Benchmarking Open-Source Safety Guard Models: A Comprehensive Evaluation

A new evaluation of 14 open-source safety guard models finds that a smaller model, Qwen Guard, outperforms much larger counterparts in detecting harmful content, challenging assumptions that bigger models are better for content moderation [1]. The study, detailed in a paper submitted to arXiv on April 10, 2026, tested the models against a curated benchmark of 79,331 samples drawn from four datasets: HarmBench, StrongREJECT, RealToxicityPrompts, and BeaverTails [1]. The samples were filtered to cover eight safety categories defined by the NIST AI Risk Framework, including violence, hate speech, harassment, sexual content, suicide and self-harm, profanity, threats, and health misinformation [1]. Researchers prioritized the recall metric, which measures a model's ability to catch all harmful content. The paper states that recall is critical for safety applications because missing harmful content poses a greater risk than generating false positives [1]. Qwen Guard, a model with 4 billion parameters, achieved a recall of 83.97%, the highest among all models tested [1]. In contrast, larger models exhibited what the authors describe as conservative behavior. Llama Guard, at 12 billion parameters, and GPT-OSS Safeguard, at 20 billion parameters, missed up to 75% of unsafe content [1]. The findings indicate that model size does not correlate with safety detection performance [1]. The evaluation also found that general-purpose guard models outperformed specialized ones, providing practical guidance for teams selecting safety guard models for production deployments [1]. The benchmark's aggregation of multiple datasets was designed to create a more rigorous and diverse testing environment for content moderation tools [1]. As large language models are increasingly deployed in safety-critical applications, robust content moderation has become essential [1]. The paper's results suggest that developers should not assume that scaling up model size will automatically yield better safety outcomes, and that smaller, general-purpose models may offer a more effective first line of defense against harmful outputs [1].