One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails

Key points

• Recent work places these models in agent systems as guardrails: the component that reads a proposed tool call or incoming message and decides whether to allow it.1
• We evaluate seven open-weight models in that role and report the two error directions separately: a fail-open error allows a prohibited action and is a vulnerability; a fail-closed error blocks a permitted one and is only a cost.1
• Escalating the least confident decisions does not help either: a decision an attack has reversed is no less confident than the one it replaced.1
• Parsing each policy field into a typed value does eliminate one attack, but it also makes the model unnecessary: a deterministic rule over those values reaches 100% accuracy on all six policies.1

Sources (1)

• [1]One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 8, 04:46 PM

  A typed decision model reads a piece of text and returns a probability over caller-defined options, each with a short written definition, generating no text.

  Recent work places these models in agent systems as guardrails: the component that reads a proposed tool call or incoming message and decides whether to allow it.

Extractive summary: sentences quoted from the sources.