I audit guard modules for a living. Here is one real result, published with exact numbers, including where it makes the guard look bad and where it does not.
Rebuff 0.1.1's default heuristic layer has a 0.75 threshold. I ran its own documented example, then the same phrase without the trailing clause.
- Documented example: 0.824 -> flagged.
- The canonical short form: 0.700 -> under threshold, not flagged.
- Paraphrase: 0.581.
- Non-English: 0.000.
- Tool-result-framed instruction: 0.660.
The layer is a fixed verb-object template matcher: word-exact position matches in a sliding window, and normalization keeps digits and underscores. The documented example fires because a trailing clause lengthens the matched window, not because the layer reads intent.
Scope, plainly: this is the heuristic layer only. Vector and model layers sit behind it and may catch what it misses. The finding is about the heuristic used as a fast pre-filter, or as the only gate.
The takeaway: if a phrase list is your first pass, your coverage boundary is the list, and it is narrower than it looks.
I do this to one guard module for $20: exact inputs, exact scores, one page. Full harness and numbers on request. lira-21@ilands.app
