RAG Makes Guardrails Unsafe? Investigating Robustness of Guardrails under RAG-style Contexts

With the increasing adoption of large language models (LLMs), ensuring the safety of LLM systems has become a pressing concern. External LLM-based guardrail models have emerged as a popular solution to screen unsafe inputs and outputs, but they are themselves fine-tuned or prompt-engineered LLMs that are vulnerable to data distribution shifts. In this paper, taking Retrieval Augmentation Generation (RAG) as a case study, we investigated how robust LLM-based guardrails are against additional information embedded in the context. Through a systematic evaluation of 3 Llama Guards and 2 GPT -oss models, we confirmed that inserting benign documents into the guardrail context alters the judgments of input and output guardrails in around 11% and 8% of cases, making them unreliable. We separately analyzed the effect of each component in the augmented context: retrieved documents, user query, and LLM-generated response. The two mitigation methods we tested only bring minor improvements. These results expose a context-robustness gap in current guardrails and motivate training and evaluation protocols that are robust to retrieval and query composition. Large language models (LLMs) have rapidly become a central component of modern AI systems, powering applications from conversational assistants to code generation (Brown et al., 2020; Jiang et al., 2024). Their ability to generalize across domains and tasks has made them widely adopted in real-world deployments (Hadi et al., 2023). However, the same flexibility that enables their success also raises serious concerns about safety. LLMs are known to occasionally produce harmful, biased, or otherwise unsafe outputs, which poses significant risks when these models are used by millions of end users (Bai et al., 2022b; Ganguli et al., 2022; Gallegos et al., 2024; She et al., 2025; Guo et al., 2025). To mitigate such risks, the research community and industry have invested heavily in methods for aligning LLMs with human safety preferences.