Typed decision model vulnerabilities can push AI guardrail fail-open rates to 63%

What it is

A study by Erfan Baghaei Potraghloo (arXiv, October 8, 2026) evaluating seven open-weight LLMs used as "typed decision model" guardrails in agent systems — models that assign probabilities to caller-defined allow/block options rather than generating text, used to screen prompt injection, jailbreak, and toxic-content cases.

How it works

The guardrails read a proposed tool call or message and score it against options the caller defines, each with a short written definition. The paper identifies two distinct error types measured separately: fail-open (permitting prohibited actions — a security vulnerability) and fail-closed (rejecting permitted actions — an operational cost). A low rate in either direction alone doesn't indicate reliable enforcement, since it can just reflect a model's default bias toward one answer — the study found one model permitted nearly everything while another blocked nearly everything.

Two concrete attacks are demonstrated:

• Irrelevant context injection: six lines of server-log text unrelated to the policy, added to a synthetic agent tool-call input, raised one guardrail's fail-open rate from 0% to 63%, despite the model having otherwise assessed that same policy correctly.
• Option-label renaming: relabeling the permissive option (without touching its definition or the text being judged) drove fail-open rates to 93–100% across the four models whose input included the label text.

flowchart TD
    A[Tool call / message] --> B{Guardrail model}
    B -->|baseline| C[0% fail-open]
    D[+6 lines unrelated log text] --> B
    B -->|injected| E[63% fail-open]
    F[Permissive option relabeled] --> B
    B -->|relabeled| G[93-100% fail-open]

Preconditions / Affected

Applies to the four (of seven) evaluated models whose guardrail input includes the option's label text — models that don't expose the label to the judging step aren't susceptible to the renaming attack. Baseline accuracy across all seven models on allow/block decisions ranged 36%–72%, against a 50% chance level.

What to do

The paper's own recommendation: don't give typed decision models sole decision-making authority. Instead use them to triage/filter which cases reach a human reviewer. Separately, a deterministic rule operating on typed output values (rather than trusting the model's final label mapping) achieved 100% accuracy across all six tested policies — suggesting the label/definition layer itself is the attack surface to remove or hard-code rather than trust to the model.

Caveats

The log-injection and relabeling results are demonstrated on a synthetic set of agent tool calls, not production traffic. The paper does not specify which seven models were tested or give version numbers. Code is on GitHub per the article, but no link or repo name is given in the fetched text.