Large Language Models (LLMs) can produce fluent responses to diverse user requests, yet streaming generation may expose users to harmful content before the full output is completed. Existing guardrails suffer from two limitations: first, they perform post‑hoc moderation only at response or chunk boundaries, which can let harmful material reach users before verification; second, even with token‑level detection, coarse response‑level supervision does not pinpoint where the harmful content begins, and fixed‑layer readouts may miss safety signals present at other depths. To overcome these issues, we introduce ADTGuard, which checks each token before it is released, progressively refines token‑level training targets, and adapts the selection of observation layers to the current prefix. ADTGuard models risk across depth and time via Depth‑Time Safety Dynamics (DTSD), aggregating safety evidence from all layers for each token and using it to guide risk accumulation over successive tokens. To adapt layer choice to the evolving prefix, we propose the Causal Depth Router (CDR). When only response‑level labels are available, we further develop Risk‑Onset Target Refinement (RTR) to iteratively construct token‑level targets for both components. Extensive experiments on multiple safety benchmarks show that ADTGuard consistently delivers strong streaming detection performance, matching or surpassing state‑of‑the‑art safeguards while requiring only 16 M trainable parameters and maintaining competitive per‑token latency.
Review: ADTGuard’s joint depth‑time modeling provides fine‑grained, low‑latency interception for streaming LLM outputs, offering an efficient and scalable safety solution suitable for real‑world deployment.