--- title: "Peering Behind the Shield — paper by Yang et al. (2026)" description: "The authors propose AP-Test. 2 references, cited by 1 paper here. Among them: 0." authors: ["Ziqing Yang", "Yixin Wu", "Rui Wen", "Michael Backes", "Yang Zhang"] year: 2026 venue: "Findings of the Association for Computational Linguistics: ACL 2026" source: "https://aclanthology.org/2026.findings-acl.566/" doi: "10.18653/v1/2026.findings-acl.566" licence: "CC BY 4.0 (ACL Anthology)" licence_url: "https://creativecommons.org/licenses/by/4.0/" summary_licence: "Elamur Cosmic License" canonical: "https://research.elamur.ai/free/en/papers/yang-2026-peering-behind-shield-guardrail-identification/" --- [Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/yang-2026-peering-behind-shield-guardrail-identification/) [home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/15/) / Peering Behind the Shield: Guardrail Identification in Large Language Models # Peering Behind the Shield: Guardrail Identification in Large Language Models **Authors:** [Ziqing Yang](https://md.research.elamur.ai/free/en/authors/ziqing-yang/), [Yixin Wu](https://md.research.elamur.ai/free/en/authors/yixin-wu/), [Rui Wen](https://md.research.elamur.ai/free/en/authors/rui-wen/), [Michael Backes](https://md.research.elamur.ai/free/en/authors/michael-backes/) and [Yang Zhang](https://md.research.elamur.ai/free/en/authors/yang-zhang/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/) **Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.566/) · [PDF](https://aclanthology.org/2026.findings-acl.566.pdf) · [DOI 10.18653/v1/2026.findings-acl.566](https://doi.org/10.18653/v1/2026.findings-acl.566) · [OpenAlex](https://openalex.org/W4407131685) **Citations:** 0 citations (OpenAlex, 2026-10-14) · 1 in our library, of the 149,439 papers whose bibliographies we read ## Summary Conversational AI agents often place safety guardrails before or after their core LLM. Knowing which guardrail is in use lets an attacker treat it as a white-box target. Existing LLM fingerprinting methods transfer poorly to this task for four reasons: guardrails give near-binary verdicts, agents allow only black-box queries, the guard's position in the pipeline is unknown, and decision thresholds are usually set ad hoc. The authors propose AP-Test. It optimizes adversarial prompts that one candidate guardrail flags as unsafe while other guards and safety-aligned LLMs treat them as harmless. A tailored loss guides this optimization, starting from a set of normal queries. The agent is then probed in two ways: - **Input guard test:** the prompts are sent directly. - **Output guard test:** the agent is asked to repeat the prompt, so any output guard sees the text. A new match score turns the agent's refusals into a decision using only the candidate guard. Across agents built on Llama3.1 and GPT4o with 10 guardrails, the method reaches perfect accuracy in several settings. The authors frame this as useful both to attackers and to owners checking for unauthorized use of their guardrail. ## Key points - **Candidates:** four open-source guardrails were tested, including WildGuard and the LlamaGuard family. The code is at github.com/TrustAIRLab/AP-Test. - **Main result:** the WildGuard-specific input guard test reached Acc = 1.00 on both Llama3.1-based and GPT4o-based agents. AP-Test also worked on agents running two different guardrails. - **Loss term L3:** this term keeps prompts safe for non-target guards. Without it, a WildGuard-only agent was mistaken for one using LlamaGuard3, with a refusal rate of 0.86 against a target rate of 0.98. - **Ablation setup:** LlamaGuard3 was the candidate across 11 Llama3.1-based agents. Losses converged around epoch 50. - **Query set:** swapping in 50 Alpaca samples or 50 synthetic questions generated by GPT 5.2 gave comparable results. Removing the query set caused misidentification: refusal was 0.98 on the LlamaGuard agent versus 0.92 on the LlamaGuard3 agent. *Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.* ## Institutions - [Helmholtz Center for Information Security](https://md.research.elamur.ai/free/en/labs/helmholtz-center-for-information-security/) — Research institute, Saarbrücken, Germany · 14 works · 1,172 citations - [Institute of Science Tokyo](https://md.research.elamur.ai/free/en/universities/institute-of-science-tokyo/) — University, Tokyo, Japan · 10 works · 20 citations 📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works 🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works ## Cite Cite as: Ziqing Yang, Yixin Wu, Rui Wen, Michael Backes and Yang Zhang. 2026. Peering Behind the Shield: Guardrail Identification in Large Language Models. Findings of the Association for Computational Linguistics: ACL 2026. The paper itself, not this page. BibTeX from the library's record of the work. ```bibtex @inproceedings{yang2026peering, title = {{Peering Behind the Shield: Guardrail Identification in Large Language Models}}, author = {Ziqing Yang, Yixin Wu, Rui Wen, Michael Backes and Yang Zhang}, booktitle = {Findings of the Association for Computational Linguistics: ACL 2026}, year = {2026}, doi = {10.18653/v1/2026.findings-acl.566}, url = {https://doi.org/10.18653/v1/2026.findings-acl.566} } ``` - [← previous PEAR: Pairwise Evaluation for Automatic Relative Scoring in Machine Translation](https://md.research.elamur.ai/free/en/papers/proietti-2026-pear-pairwise-evaluation-automatic-relative/) - [next → Personal Information Parroting in Language Models](https://md.research.elamur.ai/free/en/papers/subramani-2026-personal-information-parroting-language-models/) - [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/15/) ## References 2 references, 0 of them with a card of ours. ↗ leads to the work. 1. Perspective API. [https://www.perspectiveapi.com](https://www.perspectiveapi.com). [↗](https://www.perspectiveapi.com) 2. Amazon. 2025. AWS Responsible AI Policy. [https://aws.amazon.com/cn/machine-learning/](https://aws.amazon.com/cn/machine-learning/) responsible-ai/policy/. \#\# Limitations [↗](https://aws.amazon.com/cn/machine-learning/) *Updated 1 November 2026*