HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety

Efficient safety screening is now possible at scale: HaloGuard 1.0 achieves state-of-the-art performance on safety benchmarks while being roughly one-tenth the size of competing open guard models, meaning AI systems can screen for harmful content more efficiently without requiring massive computational resources.

A "constitution" approach provides transparent safety standards: The model is organized around 46 explicit safety policies and 2,940 subcategories that form a natural-language constitution, making the safety criteria interpretable and auditable rather than hidden in a black box—important for understanding what an AI system considers harmful.

Multilingual safety requires intentional design, not just translation: Rather than treating different languages as adversarial challenges, HaloGuard treats language as a surface variation of the same safety principles across 46 languages, achieving balanced performance across linguistic communities and avoiding the common pitfall of safety systems that work well in English but fail in other languages.

False positives and false negatives require different solutions: The model uses a two-tier design that separately addresses boundary false positives (incorrectly flagging safe content) and baseline false positives, achieving a 4.3% false-positive rate and 9.5% false-negative rate—demonstrating that responsible AI requires balancing the distinct harms of over-blocking and under-blocking.

Continuous adversarial testing is essential for robust safety: The paper employs an "always-on adversarial red-teaming protocol" to continuously harden the guard against attacks, suggesting that responsible AI safety requires ongoing stress-testing rather than one-time validation.