---
title: "StepGuard：面向智能体步骤级安全护栏的可扩展监督与安全效用平衡方法"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.24777v1"
permalink: "https://feed.astralor.com/items/itm_92ccb279d1c64337a506308d"
published: "2026-08-25T16:17:27.000Z"
score: 77
channel: "ai"
tags: ["AgentDojo","AgentDyn","Balance-GRPO","LLM智能体安全","StepGen","StepGuard"]
---

# StepGuard：面向智能体步骤级安全护栏的可扩展监督与安全效用平衡方法

## AI 点评

> 这篇论文最值得关注的地方是把护栏从'事后复盘'推进到'事前拦截'，而且用自动数据生成解决了步骤级监督的数据瓶颈。对正在做Agent安全防护的工程团队来说，StepGuard的77.3%攻击成功率降幅和2.8%效用损失组合很有参考价值，建议进一步看它与现有护栏系统的集成成本。

## 速览

LLM智能体通过工具调用与外部环境交互，但面临文件篡改、信息泄露等安全风险。现有护栏多评估完整轨迹，缺乏对步骤级动作执行前的监控。研究者提出StepGuard步骤级护栏模型，可审计已完成的智能体轨迹并在工具执行前检查动作。为训练该模型，设计了自动数据引擎StepGen生成同样上下文但风险步骤动作不同的安全与不安全轨迹，并提出Balance-GRPO在安全与不安全动作之间动态平衡学习。实验显示StepGuard在开放权重护栏模型中平均准确率最高，性能接近GPT-5.4；在AgentDojo和AgentDyn上使平均攻击成功率相对降低77.3%，而平均效用仅下降2.8个百分点。

## 关键点

- StepGuard是步骤级护栏模型，可审计已完成轨迹并在工具执行前检查动作，弥补现有轨迹级护栏的盲区。
- StepGen自动数据引擎可生成高风险步骤处动作不同而上下文相同的安全/不安全轨迹，提供可扩展训练数据。
- Balance-GRPO算法通过对安全与不安全动作的观测准确率动态平衡学习，降低过度防御与防御不足。
- 在AgentDojo和AgentDyn基准上，StepGuard使平均攻击成功率相对降低77.3%，平均效用仅下降2.8个百分点。

## 全文

LLM-based agents can interact with external environments through tool invocation, but this capability also introduces security risks such as file modification, information leakage, and unauthorized actions. Existing guardrails often evaluate completed trajectories, leaving pre-execution monitoring of step-level actions underexplored. We propose StepGuard, a step-level guard model that can audit completed agent trajectories and check tool actions before they are executed. To train StepGuard, we introduce StepGen, an automatic data engine that generates safe and unsafe trajectories with the same context but different actions at the risky step. To further reduce over-defense and under-defense, we propose Balance-GRPO, which dynamically balances learning between safe and unsafe actions based on their observed accuracy. Experiments show that StepGuard achieves the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4. When used to guard agents on AgentDojo and AgentDyn, StepGuard reduces mean attack success rate by 77.3% relative to the no-guard setting, while mean utility drops by only 2.8 percentage points.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_92ccb279d1c64337a506308d