Researchers test a guard that stops a reply only if it turns dangerous

Researchers made a dataset of 41,944 prompt and response pairs. They used 7 open-weights models. The 3 types are Llama, Gemma and Qwen. A label on the prompt and a label on the response agree on only 50.46% of items. They want a system that starts a reply and looks at the first part. It stops only if the reply turns dangerous.