PolyGuard: Massive Multi-Domain Safety Policy-Grounded Guardrail Dataset

Bo Li (Nanjing University) · Zhaorun Chen (University of Chicago) · Yu Sun (California Polytechnic State University, Pomona) · Jiawei Zhang (Beihang University) · Mintong Kang (UIUC) · Chejian Xu (University of Illinois at Urbana-Champaign) · Chengquan Guo (University of Chicago) · Minzhou Pan (VirtueAI) · Ivan Revilla (California Polytechnic State University, Pomona)

adversarial inputsdetoxification promptingdomain coveragedomain-specific risksf1 scoresguardrail benchmarkguardrail modelsinteraction formatsmulti-domain safetyoptimized adversarial attackspolicy-aligned systemspolicy-grounded risk constructionrisk taxonomiessafety policiessafety-critical domains

As large language models (LLMs) become widespread across diverse applications, concerns about the security and safety of LLM interactions have intensified. Numerous guardrail models and benchmarks have been developed to ensure LLM content safety. However, existing guardrail benchmarks are often built upon ad hoc risk taxonomies that lack a principled grounding in standardized safety policies, limiting their alignment with real-world operational requirements. Moreover, they tend to overlook domain-specific risks, while the same risk category can carry different implications across different domains. To bridge these gaps, we introduce PolyGuard, the first massive multi-domain safety policy-grounded guardrail dataset. PolyGuard offers: (1) broad domain coverage across eight safety-critical domains, such as finance, law, and codeGen; (2) policy-grounded risk construction based on authentic, domain-specific safety guidelines; (3) diverse interaction formats, encompassing declarative statements, questions, instructions, and multi-turn conversations; (4) advanced benign data curation via detoxification prompting to challenge over-refusal behaviors; and (5) \textbf{attack-enhanced instances} that simulate adversarial inputs designed to bypass guardrails. Based on PolyGuard, we benchmark 19 advanced guardrail models and uncover a series of findings, such as: (1) All models achieve varied F1 scores, with many demonstrating high variance across risk categories, highlighting their limited domain coverage and insufficient handling of domain-specific safety concerns; (2) As models evolve, their coverage of safety risks broadens, but performance on common risk categories may decrease; (3) All models remain vulnerable to optimized adversarial attacks. The policy-grounded \dataset establishes the first principled and comprehensive guardrail benchmark. We believe that \dataset and the unique insights derived from our evaluations will advance the development of policy-aligned and resilient guardrail systems.