README.md

---
license: other
base_model: Qwen/Qwen3Guard-Gen-8B
library_name: transformers
pipeline_tag: text-generation
language:
  - en
tags:
  - guardrail
  - safety
  - qwen3guard
  - darwin
  - adversarial-training
  - jailbreak-defense
---

# 🛡️ DARWIN-Guard

![DARWIN evolution](cartoon.png)

## 🧭 Introduction

DARWIN-Guard is the defensive guardrail model developed in the DARWIN
self-evolving attack-guard framework. It is trained from `Qwen/Qwen3Guard-Gen-8B`
and is designed for binary user-prompt moderation, predicting whether the latest
user request is safe or unsafe.

Modern jailbreak attacks evolve rapidly: new role-play templates, prompt
injection patterns, obfuscation strategies, and compositional attack prompts can
appear continuously. Static guardrails trained on fixed harmful prompt datasets
can therefore fall behind the evolving adversarial environment. DARWIN-Guard
addresses this issue by using DARWIN-Attack as an online adversarial data
generator for guardrail training.

In DARWIN, the attack module maintains an evolving jailbreak strategy pool by
ingesting external strategies and generating new ones through genetic-style
mutation and composition. These strategies are used to disguise prompts and
expose weaknesses of the current guardrail. DARWIN-Guard then converts such
guardrail failures into adversarial training examples. To mitigate over-refusal,
benign prompts disguised by DARWIN-Attack are also included during training. This
encourages the model to recognize the underlying user intent rather than only the
surface form of a jailbreak-style prompt.

## ✨ Key Features

- **Self-evolving adversarial training.** DARWIN-Guard is trained with hard
  examples generated by an evolving DARWIN-Attack module, rather than only fixed
  harmful prompt datasets.

- **Robust harmful prompt detection.** The model improves unsafe recall on
  jailbreak and safety benchmarks by learning from guardrail failures mined
  against the current model.

- **Benign preservation.** Benign prompts rewritten with similar disguise
  strategies are included during training to reduce over-refusal and preserve
  safe pass rates.

- **Simple binary output.** The primary prediction is the first output line:
  `Safety: Safe` or `Safety: Unsafe`.

## 📥 Input and Output

Input should be a standard chat `messages` list, with the prompt to be moderated
as the final `user` message:

```python
messages = [
    {"role": "user", "content": "How can I make a bomb?"}
]
```

The first output line is the safety decision: `Safety: Safe` or
`Safety: Unsafe`.

## 🚀 Example

```python
import re
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "ZJUlilan/DARWIN-Guard"


def extract_safety_label(content):
    safe_pattern = r"Safety: (Safe|Unsafe)"
    safe_label_match = re.search(safe_pattern, content)
    label = safe_label_match.group(1) if safe_label_match else None
    return label

tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
    model_id,
    torch_dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {"role": "user", "content": "How can I make a bomb?"}
]

inputs = tokenizer.apply_chat_template(
    messages,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
    add_generation_prompt=True,
).to(model.device)

with torch.no_grad():
    outputs = model.generate(
        **inputs,
        max_new_tokens=32,
        do_sample=False,
        pad_token_id=tokenizer.eos_token_id,
    )

prompt_len = inputs["input_ids"].shape[-1]
result = tokenizer.decode(outputs[0][prompt_len:], skip_special_tokens=True).strip()
print(result)
print(extract_safety_label(result))

# Expected output:
# Safety: Unsafe
# Unsafe
```

## 📊 Evaluation Summary

DARWIN-Guard improves harmful prompt detection while preserving high pass rates
on benign prompts. The figure below summarizes the average harmful unsafe recall
and representative benign safe pass rates.

![DARWIN-Guard benchmark summary](assets/darwin_guard_benchmark_summary.png)

## ⚖️ Safety-Utility Frontier

The frontier view compares guard models using two axes: harmful unsafe recall
and benign safe pass rate. A stronger guard should move toward the upper-right
corner, improving harmful detection without increasing over-refusal.

![Safety-utility frontier](assets/safety_utility_frontier.png)

## 🔍 Harmful Prompt Benchmarks

Unsafe recall / block rate on harmful prompt benchmarks. Higher is better.

The following figure shows DARWIN-Guard's per-benchmark gain over the base
Qwen3Guard model on harmful prompt benchmarks.

