldGemma 9B
2.47 2.43 2.41 2.39 2.39 2.29 2.08 2.01
0
0.5
1
1.5
2
2.5
3
Efficiency = F1avg / log2 P Figure 1: Parameter efficiency: F1avg / log2 P , where P is the number of parameters. Higher is better. GLiNER Guard achieves the best quality-per-parameter ratio.
Model YuFeng-XGuard WildGuard GLiNER2 Multi
Params
Latency↓ (s/req)
Throughput↑ (req/s)
8B 7B 209M
0.051 0.744 0.021
20 1.3 49
0.019 0.020
54 51
Ours GLiGuard bi-enc GLiGuard uni-enc
145M 147M
Table 2: Single-request inference speed on A100 80 GB (batch size 1). Compact GLiNER Guard variants provide the strongest encoder latency while remaining substantially faster than larger autoregressive moderators.
The NAME results show a different trade-off. GLiNER2 Multi and Omni are stronger in raw extraction, but their scores drop after mapping and span consolidation, suggesting that they more often predict fragmented sub-spans whose boundaries do not align with the benchmark’s full-name annotations. In contrast, the compact GLiGuard variants produce the strongest final pipeline results. Overall, these results support the central multitask claim of GLiGuard: a single encoder can provide both safety moderation and useful PII handling within one deployed system, reducing the need for separate moderation and NER stacks. Extended PII breakdowns and SPY results are provided in Appendix D.1. 10
NAME F1
ADDRESS F1
Model
Model
Pipeline
Model
Pipeline
GLiGuard uni-enc GLiGuard bi-enc GLiGuard Omni GLiNER2 Multi GLiNER2 Large
74.6 63.7 83.1 85.2 27.8
75.7 69.5 52.3 60.6 30.3
0.5 0.0 6.6 5.2 0.0
65.9 68.7 54.6 52.1 35.9
Table 3: PII-Bench: F1 (%) on model-dependent entity types. “Model” = raw inference; “Pipeline” = with span merging and label mapping. GLiNER Guard leads on pipeline NAME; ADDRESS requires merging for all models.
5.3
Q4: Generalization Beyond Safety
We next test whether safety fine-tuning preserves transfer ability for adjacent tasks and custom policy settings. The compact uni-/bi-encoders are deliberately specialized for fixed-schema moderation and generalize poorly outside their target domain. On Banking77, for example, they reach only 0.08 and 0.01 accuracy, respectively. This confirms that their strong moderation efficiency comes from deliberate specialization rather than broad transfer capacity. Omni substantially outperforms the compact variants on both benchmarks, reaching 0.74 accuracy on SST-2 and 0.59 on Banking77. Relative to the original GLiNER2 model, Omni retains much of the base model’s zero-shot transfer ability while adding strong moderation performance. This makes Omni the preferable variant when deployments require custom policy categories, broader schemas, or adjacent extraction tasks beyond core safety filtering. Model
Params
SST-2 (Acc)
Banking77 (Acc)
GPT-4o DeBERTa-v3 GLiClass GLiNER2 [23]
>100B 435M 190M 209M
0.94 0.92 0.90 0.86
0.78 0.42 0.21 0.70
0.50 0.62 0.74
0.01 0.08 0.59
Ours GLiGuard bi-enc GLiGuard uni-enc GLiGuard Omni
145M 147M 209M
Table 4: Zero-shot generalization to sentiment (SST-2) and intent detection (Banking77). Accuracy. Uni/bi-encoders collapse on tasks outside their safety training distribution. Omni partially retains generalization from GLiNER2 [23] pretraining, at a cost relative to the base model (0.74 vs. 0.86 on SST-2; 0.59 vs. 0.70 on Banking77).
