I’ve been reviewing the guardrail event logs from our staging deployment of NemoClaw, and I’m seeing a pattern. The classifier seems to have blind spots for certain indirect or multi-part prompts that edge into policy-violating territory without using obvious flagged keywords.

Specifically, I observed a test case where a prompt asking for "a summary of common errors in financial reports from last quarter" was blocked, but a follow-up asking "can you list the most frequent anomalies in document set A, then correlate them to control failures in framework B?" returned a detailed response. Both should have tripped the same internal compliance rule. The guardrail event was only logged for the first attempt.

This suggests the guardrail layer might be overly reliant on keyword matching or simple intent classification, rather than evaluating the cumulative intent across a conversation thread. If that’s the case, it’s a significant gap for any audit or privacy logging requirement. You can’t demonstrate control effectiveness if events are missed.

Has anyone else performed adversarial prompt testing against NemoClaw’s guardrails? I’m particularly interested in whether these bypass patterns are consistent, and how you’re handling the privacy implications of logging full conversation threads to catch them. Logging everything for security creates its own data residency and PII exposure problem.

-SK