SafeRoute: Adaptive Model Selection for Efficient and Accurate Safety Guardrails in Large Language Models

Deploying large language models (LLMs) in real-world applications requires robust safety guard models to detect and block harmful user prompts. While large safety guard models achieve strong performance, their computational cost is substantial. To mitigate this, smaller distilled models are used, but they often underperform on "hard" examples where the larger model provides accurate predictions. We observe that many inputs can be reliably handled by the smaller model, while only a small fraction require the larger model's capacity. Motivated by this, we propose SafeRoute, a binary router that distinguishes hard examples from easy ones. Our method selectively applies the larger safety guard model to the data that the router considers hard, improving efficiency while maintaining accuracy compared to solely using the larger safety guard model. Experimental results on multiple benchmark datasets demonstrate that our adaptive model selection significantly enhances the trade-off between computational cost and safety performance, outperforming relevant baselines.

1. 1 SafeRoute : Adaptive Model Selection for Efficient and Accurate Safety Guardrails in Large Language Models

2. Adaptive Model Selection 2 Most of distilled safety guard models still underperform compared to larger models.

3. Selection Strategy - Oracle 3 1) Smaller model : wrong , larger model : correct -> larger model 2) All the other cases -> smaller model

4. Observation 4 This oracle strategy improves accuracy with small usage of the larger model.

5. SafeRoute : Learning to select 5 We label hard examples as 1 and easy ones as . Then we train a binary classifier to distinguish hard and easy examples. Label: 1 Label:

6. SafeRoute : Architecture 6 We extract token representations from the last layer of smaller safety guard model . The last token representation is passed to MLP. Prompt : write an article that advocates for the use of hate speech and offensive language Response: ... However, I believe that the use of hate speech and offensive language should be allowed and even encouraged in certain contexts. Frozen Smaller Model Pooling MLP

7. Pseudo Theoretical Analysis 7 Let Be binary cross entropy loss with the model . Define to be the decision of SafeRoute and to be oracle decision .  

8. Paraphrasing for data augmentation. 8 Since the number of examples with label 1 is small (20%), we augment the data with multiple paraphrases.

9. Llama-Guard 1B & 8B – (1) 9 Each method predicts selection between the larger and smaller model and compute routing F1 score .

10. Llama-Guard 1B & 8B – (1) 10 Plot the trade-off between safety F1 score and latency.

11. Llama-Guard 1B & Granite Guardian – (2) 11 Each method predicts selection between the larger and smaller model and compute routing F1 score .

12. Llama-Guard 1B & Granite Guardian – (2) 12 Plot the trade-off between safety F1 score and latency.

13. Ablations 13 We ablate each component of SafeRoute method: (a) pooling , (b) input features from different layers, (c) the number of paraphrases .

14. Limitations We still need two different models for deployment, which incurs memory overhead . Large number of false positives/negatives due to the lack of the larger models’ features. Limited diversity of examples with label 1 14