AprielGuard

🕒 Published (v1): 2025-12-23 12:01 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

AprielGuard is an 8B parameter guardrail model that unifies safety risk detection (toxicity, bias, etc.) and adversarial attack detection (jailbreaks, prompt injections) under a single taxonomy and inference call. It is trained on ~327k synthetic samples spanning standalone prompts, multi-turn conversations, and agentic workflows augmented with structured chain-of-thought reasoning traces. On both standard safety benchmarks and a proprietary agentic jailbreak benchmark, it outperforms same-size open-source guardrails including Llama-Guard-3-8B and Granite Guardian variants.

Problem

Existing moderation tools treat safety risks and adversarial threats as orthogonal problems requiring separate models and inference passes; they are also designed for single-turn interactions and break down on multi-step agentic trajectories involving tool calls, API invocations, and inter-agent communications where attack surfaces include reasoning chains and planning states rather than just user utterances. Additionally, many guardrail models are trained on closed-model synthetic data under non-permissive licenses.

Method

Taxonomy: Combines a 16-category SALAD-Data safety taxonomy with a custom adversarial attacks taxonomy, enabling joint binary classification (safe/unsafe × adversarial/non-adversarial) in a single forward pass.

Data pipeline: Fully synthetic dataset generated by Mixtral-8x7B and internal uncensored models (temperature-elevated), deduplicated via semantic embedding similarity (threshold 0.7) and ROUGE-L syntactic similarity (threshold 0.9), and augmented with character noise, leetspeak, paraphrase, and syntactic reordering. Data covers three content formats: standalone prompts, conversational (single/multi-turn), and agentic workflows (tool traces, execution logs up to 32k tokens).

Reasoning annotation: A secondary LLM pipeline generates structured reasoning for each sample using 8 prompt templates conditioned on (safe/unsafe × adversarial/non-adversarial × conversational/standalone), outputting <reasoning>...</reasoning> plus <result>...</result> tags, validated for format alignment with ground truth.

Model: Supervised fine-tuning of a downscaled Apriel-1.5-15B-Thinker base (8B params) using a custom chat template with a <|content|> role tag; trains for 3 epochs, batch size 1 with 8-step gradient accumulation, lr 2×10⁻⁴, Adam. Two inference modes: with reasoning (multi-step structured output) and without reasoning (compact two-line output).

Key Contributions

• Unified single-model, single-inference taxonomy covering both safety risks and adversarial attacks across all interaction modalities including agentic workflows.
• Synthetic training corpus of ~327k samples with semantic/syntactic deduplication and augmentation, released under a permissive license.
• Structured reasoning annotation pipeline producing interpretable, category-aware explanations.
• Internal proprietary agentic jailbreak benchmark (~4,326 samples) targeting attack vectors at planning, reasoning, tool-parameter, memory, and inter-agent communication stages.

Results

• Aggregate safety benchmarks (11 datasets, 44,699 samples): AprielGuard-8B without reasoning achieves F1=0.88 (safety) and F1=0.93 (adversarial) vs. best open-source baseline GG-3.3-8B at F1=0.87/0.87; with reasoning, AprielGuard-8B achieves F1=0.87/0.92 vs. GG-3.3-8B F1=0.86/0.79 and gpt-oss-safeguard-20B (2.5× larger) F1=0.85/0.61.
• Agentic workflow benchmark: AprielGuard-8B without reasoning achieves F1=0.86 (safety) and F1=0.95 (adversarial), vs. best baselines GG-3.2-5B F1=0.71/0.77; with reasoning, AprielGuard-8B F1=0.80/0.91 vs. GG-3.3-8B F1=0.37/0.28 and gpt-oss-20B F1=0.62/0.32 — the largest margin is on the agentic benchmark.
• Multilingual: F1 performance consistent at ~86–93% across English, German, Spanish, French, Italian, Japanese, Dutch, Portuguese (Brazilian), and Chinese (Figure 3).
• FPR on agentic benchmark: AprielGuard-8B achieves FPR=0.02 for both safety and adversarial vs. GG-3.2-5B FPR=0.83/0.90.

Limitations

• Training data is entirely synthetic; distribution may diverge from real-world adversarial prompt distributions.
• Proprietary agentic benchmark is not publicly released, limiting external reproducibility for that evaluation.
• Taxonomy alignment across heterogeneous public benchmarks required collapsing to binary labels, masking fine-grained category-level comparisons.
• 8B parameter size with 32k context may be too resource-intensive for edge deployments.
• Evaluation of multilingual adversarial attacks is not shown (only safety risks in Figure 3).

Relevance to Harnesses / Meta-Harnesses

AprielGuard is directly deployable as a safety gate within multi-agent harnesses and meta-harnesses: its ability to ingest full agentic trajectories—tool calls, execution traces, inter-agent messages—as a single <|content|> block and return joint safety/adversarial verdicts makes it a drop-in moderation layer for orchestration frameworks. The paper's agentic jailbreak benchmark, which targets attack vectors at planning, reasoning, and inter-agent communication stages, maps directly to the threat model faced by systems that chain LLM agents through APIs and tool registries. The with-reasoning output mode provides auditable traces useful for harness-level logging, policy compliance, and adaptive routing (e.g., escalating flagged trajectories to human review). For meta-harness designers, AprielGuard's single-model unification eliminates the latency and complexity of running separate safety and adversarial guardrail passes at each step of a workflow.