BRANCH: Bypassing Multi-Scanner AI Guardrails

William Hackett; Peter Garraghan

cs.CROct 7, 2026

BRANCH: Bypassing Multi-Scanner AI Guardrails

Authors: William Hackett, Peter Garraghan

Organizations: Mindgard

Abstract

AI systems increasingly rely on Large Language Models (LLMs) as core reasoning engines, making them targets for prompt injection and jailbreaks. Guardrails monitor and validate model inputs and outputs, yet their isolated, task-focused detection leaves gaps in their classification making them susceptible to bypasses. In response, guardrail systems formed by multiple scanners have emerged that collaboratively detect different types of malicious instructions, whereby shared latent representations across classification boundaries render established bypassing techniques ineffective. We propose BRANCH, a bypassing methodology designed for multi-scanner guardrail systems. Our method leverages a branching tree search approach that dynamically applies adversarial perturbation against individual scanners, with subsequent perturbation optimization and technique selection based on overall improvement across all guardrail system scanners, effectively decoupling bypass evaluation from attack signal optimization. Our findings demonstrate that BRANCH achieves 100% attack success rate across 6 guardrail systems in 120 scenarios with 72% fewer queries and 4.5x reduced wallclock time compared to established techniques, while preserving semantic meaning within the bypass. We also show how bypasses generated by BRANCH transfer to 29 unseen guardrails, including 8 commercial black-box guardrails, improving attack success in some cases up to 100% with no additional optimization.

Figures & tables

Panel of Figure 1 — Figure 1: Static Scanner Activations. The number of scanners activating, and their distribution, across 8 scanners within LLM Guard during inference of 3,191 prompt injection and jailbreak samples from PIGuard Li et al. (2025) .

Figure 2: Scanner Displacement. Scanner confidences tracked across two single-objective techniques, PWWS and TextBugger showing the currently highest blocking scanner and variance of other scanners during perturbation.

Figure 3: BRANCH Methodology. Example bypass against a guardrail system with three scanners: Prompt Injection, Toxicity, and Gibberish, using four perturbation techniques BAE, TextBugger, Pruthi, and PWWS. BRANCH selects the node with the lowest total blocked confidence (

(C(p)

), perturbs it with one or more techniques, and then validates candidates against the full guardrail system. The process is repeated until a bypass is found.

Guardrail System	Number of Scanners
LLM Guard Protect AI (2025)	8
Vijil Dome Vijil AI (2024)	3
Guardrails AI Guardrails AI (2026)	3
Samsung Guard Lee et al. (2025)	2
LlamaFirewall Chennabasappa et al. (2025)	2
Ensemble Guardrail (Custom Built)	3

Table 1: Target Guardrail Systems . Guardrails targeted in this work, including total number of scanners.

Panel of Figure 4 — Figure 4: Bypass Effectiveness. Overall attack success rate of all methods against 6 guardrail systems.

Panel of Figure 5 — Figure 5: Query Efficiency Across Methods. Average queries per bypass attempt for BRANCH, Exhaustive, and the 11 individual techniques, across targeted guardrail system.

Figure 6: Most Successful Perturbation Techniques. The left panel shows the number of prompts bypassed by each Exhaustive technique alone. The right panel shows the number of times each technique is used along BRANCH’s optimal paths.

Figure 7: Semantic Preservation. Average semantic preservation of each technique’s generated bypasses plotted against ASR. The stars mark BRANCH and Exhaustive, while dots represent individual techniques. Horizontal bars span

\pm 1

standard deviation of semantic preservation across all generated bypasses.

Figure 8: Adversarial Utility. Distribution of adversarial utility scores comparing the outputs generated from the original seed prompt and generated bypasses, evaluated by an LLM judge. Utility is scored from 1-5 (1 indicates no similarity, 5 indicates high similarity).

Figure 9: Transferability to Unseen Guardrails. Per-guardrail ASR of the 20 original seed prompts alone as a baseline against that of BRANCH’s generated bypasses, for each of the 32 previously-unseen guardrails, ordered by transfer ASR. A seed prompt counts as transferring if at least one bypass derived from a given seed evades the guardrail. * = black-box commercial guardrails.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Figure A.1: Number of Scanners Activated per Prompt, Across all Targets. Distribution of how many scanners simultaneously flag each of the 3,191 PIGuard candidate prompts, per target guardrail system.

Evasion Attack	Description
TextFooler ( Jin et al., 2020 )	Words with the highest importance ranking are replaced with suitable replacement words with similar semantic meaning.
DeepWordBug ( Gao et al., 2018 )	Character-level transformations are applied to the highest-ranked tokens to minimise distance of the perturbation.
TextBugger ( Li et al., 2019 )	Generates utility-preserving adversarial text against black-box and white-box classification systems.
PWWS ( Ren et al., 2019 )	Probability Weighted Word Saliency (PWWS) ranks word importance using word saliency and classification probability.
Pruthi ( Pruthi et al., 2019 )	Generates perturbations in the form of adversarial spelling mistakes via removing or swapping characters.
PSO ( Zang et al., 2020 )	Combines word substitution with particle swarm optimization (PSO) to search for adversarial candidates.

