FreoStream:Enhancing Stream Guardrails via Future-Aware Reasoning and Safety-Aligned Optimization

A new streaming guardrail framework called FreoStream aims to reduce over-refusal in large language models while strengthening defenses against jailbreak attacks, according to a paper submitted June 11, 2026. [1] Stream guardrails inspect content token-by-token before a full response is generated, but they frequently block safe yet sensitive tokens — a problem known as over-refusal — and miss implicitly harmful content because they lack full context. [2] The proposed FreoStream framework addresses both shortcomings by adding a LoRA module that performs Future-Aware Reasoning when the base guardrail flags an unsafe token. [2] The reasoning follows a Future-Reason-Judge paradigm: the system predicts what will come next, reasons about the full context, and then issues a final judgment. [2] By incorporating future information, the design reduces over-refusal. A separate Safety-Aligned Optimization module extracts the safety-aligned component from reasoning gradients and uses it to update the base guardrail model, improving streaming safety detection. [2] The authors report that across multiple safety benchmarks, FreoStream achieves lower over-refusal rates and better jailbreak defense than existing streaming guardrails. [2] The paper appears on arXiv, a preprint server that accounts for roughly 95 percent of the paper URLs Hugging Face users have linked in their repositories. [4] Hugging Face and arXiv have collaborated to embed interactive demos directly alongside papers, allowing readers to try models without writing code. [5] Large language models have drawn intense scrutiny over safety mechanisms. DeepSeek, the Chinese AI firm, released its R1 model in January 2025 under open-weight terms, and its low training cost — a reported US$6 million for the V3 model — triggered a sharp sell-off in AI hardware stocks. [7] Alibaba Cloud’s Qwen family of models is distributed under Apache 2.0 and other licenses. [9] The FreoStream paper does not disclose which base model was used for fine-tuning. [2] The paper was submitted through arXivLabs, a framework that lets collaborators develop and share new arXiv features directly on the site. [1]