AI guardrails are becoming a standard control in production AI systems for run-time protection.
They are used to monitor user inputs, model outputs and agent behavior, helping determine whether a prompt should be allowed, blocked or routed for further review. In practice, this can mean identifying prompt injection, jailbreak attempts, toxic content, malicious code, policy violations or other unsafe instructions before they reach the model or tool layer.
However production AI deployments are rarely protected by a single isolated guardrail.
Developers increasingly combine and stack multiple guardrails together into a broader guardrail system. Each scanner may be designed to detect a different class of risk, and the system only allows a prompt through if it avoids being blocked by every relevant scanner. This makes intuitive sense: layered defenses should reduce blind spots and make evasion harder.
Mindgard and Lancaster University’s new research paper, “BRANCH: Bypassing Restrictions via Adaptive Node-based Candidate Heuristics,” shows why this assumption needs to be tested.
BRANCH is a novel guardrail evasion methodology built specifically for multi-scanner guardrail systems. The proposed approach demonstrates that even when guardrails are combined to create a more sophisticated defense, it is still possible for researchers to still generate bypasses that evade every scanner simultaneously.
Most established guardrail evasion techniques were designed to target individual classifiers - or scanners.
Evasion techniques work by modifying a malicious prompt in ways that preserve its underlying meaning while changing the surface form enough to avoid detection. For example, a technique might substitute words, inject characters, introduce spelling changes or apply other perturbations to lower the confidence score of a target guardrail.
That approach becomes more difficult when a guardrail system contains multiple scanners.
A prompt might be flagged by a prompt injection scanner, a toxicity scanner, a jailbreak scanner and a malicious code scanner at the same time. Reducing the confidence of one scanner does not necessarily reduce the confidence of the others. In some cases, changing the prompt to bypass one scanner can cause another scanner to activate. Moreover as a perturbation technique begins to modify the input to achieve a bypass, guardrail scanners who originally were not blocking can become activated due the modifications to the input.
Instead of needing to cross one decision boundary, the attacker needs to cross several overlapping decision boundaries simultaneously. Existing single-objective techniques struggle in this setting because they typically collapse all scanner feedback into one signal, then optimize against whichever scanner appears most important at that moment.
That can lead to scanner interference: the attack suppresses one blocking scanner, only for another scanner to become the dominant blocker. This is problematic because established approaches primarily focus on a single-objective, including distinct phases within their lifecycle to identify key features within the input to modify based upon the initial feedback from the target. Therefore, these techniques lack the ability to isolate scanners they are optimizing against, instead treating all scanners as a single target.
BRANCH approaches the problem differently.
Rather than treating the guardrail system as one flat target, BRANCH uses a branching tree search that isolates and attacks individual scanners within the system. Each node in the search tree focuses on the scanner with the highest blocking confidence, applies an evasion technique against that scanner, then evaluates whether the resulting candidate improves the bypass across the guardrail system as a whole.
In simpler terms, BRANCH does not try to solve the entire guardrail system in one move, and instead gradually builds a bypass by chaining perturbations together. One branch may reduce the confidence of a prompt injection scanner. Another may reduce the confidence of a toxicity scanner. Another may help evade a code or jailbreak scanner. BRANCH scores these candidates based on their total progress toward bypassing every scanner, then expands the most promising path.
This is important because it separates two problems that are often blended together.
The first problem is generating a perturbation that can reduce one scanner’s confidence. The second is selecting the perturbations that move the full guardrail system toward a successful bypass. BRANCH decouples those tasks, allowing it to use existing evasion techniques while making better decisions about how to combine them.
The result is a method that is technique-agnostic. BRANCH can use older evasion techniques, newer techniques and combinations of techniques, enabling the ability to select approaches which work best against the target system.
Mindgard and Lancaster University evaluated BRANCH against six target guardrail systems across 120 bypass scenarios.
BRANCH achieved a 100% attack success rate across all six targets.
We observed that the ability for BRANCH to chain multiple perturbation techniques together enabled generation of more sophisticated bypass solutions. In doing so, weaker techniques which achieved lower ASRs were able to contribute meaningfully to bypassing guardrail systems.
The research also found that BRANCH was substantially more efficient than established approaches. Compared with the strongest baseline, BRANCH used 72% fewer queries and reduced wall-clock time by 4.5x, while preserving the semantic meaning of the original malicious prompt.