Appendix

Table A.1: Perturbation Techniques. All 11 perturbation techniques used in Exhaustive and BRANCH.

Detector category	LLM Guard	Vijil Dome	Guardrails AI	Samsung Guard	LlamaFirewall	Ensemble Guardrail
Prompt Injection	✓	✓	✗	✗	✓	✓
Jailbreak	✗	✗	✓	✓	✓	✓
Toxicity	✓	✓	✓	✗	✗	✓
Gibberish	✓	✗	✓	✗	✗	✓
Harm	✗	✗	✗	✓	✗	✗
Moderation	✗	✗	✗	✓	✗	✗

Appendix

Table A.2: Experiment Target Detector Categories. Highlights what each guardrail system within our experimentation is designed to detect and block. Categories vary across targets based on capability and implemented scanners.

Figure A.2: Average Wall-Clock Time by Method. Average wall-clock time per bypass job for BRANCH, Exhaustive, and the 11 individual techniques, averaged across all 6 target guardrail systems.

Figure A.3: BRANCH vs Individual Techniques Coverage. Per-prompt bypass coverage, showing the effectiveness of each technique across different guardrail systems.

Figure A.4: Average Surface Similarity and Semantic Preservation to the Original Seed Prompt. Exact per-target values for BRANCH, Exhaustive, and each of the 11 individual techniques.

Figure A.5: BRANCH Surface Similarity. Shows recorded surface similarity at each depth across all bypass scenarios against all targets.

Figure A.6: BRANCH Semantic Preservation. Shows recorded semantic preservation at each depth across all bypass scenarios against all targets.

Figure A.7: Transferability Heatmap for BRANCH. Shows percentage of generated bypasses from the original target (x) transferring to an unseen guardrail (y).

Explore similar work

Behind the Refusal: Determining Guardrail Activation via Behavioral Monitoring
Jul 2, 2026William Hackett, Peter GarraghanLLM Auditing LLM Guardrails
Mindgard · Lancaster University
GuardNet: Ensemble Strategies of Shallow Neural Networks for Robust Prompt Injection and Jailbreak Detection
Jun 4, 2026Paulo Ricardo Ferreira Neves, Edson Rodrigues da Cruz Filho, Paulo Henrique Eleuterio Falsetti +7LLM Guardrails Neural Network Robustness
Quickium Technology Ltd. – Piracicaba, São Paulo · Federal Institute of Education, Science and Technology of São Paulo (IFSP) – Piracicaba Campus – São Paulo · Federal University of São Carlos (UFSCar) – Sorocaba Campus – São Paulo
BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes
Aug 8, 2026Laiqiao Qin, Tianqing Zhu, Longxiang Gao +1Prompt Injection Defense Prompt Injection Attacks on LLMs
City University of Macau, Macau · Qilu University of Technology

Jul 2, 2026, cs.CRJ/K move · Enter open · S save

Behind the Refusal: Determining Guardrail Activation via Behavioral Monitoring

William Hackett, Peter Garraghan

Mindgard · Lancaster University

LLM Auditing LLM Guardrails AI Agent Monitoring Safety Filtering

Open paper AskPDF arXiv

As Large Language Models (LLMs) and agentic systems become integrated into real-world applications, ensuring their safety and security is critical. Guardrail systems that detect and block malicious instructions sent to and from an LLM are an essential component of AI security. However, researchers conducting black-box adversarial emulation against production AI systems often struggle to determine whether a guardrail block or an LLM rejection has occurred. This distinction is important because the techniques used to bypass guardrails can differ substantially from those used to bypass LLM safety alignment, and has a material impact on attack technique selection and optimization. We propose the first black-box guardrail reconnaissance methodology, which detects the presence of a guardrail within a target AI system through behavioral monitoring of HTTP, lexical, and timing signals, assuming only black-box access and zero prior knowledge of the guardrail or AI system. Experiments demonstrate that our approach detects guardrail presence with 100% accuracy, with statistically significant behavioral separation between benign and malicious interactions (q < 0.001). Our approach further identifies the content categories a guardrail is designed to block, and distinguishes guardrail blocks from LLM rejection on unseen prompts with an average F1 score of 98%.

Abstract

Explore similar work

Behind the Refusal: Determining Guardrail Activation via Behavioral Monitoring

GuardNet: Ensemble Strategies of Shallow Neural Networks for Robust Prompt Injection and Jailbreak Detection

BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes