Encrypted language model replies guarded against jailbreak prompt attacks
HE-Guardrail: A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inference
Cryptography and SecurityArtificial Intelligence
Summary
When people send secret messages to computers using encryption, those computers can't read the messages themselves. This makes it hard to stop bad or tricky questions that try to make the computer say unsafe things. The authors found a way to block these harmful messages while still keeping the messages secret using a new system called HE-Guardrail. This system works even though everything is encrypted, so it can stop bad requests without seeing the actual message.
What this means in practice
- •For cloud service providers: Implement encrypted guardrails to block harmful prompts during language model inference without decrypting user data.
- •For cybersecurity teams: Deploy encrypted content filters to detect and prevent adversarial requests in privacy-preserving AI applications.
Authors
Byeongseo Min, Yongwoo Lee, Young-Sik Kim, Yongjune Kim
Abstract
Homomorphic encryption (HE) has emerged as a promising approach to privacy-preserving machine learning (PPML), enabling computation directly over encrypted data. In HE-based PPML, a client submits an encrypted input to the server, which evaluates models such as large language models (LLMs) without access to the underlying plaintext. However, we identify a critical security vulnerability in this setting: HE-LLM inference is vulnerable to malicious clients that submit adversarial prompts, such as jailbreak attacks. The same confidentiality that protects benign clients also prevents the server from inspecting incoming prompts or generated responses, making adversarial attempts difficult to detect or block and potentially allowing successful attacks to remain entirely invisible to the server. To address this vulnerability, we propose HE-Guardrail, a framework that evaluates guardrail mechanisms entirely over encrypted data and homomorphically controls whether the target-model response is returned to the client. We instantiate HE-Guardrail with three representative guardrails - Llama Guard, JBShield, and GradSafe. Our results show that HE-Guardrail closely reproduces the decisions of the corresponding plaintext guardrails in the encrypted domain, with distinct security-efficiency-utility trade-offs.