BRANCH: Bypassing Multi-Scanner AI Guardrails

What it is

BRANCH (Hackett and Garraghan, Mindgard / Lancaster University) is a black-box attack on guardrail systems that ensemble several scanners, such as prompt-injection, toxicity, code and gibberish detectors. The attack must clear every scanner at once. The paper argues that off-the-shelf text-evasion attacks (PWWS, TextBugger) perform badly in this setting, and that BRANCH fixes this by attacking one scanner at a time.

How it works

The paper gives two reasons single-objective attacks struggle:

• Overlapping decision boundaries. Scanners share latent features, so a perturbation that lowers one scanner's confidence can raise another's. On 3,191 PIGuard prompt-injection and jailbreak samples run through LLM Guard's 8 scanners, 47.57% tripped exactly one scanner and 20.15% tripped two or more. Code (1,287 activations) fired more often than PromptInjection (1,100), even though every sample was labelled as injection or jailbreak.
• Scanner interference. Collapsing per-scanner scores into one scalar hides which scanner is blocking. On one seed prompt against LLM Guard, the dominant blocking scanner switched 14 times over PWWS's 1,637 queries and 7 times over TextBugger's 1,033.

BRANCH's search loop:

flowchart TD
    A[Pick node with lowest total blocked confidence] --> B[Target highest-confidence blocking scanner]
    B --> C[Run a perturbation technique on that scanner only]
    C --> D[Score candidate: blocked confidence summed over all scanners]
    D --> E{All scanners pass?}
    E -- no --> A
    E -- yes --> F[Bypass found]

Each technique is seeded with the previous node's output, so perturbations accumulate. The method is perturbation-agnostic and works with any malicious seed prompt.

Preconditions

• The attacker can submit arbitrary prompts and sees the per-scanner block decision and confidence score for each query. That access comes from running the guardrail locally or from a vendor API that exposes scores.
• No weights, gradients, training data or knowledge of the downstream model is needed.

Reported results

• 100% attack success on 6 guardrail systems across 120 scenarios, with 72% fewer queries and 4.5x lower wallclock time than established techniques.
• Semantic meaning is preserved at a level the authors call comparable to established techniques.
• Bypasses generated against the 6 systems, replayed with no further optimization on 29 unseen guardrails (8 of them commercial black-box), raised attack success by 32.9 percentage points on average, and by up to 100% in some cases.

What it means for a defender

• Treat a multi-scanner ensemble as only a modest improvement over a single classifier when raw per-scanner confidences are observable. Not exposing per-scanner scores to callers removes the signal BRANCH needs.
• Transfer to commercial guardrails means that having no access to your own guardrail's scores does not rule out attacks that were optimized elsewhere.

Caveats

• The fetched text ends partway through the threat model. Method details, baselines, per-guardrail results and any proposed defenses are not covered here, so the headline numbers are unchecked against the paper's evaluation sections.
• The transfer gain is an average, so some guardrails likely improved far less than others.
• The motivating measurements (activation counts, scanner-switch counts) come from LLM Guard on a single seed prompt, which is an illustration and not a general result.