A Multi-Policy Safety Guardrail Framework for LLMs via Dynamic LoRA Switching

This work was initially submitted to the IEEE in January 2026 for possible peer review and publication. Copyright may be transferred without notice, after which this version may no longer be accessible. This preprint version (v1.1.5) reflects minor formatting refinements over the submitted manuscript; substantive content remains unchanged.

Ensuring the safety of large language models (LLMs) is challenging due to varying national regulations, industry standards, and cultural differences that cannot be addressed by a single policy. Prompt-based approaches struggle to maintain consistency and are vulnerable to jailbreak attacks, while model-level safety alignment incurs performance degradation known as the so-called "Safety Tax." This paper proposes a multi-policy safety guardrail framework based on dynamic LoRA switching to overcome these limitations. We propose an end-to-end pipeline encompassing policy definition, dataset construction, and adapter training, and empirically validate both the feasibility and limitations of multi-policy deployment.

Three research hypotheses were formulated and statistically validated: (H1) specialized learning of adapters for each policy, (H2) significant differences between policies in boundary cases, and (H3) favorable safety-utility trade-off of the multi-policy system. We confirmed statistically significant policy differentiation with non-overlapping Wilson 95% confidence intervals, McNemar's test p < 0.0001, and a 66.6 percentage point refusal rate difference in boundary cases (Weak Bias), suggesting that the Dynamic system can achieve a favorable safety-utility trade-off under the evaluated conditions with effect size (Cohen's h = 0.209).

The key contributions include: (1) a methodology for dynamic switching of multiple policies within a single model, (2) introduction of a three-tier response system (REFUSE/SAFE_ANSWER/ALLOW), and (3) empirical demonstration of policy differentiation based on boundary cases. Experiments were conducted using Llama 3.1 8B Instruct as the base model with the Jigsaw Unintended Bias dataset (n = 2,800) under oracle routing conditions. The framework is designed to be reproducible in a Google Colab Pro environment (NVIDIA A100 80 GB).

Note: This preprint contains the main paper. Supplementary materials have been omitted from this public version.