Multi-scanner guardrails can still be bypassed by chained evasion

At a glance

What this is: Mindgard says the BRANCH method can evade multi-scanner AI guardrail systems by chaining perturbations that defeat layered runtime controls together rather than one scanner at a time.

Why it matters: AI security teams and identity-governance leads need to treat guardrails as composable control planes that can fail through interaction, especially where prompts, tools, and workflow identities are all in scope.

By the numbers:

• BRANCH achieved a 100% attack success rate across all six target guardrail systems, across 120 bypass scenarios.
• BRANCH increased single-shot guardrail evasion by an average of 32.9 percentage points against 29 unseen guardrails.

Context

AI guardrails are runtime controls that inspect prompts, outputs, and tool calls before a model or agent can act on them. In production, teams often stack multiple scanners to cover different risks such as prompt injection, jailbreaks, toxic content, and malicious code, but that layering only helps if the combined system behaves predictably under attack.

The problem is not whether one detector works in isolation. The real governance issue is whether a collection of scanners creates overlapping decision boundaries that an adaptive attacker can navigate around, especially when the same AI workflow also touches tools, files, and identity-bearing access paths.

Key questions

Q: What breaks when AI guardrails are only tested before deployment?

A: Static testing misses production drift, new jailbreak variants, and data leakage patterns that appear only under real traffic. When controls are never validated live, false confidence grows while the model learns from contexts the test set never covered. Continuous monitoring closes that gap by turning live incidents into new test cases.

Q: Why do multi-scanner guardrails still allow jailbreaks and prompt injection through?

A: Because overlapping scanners can be treated as a search space rather than a fixed barrier. Attackers can iteratively perturb the same prompt, reduce one scanner's confidence, and preserve the underlying meaning until the combined system no longer blocks it. The risk is highest when each scanner is tuned independently and the whole stack is never validated adversarially.

Q: How should security teams test AI guardrails before deployment?

A: Test guardrails with adversarial variation, not just known-bad prompts. Include obfuscation, encoding, role-play, and multi-step jailbreak patterns, then measure whether the control still blocks the request under repeat attempts and operational load. A guardrail that only performs in benchmark conditions is not ready to serve as the primary enforcement layer.

Q: What should teams do when a prompt bypass reaches an AI agent tool layer?

A: They should treat it as a runtime authorisation problem, not only a content-moderation failure. Once a prompt can influence tools, files, or external actions, the blast radius depends on delegated permissions and workflow trust. Containment should focus on stopping tool execution, revoking access paths, and checking whether the same bypass pattern can move laterally across related workflows.

Technical breakdown

Why multi-scanner guardrails create new attack surfaces

A single scanner produces one decision boundary, but a multi-scanner system creates several. Each scanner may optimize for a different class of unsafe input, so an attacker can suppress one detector while accidentally activating another. That interaction is the key failure mode: the defence is no longer a simple block-or-allow gate, but a coupled system where modifications made to evade one control can increase the confidence score of another. In practice, the surface is larger than the sum of the parts because the scanners influence each other through the same input. See the AI Guardrails and AI Firewalls Guide. See the AI Guardrails and AI Firewalls Guide.

Practical implication: Test the combined scanner stack as one control surface, not as a set of independent filters.

How branch-and-bound evasion turns local bypasses into full-system failures

BRANCH treats evasion as a search problem. It identifies which scanner is currently most blocking, applies a perturbation technique against that scanner, and then evaluates whether the resulting candidate improves overall bypass probability across the full guardrail stack. That differs from single-objective evasion methods, which collapse feedback into one signal and can miss the fact that progress against one scanner may worsen another. The tree-based approach matters because it lets the attacker chain multiple partial wins into one working bypass while preserving the original semantic intent of the prompt. See the AI Security Platform Buyer's Guide. See the AI Security Platform Buyer's Guide.

Practical implication: Assume adversaries will chain small wins into a complete bypass unless you validate the whole decision path.

Why transferability matters more than a single successful bypass

A bypass that only works against one environment is a lab finding. A bypass that transfers to unseen guardrails becomes a deployment risk. Mindgard's results show that candidates generated against one target can evade others without modification, which means the attacker does not need intimate knowledge of the production stack to get value from the technique. That is especially important for AI deployments where the same prompt, policy, or tool-routing pattern may be reused across environments. Once the bypass logic generalises, the control failure is architectural rather than local.

Practical implication: Validate whether evasion techniques transfer across environments before you treat a passing test as coverage.

Threat narrative

Attacker objective: To deliver a malicious prompt or unsafe instruction through layered AI guardrails without altering its operational meaning.

