Malicious content generated from large language models (LLMs) could pose severe safety risks and ethical concerns. While existing LLM safety guardrails excel in English or multilingual settings, they lack adaptation to Chinese-specific regulatory policies, cultural context, and linguistic nuances, failing to support fine-grained risk classification for diverse deployment needs. In this paper, we introduce a 5-macro, 31-micro category fine-grained risk taxonomy for Chinese scenarios, and build CHILLGuard: a dedicated Chinese LLM content safety guardrail. To address the critical scarcity of high-quality annotated Chinese safety data, we propose a scalable multi-stage data construction pipeline: we expand multi-source corpus via retrieval-augmented generation, generate implicit harmful samples through prompt engineering rewriting, and refine high-quality data via multi-model voting-based label calibration. Based on this, we build CHILLGuardTrain, a large-scale training set with 405,007 samples, and CHILLGuardTest, a rigorously curated annotated test set with 51,745 samples. We then train CHILLGuard on CHILLGuardTrain under a generator-classifier collaborative framework via Model-aware Direct Preference Optimization. Extensive experiments under multiple settings demonstrate the state-of-the-art performance of CHILLGuard, e.g., a 15.92% relative improvement of F1 score over Qwen3Guard-8B-Strict on our benchmark. We release our resources at https://github.com/cswbyu/CHILLGuard.

Recent backdoor studies on Large Language Models (LLMs) typically insert harmful question-answer (QA) pairs into their training data. However, we identify two critical limitations: (1) directly embedding harmful content into training data compromises safety alignment, resulting in attack efficacy even for clean queries, and (2) the poisoned training samples can be easily filtered by guardrail models. To this end, we propose a novel poisoning approach via completely harmless data. Inspired by the causal reasoning of auto-regressive LLMs, we aim to establish robust associations from triggers to an affirmative response prefix using only benign QA pairs, rather than directly to harmful content. During inference, a triggered query elicits this affirmative prefix, after which the LLM completes the response based on its language-modeling capabilities. However, we observe a resistance phenomenon in which the model initially appears to comply but subsequently refuses to answer. We attribute this behavior to prefix-level overfitting and address it by inducing trajectory-level behavioral conditioning via a robust and general response template. To further enhance the attack, we improve the universal trigger via a gradient-based coordinate optimization. Extensive experiments demonstrate that our method successfully injects backdoors into LLMs to generate harmful content, even under detection by powerful guardrail models.