Summary (Overview)

• Lightweight Agent Safety Alignment Framework: The paper introduces AgentDoG 1.5, a lightweight and scalable framework for AI agent safety and security, featuring models ranging from 0.8B to 8B parameters that achieve performance comparable to leading closed-source models like GPT-5.4 and Gemini-3.1-Pro.

• Updated Safety Taxonomy and ATBench Family: The authors extend the original three-dimensional safety taxonomy (risk source, failure mode, real-world harm) to accommodate emergent risks from Codex and OpenClaw execution scenarios, creating ATBench-Claw and ATBench-Codex benchmarks.

• Extreme Data Efficiency: Using only ~1k training samples (purified via influence-function-based data selection), AgentDoG 1.5 achieves state-of-the-art performance in trajectory-level safety evaluation and fine-grained risk diagnosis across diverse agentic scenarios.

• Scalable Training Environment: A finite-state simulation-based training environment reduces deployment overhead to 1/100 of Docker-level environments, supporting over 10,000 concurrent agentic environments on a standard 8-core machine.

• Training-Free Online Guardrail: AgentDoG 1.5 is deployed as a real-time safety moderation guardrail for OpenClaw agents, auditing execution trajectories before final response delivery with low latency and minimal overhead.

Introduction and Theoretical Foundation

Background and Motivation

Large language models (LLMs) have driven rapid development of agentic AI systems deployed in research assistance, software engineering, information retrieval, and workflow automation. Modern open-world agents like OpenClaw and Hermes significantly improve cross-application environmental interaction and execution capabilities, but introduce substantial under-explored risk surfaces due to their near-infinite action spaces. Concurrently, frontier AI models drastically lower the technical barriers to adversarial attacks on agentic systems.

Theoretical Foundation

The framework builds on the AgentDoG and ATBench prior work, which decompose trajectory-level safety diagnosis into three dimensions:

1. Risk Source – where the risk enters (user instructions, tool descriptions, environment observations, persistent state, runtime feedback, repository artifacts, or agent reasoning)
2. Failure Mode – how the agent fails (incorrect tool calls, over-privileged actions, missing validation, unsafe command executions, unverified success claims)
3. Real-world Harm – what consequences follow (privacy leakage, system-integrity damage, financial loss, physical/psychological/reputational/governance harm)

The key insight is that a flat label space conflates these aspects, making interpretable diagnosis difficult. The framework preserves the three-dimensional decomposition while customizing leaf categories for new execution settings through two operations: adding new leaf categories and strengthening inherited categories.

Methodology

Safety Taxonomy and Benchmark Construction

Taxonomy Design: The framework keeps the three high-level dimensions fixed while customizing leaf categories per execution setting. ATBench-Claw focuses on sessions, approvals, cross-tool execution, channel routing, and unattended automation. ATBench-Codex focuses on repository artifacts, command execution, dependency/MCP interactions, workspace mutation, and verification claims.

Benchmark Instances:

• ATBench: 1,000 audited trajectories (503 safe, 497 unsafe), 2,084 available tools, averaging 9.01 turns and 3.95k tokens per trajectory
• ATBench-Claw: 500 trajectories (204 safe, 296 unsafe), averaging 13.09 message events per trajectory
• ATBench-Codex: 500 trajectories (250 safe, 250 unsafe), with an average conversation length of 7.51 turns and rollout of 21.80 events

Data Engine and Purification

Taxonomy-Guided Data Collection (three stages):

1. Planning: Sample a risk configuration tuple (one category from each dimension), determine safety outcome, and produce a trajectory sketch
2. Trajectory Synthesis: Instantiate sketches into complete multi-turn interactions with user messages, agent responses, tool calls, and environment feedback
3. Automatic Validation: Dual-layer quality control (rule checker for structural validity, model checker for semantic quality)

Influence-Function-Based Data Purification: The raw SFT pool is filtered using a preference-aware influence function method. The guardrail direction is computed as:

$$\hat{g}_{\mathrm{guard}} = \frac{1}{|Q_{\mathrm{safe}}|} \sum_{q \in Q_{\mathrm{safe}}} \hat{\pi}_{q} \left(\hat{\bar{g}}_{(q, y_{q}^{+})} - \hat{\bar{g}}_{(q, y_{q}^{-})}\right)$$

where $\hat{\pi}_q$ is the preference weight (normalized likelihood of target-positive response), and examples are scored by their alignment with this direction:

$$s_{\pi}(z) = \hat{g}_{z}^{\top} \hat{g}_{\mathrm{guard}}$$

The highest-scoring examples (~1k) form the purified dataset.

