Introducing ScopeGuard-2

Today we're releasing ScopeGuard-2, the next generation of our guardrail model. Its open-weight 4B version matches frontier models on accuracy and is the fastest model in the top ten of the unsafe-eval leaderboard. We're also releasing a preview of ScopeGuard-2 Pro, which ranks first on the same leaderboard and is available through our hosted API or licensed for on-premises deployments.

ScopeGuard is a guardrail model that verifies whether a user request to an AI system is safe to process with respect to the scope of the AI system. In its first version, ScopeGuard could tell whether a request was "directly supported", "potentially supported", "out of scope", "restricted", or just "chit chat." Following our users' feedback, ScopeGuard-2 can now detect two new types of requests: those which should require "human oversight" or human intervention, and those for which a "predefined answer" is good enough.

We've also added more control over the information returned with each prediction. You can request reasoning and supporting evidence when reviewing decisions, or use a dedicated, faster classification mode in Orbitals and our hosted API.

ScopeGuard-2 is also more flexible now. You can use it in "classification mode" to obtain a result in less than 100ms on a consumer-grade GPU (ScopeGuard-2 4B returns a decision in 34ms on average across more than 10,000 requests on an Nvidia RTX 5090), or you can turn on reasoning and/or evidence extraction to get more insights into a ScopeGuard-2 decision.

ScopeGuard-2 4B combines fast classification with accuracy on par with the frontier models we tested. Across six public benchmarks, its mean balanced accuracy is within half a point of the best-scoring frontier model we tested. Its median response time is more than 80 times faster than GPT-6.1 Sol, Claude Opus 5.5, and Gemini 4 Argon. See "Accuracy and latency" below for the full comparison and evaluation details.

Approved replies

Say you're building a delivery assistant to help customers track their packages. If someone asks how to contact support, you probably already have the answer written and want the assistant to stick to it.

Alongside the assistant's responsibilities and restrictions, you can now provide predefined replies with instructions for when to use them. ScopeGuard-2 recognizes these requests with the new Predefined Answer class.

For the delivery assistant, you might provide an approved reply to questions about contacting support: "You can reach our support team at support@example.com, Monday to Friday, 9 am to 6 pm."

ScopeGuard spots when an approved reply is a good fit, and your application sends that reply to the customer.

Human oversight

Some requests need a person to step in rather than an automated reply. If a customer reports that their parcel has been stolen, for example, you'd want someone on your team to take it from there.

You can now specify criteria for when someone on your team should take over. ScopeGuard-2 recognizes these requests with the new Human Oversight class.

ScopeGuard identifies when human oversight is needed, and your application handles the handoff.

Choosing what ScopeGuard returns

ScopeGuard-2 gives you more control over what each prediction includes. The first release could already return evidence from your service description to support its decision. With ScopeGuard-2, you can also ask for:

• Reasoning: a short explanation of why the request received that classification.
• A suggested response: a reply your application can use when responding to the user.

You can choose which fields to return alongside the scope class. Reasoning and evidence are useful when you want to understand a decision or refine your service description, though generating them takes extra time.

Classification mode

When you only need to know which scope class a request belongs to, classification mode gives you a faster answer without generating reasoning, evidence, or a suggested reply.

You can use it through the new classify() method in Orbitals and our hosted API. It scores all seven scope classes in a single prediction step and returns the most likely one.

Available models

ScopeGuard-2 comes in two versions:

• ScopeGuard-2 4B (scope-guard-v2-4B-q-2609) is our open-weight model, based on Qwen3.5-4B and available on Hugging Face.
• ScopeGuard-2 Pro (scope-guard-v2-pro-2609) is our most capable, closed-source model, available through our hosted API or licensed for on-premises deployments.

Both support the new scope classes and configurable output fields. Below, we compare them with the previous release and other general-purpose models.

Accuracy and latency

We evaluated both ScopeGuard-2 models as part of the unsafe-eval leaderboard, which compares 35 models as safety guardrails under the same setting. Here we compare them with the first ScopeGuard release and with the general-purpose models GPT-6.1 Sol, Claude Opus 5.5, Gemini 4 Argon, and Jev. We also included Nemotron-3.5-Content-Safety and Shieldstral-1.0-3B, which are built specifically for safety classification. The table reports balanced accuracy on six public benchmarks covering general safety and the ability to follow specific policies. Balanced accuracy gives equal weight to catching unsafe requests and allowing legitimate ones.

As shown in the table, both ScopeGuard-2 models improve on the previous release's average balanced accuracy and score on par with or above the general-purpose models we tested, while responding much faster. ScopeGuard-2 4B returns a result in a median of 34 ms, about ten times faster than Jev and more than 80 times faster than GPT-6.1 Sol, Claude Opus 5.5, and Gemini 4 Argon, while ScopeGuard-2 Pro takes 118 ms. Compared with Nemotron-3.5-Content-Safety, ScopeGuard-2 4B is both faster and more accurate on average.

Try ScopeGuard-2

To run ScopeGuard-2 locally, download the 4B model from Hugging Face and install Orbitals 0.6.1 or later. ScopeGuard-2 Pro is available through our hosted API or licensed for on-premises deployments.