StepGuard：可扩展监督与安全-效用平衡下的步骤级护栏学习

摘要

基于大语言模型的智能体可以通过工具调用与外部环境交互，但这种能力也带来了文件修改、信息泄露和未授权操作等安全风险。现有的防护机制通常评估已完成的轨迹，对步骤级动作的执行前监控则探索不足。我们提出StepGuard，一种步骤级防护模型，能够审计已完成的智能体轨迹，并在工具动作执行前对其进行检查。为训练StepGuard，我们引入了StepGen，一个自动数据引擎，可在风险步骤处生成上下文相同但动作不同的安全与不安全轨迹。为进一步减少过度防御和防御不足，我们提出Balance-GRPO，根据安全与不安全动作的观测准确率动态平衡两者的学习。实验表明，StepGuard在开放权重防护模型中取得了最高的平均准确率，性能与GPT-5.4相当。在AgentDojo和AgentDyn上用于保护智能体时，与无防护设置相比，StepGuard将平均攻击成功率降低了77.3%，而平均效用仅下降2.8个百分点。

English

LLM-based agents can interact with external environments through tool invocation, but this capability also introduces security risks such as file modification, information leakage, and unauthorized actions. Existing guardrails often evaluate completed trajectories, leaving pre-execution monitoring of step-level actions underexplored. We propose StepGuard, a step-level guard model that can audit completed agent trajectories and check tool actions before they are executed. To train StepGuard, we introduce StepGen, an automatic data engine that generates safe and unsafe trajectories with the same context but different actions at the risky step. To further reduce over-defense and under-defense, we propose Balance-GRPO, which dynamically balances learning between safe and unsafe actions based on their observed accuracy. Experiments show that StepGuard achieves the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4. When used to guard agents on AgentDojo and AgentDyn, StepGuard reduces mean attack success rate by 77.3% relative to the no-guard setting, while mean utility drops by only 2.8 percentage points.