Guardrail models are classifiers that screen malicious prompts and responses in LLM‑based services. To satisfy latency constraints, many lightweight guardrails use compact Transformer backbones (e.g., DeBERTa) trained on short context windows (typically 512 tokens) and rely on bucketed relative positional encodings to handle longer inputs. Prior evaluations assumed that a guardrail’s decision remains stable as the input length grows. We show that this assumption can fail.
We introduce Overflip, a repetition‑induced instability where repeating a prompt causes the guardrail’s prediction to flip from malicious (MAL) to benign (BEN) as the sequence expands. Experiments on nine widely used lightweight guardrail models reveal that five of them exhibit MAL$\to$BEN flips on a benchmark of 100 prompts, with confidence margins shrinking steadily with repetition. Flip rates among vulnerable models range from 8% to 92%, and the first flips occur at roughly 2.6k–9.4k tokens.
Our analysis indicates that Overflip differs from traditional attention‑dilution attacks, which aim to divert attention away from malicious tokens toward unrelated content such as benign padding or shuffled text. Overflip preserves the malicious content but homogenizes token‑level attention over the repeated structure, leading to a more gradual attention‑dispersion trajectory than padding‑based dilution.
Because the bypassed prompt remains semantically intact and is still readily understood by downstream business LLMs, Overflip poses a greater threat to LLM services than conventional attention‑dilution methods. These findings expose repetition as an attack surface for guardrail models and motivate length‑robust evaluation and mitigation.
Review