Safe Responses Matter: Output-Aware Safety Guardrail Mitigate Over-Refusal in MLLMs

Existing safety mechanisms for multimodal large languagemodels (MLLMs) face a fundamental trade-off between safety and util-ity. Model fine-tuning achieves robust safety but compromises generalutility. Input-side safety guardrails offer a lightweight alternative, yetthey suffer from severe over-refusal, indiscriminately blocking benignqueries or those the model could have safely answered through refusalor advisory responses. We identify that the root cause of over-refusallies in the input-aware paradigm: safety guardrails make safety decisionswithout considering whether the model itself is capable of generatingsafe responses. Usually, MLLMs already possess intrinsic safety mech-anisms that can transform harmful inputs into harmless outputs, butinput-side safety guardrails override this capability, degrading user ex-perience. Motivated by this insight, we propose a paradigm shift towardoutput-aware safety guardrails. Our method operates within the model’shidden state space to predict whether the forthcoming generation willbe unsafe before it is fully produced. By training a lightweight classifiervia multi-instance contrastive learning on hidden state representations,our approach distinguishes between inputs that will lead to unsafe out-puts and those that will not, even when the inputs themselves containrisky elements. This enables precise intervention only when the model’sactual response would be harmful. Extensive experiments demonstratethat our output-aware safety guardrail matches the safety performance ofexisting methods while drastically reducing over-refusal, preserving themodel’s utility and built-in safety capabilities. Our code is available athttps://github.com/kunzhan/OutGuard.