Additional CrossNER results are provided in Appendix D.2. 11
5.4
Q5: Serving Efficiency
We evaluate serving under dynamic batching and concurrent load on a single A100 80 GB. Table 5 reports three runtime backends for each model: PyTorch FP16, ONNX CUDA FP16, and ONNX TensorRT FP16. GLiGuard achieves the strongest overall serving result, reaching 193.6 requests per second with 480 ms P50 latency, 750 ms P95 latency, and 900 ms P99 latency under ONNX TensorRT, with zero errors. Relative to GLiNER2 under the same ONNX TensorRT backend, GLiGuard improves throughput by 58% (193.6 vs. 122.6 RPS) while reducing tail latency by 36% at P99 (900 vs. 1400 ms). Similar gains hold across the PyTorch and ONNX CUDA backends. We also observe stronger runtime stability: GLiGuard maintains zero errors across all three backends, whereas GLiNER2 under PyTorch exhibits a 12.95% error rate under load. These results support the intended role of GLiGuard as an always-on first-stage moderation layer with favorable throughput, latency, and serving robustness. Model
RPS↑
P50 (ms)↓
P95 (ms)↓
P99 (ms)↓
Err (%)↓
PyTorch FP16 GLiGuard uni-enc ONNX CUDA FP16 ONNX TensorRT FP16
148.2 170.6 193.6
570 540 480
1500 870 750
1700 1000 900
0.00 0.00 0.00
PyTorch FP16 ONNX CUDA FP16 ONNX TensorRT FP16
83.7 90.8 122.6
1200 1000 740
2000 1700 1200
2400 2100 1400
12.95 0.00 0.00
GLiNER2 Multi
Runtime
Table 5: Serving performance under dynamic batching (LitServe, max batch 64, timeout 50 ms, NVIDIA A100 80 GB). RPS = requests per second; P50/P95/P99 = end-to-end latency percentiles; Err = HTTP error rate.
Full backend comparisons and batch-size-1 latency are provided in Appendix D. Overall, the results provide consistent answers to the five practical questions posed in Section 4. GLiGuard delivers strong moderation quality with a leading quality– efficiency trade-off, extends the same deployed model to practical PII detection, and offers high serving throughput suitable for always-on production use. Within the model family, the compact uni-/bi-encoder variants are best suited for cost-efficient first-stage filtering, while Omni trades some efficiency for stronger transfer, broader schema support, and higher-quality fallback or cascade deployments.
6
Discussion
A practical middle tier for guardrails. Our results suggest that safety systems need not choose only between small but weak classifiers and large but expensive autoregressive moderators. GLiNER Guard occupies a useful middle tier: compact encoder models that remain competitive on core moderation benchmarks while 12
offering substantially lower serving cost and latency. This makes always-on firststage filtering practical in settings where LLM moderation would be prohibitively expensive. Different variants for different deployments. The three model variants are complementary rather than strictly ranked. The uni-encoder is the default choice for fixed-schema production moderation, combining strong quality with the highest throughput. The bi-encoder is most attractive when label spaces are large, tenantspecific, or frequently updated, since label embeddings can be cached independently of requests. Omni is the preferred option when deployments require broader transfer, custom schemas, or additional tasks beyond safety moderation, trading some throughput for stronger generalization. Value of unifying moderation and PII detection. A key practical contribution is task unification. Production systems often maintain separate stacks for moderation and PII detection, requiring multiple models, multiple inference passes, and duplicated operational overhead. GLiNER Guard shows that both capabilities can be delivered by a single encoder in one forward pass. The strong PII-Bench results indicate that safety classification and span extraction can share useful representations rather than competing for capacity. Where larger models still help. Large autoregressive guardrails retain advantages on response-level moderation, multilingual transfer, and ambiguous cases requiring longer-context reasoning. We view this not as a failure of encoder-based guardrails, but as evidence for tiered moderation architectures. In such systems, GLiNER Guard handles high-volume routine traffic, while a stronger second-stage model is invoked only for uncertain or structurally difficult inputs.
7
Limitations and Future Work
Response-level moderation and context length. Response-level moderation remains weaker than the strongest large-model baselines, particularly in multilingual and longer-context settings requiring more advanced reasoning capabilities. The compact context window further constrains robustness on very long inputs. PII evaluation scope. PII-Bench is synthetic and currently limited to Russianlanguage data. Broader multilingual and real-world privacy evaluation therefore remains unresolved. In addition, some PII categories in the deployed pipeline rely primarily on deterministic rule-based components rather than learned extraction. Consequently, the reported end-to-end PII results should be interpreted as hybrid pipeline performance rather than purely model-based capability. Comparison and serving constraints. Comparisons between encoder-based and autoregressive guardrails are constrained by differing inference paradigms and 13
serving assumptions, which complicates direct comparison. Serving experiments are limited to A100-class hardware and may not directly generalize to CPU-only, edge, or lower-memory deployment environments.
Future work. Future work should include stronger calibration analysis, broader robustness evaluation, cost-normalized comparisons under matched deployment constraints, longer-context backbones, improved cascade routing strategies, and broader multilingual supervision.
