Explaining a guardrail also shows you how to bypass it.

An XAI study on Meta's Prompt Guard 2 found its decisions rest on many small token contributions rather than a few dominant ones, which sounds sturdy until the same Vanilla Gradient and SHAP attributions get pointed the other way. Saliency-guided synonym substitution and sentence-level paraphrasing flipped predictions while changing only a moderate fraction of the text, in some cases jailbreaking the underlying model. Dataset-scale analysis showed undetected injections systematically lack the lexical markers the classifier depends on. (arXiv 2609.24801)