  As LLMs become increasingly prevalent across various applications, it is
critical to establish safety guardrails to moderate input/output content of
LLMs. Existing guardrail models treat various safety categories independently
and fail to explicitly capture the intercorrelations among them. This has led
to limitations such as ineffectiveness due to inadequate training on long-tail
data from correlated safety categories, susceptibility to jailbreaking attacks,
and inflexibility regarding new safety categories. To address these
limitations, we propose $R^2$-Guard, a robust reasoning enabled LLM guardrail
via knowledge-enhanced logical reasoning. Specifically, $R^2$-Guard comprises
two parts: data-driven category-specific learning and reasoning components. The
data-driven guardrail models provide unsafety probabilities of moderated
content on different safety categories. We then encode safety knowledge among
different categories as first-order logical rules and embed them into a
probabilistic graphic model (PGM) based reasoning component. The unsafety
probabilities of different categories from data-driven guardrail models are
sent to the reasoning component for final inference. We employ two types of
PGMs: Markov logic networks (MLNs) and probabilistic circuits (PCs), and
optimize PCs to achieve precision-efficiency balance via improved graph
structure. To further perform stress tests for guardrail models, we employ a
pairwise construction method to construct a new safety benchmark TwinSafety,
which features principled categories. We demonstrate the effectiveness of
$R^2$-Guard by comparisons with eight strong guardrail models on six safety
benchmarks, and demonstrate the robustness of $R^2$-Guard against four SOTA
jailbreaking attacks. $R^2$-Guard significantly surpasses SOTA method
LlamaGuard by 30.2% on ToxicChat and by 59.5% against jailbreaking attacks.
