OpenAI launches gpt-oss-safeguard for AI moderation
OpenAI is releasing `gpt-oss-safeguard`, two open-weight models that classify content according to policies defined by each developer. They offer more flexibility for moderating new risks, but consume more resources and do not always outperform specialized classifiers.
OpenAI has introduced gpt-oss-safeguard, a family of reasoning models that lets you review content using the safety rules defined by each developer. It is available as a research release in two sizes: gpt-oss-safeguard-120b and gpt-oss-safeguard-20b.
Unlike a traditional moderator, these models do not apply a fixed policy learned during training. They receive two elements at the same time: the policy they must follow and the content they need to evaluate. They then indicate whether the text fits that policy and explain how they reached their decision.
Moderation rules you can change
A gaming forum could create a rule to detect posts about cheating. A review site could define another to identify comments that appear fake. If the rules change, the developer can modify the policy sent to the model without having to retrain it from scratch.
That is the main difference from standard safety classifiers. These are trained on thousands of examples labeled as safe or dangerous and learn to recognize patterns. They work quickly, but changing their criteria usually requires collecting new data and repeating the training process.
With gpt-oss-safeguard, the policy is provided while the model is being used. This makes it easier to adapt to new risks, specific industries or different definitions of harm. It can also show its reasoning so safety teams can review why a post was classified in a particular way.
Two open-licensed models
OpenAI is releasing both models under the same Apache 2.0 license used by the gpt-oss family. That allows you to use, modify and deploy them freely, subject to the terms of that license. The files are available for download on Hugging Face.
The models are intended for tasks where accuracy and explanation matter more than speed. OpenAI highlights four scenarios:
- New risks that require policies to be updated quickly.
- Specialized or ambiguous content that is difficult for smaller classifiers to evaluate.
- Platforms that do not have enough examples to train their own system.
- Processes where latency, meaning response time, is not the main priority.
In practice, a platform could use a fast filter to review all content and send only questionable cases to gpt-oss-safeguard. It could also analyze posts asynchronously and take action afterward if it detects a problem, instead of blocking every message while the user waits.
What the tests show
OpenAI says its models outperformed gpt-5-thinking and the open gpt-oss models in an internal evaluation with several policies applied at the same time. To count as correct, the system had to get all the labels for each case right.
In a moderation evaluation published in 2022, gpt-oss-safeguard achieved a slightly higher result than the other models tested, including OpenAI's internal Safety Reasoner system and gpt-5-thinking. The company clarifies that the difference compared with Safety Reasoner is not statistically significant.
On ToxicChat, another public benchmark based on queries to an open-source chatbot, OpenAI's internal systems came out slightly ahead. Even so, OpenAI argues that the smaller size of gpt-oss-safeguard could make it more practical for this type of task.
It does not always replace a specialized classifier
OpenAI also acknowledges two important limitations. A classifier trained on tens of thousands of high-quality examples can be more accurate on complex risks. If a platform needs maximum performance for a very specific use case, training a dedicated system may still be the best option.
In addition, reasoning about every message takes more time and resources than applying a quick label. That is why the most realistic approach is not to use a single model for everything, but to combine several layers: an inexpensive filter to identify potential risks and a reasoning model to examine difficult cases.
The release is a preliminary version created with help from specialists and organizations such as ROOST, SafetyKit and Discord. The next step will be to see how it performs outside testing environments and what policies developers build. The important idea is that moderation no longer depends solely on rules embedded during training. It can now also become an editable policy that each platform's team adjusts as needed.