The option-channel attack: why typed decision models fail as autonomous agent guardrails

Azizi et al. audit typed decision models used as agent guardrails, showing how semantic manipulation of option labels drives fail-open rates up to 100%.

Primary source: arXiv:2610.12292: https://arxiv.org/abs/2610.12292

What’s new: Typed decision models, which evaluate text inputs to output probability distributions over discrete options without generating freeform tokens, are increasingly used as security guardrails for autonomous LLM agents. Positioned as execution gates, these models inspect candidate tool calls or messages to determine whether an action should be permitted or blocked. In One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails (arXiv:2610.12292, 8 Oct 2026), Azizi et al. perform a comprehensive security audit of seven open-weight decision models, evaluating their resilience to adversarial evasion.

The authors report fail-open errors (permitting a prohibited action) and fail-closed errors (blocking a permitted action) separately. On prompt-injection, jailbreak, and toxic content benchmarks, decision-gate accuracy ranges from 36% to 72% against a 50% chance baseline, with low directional error rates often merely reflecting an uncalibrated default bias. On a synthetic suite of agent tool calls, appending six lines of irrelevant server logs raises the fail-open rate from 0% to 63% on a policy the model previously evaluated correctly. Worse, the authors identify the option-channel attack: assigning the permissive option a misleading name while leaving its text definition untouched drives fail-open rates to between 93% and 100% on models that place labels in their context. Confidence-based human escalation fails because attack-reversed decisions show the exact same confidence levels as genuine verdicts.

Why it matters: As agents receive access to terminals, APIs, and write privileges, developers often assume that classification-only guardrails eliminate the jailbreak risks of generative language models. This audit demonstrates that typed decision models remain vulnerable to subtle semantic manipulation, proving that neural classifiers cannot serve as standalone execution boundaries without deterministic schema validation.

Caveats: The audit focuses on single-step classification gates over predefined option sets. While deterministic rule engines over parsed input fields completely prevent the attack, as the authors note, deterministic validation removes the need for the neural decision model altogether.