Input rails + model + output rails + dialog rails
user turn
text / image
normalize
NFKC + homoglyph
input rail
Llama Guard 4
main model
(Lesson 17 weights)
output rail
Llama Guard / regex
dialog rail (Colang): cross-turn constraints — e.g. never discuss medical diagnosis, even if asked three ways
taxonomy (Llama Guard 4 S1–S14)
S1 violent crimes · S2 non-violent crimes · S3 sex crimes · S4 child exploit
S5 defamation · S6 specialized advice · S7 privacy · S8 IP · S9 indiscriminate weapons
S10 hate · S11 self-harm · S12 sexual content · S13 elections · S14 code interpreter abuse
documented bypasses — Huang et al. arXiv:2504.11168 (2025)
Emoji Smuggling: 100% ASR on six guard systems
NeMo Guard Detect: 72.54% ASR on adversarial jailbreak set
Homoglyph substitution: Cyrillic "р" for Latin "p"; classifier misses
Semantic paraphrase: same intent, novel vocabulary; fine-tune cannot cover all
mitigation: normalize + classifier + constitution (L17) + runtime (L10/13/14)
classifiers are a layer, not a solution