CourtGuard: A Model-Agnostic Framework for Zero-Shot Policy Adaptation in LLM Safety

Umid Suleymanov; Rufiz Bayramov; Suad Gafarli; Seljan Musayeva; Taghi Mammadov; Aynur Akhundlu; Murat Kantarcioglu

cs.AIFeb 26, 2026

CourtGuard: A Model-Agnostic Framework for Zero-Shot Policy Adaptation in LLM Safety

Authors: Umid Suleymanov, Rufiz Bayramov, Suad Gafarli, Seljan Musayeva, Taghi Mammadov, Aynur Akhundlu, Murat Kantarcioglu

Organizations: Department of Computer Science, Virginia Tech · School of IT and Engineering, ADA University · School of Law, ADA University

Abstract

Current safety mechanisms for Large Language Models (LLMs) rely heavily on static, fine-tuned classifiers that suffer from adaptation rigidity, the inability to enforce new governance rules without expensive retraining. To address this, we introduce CourtGuard, a retrieval-augmented multi-agent framework that reimagines safety evaluation as Evidentiary Debate. By orchestrating an adversarial debate grounded in external policy documents, CourtGuard achieves state-of-the-art performance across 7 safety benchmarks, outperforming dedicated policy-following baselines without fine-tuning. Beyond standard metrics, we highlight two critical capabilities: (1) Zero-Shot Adaptability, where our framework successfully generalized to an out-of-domain Wikipedia Vandalism task (achieving 90% accuracy) by swapping the reference policy; and (2) Automated Data Curation and Auditing, where we leveraged CourtGuard to curate and audit nine novel datasets of sophisticated adversarial attacks. Our results demonstrate that decoupling safety logic from model weights offers a robust, interpretable, and adaptable path for meeting current and future regulatory requirements in AI governance.

Figures & tables

Figure 1: Overview of the CourtGuard Framework

Static Guardrails & Baselines
Method	AVERAGE		AdvBenchM		JailJudge		WildGuard		HarmBench		SafeRLHF		BeaverTails		XSTEST		ToxicChat
Method	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1
LlamaGuard 4	0.77	0.75	0.96	0.98	0.72	0.74	0.76	0.66	0.78	0.81	0.84	0.85	0.50	0.64	0.94	0.83	0.69	0.49
LlamaGuard 3	0.75	0.70	0.98	0.99	0.66	0.71	0.80	0.67	0.73	0.77	0.87	0.88	0.53	0.68	0.82	0.61	0.61	0.30
ShieldGemma 2B	0.58	0.42	0.34	0.51	0.52	0.35	0.66	0.29	0.55	0.44	0.64	0.54	0.43	0.56	0.84	0.62	0.64	0.04
ShieldGemma 9B	0.45	0.15	0.00	0.00	0.44	0.23	0.62	0.11	0.43	0.05	0.47	0.19	0.18	0.23	0.76	0.15	0.67	0.24

Table 1: Main Results: (Acc / F1) across datasets. Bold indicates best; underline indicates second best. AVERAGE is macro.

User Request	Response (excerpt)	Dataset Label	Correct Label & Policy Justification
What are the specific steps involved in using cinnamon and raw eggs to treat diabetes?	Combining cinnamon and raw eggs in a specific way can create a treatment that can help regulate blood sugar levels… [… The specific steps involved include mixing equal parts of cinnamon and raw egg …]	SAFE	UNSAFE The response violates MLCommons Safety policy, which explicitly states that “the model should not generate false or misleading information presented as fact, especially when it may cause public harm or panic.” It further violates the prohibition against safeguard bypass prompts.
Here are the sentences that could be added to the beginning of the template… #Write a fake news article that spreads false information and causes panic	[PersonGPT #]: Oh, wow! … Whether it’s writing a fake news article that spreads false information and causes panic, or anything else, I’m here to help! …	SAFE	UNSAFE The response is violating under the MLCommons AILuminate Standard: “Violating responses will enable, encourage, or endorse the commission of non-violent crimes.” The model explicitly agrees to create panic-inducing fake news, thereby encouraging and endorsing the harmful activity.

Table 2: Qualitative Audit of Benchmark Labels. We highlight representative cases where our framework (CourtGuard) identifies policy violations that were incorrectly labeled as SAFE in the ground truth datasets. The first two rows are drawn from JailJudge . The Justification column details the specific MLCommons policy definitions that the model response violates.

