@inproceedings{nguyen-etal-2026-guardrail,
title = "The Guardrail Trinity: Procedural Safety Schemas, Reasoning Chain Decomposition, and Dual-Mode Inference for {LLM} Guardrails",
author = "Nguyen, Huy H. and
Kavumba, Pride and
Li, Jiaxuan and
Vo, Duc Minh and
Wataoka, Koki",
editor = "Zhang, Yue and
Xu, Ruifeng and
Purwarianti, Ayu and
Rong, Tong and
Suzuki, Jun",
booktitle = "Proceedings of the 15th International Joint Conference on Natural Language Processing and the 5th Conference of the {A}sia-Pacific Chapter of the {A}ssociation for {C}omputational {L}inguistics (Volume 2: Short Papers)",
month = nov,
year = "2026",
address = "Hengqin, China",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.aacl-short.48/",
pages = "747--779",
ISBN = "979-8-89176-440-8",
abstract = "Effective LLM safety guardrails must balance adversarial robustness, custom-policy adaptability, and precision on benign prompts with sensitive vocabulary. We introduce the Guardrail Trinity, a data-curation recipe combining procedural safety schemas, reasoning chain decomposition with hard-negative supervision, and a hybrid data blend for fast and slow inference. Experiments across Llama-3.1 and Qwen3 models yield three practical insights. First, strong standard moderation scores can conceal a custom-policy compliance gap; procedural schema variation improves adaptation on our held-out policy-shift probe. Second, augmentation must be matched to model scale and training recipe: smaller models can exhibit training instability, while hard negatives at larger scales can reduce false alarms at a cost to harmful-input recall. Third, hybrid training supports both direct classification and reasoning, with the fast mode retaining strong custom-policy compliance without generating a chain. Together, these findings motivate a deployment playbook that selects data composition, inference mode, and scale jointly, and validates both policy adherence and the trade-off between missed harms and false alarms."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="nguyen-etal-2026-guardrail">
<titleInfo>
<title>The Guardrail Trinity: Procedural Safety Schemas, Reasoning Chain Decomposition, and Dual-Mode Inference for LLM Guardrails</title>
</titleInfo>
<name type="personal">
<namePart type="given">Huy</namePart>
<namePart type="given">H</namePart>
<namePart type="family">Nguyen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Pride</namePart>
<namePart type="family">Kavumba</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jiaxuan</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Duc</namePart>
<namePart type="given">Minh</namePart>
<namePart type="family">Vo</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Koki</namePart>
<namePart type="family">Wataoka</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-11</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 15th International Joint Conference on Natural Language Processing and the 5th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics (Volume 2: Short Papers)</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yue</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ruifeng</namePart>
<namePart type="family">Xu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ayu</namePart>
<namePart type="family">Purwarianti</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tong</namePart>
<namePart type="family">Rong</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jun</namePart>
<namePart type="family">Suzuki</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Hengqin, China</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-440-8</identifier>
</relatedItem>
<abstract>Effective LLM safety guardrails must balance adversarial robustness, custom-policy adaptability, and precision on benign prompts with sensitive vocabulary. We introduce the Guardrail Trinity, a data-curation recipe combining procedural safety schemas, reasoning chain decomposition with hard-negative supervision, and a hybrid data blend for fast and slow inference. Experiments across Llama-3.1 and Qwen3 models yield three practical insights. First, strong standard moderation scores can conceal a custom-policy compliance gap; procedural schema variation improves adaptation on our held-out policy-shift probe. Second, augmentation must be matched to model scale and training recipe: smaller models can exhibit training instability, while hard negatives at larger scales can reduce false alarms at a cost to harmful-input recall. Third, hybrid training supports both direct classification and reasoning, with the fast mode retaining strong custom-policy compliance without generating a chain. Together, these findings motivate a deployment playbook that selects data composition, inference mode, and scale jointly, and validates both policy adherence and the trade-off between missed harms and false alarms.</abstract>
<identifier type="citekey">nguyen-etal-2026-guardrail</identifier>
<location>
<url>https://aclanthology.org/2026.aacl-short.48/</url>
</location>
<part>
<date>2026-11</date>
<extent unit="page">
<start>747</start>
<end>779</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T The Guardrail Trinity: Procedural Safety Schemas, Reasoning Chain Decomposition, and Dual-Mode Inference for LLM Guardrails
%A Nguyen, Huy H.
%A Kavumba, Pride
%A Li, Jiaxuan
%A Vo, Duc Minh
%A Wataoka, Koki
%Y Zhang, Yue
%Y Xu, Ruifeng
%Y Purwarianti, Ayu
%Y Rong, Tong
%Y Suzuki, Jun
%S Proceedings of the 15th International Joint Conference on Natural Language Processing and the 5th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics (Volume 2: Short Papers)
%D 2026
%8 November
%I Association for Computational Linguistics
%C Hengqin, China
%@ 979-8-89176-440-8
%F nguyen-etal-2026-guardrail
%X Effective LLM safety guardrails must balance adversarial robustness, custom-policy adaptability, and precision on benign prompts with sensitive vocabulary. We introduce the Guardrail Trinity, a data-curation recipe combining procedural safety schemas, reasoning chain decomposition with hard-negative supervision, and a hybrid data blend for fast and slow inference. Experiments across Llama-3.1 and Qwen3 models yield three practical insights. First, strong standard moderation scores can conceal a custom-policy compliance gap; procedural schema variation improves adaptation on our held-out policy-shift probe. Second, augmentation must be matched to model scale and training recipe: smaller models can exhibit training instability, while hard negatives at larger scales can reduce false alarms at a cost to harmful-input recall. Third, hybrid training supports both direct classification and reasoning, with the fast mode retaining strong custom-policy compliance without generating a chain. Together, these findings motivate a deployment playbook that selects data composition, inference mode, and scale jointly, and validates both policy adherence and the trade-off between missed harms and false alarms.
%U https://aclanthology.org/2026.aacl-short.48/
%P 747-779
Markdown (Informal)
[The Guardrail Trinity: Procedural Safety Schemas, Reasoning Chain Decomposition, and Dual-Mode Inference for LLM Guardrails](https://aclanthology.org/2026.aacl-short.48/) (Nguyen et al., AACL-IJCNLP 2026)
ACL