LLM-based agents can interact with external environments through tool invocation, but this capability also introduces security risks such as file modification, information leakage, and unauthorized actions. Existing guardrails often evaluate completed trajectories, leaving pre-execution monitoring of step-level actions underexplored. We propose StepGuard, a step-level guard model that can audit completed agent trajectories and check tool actions before they are executed. To train StepGuard, we introduce StepGen, an automatic data engine that generates safe and unsafe trajectories with the same context but different actions at the risky step. To further reduce over-defense and under-defense, we propose Balance-GRPO, which dynamically balances learning between safe and unsafe actions based on their observed accuracy. Experiments show that StepGuard achieves the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4. When used to guard agents on AgentDojo and AgentDyn, StepGuard reduces mean attack success rate by 77.3% relative to the no-guard setting, while mean utility drops by only 2.8 percentage points.</p>\n<p>🧑💻 Code: <a href=\"https://github.com/zheng977/StepGuard\" rel=\"nofollow\">https://github.com/zheng977/StepGuard</a><br>🤗 Weight: <a href=\"https://huggingface.co/ninty-seven/StepGuard\">https://huggingface.co/ninty-seven/StepGuard</a></p>\n","updatedAt":"2026-08-31T02:34:14.252Z","author":{"_id":"68f59ae49315a06ad9a01464","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/68f59ae49315a06ad9a01464/welpgtUr6TY9Qa7nPBigg.jpeg","fullname":"Sean Yu","name":"yushaohan","type":"user","isPro":false,"isHf":false,"isHfAdmin":false,"isMod":false,"followerCount":2,"isUserFollowing":false}},"numEdits":0,"identifiedLanguage":{"language":"en","probability":0.9169273376464844},"editors":["yushaohan"],"editorAvatarUrls":["https://cdn-avatars.huggingface.co/v1/production/uploads/68f59ae49315a06ad9a01464/welpgtUr6TY9Qa7nPBigg.jpeg"],"reactions":[],"isReport":false}}],"primaryEmailConfirmed":false,"paper":{"id":"2608.24777","authors":[{"_id":"6a8eb0b75673886739f19899","user":{"_id":"6760d7f2899f4731eb9ce817","avatarUrl":"/avatars/ef2bcf819e06c5ab1d1941bf6793fcb0.svg","isPro":false,"fullname":"Zhijie-Zheng","user":"ninty-seven","type":"user","name":"ninty-seven"},"name":"Zhijie Zheng","status":"claimed_verified","statusLastChangedAt":"2026-08-26T16:45:04.578Z","hidden":false},{"_id":"6a8eb0b75673886739f1989a","name":"Yu Li","hidden":false},{"_id":"6a8eb0b75673886739f1989b","name":"Chen Qian","hidden":false},{"_id":"6a8eb0b75673886739f1989c","name":"Yuqian Fu","hidden":false},{"_id":"6a8eb0b75673886739f1989d","name":"Yanwei Fu","hidden":false},{"_id":"6a8eb0b75673886739f1989e","name":"Lu Sheng","hidden":false},{"_id":"6a8eb0b75673886739f1989f","name":"Jing Shao","hidden":false},{"_id":"6a8eb0b75673886739f198a0","name":"Dongrui Liu","hidden":false}],"publishedAt":"2026-08-25T00:00:00.000Z","submittedOnDailyAt":"2026-08-31T00:00:00.000Z","title":"StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing","submittedOnDailyBy":{"_id":"68f59ae49315a06ad9a01464","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/68f59ae49315a06ad9a01464/welpgtUr6TY9Qa7nPBigg.jpeg","isPro":false,"fullname":"Sean Yu","user":"yushaohan","type":"user","name":"yushaohan"},"summary":"LLM-based agents can interact with external environments through tool invocation, but this capability also introduces security risks such as file modification, information leakage, and unauthorized actions. Existing guardrails often evaluate completed trajectories, leaving pre-execution monitoring of step-level actions underexplored. We propose StepGuard, a step-level guard model that can audit completed agent trajectories and check tool actions before they are executed. To train StepGuard, we introduce StepGen, an automatic data engine that generates safe and unsafe trajectories with the same context but different actions at the risky step. To further reduce over-defense and under-defense, we propose Balance-GRPO, which dynamically balances learning between safe and unsafe actions based on their observed accuracy. Experiments show that StepGuard achieves the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4. When used to guard agents on AgentDojo and AgentDyn, StepGuard reduces mean attack success rate by 77.3% relative to the no-guard setting, while mean utility drops by only 2.8 percentage points.","upvotes":13,"discussionId":"6a8eb0b75673886739f198a1","projectPage":"https://zheng977.github.io/StepGuard/","githubRepo":"https://github.com/zheng977/StepGuard","githubRepoAddedBy":"user","ai_summary":"StepGuard is a step-level guard model that audits agent actions before execution, trained via automatic trajectory generation and balanced reinforcement learning to reduce attacks with minimal utility loss.","ai_keywords":["LLM-based agents","tool invocation","step-level guard model","StepGen","Balance-GRPO","AgentDojo","AgentDyn"],"ai_summary_model":"thinkingmachines/Inkling-Small","githubStars":3,"organization":{"_id":"68f716f832b31e42cbc2be7f","name":"AI45Research","fullname":"AI45Research","avatar":"https://cdn-avatars.huggingface.co/v1/production/uploads/68f6ffaa04d1019724af41fc/EVBafPHXvChszTM5tJcc9.png"}},"canReadDatabase":false,"canManagePapers":false,"canSubmit":false,"hasHfLevelAccess":false,"upvoted":false,"upvoters":[{"_id":"63ac5701c21e60a3e9b58aa7","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/63ac5701c21e60a3e9b58aa7/g6EX7diOpuA94R2ab-rZC.png","isPro":true,"fullname":"Dipankar