# AI Guardrails Are Security Theater. These Researchers Want to Look Inside Instead.
The jailbreak arms race has been embarrassing the AI industry for three years. You add a filter, someone switches to French. You patch that, someone wraps the prompt in a fictional framing. You patch that, someone encodes it in Base64. The guardrails keeping large language models from helping bad actors are, in most deployments, input/output filters — sophisticated autocomplete for the security team, watching what goes in and what comes out while remaining completely blind to what's happening in between.
A team of offensive security researchers from Ben-Gurion University's Offensive AI Research Lab thinks the industry has been solving the wrong problem. Their answer — being presented at Black Hat USA 2026 next month — doesn't add another layer of output filtering. It peers inside the model itself.
## The Problem With Watching the Doors
Current AI safety architectures treat the LLM as a sealed container. You inspect the package arriving at the door, you inspect the package leaving. If the contents look dangerous by whatever classification scheme you've trained, you block it. This approach has produced a category of tooling — content classifiers, prompt injection detectors, response filters — that is, by now, reasonably mature and demonstrably inadequate.
The inadequacy isn't primarily a compute or accuracy problem. It's architectural. A filter trained to recognize "phishing language" in English may not flag an identical prompt in Swahili. A classifier built to catch direct requests for harmful content doesn't know what to do with an elaborate roleplay scenario where the harmful content is never named explicitly but is clearly the destination. These aren't edge cases anymore. They're documented, repeatable, catalogued in public jailbreak libraries that any motivated teenager can browse.
The fundamental issue: the model's internal state — the actual cognitive processing happening between input and output — contains information that surface-level analysis cannot. A model generating a phishing email and a model helping draft a legitimate marketing email may produce superficially similar token sequences. Inside the model, they're doing something very different.
## Cognitive Elements as a Common Language
What Yisroel Mirsky and his team are proposing is an approach they're calling cognitive element (CE) analysis — a framework for reading those internal states and reasoning about them at a level practitioners can actually work with.
The core insight is a deliberate separation of concerns. The neural network math — activation patterns, embedding spaces, the actual interpretability machinery — is handled at a low level. What practitioners get on top is something closer to a rule language: named cognitive elements that represent discrete semantic operations the model is performing, which can then be combined into detection logic.
An example the team offers: combine the cognitive elements "create content," "provide/give," "click/enter," and "personal information" in a logical expression, and you've described the internal signature of a model composing a phishing lure. Not the output. Not the prompt. The cognitive process itself.
The explicit design goal is a model-agnostic, open system — something like YARA or Snort rulesets, but for the inside of AI systems. YARA lets threat analysts share malware detection logic without sharing the underlying detection infrastructure. The vision here is similar: a shared vocabulary of cognitive elements and community-maintained detection rules that work across models rather than being custom-built for each one.
"What we really tried to do here is make that separation," Mirsky told Dark Reading. "All the annoying math and processes — separate from what the practitioner has to do. The practitioner wants to deal with high-level stuff — what the model should and shouldn't do."
## Why Model-Agnostic Matters More Than It Sounds
The current state of AI safety tooling is a fragmented mess of vendor-specific implementations. A guardrail built for GPT-4 doesn't port cleanly to Claude doesn't port cleanly to Gemini doesn't port cleanly to whatever open-weight model a threat actor is running locally without any guardrails at all. Every enterprise deploying an LLM is essentially starting from scratch, building detection logic that's tightly coupled to the specific model version they're using today.
This creates two problems simultaneously. For defenders, it means safety investments don't compound — every model migration is another year of catching up. For attackers, it means the attack surface is predictably shaped: find a bypass on one model, and you've often found it on several.
A genuinely model-agnostic cognitive element framework wouldn't eliminate this, but it would change the economics. If a community of security researchers can share detection rules that function across model architectures, the cumulative defensive advantage grows rather than resets with every product cycle.
---
## HackWire Analysis
There's a familiar arc in security history that this research maps onto almost exactly. Perimeter defenses — firewalls, content filters, network ACLs — were the dominant paradigm until attackers demonstrated, repeatedly, that traffic can look clean on the outside while carrying malicious intent. The response was behavioral analysis: stop inspecting packets in isolation, start modeling what systems are actually doing over time. Network security got more expensive and more effective simultaneously.
AI safety is currently at the perimeter stage. The content classifiers and prompt injection filters are the firewalls of 2024. They work fine against unsophisticated attacks and fail systematically against anyone who's bothered to study them for an afternoon. The Black Hat research is proposing a behavioral layer — introspection rather than perimeter inspection.
What's genuinely novel here is the YARA analogy and what it implies about community-scale threat intelligence for AI systems. YARA worked because the malware research community adopted a common format and shared rules openly. If the cognitive element framework produces anything like that ecosystem, the compounding effects could be significant. The alternative — every AI vendor building proprietary internal safety tooling that doesn't interoperate with anything — is where the industry is currently headed, and it's not working.
The skeptical read: interpretability research has been promising more tractable AI internals for years, and the gap between academic results and production deployments has been wide. Activation analysis that works cleanly in lab conditions on a specific model version may not generalize as promised when models update, fine-tune, or distill. The YARA comparison is appealing, but YARA rules operate on static byte patterns. Cognitive elements are operating on latent space representations that shift every time weights change.
Still, this is the direction the field needs to go. Defenders who want to get ahead of it should watch the Black Hat presentation closely and start thinking about how activation analysis fits into their AI security architecture now — before another generation of output filters proves insufficient.
— HackWire Editorial
---
## Related Coverage