LLM Guardrails

LLM: Large Language Model

Follow this topic Ask about this topic

Momentum

15 papers in the last four weeks, up 36% on the four weeks before. 0.1% of all new papers.

Jul 13Week of Sep 28

Latest papers 138

All topics

One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails
Oct 8, 2026Seyedarmin Azizi, Erfan Baghaei Potraghloo, Massoud PedramLLM Guardrails LLM Agent Security
University of Southern California (USC), USA
Safe Actions Alone Do Not Ensure Safe Agents: Identifying Unfulfilled Obligations with Guard Models
Oct 8, 2026Youwei Feng, Yitong Zhang, Yuetong Liu +1LLM Agent Safety LLM Guardrails
Tsinghua University, China · College of AI, Tsinghua University, China
Constitutional Gating and Deterministic Recovery for Multi-Agent LLM Negotiation: Ablations Against a Stateful Adversarial Gatekeeper
Oct 8, 2026Masaaki Nakatsu, Reno WangLLM Agent Reliability Multi-Agent Negotiation
AO, Inc. / OrbLabs AG · AO, Inc.
BRANCH: Bypassing Multi-Scanner AI Guardrails
Oct 7, 2026William Hackett, Peter GarraghanLLM Guardrails Adversarial Attacks on LLMs
Mindgard
Constrained-Action AI Remediation for SIEM/XDR via a NeMo-Guardrails Proxy
Oct 7, 2026Georgios Koutidis, Nikolaos Kekatos, Tom Nianios +1LLMs for Cybersecurity Tool Access Control for LLM Agents
Clone Systems, Larnaca, Cyprus · University of Thessaly, Department of Intelligent Energy Systems, Larissa, Greece
AdaGuard: Enhancing Safety and Policy Compliance with Reasoning-Enabled LLM-As-A-Judge Guardrails
Oct 6, 2026Melissa Kazemi Rad, Sihui Dai, Isha Slavin +6LLM Guardrails LLM Safety
Capital One
POLAR: Ontology-Guided Risk Prevention for Tool-Calling LLM Agents
Oct 6, 2026Yunju Kang, Seonghyeon Cho, Irene Li +2LLM Guardrails Runtime Enforcement for AI Agents
Soongsil University · Tokyo University · Jeju National University
Benchmarking Jailbreak Guardrails for Embodied Agents
Oct 5, 2026Xunguang Wang, Qingyue Wang, Yuguang Zhou +3LLM Guardrails AI Agent Safety
Department of Computer Science and Engineering The Hong Kong University of Science and Technology Clear Water Bay, Kowloon, Hong Kong · School of Information Renmin University of China Beijing, China
Trustworthy Runtime Error Healing in Real-World Repositories: A Benchmark and Guardrail
Sep 30, 2026Gou Tan, Pengfei Chen, Zhensu Sun +9Automated Program Repair LLM Guardrails
Sun Yat-sen University · Singapore Management University · Monash University
Evaluating Bounded Autonomy in Regulated Agentic AI: A Diagnostic Harness with Constitutional Rewards, Escalation Labels, and Runtime Governance
Sep 28, 2026Dipankar SarkarLLM Guardrails AI Agent Evaluation
Skelf Research
PROACT-Agent: Progressive Runtime Oversight and Active Circuit-breaking for Real-Time Safety
Sep 28, 2026Ding Jia, Wei Liu, Xianglong Du +5LLM Guardrails Runtime Enforcement for AI Agents
State Key Laboratory of Intelligent Vehicle Safety Technology, Changan Automobile · Independent Researcher
AdaGuard: An Adaptive Guard Model with User-defined Policies
Sep 28, 2026Yunhao Feng, Yifan Ding, Yuxiang Xie +4LLM Guardrails AI Agent Safety
National University of Defense Technology · Fudan University
COGNIT-Guard: Calibrated Standalone Direct-Decision Guardrails with Heterogeneous CPU-NPU Confidence Cascading under Explicit Latency and False-Positive Constraints
Sep 27, 2026Hao ChenLLM Guardrails Language Model Calibration
School of Cyber Security, Guangdong Polytechnic Normal University, Guangzhou, China
Safety Reconstructed: Generative Modeling via Masked Diffusion Builds Strong Safety Guardrails
Sep 27, 2026Gert Lek, Abele Malan, Chaoyi Zhu +3LLM Safety Benchmarks LLM Guardrails
University of Neuchâtel · Delft University of Technology · IBM Research +1
Guardrails or Roadblocks? Effects of Pedagogical Style and Context Awareness in AI Teaching Assistants for Programming
Sep 24, 2026Madeleine Eastwood, Harshith Narne, Joseph Hilby +3LLM Guardrails Programming Education
University of Florida Gainesville, FL, United States · University of Auckland Auckland, New Zealand
From Alignment to Access Control: A Framework for GenAI Policy Enforcement
Sep 22, 2026Nathalie BaracaldoLLM Guardrails Runtime Enforcement for AI Agents
IBM Research
Visual Compliance via Executable Safety Rule Entailment
Sep 16, 2026Jisoo Kim, TaeYoon Kwack, Jinwoo Jang +1Logical Reasoning LLM Guardrails
Sungkyunkwan University
SAGE: Governed Artifact Generation from Enterprise Guidelines
Sep 15, 2026Mohammadreza Sediqin, Shivali Dalmia, Sumukha Thoppanahalli +2LLM Hallucination Mitigation LLM Guardrails
Centific Research New York, USA · Centific Research Seattle, USA · Centific Research Washington, USA
HazardAuditor: From Executable Threats to Safer Computer-Use Agents
Sep 14, 2026Yunhao Feng, Ruixiao Lin, Ming Wen +5Language Model Safety Evaluation AI Agent Auditing
Ant Group · Hunan Institute of Advanced Technology · Zhejiang University +3
Overflip: Repetition-Induced Label Flips in Guardrail Models
Sep 14, 2026Xu He, Chih-Hsuan Lin, Hung-Mao Chen +3LLM Guardrails Adversarial Attacks on LLMs
1George Mason University · 2Virginia Tech · 3Missouri University of Science and Technology +1
DeFiFlowBench: Benchmarking and Improving Safe Executability in Natural-Language DeFi Workflow Synthesis
Sep 11, 2026Abhinav Rajeev Kumar, Harshit Arora, Varun Singh +1LLM Safety Benchmarks LLM Guardrails
SRM Institute of Science and Technology
CS-Guard: Benchmarking LLM Guardrails for Code Generation Security
Sep 9, 2026Jinyang Li, Mingyu Guo, Hung X. NguyenLLM Guardrails Adversarial Attacks on LLMs
Adelaide University Adelaide, Australia
Style Over Substance: Content-Invariant Wrappers Flip LLM Safety-Judge Verdicts
Sep 8, 2026Yongxi Zhou, Wenbo Ye, Yuanzhe Liu +2LLM Safety Benchmarks LLM-as-a-Judge
Northeastern University, Massachusetts, USA · University of Southern California, California, USA · Georgia Institute of Technology, Georgia, USA
Recall Is Not Protection: Evaluating Safety Monitors Against Model Compliance
Sep 5, 2026Sripad KarneLanguage Model Safety Evaluation LLM Guardrails
Columbia University
When Guardrails Look Effective: Construct Validity Failures in LLM Agent Commerce Evaluation
Sep 1, 2026Peiying Zhu, Sidi ChangLLM Guardrails LLM Agent Evaluation
Blossom AI · San Francisco, CA, USA · Blossom AI Labs +1
HiveTraceGuard-Pro: A Compact Generative Guardrail for Prompt Injection, Jailbreaks, and Adversarial Obfuscation
Sep 1, 2026Nikita Oblakov, Sabrina Sadiekh, Evgeniy KokuykinLanguage Model Safety Evaluation LLM Guardrails
HiveTraceLab
The Safeguard Worked. Is the LLM System Safer?
Sep 1, 2026Pingyu Wu, Weiming Zhang, Nenghai YuLLM Guardrails LLM Safety
University of Science and Technology of China · 2Hefei AiDA Lab
SingProbe Technical Report
Aug 31, 2026Sing TeamLanguage Model Safety Evaluation LLM Guardrails
AI Security Lab, Ant Group
Influence Is Not Authority: When Causal Guardrail Signals Make Legitimate Tool Use Look Like an Attack in Tool-Using LLM Agents
Aug 30, 2026Tanzim Ahad, Ismail Hossain, Md Jahangir Alam +3LLM Guardrails LLM Agent Security
Department of Computer Science, University of Texas at El Paso, TX, USA 79902 · Department of Computer Science and Engineering, New Mexico Tech, Socorro, NM, USA 87801 · University of Illinois Urbana-Champaign, IL, USA
LongGuard: Mechanistic Analysis and Training-Free Mitigation of Long-Context Failure in Safety Guardrails
Aug 27, 2026Ziyang Chen, Xing Wu, Songlin HuLanguage Model Safety Evaluation Long-Context Language Model Evaluation
Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China · School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China

