1 Introduction↩︎

Large language models are increasingly deployed behind safety guardrails, models that screen prompts and responses for harmful content and decide whether the system should comply or refuse [1]–[3]. As guardrails have become standard infrastructure, two design choices have come to dominate. The first is to build the guard as a large decoder-based generative classifier that is fine-tuned to emit its verdict directly in natural language. The second, a fast-growing line of work, makes that same decoder reason first before it commits to a verdict. GuardReasoner [4], for instance, trains the model to produce an explicit chain-of-thought (CoT) before its verdict, on the premise that thinking step by step yields a more accurate and trustworthy guard.

This reasoning-first view has hardened into a near-consensus, yet this consensus may be misplaced. Safety moderation is, at its core, a bounded labeling decision, asking for example “is this input harmful?” or “did the model comply or refuse?” It is not the kind of open-ended, multi-step problem on which CoT has actually been shown to help [5]. In our experiments, a lightweight bidirectional encoder (a BERT-family model) matches a decoder reasoning guard even under a tight input budget of a few hundred tokens, without generating any reasoning at all. In our experiments, a small single-pass classifier keeps pace with a far larger reasoning model, which may point to one of two conclusions, each consequential: either (1) current guardrail benchmarks are not hard enough to reward reasoning, or (2) the necessity of CoT for safety moderation has simply never been established. We set out to test which.

We organize the evidence around two misconceptions the field holds about reasoning guards. (M1) that chain-of-thought is necessary for an accurate guardrail, and (M2) that a heavier generative or reasoning guard is more capable and more robust to training-label noise. Our central tool is a same-base comparison that varies only whether the model reasons before it labels. We hold architecture, scale, pretraining, and data fixed, which is the one controlled cut that isolates the effect of reasoning. Our contributions are as follows.

• A plain decoder needs no reasoning to reach state-of-the-art accuracy. Through extensive same-base experiments, on an identical decoder backbone, simply training the model to predict the verdict directly, with no chain-of-thought, matches the reasoning recipe of GuardReasoner. The reasoning that prior work frequently treats as essential may buy no accuracy. We argue that this is the overlooked result. A standard discriminative backbone may already be enough (Section 5).

• Reasoning is frequently post-hoc and should be used with caution. In our experiments, re-sampling the chain-of-thought almost never changes the verdict. The model has effectively decided before it reasons, so the chain justifies a pre-determined answer rather than computing it, which raises the question of whether the reasoning contributes at all. We have also found that adding a chain-of-thought does not improve, and can even lower, accuracy on a fixed base, so the chain can quietly hurt (Section 5.1).

• A heavier reasoning guard may not be the more robust choice. A label-only encoder stays accurate under injected training-label noise, holding strong F1 even when a large fraction of its labels are corrupted, and it retains far more recall than the reasoning guard at a strict false-positive rate, where the reasoning guard’s confidence polarizes. In our experiments, heavier and slower does not translate into more robust (Section 6).

• An open, deployable guardrail. Beyond the analysis we release a practical model, LeanGuard, a 395M single-pass guard that we publicly release with an ONNX export for on-device use, together with a unified and reproducible comparison against the prevailing guard landscape (Llama Guard 2 and 3, WildGuard, Aegis, ShieldGemma, MD-Judge) and all training and evaluation code. We hope that our lightweight, reasoning-free guard model becomes a ready-to-deploy baseline the community can build on.

In this study, “reasoning” refers to CoT fine-tuning, not test-time reasoning, tool use, or verifier-based methods. This work is a controlled empirical study rather than a new architecture, and we release LeanGuard with all code and models.

2 Related Work↩︎

LLM-based safety guards. Llama Guard [1], [6] recast prompt and response moderation as instruction-tuned generative classification on a roughly 7B decoder, a template inherited by Llama Guard 3 [7], Aegis [3], ShieldGemma [8], WildGuard [2], MD-Judge [9], and Granite Guardian [10] and evaluated on a now-standard suite [11]–[16]. Across this line of studies the guard is almost always a multi-billion-parameter generative model, and the discriminative encoder-based alternative is the road not taken, even though such an encoder is the natural fit for a fixed-label decision.

