Trishool’s HaloGuard 2.0 Beats a Streaming AI Safety Model Five Times Its Size

Checking what someone asks an AI model is only part of keeping its responses safe. A request can pass an input filter, yet the answer may still become harmful.

Trishool (SN23) has released HaloGuard 2.0 to monitor answers during generation. It can be used by applications to interrupt unsafe responses.

HaloGuard 2.0 is a compact model with 0.8 billion parameters. It assigns a safe or unsafe probability to each response token. Its training follows the safety constitution used in HaloGuard 1.0. Responses are labelled from the point where they become harmful, teaching the guard to recognise that transition.

During development, the researchers found that guards often judged the prompt while overlooking the answer. A dangerous request could receive a harmless refusal and still trigger a warning. The initial model correctly handled only 13.9% of matched safe and unsafe response pairs. The team addressed this with 106,043 corrective examples, following an initial training phase using 478,532 responses.

According to HaloGuard 2.0’s technical paper, the final model scored 83.6 macro F1 across six English response-safety benchmarks. This was up from 72.8 for the initial version, with 38% fewer false positives. F1 measures the balance between detecting harmful content and avoiding incorrect flags.

HaloGuard 2.0 beat Qwen3Guard-Stream-4B by 2.6 points using one-fifth of its parameters. It also matched or exceeded several full-response guards five to ten times its size.

The team reports processing times of 0.37 milliseconds per token per stream. This was measured while moderating 64 concurrent streams on a single H100 GPU. That speed helps safety checks keep pace with live AI responses.

The release also includes multilingual and input-safety models. The multilingual version scored 83.1 F1 across 17 languages on PolyGuardPrompts response labels. It beat the strongest baseline tested by five points. The updated input guard, HaloGuard2-Gen-0.8B, supports up to 8,192 tokens. It averaged 90.9 F1 across seven prompt-safety benchmarks.

Bittensor’s incentive system supports Trishool’s ongoing adversarial testing. Miners earn rewards for finding ways to defeat its guards. Successful attacks then feed into future training, giving the team fresh examples of weaknesses to address. HaloGuard 2.0 shows how a small, focused model can compete with much larger safety tools.

➛ Explore HaloGuard 2.0’s Technical Paper and access the Model Weights.