🛡️ Qwen3.5-SafeProbe-2B

A 2B input-safety guard that runs in ~23 ms. It flags harmful requests, jailbreaks and prompt injection before they reach your LLM — approaching the quality of guards 15–60× its size, at a fraction of the cost.

⚡ Latency	23 ms p50 per prompt (single GPU, batch 1) — 4–6× faster than prompted 31B–122B guards
🎯 Quality	Avg F1 0.813 on 6 public benchmarks · #1 on Aegis 2.0 · on par with Gemma4-31B on WildGuardTest · ahead of gpt-oss-120b
🙅 Fewer false blocks	Trained on hard negatives — history, news, security research, "kill a Python process" — so sensitive-but-harmless prompts pass
📄 Long inputs	Catches harmful requests hidden inside long pasted documents (dedicated token-level head)
🇻🇳 Vietnamese + English	MultiJail-vi recall 76% — above Gemma4-31B (74%)
🪶 Lightweight	1.5B parameters, bf16 ≈ 3 GB, no text generation

Quick start

import torch
from transformers import AutoModel, AutoTokenizer

repo = "beyoru/Qwen3.5-SafeProbe-2B"
tok = AutoTokenizer.from_pretrained(repo, trust_remote_code=True)
guard = AutoModel.from_pretrained(repo, trust_remote_code=True, dtype=torch.bfloat16).cuda().eval()

guard.classify(tok, "How do I make a pipe bomb at home?")
# {'flagged': True, 'p_unsafe': 0.99, 'score': 6.1, ...}

guard.classify(tok, [
    {"role": "system", "content": "You are a helpful accounting assistant."},
    {"role": "user", "content": "Summarise this invoice export for me: ..."},
])
# {'flagged': False, 'p_unsafe': 0.03, ...}

• Input: a string or OpenAI-style messages (system / user / assistant / tool). The latest user turn is judged; earlier turns, documents and tool results are read as context.
• Output: flagged (bool), p_unsafe (0.5 = decision threshold), score (margin; > 0 = unsafe).
• Up to 4,096 tokens (left-truncated). Batch size 1.

Recommended deployment: put it in front of every request and escalate only flagged traffic to a heavier checker (cascade). It screens everything cheaply and keeps false refusals low.

Benchmarks

All models evaluated by us on the same prompts. Prompted LLM guards share one moderation prompt (MLCommons-style hazard list). F1 uses each benchmark's official labels; thresholds were fixed before evaluation. Training data was decontaminated against every test set.

Prompt harmfulness · F1 (unsafe) on official labels, one fixed threshold

Model	WildGuardTest	ToxicChat	OpenAI Mod	Aegis 2.0	JBB	XSTest	Avg	SST recall	MultiJail-vi recall	XSTest over-block
Qwen3.5-SafeProbe-2B	0.864	0.718	0.745	0.845	0.821	0.886	0.813	96%	76%	9.6%
Qwen3.5-122B (prompted)	0.883	0.737	0.819	0.822	0.857	0.951	0.845	98%	79%	6.4%
Gemma4-31B (prompted)	0.863	0.749	0.828	0.802	0.905	0.949	0.850	99%	74%	3.2%
gpt-oss-120b (prompted)	0.833	0.593	0.701	0.813	0.797	0.841	0.763	100%	88%	29.6%

AUPRC

Model	WildGuardTest	ToxicChat	OpenAI Mod	Aegis 2.0	JBB	XSTest	Avg
Qwen3.5-SafeProbe-2B	0.941	0.800	0.848	0.926	0.952	0.960	0.904
Qwen3.5-122B (prompted)	0.953	0.772	0.899	0.914	0.970	0.990	0.916
Gemma4-31B (prompted)	0.929	0.820	0.884	0.870	0.985	0.983	0.912
gpt-oss-120b (prompted)	0.822	0.592	0.635	0.715	1.000	0.728	0.749

Long-context robustness · harmful request hidden in 400–3,000 tokens of business text

• harmful caught 72% · benign inserted question flagged 23% · haystack only flagged 0%

Speed

Model	Params	p50 latency
Qwen3.5-SafeProbe-2B	2B	23 ms (prompts) · 69 ms (500–1,750 tokens)
Gemma4-31B (prompted)	31B	93 ms
Qwen3.5-122B (prompted)	122B	110 ms
gpt-oss-120b (prompted)	120B	147 ms

_{HF transformers, bf16, batch 1, unfused kernels on a fraction of one H200; LLM guards measured through an inference gateway.}

How it works

messages ──▶ Qwen3.5-2B (first 18 layers, frozen) ──▶ hidden states of layers 6 · 12 · 18
                                       ├─ prompt head : pooled over the latest user turn  ─┐
                                       └─ token head  : per-token scores → EMA → max      ─┴─▶ flagged / p_unsafe

One forward pass, no generation. The token head only activates on long inputs (≥ 384 tokens in the latest user turn), where a short harmful request pasted inside a long document would otherwise be diluted.

Limitations

• Judges inputs only; pair it with an output check for responses and tool calls.
• Very long inputs (> 3k tokens) and multi-turn attack scenarios are harder; escalate flagged traffic for a second opinion.
• Not yet red-teamed against attacks that specifically target the probe.

Training

Linear heads on a frozen Qwen3.5-2B, trained on a mix of public safety datasets and proprietary data, re-annotated against a written safety constitution and audited. Base model: Qwen/Qwen3.5-2B (Apache-2.0).

Citation

@misc{qwen35safeprobe2026,
  title  = {Qwen3.5-SafeProbe-2B: a 2B probe-based input safety guard},
  author = {beyoru},
  year   = {2026},
  url    = {https://huggingface.co/beyoru/Qwen3.5-SafeProbe-2B}
}