📄 Peering Behind the Shield: Guardrail Identification in Large Language Models

Summary

Conversational AI agents often place safety guardrails before or after their core LLM. Knowing which guardrail is in use lets an attacker treat it as a white-box target. Existing LLM fingerprinting methods transfer poorly to this task for four reasons: guardrails give near-binary verdicts, agents allow only black-box queries, the guard's position in the pipeline is unknown, and decision thresholds are usually set ad hoc.

The authors propose AP-Test. It optimizes adversarial prompts that one candidate guardrail flags as unsafe while other guards and safety-aligned LLMs treat them as harmless. A tailored loss guides this optimization, starting from a set of normal queries. The agent is then probed in two ways:

• Input guard test: the prompts are sent directly.
• Output guard test: the agent is asked to repeat the prompt, so any output guard sees the text.

A new match score turns the agent's refusals into a decision using only the candidate guard. Across agents built on Llama3.1 and GPT4o with 10 guardrails, the method reaches perfect accuracy in several settings. The authors frame this as useful both to attackers and to owners checking for unauthorized use of their guardrail.

Key points

• Candidates: four open-source guardrails were tested, including WildGuard and the LlamaGuard family. The code is at github.com/TrustAIRLab/AP-Test.
• Main result: the WildGuard-specific input guard test reached Acc = 1.00 on both Llama3.1-based and GPT4o-based agents. AP-Test also worked on agents running two different guardrails.
• Loss term L3: this term keeps prompts safe for non-target guards. Without it, a WildGuard-only agent was mistaken for one using LlamaGuard3, with a refusal rate of 0.86 against a target rate of 0.98.
• Ablation setup: LlamaGuard3 was the candidate across 11 Llama3.1-based agents. Losses converged around epoch 50.
• Query set: swapping in 50 Alpaca samples or 50 synthetic questions generated by GPT 5.2 gave comparable results. Removing the query set caused misidentification: refusal was 0.98 on the LlamaGuard agent versus 0.92 on the LlamaGuard3 agent.