{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.",
    "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.",
    "baseline": "Your existing checks with the same tasks, permissions, and tool responses.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2609.24801",
  "title": "Decoding Guardrails: XAI-Guided Perturbation Analysis of Prompt Injection Detection",
  "summary": "The method replaces blind trust in classifier-based guardrails such as Prompt Guard 2 with a white-box audit that uses gradient and SHAP attributions to identify decision-critical tokens, then flips predictions via saliency-guided synonym substitution and sentence-level paraphrasing. It costs only modest compute, since attribution and paraphrase generation run on a single GPU or through APIs, but it adds an evaluation pipeline and requires access to the guardrail's gradients or outputs. What can fail is the defense itself: the paper shows undetected injections systematically lack the lexical markers the classifier depends on, so a team that adopts the classifier without layered checks retains a quantified-unknown bypass risk that the same XAI tooling lowers for attackers.",
  "rationale": "The reader deploying an LLM behind a classifier guardrail can cheaply replicate this audit to measure their own bypass exposure, but the paper offers no deployable defense and its core lesson is that the classifier alone is insufficient.",
  "technique": "XAI-guided adversarial auditing of injection classifiers",
  "family": "seguranca_e_guardrails",
  "recommendation": "testar",
  "published": "2026-09-21",
  "as_of": "2026-10-18",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2609.24801",
  "independent_implementations": 0,
  "total_implementations": 1,
  "stars": 1,
  "citations": 0,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "The method replaces blind trust in classifier-based guardrails such as Prompt Guard 2 with a white-box audit that uses gradient and SHAP attributions to identify decision-critical tokens, then flips predictions via saliency-guided synonym substitution and sentence-level paraphrasing. It costs only modest compute, since attribution and paraphrase generation run on a single GPU or through APIs, but it adds an evaluation pipeline and requires access to the guardrail's gradients or outputs. What can fail is the defense itself: the paper shows undetected injections systematically lack the lexical markers the classifier depends on, so a team that adopts the classifier without layered checks retains a quantified-unknown bypass risk that the same XAI tooling lowers for attackers.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2609.24801",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}