BRANCH: a tree search bypassed six AI guardrail systems

01What happened

William Hackett and Peter Garraghan of Mindgard posted BRANCH to arXiv on October 7, 2026. The paper targets multi-scanner guardrails, where detectors share latent representations and established single-technique bypasses lose their effect. The authors test six guardrail systems and measure how well their bypasses transfer to 32 more they never optimized against.

02How it works

BRANCH searches a tree of adversarial perturbations and scores each candidate by how much it improves the prompt across all scanners at once, instead of defeating one detector at a time. Separating the bypass check from the attack signal it optimizes lets the search preserve the prompt's meaning while the whole stack clears it. The authors report the search needs about 72% fewer queries than combining all eleven baseline techniques, and runs about 4.5 times faster.

03Who is affected

Teams that place a stack of prompt-injection and jailbreak detectors in front of an LLM, starting with the five named products the paper tested. The authors also report that their bypasses raised attack success by an average of 32.9 percentage points on 29 of 32 guardrails they had never tuned against, including eight commercial black-box services.

04What to do

Treat a guardrail stack as a detection layer rather than the control that stops prompt injection, since the authors report a bypass for every system they tested. Check whether the detectors in your pipeline are still maintained: Protect AI's LLM Guard, one of the six tested, is archived and read-only on GitHub.

Measured results

Sources 4 links, all fetched

1. 1arxiv.orgarXiv Paper
2. 2arxiv.orgPaper Full Text
3. 3github.comLlamaFirewall Repo
4. 4github.comLLM Guard Repo