HaloGuard 1.0 Arrives on Hugging Face as Trishool Opens AI Safety Model

Trishool (SN23) has released HaloGuard 1.0 as an open-weight AI safety model on Hugging Face, allowing anyone to download the weights and integrate it directly into their applications.

It is available in both 0.8B and 4B variants, giving developers the flexibility to choose a model size that fits their deployment needs.

We’re excited to announce that Trishool’s HaloGuard 1.0 𝐡𝐚𝐬 𝐚𝐜𝐡𝐢𝐞𝐯𝐞𝐝 𝐒𝐎𝐓𝐀 prompt-safety performance among open-weight guard models.

Today, we present HaloGuard 1.0, a constitutional input classifier for multilingual AI safety.

It is built as a first-layer input… pic.twitter.com/YJswErsZSs

— Trishool | SN23 (@trishoolai) July 2, 2026

HaloGuard supports 46 languages, is peer-reviewed, production-ready, and delivers inference latency of under 100 milliseconds.

By making the model fully open, Trishool aims to let researchers and builders evaluate its safety capabilities themselves instead of relying on a closed API.

What HaloGuard 1.0 Does

HaloGuard is an input-prompt safety classifier that checks user prompts before they reach a downstream LLM, agent, or application. It emits a safe or unsafe verdict plus a policy category so applications can decide what to do next.

1. Constitution-as-data design: A natural-language constitution of 46 policies and 2,940 subcategories generates the training corpus of 1.26 million records, rather than applying labels after collection.

2. Best-in-class accuracy: 92.1 average F1 across seven prompt-safety benchmarks, ahead of the strongest baseline PolyGuard-Qwen (7B) by 5.1 points.

3. Stronger multilingual precision: On PolyGuardPrompts, HaloGuard 1.0-4B hits 88.0 F1, ahead of PolyGuard-Qwen 7B (87.1) and its own 0.8B sibling (86.1).

4. Two deployment lanes: Fast inline classifier plus an asynchronous sliding-window monitor for long documents and context-stuffing attacks.

5. Constitution-attributed output: Binary verdict, policy category, per-category confidence, and calibrated probabilities so applications can allow, block, route, log, or escalate per policy.

HaloGuard currently focuses on analyzing input prompts, with response-side and agentic guardrails planned for future releases as Trishool positions it as one layer in a broader defense-in-depth security stack.

Why the Open Release Matters

Most AI safety infrastructure sits behind API keys and commercial agreements, limiting how deeply the wider community can inspect it. HaloGuard removes that gate.

1. Researchers can validate the benchmarks. Peer-reviewable weights let independent teams verify the numbers.

2. Builders can deploy in production. No procurement cycle. Pull the weights, run them, ship.

3. The community can find edge cases. More testers surface failure modes faster than any closed team could.

Basically, more people inspecting and testing HaloGuard makes the whole safety ecosystem stronger.

Where This Points

HaloGuard 1.0 is a major contribution to decentralized AI safety, providing an open-weight, peer-reviewed, and production-ready guard model for developers.

It delivers multilingual support and strong benchmark performance in a package that few centralized AI labs have released openly.

The model is well suited for teams building AI agents, chat applications, and enterprise systems that require prompt-level safety filtering.

Both the 0.8B and 4B variants are available for download on HuggingFace today.