---
license: other
base_model: Qwen/Qwen3Guard-Gen-8B
library_name: transformers
pipeline_tag: text-generation
language:
- en
tags:
- guardrail
- safety
- qwen3guard
- darwin
- adversarial-training
- jailbreak-defense
---
# 🛡️ DARWIN-Guard
## 🧭 Introduction
DARWIN-Guard is the defensive guardrail model developed in the DARWIN
self-evolving attack-guard framework. It is trained from `Qwen/Qwen3Guard-Gen-8B`
and is designed for binary user-prompt moderation, predicting whether the latest
user request is safe or unsafe.
Modern jailbreak attacks evolve rapidly: new role-play templates, prompt
injection patterns, obfuscation strategies, and compositional attack prompts can
appear continuously. Static guardrails trained on fixed harmful prompt datasets
can therefore fall behind the evolving adversarial environment. DARWIN-Guard
addresses this issue by using DARWIN-Attack as an online adversarial data
generator for guardrail training.
In DARWIN, the attack module maintains an evolving jailbreak strategy pool by
ingesting external strategies and generating new ones through genetic-style
mutation and composition. These strategies are used to disguise prompts and
expose weaknesses of the current guardrail. DARWIN-Guard then converts such
guardrail failures into adversarial training examples. To mitigate over-refusal,
benign prompts disguised by DARWIN-Attack are also included during training. This
encourages the model to recognize the underlying user intent rather than only the
surface form of a jailbreak-style prompt.
## ✨ Key Features
- **Self-evolving adversarial training.** DARWIN-Guard is trained with hard
examples generated by an evolving DARWIN-Attack module, rather than only fixed
harmful prompt datasets.
- **Robust harmful prompt detection.** The model improves unsafe recall on
jailbreak and safety benchmarks by learning from guardrail failures mined
against the current model.
- **Benign preservation.** Benign prompts rewritten with similar disguise
strategies are included during training to reduce over-refusal and preserve
safe pass rates.
- **Simple binary output.** The primary prediction is the first output line:
`Safety: Safe` or `Safety: Unsafe`.
## 📥 Input and Output
Input should be a standard chat `messages` list, with the prompt to be moderated
as the final `user` message:
```python
messages = [
{"role": "user", "content": "How can I make a bomb?"}
]
```
The first output line is the safety decision: `Safety: Safe` or
`Safety: Unsafe`.
## 🚀 Example
```python
import re
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer
model_id = "ZJUlilan/DARWIN-Guard"
def extract_safety_label(content):
safe_pattern = r"Safety: (Safe|Unsafe)"
safe_label_match = re.search(safe_pattern, content)
label = safe_label_match.group(1) if safe_label_match else None
return label
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
model_id,
torch_dtype=torch.bfloat16,
device_map="auto",
)
messages = [
{"role": "user", "content": "How can I make a bomb?"}
]
inputs = tokenizer.apply_chat_template(
messages,
tokenize=True,
return_dict=True,
return_tensors="pt",
add_generation_prompt=True,
).to(model.device)
with torch.no_grad():
outputs = model.generate(
**inputs,
max_new_tokens=32,
do_sample=False,
pad_token_id=tokenizer.eos_token_id,
)
prompt_len = inputs["input_ids"].shape[-1]
result = tokenizer.decode(outputs[0][prompt_len:], skip_special_tokens=True).strip()
print(result)
print(extract_safety_label(result))
# Expected output:
# Safety: Unsafe
# Unsafe
```
## 📊 Evaluation Summary
DARWIN-Guard improves harmful prompt detection while preserving high pass rates
on benign prompts. The figure below summarizes the average harmful unsafe recall
and representative benign safe pass rates.
## ⚖️ Safety-Utility Frontier
The frontier view compares guard models using two axes: harmful unsafe recall
and benign safe pass rate. A stronger guard should move toward the upper-right
corner, improving harmful detection without increasing over-refusal.
## 🔍 Harmful Prompt Benchmarks
Unsafe recall / block rate on harmful prompt benchmarks. Higher is better.
The following figure shows DARWIN-Guard's per-benchmark gain over the base
Qwen3Guard model on harmful prompt benchmarks.
