# BRANCH: a tree search bypassed six AI guardrail systems

> BRANCH is a branching tree search that turns a blocked prompt into one every detector in a multi-scanner guardrail lets through.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Research, Attack
- **Published by:** arXiv
- **Disclosed:** 2026-10-07
- **Affects:** LLM Guard, Vijil Dome, Guardrails AI, Samsung Guard, LlamaFirewall
- **Research by:** William Hackett (Mindgard), Peter Garraghan (Mindgard and Lancaster University)
- **Primary source:** https://arxiv.org/abs/2610.10742
- **Page:** https://theinjection.dev/items/mindgard-branch-guardrail-bypass/

BRANCH is an attack from Mindgard that rewrites a blocked prompt step by step until every detector in a multi-scanner guardrail passes it. The authors report a 100% attack success rate against six guardrail systems across 120 scenarios.

## What happened

William Hackett and Peter Garraghan of Mindgard posted BRANCH to arXiv on October 7, 2026. The paper targets multi-scanner guardrails, where detectors share latent representations and established single-technique bypasses lose their effect. The authors test six guardrail systems and measure how well their bypasses transfer to 32 more they never optimized against.

## How it works

BRANCH searches a tree of adversarial perturbations and scores each candidate by how much it improves the prompt across all scanners at once, instead of defeating one detector at a time. Separating the bypass check from the attack signal it optimizes lets the search preserve the prompt's meaning while the whole stack clears it. The authors report the search needs about 72% fewer queries than combining all eleven baseline techniques, and runs about 4.5 times faster.

## Who is affected

Teams that place a stack of prompt-injection and jailbreak detectors in front of an LLM, starting with the five named products the paper tested. The authors also report that their bypasses raised attack success by an average of 32.9 percentage points on 29 of 32 guardrails they had never tuned against, including eight commercial black-box services.

## What to do

Treat a guardrail stack as a detection layer rather than the control that stops prompt injection, since the authors report a bypass for every system they tested. Check whether the detectors in your pipeline are still maintained: Protect AI's LLM Guard, one of the six tested, is archived and read-only on GitHub.

## Overall attack success rate, 6 guardrail systems

Higher is worse for defenders. Exhaustive combines all 11 baseline techniques.

| Result | Score |
|---|---|
| **BRANCH** (this story) | 100% |
| Exhaustive (all 11 techniques) | 80.8% |
| CLARE | 75% |

Source: https://arxiv.org/abs/2610.10742

## Quick facts

- **Systems tested:** LLM Guard, Vijil Dome, Guardrails AI, Samsung Guard, LlamaFirewall, custom ensemble
- **Attack type:** Branching tree search over adversarial perturbations
- **Found by:** William Hackett and Peter Garraghan, Mindgard
- **Posted:** October 7, 2026
- **Transfer:** 29 of 32 unseen guardrails, including 8 commercial services
- **Code:** No code release linked from the paper

## Sources

1. [arXiv Paper](https://arxiv.org/abs/2610.10742)
2. [Paper Full Text](https://arxiv.org/html/2610.10742v1)
3. [LlamaFirewall Repo](https://github.com/meta-llama/PurpleLlama/tree/main/LlamaFirewall)
4. [LLM Guard Repo](https://github.com/protectai/llm-guard)