AgentDoG: a diagnostic guardrail for agent trajectories, shipped as small fine-tuned checkpoints

The problem AgentDoG targets: safety decisions made on trajectories, not prompts

Most content moderation tooling scores a single string. An agent produces something structurally different: a sequence of planning steps, tool invocations, tool outputs, and environment observations that unfold over time, where the harmful outcome may only be visible in the combination. A model that reads one message at a time cannot see that a benign-looking shell command follows a benign-looking file read. AgentDoG is built around that gap. The README describes AgentDoG 1.0 as a diagnostic guardrail framework and AgentDoG 1.5 as extending diagnosis and alignment from fixed trajectory classification toward long-horizon planning, tool-mediated execution, and deployable runtime safety monitoring. The intended user is therefore an engineer running an agent framework who can log whole trajectories. If you only have access to the final assistant message, the input this project expects does not exist in your system.

Two axes of output: coarse moderation versus fine-grained diagnosis

The model zoo splits checkpoints along a task axis rather than only a size axis. The coarse-grained moderation checkpoints (AgentDoG1.5-Qwen3.5-0.8B, 2B, 4B, and AgentDoG1.5-Llama3.1-8B) are separate weights from the fine-grained diagnosis checkpoints (the FG- prefixed entries at the same sizes and bases). There is also a single unified checkpoint, AgentDoG1.5-Unified-Qwen3.5-4B, labelled unified safety diagnosis. That split is a real deployment decision, not a naming convention. A coarse moderation model gives you a pass or block signal cheaply; a fine-grained diagnosis model is meant to tell you which risk type was triggered, which is what you need if you are feeding failures back into training data or writing an incident report. The README does not state latency or throughput numbers for either variant, so the cost of the fine-grained path has to be measured on your own hardware. The 0.8B and 2B FG checkpoints exist, which suggests the project expects some users to want diagnosis without a 8B-class model in the loop.

The taxonomy and ATBench are the actual product surface

AgentDoG ships a safety taxonomy alongside the weights, and the 1.5 release notes say it revises the original three-dimensional taxonomy and adds risk types for Codex and OpenClaw agents. The benchmark family grows with it: ATBench was released in April 2026 as a trajectory benchmark for safety evaluation and diagnosis, followed by ATBench-Claw and ATBench-Codex for those two agent types. This matters more than it first appears. A guardrail model is only as useful as its label space. If your agent's failure modes are not represented in the taxonomy, the diagnostic output will be uninformative even when the binary decision is correct. The practical question for an adopter is whether the published risk types cover what your agent actually does. The README names Codex and OpenClaw specifically, which implies the taxonomy is tuned to those ecosystems rather than being domain-neutral.

Getting the weights: what the README actually tells you to do

There is no installation section, no pip package, and no CLI in the supplied material. The README's instruction is navigation-based: visit the Hugging Face or ModelScope organization, search for checkpoints whose names begin with AgentDoG-, and download from there. The two entry points named are the Hugging Face collection at huggingface.co/collections/AI45Research/agentdog15 and the ModelScope collection at modelscope.cn/collections/Shanghai_AI_Laboratory/AgentDoG15. Individual model pages follow a predictable pattern, for example huggingface.co/AI45Research/AgentDoG1.5-Unified-Qwen3.5-4B and its ModelScope counterpart. Because these are fine-tuned Qwen3.5 and Llama3.1 checkpoints, loading them is standard transformer inference work rather than a bespoke runtime. Note one detail in the table: the Llama 3.1 8B links are written with a doubled m in the path (AgentDoG1.5-LLamma-3.1-8B). That is what the README shows, and it is the kind of typo that breaks a scripted download, so copy the URL from the model card rather than retyping it.

The runtime guardrail and the training pipeline are the two least documented pieces

The 1.5 announcement lists two components that go beyond shipping weights: an online agent safety guardrail for OpenClaw deployment, supporting monitoring and intervention in live workflows, and a lightweight agentic SFT and RL training pipeline that the README says runs over 10,000 concurrent agentic environments on a standard 8-core machine. The data engine behind the 1.5 models is described as taxonomy-guided and trained on roughly 1k samples. These are the parts an adopter would most want to inspect, because a guardrail that intervenes in a running agent needs to define what intervention means (blocking a tool call, terminating the episode, flagging for review) and the training pipeline needs reproducible environment setup. The supplied README does not give commands, config keys, or file paths for either. Treat both as claims to verify against the technical reports at arxiv.org/pdf/2601.18491 (1.0) and arxiv.org/pdf/2605.29801 (1.5) before you plan around them.

Where AgentDoG is the wrong tool

Three cases. First, single-turn moderation. If your product is a chat interface and you need to classify one user message, the trajectory machinery adds nothing and a general moderation model or a hosted API will be simpler to operate. Second, agents whose audit trail is incomplete. The framework is explicitly trajectory-level, so if your logging drops tool outputs or truncates long episodes, the model is being asked to judge a partial record and you should expect degraded accuracy with no obvious signal that it happened. Third, anything requiring a vendor relationship. The repository as supplied lists no releases, no homepage, and no licence, so there is no versioned artifact to pin and no stated terms for commercial use of the weights. For a regulated deployment, an unlicensed model checkpoint is a blocker regardless of how well it performs. Compare with a general-purpose guardrail such as Llama Guard: that approach classifies a prompt and response pair with a single model and a documented licence, which is easier to slot into existing infrastructure but cannot express which step in a multi-turn tool-using episode went wrong. AgentDoG trades that operational simplicity for trajectory awareness and diagnostic labels.

Maintenance, licence, and what to check before adopting

The project is active, with the last push in June 2026 and a 1.0 to 1.5 transition inside five months. That pace is the maintenance cost: a taxonomy that was revised between 1.0 and 1.5 will likely be revised again, and any fine-tuning or thresholding you build on top of the current label space may need rework. Upgrading is not a drop-in operation either, because 1.0 and 1.5 use different base models (Qwen3-4B-Instruct-2507 and Qwen2.5-7B-Instruct in 1.0 versus Qwen3.5 and Llama3.1 in 1.5), so prompt formats and tokenizer behaviour can shift between generations. On licensing, the supplied material declares no licence for the repository, and the model cards on Hugging Face and ModelScope are where the terms for the weights themselves would appear. I cannot state what those terms are, and this is not legal advice: read the licence field on the specific checkpoint you download, and note that Llama 3.1 based checkpoints carry the upstream Llama terms in addition to anything AI45Lab adds. The concrete first step is to open the model card for the variant you intend to run, confirm the licence, and confirm the expected input schema, since the README gives the model names and download locations but not the inference contract.

Editorial conclusion

Adopt AgentDoG if you already capture full agent trajectories (tool calls, observations, intermediate reasoning) and want a small local checkpoint that labels them, because the whole design assumes trajectory-level input rather than single prompts. Do not adopt it if your safety surface is a chat completion endpoint or if you need a supported, versioned API with a published licence, since the repository as supplied declares no licence and no releases. Before committing, verify three things on the actual Hugging Face or ModelScope card for the specific checkpoint you intend to run: its licence, the exact input format the model expects, and whether the fine-grained variant is worth the extra latency over coarse moderation for your traffic.

Official sources

1. AI45Lab/AgentDoG on GitHub
2. Issues
3. README