8
Conclusion
We presented GLiNER Guard, a unified encoder-based guardrail that performs safety classification and PII detection in a single forward pass. By combining moderation and structured extraction within one model, it reduces pipeline complexity, lowers serving cost, and simplifies deployment compared with multi-model safety stacks. Our experiments show that compact encoder guardrails can be both practical and strong. Under realistic production load, the compact variant reaches 193.6 requests per second on a single A100 with 900 ms P99 latency and zero serving errors, substantially outperforming GLiNER2 Multi in throughput and tail latency under the same runtime. On public safety benchmarks, GLiNER Guard Omni achieves the strongest overall encoder result with 76.9 F1avg , improving over GLiNER2 Multi by 10.3 points while remaining competitive with much larger autoregressive moderators. The three released variants target complementary deployment needs. The uniencoder prioritizes maximum throughput for fixed moderation schemas, the biencoder enables scalable serving through label caching for large or evolving taxonomies, and Omni extends the framework toward broader zero-shot transfer and multi-purpose use cases. Across variants, we also demonstrate useful zero-shot PII detection and release PII-Bench, a Russian-language benchmark with 1,810 span-annotated examples across 13 entity types and 9 domains. At the same time, larger autoregressive moderators still hold advantages on responselevel moderation, multilingual transfer, and other cases requiring longer-context reasoning. This motivates tiered production architectures in which a fast encoder handles high-volume traffic and stronger LLM moderators are reserved for harder or uncertain requests. Overall, our results show that unified encoder guardrails are a viable foundation for modern safety systems: fast enough for always-on deployment, flexible enough for multi-task moderation, and strong enough to meaningfully reduce reliance on expensive LLM-only solutions. 14
Acknowledgments We sincerely thank Urchade Zaratiana, the creator of GLiNER and GLiNER 2, and Ihor Stepanov, the creator of GLiClass, as well as their teams, whose architectural contributions and open-source work greatly inspired and enabled the development of GLiNER Guard.
References [1] Iz Beltagy, Matthew E Peters, and Arman Cohan. Longformer: The longdocument transformer. arXiv preprint arXiv:2004.05150, 2020. [2] Shaona Ghosh, Prasoon Varshney, Makesh Narsimhan Sreedhar, Aishwarya Padmakumar, Traian Rebedea, Jibin Rajan Varghese, and Christopher Parisien. AEGIS2.0: A diverse AI safety dataset and risks taxonomy for alignment of LLM guardrails. In Proceedings of the 2025 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 5992–6026, 2025. [3] Aaron Grattafiori, Abhimanyu Dubey, et al. The Llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024. [4] Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. WildGuard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of LLMs. arXiv preprint arXiv:2406.18495, 2024. [5] Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. WildGuard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of LLMs. arXiv preprint arXiv:2406.18495, 2024. [6] Pengcheng He, Jianfeng Gao, and Weizhu Chen. DeBERTaV3: Improving DeBERTa using ELECTRA-style pre-training with gradient-disentangled embedding sharing. In Proceedings of the Eleventh International Conference on Learning Representations (ICLR), 2023. [7] Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: LLM-based input-output safeguard for human-AI conversations. arXiv preprint arXiv:2312.06674, 2023. [8] Knowledgator. FlashDeBERTa: Memory-efficient attention for deberta. https: //github.com/Knowledgator/FlashDeBERTa, 2024. [9] Priyanshu Kumar, Devansh Jain, Akhila Yerukola, Liwei Jiang, Himanshu Beniwal, Thomas Hartvigsen, and Maarten Sap. PolyGuard: A multilingual safety moderation tool for 17 languages. arXiv preprint arXiv:2504.04377, 2025. 15
[10] Junyu Lin, Meizhen Liu, Xiufeng Huang, Jinfeng Li, Haiwen Hong, Xiaohan Yuan, Yuefeng Chen, Longtao Huang, Hui Xue, Ranjie Duan, Zhikai Chen, Yuchuan Fu, Defeng Li, Lingyao Gao, and Yitong Yang. YuFeng-XGuard: A reasoning-centric, interpretable, and flexible guardrail model for large language models. arXiv preprint arXiv:2601.15588, 2026. [11] Zihan Liu, Yan Xu, Tiezheng Yu, Wenliang Dai, Ziwei Ji, Samuel Cahyawijaya, Andrea Madotto, and Pascale Fung. CrossNER: Evaluating cross-domain named entity recognition. arXiv preprint arXiv:2012.04373, 2020. [12] Marc Marone, Orion Weller, William Fleshman, Eugene Yang, Dawn Lawrie, and Benjamin Van Durme. mmbert: A modern multilingual encoder with annealed language learning. arXiv preprint arXiv:2509.06888, 2025. [13] Meta AI. Llama 4 guard, 2025. Available at https://huggingface.co/met a-llama/Llama-4-Guard-12B. [14] Microsoft. Presidio – data protection and de-identification SDK, 2018. Available at https://github.com/microsoft/presidio. [15] NVIDIA. Aegis NemotronGuard, 2025. Available at https://huggingface. co/nvidia/Aegis-AI-Content-Safety-NemotronGuard-V2-8B. [16] OpenAI. gpt-oss-120b & gpt-oss-20b model card. arXiv:2508.10925, 2025.
