SAFETY SENTRY: Context-Aware Human Intervention via EXECUTE-ASK-REFUSE Routing
Safety Sentry is a lightweight guard model that implements per-instance three-way routing (EXECUTE / ASK / REFUSE) in a single decoding call, enabling dynamic risk-threshold adjustment across deployments without retraining; it outperforms broad open-weight and frontier closed-source baselines—including Llama-Guard-3, GPTGuard, and Gemini Safety Classifier—on overall accuracy and safety-related recall while jointly controlling both directional error rates.
Problem: Structural Limitations of Binary Guarding
LLM agents act on real-world environments via tool calls, where a single misjudged action can cause irreversible harm. The standard safeguard—a binary guard model labeling each proposed action as safe or unsafe—conflates two orthogonal decisions: (1) whether the action is inherently harmful, and (2) whether it is contextually appropriate for the user. Moreover, its granularity operates at the action category level (e.g., ‘send email’) rather than the instance level (e.g., ‘send email containing PII to external recipient’), resulting in routine, low-signal interruptions that erode user autonomy and train users to dismiss high-stakes alerts.
Innovation: Three-Way Routing + Single-Decoding Lightweight Architecture
Safety Sentry reframes guarding as a per-instance three-way routing decision:
- EXECUTE: Action is both inherently safe and contextually appropriate → execute directly;
- ASK: Action is not inherently harmful but requires user confirmation on contextual appropriateness (e.g., privacy, timeliness, permissions);
- REFUSE: Action is inherently hazardous (e.g., privilege escalation, data leakage, destructive operation) → block unconditionally.
Its core is a lightweight guard model whose inference reduces to a single decoding call. A single decoding-time threshold enables one fixed checkpoint (e.g., safetysentry-1.0) to be repositioned across deployments with differing risk tolerance (e.g., healthcare vs. customer support) — without any fine-tuning or retraining.
Empirical Results: Balanced Performance Across Accuracy, Safety Recall, and Error Control
- On benchmarks reported in arXiv:2607.13594v1, Safety Sentry surpasses a broad set of baselines—including Llama-Guard-3, Microsoft’s GPTGuard, and Google’s Gemini Safety Classifier—in both overall accuracy and safety-related recall;
- It is the first guard model to simultaneously control both directional error rates: false EXECUTE (unsafe actions mistakenly executed) and false REFUSE (safe, contextually valid actions unnecessarily blocked).