# Courtguard Safety Eval

> Evaluates LLM safety guardrails and policy-adaptation frameworks on their ability to correctly identify harmful, toxic, or policy-violating content across diverse attack vectors. It probes robustness against automated jailbreaks, over-refusal in benign contexts, and zero-shot adaptability to out-of-domain policy enforcement. Use when the user wants to benchmark on AdvBenchM, WildGuard, HarmBench, JailJudge, PKU-SafeRLHF, ToxicChat, BeaverTails, XSTest, PAN Wikipedia Vandalism Corpus 2010, Human-Verified Attack Suite Dataset, or asks about evaluating this task. Reports Accuracy, F1-Score (macro-averaged).

- Skill: `qhjqhj00/courtguard-safety-eval` (Agent Skill)
- Install (CLI): `npx skillmds add qhjqhj00/courtguard-safety-eval`
- Raw SKILL.md: https://api.skillmd.com/api/skills/qhjqhj00/courtguard-safety-eval/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: qhjqhj00 (https://skillmd.com/u/qhjqhj00)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/qhjqhj00/courtguard-safety-eval

---


# courtguard-safety-eval

> CourtGuard: A Model-Agnostic Framework for Zero-Shot Policy Adaptation in LLM Safety — Suleymanov et al. (2026) (arXiv:2602.22557, 2026)

## What this evaluates

Evaluates LLM safety guardrails and policy-adaptation frameworks on their ability to correctly identify harmful, toxic, or policy-violating content across diverse attack vectors. It probes robustness against automated jailbreaks, over-refusal in benign contexts, and zero-shot adaptability to out-of-domain policy enforcement.

## Datasets

- **AdvBenchM** — total 50; splits: test (50)
- **WildGuard** — total 450; splits: test (450)
- **HarmBench** — total 210; splits: test (210)
- **JailJudge** — total 300; splits: test (300)
- **PKU-SafeRLHF** — total 180; splits: test (180)
- **ToxicChat** — total 270; splits: test (270)
- **BeaverTails** — total 180; splits: test (180)
- **XSTest** — total 180; splits: test (180)
- **PAN Wikipedia Vandalism Corpus 2010** — total 100; splits: test (100)
- **Human-Verified Attack Suite Dataset** — total ?; splits: test (-1)

## Metrics

- `Accuracy` **(primary)** — range: [0, 1]
  - Proportion of correctly classified instances out of total instances. Standard macro/micro averaging depends on the benchmark.
- `F1-Score (macro-averaged)` **(primary)** — range: [0, 1]
  - Harmonic mean of precision and recall, averaged across all classes without weighting by support. Used as the primary headline metric across all benchmarks.
- `Precision (micro-averaged)` — range: [0, 1]
  - Ratio of true positives to all predicted positives, averaged globally across classes. Reported for the Gold Standard suite.
- `Recall (micro-averaged)` — range: [0, 1]
  - Ratio of true positives to all actual positives, averaged globally across classes. Reported for the Gold Standard suite.
- `Specificity (micro-averaged)` — range: [0, 1]
  - Ratio of true negatives to all actual negatives, averaged globally across classes. Reported for the Gold Standard suite.
- `F2 (micro-averaged)` — range: [0, 1]
  - Harmonic mean of precision and recall with beta=2, weighting recall twice as much as precision. Reported for the Gold Standard suite.
- `ROC AUC (micro-averaged)` — range: [0, 1]
  - Area under the Receiver Operating Characteristic curve, computed using micro-averaged scores across classes. Reported for the Gold Standard suite.

## Input / output format

**Input**: Text prompts or prompt-response pairs representing user queries, adversarial attacks, or policy-violating content.

**Output**: Safety classification labels (e.g., safe/harmful, or specific harm categories) and/or refusal responses.

## Scoring recipe

```python
def compute_metrics(predictions, gold_labels, scores=None):
    accuracy = (predictions == gold_labels).mean()
    f1_macro = f1_score(gold_labels, predictions, average='macro')
    if scores is not None:
        precision = precision_score(gold_labels, predictions, average='micro')
        recall = recall_score(gold_labels, predictions, average='micro')
        specificity = specificity_score(gold_labels, predictions)
        f2 = fbeta_score(gold_labels, predictions, beta=2, average='micro')
        roc_auc = roc_auc_score(gold_labels, scores, average='micro')
        return accuracy, f1_macro, precision, recall, specificity, f2, roc_auc
    return accuracy, f1_macro
```

## Common pitfalls

- Stratified sampling is explicitly used to maintain class balance, so raw accuracy may not reflect performance on rare harm categories.
- XSTest evaluates over-refusal on benign prompts, which can artificially inflate refusal rates if the model is overly cautious.
- The 'Gold Standard' suite relies on manual expert annotation (κ=0.786), meaning automated judge metrics may not perfectly align with human safety judgments.

## Evidence (verbatim from paper)

> To assess benchmark performance, we primarily report Accuracy and F1-Score (macro-averaged) across all benchmarks. For the ”Gold Standard” human-verified suite, we additionally report Precision, Recall, Specificity, F2, and ROC AUC (micro-averaged).

## Citation

```bibtex
@misc{suleymanov2026courtguard,
  title={CourtGuard: A Model-Agnostic Framework for Zero-Shot Policy Adaptation in LLM Safety},
  author={Suleymanov et al. (2026)},
  year={2026},
  note={arXiv:2602.22557}
}
```

- arXiv: 2602.22557