1. Entry begins with a malicious prompt that is repeatedly mutated to probe the combined guardrail stack and discover which scanners respond most strongly.
2. Credential_harvested is not the right frame here; instead, the attacker iteratively harvests control weaknesses by learning which perturbations reduce one scanner without triggering the others.
3. Escalation occurs when the attacker chains multiple perturbations into a semantically preserved prompt that slips through the full multi-scanner system.
4. Impact is successful delivery of unsafe instructions, jailbreak content, or malicious tool-use prompts into the downstream model or agent workflow.

Breaches seen in the wild

• DPD chatbot incident 2024: A customer got DPD's AI chatbot to swear and mock its owner; DPD blamed an error after a system update and disabled the AI element.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Multi-scanner guardrails are a system design problem, not a detector-count problem. Adding more scanners can improve coverage, but it also introduces interaction effects that attackers can exploit. If one scanner's bypass path increases another scanner's confidence, the stack is not acting like defence in depth; it is acting like a coupled optimisation surface. Practitioners should treat scanner interactions as part of the control design, not as an implementation detail.

AI guardrail governance now has an identity and workflow dimension. Once an AI application can call tools, access files, or act on behalf of a user or service, a successful prompt bypass is no longer just a model-safety event. It becomes a control-plane problem for permissions, delegated actions, and runtime authorisation, which is why AI security platform evaluation needs to include how the system behaves after a prompt reaches the tool layer.

Transferable bypasses create a false sense of local assurance. A guardrail that survives internal testing may still fail when the same prompt logic is reused in a different deployment, vendor stack, or agent workflow. That means assurance has to extend beyond point-in-time red teaming toward repeatable adversarial validation across environments. The practitioner takeaway is to measure resilience against generalised evasion, not only against a single test corpus.

Semantic preservation is the most operationally important part of the finding. If an attacker can change the surface form while keeping the malicious intent intact, then keyword filters and simple pattern matching are not enough. The control objective has to move from blocking known strings to resisting meaning-preserving transformations across the full runtime path. That changes how AI security teams define success for guardrails in production.

What this signals

Ensemble-aware red teaming is becoming mandatory for AI runtime protection. The relevant test is no longer whether one scanner can block one prompt, but whether a layered defence can survive adaptive chaining across the entire policy stack. That means guardrail tuning, routing logic, and escalation paths all need to be exercised together before production rollout.

Prompt filtering and identity governance are converging at the tool boundary. Once an AI system can act through files, APIs, or delegated permissions, a successful jailbreak becomes a governance issue for who or what is allowed to execute the next step. Teams should validate tool access, not just text moderation, because the operational risk appears after the model output is accepted.

Meaning-preserving evasion is the practical benchmark defenders should care about. A control that only catches obvious rewrites is easy to overestimate. If an attacker can keep the intent intact while changing the surface form, then the security programme needs adversarial validation that measures resilience to semantic preservation rather than simple phrase matching.

For practitioners

• Validate the full guardrail stack as one control Test combined scanners against adaptive prompts that are designed to trigger scanner interference, not just single-detector failures.
• Measure transferability across environments Re-run bypass attempts against separate staging, vendor, and production configurations to see whether a local bypass still works when the stack changes.
• Test runtime controls after tool routing Check what happens when a prompt passes the guardrail layer but then reaches tool calls, file access, or delegated actions inside an agent workflow.
• Reduce scanner interference in control design Tune thresholds, ordering, and escalation logic so one scanner's remediation path does not create a blind spot in another scanner.

Key takeaways

• BRANCH shows that layered AI guardrails can fail as a coupled system, not just as isolated scanners.
• The paper reports 100% attack success across 120 bypass scenarios and transfer to 29 unseen guardrails.
• For practitioners, the lesson is to test multi-scanner systems against adaptive, meaning-preserving attacks before trusting them in production.

Related NHI Mgmt Group resources: AI Guardrails and AI Firewalls Guide · AI Security Platform Buyer's Guide · AI Security Maturity Model · Breach and Attack Simulation (BAS) Guide

Key terms

• Multi-Scanner Guardrail System: A multi-scanner guardrail system combines several AI content or policy filters before a prompt, output, or tool request is allowed to proceed. The security value depends on how the scanners interact, because attackers can exploit gaps between them as easily as they can defeat one detector.
• Meaning-Preserving Evasion: Meaning-preserving evasion is the practice of changing a malicious prompt's surface form while keeping its intent intact. In AI security, the challenge is to detect semantic manipulation rather than only matching known words, patterns, or obvious jailbreak strings.
• Scan Interference: Scan interference is the distortion or blocking of penetration test activity by defensive controls such as intrusion prevention systems or web application firewalls. It matters because the test is meant to assess exposure to exploitation, not the detection or suppression behavior of security appliances.
• Transferable Bypass: A transferable bypass is an evasion method that works on one target and remains effective against another system without substantial modification. In AI security, transferability matters because it turns a local control weakness into a broader production risk across deployments and vendors.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and identity lifecycle control. It helps security teams connect identity governance to the broader security decisions that shape runtime AI risk.