AprielGuard detects attacks against AI agents

ServiceNow AI has introduced AprielGuard, an 8 billion parameter model designed to detect both dangerous content and attacks intended to manipulate AI systems. It is built for models that no longer just answer questions, but also use tools, retrieve memories, run code and make decisions across multiple steps.

The difference lies in the types of threats it aims to cover. A traditional filter can identify insults or sexual content in an isolated message. AprielGuard also analyzes long conversations and complete workflows to find hidden instructions, attempts to bypass rules, or malicious changes to an agent’s memory and tools.

What AprielGuard detects

The model classifies 16 categories of security risks, including:

• Toxic content, hate and unfair representations.
• Adult content, self-harm and illegal activities.
• Disinformation, fraud, manipulation and influence attempts.
• Financial risks, security threats and privacy violations.
• Defamation, dangerous information and property violations.

It also looks for adversarial attacks. These are techniques designed to make a model ignore its instructions or act outside its intended limits. The system covers cases such as prompt injection, an attack that inserts malicious instructions into seemingly normal text, as well as jailbreaks, context hijacking, reasoning corruption, memory poisoning and tool manipulation.

For example, in an agent that summarizes documents, a harmful instruction could be hidden in a page retrieved by the system. In another case, an attacker could alter a parameter before the agent calls an API. AprielGuard attempts to review those parts of the process, not just the user’s initial message.

A filter for conversations and agents

The model accepts three types of input:

• A standalone message or instruction.
• A multi-turn conversation.
• An agent workflow containing system messages, reasoning, memory, tool calls and intermediate results.

It can run in fast mode, which returns only the classification, or in reasoning mode, which adds a structured explanation of the decision. The first is intended for systems that need low latency. The second provides more context for reviewing why an input was flagged, but takes more time and resources.

It is based on an 8 billion parameter version of Apriel-1.5 Thinker Base. The model supports contexts of up to 32,000 tokens, a unit of text that allows it to process long documents and conversations, and was designed to run with bfloat16 precision, which is common in AI workloads.

Results: strong performance, but no guarantee

In public tests, AprielGuard achieved high scores across several datasets. Its F1 score, a metric that combines precision with the ability to find dangerous cases, reached 1.00 on HarmBench and 0.98 on SimpleSafetyTests. Against adversarial attacks, it reached 0.98 on Salad-Data and 1.00 on ChatGPT-Jailbreak-Prompts.

The results were not the same in every test. On a dataset focused on instruction injections, it achieved an F1 score of 0.68, while on another dataset of attacks against instructions, it reached 0.73. This matters because detecting a known attack does not mean recognizing every new attack.

In an internal evaluation with agent workflows and texts of up to 32,000 tokens, the mode without reasoning achieved an F1 score of 0.97 for security risks and 0.88 for adversarial attacks. With reasoning enabled, the F1 scores were 0.95 and 0.94, respectively. The tradeoff was a higher false-positive rate, meaning the proportion of safe cases flagged by mistake.

Synthetic data and model limitations

The model was trained mainly on synthetic data generated by other models and automated techniques. The team created long conversations, tool-use scenarios, altered memory states and interactions between multiple agents. It also added typos, changes in word order, paraphrases and leetspeak substitutions to test whether the detector could withstand superficial variations.

There are several important caveats. Although it was evaluated in English, German, Spanish, French, Canadian French, Italian, Dutch, Brazilian Portuguese and Japanese, most of its training was in English. ServiceNow recommends testing and calibrating it before using it in production in other languages.

It can also fail when facing new attacks, highly specialized text, or legal, medical and scientific contexts. It should not be treated as a single barrier either: a security model can also make mistakes, block legitimate content or miss a sophisticated manipulation.

For you, the potential change is behind assistants that work with your documents, accounts or tools. Instead of applying separate filters to each stage, companies could use a single guardrail to review messages, memory, service calls and results. What remains to be seen is whether this approach maintains its accuracy outside synthetic scenarios and against attacks its creators did not anticipate.