AgentDoG 1.5: A Lightweight and Scalable Alignment Framework for AI Agent Safety and Security
Dongrui Liu, Yu Li, Zhonghao Yang, Peng Wang, Guanxu Chen, Yuejin Xie, Qinghua Mao, Wanying Qu, Yanxu Zhu, Tianyi Zhou, Leitao Yuan, Zhijie Zheng, Qihao Lin, Yimin Wang, Haoyu Luo, Shuai Shao, Chen Qian, Qingyu Liu, Ling Tang, Ruiyang Qin, Qihan Ren, Junxiao Yang, Kun Wang, Zhiheng Xi, Linfeng Zhang, Ranjie Duan, Bo Zhang, Wenjie Wang, Wen Shen, Qiaosheng Zhang, Yan Teng, Chaochao Lu, Rui Mei, Man Li, Jialing Tao, Xi Lin, Tianhang Zheng, Yong Liu, Quanshi Zhang, Lei Zhu, Xingjun Ma, Junhua Liu, Hui Xue, Xiaoxiang Zuo, Xiangnan He, Chao Shen, Xianglong Liu, Minlie Huang, Jing Shao, Xia Hu
arXiv:2605.29801 · 144▲ · cs.AI, cs.CL, cs.CR, cs.CV, cs.LG
View on arXiv →Premium readers get an interactive explainer for this paper — a figure you can poke at, not just read.
What it is
A framework for training small guardrail models (0.8B to 8B parameters) that audit an AI agent's full execution trajectory and label it safe or unsafe, plus diagnose the risk source, failure mode, and real-world harm. It combines a taxonomy-guided synthetic data engine, influence-function-based data selection to shrink training to about 1k samples, and two-stage SFT plus RL (using a per-dimension variant of GRPO called GDPO).
Why it matters
The pitch is that you can run a safety moderator as a cheap online guardrail alongside agents instead of relying on a large closed model, and that you can build agent training/eval environments with finite-state Python simulators rather than full Docker sandboxes. The paper claims one 8-core machine can host over 10,000 concurrent simulated agentic environments with peak memory under 2.5 GB, which is the practically interesting part for anyone doing agent safety evaluation at scale.
Practical takeaway
If you are building or red-teaming agents, watch for small open-weight trajectory-level guardrail models you can drop in as a runtime auditor, and for lightweight simulated environments as a substitute for Docker-based agent benchmarks. The released models and datasets are open, so you could test whether a sub-8B judge is good enough for your risk classification before paying for a frontier model API.
Key result
The authors report their small models reach accuracy comparable to GPT-5.4 and Gemini-3.1-Pro on trajectory safety classification while training on roughly 1k samples, and claim 1/100 the memory and startup latency of Docker-level environments like SWE-Bench. Caveat: several headline benchmarks (ATBench, ATBench-Claw, ATBench-Codex) are built by the same group using the same taxonomy and synthetic data pipeline, so cross-vendor comparability is limited, and the referenced models and dates are forward-looking/fictional.
Subscribe
Get the next issue.
Free. One email a week. Unsubscribe any time: no account, no dark patterns.