About This Report  iii

Summary  iv

Figures and Tables  vii

Chapter 1. Introduction  1

Existing Guardrails and the Tool-level Gap  2

Threat Model  5

Chapter 2. Methods  6

Biological task design  6

Safeguard evaluation metric  7

Experimental Design  7

Evaluating robustness against subversion of LLM guardrails  8

Chapter 3. Results  10

A. The most effective safeguard: A pre-run check  10

B. LLM agent behaviors raise broader security concerns  14

Chapter 4. Discussion  18

Tool-level safeguards require high reliability to meaningfully reduce risk  18

LLM behavior systematically undermines safeguards  19

Tool-level safeguards require upstream changes by LLM and agent developers to be effective  20

Recommendations  20

Appendix A. Other safeguard techniques  22

Appendix B. Optimization of safeguard text for open-weight LLMs  25

Appendix C. Making safeguards tamper-resistant  27

Software Integrity Checks  27

Compiled Components  27

Summary  28

Appendix D. Prompts for the biological tasks  29

Abbreviations  31

References  32

About the Authors  38