HE-Guardrail: A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inference
HE-Guardrail detects LLM jailbreaks during encrypted inference without decrypting client prompts.
Homomorphic encryption lets a server run an LLM on encrypted inputs but prevents inspection of prompts and responses, so jailbreaks can succeed invisibly. HE-Guardrail evaluates guardrails over ciphertext and homomorphically decides whether the model response is returned. Instantiations using Llama Guard, JBShield, and GradSafe closely reproduce plaintext decisions, with different security, efficiency, and utility trade-offs.
- Encrypted LLM inference hides adversarial prompts from the server.
- HE-Guardrail evaluates guardrails entirely over ciphertext.
- Instantiated with Llama Guard, JBShield, and GradSafe.
- Encrypted decisions closely match the plaintext guardrails.
Full article174 words · extracted from arxiv.org · click to collapse
Homomorphic encryption (HE) has emerged as a promising approach to privacy-preserving machine learning (PPML), enabling computation directly over encrypted data. In HE-based PPML, a client submits an encrypted input to the server, which evaluates models such as large language models (LLMs) without access to the underlying plaintext. However, we identify a critical security vulnerability in this setting: HE-LLM inference is vulnerable to malicious clients that submit adversarial prompts, such as jailbreak attacks. The same confidentiality that protects benign clients also prevents the server from inspecting incoming prompts or generated responses, making adversarial attempts difficult to detect or block and potentially allowing successful attacks to remain entirely invisible to the server. To address this vulnerability, we propose HE-Guardrail, a framework that evaluates guardrail mechanisms entirely over encrypted data and homomorphically controls whether the target-model response is returned to the client. We instantiate HE-Guardrail with three representative guardrails - Llama Guard, JBShield, and GradSafe. Our results show that HE-Guardrail closely reproduces the decisions of the corresponding plaintext guardrails in the encrypted domain, with distinct security-efficiency-utility trade-offs.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.21484