Reasoning guards. A fast-growing line makes the generative guard reason first. GuardReasoner [4], our closest baseline, uses R-SFT and HS-DPO. ThinkGuard [17] distills slow thinking on the premise that single-pass classifiers are too shallow, and R\(^2\)-Guard [18] adds knowledge-grounded logical reasoning, with extensions to multilingual and multi-modal moderation. All of them share the assumption that an accurate guard must reason, yet they do not deeply address the clean same-base ablation that removes only the reasoning, so their reported gains confound the reasoning with architecture, scale, data, and objective. We supply that ablation.

Revisiting noisy labels and necessities of CoT. Recent evidence finds that CoT helps far less broadly than assumed. CoT gives large gains almost only on math and symbolic tasks [5], its chains are often post-hoc rather than causal [19], [20], an efficiency literature documents wasteful overthinking [21], and latent-reasoning methods recover the benefit while emitting no reasoning at all [22], [23]. Safety moderation is a short, non-symbolic labeling task with a small output space, so the prior work may sit in this unfavorable regime. Our guards also train on imperfectly labeled corpora, and early-learning regularization [24] explains why a single-epoch discriminative recipe stays robust, while CoT fine-tuning is fragile to propagating noise [25], [26] and classical noise-robust losses [27]–[29] have no clean analogue for a free-form reasoning trace.

Safety for embodied and robotic agents. As LLMs and VLMs begin to drive robots, benchmarks such as ASIMOV [30], SafeAgentBench [31], and AgentSafe [32], organizing risk after Asimov into harm to humans, to the environment, and to the agent itself, report that capable planners execute unsafe tasks at high rates [33], and defenses such as RoboGuard [34] insert heavy, reasoning-driven safeguards into the control loop. These motivate why an on-device guard must be small and fast, and why a guard that must wait for a chain is a poor fit for the embodied setting [35]. Reliability is just as critical for the spatial decisions these agents make. In spatial question answering for navigation, a localization agent such as BinTrack [36] must return an accurate metric coordinate, because a large localization error can send the robot far from the goal and waste a long traversal before it recovers. This high cost of a confidently wrong answer is exactly what a guardrail should prevent, and Semantic Flip [37] synthesizes out-of-distribution query and memory pairs so that a lightweight rejection module can learn when an embodied query is unanswerable and the agent should decline rather than act on an arbitrary coordinate. These robotic spatial-reasoning pipelines make the same case as text moderation, that the guard which is accurate, lightweight, and fast is the one an on-device agent can actually run.

3 Problem Formulation↩︎

A moderation instance is \(x=(p,a)\) with a prompt \(p\) and an optional response \(a\). The label is a triple \(y=(y^{\mathrm{\small req}},y^{\mathrm{\small comp}},y^{\mathrm{\small resp}})\) of integer-coded verdicts. The request-harm label is \(y^{\mathrm{\small req}}\in\{0,1\}\), where \(0\) denotes an unharmful request and \(1\) a harmful one. The response-harm label is \(y^{\mathrm{\small resp}}\in\{0,1\}\), where \(0\) denotes an unharmful response and \(1\) a harmful response. The completion label is \(y^{\mathrm{\small comp}}\in\{0,1\}\), where \(0\) denotes a refusal and \(1\) a compliance. A discriminative encoder computes one bidirectional representation \(h=\mathrm{Enc}_\phi(x)\) and reads off \(\hat{y}^{(k)}=\arg\max(W_k h)\) in a single forward pass. A generative reasoner models a chain \(r=(r_1,\dots,r_T)\) and the verdict jointly, \(P_\theta(r,y\mid x)=\prod_t P_\theta(r_t\mid x,r_{<t})\,P_\theta(y\mid x,r)\), and decodes \(r\) before \(y\).

