A paper posted to arXiv on July 22 claims that small language models trained on synthetic data can catch LLM safety failures better than the standard approach of asking the big model to police itself S¹. The authors list a JPMorgan correspondence address P² and call their system Fence. The trick is how they generate the training data, and it borrows from a technology most people associate with deepfakes, not safety.

My read: This is the first guardrail paper I've seen that frames the problem as model specialisation rather than prompt engineering. The GAN-inspired data generation is clever in theory, but without any reported numbers I can't judge whether "performance gains" means a 2% improvement or a 20% one. The JPMorgan correspondence address suggests the work may be tuned for financial use cases, since banks face some of the strictest requirements for LLM behaviour in production.

Why asking the LLM to police itself fails

The standard approach to LLM safety in production is to add a system prompt that says "don't do X" and hope the model complies. The Fence authors argue this is not enough for real-world applications using closed-source models S¹. Application-specific failures like hallucination, topic drift, and behaviour deviation are harder to model than standard content moderation S¹. A model that refuses to produce toxic text is one thing. A model that drifts from explaining general financial concepts into giving specific investment advice is another.

Data scarcity and annotation costs make building specialised guardrails expensive S¹. You need thousands of examples of the specific failure mode you want to catch, and labelling them requires domain expertise that is hard to scale.

How Fence turns adversarial training into a data factory

The authors' solution has two parts. First, use a small language model, not the big LLM, as the guardrail. Small models are cheaper to run and can be trained for one specific task. Second, generate the training data synthetically using a method inspired by Generative Adversarial Networks S¹.

GANs, introduced in 2014, pit two neural networks against each other: a generator that creates fake examples and a discriminator that tries to tell real from fake. Fence adapts this idea so one model generates attempts to break the guardrail while the other learns to catch them. The competition drives both to improve.

The paper claims that SLM guardrails trained on this synthetic data show performance gains over prompt-based LLM guardrails S¹. No specific numbers appear in the abstract.

The wider push for external guardrails

This paper sits in a growing field. The common thread across recent work is that teams are realising the LLM itself cannot be the last line of defence.

Open-source projects are already moving in this direction. A GitHub repository called Sentinel-SLM offers a lightweight multilingual moderation model trained on 1.6 million samples across 20 languages P³. Another project, hoophq/fence, provides guardrails for AI coding agents that block dangerous tool calls before they execute P⁵. Neither is connected to the arXiv paper, but both point the same way: small, specialised models as a separate safety layer.

What to do about it

Consider a legal tech startup that deploys a closed-source LLM to draft contract summaries from uploaded documents. The model occasionally hallucinates clauses that don't exist in the source text. A prompt-based guardrail saying "only use information from the provided document" catches some cases but misses subtle fabrications. Training a small model on thousands of synthetic examples of hallucinated versus accurate summaries, generated through the adversarial method Fence describes, could catch more failures at a fraction of the inference cost of running the big LLM twice.

The practical step this week: audit which LLM failure modes in your application are application-specific rather than generic content moderation. Hallucination, topic drift, and behaviour deviation are the three the paper names S¹. If you are spending on prompt-based guardrails for any of these, start tracking the failure rate so you have a baseline to compare against a specialised model approach.

What we don't know yet

The paper provides no quantitative metrics, benchmark names, or confidence intervals in its abstract S¹. The performance claims are self-reported by the authors without independent corroboration. The work focuses on closed-source LLMs and does not establish whether the approach generalises to open-source models. The paper is an unreviewed arXiv preprint, not a peer-reviewed publication.

No code or model weights appear to be publicly available. The JPMorgan correspondence address P² suggests the research may be optimised for financial services use cases, but the paper does not specify which applications were tested.

The next signal: the full paper, once arXiv renders the HTML version with experimental details and benchmarks, will reveal whether "performance gains" is a marginal or meaningful improvement. We'll check the claims against it. If you want that follow-up in your inbox, subscribe and we'll send it the day it lands.

Sources: S1 — Fence: Specialized SLM Guardrails for LLM Applications · P2 — Fence: Specialized SLM Guardrails for LLM Applications · P3 — abdulmunimjemal/Sentinel-SLM · P4 — GitHub - DeepExperience/DeepAgent: 🛠️ DeepAgent: A General Reasoning A · P5 — hoophq/fence

More from Not A Tech Guy

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.