AsrielNetworksGuardrail evasion
Techniques that get a request past input filters, output classifiers or policy checks: obfuscation, encoding, role play, repetition, splitting.
Definition
Guardrails are the classifiers, filters and policy checks placed around a model: on the input, on the output, on tool proposals. Guardrail evasion is any technique that gets a disallowed request past them. Jailbreaks are the input-side family; encoding, splitting and obfuscation defeat pattern-based filters; role play and hypothetical framing defeat intent classifiers; many-shot prompts overwhelm the model's own refusal behaviour.
Every guardrail is a model or a rule with an error rate, so evasion is expected. The defensive question is not whether a single check can be beaten but whether repeated attempts are visible and whether the action behind the guardrail is gated by something the model cannot talk its way past.
How it manifests
- Repeated guardrail triggers from one agent or session in a short window (
guardrail.triggered,policy.evaluatedwith a failure). - Encoded or obfuscated input: base64, leetspeak, unicode homoglyphs, translation to a low-resource language, instructions split across turns.
- Framing: “for a novel”, “as a hypothetical”, “you are DAN”, or a long run of fabricated compliant examples.
- Success after failures: a denial followed by a near-identical request that passes.
How AsrielNetworks detects it
The repeated-failure rule aggregates policy denials and guardrail failures over a bounded window (three in sixty minutes by default, tenant-configurable) so that a campaign of attempts becomes one incident rather than a stream of ignored warnings. When the evasion carries an override payload, the direct injection rule fires on the same event.
- Repeated security control failure
ai.control.repeated_failure· high
Repeated policy denials or guardrail failures aggregated over a bounded window (3 in 60 minutes by default). - Direct prompt injection
ai.prompt_injection.direct· high
Structured injection verdicts and deterministic instruction-override signals in received or scanned prompts.
References
- Wei, Haghtalab & Steinhardt, Jailbroken: How Does LLM Safety Training Fail? (2023).
- Zou et al., Universal and Transferable Adversarial Attacks on Aligned Language Models (2023).
- Anil et al., Many-shot jailbreaking (2024).
- MITRE ATLAS, AML.T0054 LLM Jailbreak.