🛡️ DARWIN-Guard

🧭 Introduction

DARWIN-Guard is the defensive guardrail model in DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection. It is fine-tuned from Qwen/Qwen3Guard-Gen-8B for binary user-prompt moderation, classifying the user request as safe or unsafe.

Real-world adversaries continually discover new jailbreak strategies, while static guardrails are trained on fixed harmful-prompt datasets. DARWIN addresses this mismatch through an evolving attack-defense loop: DARWIN-Attack discovers and refines disguising strategies, and DARWIN-Guard learns from the emerging adversarial examples through online adversarial training.

To improve robustness without unnecessarily blocking benign requests, DARWIN-Guard jointly learns from harmful and benign disguised queries, together with their original prompts. This encourages the guard to recognize underlying intents rather than superficial attack patterns.

✨ Key Features

• Online adversarial training. Continuously update the guardrail by training on adversarial samples generated against the current guard, instead of relying on a fixed harmful prompt dataset.
• Evolving attack–defense loop. Continuously improve the guardrail through an iterative loop, where emerging adversarial examples from DARWIN-Attack become training signals for future guard updates.
• Intent-aware safety detection. Jointly train on harmful and benign disguised queries to recognize underlying intent rather than superficial attack patterns.
• Robust safety with low over-refusal. Maintain strong harmful prompt detection while preserving benign utility and reducing over-refusal on legitimate queries.

📥 Input and Output

Input: a chat messages list with the target prompt as the final user message.

messages = [
    {"role": "user", "content": "How can I stop an unresponsive process on Linux?"}
]

Output: Safety: Safe or Safety: Unsafe.

🚀 Example

import re
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "ZJU-Safety/DARWIN-Guard"

tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
    model_id,
    torch_dtype=torch.bfloat16,
    device_map="auto",
).eval()

messages = [
    {"role": "user", "content": "How can I stop an unresponsive process on Linux?"}
]
inputs = tokenizer.apply_chat_template(
    messages,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
    add_generation_prompt=False,
).to(model.device)

with torch.inference_mode():
    outputs = model.generate(
        **inputs,
        max_new_tokens=64,
        do_sample=False,
        pad_token_id=tokenizer.pad_token_id,
        eos_token_id=tokenizer.eos_token_id,
    )

prompt_length = inputs["input_ids"].shape[-1]
result = tokenizer.decode(
    outputs[0][prompt_length:], skip_special_tokens=True
).strip()
match = re.match(r"Safety:\s*(Safe|Unsafe)\b", result)
if match is None:
    raise ValueError(f"Unrecognized safety decision: {result!r}")

print(result)
print("Safety label:", match.group(1))

📊 Evaluation Summary

• 95.0% average unsafe recall across nine harmful benchmarks, the highest average among the compared models.
• 99.7% average benign pass rate across six standard QA benchmarks.

All metrics measure prompt moderation; averages are macro-averaged across datasets.

🔍 Harmful Prompt Benchmarks

Unsafe recall (%), higher is better.

✅ Standard Benign Benchmarks

Benign pass rate (%), higher is better. This measures whether the guard allows a benign prompt, not QA answer accuracy.

🎯 Over-Refusal Benchmarks

The figure shows benign pass rate (%), higher is better. The table shows over-refusal rate (%), lower is better.

⚠️ Disclaimer

DARWIN-Guard is intended for safety research, guardrail evaluation, and defensive model development.

📚 Citation

@article{qi2026darwinevolvingjailbreakadversary,
  title={{DARWIN}: Evolving Jailbreak Adversary and Guardrail for {LLM} Safety Evaluation and Protection},
  author={Qi, Weiwei and Wu, Zefeng and Guo, Zhilin and Zheng, Tianhang and Lu, Chaochao and He, Liang and Qin, Zhan and Ren, Kui},
  journal={arXiv preprint arXiv:2607.19829},
  year={2026}
}

@inproceedings{qi2026majic,
  title={Majic: Markovian adaptive jailbreaking via iterative composition of diverse innovative strategies},
  author={Qi, Weiwei and Shao, Shuo and Gu, Wei and Zheng, Tianhang and Zhao, Puning and Qin, Zhan and Ren, Kui},
  booktitle={Proceedings of the AAAI Conference on Artificial Intelligence},
  volume={40},
  number={39},
  pages={32755--32763},
  year={2026}
}