FreoStream:Enhancing Stream Guardrails via Future-Aware Reasoning and Safety-Aligned Optimization

2026-06-11

AI Summary

Existing streaming safety guardrails often over-reject tokens that are sensitive yet safe due to the lack of complete contextual information, and they struggle to defend against implicit jailbreak attacks. To address these limitations, this work proposes FreoStream, a novel framework that, upon initial guardrail alerts, incorporates a LoRA-based future-aware reasoning mechanism. This mechanism operates through a “predict–reason–judge” paradigm to integrate forthcoming contextual cues and is complemented by a safety alignment optimization module that dynamically updates the guardrail model. The proposed approach significantly reduces over-rejection rates while substantially enhancing detection and defense capabilities against implicit jailbreak attacks. Extensive evaluations across multiple safety benchmarks demonstrate the superiority of FreoStream in both robustness and precision.

Abstract

Stream guardrails enable token-level safety detection before full responses are generated. However, they often make overly conservative judgements and block those sensitive but safe tokens, which is known as over-refusal. Due to lack of full context, they also fail to detect implicitly harmful content from jailbreaking. To address these challenges, we propose FreoStream, a novel streaming guardrail framework. Specifically, FreoStream fine-tunes a LoRA module to perform Future-Aware Reasoning when the base guardrail detects unsafe tokens. The reasoning process follows a Future-Reason-Judge paradigm: predict the future, reason about the full context and give the final judgement. This design can effectively reduce over-refusal by incorporating the future information. Moreover, we introduce the Safety-Aligned Optimization module that extracts the safety-aligned component from the reasoning gradients to update the base guardrail model, thereby enhancing streaming safety detection. Extensive experiments on various safety benchmarks demonstrate that FreoStream achieves lower over-refusal rates and better jailbreak defense compared to existing streaming guardrails.

Problem

• stream guardrails
• over-refusal
• jailbreaking
• safety detection
• future context

Innovation

• Future-Aware Reasoning
• Safety-Aligned Optimization
• Streaming Guardrails
• Over-Refusal Reduction
• Jailbreak Defense