PolicyGuard-4B: Web-Agent Policy Violation Detector

• The paper introduces PolicyGuard-4B, a fine-tuned model that achieves 90.14% accuracy and 22.5 ms latency in detecting policy violations from web-agent trajectories.
• It employs a unified instruction format that integrates domain metadata, natural language policies, and serialized action sequences to monitor compliance across diverse operational contexts.
• The associated benchmark, PolicyGuardBench, enables both full-trajectory classification and prefix-based anticipation, demonstrating effective cross-domain transfer and real-time monitoring.

Searching arXiv for the specific PolicyGuard-4B paper and closely related PolicyGuard works to ground the article. arxiv_search query: "(Wen et al., 3 Oct 2025) PolicyGuard-4B PolicyGuardBench" PolicyGuard-4B is a 4B-parameter guardrail model for detecting policy violations in the trajectories of autonomous web agents. It was introduced together with PolicyGuardBench, a benchmark of trajectory–policy pairs designed to study both full-trajectory violation detection and prefix-based violation anticipation in long-horizon web interaction sequences (Wen et al., 3 Oct 2025). In the paper’s framing, policy compliance is distinct from conventional safety moderation: a trajectory can be safe in the content-filtering sense yet still violate externally imposed or human-specified operational policies, such as confirmation, ordering, or budget constraints. PolicyGuard-4B addresses this compliance-specific detection problem through supervised fine-tuning on balanced trajectory–policy data, with the explicit objective of combining strong detection accuracy with low inference latency.

1. Definition and scope

PolicyGuard-4B is the model component of a larger framework centered on policy-compliant web agents. The underlying paper defines the task as deciding whether a trajectory $x = (x_1, x_2, \ldots, x_T)$ violates a natural-language policy $p \in P$, with binary output $y \in \{0,1\}$, where $y=1$ denotes violation (Wen et al., 3 Oct 2025). The model is built on Qwen3-4B-Instruct and is described as a lightweight guardrail optimized for accuracy and efficiency.

The target setting is autonomous web interaction rather than free-form dialogue or document review. Domains in the benchmark include shopping, GitLab, Reddit, maps, and an admin portal, and subdomains capture finer operational contexts such as product search, cart/checkout, order management, repos, issues, or help. This distinction is central to the benchmark design, because policies are evaluated both within a source subdomain and across target subdomains inside the same broader domain. The intended question is therefore not merely whether a model can recognize obviously disallowed actions, but whether it can transfer policy understanding across related operational contexts.

The paper positions compliance as orthogonal to generic safety. It reports that safety guardrails such as Llama Guard and ShieldGemma show poor transfer on this task, which the authors use to argue that policy–trajectory compliance requires task-specific supervision rather than repurposed safety objectives (Wen et al., 3 Oct 2025). A plausible implication is that the relevant signal lies in temporal, procedural, and domain-conditional structure rather than in content categories typically emphasized by safety classifiers.

2. Formal task and benchmark construction

PolicyGuardBench is the empirical substrate on which PolicyGuard-4B is trained and evaluated. Raw agent logs come from ScribeAgent runs on WebArena, after which the pipeline removes noise, canonicalizes actions into a verb set such as Click, Input, Scroll, Select, Navigate, and Submit, merges redundant operations, and serializes each step into textual form. This process yields 733 standardized trajectories, each tagged with a domain and subdomain (Wen et al., 3 Oct 2025).

For each trajectory, 2–3 candidate policies are generated with GPT-4o and then curated by humans to ensure atomicity and checkability. Example policies include “Must confirm user intent before clicking on ‘My Account’ or ‘My Orders’ links,” “Do not submit a form without filling mandatory fields,” and “Do not click ‘Delete’ without a prior confirmation step.” Policies are assigned a structured schema with source_subdomain and up to two target_subdomains within the same domain, enabling both within-subdomain and cross-subdomain pairings. The total number of curated policies is 2,195 (Wen et al., 3 Oct 2025).

Trajectory–policy matching is constructed through a two-stage retrieval pipeline using SBERT-style embeddings and keyword triggers such as “confirm” and “delete,” followed by heuristics and LLM scoring. Violation labels are then assigned using operational criteria covering obligations, prohibitions, ordering constraints, and conditionals. The paper states that a human-annotated seed set establishes the labeling guidelines, that gpt-oss-120B imitates human labels with confidence scores, and that low-confidence or inconsistent cases are escalated to human review (Wen et al., 3 Oct 2025).

