Search papers, labs, and topics across Lattice.
This paper systematically compares the effectiveness of fine-tuned encoder classifiers from the ModernBERT family against traditional LLM-based judges for evaluating harmful outputs in large language models (LLMs). The study benchmarks various safety evaluation methodologies, including rule-based and fine-tuned LLM classifiers, across multiple adversarial datasets, revealing that encoder classifiers can identify harmful outputs with comparable performance to LLM judges while being more cost-effective and faster. Key results indicate that encoder classifiers can serve as viable alternatives in specific contexts, particularly in scenarios where latency and cost are critical considerations.
Encoder classifiers can match the performance of LLM-based safety judges while being significantly faster and cheaper to deploy.
With the widespread adoption of large language models (LLMs) in chatbots and everyday applications, companies increasingly need guardrails that are effective while remaining low-cost and low-latency. Safety evaluation of LLM outputs has generally relied on LLM-based judges, which can be effective but are often slow and expensive to deploy at scale. In this paper, we evaluate whether fine-tuned modern encoder classifiers from the ModernBERT family, including ModernBERT and Ettin, can reliably identify harmful LLM outputs in user-model conversations without substantial performance loss relative to LLM-based judges. We benchmark these encoder classifiers against rule-based prefix matching, fine-tuned LLM classifiers, and LLM judges using a range of judge-prompting strategies across open-source adversarial datasets. The LLM judges include evaluation methodologies from StrongReject, ShieldGemma, JailbreakBench, AILuminate, SorryBench, and a Claude-as-a-judge setup, as well as fine-tuned safety classifiers such as LlamaGuard 3 and LlamaGuard 4. The encoder classifiers are fine-tuned on judge-labeled data using a majority-voting label strategy and are then evaluated on a gold-standard holdout dataset to assess their performance relative to LLM judges. We report absolute performance using F1 score, false negative rate, and precision-recall metrics. We also break down results by attack technique, including single-turn prompting, decomposition, escalation, and context manipulation, to identify where encoder classifiers align with or diverge from LLM-based judges. Our findings provide guidance on when encoder classifiers can serve as cost- and latency-efficient alternatives to LLM-based safety evaluation.