The discriminative encoder. Our primary guard \(f_\phi\) is ModernBERT-large [38], [39]. It encodes the full instance into a single pooled representation \(h=\mathrm{Enc}_\phi(x)\in\mathbb{R}^d\) and attaches three independent linear heads \(W_{\mathrm{\small req}},W_{\mathrm{\small comp}},W_{\mathrm{\small resp}}\), one per verdict component, each trained with cross-entropy against its gold label. The objective is their sum, \(\mathcal{L}_\phi=\sum_{k}\mathrm{CE}(W_k h,\,y^{(k)})\), and inference reads off \(\hat{y}^{(k)}=\arg\max(W_k h)\) in a single forward pass. The supervision is the verdict alone, and no reasoning is ever constructed or scored, so the model commits its entire capacity to the labeling decision rather than to fluent text. This is the natural inductive bias for a bounded-label problem. Bidirectional attention lets every token attend to every other before one decision is made, and a fixed-size head casts moderation as one-shot classification rather than autoregressive generation, which (Section 6) is also what makes it robust to label noise. All encoder weights are fine-tuned. We refer to this trained guard as LeanGuard.

The generative guard and parameter-efficient adaptation. The competing paradigm \(g_\theta\) instead emits the verdict as text. We instantiate this generative paradigm on a decoder (Llama-3.2 [6]) and an encoder-decoder (T5 [40]) and train it with a completion-only objective. The prompt tokens are masked out of the loss (\(\text{label}={-}100\)) and the gradient flows only through the completion, so the model is supervised purely on what it must generate. The same backbone is trained in two modes that share data, optimizer, and schedule and differ only in the completion target. The with-CoT mode generates the GuardReasoner reasoning trace and then the verdict, while label-only generates the verdict token(s) alone. This yields the three settings whose comparison is the entire study, generate-with-CoT (\(g_\theta^{\mathrm{\small cot}}\)), generate-label-only (\(g_\theta^{\mathrm{\small lab}}\)), and the classification head (\(f_\phi\)). The two generative settings are reachable on one Llama base by changing only the completion target, which isolates the chain of thought on a fixed base, while \(f_\phi\) is the discriminative encoder. For the heavier decoder settings we use parameter-efficient adaptation. Updating all parameters of a 3B decoder is costly, so we adapt these heavier settings with Low-Rank Adaptation (LoRA [41]). LoRA freezes each adapted projection \(W_0\) and learns a low-rank update \(\Delta W = BA\) with \(A\in\mathbb{R}^{r\times d}\), \(B\in\mathbb{R}^{k\times r}\), and rank \(r\ll\min(d,k)\), injected on the attention projections, so only a small fraction of parameters is trained while the pretrained weights stay fixed. For the 1.24B same-base comparison we report a single-epoch budget and rest the conclusion on the absence of a chain-of-thought gain rather than on the sign of any single adapter-matched pair. Holding backbone, data, optimizer, and schedule fixed and varying only the target and the head turns the question “does the chain help?” into a single controlled comparison rather than a confounded one (Section 4).

Cost. With \(C(\ell)\) the FLOPs of one forward pass, the reasoner costs \(\ge(T{+}1)\,C(|x|)\) against the encoder’s \(C(|x|)\), so \[\frac{\text{cost}(g_\theta)}{\text{cost}(f_\phi)}\;\gtrsim\;(T{+}1)\cdot\frac{|\theta|}{|\phi|}\,, \label{eq:cost}\tag{1}\] which for \(T=\mathcal{O}(10^2)\) and \(|\theta|/|\phi|=1.24\text{B}/0.395\text{B}\) is two orders of magnitude.

Noise slope. Training corpora for guards are labeled by humans and with model assistance, and both introduce errors, so robustness to training-label noise matters in practice. Corrupting each training label independently with rate \(\eta\) gives a headline \(F_1(\eta)\) and a degradation slope \(s=-\,dF_1/d\eta\). A guard is noise-robust if and only if \(s\) is small (Section 6).

