GPT-OSS Safeguard 120B: How to Use OpenAI's Policy Classifier

GPT-OSS Safeguard 120B is OpenAI's open-weight model for classifying content against a policy you write. You give it the policy and the text to check, and it returns a label with the reasoning behind it. OpenAI released it with a smaller 20B sibling on October 29, 2025, as a research preview under the Apache 2.0 license.¹

It is a classifier for builders, not a chat model. You can pick it in Maple Work, our desktop app in early access, or call it through Maple Proxy, our OpenAI-compatible API, as gpt-oss-safeguard-120b; it isn't listed in Maple Chat. This guide covers what it does, where policy-based reasoning helps and where a trained classifier does better, how to write a policy for it, and how to call it. For the base model's architecture and hardware, read our GPT-OSS 120B guide.

What is GPT-OSS Safeguard?

A version of GPT-OSS fine-tuned to reason from a written policy. A conventional safety classifier learns its policy indirectly, from thousands of labeled examples, and never sees the rules themselves. Safeguard reads your policy at the moment it classifies, so changing the policy means editing text, not retraining a model.

OpenAI describes the inputs and output plainly:

The model takes two inputs at once—a policy and the content to classify under that policy—and outputs a conclusion about where the content falls, along with its reasoning.

That content can be a user's message, a model's response or a whole conversation. The policy doesn't have to be about safety: OpenAI's own examples are a gaming forum flagging posts about cheating and a reviews site screening likely fake reviews. It is an open-weight implementation of the approach behind Safety Reasoner, a tool OpenAI uses inside its own safety systems.

The model is text only and supports three reasoning levels: low, medium and high. It was trained on OpenAI's harmony response format, which separates its reasoning from its final answer.⁴ OpenAI's prompting guide says chat-message runtimes such as vLLM apply that format for you, and Maple Proxy accepts ordinary chat messages too.

Is GPT-OSS Safeguard open source?

The weights are. OpenAI publishes them on Hugging Face under the Apache 2.0 license, with the same two-sentence usage policy as GPT-OSS: by using the models, you agree to comply with all applicable law. The weights are 65.25 GB across 15 files, the same as the base model, and OpenAI says the 120B fits on a single 80 GB GPU such as an H100. The hardware section of our GPT-OSS 120B guide covers what that means in practice.

It is also built with the trust-and-safety community. OpenAI developed the release with ROOST (Robust Open Online Safety Tools) and iterated on it with trust-and-safety specialists at SafetyKit, Tomoro and Discord. ROOST runs a model community where practitioners share results and feedback.

When should you use GPT-OSS Safeguard?

When your policy is new, nuanced or changing faster than you can label data for it. OpenAI says the reasoning approach works especially well in four situations, and names two limits in the same post.¹ Put together, the fit looks like this:

The limits matter. OpenAI calls Safeguard "time and compute-intensive", and doesn't run its own version on everything. It uses small, fast classifiers to pick out which content needs a closer look, and sometimes runs the reasoning model after the fact, so users don't wait.

The practical pattern is the same: rules and a cheap classifier first, Safeguard on what they can't settle, and people on what Safeguard flags for escalation. OpenAI's Help Center says it can work alongside OpenAI's Moderation API but is "likely not a replacement for low latency use cases."⁵

How good is GPT-OSS Safeguard?

In OpenAI's own tests, both Safeguard models beat gpt-5-thinking on two of the three classification evaluations; OpenAI calls the multi-policy result surprising given their small size. These are OpenAI's results on evaluations it chose, not Maple measurements.⁶

The multi-policy test is strict: each input is checked against several policies at once, and it counts only when every label matches. OpenAI's internal Safety Reasoner scored 52.2% on it. On ToxicChat, a public benchmark built from real chatbot queries, gpt-5-thinking and Safety Reasoner both did slightly better than Safeguard.

Two caveats from OpenAI apply to real deployments. Its reasoning can contain hallucinated content, including language that doesn't reflect the policy it was asked to apply, so treat the explanation as evidence to check, not as the decision itself. And OpenAI says the raw reasoning is meant for developers and safety teams, not for display to the people whose content you classified.

The content you classify is untrusted, and some of it will try to talk to the model. OpenAI tested Safeguard 120B in chat settings for instructions that conflict with its system message; on prompt-injection hijacking it scored 0.728, against 0.780 for GPT-OSS 120B. That test isn't a classification task, but design for a label you can't trust blindly: validate the output and route anything odd to review.

How do you write a policy for GPT-OSS Safeguard?

Like a policy guide for human reviewers, not an essay. OpenAI and ROOST's prompting guide recommends four sections:⁴

1. Instructions: what the model must do and exactly how to answer.
2. Definitions: short explanations of the key terms.
3. Criteria: what violates the policy and what doesn't.
4. Examples: short cases near the line, on both sides of it.

