---
title: "StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.24777v1"
permalink: "https://feed.astralor.com/items/itm_92ccb279d1c64337a506308d"
published: "2026-08-25T16:17:27.000Z"
score: 77
channel: "ai"
tags: ["AgentDojo","AgentDyn","Balance-GRPO","LLM Agent Safety","StepGen","StepGuard"]
---

# StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing

## AI commentary

> The most noteworthy aspect of this paper is advancing guardrails from 'post-hoc review' to 'pre-execution interception,' using automatic data generation to solve the step-level supervision bottleneck. For engineering teams working on agent safety, StepGuard's combination of a 77.3% attack success rate reduction and 2.8% utility loss is highly informative; it's worth further examining integration costs with existing guardrail systems.

## At a glance

LLM-based agents interact with external environments through tool invocation but face security risks such as file modification, information leakage, and unauthorized actions. Existing guardrails often evaluate completed trajectories, leaving step-level pre-execution monitoring underexplored. The authors propose StepGuard, a step-level guard model that audits completed agent trajectories and checks tool actions before execution. They introduce StepGen, an automatic data engine that generates safe and unsafe trajectories with the same context but different actions at the risky step, and Balance-GRPO, which dynamically balances learning between safe and unsafe actions based on observed accuracy. Experiments show StepGuard achieves the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4. When guarding agents on AgentDojo and AgentDyn, StepGuard reduces mean attack success rate by 77.3% relative to the no-guard setting, while mean utility drops by only 2.8 percentage points.

## Key points

- StepGuard is a step-level guard model that audits completed trajectories and checks tool actions before execution, filling the gap left by trajectory-level guardrails.
- StepGen, an automatic data engine, generates safe and unsafe trajectories sharing the same context but differing actions at risky steps, enabling scalable supervision.
- Balance-GRPO dynamically balances learning between safe and unsafe actions based on observed accuracy, reducing over-defense and under-defense.
- On AgentDojo and AgentDyn benchmarks, StepGuard reduces the mean attack success rate by 77.3% relative to the no-guard setting while mean utility drops by only 2.8 percentage points.

## Full text

LLM-based agents can interact with external environments through tool invocation, but this capability also introduces security risks such as file modification, information leakage, and unauthorized actions. Existing guardrails often evaluate completed trajectories, leaving pre-execution monitoring of step-level actions underexplored. We propose StepGuard, a step-level guard model that can audit completed agent trajectories and check tool actions before they are executed. To train StepGuard, we introduce StepGen, an automatic data engine that generates safe and unsafe trajectories with the same context but different actions at the risky step. To further reduce over-defense and under-defense, we propose Balance-GRPO, which dynamically balances learning between safe and unsafe actions based on their observed accuracy. Experiments show that StepGuard achieves the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4. When used to guard agents on AgentDojo and AgentDyn, StepGuard reduces mean attack success rate by 77.3% relative to the no-guard setting, while mean utility drops by only 2.8 percentage points.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_92ccb279d1c64337a506308d