arXiv preprint
[17] Maksim Savkin, Timur Ionov, and Vasily Konovalov. SPY: Enhancing privacy with synthetic PII detection dataset. In Proceedings of the 2025 Conference of the North American Chapter of the Association for Computational Linguistics: Student Research Workshop, 2025. URL https://aclanthology.org/202 5.naacl-srw.23/. [18] Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and Sam Toyer. A StrongREJECT for empty jailbreaks. In Advances in Neural Information Processing Systems 37 (NeurIPS 2024), Datasets and Benchmarks Track, 2024. [19] Ihor Stepanov, Mykhailo Shtopko, Dmytro Vodianytskyi, Oleksandr Lukashov, Alexander Yavorskyi, and Mykyta Yaroshenko. GLiClass: Generalist lightweight model for sequence classification tasks. arXiv preprint arXiv:2508.07662, 2025. [20] Ihor Stepanov, Mykhailo Shtopko, Dmytro Vodianytskyi, and Oleksandr Lukashov. The million-label NER: Breaking scale barriers with GLiNER bi-encoder. arXiv preprint arXiv:2602.18487, 2026. [21] Benjamin Warner, Antoine Chaffin, Benjamin Clavié, Orion Weller, Oskar Hallström, Said Taghadouini, Alexis Gallagher, Raja Biswas, Faisal Ladhak, Tom Aarsen, Griffin Thomas Adams, Jeremy Howard, and Iacopo Poli. Smarter, better, faster, longer: A modern bidirectional encoder for fast, memory efficient, 16
and long context finetuning and inference. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 2526–2547, Vienna, Austria, 2025. Association for Computational Linguistics. [22] Urchade Zaratiana, Nadi Tomeh, Pierre Holat, and Thierry Charnois. GLiNER: Generalist model for named entity recognition using bidirectional transformer. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 5364–5376. Association for Computational Linguistics, 2024. [23] Urchade Zaratiana, Gil Pasternak, Oliver Boyd, George Hurn-Maloney, and Ash Lewis. GLiNER2: An efficient multi-task information extraction system with schema-driven interface. arXiv preprint arXiv:2507.18546, 2025. [24] Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, Olivia Sturman, and Oscar Wahltinez. ShieldGemma: Generative AI content moderation based on Gemma. arXiv preprint arXiv:2407.21772, 2024.
A
Training Details
A.1
Training Hyperparameters
Table 6 reports the optimization settings used for all model variants. The compact uni-/bi-encoder models share the same configuration, while Omni differs in backbone and batch size. Parameter
uni/bi-encoder
Omni
Backbone Max sequence length Max span width Epochs Batch size Encoder LR Task heads LR Scheduler Optimizer Warmup ratio Weight decay Max gradient norm Precision
mmBERT-small 384 12 3 64 1 × 10−5 2 × 10−5 cosine AdamW 0.1 0.01 10.0 bf16
mDeBERTa (GLiNER2-Multi-v1) 384 8 3 32 1 × 10−5 2 × 10−5 cosine AdamW 0.1 0.01 10.0 bf16
Table 6: Training hyperparameters. Omni was trained with FlashDeBERTa [8] for memory efficiency and speed.
17
B
Training Data
Data sources and provenance. GLiNER Guard is trained on 467,273467,273 467,273 multi-task samples. Each sample carries up to 6 simultaneous tasks: 1 span extraction (NER) and 5 classification tasks. Table 7 lists the publicly available datasets used to construct the training corpus. In addition to the public sources, the corpus includes internal data: Russian translations of the WildGuardMix [5] and Aegis 2.0 [2] safety datasets, as well as internal safety data. Dataset
Domain
Language
License
WildGuardMix Aegis 2.0 Ru Toxic Texts PII NER Corpus Synthetic Nemotron-PII Synthetic PII Finance Russian Dialogues GrandMaster-PRO-MAX
Safety Safety Toxicity PII / NER PII / NER PII / NER Dialogues General
EN EN RU EN EN Multi RU RU/EN
ODC-BY CC-BY-4.0 MIT MIT CC-BY-4.0 Apache-2.0 MIT Apache-2.0
Table 7: Public data sources used in training.
Full label distributions. objective.
