PaxmodGuard: a 0.3B guardrail that out-ranks guard models 30x its size on kids' chat

All models were run by us on the same inputs. Game A and Game B are about 52,685 messages of real chat from two children's online games, stored after our training data was frozen, so no model saw them; messages were labelled to our written policy, which favours a model trained on that policy. AUPRC measures how well a model's scores rank harmful messages above harmless ones, whatever threshold you choose. OR-Bench-Hard is independent.

Key features

Built for kids' chat

On real chat from two children's games that no model had seen, PaxmodGuard ranks harmful messages above harmless ones better than any other model we tested: ROC-AUC 0.85 and 0.87, against at most 0.80 and 0.79 for models up to 30 times its size. General guard models built for assistant prompts transfer poorly to this chat; a classifier of the same size and design scored 0.02 AUPRC on Game A, against 0.17.

Built not to over-block

False alarms are the main reason teams switch moderation off. On safe prompts that only sound harmful, PaxmodGuard wrongly blocks 17% at its default settings; the general guard models we tested block between 38% and 89%. Roleplay, game deaths, breeding a horse and everyday insults are not harm.

Grooming, one tactic at a time

Grooming is rarely one message. It is a pattern: checking whether a child is alone, asking them to keep a secret, setting them against their parents, moving them to another app. PaxmodGuard labels each of those moves on its own, so they can be seen early, before anything sexual is said, and it labels the conversation as suspected grooming when they add up.

It reads the conversation

The same model takes four kinds of input. Each turn is tagged with who wrote it, so nothing about the model changes between them.

Small enough for a CPU

307 million parameters and milliseconds per message on two ordinary CPU threads (7 ms for a short message). Every label is scored in one pass instead of an answer being generated word by word, so the guardrail fits inside a chat turn on the server you already have.

Labels for companions and kids

Multilingual

PaxmodGuard is built on mmBERT, a multilingual encoder, and trained on chat in many languages, including copies disguised the way people dodge filters.

PaxmodGuard Cloud

The open model is trained on public and synthetic data. Paxmod's cloud version uses the same architecture, trained additionally on proprietary data from real kids' games and companion apps. It is the model behind a Paxmod key, and it is where PaxmodGuard is strongest:

"Best other model" is the best score among Qwen3Guard (0.6B, 4B, 8B), ShieldGemma, Granite Guardian, Llama Guard 3 and GLiGuard on each measure. Harm is about 1% of real chat, so AUPRC is low for every model; random scoring would get about 0.01.

Develop with PaxmodGuard

Install from npm or PyPI. The model downloads once and every check runs locally; no message leaves your server. Drop it in as a guardrail in the framework you already use: Vercel AI SDK middleware, an OpenAI Agents SDK guardrail, a Mastra processor or LangChain middleware, or run it as a self-hosted HTTP service for any other language.

npm i @paxmod/guard · pip install paxmod-guard

import { createGuard } from "@paxmod/guard";

const guard = await createGuard(); // downloads the model once, then runs on your CPU

// a person, to your companion: before your LLM sees it
const input = await guard.checkInput(userMessage);
if (input.crisisReply) return input.crisisReply;

// a player, read with the messages before it
await guard.checkChat(message, { context: earlierTurns });

// a whole DM, both sides
await guard.checkConversation(turns);

Limits

• On broad public benchmarks, larger general guard models rank better: average AUPRC 0.81 across eight public sets, against 0.91 for Qwen3Guard-0.6B and 0.92 for Qwen3Guard-8B. Those sets count as unsafe much that our policy allows; the opt-in strict mode follows their broader definition (0.82).
• Real kids' chat is hard. No model we tested, this one included, reaches 90% precision at a useful catch rate on it. Use the scores to rank and route messages to people, not as a sole decision.
• Grooming builds over days and many messages. A single message carries only the tactic signals; check whole conversations to see the pattern.
• Most training data is English and Spanish. Other languages are covered but less tested.
• It checks a message after it is written, so on its own it cannot undo a first harmful message that was already shown.
• Rare harms such as extremism and dangerous challenges have few training examples.
• It is a guardrail, not a moderator. Serious cases need a person.