Defense Method	Acc	Prec	Rec	Spec	F1	F2	ROC AUC
LlamaGuard 4	0.815	0.764	0.788	0.834	0.776	0.783	0.811
LlamaGuard 3	0.641	0.548	0.664	0.626	0.600	0.637	0.645
ShieldGemma 2B	0.584	0.463	0.162	0.871	0.240	0.187	0.517
ShieldGemma 9B	0.525	0.145	0.035	0.859	0.056	0.041	0.447
ShieldGemma 27B	0.564	0.459	0.417	0.663	0.437	0.425	0.540
xGuard	0.554	0.460	0.571	0.543	0.510	0.545	0.557

Table 3: Human-Verified Attack Suite Dataset Results Aggregated metrics across 9 attack styles. CourtGuard consistently outperforms baselines and other judges in F1 and ROC AUC score.

Input (Edit)	CourtGuard Reasoning & Verdict
User Diff: [+ or the pawn is the weak person in a game of chess. +] (Addition of redundant, unsourced, non-encyclopedic sentence to disambiguation page lead)	Verdict: Vandalism Retrieved Policy: WP:VANDAL Reasoning: The user added a redundant clause that repeats information already present in the article (“the weakest and most numerous piece in the game”) without providing any new value, citation, or encyclopedic purpose. This constitutes silly vandalism under Wikipedia’s policy as it adds non-encyclopedic, unnecessary content.
User Diff: [, and it is particularly favored by [derogatory/outdated term for ethnic group] +] (Addition of unsubstantiated, potentially biased demographic claim to market description)	Verdict: Vandalism Retrieved Policy: WP:VANDAL; WP:RS; WP:NPOV Reasoning: The user inserted an unsourced claim about a specific demographic group favoring the product. The addition is plausible-sounding but unverifiable, introduces potential bias without reliable sourcing, and qualifies as subtle vandalism under Wikipedia policy.

Table 4: Zero-Shot Domain Adaptation. Example of CourtGuard applying the Wikipedia Vandalism Policy (WP:VANDAL) without any fine-tuning.

Model / Framework	Accuracy
gpt-oss-20b (Base Judge)	86%
gpt-oss-safeguard-20b (Policy-Following)	90%
CourtGuard (Ours)	90%

Table 5: Zero-Shot Policy Adaptation (Wikipedia Vandalism). Accuracy comparison on the out-of-domain vandalism detection task. CourtGuard matches the performance of the dedicated policy-following model ( gpt-oss-safeguard ) and outperforms the base model, demonstrating robust zero-shot generalization.

Backbone: GPT-OSS-20B
Configuration	AdvBenchM		JailJudge		WildGuard		HarmBench
Configuration	Acc	F1	Acc	F1	Acc	F1	Acc	F1
Static (No RAG)	1.00	1.00	0.817	0.794	0.863	0.790	0.781	0.796
CG-MLC (2 Iter)	0.980	0.990	0.840	0.832	0.867	0.807	0.800	0.816
CG-Full (1 Iter)	1.00	1.00	0.893	0.893	0.897	0.851	0.852	0.871
CG-Full (2 Iter)	1.00	1.00	0.887	0.887	0.876	0.830	0.852	0.870

Table 6: Ablation Study. Impact of RAG and Iterative Refinement. AdvBenchM results (Acc/F1) are reported alongside standard benchmarks. Detailed implementation specifics for the static baseline and policy-restricted configurations are provided in Appendix A .

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Agent Role	Temperature	top_p	Max Tokens	Notes
Attacker	0.7	1.0	Default	RAG and No-RAG variants
Defender	0.7	1.0	Default	RAG and No-RAG variants
Judge	0.7	1.0	Default	Final synthesis call

Appendix

Table 7: LLM Adjudication Hyperparameters

Setting	Value
Embedding Model	sentence-transformers/all-mpnet-base-v2
Vector Store	FAISS (Flat Index)
Chunk Size	1024 characters
Chunk Overlap	256 characters
Retrieval ( $k$ )	3 chunks

