CorrectGuard: Eyes-Off Correctness Estimation for Black-Box Security Guardrails

What it is

CorrectGuard trains an external "Correctness Model" (CM) to predict whether a black-box security guardrail's decision on a given input was right or wrong, without needing access to the guardrail's internals and without the evaluator needing to inspect the raw input in the machine-eyes-off case. It's evaluated against three open-weight guardrails used as black-box proxies: Granite Guardian 3.1 2B, Qwen3Guard 8B, and GPT-OSS-Safeguard-20B, across 13 public datasets (listed with exact record counts in Table I, e.g., wildjailbreak 6,000, advbench 520, injecagent 1,054).

How it works

Each CM variant receives the input x and the guardrail's decision ŷ (or a privacy-preserving transform of x) and outputs P(guardrail decision correct). Three CM families are compared: (1) ICL-based, using GPT-5.4 with 10 labeled demonstrations, in three variants — fixed-prompt ICL, DSPy-optimized prompts/demos, and a hybrid; (2) embedding-based MLPs — Dense-MLP on 3,072-dim text-embedding-3-large vectors, and Binary-MLP on 3,072-bit BinaryShield fingerprints (sign-quantized embeddings with noise injection at α=2, after PII redaction via Microsoft Presidio) for the machine-eyes-off setting; (3) LoRA-finetuned LLMs (Qwen2.5-7B, Llama-3.1-8B, Phi-4-14B; rank r=16, α=32, dropout 0.05, lr 2×10⁻⁵), with correctness probability taken from normalized logits, plus post-hoc calibration (temperature scaling, Platt scaling, isotonic regression) fit on a held-out calibration split. All approaches are evaluated under Leave-One-Dataset-Out (LODO): each of the 13 datasets is held out in turn while the rest train/tune the CM, simulating an unseen production distribution.

Preconditions / Affected

Applies to deployments where guardrail inputs are inaccessible to human reviewers (zero-retention/zero-access configs) or, in the stricter case, to the auditing model itself (machine eyes-off, using only BinaryShield fingerprints as features). Requires labeled "eyes-on" data from other distributions to train the CM; no labeled production data is used or needed.

What to do

The paper reports concrete operating numbers rather than a procedure to run: ICL-based CMs give up to a 25-point macro-accuracy gain in error identification over baseline; finetuned CMs give close to 15 points but transfer inconsistently across guardrails/datasets. For ranking/abstention (3 guardrails tested), the best correctness rankings cut AURC from an unranked baseline of 0.33–0.44 down to 0.17–0.22, and the best operating points retain 37.5–52.0% of guardrail decisions while holding observed risk at 15%. A key finding for prioritization: correctness-model lift shrinks as the underlying guardrail's own baseline accuracy increases (Fig. 2) — meaning this approach pays off most for weaker/less-reliable guardrails, with diminishing returns once a guardrail is already strong.

Caveats

The machine-eyes-off variant (BinaryShield fingerprints only) gives only "mixed," modest accuracy and ranking gains across all three guardrails — it does not reproduce the strength of the human-eyes-off results. Finetuned evaluators "do not consistently transfer across guardrails and datasets," and the paper states explicitly that correctness estimation is "not a universally reliable monitor," with shared failure modes across CMs and strong variation by held-out dataset. Raw correctness probabilities can keep useful ranking ability even as their calibration degrades under distribution shift.