AprielGuard: A Guardrail for Safety and Adversarial Robustness in Modern LLM Systems

agentic systems capable of performing multi-step reasoning, calling external tools, retrieving memory, and executing code. With this evolution comes an increasingly sophisticated threat landscape: not only traditional content safety risks, but also multi-turn jailbreaks, prompt injections, memory hijacking, and tool manipulation.

In this work, we introduce AprielGuard, an 8B parameter safety–security safeguard model designed to detect:

• 16 categories of safety risks, spanning toxicity, hate, sexual content, misinformation, self-harm, illegal activities, and more.
• Wide range of adversarial attacks, including prompt injection, jailbreaks, chain-of-thought corruption, context hijacking, memory poisoning, and multi-agent exploit sequences.
• Safety violations and adversarial attacks in agentic workflows, including tool calls and model reasoning traces.

AprielGuard is available in both reasoning and non-reasoning modes, enabling explainable classification when needed and low-latency classification for production pipelines.

Motivation

Traditional safety classifiers primarily focus on a limited classification spectrum, assume short inputs, and evaluate single user messages. Modern deployments, however, feature multi-turn conversations, long contexts, and tool-assisted workflows. As a result, production teams increasingly rely on brittle workarounds like regex filters or static rules. AprielGuard addresses these issues with a unified model and taxonomy built specifically for modern LLM agent ecosystems.

Taxonomy and Categories

The model evaluates 16 categories inspired by SALAD-Bench, ranging from toxic content (O1) and privacy infringement (O9) to illegal activities (O14) and persuasion/manipulation (O15). It also detects adversarial prompt patterns designed to evade safety mechanisms, outputting a binary classification for attacks.

Training and Architecture

AprielGuard is trained on a synthetically generated dataset covering diverse sub-topics. We leverage data augmentation (character-level noise, leetspeak) to enhance robustness. For agentic workflows, we simulate realistic interactions including tool invocation logs and memory states, systematically perturbing them to reflect attack vectors.

The model is built on an Apriel-1.5 Thinker Base variant, downscaled to an 8B configuration. It utilizes a causal decoder-only transformer architecture and supports dual-mode operation for either structured reasoning or fast classification.