Research · arXiv 2510.19169 · cs.CR
OpenGuardrails: A Configurable, Unified, and Scalable Guardrails Platform for Large Language Models
Thomas Wang (OpenGuardrails.com), Haowen Li (The Hong Kong Polytechnic University). October 2025.
Abstract
As large language models (LLMs) are increasingly integrated into real-world applications, ensuring their safety, robustness, and privacy compliance has become critical. We present OpenGuardrails, the first fully open-source platform that unifies large-model-based safety detection, manipulation defense, and deployable guardrail infrastructure. OpenGuardrails protects against three major classes of risks: (1) content-safety violations such as harmful or explicit text generation, (2) model-manipulation attacks including prompt injection, jailbreaks, and code-interpreter abuse, and (3) data leakage involving sensitive or private information. Unlike prior modular or rule-based frameworks, OpenGuardrails introduces three core innovations: (1) a Configurable Policy Adaptation mechanism that allows per-request customization of unsafe categories and sensitivity thresholds; (2) a Unified LLM-based Guard Architecture that performs both content-safety and manipulation detection within a single model; and (3) a Quantized, Scalable Model Design that compresses a 14B dense base model to 3.3B via GPTQ while preserving over 98% of benchmark accuracy. The system supports 119 languages, achieves state-of-the-art performance across multilingual safety benchmarks, and can be deployed as a secure gateway or API-based service for enterprise use. All models, datasets, and deployment scripts are released under the Apache 2.0 license.
Results
Highest average F1 in all six evaluations
OpenGuardrails-Text-2510 against LlamaGuard, WildGuard, ShieldGemma, NemoGuard, PolyGuard and Qwen3Guard. These are the report's own measurements, following Qwen3Guard's methodology. The model is open, so you can rerun them.
| Evaluation | OpenGuardrails | Next best | Next best model |
|---|---|---|---|
| English prompts | 87.1 | 85.1 | PolyGuard-Qwen-7B |
| English responses | 88.5 | 80.5 | Qwen3Guard-4B-Gen and -8B-Gen, strict |
| Chinese prompts | 87.4 | 85.9 | Qwen3Guard-4B-Gen, loose |
| Chinese responses | 85.2 | 82.4 | Qwen3Guard-8B-Gen, strict |
| Multilingual prompts (RTP-LX) | 97.3 | 85.0 | Qwen3Guard-4B-Gen, strict |
| Multilingual responses (PolyGuard-Response) | 97.2 | 78.1 | Qwen3Guard-4B-Gen |
- 119 languages and dialects
- 3.3B parameters, quantized from a 14B base, keeping over 98% of benchmark accuracy
- 274.6 ms P95 latency
How it relates to the product
The report came first. The agent guard grew from it.
The report covers guard models for content safety and manipulation detection, as of October 2025. The local gateway, the rules and the judge for agent actions came later, and these results do not measure them. For those, see the public benchmark and the experiments.
Cite
@misc{wang2025openguardrails,
title = {OpenGuardrails: A Configurable, Unified, and Scalable
Guardrails Platform for Large Language Models},
author = {Wang, Thomas and Li, Haowen},
year = {2025},
eprint = {2510.19169},
archivePrefix = {arXiv},
primaryClass = {cs.CR},
url = {https://arxiv.org/abs/2510.19169}
}