Influence-based guardrails flagged legitimate actions as attacks in all 24 base cases tested.

An authorization-equivalence audit across 96 conditions found that when a required value comes from a legitimate tool rather than directly from the user, the causal guardrail signal shifts toward attack classification in 100% of cases under both Llama and Gemma scorers, with authorization unchanged (arXiv 2608.29942). Adding a semantic monitor drove attack success to 0% but collapsed utility to 28%, against 16% attack success at 60% utility without it. A shadow-based guardrail let 57.5% of unauthorized runs past early checks against 29.2% of authorized ones. These signals describe how an action was assembled. They do not describe whether anyone approved it.