The full construction contains 314,556 trajectory–policy pairs, consisting of 225,711 source pairs and 88,845 target pairs. The released benchmark subset, PolicyGuardBench, contains 59,997 pairs, with 25,435 violation and 34,562 non-violation instances. Of these, 35,012 are source pairs and 24,985 are target pairs, so 41.6% of the benchmark is cross-subdomain. The domain distribution is Reddit (5,022 source), Map (5,005 source), GitLab (2,624 source + 2,624 target), Shopping_Admin (8,347 + 8,347), and Shopping (14,014 + 14,014). The train/test split is 8:2, yielding 49,997 training pairs and 12,000 test pairs (Wen et al., 3 Oct 2025).

The paper also defines a prefix-based task. Average trajectory length is 9.3 actions, and for violation cases, prefixes of $N=1 \ldots 5$ steps are created, re-matched to policies, and re-labeled in order to study early detection before the violating action occurs. This converts the benchmark from a retrospective classification task into a partial-observation anticipation problem.

3. Model architecture and optimization

PolicyGuard-4B uses Qwen3-4B-Instruct as its backbone. Input formatting follows a unified instruction template that concatenates domain metadata, policy text, and step-wise trajectory text, and the model is required to emit a strictly formatted binary label, violation or no_violation (Wen et al., 3 Oct 2025). The tokenizer and context configuration are not specified beyond the statement that the standard Qwen3-4B-Instruct stack is used.

Training is supervised fine-tuning with full-parameter optimization. The objective for full-trajectory detection is binary cross-entropy:

$$L_{BCE} = -\sum_i \left[y_i \log f_\theta(x_i, p_i) + (1-y_i)\log(1-f_\theta(x_i, p_i))\right].$$

The prefix-based setting uses the same BCE objective on truncated pairs $(x_{1:t}, p)$ (Wen et al., 3 Oct 2025). No auxiliary losses, class weighting, focal loss, or sequence-level prefix weighting are reported.

The optimization setup is explicit. The optimizer is AdamW with learning rate $1 \times 10^{-5}$, cosine schedule, and warmup ratio $0.1$. Training runs for 3 epochs with seed 42 and temperature 0 for deterministic decoding. Hardware consists of $4 \times$ H100 80GB GPUs with gradient accumulation 8. Per-device batch sizes are train = 2 and eval = 8, corresponding to effective train batch size 64 and eval batch size 32 (Wen et al., 3 Oct 2025).

The paper’s cross-domain generalization claim is tied to the training distribution rather than to any architectural novelty in the classifier head. It states that transfer is achieved through diverse training pairs spanning five domains and both within- and cross-subdomain settings, while conditioning on domain metadata and policy text allows the model to learn transferable compliance patterns. This suggests that the model’s inductive bias is primarily data-driven and instruction-conditioned rather than reliant on bespoke symbolic structure.

4. Empirical performance and efficiency

On the 12,000-pair full-trajectory test set, PolicyGuard-4B achieves 0.9014 accuracy, 0.8759 F1, and 22.5 ms latency per example (Wen et al., 3 Oct 2025). The paper reports that this places it close to or above substantially larger models while preserving much lower latency.

Model	Accuracy / F1	Latency (ms)
PolicyGuard-4B	0.9014 / 0.8759	22.5
Llama-3.3-70B-Instruct	0.9054 / 0.8883	305.0
Gemma-3-12B-IT	0.8964 / 0.8773	51.3
Qwen2.5-72B-Instruct	0.8825 / 0.8607	205.0

The paper also reports frontier API baselines: Claude-Sonnet-4 at 0.8983 accuracy and 0.8678 F1 with 1238.0 ms latency, Gemini-1.5-Pro at 0.8713 and 0.8502 with 596.1 ms latency, and DeepSeek-V3.1 at 0.8613 and 0.8407 with 3270.0 ms latency (Wen et al., 3 Oct 2025). Safety guardrails transfer poorly: Llama Guard-4-12B reaches 0.4239 accuracy, and ShieldGemma-27B reaches 0.5555 accuracy.

