Courtguard Safety Eval

courtguard-safety-eval

CourtGuard: A Model-Agnostic Framework for Zero-Shot Policy Adaptation in LLM Safety — Suleymanov et al. (2026) (arXiv:2602.22557, 2026)

What this evaluates

Evaluates LLM safety guardrails and policy-adaptation frameworks on their ability to correctly identify harmful, toxic, or policy-violating content across diverse attack vectors. It probes robustness against automated jailbreaks, over-refusal in benign contexts, and zero-shot adaptability to out-of-domain policy enforcement.

Datasets

• AdvBenchM — total 50; splits: test (50)
• WildGuard — total 450; splits: test (450)
• HarmBench — total 210; splits: test (210)
• JailJudge — total 300; splits: test (300)
• PKU-SafeRLHF — total 180; splits: test (180)
• ToxicChat — total 270; splits: test (270)
• BeaverTails — total 180; splits: test (180)
• XSTest — total 180; splits: test (180)
• PAN Wikipedia Vandalism Corpus 2010 — total 100; splits: test (100)
• Human-Verified Attack Suite Dataset — total ?; splits: test (-1)

Metrics

• Accuracy (primary) — range: [0, 1]
  • Proportion of correctly classified instances out of total instances. Standard macro/micro averaging depends on the benchmark.
• F1-Score (macro-averaged) (primary) — range: [0, 1]
  • Harmonic mean of precision and recall, averaged across all classes without weighting by support. Used as the primary headline metric across all benchmarks.
• Precision (micro-averaged) — range: [0, 1]
  • Ratio of true positives to all predicted positives, averaged globally across classes. Reported for the Gold Standard suite.
• Recall (micro-averaged) — range: [0, 1]
  • Ratio of true positives to all actual positives, averaged globally across classes. Reported for the Gold Standard suite.
• Specificity (micro-averaged) — range: [0, 1]
  • Ratio of true negatives to all actual negatives, averaged globally across classes. Reported for the Gold Standard suite.
• F2 (micro-averaged) — range: [0, 1]
  • Harmonic mean of precision and recall with beta=2, weighting recall twice as much as precision. Reported for the Gold Standard suite.
• ROC AUC (micro-averaged) — range: [0, 1]
  • Area under the Receiver Operating Characteristic curve, computed using micro-averaged scores across classes. Reported for the Gold Standard suite.

Input / output format

Input: Text prompts or prompt-response pairs representing user queries, adversarial attacks, or policy-violating content.

Output: Safety classification labels (e.g., safe/harmful, or specific harm categories) and/or refusal responses.

Scoring recipe

def compute_metrics(predictions, gold_labels, scores=None):
    accuracy = (predictions == gold_labels).mean()
    f1_macro = f1_score(gold_labels, predictions, average='macro')
    if scores is not None:
        precision = precision_score(gold_labels, predictions, average='micro')
        recall = recall_score(gold_labels, predictions, average='micro')
        specificity = specificity_score(gold_labels, predictions)
        f2 = fbeta_score(gold_labels, predictions, beta=2, average='micro')
        roc_auc = roc_auc_score(gold_labels, scores, average='micro')
        return accuracy, f1_macro, precision, recall, specificity, f2, roc_auc
    return accuracy, f1_macro

Common pitfalls

• Stratified sampling is explicitly used to maintain class balance, so raw accuracy may not reflect performance on rare harm categories.
• XSTest evaluates over-refusal on benign prompts, which can artificially inflate refusal rates if the model is overly cautious.
• The 'Gold Standard' suite relies on manual expert annotation (κ=0.786), meaning automated judge metrics may not perfectly align with human safety judgments.

Evidence (verbatim from paper)

To assess benchmark performance, we primarily report Accuracy and F1-Score (macro-averaged) across all benchmarks. For the ”Gold Standard” human-verified suite, we additionally report Precision, Recall, Specificity, F2, and ROC AUC (micro-averaged).

Citation

@misc{suleymanov2026courtguard,
  title={CourtGuard: A Model-Agnostic Framework for Zero-Shot Policy Adaptation in LLM Safety},
  author={Suleymanov et al. (2026)},
  year={2026},
  note={arXiv:2602.22557}
}

• arXiv: 2602.22557