Imagine a bank vault with a transparent door. You can see every gear, every tumbler, every spring. That transparency was supposed to build trust — but it also lets the locksmith-turned-burglar study the mechanism at leisure. This paper does exactly that to Meta's Prompt Guard 2, one of the most widely deployed classifier-based guardrails for LLMs, and finds that the very tools designed to make its decisions interpretable also dramatically lower the cost of breaking it. The committed claim: XAI attribution methods (Vanilla Gradient and SHAP) can reverse-engineer the decision logic of production guardrail classifiers, and the resulting saliency maps can be weaponized to construct adversarial inputs that flip the classifier's verdict — in some cases yielding actual jailbreaks against the underlying LLM. This is not a new attack vector in the abstract; adversarial perturbation of text classifiers is well-trodden ground. What's new is applying it specifically to the guardrail layer that sits between users and deployed LLMs, turning the transparency mandate against the defense. The architecture is straightforward: Prompt Guard 2 is a DeBERTa-based text classifier fine-tuned to distinguish benign prompts from injections and jailbreaks. The authors run four experiments. First, they compute token-level saliency maps using Vanilla Gradient and SHAP to identify which tokens drive the classifier's decisions. Second, they perform saliency-guided synonym substitution — replacing the highest-attribution tokens with semantically equivalent alternatives. Third, they apply sentence-level paraphrasing guided by the same saliency rankings. Fourth, they conduct a dataset-scale analysis comparing the saliency profiles of detected versus undetected injection prompts. The key finding cuts both ways: Prompt Guard 2 does not rely on a small set of 'trigger words' but on the cumulative contribution of many tokens. That sounds robust — except that saliency-guided synonym substitution and paraphrasing can still flip its predictions while altering only a moderate fraction of the input text. The dataset-scale analysis adds a structural insight: undetected injections systematically lack the lexical markers the classifier expects. The classifier is essentially pattern-matching on a learned vocabulary of malicious-looking tokens, and prompts that express the same intent through unfamiliar phrasing slip through. The integrity picture is mixed. This is an exploratory case study on a single classifier (Prompt Guard 2) with experiments designed by the same team interpreting the results. There is no pre-registration, and we do not know if the authors ran additional experiments that did not make the cut. The choice of Prompt Guard 2 is defensible — it is a real, widely deployed system — but generalizing from one classifier to 'classifier-based guardrails' as a category requires caution. The benchmarks are internally constructed, not community-standard adversarial robustness suites. The dual-use tension is the real contribution. The paper argues explicitly that explanation methods intended for transparency simultaneously lower the cost of adversarial bypass construction. This is not a speculative worry — it is demonstrated empirically in the four experiments. The implication for the guardrail design community is uncomfortable: the more interpretable you make your defense, the cheaper you make it to attack. This mirrors a recurring pattern in security research where defensive tooling doubles as offensive reconnaissance. What the paper does NOT do is quantify the attack success rate precisely against the underlying LLM in a systematic way, test against multiple guardrail architectures, or propose a concrete mitigation. The 'in some cases yielding a successful jailbreak' qualifier is doing heavy lifting. The next obvious experiment — running this methodology against Llama Guard, NeMo Guardrails, and other production systems — would tell us whether this is a Prompt Guard 2 idiosyncrasy or a structural vulnerability of the classifier-based guardrail paradigm. The authors almost certainly know this; it is either the next paper or it did not produce clean enough results to include here.
