Railz — sub-1B policy-conditioned safety guard (no reasoning)

Railz is a 0.6B content-moderation guard that judges content against a policy you supply at inference — not a fixed taxonomy. Give it a list of prohibited categories; it emits the violated category verbatim (or abstains). Same content flips safe↔unsafe when the policy changes. No chain-of-thought — a fast, direct verdict.

Built on Qwen3-0.6B. Trained with mechanical supervision (NVIDIA Aegis-2.0 labels) + hard-negative mining, on the same data as its reasoning sibling Railz-R. No teacher model in the training loop.

Results (0.6B)

metric	Railz	note
policy-flip (held-out contrast pairs)	75%	same content, policy toggled → verdict must flip
Aegis-2.0 test F1 (in-domain detection)	76% (P69/R85)	NVIDIA's primary in-domain metric; in the range of 8B guards
ToxicChat F1 (out-of-domain)	22% (P14/R55)	high recall, over-flags novel benign content; see limitations

Railz vs Railz-R (pick one)

	flip	Aegis-F1	ToxicChat	use when
Railz (this)	75	76	22 (R55)	throughput; higher recall; no CoT overhead
Railz-R (reasoning)	78	76	28	better precision/calibration + interpretable rationale

Note: on this data the reasoning model is better calibrated (higher precision). Railz leans higher-recall (flags more). Choose by whether you want speed/recall (Railz) or calibration/explanations (Railz-R).

Prompt format (direct verdict)

<|im_start|>system
You are a content moderation system. The policy below lists PROHIBITED categories. Anything not listed is permitted.
First reason briefly inside <think></think>. Then, on a new line, state the violated category using the exact category text from the list, or exactly: no listed category applies

PROHIBITED:
- violence or physical harm
- hate speech or identity-based hatred
- controlled or regulated substances
<|im_end|>
<|im_start|>user
CONTENT TO MODERATE:
<content here><|im_end|>
<|im_start|>assistant

Model output (emits an empty think block, then the verdict — no reasoning):

<think>

</think>

Violated category: controlled or regulated substances

Parse the verdict from the line after Violated category:. Greedy decoding, ~24 max new tokens (no CoT → short). Compare to no listed category applies for abstain.

Limitations

OOD gap + over-flagging: trained on the Aegis distribution; on out-of-distribution content (ToxicChat) it over-flags benign inputs (low precision). If precision matters on novel content, prefer Railz-R.
English; text-only.