Fixed guard today is not very fixed. For ex, the safeguard qwen released is a full 4b llm model. It has no different to normal llm model arch except tuned for this specific purpose,

So it is tuned specifically to classify content for safeguarding? I'm not familiar with this particular model, but it most likely has a specific classifier head that is tuned for the safeguard task. This is completely different to zero-shot classification.