A safety guard can check the wrong request while a correct search returns the wrong answer

A safety classifier can perform its assigned algorithm correctly on an attacker-chosen substitute request. A search engine can retrieve a correct passage and still present it misleadingly to both the assistant and a reviewer. These failures sit between evidence and judgment, where a reliable component may be pointed at the wrong object.

In GuardRebind, Utkarsh Kanwat and collaborators study an attacker who appends text that makes a moderation model treat a benign-looking classification task as the real review target. In the study's Shieldstral setting, one attack cleared 75 of 75 harmful prompts that a naive ignore instruction did not clear. A segment-oriented defense drove one measured success rate down to about 0.8 to 1.6 percent; an adaptive variant later bypassed 47 of 50 tested cases. These results are model- and setup-dependent.

The crucial move is not an attacker telling the model to be unsafe. It is an attacker replacing the identity of the material being evaluated. A guard that reads the same untrusted tool text for both the object and the review instruction can be persuaded to judge a different object while returning an internally plausible verdict.

William Jeffries and colleagues present a complementary risk in Warped Tool Formatters. Their tests keep the underlying retrieved information correct but alter how the tool surfaces it to a model and its verifier. In a reported research RAG setting, misleading formatting produced 90 accepted wrong answers in 90 checked trials, while the repaired formatter led to 90 rejected wrong answers in the corresponding checks. This is a narrow comparative result, not a claim that all retrieval systems have that failure rate.

The bytes used to choose what is checked cannot come solely from the same untrusted passage being checked. Likewise, a verifier should not rely on the assistant's interpretation of a formatted search result if it can inspect the original retrieval record. These are implementations of audit context completeness rather than generic instructions to "be more cautious".

An application-level test should preserve the exact requested action or output target in a trusted structure, inject conflicting descriptions into retrieved material, then compare the guard's target identifier and the executed effect. The security result is whether the original target remained fixed, not whether the model spoke confidently about its review.

The two research efforts report controlled manipulations, not a documented breach of a named production deployment. Their value is specifying which data object a test should bind before asking whether the judgment was right.