Classifiers are policy enforced by the process serving the model.

Input classifiers get applied before it reaches the model so somebody hacking an open-weight model would skip this. Streaming classifiers get polled during decoding; hackers delete this check in the sampling loop.

But both are always applied in closed weight models.

Set Llama Guard to 1.0 and nothing is ever unsafe.