Sarkar","user":"dipankarsarkar","type":"user"},{"_id":"68f59ae49315a06ad9a01464","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/68f59ae49315a06ad9a01464/welpgtUr6TY9Qa7nPBigg.jpeg","isPro":false,"fullname":"Sean Yu","user":"yushaohan","type":"user"},{"_id":"6889daeb27c7ea270dfbe673","avatarUrl":"/avatars/48814315eb39d57269cf8e250124245a.svg","isPro":false,"fullname":"beingbetter111643","user":"beingbetter11643","type":"user"},{"_id":"67f01286fcdc4fce387f1de5","avatarUrl":"/avatars/7fcbb3600a9ace264c981875201b65fe.svg","isPro":false,"fullname":"YU LI","user":"YuLillll","type":"user"},{"_id":"6621f4eb64e84619e578aad6","avatarUrl":"/avatars/b1ad96ee354b999fcafb2998a636609c.svg","isPro":false,"fullname":"Dongrui Liu","user":"shenqiorient","type":"user"},{"_id":"682ec448c535da18b9a7d861","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/no-auth/5uynjdsbZFRucN0t7Ek09.png","isPro":false,"fullname":"machine not learning","user":"titanwings","type":"user"},{"_id":"68b4286d2511563aba883bf4","avatarUrl":"/avatars/694b76207ed8483c297bd1427d724761.svg","isPro":false,"fullname":"Qihao Lin","user":"lqh201106","type":"user"},{"_id":"6760d7f2899f4731eb9ce817","avatarUrl":"/avatars/ef2bcf819e06c5ab1d1941bf6793fcb0.svg","isPro":false,"fullname":"Zhijie-Zheng","user":"ninty-seven","type":"user"},{"_id":"6a1068b90cdd06c3950844dd","avatarUrl":"/avatars/e231a2ffe54e7e0c200663e636c70900.svg","isPro":false,"fullname":"Li","user":"Brr2","type":"user"},{"_id":"620783f24e28382272337ba4","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/620783f24e28382272337ba4/zkUveQPNiDfYjgGhuFErj.jpeg","isPro":false,"fullname":"GuoLiangTang","user":"Tommy930","type":"user"},{"_id":"6989f8c5a326a5d5492e5292","avatarUrl":"/avatars/c9e7e0537712bed0279cca008125bd21.svg","isPro":false,"fullname":"EileenLiang","user":"Eileen12345","type":"user"},{"_id":"646ac89935c7a57f936c2f78","avatarUrl":"/avatars/e0dda4a67a5971ac745fcf0cc9f16e06.svg","isPro":false,"fullname":"Guo Dadi","user":"guodadi","type":"user"}],"acceptLanguages":["en"],"dailyPaperRank":0,"organization":{"_id":"68f716f832b31e42cbc2be7f","name":"AI45Research","fullname":"AI45Research","avatar":"https://cdn-avatars.huggingface.co/v1/production/uploads/68f6ffaa04d1019724af41fc/EVBafPHXvChszTM5tJcc9.png"},"markdownContentUrl":"https://huggingface.co/buckets/huggingchat/papers-content/resolve/2608/2608.24777.md","query":{}}">
StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing
Abstract
StepGuard is a step-level guard model that audits agent actions before execution, trained via automatic trajectory generation and balanced reinforcement learning to reduce attacks with minimal utility loss.
LLM-based agents can interact with external environments through tool invocation, but this capability also introduces security risks such as file modification, information leakage, and unauthorized actions. Existing guardrails often evaluate completed trajectories, leaving pre-execution monitoring of step-level actions underexplored. We propose StepGuard, a step-level guard model that can audit completed agent trajectories and check tool actions before they are executed. To train StepGuard, we introduce StepGen, an automatic data engine that generates safe and unsafe trajectories with the same context but different actions at the risky step. To further reduce over-defense and under-defense, we propose Balance-GRPO, which dynamically balances learning between safe and unsafe actions based on their observed accuracy. Experiments show that StepGuard achieves the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4. When used to guard agents on AgentDojo and AgentDyn, StepGuard reduces mean attack success rate by 77.3% relative to the no-guard setting, while mean utility drops by only 2.8 percentage points.
Community
LLM-based agents can interact with external environments through tool invocation, but this capability also introduces security risks such as file modification, information leakage, and unauthorized actions. Existing guardrails often evaluate completed trajectories, leaving pre-execution monitoring of step-level actions underexplored. We propose StepGuard, a step-level guard model that can audit completed agent trajectories and check tool actions before they are executed. To train StepGuard, we introduce StepGen, an automatic data engine that generates safe and unsafe trajectories with the same context but different actions at the risky step. To further reduce over-defense and under-defense, we propose Balance-GRPO, which dynamically balances learning between safe and unsafe actions based on their observed accuracy. Experiments show that StepGuard achieves the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4. When used to guard agents on AgentDojo and AgentDyn, StepGuard reduces mean attack success rate by 77.3% relative to the no-guard setting, while mean utility drops by only 2.8 percentage points.
🧑💻 Code: https://github.com/zheng977/StepGuard
🤗 Weight: https://huggingface.co/ninty-seven/StepGuard
Upload images, audio, and videos by dragging in the text input, pasting, or clicking here.
Tap or paste here to upload images
Cite arxiv.org/abs/2608.24777 in a dataset README.md to link it from this page.
Cite arxiv.org/abs/2608.24777 in a Space README.md to link it from this page.
Discussion (0)
Sign in to join the discussion. Free account, 30 seconds — email code or GitHub.
Sign in →No comments yet. Sign in and be the first to say something.