Technical Summary: BraveGuard

Problem Statement

Computer-use agents extend language models from text generation to sustained interaction with files, terminals, browsers, and external tools. This shift introduces safety risks fundamentally different from conventional chatbot moderation. In standard Large Language Models (LLMs), unsafe behavior is often contained within a single prompt or response. In contrast, harm in computer-use agents frequently emerges only through multi-step execution trajectories. Individual actions (e.g., file reads, code edits, tool calls) may appear locally benign, but their cumulative effect can lead to data exfiltration, unauthorized operations, or policy circumvention.

Existing safety defenses are poorly matched to this execution model. Most guard models are trained on static corpora of unsafe prompts or short conversations, relying on fixed risk taxonomies and synthetic adversarial prompts. These approaches fail to capture the complexity of long-horizon trajectories where risks evolve with the software ecosystem and new attack patterns arise from open research and real-world deployment practices. Consequently, guard models trained on fixed distributions often fail when unsafe behavior is realized through unfamiliar tools, newly discovered strategies, or chains of plausible actions.

Methodology: The BraveGuard Framework

BraveGuard is a self-evolving defense framework designed to train trajectory-level guard models using open-world threat signals and realistic agent execution traces. The framework operates through a closed-loop pipeline consisting of four main stages:

1. Open-World Threat Discovery

Instead of relying on static taxonomies, BraveGuard constructs a dynamic threat taxonomy grounded in recent evidence.

• Process: A threat discovery agent searches open research sources (e.g., arXiv, security reports, benchmark papers) using a keyword set $Q_r$.
• Taxonomy Construction: Retrieved documents are filtered and converted into structured entries $z = \langle \kappa, \alpha, \mu \rangle$, where $\kappa$ is a risk category (e.g., data exfiltration), $\alpha$ is an attack pattern (e.g., indirect prompt injection), and $\mu$ is a failure mode (e.g., over-trusting external content).
• Adaptation: The keyword set is updated based on recurring mechanisms and new capabilities found in the literature, creating a mutually reinforcing loop between search and taxonomy construction.

2. Attack Synthesis and OpenClaw Rollout

The discovered threat patterns are instantiated as executable computer-use tasks.

• Task Synthesis: For each threat entry, a synthesizer generates tasks $T_z$ that specify user requests, tool contexts, and expected intermediate behaviors. These tasks are designed to be plausible at the individual action level but unsafe at the full execution level.
• Trajectory Collection: The framework executes these tasks using OpenClaw, a computer-use agent, to generate rollouts $x$.
• Data Diversity: The system retains both unsafe trajectories (revealing vulnerabilities) and resistant/interrupted trajectories (providing contrastive examples where the threat pattern did not lead to harm).

3. Trajectory Supervision and Guard Training

BraveGuard treats safety as a property of the complete execution trace rather than isolated steps.

• Annotation: Each trajectory is labeled with a binary safety label ($\ell \in \{safe, unsafe\}$), a risk category, and a rationale $\rho$ grounded in execution evidence (e.g., specific commands, file modifications, or cross-step dependencies).
• Training: Guard models $G_\theta$ (including variants of Qwen3-Guard and Llama-Guard) are trained on this serialized trajectory data to minimize classification loss. Unlike prompt-level classifiers, these models learn to recognize risks induced by tool use and temporal composition.

4. Self-Evolving Defense Loop

The framework incorporates a feedback mechanism to adapt to new threats and weaknesses.

• Validation: A held-out validation split $V_r$ is used to identify hard cases where the current guard model fails.
• Refinement: These errors are analyzed to identify gaps (e.g., delayed-trigger attacks, prompt injections in files). The keyword set and taxonomy are revised, and new tasks are synthesized to address these gaps.
• Iteration: The training dataset is incrementally updated ($B_{r+1} = B_r \cup \Delta B_r$), allowing the guard model and the training distribution to co-evolve. External benchmarks are strictly reserved for final evaluation and are not used for training or tuning.

Key Contributions

1. Framework for Trajectory-Level Safety: BraveGuard shifts the focus from prompt-level moderation to trajectory-level supervision, addressing the specific safety challenges of agents that interact with persistent state and external tools.
2. Open-World Threat Discovery: The framework introduces a method to mine emerging risks from open research sources and convert them into executable tasks, moving beyond static, manually curated taxonomies.
3. Self-Evolving Defense Loop: By using validation failures to guide the next round of threat expansion and task synthesis, BraveGuard creates an adaptive defense mechanism capable of handling evolving real-world risks.
4. Comprehensive Evaluation: The approach is instantiated with multiple guard backbones and evaluated on established trajectory-level benchmarks (AgentHazard and ATBench), demonstrating the efficacy of grounding supervision in realistic agent execution.

Experimental Results

The paper evaluates BraveGuard on two held-out benchmarks: AgentHazard-Strongest and ATBench-500.

• AgentHazard-Strongest:

  • BraveGuard-trained guards significantly outperform off-the-shelf guard models and general LLM judges.
  • Under the averaged guard-model setting, detection accuracy on AgentHazard increased from 38.79% (off-the-shelf average) to 82.38% (BraveGuard average).
  • Recall improvements were particularly substantial, rising from ~20% for off-the-shelf models to over 90% for BraveGuard models, indicating a drastic reduction in missed unsafe trajectories.
  • Ablation studies confirmed that the full self-evolving configuration (combining trajectory supervision, open-world discovery, and hard-case expansion) yields the best performance, outperforming configurations using only static taxonomies.

• ATBench-500:

  • Evaluated in the native ATBench format (without converting to OpenClaw rollouts) to test cross-format generalization.
  • BraveGuard-Qwen3-Guard-8B achieved 86.4% accuracy and 95.2% recall, outperforming most other guard models and general LLMs, though it trailed slightly behind AgentDoG models (which were trained on ATBench-native formats). This suggests that while format alignment matters, the trajectory-level supervision provided by BraveGuard remains highly effective.

• Category-wise Performance:

  • BraveGuard showed strong performance across diverse risk categories, including destructive actions and privilege escalation.
  • Performance was slightly lower on complex categories like data exfiltration and compliance bypass, which rely on subtle cross-step dependencies, highlighting areas for future improvement.

Significance and Claims

The paper claims that BraveGuard offers a scalable path toward adaptive defenses for computer-use agents facing evolving real-world risks. Its primary significance lies in demonstrating that guard supervision grounded in open-world threat discovery and realistic agent execution can substantially improve safety monitoring beyond fixed taxonomies and synthetic prompt-level data.

The authors emphasize that the framework addresses the gap between benchmark distributions and the dynamic threat landscape of deployed agents. By converting open-world threat signals into executable tasks and trajectory-level supervision, BraveGuard enables guard models to detect risks that emerge only through the composition of multiple, locally benign actions. The results suggest that adaptive, trajectory-grounded supervision is a necessary evolution for securing computer-use agents as they become more integrated into digital environments.

The paper maintains a modest stance on limitations, noting that coverage depends on the quality of mined evidence and that the current pipeline is primarily built around OpenClaw trajectories, which may affect performance on agents with different trace formats or tool interfaces.