Operating-point metric. A guard emits a harmful-class score \(\sigma(x)\!\in\![0,1]\). At threshold \(\tau\) it has a false-positive rate \(\mathrm{FPR}(\tau)\) and a true-positive rate \(\mathrm{TPR}(\tau)\). Production fixes a small target FPR \(\alpha\) and cares about \(\mathrm{TPR}@\alpha\), the recall at \(\mathrm{FPR}(\tau_\alpha)=\alpha\). A paradigm that polarizes \(\sigma\) toward \(\{0,1\}\) loses the score resolution needed near \(\tau_\alpha\) (Section 6).

These give three testable hypotheses, organized by the two misconceptions. H1 (against M1) the CoT term in \(P_\theta\) does not improve \(\hat{y}\) on a fixed base. H2 (against M2) a single-pass discriminative encoder remains robust as the training-label noise rate \(\eta\) grows, so its degradation slope \(s\) is small. H3 (against M2) the reasoner loses recall at a strict FPR because its confidence polarizes, so the discriminative inductive bias, not a reasoning component, governs the operating point.

4 Experimental Setup↩︎

Corpus and protocol. We use the public GuardReasoner training corpus of 127,465 conversation-level examples, which carries both the three-part verdict label and a reasoning trace per example. This lets us define a clean ablation on one corpus. The with-CoT condition trains on (reasoning \(+\) verdict), and the label-only condition trains on the verdict target alone, with the reasoning removed. The data, the optimizer, and the schedule are identical, and only the supervision target changes. We train every setting ourselves. All settings share the data, a one-epoch schedule, an effective batch of 16, AdamW with cosine decay and 10% warmup, and bf16 mixed precision. What differs per backbone is exactly the lever we study. Our primary model is the ModernBERT encoder, trained at learning rate \(3\!\times\!10^{-5}\) over a 1024-token context, and the completion-only decoder (Llama-3.2-1B) and encoder-decoder (T5) settings use learning rates \(1\!\times\!10^{-5}\) and \(3\!\times\!10^{-4}\) respectively, with the heavier decoder settings adapted by LoRA, and we defer their full configuration to the recipe. To put the central null on solid statistical footing we run three seeds for every trained setting and report the mean \(\pm\) standard deviation. We additionally evaluate the released GuardReasoner-1B and 3B [4] checkpoints, which were trained on this same corpus, with our scorer as the reference reasoning system.

Models and evaluation. Our primary model is ModernBERT-large [38] (395M) with three linear heads on the pooled representation, and the same-base experiments use a Llama-3.2-1B decoder (1.24B) and a T5-base [40] encoder-decoder (220M). We evaluate on public test sets over three tasks, abbreviated in Table 2 as follows. Prompt-harm: ToxicChat (TC), OpenAI Moderation (OAI), AegisSafetyTest (Aeg), SimpleSafetyTests (SST), HarmBenchPrompt (HBp), and the WildGuardTest prompt split (WGp). Response-harm: HarmBenchResponse (HBr), the WildGuardTest response split (WGr), BeaverTails (BT), SafeRLHF (SRL), and XSTestResponseHarmful (XSh). Refusal: the WildGuardTest refusal split (WGf) and XSTestResponseRefusal (XSr). The three families probe complementary failure modes: prompt-harm asks whether a request is harmful, response-harm whether a model’s reply is harmful, and refusal whether the reply declines or complies, which a guard must separate from harmfulness so a safe refusal is not scored as a violation. Per task we report the dataset-size-weighted F1 of the harmful or refusal class, and the headline classification performance (the headline, for short) is the unweighted mean of the three task F1 scores. This is the reasoning baseline’s protocol, matched cell-for-cell (Table 2).

