Loading…
AprielGuard: A Guardrail for Safety and Adversarial Robustness in Modern LLM Systems
Hugging FaceJaykumar Kasundra
Summary
Modern language model systems face security and safety threats spanning prompt injection, jailbreaks, and tool manipulation across long-context agentic workflows. To address these vulnerabilities, researchers introduced AprielGuard, an 8B parameter causal decoder-only transformer based on a downscaled Apriel-1.5 Thinker Base model. The model detects 16 safety risk categories alongside binary adversarial attacks across standalone prompts, multi-turn dialogues, and agentic workflows. Trained on synthetic datasets created with Mixtral-8x7B, NVIDIA NeMo Curator, and SyGra, AprielGuard operates in both explainable reasoning and fast non-reasoning modes. Evaluation shows high precision and recall on safety and adversarial benchmarks, though trade-offs exist between explainability latency and non-reasoning performance.
Context
Modern large language model deployments feature multi-turn conversations, long contexts, structured reasoning, and agentic tool workflows that expose systems to adversarial attacks like jailbreaks, context hijacking, and tool manipulation. Existing moderation relies on brittle combinations of multi-stage guard models, regex filters, and hand-crafted heuristics that fail to scale.
Approach / What changed
The authors developed AprielGuard, an 8B parameter causal decoder-only transformer derived from an Apriel-1.5 Thinker Base variant. It unifies a 16-category safety taxonomy inspired by SALAD-Bench with binary adversarial attack detection across standalone prompts, multi-turn chats, and agentic workflows. Training utilized synthetic data generated via Mixtral-8x7B, uncensored models, NVIDIA NeMo Curator, and the SyGra framework, paired with data augmentations like character noise and leetspeak substitutions. The model supports both a fast classification mode and an explainable reasoning mode.
Takeaways
- AprielGuard supports dual-mode operation: a fast non-reasoning mode for low-latency production pipelines and a reasoning mode that outputs structured explanations.
- On adversarial attack benchmarks, AprielGuard-8B achieved 1.00 precision and 0.78 recall without reasoning, versus 0.93 precision and 0.94 recall when reasoning was enabled.
- The evaluation benchmarks were translated into eight non-English target languages using the MADLAD400-3B-MT model while preserving English role identifiers like User: and Assistant:.
Related reading
Apriel-H1: The Surprising Key to Distilling Efficient Reasoning Models
Retrofitting efficiency into existing large language models often fails when naive distillation disrupts complex multi-step reasoning mechanisms. The Apriel-H1 project addresses this challenge by converting a 15B full-attention reasoning model into a Mamba hybrid using targeted distillation on high-quality SFT reasoning traces rather than diffuse pretraining data. Built on the open-source Fast-LLM framework, the process applies reverse KL divergence alongside a staged layer replacement strategy combining Leave-One-Out analysis and dynamic loss evaluations. Across fifty total blocks, replacing thirty attention layers with Mamba mixers yielded the flagship Apriel-H1-15b-Thinker-SFT checkpoint. This configuration achieved a 2.1x throughput increase with minimal benchmark degradation after 76.8B training tokens.
Torsten Scholak, Oleksiy Ostapenko, Raymond Li, Luke Kumar, Joel Lamy-Poirier