Explaining Prompt Guard 2 also shows you how to bypass it: saliency-guided synonym swaps flip its verdict

arXiv 2609.24801·medium signalXBlueskyLinkedInCopy link

An XAI case study on Meta's Prompt Guard 2 classifier found its decisions rest on the cumulative contribution of many tokens rather than a few dominant ones, which sounds robust until the same Vanilla Gradient and SHAP attributions are used offensively. Saliency-guided synonym substitution and sentence-level paraphrasing flipped predictions while altering only a moderate fraction of the text, in some cases producing a successful jailbreak of the underlying model. A dataset-scale saliency analysis showed undetected injection prompts systematically lack the lexical markers the classifier depends on, which is the structural reason a lexically-driven guardrail misses novel phrasings. The authors' own conclusion is worth the read: explanation methods meant to support transparency lower the cost of building bypasses.