5 CoT May Not Improve Accuracy (M1)↩︎

Table 1 reports the same-base experiments and Table 2 the per-benchmark landscape, both with three seeds per trained setting. These experiments answer the obvious objection that a “label-only decoder” is still a generative causal LM. On one Llama base we compare generate-with-CoT against generate-label-only, varying only whether the model reasons before it labels. Reading along the 1.24B row, the released with-CoT GuardReasoner-1B reaches 82.05, while a single-epoch label-only setting on the same Llama 1B model base already reaches 81.42, so the reasoning pipeline buys at most \(0.63\) F1 over a far cheaper label-only run, and the 395M encoder (82.90) exceeds both. On a compute-matched single-epoch comparison on the same base and data, adding CoT does not help, giving 81.35 against the label-only 81.42. We have also found that a simple fine-tuning run without HS-DPO reproduces this prior state of the art almost exactly, reaching 81.93, which confirms the baseline is easy to hit and is not the bottleneck. The same pattern holds at 3B, where GuardReasoner-3B reaches 82.50 and still does not beat the 395M encoder. On the T5 encoder-decoder, removing CoT raises F1 by 7.05 at 220M (80.02 against 72.97), a residual consistent with exposure bias in seq2seq verdict generation, so we treat the T5 result as corroborating rather than headline evidence. The label-only encoder leads GuardReasoner-1B on most axes (Table 2, 9 of 13 cells).

2.4pt

3.2pt

A lightweight classifier suffices. The 395M label-only encoder, LeanGuard, reaches 82.90\(\pm\)​0.26 (3 seeds). It matches GuardReasoner-1B in one forward pass at \({\sim}100\times\) lower cost (Figure 1), and stays competitive with the wider production-guard landscape (Llama-Guard 2 and 3, WildGuard, Aegis, ShieldGemma, MD-Judge) under our scorer. We do not over-attribute this cross-architecture cell, because ModernBERT’s pretraining is newer, so we claim only sufficiency. The confound-controlled statement is the same-base comparison that removes only the reasoning (Table 1), and the cheap encoder simply shows that a single-pass classifier can also be small and fast.

5.1 The Reasoning May Be Post-hoc↩︎

Why does a chain-of-thought leave the verdict unchanged? The usual information argument is real but weak. At inference the reasoning is generated from the input, so \(R\) is a function of \(X\), the chain \(Y\!-\!X\!-\!R\) holds, and \(I(Y;R\mid X)=0\) by the data-processing inequality, so there is no new information about the verdict. This is almost definitional and concerns information, not computation. A reasoning trace could still help by making the decision easier to compute. What rules that out here is not a theorem but a measurable property of the trained reasoner, which we state as a simple observation and then verify.

Model the guard as forming an implicit pre-reasoning verdict \(\hat{y}_0=\arg\max_y P_\theta(y\mid x)\), the answer it would give from \(x\) alone, then sampling a reasoning trace \(r\sim P_\theta(\cdot\mid x,\hat{y}_0)\) and emitting \(\hat{y}=\arg\max_y P_\theta(y\mid x,r)\). R-SFT trains on reasoning traces annotated to support the gold verdict, and HS-DPO prefers reasoning-verdict pairs whose verdict matches, so both push the chain toward self-consistency, \(\Pr[\hat{y}=\hat{y}_0]\ge 1-\epsilon\).

Observation 1 (post-hoc justification, not revision). If the chain is \(\epsilon\)-self-consistent then \(\hat{y}=\hat{y}_0\) with probability \(\ge1-\epsilon\), so it overturns an erroneous first-glance verdict with probability \(\le\epsilon\). Combined with \(I(Y;R\mid X)=0\), the reasoning adds neither information nor error-correction. The content of the observation is not the one-line algebra but whether its premise holds, so we measure \(\epsilon\) in two complementary ways. First, we re-sample the reasoning and re-read the verdict, and across a \(K\)-sample majority vote the final verdict changes on only 5.08% of inputs. Second, we read the decoder’s hidden state at an early, a middle, and a late token while it generates its chain, fit a linear probe on the late at-verdict state, and apply it to the earlier states (Figure 2). The probe already places all three states inside the harmful region, and the harmful-class confidence is essentially flat across the chain, about \(0.67\) at the early token and \(0.67\) at the late at-verdict token, so the verdict is fixed before the chain is written. The chain is therefore empirically a justification step, not a correction step, and a slow one, \({\sim}10^2\) sequential forward passes per verdict.

