Qwen3Guard Technical Report
Authors: name: Haiquan Zhao; name: Chenhan Yuan; name: Fei Huang; name: Xiaomeng Hu; name: Yichang Zhang; name: An Yang; name: Bowen Yu; name: Dayiheng Liu; name: Jingren Zhou; name: Junyang Lin; name: Baosong Yang; name: Chen Cheng; name: Jialong Tang; name: Jiandong Jiang; name: Jianwei Zhang; name: Jijie Xu; name: Ming Yan; name: Minmin Sun; name: Pei Zhang; name: Pengjun Xie; name: Qiaoyu Tang; name: Qin Zhu; name: Rong Zhang; name: Shibin Wu; name: Shuo Zhang; name: Tao He; name: Tianyi Tang; name: Tingyu Xia; name: Wei Liao; name: Weizhou Shen; name: Wenbiao Yin; name: Wenmeng Zhou; name: Wenyuan Yu; name: Xiaobin Wang; name: Xiaodong Deng; name: Xiaodong Xu; name: Xinyu Zhang; name: Yang Liu; name: Yeqiu Li; name: Yi Zhang; name: Yong Jiang; name: Yu Wan; name: Yuxin Zhou
Published: 2025-10-16 04:00:18

Abstract: As large language models (LLMs) become more capable and widely used, ensuring
the safety of their outputs is increasingly critical. Existing guardrail
models, though useful in static evaluation settings, face two major limitations
in real-world applications: (1) they typically output only binary "safe/unsafe"
labels, which can be interpreted inconsistently across diverse safety policies,
rendering them incapable of accommodating varying safety tolerances across
domains; and (2) they require complete model outputs before performing safety
checks, making them fundamentally incompatible with streaming LLM inference,
thereby preventing timely intervention during generation and increasing
exposure to harmful partial outputs. To address these challenges, we present
Qwen3Guard, a series of multilingual safety guardrail models with two
specialized variants: Generative Qwen3Guard, which casts safety classification
as an instruction-following task to enable fine-grained tri-class judgments
(safe, controversial, unsafe); and Stream Qwen3Guard, which introduces a
token-level classification head for real-time safety monitoring during
incremental text generation. Both variants are available in three sizes (0.6B,
4B, and 8B parameters) and support up to 119 languages and dialects, providing
comprehensive, scalable, and low-latency safety moderation for global LLM
deployments. Evaluated across English, Chinese, and multilingual benchmarks,
Qwen3Guard achieves state-of-the-art performance in both prompt and response
safety classification. All models are released under the Apache 2.0 license for
public use.