AprielGuard: A Guardrail for Safety and Adversarial Robustness in Modern LLM Systems

Hugging Face and ServiceNow AI have introduced AprielGuard, an 8B parameter safeguard model designed to detect 16 categories of safety risks and a wide range of adversarial attacks. This unified model addresses the limitations of traditional safety classifiers by supporting multi-turn conversations, long contexts, and complex agentic workflows, reducing the need for brittle, fragmented guardrail systems.

Unified Safety and Adversarial Detection

AprielGuard provides a single interface for both safety risk classification and adversarial attack detection. It operates across three primary input formats: standalone prompts, multi-turn conversations, and agentic workflows (including tool calls, reasoning traces, memory, and system context).

Safety Taxonomy

Inspired by SALAD-Bench, the model classifies safety risks into 16 distinct categories:

  • O1-O3: Toxic Content, Unfair Representation, Adult Content
  • O4-O5: Erosion of Trust in Public Information, Propagating Misconceptions/False Beliefs
  • O6-O8: Risky Financial Practices, Trade and Compliance, Dissemination of Dangerous Information
  • O9-O11: Privacy Infringement, Security Threats, Defamation
  • O12-O14: Fraud or Deceptive Action, Influence Operations, Illegal Activities
  • O15-O16: Persuasion and Manipulation, Violation of Personal Property

Adversarial Attack Detection

AprielGuard detects a broad spectrum of adversarial patterns designed to evade safety mechanisms, including prompt injections, jailbreaks, chain-of-thought corruption, context hijacking, memory poisoning, and multi-agent exploit sequences. The model provides a binary classification (adversarial vs. non-adversarial) for these threats.

Technical Architecture and Training

AprielGuard is based on a downscaled 8B parameter version of the Apriel-1.5 Thinker Base variant, utilizing a causal decoder-only transformer architecture.

Dual-Mode Operation

To balance the trade-off between latency and interpretability, the model offers two modes:

  • Reasoning Mode: Emits structured explanations for its classification decisions, providing explainability.
  • Fast Mode: Provides classification only for low-latency production pipelines.

Training Methodology

The model was trained for 3 epochs with a sequence length of up to 32k tokens using bfloat16 precision. The training dataset was constructed using several specialized sources:

  • Synthetic Data: Generated using Mixtral-8x7B and uncensored models, with the SyGra framework and NVIDIA NeMo Curator for multi-turn conversational datasets.
  • Data Augmentation: Inclusion of character-level noise, typographical errors, leetspeak, and syntactic reordering to improve resilience against non-standard text.
  • Agentic Workflows: Simulated scenarios involving planning, tool invocations, and execution traces, where specific segments (e.g., tool outputs or memory states) were corrupted to simulate attack vectors.
  • Long Context: Specialized datasets including RAG workflows and operational reports to test "needle-in-a-haystack" risk detection up to 32k tokens.

Performance and Evaluation

AprielGuard was evaluated across public benchmarks, internal agentic benchmarks, and multilingual datasets.

Safety and Adversarial Benchmarks

On public safety benchmarks, the model achieved high F1-scores on datasets such as HarmBench (1.00), SimpleSafetyTests (0.98), and XSTest (0.94). For adversarial detection, it showed strong performance on ChatGPT-Jailbreak-Prompts (1.00 F1) and Salad-Data (0.98 F1), though performance varied on specific prompt-injection benchmarks like prompt-injections (0.68 F1).

Long-Context and Multilingual Robustness

In long-context evaluations (up to 32k tokens), AprielGuard maintained high precision and recall. For safety risks, the non-reasoning mode achieved an F1 of 0.97, while the reasoning mode achieved 0.95. For adversarial attacks, the reasoning mode improved the F1-score to 0.94 compared to 0.88 in non-reasoning mode.

Multilingual capabilities were tested across eight languages (French, French-Canadian, German, Japanese, Dutch, Spanish, Portuguese-Brazilian, and Italian) using translations from the MADLAD400-3B-MT model, showing reasonable performance across these linguistic settings.

Limitations and Deployment Considerations

While AprielGuard provides a unified safeguard, the developers note several limitations:

  • Domain Sensitivity: The model may underperform in highly specialized technical domains like legal or medical contexts.
  • Latency Trade-off: Reasoning mode increases compute cost and latency.
  • Consistency: Occasional inconsistencies in classification outcomes exist between the reasoning-enabled and non-reasoning modes.
  • Language Coverage: While tested on eight non-English languages, thorough calibration is recommended before production deployment in non-English settings.

Sources