Corollary (the chain does not correct label-noise errors). If training-label noise \(\eta\) raises the rate of an incorrect \(\hat{y}_0\), the rationalized output inherits those errors at rate \(\ge(1-\epsilon)\Pr[\hat{y}_0\text{ wrong}]\), and a confident chain tends to defend rather than revise them [42], so a chain has no error-correcting advantage under label noise. Consistent with this, a one-dimensional linear projection of the encoder already separates the harmful/unharmful decision at AUC 0.926. The decision is nearly linearly separable, so a single pass realizes it and there is no serial structure for a chain to exploit, as [5] would predict.

What actually moves the needle. If the chain is not the lever, classical discriminative training is. On the same encoder, we have also experimented with label smoothing [28] (82.88), generalized cross-entropy [27] (81.83), and a longer schedule (83.37), all of which hold at or above the reasoning guard. Recent reasoning-guard work largely overlooks that, for accuracy under realistic labels, these decades-old single-pass tools dominate a reasoning trace.

6 Heavy Reasoning and Robustness (M2)↩︎

A single-pass encoder is robust to label noise. A heavier reasoning guard is often assumed to be the safer and more robust choice. We find that a lightweight label-only encoder is already highly robust to training-label noise. Under injected label noise (Table 3), the 395M label-only encoder degrades at only \(-0.81\) F1 per 10% (\(R^2{=}0.99\)) and still reaches 80.56 with 30% of its training labels corrupted, while a smaller T5 encoder-decoder trained label-only degrades almost twice as fast at \(-1.55\) per 10%. The practical headline performance is that the encoder trained with 10% of its labels corrupted (82.16) still matches a clean GuardReasoner-1B (82.05). For accuracy under realistic noisy labels a single-pass discriminative encoder is a strong and robust lever, and the strict-FPR comparison below shows that a heavier reasoning guard is not the more robust choice where it matters most in production.

3.5pt

Lightweight and embodied deployment. Real guardrails must often be small and fast, on-device, low-latency, with no room to wait for a chain, and trained on labels of uneven quality. A 395M single-pass encoder fits this regime, and the reasoning guard, about \({\sim}100\times\) slower, does not. LeanGuard runs cheaply on a short context. A 512-token window already matches GuardReasoner-1B (Figure 4), and it exports to ONNX for a single-pass deployment. This is the embodied-robot scenario that motivates the work, where a guard that must generate a chain before it acts is a poor fit for the control loop. On such a controller the guard must return a verdict within a single control step, so a chain of about \(10^2\) sequential decode steps can miss the deadline outright, whereas one bidirectional pass returns a fixed-latency verdict the controller can schedule against. The same property pays off away from the robot as well. A guard that screens every prompt and every response sits on the critical path of each interaction, so a hundred-fold reduction in per-call cost lowers serving cost directly and leaves headroom to run the guard at a higher sampling rate or alongside other safety checks rather than in place of them.

Data efficiency. The single-pass design is also cheap to train, not only to run. With only a quarter of the GuardReasoner corpus the label-only encoder already reaches 81.43, within 0.6 F1 of the full-data GuardReasoner-1B (82.05), and the full corpus carries it past every 1B and 3B reasoning guard we evaluate (Figure 5). The curve is steep early and then flat, so most of the signal is learned from a small, easily curated slice of the data. Because the encoder needs neither a long context nor a large labeled budget to match a reasoning decoder, it is also cheaper to re-train as moderation policies drift, whereas a reasoning guard must regenerate a full chain-annotated corpus for every policy change.

