GuardRebind changes which request a safety classifier thinks it is checking

A moderation component is meant to assess the actual content routed by an application. An attacker appends an apparent replacement task in lower-trust text so that the classifier evaluates a harmless proxy question instead. The model may return a correct answer to the wrong assessment target.

GuardRebind reports that forged benign classification requests inside tool results caused the Shieldstral configuration to clear 75 of 75 harmful samples in its tested setting. Adapted payloads retained effectiveness against a modified segment-defense baseline. The study tests selected guards, prompts and benchmark samples. A complete bypass rate in that configuration is not a cross-product claim about every moderation service or production content stream.

Bind the object of review through structured application metadata outside the text being inspected, and log the exact byte range or artifact under assessment. Adversarial redirection of a safety check is distinct from persuading a task agent to execute code. The failure occurs when the monitor loses its independently specified target. Primary evidence.

Additional evidence and trust boundary

The key exploit primitive is not merely persuasion to ignore rules. It is a shift of the moderation target: the guard gives a plausible answer to a new, benign task inserted in the text it was supposed to examine. Binding the original target outside the untrusted payload prevents that exact replacement, but the paper also reports adaptive attacks against a segment-max defense. A measured defense must specify the adversary adaptation budget. Supporting record.