DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model

• URL: http://arxiv.org/abs/2608.05695v1
• Date: Thu, 06 Aug 2026 07:37:49 GMT
• Title: DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model
• Abstract summary: Large language model (LLM) agents increasingly interact with real-world systems.<n> unsafe actions may cause irreversible consequences on external states, user data, and downstream services.<n>We propose DreamGuard, a proactive guardrail for LLM agents built around a risk-aware world model.
• Score: 14.643297355742185
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: As large language model (LLM) agents increasingly invoke external tools and interact with real-world systems, unsafe actions may cause irreversible consequences on external states, user data, and downstream services. Recent runtime guardrails mitigate such risks by checking proposed actions before execution, but many remain reactive: they primarily assess the apparent safety of the current action, lacking an explicit model of how risk evolves across the trajectory. This limitation creates a critical blind spot for long-horizon risks, where individually benign-looking actions can gradually drift the agent toward hazardous states. In response, we propose DreamGuard, a proactive guardrail for LLM agents built around a risk-aware world model. The world model maintains a compact recurrent latent state over the trajectory and predicts future latent states from which DreamGuard derives immediate-hazard and prefix-risk evidence. It then fuses these multi-horizon signals into intervention decisions before execution. Experiments across four benchmarks and an online guardrail evaluation show that DreamGuard outperforms generic, reactive, and proactive guardrail baselines, achieves the best safety-utility trade-off among evaluated guardrails, and maintains an average end-to-end latency of 25 ms per call.

Related papers

• TrojanWorld: Backdooring World-Model Agents via Imagination Steering [65.38754125569848]
  TrojanWorld is a backdoor framework for world-model agents that induces attacker-specified behavior by steering internal imagination.<n>Under trigger activation, TrojanWorld achieves a target-action deviation as low as 0.026 while retaining at least 98.8% of the corresponding clean performance.
  arXiv  Detail & Related papers  (2026-09-07T05:14:10Z)
• Reassembling Distributed Risk: Trajectory-Conditioned Action Generation for Multi-Turn Agent Safety [12.022506016268112]
  Under multi-turn decomposition attacks, a harmful objective can be distributed across individually plausible requests and tool calls.<n>We propose emphReassembling Distributed Risk (ReDiR), a generation-time defense that conditions action generation on trajectory-level security evidence.<n>We evaluate ReDiR on two agent-safety benchmarks across three model families and eight held-out tool domains.
  arXiv  Detail & Related papers  (2026-08-26T12:28:35Z)
• From Risk Classification to Action Plan Remediation: A Guardrail Feedback Driven Framework for LLM Agents [35.39244077703096]
  Guardrails typically safeguard agents by evaluating proposed actions or inputs before execution.<n>Existing guardrails often flag the entire task uniformly as unsafe, thereby blocking the threat but sacrificing the benign part.<n>We introduce TRIAD, a guardrail-integrated agent framework that leverages guardrail-generated verbal feedback as a guiding signal to keep the agent aligned with benign objectives.
  arXiv  Detail & Related papers  (2026-06-04T07:34:35Z)
• BraveGuard: From Open-World Threats to Safer Computer-Use Agents [68.38397514360227]
  BraveGuard is a self-evolving defense framework for training guard models from open-world threat signals and realistic agent trajectories.<n>We instantiate BraveGuard by training multiple guard backbones, including Qwen3-Guard and Llama-Guard variants, and evaluate the resulting guards on trajectory-level agent-safety benchmarks.
  arXiv  Detail & Related papers  (2026-05-31T11:16:18Z)
• HomeGuard: VLM-based Embodied Safeguard for Identifying Contextual Risk in Household Task [42.665798473119516]
  We propose an architecture-agnostic safeguard featuring Context-Guided Chain-of-Thought (CG-CoT)<n>CG-CoT decomposes risk assessment into active perception that sequentially anchors attention to interaction targets and relevant spatial neighborhoods.<n> Experiments demonstrate that our model HomeGuard significantly enhances safety, improving risk match rates by over 30% compared to base models.
  arXiv  Detail & Related papers  (2026-03-15T13:09:43Z)
• RoboSafe: Safeguarding Embodied Agents via Executable Safety Logic [56.38397499463889]
  Embodied agents powered by vision-language models (VLMs) are increasingly capable of executing complex real-world tasks.<n>However, they remain vulnerable to hazardous instructions that may trigger unsafe behaviors.<n>We propose RoboSafe, a runtime safeguard for embodied agents through executable predicate-based safety logic.
  arXiv  Detail & Related papers  (2025-12-24T15:01:26Z)
• When Models Outthink Their Safety: Mitigating Self-Jailbreak in Large Reasoning Models with Chain-of-Guardrails [74.63933201261595]
  Large Reasoning Models (LRMs) demonstrate remarkable capabilities on complex reasoning tasks.<n>LRMs remain vulnerable to severe safety risks, including harmful content generation and jailbreak attacks.<n>We propose the Chain-of-Guardrail (CoG), a training framework that recomposes or backtracks unsafe reasoning steps.
  arXiv  Detail & Related papers  (2025-10-24T09:32:25Z)
• Building a Foundational Guardrail for General Agentic Systems via Synthetic Data [76.18834864749606]
  LLM agents can plan multi-step tasks, intervening at the planning stage-before any action is executed-is often the safest way to prevent harm.<n>Existing guardrails mostly operate post-execution, which is difficult to scale and leaves little room for controllable supervision at the plan level.<n>We introduce AuraGen, a controllable engine that synthesizes benign trajectories, injects category-labeled risks with difficulty, and filters outputs via an automated reward model.
  arXiv  Detail & Related papers  (2025-10-10T18:42:32Z)
• PSG-Agent: Personality-Aware Safety Guardrail for LLM-based Agents [60.23552141928126]
  PSG-Agent is a personalized and dynamic system for LLM-based agents.<n>First, PSG-Agent creates personalized guardrails by mining the interaction history for stable traits.<n>Second, PSG-Agent implements continuous monitoring across the agent pipeline with specialized guards.
  arXiv  Detail & Related papers  (2025-09-28T03:31:59Z)
• Pro2Guard: Proactive Runtime Enforcement of LLM Agent Safety via Probabilistic Model Checking [8.970702398918924]
  Large Language Model (LLM) agents exhibit powerful autonomous capabilities across domains such as robotics, virtual assistants, and web automation.<n>Existing rule-based enforcement systems, such as AgentSpec, focus on developing reactive safety rules.<n>We propose Pro2Guard, a proactive runtime enforcement framework grounded in probabilistic reachability analysis.
  arXiv  Detail & Related papers  (2025-08-01T10:24:47Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.