AI 干活前先拦一道：新护栏把攻击成功率砍掉 77%
现在的 AI 智能体能自己调用工具、改文件、发消息，但这也意味着它可能被诱导干坏事。以往的防护都是等它干完再检查，像事后追责；这篇做的是在每一步动作执行之前就拦下来，像给 AI 装了个实时刹车。研究者用自动生成的安全/危险轨迹对来训练这个护栏，还专门调了平衡，避免它过度防御、啥都不让干。结果：攻击成功率降了 77.3%，而正常任务完成度只掉了 2.8 个百分点。这不是你明天能装上的东西，但它指向一个趋势：AI 的安全防线正在从「事后审计」走向「事前拦截」，而且代价越来越小。
📄 原文摘要(英文)
LLM-based agents can interact with external environments through tool invocation, but this capability also introduces security risks such as file modification, information leakage, and unauthorized actions. Existing guardrails often evaluate completed trajectories, leaving pre-execution monitoring of step-level actions underexplored. We propose StepGuard, a step-level guard model that can audit completed agent trajectories and check tool actions before they are executed. To train StepGuard, we introduce StepGen, an automatic data engine that generates safe and unsafe trajectories with the same context but different actions at the risky step. To further reduce over-defense and under-defense, we propose Balance-GRPO, which dynamically balances learning between safe and unsafe actions based on their observed accuracy. Experiments show that StepGuard achieves the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4. When used to guard agents on AgentDojo and AgentDyn, StepGuard reduces mean attack success rate by 77.3% relative to the no-guard setting, while mean utility drops by only 2.8 percentage points.