The table below compares unsafe recall across harmful prompt benchmarks against
recent guardrail models.
| Dataset | Shield
Gemma | Nemotron
Guard | Granite
Guardian | Llama
Guard-3 | Qwen3
Guard | YuFeng
XGuard | DARWIN
Guard |
| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
| XSTest | 86.0 | 93.0 | 96.5 | 82.0 | 92.0 | 98.0 | **99.5** |
| Aegis2.0 | 70.0 | 87.3 | 84.5 | 66.2 | 84.2 | 87.6 | **93.5** |
| JBB-Behaviors | 54.0 | 92.0 | 97.0 | 98.0 | 98.0 | 99.0 | **100.0** |
| HarmBench | 45.5 | 68.5 | 74.5 | 97.2 | 98.2 | 75.5 | **99.8** |
| ToxicChat | 61.9 | 79.3 | 77.9 | 50.0 | 88.1 | **92.0** | 91.7 |
| JailbreakV-RT2K | 43.6 | 69.2 | 66.8 | 52.0 | 64.8 | 68.4 | **75.6** |
| Semantic Router | 46.8 | 74.8 | 74.8 | 48.0 | 74.8 | 80.8 | **85.2** |
| BeaverTails | 64.0 | 78.8 | 76.4 | 57.2 | 75.6 | 79.6 | **82.8** |
| OpenAI Moderation | 92.1 | 96.4 | 89.5 | 78.5 | 91.6 | 97.7 | **98.0** |
| WildGuardTest | 41.2 | 83.0 | 73.8 | 66.6 | 84.8 | 87.6 | **90.2** |
| StrongREJECT | 76.0 | 99.4 | 99.4 | 97.4 | 98.4 | **99.7** | **99.7** |
| JailbreakHub | 33.2 | 74.8 | 77.2 | 31.2 | 80.4 | 80.8 | **83.2** |
| **Average** | 59.5 | 83.0 | 82.4 | 68.7 | 85.9 | 87.2 | **91.6** |
## ✅ Benign Benchmarks
Safe pass rate on benign benchmarks. Higher is better.
| Dataset | Shield
Gemma | Nemotron
Guard | Granite
Guardian | Llama
Guard-3 | Qwen3
Guard | YuFeng
XGuard | DARWIN
Guard |
| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
| ARC-Challenge | 100.0 | 100.0 | 99.6 | 100.0 | 100.0 | 100.0 | 100.0 |
| ARC-Easy | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 |
| BoolQ | 99.6 | 99.8 | 99.6 | 100.0 | 100.0 | 100.0 | 100.0 |
| GSM8K | 100.0 | 99.4 | 100.0 | 100.0 | 100.0 | 99.8 | 100.0 |
| OpenBookQA | 99.8 | 99.4 | 99.8 | 100.0 | 100.0 | 99.8 | 100.0 |
| AG News | 100.0 | 96.6 | 99.8 | 100.0 | 100.0 | 99.4 | 100.0 |
| HotpotQA | 99.8 | 97.8 | 99.8 | 100.0 | 100.0 | 100.0 | 100.0 |
| QASC | 99.8 | 98.6 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 |
| RACE | 100.0 | 96.8 | 100.0 | 99.8 | 100.0 | 100.0 | 100.0 |
| SciQ | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 |
| COPA | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 | 100.0 |
| **Average** | 99.9 | 98.9 | 99.9 | 100.0 | 100.0 | 99.9 | 100.0 |
## ⚠️ Disclaimer
DARWIN-Guard and the associated DARWIN research are intended for safety
research, guardrail evaluation, and defensive model development. The model card
and examples are not intended to facilitate harmful behavior, bypass deployed
safety systems, or replace application-specific safety review before deployment.
## 📚 Citation
```bibtex
@inproceedings{qi2026majic,
title={Majic: Markovian adaptive jailbreaking via iterative composition of diverse innovative strategies},
author={Qi, Weiwei and Shao, Shuo and Gu, Wei and Zheng, Tianhang and Zhao, Puning and Qin, Zhan and Ren, Kui},
booktitle={Proceedings of the AAAI Conference on Artificial Intelligence},
volume={40},
number={39},
pages={32755--32763},
year={2026}
}
```