From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails

What it is

"From Shield to Target" (arXiv 2606.14517) introduces reasoning-extension DoS, an attack class against LLM-based agent guardrails — the per-action safety layer used as "auto-approval" in commercial agents like OpenAI Codex and Anthropic Claude Code. The summary covers the attack framework and headline amplification numbers; what it omits is the mitigation analysis and the per-deployment breakdown, which is where an engineer deciding what to change will actually operate.

Mitigations the paper tested — and why each fails

This is the section the summary cannot carry. The authors evaluate three obvious defenses and report that none resolves the threat:

• Pre-inference filters — miss the payloads entirely, because the payloads are fluent and read like legitimate safety analysis rather than known-bad patterns.
• Hard token budgets — do not fix the problem, they only relocate it. A cap forces a choice between two failure modes: fail-open lets the action through when the budget is exhausted (a safety bypass), while fail-closed blocks it (a denial of availability to legitimate users).
• Using a more capable guardrail model — makes it worse: stronger models follow the injected schema more faithfully and produce even longer reasoning loops.

The takeaway the paper pushes: you need cost-bounded, reasoning-robust guardrails; a budget alone is not that.

Per-deployment numbers

The summary gives "up to 148×." The actual peak latency amplification differs sharply by deployment, which matters for prioritization:

• LangGraph (multi-agent): 148× — plus throughput collapse from head-of-line blocking on shared guardrail infrastructure.
• BrowserGym (web): 131×
• OpenHands (code): 36.3×
• OSWorld (desktop): 18×

Each required a distinct adaptation: code agents needed contradictory security factors (not pure template-following); multi-agent pipelines needed transform-resilient payloads surviving intermediate rewriting; web/desktop needed payloads fitting natural environmental content.

Other specifics worth noting

• Payloads were optimized on one open-source surrogate, TS-Guard-8B, then transferred without adaptation to eight backbones.
• Six prior DoS methods (OverThink, ReasoningBomb, ENGORGIO, CRABS, RECUR, ThinkTrap) achieve only 1.1–1.2× against guardrails, versus this attack's 13–63× — the schema-following angle is what makes the difference.

Caveats

This is a preprint (v2, June 2026); results are the authors' own and unverified externally. The mechanism turns entirely on the guardrail emitting structured, schema-following reasoning — a guardrail that returns only a bare verdict presents far less surface.