ICML 2025

SHIELDAGENT: Shielding Agents via Verifiable Safety Policy Reasoning
Zhaorun Chen 1 Mintong Kang 2 Bo Li 1 2
Abstract
Autonomous agents powered by foundation mod-
els have seen widespread adoption across vari-
ous real-world applications. However, they re-
main highly vulnerable to malicious instructions
and attacks, which can result in severe conse-
quences such as privacy breaches and financial
losses. More critically, existing guardrails for
LLMs are not applicable due to the complex
and dynamic nature of agents. To tackle these
challenges, we propose SHIELDAGENT, the first
guardrail agent designed to enforce explicit safety
policy compliance for the action trajectory of
other protected agents through logical reason-
ing. Specifically, SHIELDAGENT first constructs
a safety policy model by extracting verifiable
rules from policy documents and structuring them
into a set of action-based probabilistic rule cir-
cuits. Given the action trajectory of the protected
agent, SHIELDAGENT retrieves relevant rule cir-
cuits and generates a shielding plan, leveraging its
comprehensive tool library and executable code
for formal verification. In addition, given the
lack of guardrail benchmarks for agents, we in-
troduce SHIELDAGENT-BENCH, a dataset with
3K safety-related pairs of agent instructions and
action trajectories, collected via SOTA attacks
across 6 web environments and 7 risk categories.
Experiments show that SHIELDAGENT achieves
SOTA on SHIELDAGENT-BENCH and three ex-
isting benchmarks, outperforming prior meth-
ods by 11.3% on average with a high recall of
90.1%.
Additionally, SHIELDAGENT reduces
API queries by 64.7% and inference time by
58.2%, demonstrating its high precision and effi-
ciency in safeguarding agents. Our project is avail-
able and continuously maintained here: https:
//shieldagent-aiguard.github.io/
1University of Chicago, Chicago IL, USA 2University of Illinois
at Urbana-Champaign, Champaign IL, USA. Correspondence to:
Zhaorun Chen, Bo Li <{zhaor...