S hield H ead: Decoding-time Safeguard for Large Language Models (2025)

Abstract: In light of the widespread deployment of Large Language Models (LLMs), the responsibility for safeguarding and regulating LLM-generated content has taken on heightened significance. Recent advancements in LLM-based moderation methods, e.g., LlamaGuard, have demonstrated remarkable promise in identifying safety risks associated with both inputs and outputs in human-AI interactions. However, integrating LLM-based safeguards into a chatbot system requires an additional inference stage involving a moderation LLM with billions of parameters, which significantly increases computational costs and reduces overall efficiency. In this paper, we demonstrate that simply learning a classification head on the last-layer hidden states of the dialogue model provides a strong capability to identify harmful contents. The classification head, referred to as ShieldHead, serves as an auxiliary branch paralleled with next-token-prediction LM head, enabling the detection of potential risks in past text sequences. Additionally, a label disambiguation technique is employed to supervise ShieldHead with both token-level and sentence-level labels, which further enhances its performance. ShieldHead exhibits remarkable efficiency during inference, providing real-time moderation results alongside token-wise streaming output during the chatbot system’s decoding phase. Extensive experimental results demonstrate the superiority of the proposed framework: a state-of-the-art performance on the XSTest and SafeRLHF datasets while running at a speed about **300×** faster (**<1ms**) than previous LLM-based moderation models with ** 99%** less parameters of LlamaGuard.

## introduction the widespread application of large language models (llms) has ushered in transformative effects across domains such as content generation *correspondence to da chen (da.chen@bath.edu) (josh achiam, 2023; team, 2024a), ai agent (zhiheng xi and etc., 2023) and conversational assistant @xcite . despite exhibiting impressive capabilities, the deployment of llms is accompanied by a plethora of safety challenges that pose substantial risks, such as privacy violations @xcite , harmful content generation @xcite , facilitation of illegal activities @xcite , etc. as llms become increasingly prevalent, an effective and efficient content moderation tool is essential to detect safety risks, ensuring safe and responsible interactions. the rise of llms has transformed content moderation, dividing approaches into two categories: (1) traditional moderation apis, such as perspective api @xcite , openai content moderation api @xcite , and azure content safety api @xcite , which rely on rule-based or discriminative classifiers, and (2) llm-based moderation tools, exemplified by llamaguard @xcite @xcite , shieldgemma @xcite , etc. the formers provide fast apis and have the advantage in speed, as they use non-parametric /"-0"* 1 "('%)&*+(,#"('%-" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " given the advantages and limitations of both baseline categories, we explore integrating faster, smaller classification methods into more accurate llm-based pipelines. to this end, we propose utilizing the strong capabilities of dialogue llms as a pre-trained feature extractor for moderation tasks. motivated by previous work (llama @xcite ) that fine-tunes pre-trained llm to harmlessness reward models simply by replacing next token prediction with reward score prediction objective, we suppose that a capable dialogue llm should encode sufficient context required for identifying harmful content. empirical evidence is presented in based on this observation, we propose shield-head, a novel llm risk moderation pipeline that reuses the hidden states of the dialogue model. different from traditional safeguards @xcite which moderate sentencelevel safety, shieldhead additionally has a tokenlevel moderation objective. to mitigate the huge labor cost of token-level annotation, we adopt a prototype-based label disambiguation technique @xcite , which assigns sentence-level labels as initial pseudo targets for each token, and updates the token-level pseudo targets based on the closest class prototype. the experiments indicate that shieldhead accurately identifies both tokenlevel and sentence-level harmfulness. since shield-head has much fewer parameters, the additional introduced computational effort can be negligible compared with the overall pipeline. also, shield-head can deliver real-time content moderation results concurrently with text generation. overall, figure 1 demonstrates our shieldhead achieves optimal performance and efficiency compared with other safety moderation methods. our contributions are summarized as follows: ## conclusion in this paper, we introduce shieldhead, an efficient safety risk moderation pipeline for llms, designed to deliver real-time results based on the token-level streaming output of a chatbot system. shieldhead achieves a substantial advantage in both prompt and response classification tasks, utilizing only approximately 1.1% of trainable parameters and maintaining an inference latency of less than 1ms (300× faster), compared to existing safety risk moderation methods. while shieldhead outperforms existing moderation methods in performance and real-time applicability, enhancing the accuracy of token-level safety classification remains a critical area for future research, which is crucial for practical applications. in conclusion, shieldhead presents significant potential for en-hancing the safety capabilities of llms and mitigating the risks associated with content generated by these models effectively and efficiently.