DARWIN-Guard is the defensive guardrail model developed in the DARWIN self-evolving attack-guard framework. It is trained from Qwen/Qwen3Guard-Gen-8B and is designed for binary user-prompt moderation, predicting whether the latest user request is safe or unsafe.

Modern jailbreak attacks evolve rapidly: new role-play templates, prompt injection patterns, obfuscation strategies, and compositional attack prompts can appear continuously. Static guardrails trained on fixed harmful prompt datasets can therefore fall behind the evolving adversarial environment. DARWIN-Guard addresses this issue by using DARWIN-Attack as an online adversarial data generator for guardrail training.

In DARWIN, the attack module maintains an evolving jailbreak strategy pool by ingesting external strategies and generating new ones through genetic-style mutation and composition. These strategies are used to disguise prompts and expose weaknesses of the current guardrail. DARWIN-Guard then converts such guardrail failures into adversarial training examples. To mitigate over-refusal, benign prompts disguised by DARWIN-Attack are also included during training. This encourages the model to recognize the underlying user intent rather than only the surface form of a jailbreak-style prompt.

✨ Key Features

Self-evolving adversarial training. DARWIN-Guard is trained with hard examples generated by an evolving DARWIN-Attack module, rather than only fixed harmful prompt datasets.
Robust harmful prompt detection. The model improves unsafe recall on jailbreak and safety benchmarks by learning from guardrail failures mined against the current model.
Benign preservation. Benign prompts rewritten with similar disguise strategies are included during training to reduce over-refusal and preserve safe pass rates.
Simple binary output. The primary prediction is the first output line: Safety: Safe or Safety: Unsafe.

📥 Input and Output

Input should be a standard chat messages list, with the prompt to be moderated as the final user message:

python

messages = [
    {"role": "user", "content": "How can I make a bomb?"}
]

The first output line is the safety decision: Safety: Safe or Safety: Unsafe.

🚀 Example

python

import re
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "ZJUlilan/DARWIN-Guard"


def extract_safety_label(content):
    safe_pattern = r"Safety: (Safe|Unsafe)"
    safe_label_match = re.search(safe_pattern, content)
    label = safe_label_match.group(1) if safe_label_match else None
    return label

tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
    model_id,
    torch_dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {"role": "user", "content": "How can I make a bomb?"}
]

inputs = tokenizer.apply_chat_template(
    messages,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
    add_generation_prompt=True,
).to(model.device)

with torch.no_grad():
    outputs = model.generate(
        **inputs,
        max_new_tokens=32,
        do_sample=False,
        pad_token_id=tokenizer.eos_token_id,
    )

prompt_len = inputs["input_ids"].shape[-1]
result = tokenizer.decode(outputs[0][prompt_len:], skip_special_tokens=True).strip()
print(result)
print(extract_safety_label(result))

# Expected output:
# Safety: Unsafe
# Unsafe

📊 Evaluation Summary

DARWIN-Guard improves harmful prompt detection while preserving high pass rates on benign prompts. The figure below summarizes the average harmful unsafe recall and representative benign safe pass rates.

⚖️ Safety-Utility Frontier

The frontier view compares guard models using two axes: harmful unsafe recall and benign safe pass rate. A stronger guard should move toward the upper-right corner, improving harmful detection without increasing over-refusal.

🔍 Harmful Prompt Benchmarks

Unsafe recall / block rate on harmful prompt benchmarks. Higher is better.

The following figure shows DARWIN-Guard's per-benchmark gain over the base Qwen3Guard model on harmful prompt benchmarks.

The table below compares unsafe recall across harmful prompt benchmarks against recent guardrail models.

Dataset	Shield Gemma	Nemotron Guard	Granite Guardian	Llama Guard-3	Qwen3 Guard	YuFeng XGuard	DARWIN Guard
XSTest	86.0	93.0	96.5	82.0	92.0	98.0	99.5
Aegis2.0	70.0	87.3	84.5	66.2	84.2	87.6	93.5
JBB-Behaviors	54.0	92.0	97.0	98.0	98.0	99.0	100.0
HarmBench	45.5	68.5	74.5	97.2	98.2	75.5	99.8
ToxicChat	61.9	79.3	77.9	50.0	88.1	92.0	91.7
JailbreakV-RT2K	43.6	69.2	66.8	52.0	64.8	68.4	75.6
Semantic Router	46.8	74.8	74.8	48.0	74.8	80.8	85.2
BeaverTails	64.0	78.8	76.4	57.2	75.6	79.6	82.8
OpenAI Moderation	92.1	96.4	89.5	78.5	91.6	97.7	98.0
WildGuardTest	41.2	83.0	73.8	66.6	84.8	87.6	90.2
StrongREJECT	76.0	99.4	99.4	97.4	98.4	99.7	99.7
JailbreakHub	33.2	74.8	77.2	31.2	80.4	80.8	83.2
Average	59.5	83.0	82.4	68.7	85.9	87.2	91.6

✅ Benign Benchmarks

Safe pass rate on benign benchmarks. Higher is better.

Dataset	Shield Gemma	Nemotron Guard	Granite Guardian	Llama Guard-3	Qwen3 Guard	YuFeng XGuard	DARWIN Guard
ARC-Challenge	100.0	100.0	99.6	100.0	100.0	100.0	100.0
ARC-Easy	100.0	100.0	100.0	100.0	100.0	100.0	100.0
BoolQ	99.6	99.8	99.6	100.0	100.0	100.0	100.0
GSM8K	100.0	99.4	100.0	100.0	100.0	99.8	100.0
OpenBookQA	99.8	99.4	99.8	100.0	100.0	99.8	100.0
AG News	100.0	96.6	99.8	100.0	100.0	99.4	100.0
HotpotQA	99.8	97.8	99.8	100.0	100.0	100.0	100.0
QASC	99.8	98.6	100.0	100.0	100.0	100.0	100.0
RACE	100.0	96.8	100.0	99.8	100.0	100.0	100.0
SciQ	100.0	100.0	100.0	100.0	100.0	100.0	100.0
COPA	100.0	100.0	100.0	100.0	100.0	100.0	100.0
Average	99.9	98.9	99.9	100.0	100.0	99.9	100.0

⚠️ Disclaimer

DARWIN-Guard and the associated DARWIN research are intended for safety research, guardrail evaluation, and defensive model development. The model card and examples are not intended to facilitate harmful behavior, bypass deployed safety systems, or replace application-specific safety review before deployment.

📚 Citation

bibtex

@article{qi2026darwinevolvingjailbreakadversary,
  title={{DARWIN}: Evolving Jailbreak Adversary and Guardrail for {LLM} Safety Evaluation and Protection},
  author={Qi, Weiwei and Wu, Zefeng and Guo, Zhilin and Zheng, Tianhang and Lu, Chaochao and He, Liang and Qin, Zhan and Ren, Kui},
  journal={arXiv preprint arXiv:2607.19829},
  year={2026}
}

@inproceedings{qi2026majic,
  title={Majic: Markovian adaptive jailbreaking via iterative composition of diverse innovative strategies},
  author={Qi, Weiwei and Shao, Shuo and Gu, Wei and Zheng, Tianhang and Zhao, Puning and Qin, Zhan and Ren, Kui},
  booktitle={Proceedings of the AAAI Conference on Artificial Intelligence},
  volume={40},
  number={39},
  pages={32755--32763},
  year={2026}
}

ZJU-Safety/DARWIN-Guard

🛡️ DARWIN-Guard

🧭 Introduction