StepGuard introduces a step-level guard model that audits and checks tool actions before execution, addressing security risks in LLM-based agents. It is trained using StepGen, an automatic engine that generates safe and unsafe trajectories, and employs Balance-GRPO to dynamically balance learning between safe and unsafe actions. Experiments show StepGuard achieves high accuracy comparable to GPT-5.4 and significantly reduces attack success rates while minimally impacting utility.
Agent harnesses require a low-latency guardrail model together with customizable audit policies. However, deploying an auto-regressive guardrail model remains challenging: such models incur high infer...
arXiv:2609.14987v1 Announce Type: cross Abstract: Large language model (LLM) agents interact with external environments through tool invocation, but tool outputs can also expose them to indirect prom...
arXiv:2609.35807v1 Announce Type: cross Abstract: LLM agents can make unsafe tool calls even when instructed to behave safely. Existing defenses constrain agents before execution, modify tool inputs/...
arXiv:2609.00015v1 Announce Type: new Abstract: AI agents powered by large language models are evolving from isolated assistants into heterogeneous systems in which multiple agents, planners, control...
arXiv:2609.22724v1 Announce Type: cross Abstract: Mobile agents powered by foundation models now automate complex, multi-step workflows on real devices, but their trajectories can violate app-specifi...
Guard models are used to prevent LLM agents from performing forbidden actions, but this alone does not guarantee safety. The paper shows that many agent trajectories contain unfulfilled safety‑critical obligations—actions that should have been performed—highlighting a new source of risk. To address this, the authors introduce ObligationBench, a benchmark of 240 expert‑validated trajectories, and develop ObligationGuard, a model that improves obligation detection recall and exact‑match rates over existing models.
VEPA is a framework that enables the verified evolution of formal guardrails for lifelong large language model agents. It represents guardrails as formal policies of symbolic rules over typed agent events, and during deployment uses LLM‑guided feedback to propose policy patches that fix new failures while preserving correct behavior. A deterministic verifier accepts only structurally valid, conflict‑free policies, and an evidence‑aware authority layer activates verified rules only when sufficient supporting evidence exists, ensuring that uncertain updates do not directly affect guardrail decisions.
arXiv:2606. 05805v1 Announce Type: new Abstract: LLM-based guardrails typically safeguard agents by evaluating proposed actions or inputs before execution, producing safety signals such as binary allow/deny decisions, risk categories, and/or explanatory rationales about potential policy violations.
arXiv:2608. 05695v1 Announce Type: new Abstract: As large language model (LLM) agents increasingly invoke external tools and interact with real-world systems, unsafe actions may cause irreversible consequences on external states, user data, and downstream services.
arXiv:2606. 07054v1 Announce Type: cross Abstract: Autonomous LLM agents can pursue hidden malicious objectives through sequences of individually benign actions, making sabotage difficult to detect using standard trajectory-level monitoring.
MAS-Guard is a unified framework designed to safeguard both single- and multi-agent large language model (LLM) systems. It introduces a local Agent Guardrail (A-Guard) layer that uses task-specific experts to evaluate agentic events, and a system-level Control Plane that applies deterministic structural checks and semantic assessments to routes, capabilities, and message content. The framework enforces interventions—allow, reflection, confirmation, and block—across benchmarks, reducing attack success rates by 71.5‑86.3% while maintaining utility on benign tasks.
arXiv:2609.15134v1 Announce Type: new Abstract: Computer-use agents increasingly interact with browsers, terminals, file systems, and external services, introducing safety risks that emerge through r...