C
Table 8 report detailed class frequencies for each training
PII-Bench Benchmark Specification
PII-Bench is a Russian-language benchmark for span-level PII detection in realistic production scenarios. It uses explicit character-level offsets, enabling evaluation of complete systems including model predictions, post-processing, and rule-based components. All examples are fully synthetic and do not contain real user data; human verification was used to validate formatting, span boundaries, and domain realism. Two annotators independently reviewed all examples and resolved disagreements through discussion to reach consensus. Each example is a JSON object containing a text field, a domain label, and a list of entity spans with character-level offsets (start, end) and entity type. The benchmark covers 13 PII entity types common in Russian-language interactions. Each type has exactly 70 examples in the entity-level split, and every such example contains at least one PII span. Examples are drawn from 9 domains split into two sensitivity levels. S (Sensitive) domains represent settings where real PII is expected and recall is the main priority, since missed entities are more costly than false alarms. L (Low Sensitivity) domains represent more general dialogues where PII is typically absent and false positives are therefore more disruptive to user experience. 18
Group
Label
Count
%
Person
person first_name last_name alias title
52,754 13,020 7,877 3,493 385
13.54 3.34 2.02 0.90 0.10
Location
street city country region postal_code unit address district building landmark
26,227 24,529 12,551 8,904 7,954 3,764 3,615 2,263 2,159 746
6.73 6.30 3.22 2.29 2.04 0.97 0.93 0.58 0.55 0.19
Organization
company product government education media
36,365 3,196 2,105 1,193 708
9.33 0.82 0.54 0.31 0.18
Contact
email phone social_account messenger
31,024 25,027 3,070 91
7.96 6.42 0.79 0.02
Identity
national_id document_id passport
26,782 16,912 732
6.87 4.34 0.19
Temporal
event_date date_of_birth
31,335 11,571
8.04 2.97
Financial
bank_account card_number crypto_wallet
18,845 9,304 1,110
4.84 2.39 0.28
Table 8: NER entity distribution.
19
Type
Description
N
NAME PHONE_NUMBER EMAIL ADDRESS BANK_CARD_NUMBER CVC INN KPP OGRN OGRNIP SNILS PASSPORT_NUMBER TOKEN
Full names (all grammatical cases) Phone numbers Email addresses Physical addresses Bank card numbers CVC/CVV codes Taxpayer ID Tax registration code State registration number Individual entrepreneur reg. number Social insurance number Passport numbers API tokens, recovery keys
70 70 70 70 70 70 70 70 70 70 70 70 70
Table 9: PII-Bench entity types. Each type contains exactly 70 examples with PII spans.
Domain
Description
S-BANK S-TELECOM S-DELIVERY S-AUTO S-HR S-RE S-SUPPORT L-CHAT L-DIALOG
Banking support Telecom support Delivery service Auto service HR / recruiting Real estate General support Chats / messengers Multi-turn dialogues
N
With PII
100 100 100 100 100 100 100 100 100
65 (65%) 62 (62%) 51 (51%) 58 (58%) 65 (65%) 66 (66%) 55 (55%) 50 (50%) 50 (50%)
Table 10: PII-Bench domains. S-domains prioritize recall; L-domains prioritize low false positive rates.
PII-Bench consists of two complementary splits. The entity split groups examples by entity type (NAME, PHONE_NUMBER, etc.), with each example containing exactly one PII type; it is intended for per-type quality measurement. The domain split groups examples by realistic scenario (banking, telecom, delivery, and so on), with a natural mix of PII and non-PII examples; it is intended for end-to-end pipeline evaluation, including false positive assessment on clean text. Split
Total
With PII
Without PII
Entity Domain
910 900
910 (100%) 522 (58%)
0 (0%) 378 (42%)
Total
1,810
1,432 (79%)
378 (21%)
Table 11: PII-Bench sample-level statistics by split.
20
While 79% of examples contain PII, the actual character-level PII density is much lower, about 19.6%, reflecting realistic text distributions in which sensitive spans are short fragments embedded in longer passages. Split
Total chars
PII chars
Clean chars
Entity Domain
65.1K 91.7K
18.2K (28.0%) 12.6K (13.7%)
46.9K (72.0%) 79.1K (86.3%)
Total
156.8K
30.8K (19.6%)
126.0K (80.4%)
Table 12: PII-Bench character-level statistics. PII spans constitute only 19.6% of total characters.