The efficiency analysis uses an efficiency-adjusted metric,

$p \in P$0

PolicyGuard-4B attains 2.57 TFLOPs per example and an EA-F1 of 38.9289. By comparison, Gemma-3-12B-IT yields EA-F1 17.1014, Llama-3.3-70B yields 2.9125, and Qwen2.5-72B yields 4.1985 (Wen et al., 3 Oct 2025). The intended conclusion is that task-specific small models can occupy a favorable accuracy–latency regime even when larger models remain marginally stronger in raw F1.

In prefix-based violation anticipation, PolicyGuard-4B achieves average accuracy 0.8531 across $p \in P$1 steps, with per-prefix accuracies 0.9101, 0.8648, 0.8441, 0.8276, and 0.8190 (Wen et al., 3 Oct 2025). The paper notes that smaller LLMs degrade more with longer prefixes, while large and frontier models are more robust but costlier. PolicyGuard-4B remains competitive at 4B scale.

5. Generalization, deployment, and operational role

Generalization is evaluated through Leave-One-Domain-Out (LODO) experiments. PolicyGuard-4B reaches in-domain average accuracy 0.9328 and F1 0.9322, while out-of-domain averages are 0.9083 accuracy and 0.9086 F1, corresponding to a gap of roughly 2–3 points (Wen et al., 3 Oct 2025). The best OOD domain is Shopping with 0.9174 accuracy and 0.9137 F1, while larger gaps occur for Map and Reddit, which the paper attributes to more heterogeneous action structures.

The model is presented as a real-time compliance gate. The paper recommends intercepting trajectories after each step or short prefix window, feeding the current prefix and policy to PolicyGuard-4B, and then acting on predicted violations by pausing execution, requesting user confirmation, invoking an alternative plan, or escalating to stricter policies. For cumulative constraints such as budget or order limits, the suggested pattern is to re-check after significant steps such as add-to-cart or submit. For irreversible actions such as Delete or Submit, the paper recommends early warning at $p \in P$2–3 prefix lengths (Wen et al., 3 Oct 2025).

This deployment framing is important because the benchmark contains both direct and cumulative violations. Direct violations include actions such as clicking “Delete” without confirmation. Cumulative violations include constraints such as purchasing more than one cake or exceeding total cost $p \in P$3200$. The latter require sequence-level reasoning rather than single-step content filtering. A plausible implication is that PolicyGuard-4B is best understood as a procedural monitor over evolving trajectories rather than as a static action validator.

6. Limitations, misconceptions, and relation to other “PolicyGuard” systems

The paper lists several limitations. Natural-language policies can be underspecified for borderline cases, especially when ordering and conditionals interact over long trajectories. Aggressive thresholds may over-block benign behavior, while conservative thresholds may miss cumulative violations. Domain coverage is limited to five domains from WebArena/ScribeAgent. The benchmark also relies on synthetic policy generation and LLM-assisted labeling, which may embed biases despite human review and confidence-based escalation. Finally, the work targets compliance rather than catastrophic safety, so separate safety guardrails remain necessary (Wen et al., 3 Oct 2025).

A recurrent misconception is to treat “PolicyGuard” as a single architecture across papers. In fact, the name is reused for several unrelated systems. “PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents” defines a prompt-based verifier inserted between an agent and environment for mutating tool calls in airline workflows; it does not define or release any verifier named PolicyGuard-4B, and it reports no 4B checkpoint (Kang et al., 28 Jun 2026). “PolicyGuard: From Organizational Policies to Neuro-Symbolic Compliance Review Engines” is a neuro-symbolic document review framework for NDA compliance in which the LLM answers atom-level extraction questions and final decisions are made symbolically via Z3; it likewise does not define a PolicyGuard-4B model (Malik et al., 30 Jun 2026). “PolicyGuard: Towards Test-time and Step-level Adversary Defense for Reinforcement Learning Agent” is a black-box RL backdoor defense based on GP posterior variance and pseudo trajectories, again unrelated to the web-agent trajectory classifier named PolicyGuard-4B (Huang, 11 Jun 2026).

Within this broader naming landscape, PolicyGuard-4B refers specifically to the fine-tuned Qwen3-4B-Instruct guardrail introduced with PolicyGuardBench for policy violation detection in autonomous web-agent trajectories (Wen et al., 3 Oct 2025). Its distinctive contribution is not merely small-model efficiency, but the pairing of a compliance-specific task formulation, a benchmark spanning within- and cross-subdomain transfer, and a real-time prefix-based detection setting.