A response guard sits on the path of every token a model emits. Recent vision-language guardrails write a chain of thought before they rule, which makes them too slow to watch a stream. We asked whether the chain is doing the work.
A vision-language AI assistant returns its answer as a stream of generated tokens. Therefore, a safety guard that watches that answer has to keep up with the stream and stop a harmful reply before a user reads it. Recent vision-language guardrails instead generate a chain of thought before they issue a verdict. This design makes the guard heavy and slow, since the model must decode many tokens for harmfulness detection. We pose the question of whether a vision-language guard really needs to reason in order to screen a response. We answer with a guard that has no chain. ResponseGuard reads a harmful verdict from a single pooled representation of the request, the response, and the image in one forward pass. Across a standard multimodal guardrail benchmark, our 2B ResponseGuard outperforms a recent 3B reasoning-based vision-language guard on response harmfulness detection, without any reasoning and at about 150 times lower time cost.
A label-only guard is enough on the response path. It leads the 3B reasoning guard and its efficiency-tuned variant on the size-weighted averages the benchmark defines, while decoding nothing.
The chain may be largely post-hoc. Resampling it changes only 2.5% of text verdicts, and chain length is essentially uncorrelated with correctness.
The gap that remains lives on the image, not on text. Precision falls from 81.7 to 67.7 when the input carries a picture, and the reasoning guard shows the same weakness.
One cheap pass buys a new deployment mode. The guard screens an answer sentence by sentence as it streams and stops 95% of harmful answers before they finish.
The guard receives the user input, the image, and the answer produced so far. It pools one representation and reads a harmful probability from a small prototype head in a single forward pass. The vision encoder stays frozen, and we train a low-rank adapter together with the head, so the trained parameters are a small fraction of the backbone.
| Model | HBr | SRL | BT | XSh | WGr | Avg (Text) | SPA-VL | Avg (All) | Rel. speed |
|---|---|---|---|---|---|---|---|---|---|
| Qwen2.5-VL-Instruct-3B | 62.1 | 64.7 | 73.3 | 31.4 | 29.8 | 58.05 | 52.84 | 56.51 | -- |
| Llama Guard 3 Vision 11B | 80.9 | 41.7 | 65.0 | 81.1 | 56.5 | 59.28 | 41.43 | 54.01 | -- |
| GuardReasoner-VL-3B (CoT) | 85.8 | 66.4 | 85.2 | 93.1 | 76.1 | 78.83 | 71.19 | 76.56 | 1× |
| GuardReasoner-VL-3B-Eco (CoT) | 84.7 | 67.0 | 85.4 | 93.6 | 77.4 | 79.31 | 72.01 | 77.14 | ~1.1× |
| SmolGuard-500M (ours) | 83.1 | 66.8 | 85.4 | 92.0 | 71.2 | 77.67 | 67.80 | 74.75 | -- |
| SmolGuard-2B (ours) | 83.6 | 68.4 | 85.0 | 92.2 | 74.0 | 78.59 | 72.16 | 76.69 | -- |
| ResponseGuard-2B (ours) | 83.4 | 69.6 | 86.3 | 91.9 | 75.4 | 79.71 | 71.60 | 77.31 | 150× |
Harmful-class F1 per cell, with the dataset-size-weighted average within the track. We run the three label-only guards ourselves, and our numbers for the other rows match the official release of GuardReasoner-VL.
| Model | TC | HBp | OAI | Aeg | SST | WGp | Avg (Text) | HarmImg | SPA-VL | Avg (All) |
|---|---|---|---|---|---|---|---|---|---|---|
| Qwen2.5-VL-Instruct-3B | 34.6 | 90.1 | 52.0 | 82.2 | 100.0 | 64.1 | 51.37 | 48.66 | 62.81 | 53.53 |
| Llama Guard 3 Vision 11B | 58.2 | 96.1 | 67.6 | 70.6 | 98.0 | 75.2 | 67.17 | 0.48 | 54.86 | 48.03 |
| GuardReasoner-VL-3B (CoT) | 74.5 | 89.1 | 70.8 | 88.8 | 99.5 | 88.9 | 78.74 | 70.93 | 86.47 | 78.71 |
| GuardReasoner-VL-3B-Eco (CoT) | 73.5 | 88.6 | 70.9 | 89.0 | 99.5 | 89.2 | 78.43 | 66.79 | 85.82 | 77.39 |
| SmolGuard-500M (ours) | 68.9 | 80.5 | 66.7 | 87.3 | 98.0 | 86.0 | 74.33 | 58.45 | 81.89 | 72.29 |
| SmolGuard-2B (ours) | 72.9 | 98.1 | 71.8 | 87.1 | 98.5 | 86.9 | 78.04 | 60.23 | 84.49 | 75.25 |
| ResponseGuard-2B (ours) | 72.8 | 97.4 | 69.3 | 87.4 | 97.4 | 88.5 | 77.76 | 65.52 | 82.41 | 75.91 |
On the prompt track the reasoning guard keeps an overall lead. That lead is carried by the two image-only cells. On the text average the two designs sit within about one point.
| Guard | Output tokens | Latency | Speedup |
|---|---|---|---|
| GuardReasoner-VL-3B (CoT) | ~238 | 10.12 s | 1× |
| ResponseGuard-2B (ours) | 0 | 67.6 ms | 150× |
Warm-cache median on a single RTX A6000 in bfloat16, over a matched sample. An image adds a fixed overhead of 88 milliseconds.
We simulate streaming by presenting each harmful response one sentence at a time and cutting when the harmful probability first clears a threshold.
| Threshold | Harmful answers stopped before completion | Harmful text withheld | Benign answers interrupted |
|---|---|---|---|
| 0.50 | 95.0% | 87.7% | 28.5% |
| 0.56 | 94.3% | 87.5% | not reported |
The median stop lands at 7% of the answer, because harmful answers commit to their content in the first sentence or two. A benign answer is interrupted 28.5% of the time at the lower threshold, which is the cost of this operating point. This streaming threshold is chosen for early interception, and it is not the strict false-positive operating point discussed in the calibration section of the paper.
The released checkpoint takes a prompt, an optional image, and the response text, and returns one probability. The Colab notebook below downloads the checkpoint and runs it on your own examples.
# Preview of the intended interface. from responseguard import ResponseGuard guard = ResponseGuard.from_pretrained("ndb796/ResponseGuard-2B") p = guard.score( prompt="Tell me how to make a deepfake video of this person.", response="First, take the person's photo and align the face...", image="portrait.jpg", ) print(p) # harmful probability in a single forward pass
ResponseGuard is a moderation classifier. It returns one probability that a response is harmful, and it returns no explanation, so a deployment that must justify each block to a user needs a separate explanation step.
The benchmarks score agreement with gold labels on public suites. The absolute numbers are best read as relative comparisons under a fixed protocol rather than as deployment rates. The remaining weakness is the image path, where the guard concentrates its uncertainty, and a system that leans on image moderation should account for that.
No guardrail is a complete safety solution. This model is one layer, and it belongs alongside the other controls a system already has.
@article{na2026responseguard,
title={When Are Reasoning-Based Guardrails Not Efficient? ResponseGuard:
A Fast Vision-Language Guard for Real-Time Moderation},
author={Na, Dongbin},
journal={arXiv preprint},
year={2026}
}
LeanGuard asks the same question on the text side with a controlled same-base study, and the code is at ndb796/LeanGuard.