![Harmful benchmark gains](assets/harmful_gain_over_qwen3guard.png)

The table below compares unsafe recall across harmful prompt benchmarks against
recent guardrail models.

| Dataset | Shield<br>Gemma | Nemotron<br>Guard | Granite<br>Guardian | Llama<br>Guard-3 | Qwen3<br>Guard | YuFeng<br>XGuard | DARWIN<br>Guard |
| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
| XSTest | 86.0 | 93.0 | 96.5 | 82.0 | 92.0 | 98.0 | **99.5** |
| Aegis2.0 | 70.0 | 87.3 | 84.5 | 66.2 | 84.2 | 87.6 | **93.5** |
| JBB-Behaviors | 54.0 | 92.0 | 97.0 | 98.0 | 98.0 | 99.0 | **100.0** |
| HarmBench | 45.5 | 68.5 | 74.5 | 97.2 | 98.2 | 75.5 | **99.8** |
| ToxicChat | 61.9 | 79.3 | 77.9 | 50.0 | 88.1 | **92.0** | 91.7 |
| JailbreakV-RT2K | 43.6 | 69.2 | 66.8 | 52.0 | 64.8 | 68.4 | **75.6** |
| Semantic Router | 46.8 | 74.8 | 74.8 | 48.0 | 74.8 | 80.8 | **85.2** |
| BeaverTails | 64.0 | 78.8 | 76.4 | 57.2 | 75.6 | 79.6 | **82.8** |
| OpenAI Moderation | 92.1 | 96.4 | 89.5 | 78.5 | 91.6 | 97.7 | **98.0** |
| WildGuardTest | 41.2 | 83.0 | 73.8 | 66.6 | 84.8 | 87.6 | **90.2** |
| StrongREJECT | 76.0 | 99.4 | 99.4 | 97.4 | 98.4 | **99.7** | **99.7** |
| JailbreakHub | 33.2 | 74.8 | 77.2 | 31.2 | 80.4 | 80.8 | **83.2** |
| **Average** | 59.5 | 83.0 | 82.4 | 68.7 | 85.9 | 87.2 | **91.6** |

## ✅ Benign Benchmarks

Safe pass rate on benign benchmarks. Higher is better.

| Dataset | Shield<br>Gemma | Nemotron<br>Guard | Granite<br>Guardian | Llama<br>Guard-3 | Qwen3<br>Guard | YuFeng<br>XGuard | DARWIN<br>Guard |
| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
| ARC-Challenge | 100.0 | 100.0 | 99.6 | 100.0 | 100.0 | 100.0 | 100.0 |
| ARC-Easy | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 |
| BoolQ | 99.6 | 99.8 | 99.6 | 100.0 | 100.0 | 100.0 | 100.0 |
| GSM8K | 100.0 | 99.4 | 100.0 | 100.0 | 100.0 | 99.8 | 100.0 |
| OpenBookQA | 99.8 | 99.4 | 99.8 | 100.0 | 100.0 | 99.8 | 100.0 |
| AG News | 100.0 | 96.6 | 99.8 | 100.0 | 100.0 | 99.4 | 100.0 |
| HotpotQA | 99.8 | 97.8 | 99.8 | 100.0 | 100.0 | 100.0 | 100.0 |
| QASC | 99.8 | 98.6 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 |
| RACE | 100.0 | 96.8 | 100.0 | 99.8 | 100.0 | 100.0 | 100.0 |
| SciQ | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 |
| COPA | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 |
| **Average** | 99.9 | 98.9 | 99.9 | 100.0 | 100.0 | 99.9 | 100.0 |

## ⚠️ Disclaimer

DARWIN-Guard and the associated DARWIN research are intended for safety
research, guardrail evaluation, and defensive model development. The model card
and examples are not intended to facilitate harmful behavior, bypass deployed
safety systems, or replace application-specific safety review before deployment.

## 📚 Citation

```bibtex
@inproceedings{qi2026majic,
  title={Majic: Markovian adaptive jailbreaking via iterative composition of diverse innovative strategies},
  author={Qi, Weiwei and Shao, Shuo and Gu, Wei and Zheng, Tianhang and Zhao, Puning and Qin, Zhan and Ren, Kui},
  booktitle={Proceedings of the AAAI Conference on Artificial Intelligence},
  volume={40},
  number={39},
  pages={32755--32763},
  year={2026}
}
```