D
Extended Serving Diagnostics
The main paper reports the primary serving results, including best-runtime performance under concurrent load and a single-request latency comparison. This appendix provides the complete backend breakdown across runtimes together with additional serving diagnostics. We evaluate two serving regimes. Dynamic batching under concurrent load reflects realistic deployment behavior for an always-on firststage guardrail. Batch-size-1 (see Table 2) latency serves as a hardware-normalized microbenchmark that isolates per-request inference overhead. Figure 2 reports latency percentiles and throughput across three runtimes: PyTorch FP16, ONNX CUDA FP16, and ONNX TensorRT FP16. Across all backends, GLiNER Guard consistently outperforms GLiNER2 Multi in throughput while maintaining lower tail latency. TensorRT provides the strongest performance for both models, but the relative advantage of GLiNER Guard remains stable across runtimes.
D.1
Extended PII Evaluation
This section provides the full PII evaluation underlying the summary results reported in the main text. We separate three views of performance: (i) raw model extraction on PII-Bench, (ii) end-to-end pipeline results after deterministic post-processing, and (iii) transfer to the external SPY benchmark. In the main text, we focus on NAME and A DDRESS because these are the only entity types whose quality depends materially on the learned model. Structured identifiers such as emails, card numbers, tax IDs, and tokens are handled by deterministic detectors and therefore vary little across model backbones once integrated into the production pipeline. Table 13 reports model-only F1 by domain before any span merging or rule-based normalization. GLiNER Guard Omni and GLiNER2 Multi perform strongest in this setting, indicating the benefit of broader NER pretraining for zero-shot span extraction. 21
GLiNER2 Multi
FP16
FP16
FP16
1,000
0
1,400
1,200
P99
1,000
900
P95
740
480
750
1,000
870 540
1,000
2,000 1,200
Latency (ms)↓
1,700
1,500
2,000
P99
570
Latency (ms)↓
P95
P50
1,700
2,000
P50
2,100
2,400
GLiNER Guard uni-encoder
0
rch
PyTo
UDA
X-C ONN
-TRT
X ONN
P16
rch F PyTo
UDA
X-C ONN
16 FP16 T FP X-TR N N O
83.7 PyTorch FP16 148.2 90.8 ONNX-CUDA FP16 170.6 122.6
GLiNER Guard uni-encoder
ONNX-TRT FP16
193.6 GLiNER2 Multi 0
20
40
60
80
100
120
140
160
180
200
220
Requests per second↑ Figure 2: Serving performance under dynamic batching (LitServe, max batch 64, timeout 50 ms, A100 80 GB). Top: latency percentiles. Bottom: throughput.
D.1.1
PII-Bench: Raw Model Extraction
Domain
GLiNER Guard uni GLiNER Guard bi
GLiNER Guard Omni
GLiNER2 Multi
GLiNER2 Large
L-CHAT L-DIALOG S-AUTO S-BANK S-DELIVERY S-HR S-RE S-SUPPORT S-TELECOM
75.8 29.9 30.0 16.8 54.2 28.9 21.2 38.0 24.0
86.5 44.8 40.5 23.2 54.6 41.5 27.4 61.2 33.9
92.6 44.0 70.6 71.6 54.1 82.6 64.2 81.6 71.1
85.5 42.3 74.2 69.4 63.7 78.8 70.1 74.8 69.9
64.3 24.6 36.4 45.8 40.6 52.1 33.8 63.8 43.9
Avg
35.4
46.0
70.3
69.9
45.0
Table 13: PII-Bench: model-only F1 (%) by domain.
Table 14 provides the same comparison by entity type. Raw extraction is strongest for structured entities and weaker for entities requiring boundary aggregation, especially A DDRESS. 22
240
Entity
GLiNER Guard uni
GLiNER Guard bi
GLiNER Guard Omni
GLiNER2 Multi
GLiNER2 Large
EMAIL NAME PHONE_NUMBER BANK_CARD CVC PASSPORT TOKEN ADDRESS INN KPP OGRN OGRNIP SNILS
100.0 74.6 21.8 19.8 21.3 18.8 18.6 0.5 0.0 5.7 0.0 19.2 14.0
97.2 63.7 20.6 21.3 0.0 12.8 9.7 0.0 0.0 0.0 0.0 0.0 0.0
100.0 83.1 87.2 69.4 40.5 60.6 66.7 6.6 96.6 81.4 88.3 90.2 75.5
100.0 85.2 76.0 62.7 27.8 51.7 33.1 5.2 97.2 81.9 99.3 98.6 75.7
100.0 27.8 57.5 67.3 41.1 16.1 14.8 0.0 0.0 12.5 30.4 10.8 75.0
Avg
24.2
17.3
72.8
68.8
34.9
Table 14: PII-Bench: model-only F1 (%) by entity type.
