R²-Guard is a robust reasoning-enabled LLM guardrail that uses knowledge-enhanced logical reasoning to improve safety and effectiveness. Existing guardrail models, such as OpenAI Mod and LlamaGuard, fail to capture the intercorrelations among safety categories, leading to limitations in effectiveness, susceptibility to jailbreak attacks, and inflexibility regarding new categories. R²-Guard addresses these issues by combining data-driven category-specific learning with knowledge-enhanced logical reasoning. It encodes safety knowledge as first-order logical rules and embeds them into probabilistic graphical models (PGMs) for reasoning. Two types of PGMs, Markov logic networks (MLNs) and probabilistic circuits (PCs), are used, with PCs optimized for precision-efficiency balance. R²-Guard also optimizes knowledge weights through pseudo-learning and real-learning methods. A new safety benchmark, TwinSafety, is introduced to stress-test guardrail models, featuring principled categories and new challenges. R²-Guard outperforms existing models on multiple safety benchmarks and demonstrates robustness against jailbreak attacks. It can adapt to new safety categories by modifying the reasoning graph. R²-Guard is effective, robust, and flexible, making it a strong candidate for LLM guardrails.R²-Guard is a robust reasoning-enabled LLM guardrail that uses knowledge-enhanced logical reasoning to improve safety and effectiveness. Existing guardrail models, such as OpenAI Mod and LlamaGuard, fail to capture the intercorrelations among safety categories, leading to limitations in effectiveness, susceptibility to jailbreak attacks, and inflexibility regarding new categories. R²-Guard addresses these issues by combining data-driven category-specific learning with knowledge-enhanced logical reasoning. It encodes safety knowledge as first-order logical rules and embeds them into probabilistic graphical models (PGMs) for reasoning. Two types of PGMs, Markov logic networks (MLNs) and probabilistic circuits (PCs), are used, with PCs optimized for precision-efficiency balance. R²-Guard also optimizes knowledge weights through pseudo-learning and real-learning methods. A new safety benchmark, TwinSafety, is introduced to stress-test guardrail models, featuring principled categories and new challenges. R²-Guard outperforms existing models on multiple safety benchmarks and demonstrates robustness against jailbreak attacks. It can adapt to new safety categories by modifying the reasoning graph. R²-Guard is effective, robust, and flexible, making it a strong candidate for LLM guardrails.