GuardAI evaluates the user prompt and model's draft response against a configurable policy set. Define permitted content, disclosure boundaries, and response behavior independently of the base model. Enforcement allows, blocks, or rewrites content before delivery.
The published comparison evaluates benchmark-specific safety policies on Gemini 2.5 Flash. Application-specific policies use the same enforcement layer. Full methodology and data.
Harmful requests refused (%)
Illustrative policy: prohibit stock-specific investment recommendations while allowing general financial information.
The draft response names a stock to buy. The configured policy prohibits that recommendation, so GuardAI rewrites the answer. This decision applies the organization's advice boundary to the generated content.
The base model drafts an answer. A separate policy check evaluates that draft with the latest request as context, then returns an allowed response, a refusal, or a rewrite.
Your base model generates a draft response to the user’s request.
A separate model call evaluates the draft against your configured rules, using the latest request as context.
Return the allowed draft, a refusal, or a rewritten answer. Your application handles any human-referral workflow.
Review policy-decision metadata. Configure content logging and retention for your deployment.
The Jailbreak Against Moderation (JAM) attack demonstrates why multi-layer defense is essential. JAM attacks achieved a 75.17% average success rate (19.88x higher than baselines) and only 10.21% filtered-out rate across four leading commercial and open-source models.
Collect harmful texts and pass through moderation API to obtain harmfulness scores.
Fine-tune model to mimic guardrail behavior, enabling adversarial optimization.
Use greedy coordinate descent to find character sequences that reduce detection scores.
Combine optimized ciphers with malicious prompts to bypass both input and output guardrails.
JAM attacks achieved 75.17% average success rate (19.88x higher than baselines) and only 10.21% filtered-out rate across leading commercial and open-source models. This demonstrates that output-level moderation alone is insufficient. A multi-layer policy firewall with complexity monitoring and pattern detection is essential.
A 4-role collaborative LLM system that tests guardrail effectiveness against natural-language attacks.
Converts government safety guidelines (EU AI Act, NIST) into specific test questions that should violate policies.
Guideline to test casesCreates natural-language "playing scenarios" by reorganizing jailbreak patterns from a knowledge graph of 78+ techniques.
Knowledge graph to scenariosMeasures jailbreak success using semantic similarity scores between target LLM responses and expected safe refusals.
Response to success scoreAnalyzes failed attempts and suggests iterative improvements to reduce similarity scores (max 10 iterations).
Feedback loop to generatorGUARD achieved 82% average jailbreak success rate with natural language (perplexity ~35) vs. token-level attacks (perplexity ~1500). Natural-language attacks are both more realistic (mimicking actual users) and harder to detect using perplexity-based filtering. High transferability (73-82% across models) demonstrates systemic vulnerabilities requiring proactive testing.
Published research shows 75-87% attack success rates against unprotected models. These are the threats GuardAI was purpose-built to stop.
JAM attacks achieved a 75.17% average success rate, 19.88x higher than baselines, with only a 10.21% filtered-out rate, roughly 1/6 lower than the baseline rate of 54.76%. Testing covered four leading commercial and open-source models, confirming the threat is systemic rather than provider-specific.
The papers below describe attack methods and evaluation techniques that inform our testing.
Haibo Jin, Andy Zhou, Joe D. Menke, Haohan Wang
Jin et al. demonstrate that even sophisticated moderation guardrails can be bypassed using cipher character obfuscation, achieving 75% success rate against leading commercial and open-source models.
Haibo Jin, Ruoxi Chen, Peiyan Zhang, Andy Zhou, Yang Zhang, Haohan Wang
Jin et al. introduce a 4-role LLM system for automated security testing, achieving 82% average success rate in identifying guideline violations with natural-language attacks.
These papers form the foundation of GuardAI's understanding of attack vectors and defense mechanisms, enabling us to build protection systems that address real-world threats documented in peer-reviewed research.
Test real attacks against a GuardAI-protected system and see them get caught and rewritten. Or schedule a technical deep-dive with our team.