StepGuard is a step-level guard model for LLM agents that checks candidate tool actions before execution and can also audit completed trajectories. To train it, the authors developed StepGen, an automatic data engine that generates safe and unsafe trajectories sharing the same context but different actions at the risky step, and Balance-GRPO, which dynamically adjusts learning based on the accuracy gap between safe and unsafe actions. In static evaluations, StepGuard achieved the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4. When used to guard agents on AgentDojo and AgentDyn, it reduced the mean attack success rate by 77.3% relative to no guard, while mean utility dropped by only 2.8 percentage points. This work addresses the gap in pre-execution step-level monitoring and demonstrates a practical balance between safety and utility, reducing both over-defense and under-defense.
Step-level checks curb unsafe agent actions with little utility loss
StepGuard evaluates tool calls before execution and substantially reduced successful attacks on two agent-security benchmarks.
Top University
Zhijie Zheng · Yu Li · Chen Qian · Yuqian Fu · Yanwei Fu · Lu Sheng · +2 more
Shanghai Artificial Intelligence Laboratory · Beihang University · Fudan University · Renmin University of China · KAUST
Research Digest··2 min read
Thread:Agent Security & Attacks
In one line
StepGuard checks tool actions before execution and reduces attack success rate by 77.3% with only 2.8 percentage point utility drop.
Before you read this
Three ideas this paper builds onagent safetyRisks from AI agents including timing errors, shutdown avoidance, collusion, overclaiming, and unsafe execution, mitigated by constrained decoding, safety harnesses, and swarm governance.144 papers →runtime monitoringAudits an AI agent's live actions, internal states, or effects against constraints or policies to catch errors and attacks.107 papers →group relative policy optimizationA reinforcement learning method that optimizes policy by computing advantages based on group-level reward statistics.154 papers →
Read it as
The authors trained a guard model to identify risky actions at individual steps in an agent’s trajectory, including before a tool call is executed.
The authors developed StepGuard, a model that audits completed agent trajectories and screens proposed tool actions before execution.
The Daily Edition
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.