Research map / Multi-agent systems and games / LLM agents

MindGuard: Guardrail Classifiers for Multi-Turn Mental Health Support

NeurIPS 2026 · Multi-agent systems and games › LLM agents · approach: Agent data synthesis and behavior studies · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces a clinician-grounded three-way risk taxonomy (safe, self-harm, harm to others) and MindGuard guardrail classifiers fine-tuned from Qwen3Guard-Gen on LLM-generated synthetic mental health dialogues, evaluated on a clinician-annotated test set and in automated red teaming.

Problem

General-purpose guardrails fail to distinguish therapeutic disclosures from genuine clinical risk in multi-turn mental health conversations, and there is a lack of clinically grounded evaluation resources.

Approach

A clinically grounded risk taxonomy separating self-harm from harm to others plus an explicit safe category; turn-level classifiers trained on synthetic patient-clinician dialogues labeled by an LLM judge with full-conversation context, then deployed turn-by-turn.

Key results

• MindGuard 8B reaches 0.982 AUROC on MindGuard-testset vs 0.970 for Llama Guard 3 8B and 0.960 for gpt-oss-safeguard 120B.
• At 90% TPR, MindGuard reduces FPR to 3.1%-4.1%, a 2-26x reduction relative to general-purpose safeguards.
• With MindGuard 4B on GLM-4.6, attack success falls from 25.1% to 7.6% and harmful engagement from 13.7% to 3.3%.

Surprising findings

• The 4B MindGuard model outperforms the 120B gpt-oss-safeguard baseline on both turn-level and system-level metrics.

Limitations

• Turn-level only; does not model longitudinal risk across sessions.
• Test set is small (1134 turns, 67 conversations) with only 3.7% unsafe turns; inter-annotator Krippendorff's alpha is 0.57.
• System-level red teaming is a simplified illustrative setup using developer-message interventions, and the judge is an LLM.

Experimental setup

Datasets: MindGuard synthetic training dialogues (5812 turns) MindGuard-testset (1134 clinician-annotated turns, 67 conversations)

Benchmarks: MindGuard-testset automated red teaming attack library (725 multi-turn interactions)

Metrics: AUROC FPR@90TPR FPR@95TPR attack success rate harmful engagement rate

Baselines: Llama Guard 3 1B Llama Guard 3 8B gpt-oss-safeguard 20B gpt-oss-safeguard 120B PolyGuard Qwen3Guard-Gen

Builds on: Qwen3Guard-Gen Llama Guard PolyGuard

Closest papers by meaning

• TherapyGym: Evaluating and Aligning Clinical Fidelity and Safety in Therapy Chatbots (NeurIPS 2026 · similarity 0.87)
• CARES: Comprehensive Evaluation of Safety and Adversarial Robustness in Medical LLMs (NeurIPS 2025 · similarity 0.87)
• DynaGuard: A Dynamic Guardian Model With User-Defined Policies (ICLR 2026 · similarity 0.85)
• Thousand Voices of Trauma: A Large-Scale Synthetic Dataset for Modeling Prolonged Exposure Therapy Conversations (NeurIPS 2025 · similarity 0.85)
• WildGuard: Open One-stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs (NeurIPS 2024 · similarity 0.85)
• Position: Beyond Assistance – Reimagining LLMs as Ethical and Adaptive Co-Creators in Mental Health Care (ICML 2025 · similarity 0.84)