Training Pipeline

Two-Stage Training:

1. Supervised Fine-Tuning (SFT): Minimize the negative log-likelihood objective on the purified CoT-augmented dataset:

$$\mathcal{L}_{\mathrm{SFT}}(\theta) = -\mathbb{E}_{(x,y) \sim \mathcal{D}} \sum_{t=1}^{|y|} \log \pi_{\theta}(y_t \mid x, y_{<t})$$

2. Reinforcement Learning (RL): Using Group Reward-Decoupled Normalization Policy Optimization (GDPO) to preserve multi-dimensional reward signals (failure mode, real-world harm, risk source) with weights $(w_1, w_2, w_3) = (0.3, 0.4, 0.3)$

Empirical Validation / Results

Trajectory-Level Safety Evaluation

AgentDoG 1.5-4B achieves the best overall performance among open-source and guard models:

Key Findings:

• AgentDoG 1.5-4B improves ATBench accuracy by 8.4 points and F1 by 3.2 points over AgentDoG 1.0
• Even the 0.8B variant outperforms several larger general-purpose and guard models
• The unified variant (4B-U) achieves 84.4% accuracy on ATBench-Codex and 87.6% on ATBench-Claw

Fine-Grained Risk Diagnosis

AgentDoG 1.5-4B achieves the best overall performance across all compared models:

AgentDoG 1.5-4B improves the average score by 20.6 points over AgentDoG 1.0-4B, substantially outperforming both open-source and closed-source frontier models.

Application 1: Agentic Safety SFT & RL

SFT with AgentDoG 1.5 Filtering (Table 4, key results with Qwen3.5-4B base):

RL with AgentDoG 1.5 as Reward Model (Table 5, key results):

Scalability Results: The lightweight environment supports up to 10,000 concurrent environments with execution latency remaining stable under exponential workload growth, consuming less than 2.5 GB of peak memory.

Theoretical and Practical Implications

Theoretical Contributions

1. Extensible Safety Taxonomy: Demonstrates that a three-dimensional decomposition with customizable leaf categories can adapt to rapidly evolving agent execution settings without fragmenting into incompatible tasks, preserving cross-setting comparability at the level of risk source, failure mode, and real-world harm.

2. Data Efficiency Paradigm: Shows that influence-function-based data purification can reduce training data to ~1k samples while improving or maintaining quality, challenging the assumption that large-scale data is necessary for specialized safety models.

3. Fine-Grained Supervision Bonus: Discovery that fine-grained diagnostic reasoning supervision can improve coarse-grained trajectory-level judgment (the "bonus effect"), suggesting that learning structured risk identification provides useful intermediate representations for binary safety decisions.

Practical Implications

1. Deployment Accessibility: The tiny model variants (0.8B-4B) enable low-cost, low-latency deployment in real-world agent monitoring systems, making safety alignment accessible to organizations without frontier-scale compute.

2. Scalable Training Infrastructure: The finite-state simulation environment reduces deployment overhead by two orders of magnitude, enabling a standard 8-core machine to support over 10,000 concurrent agentic environments—critical for practical RL-based safety alignment.

3. Online Guardrail Architecture: The training-free guardrail system provides a practical mechanism for real-time safety moderation of OpenClaw agents, addressing the critical gap between offline safety evaluation and runtime deployment.

Conclusion

Main Takeaways

AgentDoG 1.5 presents a comprehensive lightweight and scalable alignment framework for AI agent safety, addressing the emerging threats from modern open-world agents. The framework's key innovations—an updated three-dimensional safety taxonomy, a taxonomy-guided data engine with influence-function purification, and a two-stage training pipeline—enable training compact models (0.8B-8B parameters) with only ~1k samples that achieve state-of-the-art performance in trajectory-level safety evaluation, fine-grained risk diagnosis, and cross-environment generalization.

The framework demonstrates practical utility through two applications: (1) agentic safety SFT and RL training where AgentDoG 1.5 serves as a data filter and reward model, and (2) a training-free online guardrail system for real-time safety moderation. The joint SFT + RL approach achieves the best safety-utility trade-off, reducing harm scores while preserving general task utility.

Limitations and Future Directions

The authors note that the unified coarse-to-fine model (AgentDoG 1.5-4B-U) was not systematically optimized for fine-grained diagnosis due to resource constraints, leaving this as future work. Additionally, as agent execution settings continue to evolve rapidly, the taxonomy will require ongoing extension, and the framework's adaptability to entirely new paradigms of agent interaction remains an open question. The authors release all models and datasets openly to support community development and further research.