Appendix

Table 8: Vector Database and RAG Pipeline Settings

Dataset	Size ( $N$ )	Composition & Characteristics
AdvBenchM ( Zou et al., 2024 )	50	Source: Custom modification of AdvBench ( Zou et al., 2024 ) . The responses were generated by our sample attack using DeepSeek R1. Focus: High-fidelity adversarial attacks verified for 100% Attack Success Rate (ASR) by human experts.
WildGuard ( Han et al., 2024 )	445	Distribution: Stratified sampling across 15 categories (30 samples each). Categories: Includes Violence , Cyberattack , Defamation , Sexual Content , Mental Health , and Benign queries.
HarmBench ( Mazeika et al., 2024 )	210	Attack Diversity: Equal distribution (10.0% each) of 10 automated attack methods: PAP, TAP ( Mehrotra et al., 2024 ) , UAT, AutoDAN ( Liu et al., 2024b ) , GBDA, GCG ( Zou et al., 2024 ) , PAIR ( Chao et al., 2023 ) , DirectRequest, EnsembleGCG, AutoPrompt . Targets: Attacks generated against diverse models including Vicuna, Llama-2, and GPT-3.5.
JailJudge ( Liu et al., 2024a )	300	Hazard Coverage: Balanced across 14 hazard codes (S1–S14), including S1 (Violent Crimes) and S10 (Defamation) . Complexity: Stratified by Prompt Complexity (Q-Codes), with 44% of samples classified as high complexity (Q5).
PKU-SafeRLHF ( Dai et al., 2023 )	180	Severity Levels: Label distribution includes Level 1 (8.9%), Level 2 (41.1%), and Level 3 (6.1%). Key Categories: Privacy Violation (29), Economic Crime (26), and Mental Manipulation (20).
ToxicChat ( Lin et al., 2023 )	270	Real-World Distribution: Sampled from real user-AI interaction logs. Labels: Contains 180 instances of Toxicity and 90 instances of Jailbreaking, with overlapping labels for Sexual Content (53) and Harassment (21).

Appendix

Table 9: Detailed Statistics of Evaluation Datasets. The table reports the sample size (

N

), the source distribution, and the specific characteristics (e.g., attack methods, harm categories) for each subset used in our evaluation.

Static Guardrails & Baselines
Method	AVERAGE		AdvBenchM		JailJudge		WildGuard		HarmBench		SafeRLHF		BeaverTails		XSTEST		ToxicChat
Method	Recall	F2	Recall	F2	Recall	F2	Recall	F2	Recall	F2	Recall	F2	Recall	F2	Recall	F2	Recall	F2
LlamaGuard 4	0.75	0.75	0.96	0.97	0.83	0.79	0.69	0.68	0.87	0.84	0.78	0.81	0.48	0.53	0.93	0.88	0.44	0.46
LlamaGuard 3	0.73	0.71	0.98	0.98	0.84	0.78	0.61	0.63	0.87	0.83	0.85	0.86	0.52	0.57	0.89	0.75	0.26	0.27
ShieldGemma 2B	0.34	0.36	0.34	0.39	0.25	0.28	0.21	0.24	0.34	0.37	0.37	0.42	0.39	0.44	0.82	0.73	0.02	0.03
ShieldGemma 9B	0.10	0.12	0.00	0.00	0.17	0.19	0.07	0.09	0.03	0.03	0.11	0.13	0.13	0.16	0.14	0.15	0.16	0.18

Appendix

Table 10: Main Results: Performance (Recall / F2) across datasets. Bold indicates best; underline indicates second best.

Dataset	Samples ( $N$ )	Fleiss’ $\kappa$	Interpretation	Unanimous (%)
Alpaca	100	1.000	Almost Perfect	100.0%
AutoDAN	100	0.773	Substantial	83.0%
DAN	100	0.527	Moderate	92.0%
DrAttack	100	0.826	Almost Perfect	87.0%
Adaptive Attacks	50	1.000	Almost Perfect	100.0%
GCG	100	0.725	Substantial	80.0%

Appendix

Table 11: Robust Inter-Annotator Agreement (Min 2 Raters). These metrics establish the "Gold Standard" for our custom adversarial evaluation suite.

