StepGuard vets agent tool calls pre-execution, cuts attacks 77.3%

StepGuard, a new open-weight guard model, reduces the mean attack success rate against LLM-based agents by 77.3% while cutting mean utility by only 2.8 percentage points, according to a paper posted to arXiv by Zhijie Zheng, Yu Li, Dongrui Liu and co-authors.

The approach flips the usual defense pattern. Rather than auditing completed agent trajectories after the fact, StepGuard vets each tool action before it runs. "Existing guardrails often evaluate completed trajectories, leaving pre-execution monitoring of step-level actions underexplored," the authors write.

To generate training data at scale, the team built StepGen, described in the abstract as "an automatic data engine that generates safe and unsafe trajectories with the same context but different actions at the risky step." They pair it with a training method they call Balance-GRPO, which "dynamically balances learning between safe and unsafe actions based on their observed accuracy" in an attempt to avoid both over-defense and under-defense.

On the AgentDojo and AgentDyn benchmarks, the paper reports StepGuard "achieves the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4." The abstract does not publish per-tool false-positive breakdowns, inference-latency figures, or the base-model size.