Research · curated 27 Sep 2026

Decoding Guardrails: XAI-Guided Perturbation Analysis of Prompt Injection Detection

First reported today arxiv.org

Coverage timeline

Single-source research — first reported, latest, and curated coincide.

Why it matters

Prompt Guard 2 is widely deployed as a first line of defense against prompt injection and jailbreaks, and this work demonstrates that XAI-guided perturbations can cheaply evade it, undermining defenders who rely on classifier-based guardrails.

An arXiv research paper by Outeda et al. applies explainable-AI techniques (Vanilla Gradient and SHAP) to probe how Meta's Prompt Guard 2 classifier-based guardrail distinguishes malicious from benign prompts. The authors show that saliency-guided synonym substitution and sentence-level paraphrasing can flip the classifier's predictions while altering only a moderate fraction of the text, in some cases producing a successful jailbreak against the underlying LLM, and that undetected injection prompts systematically lack the lexical markers the classifier relies on.