Research map / Large language models / Reasoning and chain of thought

DynaGuard: A Dynamic Guardian Model With User-Defined Policies

ICLR 2026 · Large language models › Reasoning and chain of thought · approach: RL with verifiable rewards for reasoning · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces DynaGuard, Qwen3-based guardian models that judge dialogues against user-defined policies (with optional chain-of-thought), trained on the new DynaBench dataset plus safety data via SFT and GRPO.

Problem

Existing guardian models are limited to static, predefined harm categories and degrade on application-specific, user-defined policies, while reasoning guardians are slow and API models lack open weights.

Approach

Train open-weight guardian models to judge multi-turn dialogues against arbitrary user-written policies, using a synthetic DynaBench dataset of 40K policies plus safety datasets, with a dual mode (fast label-only or chain-of-thought reasoning) and explanations for violations.

Key results

• DynaGuard-8B reaches 79.7 average F1 across all tasks, the best among evaluated models, versus 75.8 for GPT-4o-mini.
• DynaGuard-8B without CoT (79.6 safety avg) outperforms GPT-4o-mini on DynaBench (72.5 vs 70.1 F1).
• On IFEval, Ministral-8B paired with DynaGuard improves accuracy from 57.3% to 63.8%, while other guardians give no gain.

Surprising findings

• LlamaGuard3 achieves only 13.1% F1 on the DynaBench test set despite claiming to handle user-defined harms.
• Non-CoT DynaGuard-8B is within 1.3 F1 points of its reasoning mode on average.

Limitations

• Explanations' effect on multi-agent recovery and human trust is not studied.
• Models performing on the hardest DynaBench subsets (factual knowledge, multi-clause, counting policies) show high error rates.
• Training excludes safety ontology deliberately, so pure DynaBench training underperforms on out-of-distribution safety benchmarks.

Experimental setup

Datasets: DynaBench WildGuard BeaverTails ToxicChat Aegis 2.0 GuardReasoner reasoning traces

Benchmarks: DynaBench Aegis 2.0 BeaverTails HarmBench Safe-RLHF WildGuard XSTest IFEval

Metrics: F1

Baselines: GPT-4o-mini Qwen3-8B WildGuard LlamaGuard3 NemoGuard ShieldGemma GuardReasoner-8B

Builds on: GRPO Qwen3 WildGuard GuardReasoner

Closest papers by meaning

• RSafe: Incentivizing proactive reasoning to build robust and adaptive LLM safeguards (NeurIPS 2025 · similarity 0.88)
• PolyGuard: Massive Multi-Domain Safety Policy-Grounded Guardrail Dataset (NeurIPS 2025 · similarity 0.88)
• HarmAug: Effective Data Augmentation for Knowledge Distillation of Safety Guard Models (ICLR 2025 · similarity 0.87)
• WildGuard: Open One-stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs (NeurIPS 2024 · similarity 0.87)
• $R^2$-Guard: Robust Reasoning Enabled LLM Guardrail via Knowledge-Enhanced Logical Reasoning (ICLR 2025 · similarity 0.86)
• Safety Pretraining: Toward the Next Generation of Safe AI (NeurIPS 2025 · similarity 0.86)