Attack Chain

1. Target decomposition: The attacker splits a target codebase or filesystem into granular segments.
2. Recursive probing: The attacker submits these segments to an AI model with a request for explanation or analysis.
3. Guardrail observation: The attacker measures the model's response for perturbations indicative of guardrail activation.
4. Signal identification: The attacker records the specific input that triggered the refusal, latency spike, or reasoning interruption.
5. Bisection/Refinement: The attacker uses the guardrail engagement as a binary signal to narrow down the exact location of the vulnerability.
6. Vulnerability confirmation: Once the target area is isolated, the attacker performs manual analysis or targeted exploitation on the identified code or configuration.

Impact

The GbVD methodology allows for automated, high-precision identification of vulnerabilities without requiring the model to explicitly identify the bug. This significantly lowers the barrier for adversaries to find memory-safety flaws or privilege-escalation misconfigurations in complex environments. In controlled tests across five vulnerability classes, the methodology achieved high accuracy in locating flaws.

Recommendation

• Inventory the use of LLM-based code analysis or automated security audit tools that interact with third-party frontier AI models.
• Implement monitoring for anomalous patterns of repeated, high-frequency, or segmented queries to AI models that may indicate an automated bisection or probing attempt.
• Assume that codebases and configurations exposed to AI models may be subject to vulnerability discovery via side-channel leakage; treat all AI-processed code as potentially disclosed to the model provider.
• Establish a baseline for normal interaction latency, response length, and error rates (e.g., "reason: cyber") for automated AI analysis tools to detect potential probing activity.