Encrypted guardrails work, but only as well as the filter
Reviewing HE-Guardrail: A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inference · Byeongseo Min, Yongwoo Lee, Young-Sik Kim et al.
Researchers show that jailbreak filters can run entirely over homomorphically encrypted prompts and enforce refusals without the server ever seeing the text. The encryption reproduces the plaintext filters almost exactly, which shows the hard limit is not the cryptography but how little the filters themselves stop.
A client encrypts a jailbreak prompt and sends it to a server running an LLM. The server computes on the ciphertext, produces an encrypted answer and sends it back. It never sees the question or the harmful reply. The attack succeeds, and the operator has no way of knowing it happened.
That is the problem this research tackles. Homomorphic encryption lets a server run a model directly on encrypted data, so a client gets inference without handing over its prompts. The researchers point out that the same property shields a malicious client. Every guardrail that reads prompts or outputs in plaintext stops working.
Their answer is to run the guardrail under encryption too. The filter produces an encrypted safety score. The server compares it to a threshold using a polynomial that approximates a sign function, which yields a single encrypted yes-or-no bit. That bit then selects either the model's answer or a fixed refusal. A layer of added noise masks anything left over. The server enforces the decision without ever learning what it was.
This is clever. They built three kinds of filter this way: Llama Guard checking the prompt, JBShield reading the model's hidden states, and GradSafe working from encrypted gradients. The encrypted versions matched their plaintext decisions in 99.7% of cases. So the cryptography barely moves the outcome.
A faithful copy of a weak filter
The turn is what that fidelity reproduces. With no guardrail, the macro-average jailbreak success rate was 11.0%. Llama Guard cut it to 7.1%. JBShield left it unchanged, and GradSafe barely moved it. The encryption works. The filters are the weak part, and encrypting them changes nothing about that.
The costs are real too. Llama Guard demanded a vast amount of extra GPU memory over running the target model alone, and GradSafe was not far behind. JBShield was cheap but did little on average. Llama Guard also rejected the most benign prompts, so the strongest filter is the most expensive and the most annoying.
Then there are the gaps the researchers name themselves. Multi-turn jailbreaks are hard to reason about when the conversation history stays encrypted. The threat model assumes an honest-but-curious server. Nothing here tests an attacker who knows which filter is running and tunes prompts against it. What strikes me is that the attacker still sees every refusal while the server sees nothing. That makes iterating offline against the filter cheap, and blocking the probing client hard.
The work is genuinely useful. It shows enforcement is possible in a setting where people assumed it was not, at no cost to the target model's latency. But it should not be read as a solution to jailbreaks in encrypted inference. It moves today's filters into the ciphertext, weaknesses included. The encryption holds. The filter is still the weak part.
Further analysis
Problem
The paper studies a critical security gap in homomorphic-encrypted large language model (HE-LLM) inference: encryption that preserves client privacy also prevents the server from inspecting prompts or outputs, enabling malicious clients to submit adversarial or jailbreak prompts that can elicit harmful responses invisible to the server. This undermines standard guardrail mechanisms that operate on plaintext and raises practical concerns for privacy-preserving machine learning deployments.
Approach
The authors propose HE-Guardrail, a framework that evaluates and enforces guardrails entirely under homomorphic encryption so the server can homomorphically decide whether to return a target-model response or a predefined refusal without learning the plaintext. HE-Guardrail implements homomorphic gating using an encrypted binary decision derived from a homomorphic score comparison, a polynomial approximation of the sign function, and a gated noise flooding term to mask residual leakage. They instantiate three representative guardrails: Llama Guard (pre-processing), JBShield (intra-processing using hidden states) and GradSafe (intra-processing using encrypted gradient extraction). The implementation uses the RNS-CKKS scheme via desilofhe on two NVIDIA H200 GPUs, with target model Llama-3-8B-Instruct, slot count N/2 = 2^15, a post-bootstrapping multiplicative budget of 17 levels, padded prompt length 2,048 tokens and a 200-token generation budget. Evaluation uses 2,215 jailbreak prompts across six families and benign benchmark sets, with harmfulness judged by HarmBench-Llama-2-13b-cls.
Key Findings
- Encrypted guardrail fidelity: encrypted guardrails reproduce the corresponding plaintext guardrail decisions in 99.7% of evaluated cases, indicating HE numerical and approximation error rarely change safety outcomes.
- Attack mitigation: macro-average attack success rates (ASR) are 11.0% with no guardrail, 7.1% with Llama Guard, 11.0% with JBShield and 10.8% with GradSafe, showing Llama Guard reduces ASR the most overall while intra-processing methods show more variable effects by attack family.
- Pass rates and false positives: pass-guardrail rates average 38.7% for Llama Guard, 77.0% for JBShield and 62.3% for GradSafe; false-positive rejection on benign prompts is 1.83% (33/1,805) for Llama Guard, 0.06% (1/1,805) for JBShield and 0.17% (3/1,805) for GradSafe, with Llama Guard rejecting 22 of 1,000 OR-Bench prompts.
- Resource trade-offs: incremental GPU memory cost relative to target-only inference is approximately +140 GiB for Llama Guard (run separately), +5 GiB for JBShield and +110 GiB for GradSafe; multi-model interleaved batching allows concurrent target and guardrail execution without extra ciphertext memory but halves batch capacity.
- Latency: in the two-GPU configuration the guardrails impose no latency on the target model's end-to-end critical path because decisions are ready before final decoding, though they consume separate GPU compute and memory.
Limitations
The work assumes a semi-honest server and allows a malicious client that can choose arbitrary plaintext inputs while following the protocol. Major limitations include substantial resource costs (bootstrapping, memory, GPU usage) for some guardrails, the difficulty of reasoning over multi-turn jailbreaks under HE since conversation histories remain encrypted, and remaining practical challenges in scaling encrypted gradient computations and nonlinear approximations.
Implications
From an offensive-security viewpoint, HE-LLM deployments are vulnerable to clients who exploit encrypted channels to carry out jailbreak or multi-turn attacks that evade server inspection. HE-Guardrail shows it is possible to detect and block many such attempts within the encrypted domain, but attackers may probe differing guardrail designs to find permissive rules. The trade-offs demonstrated suggest attackers can target systems with permissive intra-processing thresholds or exploit capacity and multi-turn gaps; conversely, defenders must balance stronger detection with higher computational and false-rejection costs.
The paper title, authors and abstract
HE-Guardrail: A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inference
Homomorphic encryption (HE) has emerged as a promising approach to privacy-preserving machine learning (PPML), enabling computation directly over encrypted data. In HE-based PPML, a client submits an encrypted input to the server, which evaluates models such as large language models (LLMs) without access to the underlying plaintext. However, we identify a critical security vulnerability in this setting: HE-LLM inference is vulnerable to malicious clients that submit adversarial prompts, such as jailbreak attacks. The same confidentiality that protects benign clients also prevents the server from inspecting incoming prompts or generated responses, making adversarial attempts difficult to detect or block and potentially allowing successful attacks to remain entirely invisible to the server. To address this vulnerability, we propose HE-Guardrail, a framework that evaluates guardrail mechanisms entirely over encrypted data and homomorphically controls whether the target-model response is returned to the client. We instantiate HE-Guardrail with three representative guardrails - Llama Guard, JBShield, and GradSafe. Our results show that HE-Guardrail closely reproduces the decisions of the corresponding plaintext guardrails in the encrypted domain, with distinct security-efficiency-utility trade-offs.