This is important because within an adversarial scenario, attack effectiveness is evaluated both in terms of success, feasibility, and cost. If an approach requires too many queries, too much time or too much manual effort, it can be less practical. BRANCH shows that multi-guardrail bypasses can be generated both reliably and efficiently.
Moreover, bypasses generated by BRANCH are also semantically similar to the input original prompt and comparable to established bypassing approaches.
One of the key findings of our research was when we evaluated whether bypasses generated against one guardrail system could transfer to others without any further modification.
We found that BRANCH increased single-shot guardrail evasion by an average of 32.9 percentage points without any further modification to the prompt.
BRANCH-generated bypasses transferred to 29 out of 32 entirely different guardrails not used within experimentation, and and does so without any modification of the prompt. This results in creating single-shot guardrail bypasses across 29 unseen guardrails targets, 8 of which were commercial black-box guardrail offerings. We highlight that BRANCH was able to increase ASR on average by 32.9 percentage points, in some cases, transfer improved ASR up to 100%. In the cases where we couldn’t transfer to, we believe expanding the targets we optimized against using BRANCH, and increasing the number of candidate prompts to bypass would increase the likelihood of transferability considerably.
This has significant implications for production AI security.
We demonstrate that an attacker does not need full access to a commercial guardrail system to generate an effective bypass. They can instead optimize against a local or accessible guardrail, then transfer the resulting bypass to a black-box production environment.
The most important lesson is not simply that guardrails can be bypassed.
Security teams already know that no individual control is perfect. The more important finding is that stacked guardrail systems, which are often assumed to be more robust run-time protection against evasion, need to be evaluated as adversarial systems in their own right.
A collection of guardrails is not automatically equivalent to defense in depth.
When multiple scanners are combined, they create new interactions, overlapping decision boundaries and failure modes. Some combinations may improve coverage. Others may introduce unexpected gaps. Without adversarial testing, teams may not know whether the system actually blocks the attacks it is expected to stop.
BRANCH gives guardrail creators and AI security teams a way to evaluate that question more directly. It can be used to test whether a guardrail system holds up against adaptive, chained evasion techniques. It can also help red teams assess whether widely used guardrail offerings can be bypassed when deployed as part of real AI applications and agentic workflows.
Mindgard’s own disclosures show that these risks are already moving beyond unsafe model responses. Across public AI systems and AI-enabled developer tools, we have demonstrated issues involving environment and system leakage, attempted attack propagation, and data-exfiltration paths from development environments. The lesson for defenders is clear: once AI systems are connected to files, tools, identities and workflows, a successful bypass can become an operational security issue.
Guardrails and AI run-time protection can still play an important role in AI defense, however this research reinforces that they should not be treated as the primary means to secure your AI applications.
BRANCH helps move AI security research closer to the way AI systems are actually deployed.
Developers are not defending isolated models with one classifier at the edge. They are building layered systems with multiple scanners, runtime controls, application logic, policies and human escalation paths (and even these more sophisticated systems can be readily bypassed). Those systems need to be tested against attackers who adapt to the full defense, not only one component.
The research reinforces several practical principles:
BRANCH does not mean guardrails are useless, although it does mean guardrails and run-time AI protection need to be validated continuously under realistic adversarial conditions, as part of a broader AI security program. Defensive teams need to know not only whether a guardrail blocks known attacks, but whether it can withstand adaptive attempts to find and exploit the gaps between multiple layers of protection.
BRANCH gives defenders a way to understand where and how multi-guardrail systems fail, and what needs to be strengthened before attackers discover the defensive gap first.
Mindgard helps organizations discover, assess and defend their AI systems. Spun out of more than a decade of AI security research at Lancaster University in the UK and headquartered in Boston and London, Mindgard operationalizes the expertise of AI researchers and offensive security practitioners through a Security Platform that performs Shadow AI discovery, AI red teaming, and run-time AI protection to assess and mitigate risk across models, agents, and applications.
The expert-level checklist for operationalizing NIST AI RMF, ISO/IEC 42001 and the EU AI Act. 190+ interactive items and a board-ready maturity scorecard. Built for CISOs, AI governance leads and ML engineering teams.