Strict-FPR operating point. Production guards run at a small false-positive rate to avoid over-blocking benign traffic, so recall at a fixed FPR matters more than a thresholded F1. We obtain a harmful-class score \(\sigma(x)\) per model and sweep its threshold (Figure 6). The encoder uses its softmax probability, and the reasoner uses its harmful verdict-token probability. At a 1% FPR the encoder retains 44.8 TPR while the reasoner retains only 10.1, far less recall where production guards operate. The gap is not a rescaling artifact, because \(\mathrm{TPR}@\alpha\) depends only on the ranking that the score induces and is invariant to monotonic transforms. It instead reflects ranking resolution, since the reasoner’s confidence is polarized toward \(\{0,1\}\) [42]. We therefore scope the claim to substantially more recall at strict FPR.

7 Discussion and Limitations↩︎

This is a controlled empirical study, not a new architecture. Its contribution is the same-base ablation that the reasoning-guard literature left empty. (i) Reasoning means CoT fine-tuning. We test the dominant recipe (R-SFT and HS-DPO, GuardReasoner) at 1.24B and 3B, not test-time reasoning, tool use, or verifier pipelines, and the title and abstract are scoped accordingly. (ii) Cross-architecture confound. The 395M versus 1.24B comparison conflates architecture with pretraining, so the controlled claim rests on the same-base comparison that removes only the reasoning (Table 1), which varies the chain alone on one base. We report the cheap encoder and its noise robustness as sufficiency, and bidirectional attention is a factor we do not isolate. (iii) The mechanism is an observation. Its force is the measured \({\sim}5\%\) verdict-flip rate and the at-verdict probe, not the one-line algebra. (iv) Score choice at strict FPR. We report the harmful verdict-token extraction for the reasoner and scope the claim to substantially more recall. Our contribution is to combine known ingredients, namely that CoT helps mainly on reasoning tasks [5], and that encoders are cheap and robust, into the controlled test that settles whether a reasoning guard’s chain earns its cost.

When a chain would earn its cost. Our claim is about accuracy and robustness on the standard moderation suite, not about interpretability. A reasoning trace still produces a human-readable rationale that an operator can audit, and that has value even when it does not change the verdict, so a deployment that needs an explanation may accept the cost knowingly. We see this as a separable axis from accuracy. A label-only encoder can be paired with a cheap post-hoc rationale only when an audit trail is actually requested, rather than paying for a chain on every call by default. The result also predicts where reasoning should help: a task whose decision is not nearly linearly separable, with genuinely multi-step policies, compositional rules, or tool-mediated lookups, would give the chain real serial structure to exploit, unlike the short, single-step labeling task studied here. Mapping that boundary is exactly what the same-base test is for, and extending it to multilingual and multimodal moderation, where the harmful/unharmful boundary may be less linear, is the natural next step.

8 Conclusion↩︎

On a fixed base, at both 1.24B and 3B, a chain-of-thought does not measurably improve a safety guardrail’s accuracy. This is because the reasoning guard largely justifies a first-glance verdict that it overturns on only \({\sim}5\%\) of inputs, at \({\sim}100\times\) the inference cost. A 395M label-only encoder, LeanGuard, matches a 1.24B reasoning guard, stays robust under injected training-label noise, and retains far more recall at a strict false-positive rate than the reasoning guard, which counters the assumption that a heavier reasoning guard is the safer choice. For a lightweight safety guardrail, and especially for the on-device embodied setting that motivates this work, a calibrated label-only encoder is a simpler, cheaper, and at-least-as-accurate default than a CoT-fine-tuned reasoning decoder. We release LeanGuard with all data splits, models, code, and an ONNX export.

More broadly, a calibrated discriminative encoder, not a CoT decoder, is the natural default baseline against which new guards are measured. We hope that future studies will report the same-base ablation that isolates the chain from architecture, scale, and data.

References↩︎