Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

AgentDoG: A Diagnostic Guardrail Framework for AI Agent Safety and Security

Dongrui Liu, Qihan Ren, Chen Qian, Shuai Shao, Yuejin Xie, Yu Li, Zhonghao Yang, Haoyu Luo, Peng Wang, Qingyu Liu, Binxin Hu, Ling Tang, Jilin Mei, Dadi Guo, Leitao Yuan, Junyao Yang, Guanxu Chen, Qihao Lin, Yi Yu, Bo Zhang, Jiaxuan Guo, Jie Zhang, Wenqi Shao, Huiqi Deng, Zhiheng Xi, Wenjie Wang, Wenxuan Wang, Wen Shen, Zhikai Chen, Haoyu Xie, Jialing Tao, Juntao Dai, Jiaming Ji, Zhongjie Ba, Linfeng Zhang, Yong Liu, Quanshi Zhang, Lei Zhu, Zhihua Wei, Hui Xue, Chaochao Lu, Jing Shao, Xia Hu

TL;DR

AgentDoG introduces a unified three-dimensional safety taxonomy (risk source, failure mode, real-world harm) to capture agentic risks in tool-augmented AI. It pairs this taxonomy with a diagnostic guardrail that monitors trajectories and provides root-cause diagnostics, moving beyond binary safety labels. The authors release a large-scale synthetic dataset and ATBench, and train multiple AgentDoG variants across Qwen and Llama families, reporting state-of-the-art trajectory-level safety moderation and fine-grained risk attribution. The work enables more transparent, accountable, and alignable agentic systems, while acknowledging limitations such as text-only inputs and the potential for multimodal extensions and reinforcement learning-based alignment in the future.

Abstract

The rise of AI agents introduces complex safety and security challenges arising from autonomous tool use and environmental interactions. Current guardrail models lack agentic risk awareness and transparency in risk diagnosis. To introduce an agentic guardrail that covers complex and numerous risky behaviors, we first propose a unified three-dimensional taxonomy that orthogonally categorizes agentic risks by their source (where), failure mode (how), and consequence (what). Guided by this structured and hierarchical taxonomy, we introduce a new fine-grained agentic safety benchmark (ATBench) and a Diagnostic Guardrail framework for agent safety and security (AgentDoG). AgentDoG provides fine-grained and contextual monitoring across agent trajectories. More Crucially, AgentDoG can diagnose the root causes of unsafe actions and seemingly safe but unreasonable actions, offering provenance and transparency beyond binary labels to facilitate effective agent alignment. AgentDoG variants are available in three sizes (4B, 7B, and 8B parameters) across Qwen and Llama model families. Extensive experimental results demonstrate that AgentDoG achieves state-of-the-art performance in agentic safety moderation in diverse and complex interactive scenarios. All models and datasets are openly released.

AgentDoG: A Diagnostic Guardrail Framework for AI Agent Safety and Security

TL;DR

AgentDoG introduces a unified three-dimensional safety taxonomy (risk source, failure mode, real-world harm) to capture agentic risks in tool-augmented AI. It pairs this taxonomy with a diagnostic guardrail that monitors trajectories and provides root-cause diagnostics, moving beyond binary safety labels. The authors release a large-scale synthetic dataset and ATBench, and train multiple AgentDoG variants across Qwen and Llama families, reporting state-of-the-art trajectory-level safety moderation and fine-grained risk attribution. The work enables more transparent, accountable, and alignable agentic systems, while acknowledging limitations such as text-only inputs and the potential for multimodal extensions and reinforcement learning-based alignment in the future.

Abstract

The rise of AI agents introduces complex safety and security challenges arising from autonomous tool use and environmental interactions. Current guardrail models lack agentic risk awareness and transparency in risk diagnosis. To introduce an agentic guardrail that covers complex and numerous risky behaviors, we first propose a unified three-dimensional taxonomy that orthogonally categorizes agentic risks by their source (where), failure mode (how), and consequence (what). Guided by this structured and hierarchical taxonomy, we introduce a new fine-grained agentic safety benchmark (ATBench) and a Diagnostic Guardrail framework for agent safety and security (AgentDoG). AgentDoG provides fine-grained and contextual monitoring across agent trajectories. More Crucially, AgentDoG can diagnose the root causes of unsafe actions and seemingly safe but unreasonable actions, offering provenance and transparency beyond binary labels to facilitate effective agent alignment. AgentDoG variants are available in three sizes (4B, 7B, and 8B parameters) across Qwen and Llama model families. Extensive experimental results demonstrate that AgentDoG achieves state-of-the-art performance in agentic safety moderation in diverse and complex interactive scenarios. All models and datasets are openly released.
Paper Structure (72 sections, 8 equations, 26 figures, 5 tables)

This paper contains 72 sections, 8 equations, 26 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Safety Taxonomy
  3. Risk Source
  4. Failure Mode
  5. Real-world Harm
  6. AgentDoG
  7. Task Definition
  8. Trajectory-level safety evaluation.
  9. Fine-grained risk diagnosis.
  10. Prompting.
  11. Data Synthesis and Collection
  12. Data Synthesis Pipeline
  13. Execution initialization and tool interaction simulation.
  14. Agent response generation under safety constraints.
  15. Outcome summarization and trajectory assembly.
  16. ...and 57 more sections

Figures (26)

  • Figure 1: Accuracy(%) of AgentDoG and existing general and guardrail models. The first row reports binary safety classification results on three benchmark datasets, while the second row shows results on the fine-grained safety classification ATBench.
  • Figure 2: Overview of the three orthogonal dimensions of the agentic safety taxonomy.
  • Figure 3: Example task instructions for the AgentDoG classification tasks. A task consists of four main components. AgentDoG is trained on producing the desired result in the output format described in the instructions.
  • Figure 4: Three-stage, planner-based pipeline for multi-step agent safety trajectory synthesis.
  • Figure 5: Distribution of synthesized training data across the three taxonomy dimensions: risk source (8 categories), failure mode (14 categories), and real-world harm (10 categories).
  • ...and 21 more figures