InGuard Released Weights
This repository contains the released guardrail heads for
InGuard, an in-pipeline safety
framework for text-to-image generation. It does not contain the five base
text-to-image models.
For each supported model, the release provides:
- a PE-MLP classifier operating on text-encoder embeddings; and
- a ConvNeXt-Base detector operating on an intermediate latent estimate.
Supported models
| Model key |
PE-MLP input dimension |
Latent channels |
Detection step |
z-image-turbo |
2560 |
16 |
3 |
qwen-image-2512 |
3584 |
16 |
4 |
hunyuan-image-2_1 |
3584 |
64 |
4 |
flux2-klein-base-9b |
12288 |
32 |
4 |
internvl-u |
4096 |
16 |
8 |
Detection step uses zero-based indexing and refers to the default deployed
configuration in the InGuard code repository.
Repository layout
.
├── latent_detector/
│ └── <model>/
│ ├── model.pth
│ └── config.json
├── pe_mlp/
│ └── <model>/
│ └── model.pth
└── manifest.json
The PE-MLP checkpoints contain input_dim, hidden_dim, num_layers, and
dropout together with model_state_dict; no separate PE-MLP config file is
required. Training optimizer states have been removed from all released
checkpoints.
Download and verify
git clone https://github.com/Alibaba-AAIG/InGuard.git
cd InGuard
hf download Alibaba-AAIG/InGuard --local-dir weights
pip install -r requirements.txt
python scripts/verify_pipeline.py \
--model z-image-turbo \
--stage components \
--device cpu
Use --stage quick for file and manifest checks. End-to-end generation also
requires the corresponding base model and a suitable GPU; see the main
InGuard README for complete instructions.
Intended use
These weights are intended for research on generation-time safety screening,
prompt-embedding enhancement, and intermediate-latent risk detection with the
supported base models.
They are not a standalone image-generation model and must not be treated as a
complete content-safety solution. Performance can vary across prompts,
languages, model revisions, sampling settings, and content outside the
released evaluation distribution. Users remain responsible for downstream
validation and compliance with applicable law and platform policy.
Base-model terms
The supported base models are not redistributed here. Download them from their
respective providers and comply with their individual licenses and access
terms.
License
The InGuard guardrail weights are released under the Apache License 2.0. See
LICENSE for details.
Citation
@article{wang2026inguard,
title = {InGuard: Towards Generalized Inner Guardrail for
Safe Text-to-Image Generation},
author = {Wang, Zeyu and Li, Xiaodan and Li, Zhiwen and
Chen, Yuefeng and Xue, Hui},
journal = {arXiv preprint arXiv:2609.27620},
year = {2026},
doi = {10.48550/arXiv.2609.27620},
url = {https://arxiv.org/abs/2609.27620}
}