D.1.2
PII-Bench: End-to-End Pipeline Results
We next evaluate the full production pipeline, which combines learned extraction with rule-based detectors, label mapping, and span merging. This setting better reflects real deployment behavior than raw model scores alone. Table 15 shows pipeline F1 by domain. The compact GLiNER Guard variants achieve the strongest average results, reaching 84.4 and 83.3 F1. Domain
Pipe+Guard Omni
Pipe+GLiNER2 Multi
Pipe+GLiNER2 Large
L-CHAT L-DIALOG S-AUTO S-BANK S-DELIVERY S-HR S-RE S-SUPPORT S-TELECOM
Pipe+Guard uni Pipe+Guard bi 97.1 76.6 74.9 84.9 86.4 93.0 79.8 94.4 72.3
94.3 75.2 74.3 83.9 83.3 89.4 80.0 93.8 75.2
75.2 63.6 73.0 78.5 75.9 87.7 69.0 90.7 70.3
75.8 47.4 71.7 75.6 77.1 83.8 71.0 87.2 68.4
60.6 25.1 58.1 68.2 61.9 65.9 59.9 76.8 61.4
Avg
84.4
83.3
76.0
73.1
59.8
Table 15: PII-Bench: full pipeline F1 (%) by domain.
Table 16 separates rule-based and model-dependent entities. As discussed in the main text, the key learned gains come from NAME and A DDRESS.
D.1.3
External Benchmark: SPY
Finally, we evaluate transfer to SPY, a public benchmark in legal and medical domains. We report recall only, following prior work, because SPY selectively annotates author-related PII and does not support fair precision comparison. GLiNER Guard remains strongest on structured entities such as emails, IDs, phone numbers, and addresses, while task-specific DeBERTa-v3 performs best on contextheavy labels such as names and usernames. 23
Entity
Pipe+Guard uni
Pipe+Guard bi
Pipe+Guard Omni
Pipe+GLiNER2 Multi
Pipe+GLiNER2 Large
Rule-based entities (identical across models) EMAIL† TOKEN† KPP† OGRNIP† BANK_CARD† OGRN† SNILS† CVC† INN† PHONE_NUMBER† PASSPORT†
100.0 100.0 100.0 100.0 95.5 95.5 95.5 94.7 88.0 60.4 49.6
100.0 100.0 100.0 100.0 95.5 95.5 95.5 94.7 88.0 60.4 49.6
NAME ADDRESS
75.7 65.9
69.5 68.7
Avg
86.2
85.9
100.0 100.0 100.0 100.0 95.5 95.5 95.5 94.7 88.0 60.4 49.6
100.0 100.0 100.0 100.0 95.5 95.5 95.5 94.7 88.0 60.4 49.6
100.0 100.0 100.0 100.0 95.5 95.5 95.5 94.7 88.0 60.4 49.6
52.3 54.6
60.6 52.1
30.3 35.9
83.5
84.0
80.4
Model-dependent entities
†
Detected by deterministic rules; model choice has no effect.
Table 16: PII-Bench: full pipeline F1 (%) by entity type.
Llama-3-70B 70 B autoregressive yes no
DeBERTa-v3† 184 M token cls no yes
GG (uni) 147 M span + text cls yes no
(a) Legal Questions Name 79.4 Email 91.8 User. – URL 21.3 ID 34.4 Phone 68.1 Addr. –
68.9 88.5 59.7 92.5 62.2 92.8 81.3
93.2 99.1 98.0 99.0 96.6 98.7 94.5
73.6 96.0 40.9 – 80.7 86.8 83.4
72.6 96.0 43.9 – 75.8 90.4 83.8
88.8 95.9 43.8 19.5 80.9 89.4 95.5
(b) Medical Consultations Name 80.4 Email 92.2 User. – URL 19.4 ID 38.9 Phone 65.5 Addr. –
62.9 90.9 70.4 91.9 75.1 90.0 90.4
88.7 99.5 95.4 98.9 98.3 96.9 95.1
65.9 94.2 47.7 – 89.1 86.6 82.2
62.3 94.2 53.4 – 84.9 89.0 82.7
78.2 93.9 54.4 24.1 86.3 87.5 93.7
Model Presidio Params Task token cls + rules Open-labels rules only Fine-tuned no
GG (bi) GG Omni 145 M 209 M span + text cls span + text cls yes yes no yes
Model details Presidio: rule-based NER + regex, zero-shot. Llama-3-70B: autoregressive prompted NER, zero-shot. DeBERTa-v3† : token cls, fine-tuned on SPY cross-domain. GG: GLiNER Guard, zero-shot span extraction + cls, open labels. GG Omni: fine-tuned from GLiNER 2 Multi on safety-domain data.
Table 17: PII entity recall (%) on SPY. SPY annotates only author-related PII; non-author entities are unlabeled, making precision incomparable across models. “–” indicates entity types outside the model’s training ontology.
