[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83628-en":3,"doc-seo-83628-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},83628,1649267921044,"Ava Thompson","https://us-avatar.wpscdn.com/avatar/1800007509477c92dfb?_k=1782875107921204101",8,"Research & Report","Behind the Refusal: Determining Guardrail Activation via Behavioral Monitoring","As large language models (LLMs) and agentic systems move into real-world deployments, safety and security become a core requirement. Guardrails that detect and block malicious instructions are essential, yet black-box adversarial testing struggles to tell whether a rejection came from the guardrail or from the LLM itself. The paper introduces a black-box guardrail reconnaissance method using behavioral monitoring of HTTP, lexical, and timing signals without prior knowledge. Experiments show 100% detection accuracy, significant benign–malicious separation (q\u003C0.001), and strong identification of guardrail-blocked categories, with average F1=98% on unseen prompts.","Behind the Refusal: Determining Guardrail Activation via Behavioral  \nMonitoring  \nWilliam Hackett1,2 Peter Garraghan1,2  \n1Mindgard, 2Lancaster University  \n{william.hackett, [peter}@mindgard.ai](peter}@mindgard.ai)  \narXiv :2607 .02 12 1v 1 [ cs .CR] 2 Jul 2026  \nAbstract  \nAs Large Language Models (LLMs) and agentic systems become integrated into real-world applications, ensuring their safety and security is critical. Guardrail systems that detect and block malicious instructions sent to and from an LLM are an essential component of AI security. However, researchers conducting black-box adversarial emulation against production AI systems often struggle to determine whether a guardrail block or an LLM rejection has occurred. This distinction is important because the techniques used to bypass guardrails can differ substantially from those used to bypass LLM safety alignment, and has a material impact on attack technique selection and optimization. We propose the first black-box guardrail reconnaissance methodology, which detects the presence of a guardrail within a target AI system through behavioral monitoring of [HTTP](HTTP), lexical, and timing signals, assuming only black-box access and zero prior knowledge of the guardrail or AI system. Experiments demonstrate that our approach detects guardrail presence with 100% accuracy, with statistically significant behavioral separation between benign and malicious interactions (q \u003C 0.001) . Our approach further identifies the content categories a guardrail is designed to block, and distinguishes guardrail blocks from LLM rejection on unseen prompts with an average F1 score of 98% .  \nKeywords: Guardrails, AI Security, Adversarial Reconnaissance, Behavioral Monitoring  \n1 Introduction  \nArtificial Intelligence (AI) systems have become increasingly prevalent across various domains, such as healthcare, finance, and customer service, driven by advances in Large Language Models (LLMs) and their ability to be used for a wide range of complex tasks (Zhao et al., 2026) . As these systems are  \ndeployed in production AI applications, ensuring their safety and security has become critical, as they are increasingly targeted by adversaries who seek to exploit vulnerabilities for malicious purposes (Shayegani et al., 2023) . One of the most common attack vectors is through the manipulation of user inputs, such as prompt injections and jailbreaks, which can lead to unintended harmful and potentially dangerous outputs from AI systems (Russinovich et al., 2025 ; Pavlova et al., 2024 ; Liu et al., 2025) .  \nTo mitigate these risks, detection systems called Guardrails have been developed to protect deployed LLM-driven AI systems by evaluating inputs and outputs for malicious content violating predefined safety and security criteria (Rebedea et al., 2023 ; Hackett et al., 2025 ; Bassani et al., 2025 ; Zhou et al., 2026) . Guardrails detect a wide range of content, such as prompt injection, jailbreaks, and other safety-violating prompts, allowing the system to react to a block signal by withholding malicious content before it influences LLM generation or reaches the end user (Hackett et al., 2025) . Such systems are commonly deployed as amiddleware layer embedded within the system architecture, providing an additional line of defense (Dong et al., 2025) .  \nTechniques within adversarial ML literature typically rely on the feedback received from the target system to mutate and optimize their attack strategy, such as multi-turn jailbreak attacks where a rejection from the target is used to inform the next prompt mutation (Russinovich et al., 2025 ; Renet al., 2026) . However, mutations to attack techniques (such as evasion attacks) employed to bypass guardrails can be substantially different tobypassing the underlying training and safety alignment of a target LLM (Hackett et al., 2025 ; Zhou et al., 2026 ; Chu et al., 2025 ; Pavlova et al., 2024) . Failure to make this distinction results in guardrail ","cbCairsKifDhbPEt","https://ap.wps.com/l/cbCairsKifDhbPEt","pdf",1258222,1,19,"English","en",105,"# Abstract\n# Introduction\n## Background: LLM attacks and guardrails\n## Problem: distinguishing guardrail blocks from LLM rejection\n## Proposed approach and contributions","[{\"question\":\"Why is it hard to determine whether a guardrail blocked an interaction or the LLM rejected it in black-box testing?\",\"answer\":\"In production systems the guardrail’s presence and trigger conditions are limited and obfuscated, so attackers lack the information needed to distinguish a guardrail block from an LLM rejection.\"},{\"question\":\"What signals does the proposed guardrail reconnaissance method rely on?\",\"answer\":\"It monitors behavioral signals including HTTP, lexical, and timing features during benign and malicious interactions.\"},{\"question\":\"What performance do the experiments report for detecting guardrail presence and for identifying block behavior?\",\"answer\":\"The approach detects guardrail presence with 100% accuracy, shows statistically significant separation between benign and malicious interactions (q\\u003c0.001), and distinguishes guardrail blocks from LLM rejection on unseen prompts with an average F1 score of 98%.\"}]",1784189385,48,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"behind-the-refusal-determining-guardrail-activation-via-behavioral-monitoring","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/behind-the-refusal-determining-guardrail-activation-via-behavioral-monitoring/83628/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why is it hard to determine whether a guardrail blocked an interaction or the LLM rejected it in black-box testing?","Question",{"text":75,"@type":76},"In production systems the guardrail’s presence and trigger conditions are limited and obfuscated, so attackers lack the information needed to distinguish a guardrail block from an LLM rejection.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What signals does the proposed guardrail reconnaissance method rely on?",{"text":80,"@type":76},"It monitors behavioral signals including HTTP, lexical, and timing features during benign and malicious interactions.",{"name":82,"@type":73,"acceptedAnswer":83},"What performance do the experiments report for detecting guardrail presence and for identifying block behavior?",{"text":84,"@type":76},"The approach detects guardrail presence with 100% accuracy, shows statistically significant separation between benign and malicious interactions (q\u003C0.001), and distinguishes guardrail blocks from LLM rejection on unseen prompts with an average F1 score of 98%.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":21,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":106,"slug":137},"General","general"]