TRACE (LRM Safety) - Final Response: leaderboard
TRACE (Wu et al., 2026) tests guardrail models on 5,000 prompt, reasoning-trace and final-response triples from four large reasoning models in English and Chinese, with safety labels and evidence spans from a majority of three LLM annotators. This board scores safe or unsafe judgments of the final response. F1 on the unsafe class in percent; higher is better.
Metric: F1 on the unsafe class (%; guardrail safe or unsafe judgments of the final response in 5,000 prompt, reasoning-trace and final-response triples from four reasoning models, English and Chinese, nine risk categories and ten attack strategies; labels by a majority of three LLM annotators, temperature 0). Source: arxiv.org. Saturation forecast: Rough model projection: around 2026. 18 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | YuFeng-XGuard-Reason-8B | 86.11 | |
| 2 | PolyGuard-Qwen | 84.15 | |
| 3 | Qwen3Guard-Gen-8B | 83.64 | |
| 4 | Qwen3Guard-Gen-4B | 83.05 | |
| 5 | Octopus-SEval-14B | 82.46 | |
| 6 | YuFeng-XGuard-Reason-0.6B | 81.65 | |
| 7 | Qwen3Guard-Gen-0.6B | 81.52 | |
| 8 | gpt-oss-safeguard-20b | 81.39 | |
| 9 | Llama-3.1-Nemotron-Safety-Guard-8B-v3 | 80.78 | |
| 10 | WildGuard 7B | 69.86 |
Interactive version: theaggregate.ai/benchmark?slug=trace-lrm-safety-final-response · How It Works · Data refreshed daily, snapshot 2026-11-12.