24
D.2
Additional Generalization Results
We report CrossNER results to complement the SST-2 and Banking77 summary shown in the main text. CrossNER provides a stricter test of open-label transfer because it requires span-level extraction across five unseen domains rather than sentence-level classification alone. The same pattern observed in the main text becomes even clearer here. The compact uni-/bi-encoder variants, trained for fixed-schema safety deployment, collapse outside their target domain and average only 13.6–14.7 strict F1. This confirms that their strong moderation performance comes from deliberate specialization rather than broad general-purpose transfer. In contrast, GLiNER Guard Omni retains substantial zero-shot extraction ability after safety fine-tuning, reaching 51.4 average F1 across domains. It performs strongest on Music (58.0), Politics (56.2), and Literature (50.3), showing that the model still transfers to diverse entity schemas beyond safety tasks. Although Omni remains below the original GLiNER2 model (59.0) and GPT-4o (59.9), the gap is moderate relative to the large gains it delivers on moderation benchmarks. These results reinforce the intended division of roles within the model family: compact variants are optimized for efficient first-stage moderation, whereas Omni offers a better balance between guardrail quality and broader downstream adaptability. Model
Params
AI
GPT-4o GLiNER-M GLiNER2 [23]
>100B 54.7 – 51.8 209M 52.6
Literature
Music
Politics
Science
Avg
56.1 59.7 56.4
73.6 69.4 63.2
63.2 68.6 67.9
51.8 58.1 54.7
59.9 61.5 59.0
13.5 11.7 50.3
10.1 10.6 58.0
21.2 19.1 56.2
13.4 12.3 46.8
14.7 13.6 51.4
Ours GLiNER Guard bi-Encoder GLiNER Guard uni-Encoder GLiNER Guard Omni
145M 147M 209M
15.3 14.3 45.9
Table 18: Zero-shot NER strict F1 (%) on CrossNER across five domains. Uni/bi-encoders are highly specialized for safety tasks, while Omni retains substantially stronger opendomain transfer after safety fine-tuning.
D.3
Cascade for Harder Cases
The remaining quality gap is concentrated in settings where first-stage encoders are least expected to dominate: long outputs, multilingual inputs, and harder response judgments. We therefore treat this gap as a routing problem rather than a replacement problem. Pairing GLiNER Guard with YuFeng-XGuard as a second stage improves moderation quality while routing only a fraction of traffic to the more expensive LLM tier. As shown in Figure 3, increasing the escalation threshold smoothly trades efficiency for higher quality. 25
90
Prompt cascade
XGuard P
Unsafe-class F1 (%)
Response cascade 80 XGuard R Omni P (71.7) 70 Uni-enc P
60 Omni R (58.9) 50 Uni-enc R
40 0
20
40
60
80
100
XGuard calls (%) Figure 3: Cascade inference on PolyGuard: unsafe-class F1 vs. XGuard call rate at five GLiNER confidence thresholds (τ ∈ {0.5, 0.7, 0.9, 0.95, 0.99}). Solid curves: cascade (leftmost point = Uni-encoder alone; rightmost = XGuard 8B alone). Dashed lines: Omni standalone (no cascade), shown for reference. Moving right trades encoder throughput for LLM quality (see Table 19).
A practical deployment strategy is therefore to use GLiNER Guard as the default moderator and escalate only uncertain or structurally difficult cases.
26
Model Longformer-harmful-ro GLiNER2 Multi Llama4Guard GLiGuard uni-Enc (alone) GLiGuard bi-Enc (alone) Llama3Guard GLiNER Guard Omni (alone) WildGuard Cascade τ =0.95 (43%p / 35%r calls) Cascade τ =0.99 (62%p / 58%r calls) YuFeng-XGuard (alone)
Params
PolyGuard P
PolyGuard R
Type
149M 209M 12B
32.5 60.3 62.4
23.2 29.9 54.7
encoder encoder autoregressive
147M
66.2
49.1
encoder
145M 8B
69.5 68.5
49.9 66.3
encoder autoregressive
209M 7B
71.7 74.7
58.9 66.1
encoder autoregressive
147M+8B
77.4
65.0
cascade
147M+8B
81.1
70.2
cascade
8B
85.8
79.2
autoregressive
Table 19: Cascade vs. standalone models on PolyGuard (unsafe-class F1, %). P = Prompt, R = Response. Gray rows are our encoder models; cascade rows combine our encoder with XGuard 8B. Cascade operating points interpolate between GLiNER Guard uni-Enc (fast, lower quality) and XGuard (slow, higher quality).
27