ServiceNow’s research team just open-sourced AprielGuard, an 8 billion-parameter model designed to be the safety classifier that actually understands how modern AI systems get attacked. It’s not another toxicity filter — it’s built to catch sixteen categories of safety risk and a wide spectrum of adversarial manipulation across the messy, multi-step workflows that production agents actually run.
Most teams currently patch safety together with a brittle stack: one guard model for the user prompt, some regex rules for known jailbreak patterns, and a lot of hope when the agent starts chaining tool calls and reasoning steps. That approach falls apart the moment an attack spans multiple turns or hides inside a chain-of-thought trace. AprielGuard ingests the full picture — standalone prompts, multi-turn conversations, or entire agentic workflows including tool calls, memory, and system context — and outputs both a safety classification and an adversarial binary flag. It can also produce structured reasoning explaining its call, which is useful for audits and debugging, but there’s a non-reasoning mode for when latency matters.
The training pipeline is where things get interesting. The team used Mixtral-8x7B and internally developed uncensored models to generate unsafe content at high temperature, building a synthetic dataset organized at the sub-topic level of their taxonomy. They then layered on data augmentation that goes well beyond basic paraphrasing: character-level noise, typos, leetspeak, syntactic reordering — the kind of real-world crud that trips up brittle classifiers. For multi-turn resilience, they used NVIDIA NeMo Curator to generate long-horizon conversations with evolving attacks and context switches.
This is a direct response to the gap between academic safety benchmarks and what production teams actually face. The model targets attacks that exploit reasoning traces, poison memory, hijack context, or coordinate across multiple agents — threats that traditional classifiers were never designed to see. The open question is how well an 8B model generalizes to novel attack patterns it hasn’t encountered in training, but the unified taxonomy approach is a genuine step beyond the fragile patchwork most teams are stuck with.
