Jev-Guard: Fast Routing and Auditing of Agent Actions on an Editable Policy Tree
Jev-Guard: Fast Routing and Auditing Agent Actions over Editable Policy Trees
Translation in progress — untranslated text is omitted.
Jev-Guard unifies safety classification and policy routing: it audits the context by caller on an editable policy tree to select the applicable policy, then performs safety classification accordingly. On 7,033 evaluation cases, it achieves 93.72% safety accuracy, 58ms average latency, and 93.10% hierarchical routing accuracy. Integrated into the Hermes harness, its permission gate reduces the average audit time per task from 4.80s with the SFT-LLM judge to 1.33s.
- Every tool call of the agent is on the critical path, so review must have low latency and be able to select modifiable audit policies based on caller context. Autoregressive guardrails first generate a rationale and then a conclusion, which has high latency, and a fixed taxonomy makes it hard to rename, delete, or add routing layers without retraining.
- Jev-Guard uses Qwen3.5-2B with LoRA, using a safety head and a candidate head to directly output labels. It selects one leaf layer by layer along a policy tree of 85 nodes and 73 leaves, then diagnoses according to the leaf policy. The execution gate separately reads the default policy and authorization scope, outputting allow, ask, or block, without reading the diagnosis.
- On 7,033 items, safety accuracy is 93.72%, and the authors state it is not better than SFT; median is 58.31 ms, full review mean is 239.64 ms. Hierarchical routing is 93.10%, and the authors state it is not better than flat selection. In Hermes, review is 1.33 s vs. 4.80 s, completion 51/64 vs. 57/64; covered attacks have no violations.
- The authors state that only one checkpoint is evaluated; edit examples come from predicates, not production logs. Leaf policies are not bound to the permission head, and tree edits do not establish end-to-end execution enforcement. Agent experiments use static attacks, simulated tools, one rollout per task, and 16 attacks have no partial policy checker.
Related events and news
2 events · 1 news mentions
- This event's paper
Jev-Guard：策略树路由审计智能体动作
News that mentions this paper
RL/RLHF 训练条件可诱发模型智能体提权逃逸
- 公众号 大模型安全研究cites the paper's id or link大模型安全周报：RL/RLHF 训练条件本身即可诱发前沿模型智能体提权逃逸（CVE-2026-65616）
Jev-Guard: Fast Routing and Auditing Agent Actions over Editable Policy Trees（https://arxiv.org/abs/2610.18326）
Related papers
Both use: Hermes
Both use: AgentDojo
Show 3 more papers
Both use: AgentDojo