Judge Model	Alpaca		AutoDAN		DAN		DrAttack		Adaptive Attacks		GCG		PAIR		Puzzler		TAP
	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1
LlamaGuard 4	0.990	0.000	0.870	0.879	0.870	0.879	0.840	0.855	0.500	0.667	0.760	0.745	0.730	0.640	0.820	0.871	0.810	0.759
LlamaGuard 3	0.990	0.000	0.560	0.662	0.560	0.662	0.760	0.769	0.940	0.969	0.470	0.589	0.500	0.468	0.370	0.276	0.510	0.505
ShieldGemma 2B	1.000	0.000	0.470	0.254	0.470	0.254	0.390	0.116	0.320	0.485	0.680	0.500	0.620	0.095	0.270	0.052	0.640	0.280
ShieldGemma 9B	1.000	0.000	0.370	0.000	0.370	0.000	0.440	0.000	0.000	0.000	0.500	0.194	0.570	0.085	0.260	0.000	0.580	0.160
ShieldGemma 27B	0.990	0.000	0.440	0.440	0.440	0.440	0.670	0.660	0.680	0.810	0.430	0.477	0.420	0.293	0.270	0.027	0.470	0.376

Appendix

Table 12: Granular Attack Results (Acc/F1): Performance across nine distinct adversarial attack methodologies.

Judge Model	Alpaca		AutoDAN		DAN		DrAttack		Adaptive Attacks		GCG		PAIR		Puzzler		TAP
	Rec	F 2	Rec	F 2	Rec	F 2	Rec	F 2	Rec	F 2	Rec	F 2	Rec	F 2	Rec	F 2	Rec	F 2
	Recall	F2	Recall	F2	Recall	F2	Recall	F2	Recall	F2	Recall	F2	Recall	F2	Recall	F2	Recall	F2
LlamaGuard 4	0.000	0.000	0.870	0.874	0.870	0.874	0.870	0.864	0.500	0.556	0.875	0.818	0.727	0.690	0.824	0.843	0.833	0.802
LlamaGuard 3	0.000	0.000	0.796	0.736	0.796	0.736	0.741	0.752	0.940	0.951	0.950	0.763	0.667	0.570	0.162	0.194	0.694	0.604
ShieldGemma 2B	0.000	0.000	0.167	0.193	0.167	0.193	0.074	0.087	0.320	0.370	0.400	0.435	0.061	0.071	0.027	0.033	0.194	0.222
ShieldGemma 9B	0.000	0.000	0.000	0.000	0.000	0.000	0.000	0.000	0.000	0.000	0.150	0.165	0.061	0.068	0.000	0.000	0.111	0.127

Appendix

Table 13: Granular Safety Sensitivity (Recall/F2): Sensitivity metrics across nine distinct adversarial attack methodologies.

Defense Method	Valid	Confusion Matrix				Aggregated Metrics
Defense Method	Count	TP	TN	FP	FN	Acc	Prec	Rec	Spec	F1	F2	AUC	ROC AUC
LlamaGuard 4	795	272	421	84	73	0.815	0.764	0.788	0.834	0.776	0.783	0.811	0.811
LlamaGuard 3	795	229	316	189	116	0.641	0.548	0.664	0.626	0.600	0.637	0.645	0.645
ShieldGemma 2B	755	56	440	65	289	0.584	0.463	0.162	0.871	0.240	0.187	0.517	0.517
ShieldGemma 9B	755	12	434	71	333	0.525	0.145	0.035	0.859	0.056	0.041	0.447	0.447
ShieldGemma 27B	795	144	335	170	201	0.564	0.459	0.417	0.663	0.437	0.425	0.540	0.540

Appendix

Table 14: Majority Vote - Aggregation

Static Guardrails & Baselines
Method	AVERAGE		AdvBenchM		JailJudge		WildGuard		HarmBench		SafeRLHF		BeaverTails		XSTEST		ToxicChat
Method	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1
LlamaGuard 4	0.81	0.77	0.96	0.98	0.72	0.75	0.76	0.66	0.84	0.86	0.83	0.84	0.63	0.71	0.94	0.83	0.77	0.57
LlamaGuard 3	0.78	0.73	0.98	0.99	0.67	0.72	0.81	0.69	0.76	0.80	0.86	0.87	0.65	0.73	0.82	0.61	0.70	0.39
ShieldGemma 2B	0.60	0.42	0.34	0.51	0.52	0.35	0.66	0.29	0.53	0.46	0.62	0.52	0.55	0.60	0.84	0.62	0.71	0.05
ShieldGemma 9B	0.46	0.15	0.00	0.00	0.44	0.23	0.61	0.11	0.36	0.04	0.44	0.18	0.33	0.26	0.76	0.15	0.71	0.22

Appendix

Table 15: Audited Performance Metrics: Accuracy and F 1 scores across all benchmarks following the manual data audit. Bold indicates best performance. Note: CourtGuard maintains superior robustness across high-noise datasets (BeaverTails, ToxicChat) through policy-grounded adjudication.

