Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations

Content moderation at serving time requires classifying BOTH the user prompt and the model's response, and existing moderation tools were not purpose-built for the human-AI conversation setting or for taxonomy-driven classification.

An instruction-tuned Llama2-7b safeguard MODEL, not a filter. Incorporates a SAFETY RISK TAXONOMY that categorises the risks found in prompts, and uses the SAME taxonomy to classify the model's responses (prompt classification vs response classification). Functions as a language model performing MULTI-CLASS classification and emitting binary decision scores. Because it is instruction-tuned, the taxonomy categories and output format are ADAPTABLE per use case, enabling zero-shot or few-shot prompting with different taxonomies at the input.

No latency or throughput figure. The reported results are quality: strong performance on the OpenAI Moderation Evaluation dataset and ToxicChat, MATCHING OR EXCEEDING currently available content moderation tools. The serving-cost implication is structural and recorded here rather than in the paper: this is a SECOND MODEL CALL on the critical path per interaction, at 7B parameters - which is exactly the cost problem that Llama Guard 3-1B-INT4 (pap-eff-llama-guard-3-1b-int4) exists to solve, with explicit tok/s and TTFT numbers.

ADOPTION: in-production - weights are open (open_weights true) and Llama Guard is deployed as a moderation model across Meta's products and widely reused elsewhere. VENUE NOTE: no peer-reviewed venue verifiable via Semantic Scholar at verification time (rate-limited) and no arXiv comment venue, so venue = arxiv-preprint with year = ArXiv v1 (Dec 2023). THE COST POINT IS RECORDED EXPLICITLY BECAUSE IT IS THE REASON THE SUCCESSOR EXISTS: an LLM-based guardrail at 7B doubles the number of model invocations per conversation, and unlike speculative decoding there is no lossless trick for it - you either shrink the guard model or accept the latency. Pair this record with pap-eff-llama-guard-3-1b-int4, which quantifies exactly this trade with a 7x smaller model and a measured TTFT, and note the taxonomy-adaptation feature as the reason an instruction-tuned guard is preferable to a fixed-classifier approach for a repo that needs to distinguish risk categories. DANGLING REF RESOLVED 2026-10-04 by reading the paper (arXiv:2312.06674v1, section 3.4 'Model & Training Details'). The paper states: "We train on a single machine with 8xA100 80GB GPUs using a batch size of 2, with sequence length of 4096". Source: https://arxiv.org/pdf/2312.06674 . 80 GB stated, 8 GPUs on a single machine, so the 80 GB part. AFFILIATIONS BACKFILLED 2026-10-04 (paper-fields pass, agent w3p): PDF first page states 'GenAI at Meta' as the single affiliation for all eleven authors. OpenAlex returns none. Filled from the API/PDF rather than from memory, because an affiliation is a fact about a specific paper's author block and inference from the author's employer history is how wrong affiliations get shipped. VENUE_TRACK BACKFILL 2026-10-04 (paper-fields pass, agent w3p): venue_track 'unknown'. `venue` is 'arxiv-preprint', which means no peer-reviewed venue has been established for this work as of the verification date, so the track genuinely is not known. 'unknown' is used here rather than leaving the field null or guessing 'main': the schema separates 'unknown' from 'main' precisely so that an unprereviewed preprint is not silently counted as main-track work. This annotation is what lets a downstream filter distinguish 'peer reviewed, main track' from 'not peer reviewed' without inferring it from the venue string.