Search papers, labs, and topics across Lattice.
This paper introduces a novel black-box reconnaissance methodology for detecting guardrails in Large Language Models (LLMs) through behavioral monitoring of HTTP, lexical, and timing signals. The significance of this work lies in its ability to accurately distinguish between guardrail blocks and LLM rejections, which is crucial for optimizing attack techniques against AI systems. Experimental results show that the proposed method achieves 100% accuracy in detecting guardrail presence and an impressive average F1 score of 98% in categorizing content blocks, highlighting its effectiveness in enhancing AI security assessments.
Guardrail detection in LLMs can be achieved with 100% accuracy, revealing critical insights into AI safety mechanisms that could reshape adversarial strategies.
As Large Language Models (LLMs) and agentic systems become integrated into real-world applications, ensuring their safety and security is critical. Guardrail systems that detect and block malicious instructions sent to and from an LLM are an essential component of AI security. However, researchers conducting black-box adversarial emulation against production AI systems often struggle to determine whether a guardrail block or an LLM rejection has occurred. This distinction is important because the techniques used to bypass guardrails can differ substantially from those used to bypass LLM safety alignment, and has a material impact on attack technique selection and optimization. We propose the first black-box guardrail reconnaissance methodology, which detects the presence of a guardrail within a target AI system through behavioral monitoring of HTTP, lexical, and timing signals, assuming only black-box access and zero prior knowledge of the guardrail or AI system. Experiments demonstrate that our approach detects guardrail presence with 100% accuracy, with statistically significant behavioral separation between benign and malicious interactions (q<0.001). Our approach further identifies the content categories a guardrail is designed to block, and distinguishes guardrail blocks from LLM rejection on unseen prompts with an average F1 score of 98%.