Keep it short. The guide says the model gives reasonable output with policies of around 10,000 tokens, but early testing put the best range at 400 to 600 tokens. It advises against words like "generally" and "usually". It recommends an escalation path for unclear cases, and repeating the output format near the top and again before the examples.

Leave room for the reasoning. The guide recommends not capping output tokens tightly, and lowering the reasoning level instead when you need faster answers. The guide reports small but meaningful accuracy losses when you add policies to one prompt, so test before you combine them.

A worked example

Here is a short policy in that format for one of the most sensitive moderation jobs: people posting someone else's private information. Names, addresses and numbers in it are invented.

**Private Information Policy (#PI)**

## INSTRUCTIONS
Classify the CONTENT, a forum post or direct message, under this policy.
Return only a JSON object:
{"violation": 0 or 1, "policy_category": rule ID string or null, "escalate": true or false, "rationale": "one sentence"}

## DEFINITIONS
- Private information: a home address, personal phone number, personal email,
  government ID number, financial account number or precise current location.
- Private person: anyone who is not a public figure acting in a public role.
- Sharing: posting the information, or a direct way to find it, without consent.

## VIOLATES (1)
- PI1.a Sharing a private person's private information.
- PI1.b Asking others to find or post it.
- PI1.c Sharing it alongside a call to contact, visit or harass the person.

## SAFE (0)
- PI0.a Sharing your own contact details.
- PI0.b A business's own published address or phone number.
- PI0.c Discussing doxxing in general, with no one's details.
- PI0.d A city or region with no street-level detail.

## AMBIGUITY
If you cannot tell whose information it is, return "violation": 0,
"policy_category": null and "escalate": true. Otherwise "escalate" is false.
If several rules apply, report the most severe: PI1.c, then PI1.a, then PI1.b.

## EXAMPLES
Return only the JSON object described in INSTRUCTIONS.
- "DM me, my number is 555-0142."
  {"violation": 0, "policy_category": "PI0.a", "escalate": false,
   "rationale": "The poster shares their own number."}
- "The bakery's website lists 210 Main St, open till 6."
  {"violation": 0, "policy_category": "PI0.b", "escalate": false,
   "rationale": "A business's own published address."}
- "Anyone have Jordan's new home address? Post it here."
  {"violation": 1, "policy_category": "PI1.b", "escalate": false,
   "rationale": "Asks others to find and post a private person's address."}
- "Dana's new address is 14 Alder Ct, apt 3. Go tell her what you think."
  {"violation": 1, "policy_category": "PI1.c", "escalate": false,
   "rationale": "Shares a home address with a call to contact her."}

The content to classify:

found him. Marcus Reyes lives at 88 Birch Lane. go pay him a visit tonight

Under this policy it should be a violation of the most severe rule, PI1.c: a private person's home address, posted with a call to visit him. We ran this exact policy and content through GPT-OSS Safeguard 120B. We supplied the policy and the content together in one message in Maple Work. It returned:

{"violation":1,"policy_category":"PI1.c","escalate":false,"rationale":"Shares a private person's home address with a call to visit them."}

The label matches the policy, and the rationale names the rule's two parts. Its wording can vary from run to run.

The reasoning comes back separately, so a reviewer can see which rules the model weighed. Before you rely on a policy, run it against a few hundred posts your team has already labeled, and read the disagreements: they show where the policy is unclear or the model misreads it.

How do you use GPT-OSS Safeguard in Maple?

To try a policy by hand, choose GPT-OSS Safeguard in the Maple Work model picker and send the policy and the content together in one message, as in the run above. To classify content from your own code, use Maple Proxy.

Send the policy as the system message and the content as the user message, to the model gpt-oss-safeguard-120b. Maple Proxy is OpenAI-compatible, so the standard OpenAI SDK works. Set up the proxy and an API key with our getting-started guide, install the OpenAI Python package, and save the policy above as private-information-policy.md. Then:

import json
import os
from openai import OpenAI

client = OpenAI(
    base_url="http://127.0.0.1:8080/v1",  # Maple Proxy, or the URL shown in Maple
    api_key=os.environ["MAPLE_API_KEY"],
)

policy = open("private-information-policy.md").read()
content = "found him. Marcus Reyes lives at 88 Birch Lane. go pay him a visit tonight"

response = client.chat.completions.create(
    model="gpt-oss-safeguard-120b",
    reasoning_effort="medium",  # low, medium or high
    messages=[
        {"role": "system", "content": policy},
        {"role": "user", "content": content},
    ],
)

message = response.choices[0].message
reasoning = getattr(message, "reasoning", None)  # sensitive: for authorized reviewers, never end users

def valid(label):
    return (
        isinstance(label, dict)
        and label.get("violation") in (0, 1)
        and isinstance(label.get("escalate"), bool)
        and isinstance(label.get("rationale"), str)
        and (label.get("policy_category") is None or isinstance(label.get("policy_category"), str))
    )

try:
    label = json.loads(message.content)
except (TypeError, json.JSONDecodeError):
    label = None

if not valid(label) or label["escalate"]:
    print("Send to human review")  # unparseable, malformed or flagged for escalation
else:
    print(label)

