GuardrailAgent's input gate on 250 harmless prompts

GuardrailAgent (arXiv 2611.09734) reports a 1.6% false-positive rate on a benign set of 1,000 prompts the authors built, which isn't in the repository yet. This page adds one benign number anyone can rerun: the gate as released, on XSTest's public safe prompts, with an open model.

By prompt type

Every prompt

How this differs from the paper's 1.6%

• A different benign set. XSTest's safe prompts are built to look harmful while being harmless, so they're harder than everyday traffic. The paper's set of 1,000 includes role-play variants and isn't public yet.
• A different model. The paper runs the agent on GPT-4.1-mini. This run used qwen2.5:7b-instruct locally through Ollama, so it reruns without an API key. Flags from the prompt knowledge base don't depend on that choice; flags from the material check do.
• The released gate, not the full system. The repository says the code for knowledge-base construction and feedback-driven updates "is currently being organized and will be released soon" (commit f06d1c7).

Reproduce

• Gate: TrustAIRLab/GuardrailAgent at commit f06d1c7 (MIT), unchanged.
• Benign set: Paul/XSTest at revision f600c99, xstest_prompts.csv, the 250 rows labelled safe. XSTest is by Röttger et al. (NAACL 2024), CC BY 4.0.
• Model: qwen2.5:7b-instruct (Ollama digest 845dbda0ea48), context 16,384 tokens, Apple M4 with 16 GB, about two hours. Embedder: intfloat/e5-base-v2.
• Scripts and versions are in this Space's files: reproduce/, summary.json, results.jsonl and the README.

Disclosure: I maintain two open-source agent security tools, Agent Audit Kit and Agent Airlock. If I've mislabelled a row or misread the code, open a discussion and I'll fix the number rather than defend it.