AdaptiveSafety · cua-exea-policy

User-defined policies. Agent interactions. Complete rule-level verdicts.

AdaptiveSafety is the policy-conditioned safety dataset introduced with AdaGuard. Each example pairs a policy and an interaction record with an analysis and the complete set of violated rule identifiers. Policies are supplied as part of each example rather than drawn from a fixed risk taxonomy.

cua-exea-policy is the repository name for this release. CUA_exea_policy is the corresponding identifier used in evaluation records; AdaptiveSafety is the dataset name used in the paper.

Paper · Code · AdaGuard-0.6B · AdaGuard-4B · AdaGuard-8B

At a glance

Property	Train	Test
Examples	10,939	1,000
No supplied rule violated (NR)	5,439	500
One or more rules violated	5,500	500
Multiple rules violated	1,718	133
User-only requests	1,375	117
Agent trajectories	9,564	883
Rules per policy	1–100	1–100

The two splits contain 11,939 examples in total. Records are provided in JSONL format, with one conversation per line.

Split convention: the 1,000-example file was historically named validation.jsonl. This release names it test.jsonl to match its role in the reported evaluation. The records are unchanged. Keep this split for final evaluation; create any development split from the training pool, keeping related examples together. No separate development split is supplied here.

Load the dataset

python -m pip install datasets

After the dataset is published to this Hub repository:

from datasets import load_dataset

dataset = load_dataset("Yunhao-Feng/cua-exea-policy")
print(dataset)

example = dataset["train"][0]
messages = example["messages"]
print(messages[0]["role"])  # system
print(messages[1]["role"])  # user
print(messages[2]["role"])  # assistant

To load a local copy, run this from the dataset folder:

from datasets import load_dataset

dataset = load_dataset(
    "json",
    data_files={"train": "data/train.jsonl", "test": "data/test.jsonl"},
)

Record format

Each record has a single top-level field, messages, containing three objects with role and content string fields:

Position	Role	Content
0	system	Assessment instructions and a JSON policy inside <trusted_risk_policy>...</trusted_risk_policy>.
1	user	Interaction evidence inside <untrusted_content>...</untrusted_content>.
2	assistant	Reference analysis followed by the ordered rule verdict.

The policy contains risk_rules, whose entries define a local id, risk_category, and risk_description. The interaction payload has a content field containing event segments. Events represent user requests, agent thoughts/actions, and environment or tool results.

The assistant target uses this structure; the text below is a format illustration, not a dataset record:

<analysis>
An explanation grounded in the supplied policy and interaction evidence.
</analysis>
<label>R1,R3</label>

• Rule identifiers are local to the current policy. The same identifier can have different meanings in different examples.
• The label lists every violated rule in the order the rules appear in that policy.
• <label>NR</label> means that none of the supplied rules is violated. NR is a reserved output marker, not a risk rule.
• NR does not certify that an interaction is harmless under every possible policy.
• A user-only record assesses the request. When agent events are present, assess the agent's behavior; a malicious request alone does not establish an agent violation.

To inspect the structured policy without changing the stored messages:

import json

system_text = dataset["train"][0]["messages"][0]["content"]
policy_text = system_text.split("<trusted_risk_policy>", 1)[1].split(
    "</trusted_risk_policy>", 1
)[0]
policy = json.loads(policy_text)
print(policy["risk_rules"][0])

Training and evaluation

For supervised training, preserve the system policy and the evidence boundaries. The assistant message is the target; the system and user messages are the prompt.

For evaluation, exclude the reference assistant message from the model input:

example = dataset["test"][0]
prompt_messages = example["messages"][:2]
reference_response = example["messages"][2]["content"]

# Feed prompt_messages to the model; compare its generated response with
# reference_response only after generation.

Binary evaluation asks whether any supplied rule is violated. Rule-level evaluation compares the complete predicted violation set with the reference set. Output validation should check the tags, policy membership, unique IDs and policy order. Invalid or unfinished responses must not be interpreted as compliant decisions. The project repository provides the model interface and evaluation conventions.

Construction and source composition

AdaptiveSafety combines source interactions with structural augmentation, policy counterfactuals and behavioral counterfactuals:

• Structural augmentation varies policy length, rule order and rule identifiers, including relevant but unviolated rules.
• Policy counterfactuals modify requirements or permissions while preserving the interaction.
• Behavioral counterfactuals modify recorded behavior while preserving the policy.

These variations support learning both sensitivity to meaningful changes and consistency under changes in representation. Related examples can share an underlying interaction; the example count is not a count of independent original trajectories. Generated analyses and rule decisions were processed through an annotation, verification and adjudication pipeline; they should not be described as uniformly human-authored ground truth.

The source composition of the released examples is:

Source family	Train	Test
AgentHazard	3,300	300
ASSE	3,097	206
ATBench	1,348	135
Vera	1,120	130
RJudge	1,092	129
DynaBench training split	982	100
Total	10,939	1,000

These are counts of released examples after processing and augmentation, not necessarily counts of unique upstream records. The DynaBench-derived examples originate from its training split. The separate 543-example DynaBench test benchmark is not included in this repository.

Files

.
├── README.md
├── LICENSE
├── NOTICE
├── .gitattributes
├── SHA256SUMS
└── data/
    ├── train.jsonl
    └── test.jsonl

This release provides the final message-format data. It does not include annotation-service logs, work-in-progress records, training caches or model predictions. SHA256SUMS records the checksums of the two JSONL files.

Limitations and appropriate use

The dataset supports research on policy-conditioned assessment of user requests and agent behavior. Policies, annotations and generated analyses may contain ambiguities or errors. Performance on these examples does not establish reliability for every deployment domain, language or policy. Some interactions describe unsafe requests or actions as evaluation evidence; they are not instructions to follow.

License and attribution

The AdaGuard authors' contributions and the rights they control in this release are made available under Apache-2.0. Underlying third-party material retains its original ownership, applicable licenses and attribution requirements. This release does not relicense third-party material or override its terms. See NOTICE for the source families and attribution statement.

Citation

If you use this dataset, please cite:

@misc{feng2026adaguard,
  title         = {{AdaGuard}: An Adaptive Guard Model with User-defined Policies},
  author        = {Yunhao Feng and Yifan Ding and Yuxiang Xie and Zheng Li and Mingrui Lao and Zeyuan Wang and Yanming Guo},
  year          = {2026},
  eprint        = {2609.34241},
  archivePrefix = {arXiv},
  primaryClass  = {cs.AI},
  doi           = {10.48550/arXiv.2609.34241},
  url           = {https://arxiv.org/abs/2609.34241}
}