Preprint: Branching Tree Search Method Bypasses Multi-Scanner AI Guardrails with 72% Fewer Queries
New attack method achieves 100% bypass rate on 6 guardrail systems and transfers to 8 commercial black-box guardrails.
ImportanceMaterialEvidenceE2 unreplicatedWrite-upQuick
Key Finding: A branching tree search method named BRANCH achieved a 100% attack success rate against multi-scanner AI guardrails in the authors' self-tests, while reducing query counts by 72%.
Context: Traditional single detectors are easily bypassed, leading the industry to adopt collaborative defense systems composed of multiple scanners that use shared latent representations to resist known attacks.
Conclusion: The method uses dynamic adversarial perturbation optimized for overall improvement across all scanners. Experiments show it is effective in 120 scenarios, and the generated bypasses transfer to 29 unseen guardrails (including 8 commercial black-box ones), achieving up to 100% success in some cases without additional optimization.
Boundary: This is an arXiv preprint (submitted Oct 7, 2026). Data is self-reported by the authors and has not yet been independently reproduced or peer-reviewed.