The answer arrives in content and the reasoning in a separate reasoning field, as our API reference describes. Parsing is only the first check: anything malformed, and anything the model marks for escalation, goes to a person.

What to know before you build on it:

• Plans: In Maple Work it is on every plan. API access comes with Pro, Max and Team. Usage draws from your plan's usage first, then from any extra credits; per-token rates are on our pricing page.
• Context: 131,072 tokens, shared by the policy, the content, the reasoning and the answer.
• Reasoning: low, medium or high (medium if you leave it out); any other value is rejected with an error. Start at medium and drop to low for clear-cut, high-volume checks.
• No tool calls or images. It is a text classifier; check the Proxy model list for current capabilities.
• Not listed in Maple Chat. For conversation, use GPT-OSS 120B, which is in the picker on every plan.

What happens to the content you classify?

Think about what goes into a moderation pipeline: user reports, flagged direct messages, appeals, and the private information you're trying to catch. The content you classify is often your users' most sensitive text. A conventional hosted API typically processes it in a form the service can read, so its retention, access and training terms decide what happens next. Check those terms before you send it anything sensitive.

With Maple Proxy, the proxy runs next to your application. It verifies Maple's enclave and encrypts each request before it leaves your machine. Maple Work does the same from your desktop.

The model runs in its own attested enclave, and Maple's enclave verifies it before forwarding a prompt: you check Maple's enclave, and Maple's enclave checks the model's. The policy, the text you classify and the model's answer get the same protection as chats in the app. Our proof page explains the attestation you can check yourself.

The protection covers the contents of your requests: the policy, the text you classify and the model's answer. Our privacy notice covers everything else, such as account and billing records. It doesn't make the labels more accurate, and the traffic between your application and the proxy is plaintext. Keep the proxy on the same machine; if that traffic leaves it, protect it with TLS and a trusted network boundary.

Which route fits: 120B or 20B, self-hosted or Maple?

Start with size. We offer only the 120B. OpenAI says the 20B has 21B parameters, 3.6B active, fits in 16 GB of VRAM and is the choice for lower latency.² It scored a little lower than the 120B on OpenAI's multi-policy test and about the same on the two public sets.

Then pick a route:

A rough rule:

• Self-host the 20B if latency matters most. OpenAI says it fits in 16 GB of VRAM; test your context length and volume before sizing a server.
• Self-host the 120B if content must never leave hardware you run and you already operate 80 GB GPUs.
• Use Maple if you want the 120B without running the GPU, and without a host that can read what you classify: Maple Work to try policies by hand, Maple Proxy to call it from code.

Sources

1. OpenAI, “Introducing gpt-oss-safeguard”, October 29, 2025. Source for the release, research preview, license, inputs and outputs, examples, the four conditions where it performs best, the two limitations, Safety Reasoner and the ROOST collaboration.
2. OpenAI, gpt-oss-safeguard-120b and gpt-oss-safeguard-20b model cards on Hugging Face, with the usage policy. Source for the parameter counts, GPU fit, latency, license, the raw-reasoning guidance and the ROOST Model Community; file sizes from the repository listing.
3. Maple, model configuration for GPT-OSS Safeguard 120B, its reasoning levels, the API model list, plan access by model tier, API access by plan, and Maple Work's model picker, which lists the models from that API list at /v1/models. Source for availability in Maple Work and Maple Proxy, Maple Chat's model list, which leaves it out, the plans, the context window, text-only input without tool calls and the reasoning levels.
4. OpenAI and ROOST, “User guide for gpt-oss-safeguard”, OpenAI Cookbook. Source for the harmony format, the policy structure, policy length, output instructions and the chat-message pattern.
5. OpenAI Help Center, “OpenAI open-weight models (gpt-oss)”. Source for the models not being served in ChatGPT or the OpenAI API, and Safeguard working alongside a moderation API.
6. OpenAI, “Technical Report: Performance and baseline evaluations of gpt-oss-safeguard-120b and gpt-oss-safeguard-20b”, October 29, 2025. Source for the classification results, the recommended use, the instruction-hierarchy results and the hallucinated-reasoning caveat.