license: cc-by-4.0
base_model: Qwen/Qwen3-0.6B
tags:
- content-moderation
- safety
- guardrail
- policy-conditioned
- reasoning
language:
- en
Railz-R2 β sub-1B policy-conditioned safety guard, OOD-hardened
Railz-R2 is a 0.6B content-moderation guard that judges content against a policy you supply at inference, emitting the violated category verbatim (or abstaining) then a short chain-of-thought. It is the out-of-distribution / policy-following upgrade of Railz-R: dramatically stronger on real-chatbot toxicity and policy-flipping, at a small, noise-level cost to in-domain detection.
Built on Qwen3-0.6B. Trained with mechanical supervision only β no teacher model in the loop: NVIDIA Aegis-2.0 labels + NVIDIA Nemotron reasoning traces (CC-BY-4.0) + OpenSafetyLab/Salad-Data (Apache-2.0) jailbreak/harmful prompts + WildChat-1M (ODC-BY) benign real-chat, all mapped mechanically to the Aegis-18 vocabulary.
Results (0.6B) β vs Railz-R, same harness
| metric | Railz-R | Railz-R2 | Ξ |
|---|---|---|---|
| policy-flip (held-out contrast pairs) | 78% | 90% | +12 |
| ToxicChat F1 (out-of-domain) | 30% | 38% | +8 |
| Aegis-2.0 test F1 (in-domain, n=1964) | 79.4% | 77.9% | β1.5 |
Railz-R2 dominates OOD toxicity detection and policy-following. The β1.5 Aegis is near-tie and partly an artifact of Aegis test-label noise (Railz-R2 correctly abstains on some mislabeled-benign items, which lowers its score against noisy gold). Choose Railz-R2 for real-world/adversarial traffic and policy-following; Railz-R remains marginally ahead on the clean in-domain Aegis benchmark.
What changed vs Railz-R
Added OOD-distribution contrast pairs β Salad-Data jailbreak/harmful questions (the ToxicChat-adversarial distribution) + WildChat benign β minted as policy-flip pairs and blended with the in-domain reasoning data. This lifts OOD recall + policy-flip robustness. Same SFT recipe as Railz-R: fresh Qwen3-0.6B, verdict-first target, reasoning-span down-weighted (REASON_W=0.3), LoRA r16/scale20, LR 2e-5.
Prompt format
Identical to Railz-R (verdict-first, then reasoning):
<|im_start|>system
You are a content moderation system. The policy below lists PROHIBITED categories. Anything not listed is permitted.
First reason briefly inside <think></think>. Then, on a new line, state the violated category using the exact category text from the list, or exactly: no listed category applies
PROHIBITED:
- <your categories>
<|im_end|>
<|im_start|>user
CONTENT TO MODERATE:
<content><|im_end|>
<|im_start|>assistant
Output: Violated category: <X> (or no listed category applies) then <think>β¦</think>. Parse the verdict line; strip the think block. Greedy, ~120 max new tokens.
Limitations
- In-domain (Aegis) detection is ~1.5 F1 below Railz-R β a genuine (if noise-adjacent) trade for the large OOD gains. At 0.6B, OOD generalization and in-domain detection are in tension; a single model cannot maximize both.
- OOD ceiling remains (ToxicChat 38 < large-guard 76-81); English; text-only.
- CoT is a post-hoc justification of a verdict-first decision, not a guaranteed faithful trace.
Sibling models
- Railz-R β in-domain detection champion (Aegis 79.4).
- Railz β non-reasoning, higher throughput.
License
CC-BY-4.0 (inherits Aegis-2.0 / Nemotron / Salad-Data / WildChat data licensing).