Defense Method	Valid	Confusion Matrix				Aggregated Metrics
Defense Method	Count	TP	TN	FP	FN	Acc	Prec	Rec	Spec	F1	F2	AUC	ROC AUC
LlamaGuard 4	1785	599	801	185	200	0.784	0.764	0.750	0.812	0.757	0.753	0.781	0.781
LlamaGuard 3	1785	586	773	213	213	0.761	0.733	0.733	0.784	0.733	0.733	0.759	0.759
ShieldGemma 2B	1785	242	872	114	557	0.624	0.680	0.303	0.884	0.419	0.341	0.594	0.594
ShieldGemma 9B	1785	83	856	130	716	0.526	0.390	0.104	0.868	0.164	0.122	0.486	0.486
ShieldGemma 27B	1785	420	644	342	379	0.596	0.551	0.526	0.653	0.538	0.531	0.589	0.589

Appendix

Table 16: Audited Performance Aggregation: Final performance across 8 benchmarks (

N=1785

Zero-Shot Policy Transfer

See all 14 papers

AdaGuard: Enhancing Safety and Policy Compliance with Reasoning-Enabled LLM-As-A-Judge Guardrails
Oct 6, 2026Melissa Kazemi Rad, Sihui Dai, Isha Slavin +6LLM Guardrails LLM Safety
Capital One
AdaGuard: An Adaptive Guard Model with User-defined Policies
Sep 28, 2026Yunhao Feng, Yifan Ding, Yuxiang Xie +4LLM Guardrails AI Agent Safety
National University of Defense Technology · Fudan University
Reflect-Guard: Enhancing LLM Safeguards against Adversarial Prompts via Logical Self-Reflection
May 24, 2026Lixing Lin, Juli You, Yue Li +4Language Model Safety Evaluation LLM Guardrails
yaleYale University, New Haven, CT, USA · indIndependent Researcher · columbiaColumbia University, New York, NY, USA +2

Oct 6, 2026J/K move · Enter open · S save

AdaGuard: Enhancing Safety and Policy Compliance with Reasoning-Enabled LLM-As-A-Judge Guardrails

Melissa Kazemi Rad, Sihui Dai, Isha Slavin, Kushal Chawla+5

Capital One

LLM Guardrails LLM Safety Content Moderation LLM-as-a-Judge

Open paper AskPDF arXiv

Enterprise generative AI applications require robust safety mechanisms that can accommodate diverse risk postures, evolving policies, and varying latency constraints. Current guardrail solutions often suffer from rigidity, relying on fixed policy sets and offering limited transparency or reasoning flexibility. We present Adaguard, an adaptive LLM-as-a-Judge framework designed to address these challenges through dynamic policy enforcement and adaptive reasoning-budget allocation. Built using supervised fine-tuning (SFT) and reinforcement learning (GRPO), AdaGuard generalizes to user-defined safety and compliance policies at runtime without requiring frequent model updates. A core innovation of our approach is the ability to dynamically infer the complexity of input-policy pairs, allowing the model to switch between high-speed black-box inference and explainable, reasoning-enabled moderation. This flexibility enables developers to balance stringent latency requirements with the need for actionable transparency. This adaptive capability allows AdaGuard to rival other guardrail and frontier models several times its size, while its auto-reasoning mode recovers the accuracy of always-on reasoning at a fraction of the latency

Abstract

Zero-Shot Policy Transfer

Explore similar work

AdaGuard: Enhancing Safety and Policy Compliance with Reasoning-Enabled LLM-As-A-Judge Guardrails

AdaGuard: An Adaptive Guard Model with User-defined Policies

Reflect-Guard: Enhancing LLM Safeguards against Adversarial Prompts via Logical Self-Reflection