CorrectGuard: Eyes-Off Correctness Estimation for Black-Box Security Guardrails

What it claims

An external correctness model (CM), trained only on labeled public data, can flag when a black-box guardrail's binary decision is wrong on inputs nobody may inspect. Gains are uneven:

• ICL evaluators (GPT-5.4) give the largest lift, up to +25 points macro accuracy.
• LoRA fine-tuned CMs give a lift of nearly 15 points but "do not consistently transfer across guardrails and datasets."
• The machine eyes-off variant sees only noisy binary fingerprints of the input. It gives only "modest" accuracy and ranking gains.
• Lift shrinks as the guardrail gets stronger.
• Abstention: at 15% observed risk, the best rankings keep 37.5–52.0% of guardrail decisions.

How it works

1. Build training data. The authors run 13 public datasets through each guardrail and record tuples (input, guardrail decision, correct?). Datasets with more than 6k records are sampled down to a fixed 6k. Each guardrail gets its own CM because each one errs on different inputs.
2. Choose the guardrails. Three open-weight models stand in for black boxes: Granite Guardian 3.1 2B, Qwen3Guard 8B and GPT-OSS-Safeguard-20B. Their baseline accuracies differ substantially.
3. Train three CM families: - ICL: GPT-5.4 with 10 labeled demonstrations from the source folds. There are three variants: fixed prompt (ICL), DSPy-optimized prompt and demonstrations (DSPy), and fixed prompt with DSPy demonstrations (Hybrid). It returns text verdicts only, because the endpoint exposes no token probabilities. - MLP: input is either a 3,072-d text-embedding-3-large vector (Dense-MLP) or a 3,072-bit BinaryShield fingerprint (Binary-MLP), concatenated with the guardrail decision. Layers are 256→128 with ReLU and dropout 0.2. Training uses AdamW (lr 1e-3, weight decay 1e-4), batch 256, at most 50 epochs, and early stopping on validation Brier score. The decision threshold is chosen by F1 for detecting incorrect decisions. - Fine-tuned LLMs: Qwen2.5-7B, Llama-3.1-8B and Phi-4-14B with LoRA (r=16, α=32, dropout 0.05, lr 2e-5). The correctness probability comes from normalized logits. Post-hoc temperature, Platt and isotonic calibration are fitted on a held-back 25% split.
4. Evaluate with leave-one-dataset-out (LODO). Each dataset is held out in turn as the "unseen production" distribution.

flowchart LR
  X[Production input] --> P{Machine may read input?}
  P -- yes --> T[Text or dense embedding]
  P -- no --> B[PII redaction + BinaryShield fingerprint]
  G[Guardrail decision] --> CM[Correctness model]
  T --> CM
  B --> CM
  CM --> R[Rank / abstain]

BinaryShield fingerprints are made in three steps: redact PII with Presidio, sign-quantize the embedding, and add noise with α=2. The page describes the result as "DP-style" protection.

Evidence

The 13 datasets and their sizes:

Headline numbers, from the abstract and introduction:

• AURC: falls from unranked baselines of 0.33–0.44 to 0.17–0.22 across the 3 guardrails.
• Accuracy lift: up to +25 points for ICL and about +15 points for fine-tuning.
• Calibration: raw correctness probabilities keep useful ranking ability even when calibration degrades under shift.

How to use it

No code, weights or prompts are released on the fetched page. Prompts and DSPy details are said to be in Appendix A.

To reproduce the strongest variant you need:

• one CM per guardrail;
• a GPT-5.4-class API for ICL;
• text-embedding-3-large for either MLP variant;
• Presidio plus BinaryShield for the privacy-restricted setting.

The authors chose 7–14B fine-tuning models deliberately, because serving cost matters for continuous monitoring of production traffic.

Limits

• Not a universal monitor. Performance varies sharply by guardrail and held-out dataset, and some failures are shared across all CMs. The authors say plainly that external correctness estimation "is not a universally reliable monitor."
• ICL breaks the strict privacy setting. The best method sends raw input text to an external API, so it only fits the human eyes-off setting.
• The privacy-preserving variant is weak. Fingerprint-based results are described as initial and mixed.
• ICL outputs are binary. There are no probabilities, which limits fine-grained ranking.
• Proxies, not real black boxes. All guardrails are open-weight; no commercial API guardrail is tested.
• Calibration is unresolved. The authors name transferable calibration as an open challenge for population-level performance estimates.
• Truncated page. The fetched text ends mid-methods, so the per-guardrail and per-dataset result tables were not available to check.