Oct 8, 2026, cs.AIJ/K move · Enter open · S save

One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails

Seyedarmin Azizi, Erfan Baghaei Potraghloo, Massoud Pedram

University of Southern California (USC), USA

LLM Guardrails LLM Agent Security Adversarial Attacks on LLMs Language Model Safety Evaluation Prompt Injection Attacks on AI Agents

Open paper AskPDF arXiv

A typed decision model reads a piece of text and returns a probability over caller-defined options, each with a short written definition, generating no text. Recent work places these models in agent systems as guardrails: the component that reads a proposed tool call or incoming message and decides whether to allow it. We evaluate seven open-weight models in that role and report the two error directions separately: a fail-open error allows a prohibited action and is a vulnerability; a fail-closed error blocks a permitted one and is only a cost. On prompt-injection, jailbreak and toxic-content screening, accuracy at the allow-or-block decision ranges from 36% to 72% against a chance level of 50%. A low error rate in one direction only reflects which answer a model defaults to: one allows nearly everything, another blocks nearly everything. On a synthetic suite of agent tool calls, six lines of server log text that say nothing about the policy raise a gate's fail-open rate from 0% to 63% on a policy it otherwise decides correctly. Giving the permissive option a misleading name, with its definition and the judged text untouched, raises that rate to between 93% and 100% on the four models that place the label in their input. Every defense we tested is defeated, either by an attacker who targets its mechanism or by attacker-controlled text. Escalating the least confident decisions does not help either: a decision an attack has reversed is no less confident than the one it replaced. Parsing each policy field into a typed value does eliminate one attack, but it also makes the model unnecessary: a deterministic rule over those values reaches 100% accuracy on all six policies. These models can reduce how many cases reach a reviewer, but on this evidence they should not be the component that decides. Code is available at https://github.com/ArminAzizi98/option-channel-attack.

Momentum

Related topics

Latest papers 138