Paper deep dive
HE-Guardrail: A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inference
Byeongseo Min, Yongwoo Lee, Young-Sik Kim, Yongjune Kim
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 9/21/2026, 4:27:04 AM
Summary
The paper introduces HE-Guardrail, a framework that integrates jailbreak detection guardrails into Homomorphic Encryption (HE)-based Large Language Model (LLM) inference. It addresses the vulnerability where malicious clients can submit adversarial prompts that remain invisible to the semi-honest server due to encryption. HE-Guardrail evaluates guardrails (Llama Guard, JBShield, GradSafe) entirely over encrypted data and uses homomorphic response gating with noise flooding to block harmful responses while preserving privacy.
Entities (10)
Relation Signals (10)
HE-Guardrail → uses → Homomorphic Encryption
confidence 98% · HE-Guardrail, a framework that evaluates guardrail mechanisms entirely over encrypted data
HE-Guardrail → protectsagainst → Jailbreak Attacks
confidence 97% · A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inference
HE-Guardrail → instantiates → Llama Guard
confidence 96% · We instantiate HE-Guardrail with three representative guardrails - Llama Guard, JBShield, and GradSafe
HE-Guardrail → instantiates → JBShield
confidence 96% · We instantiate HE-Guardrail with three representative guardrails - Llama Guard, JBShield, and GradSafe
HE-Guardrail → instantiates → GradSafe
confidence 96% · We instantiate HE-Guardrail with three representative guardrails - Llama Guard, JBShield, and GradSafe
Homomorphic Encryption → enables → Privacy-Preserving Machine Learning
confidence 95% · Homomorphic encryption (HE) has emerged as a promising approach to privacy-preserving machine learning (PPML)
HE-Guardrail → evaluateson → Llama-3-8B-Instruct
confidence 93% · We adopt Llama-3-8B-Instruct [47] as our target model... We evaluate the three HE-Guardrail instantiations
JBShield → uses →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Homomorphic encryption (HE) has emerged as a promising approach to privacy-preserving machine learning (PPML), enabling computation directly over encrypted data. In HE-based PPML, a client submits an encrypted input to the server, which evaluates models such as large language models (LLMs) without access to the underlying plaintext. However, we identify a critical security vulnerability in this setting: HE-LLM inference is vulnerable to malicious clients that submit adversarial prompts, such as jailbreak attacks. The same confidentiality that protects benign clients also prevents the server from inspecting incoming prompts or generated responses, making adversarial attempts difficult to detect or block and potentially allowing successful attacks to remain entirely invisible to the server. To address this vulnerability, we propose HE-Guardrail, a framework that evaluates guardrail mechanisms entirely over encrypted data and homomorphically controls whether the target-model response is returned to the client. We instantiate HE-Guardrail with three representative guardrails - Llama Guard, JBShield, and GradSafe. Our results show that HE-Guardrail closely reproduces the decisions of the corresponding plaintext guardrails in the encrypted domain, with distinct security-efficiency-utility trade-offs.
Tags
Links
- Source: https://arxiv.org/abs/2609.21484v1
- Canonical: https://arxiv.org/abs/2609.21484v1
Trouble viewing inline? Open PDF directly →
Full Text
64,140 characters extracted from source content.
Expand or collapse full text
HE-Guardrail: A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inference Byeongseo Min1, Yongwoo Lee2, Young-Sik Kim3, and Yongjune Kim14 †thanks: 4Corresponding author. Affiliation: 1minbyeongseo, yongjune@postech.ac.kr, Pohang University of Science and Technology (POSTECH) Affiliation: 2yongwoo@inha.ac.kr, Inha University Affiliation: 3ysk@dgist.ac.kr, Daegu Gyeongbuk Institute of Science and Technology (DGIST) Abstract Homomorphic encryption (HE) has emerged as a promising approach to privacy-preserving machine learning (PPML), enabling computation directly over encrypted data. In HE-based PPML, a client submits an encrypted input to the server, which evaluates models such as large language models (LLMs) without access to the underlying plaintext. However, we identify a critical security vulnerability in this setting: HE-LLM inference is vulnerable to malicious clients that submit adversarial prompts, such as jailbreak attacks. The same confidentiality that protects benign clients also prevents the server from inspecting incoming prompts or generated responses, making adversarial attempts difficult to detect or block and potentially allowing successful attacks to remain entirely invisible to the server. To address this vulnerability, we propose HE-Guardrail, a framework that evaluates guardrail mechanisms entirely over encrypted data and homomorphically controls whether the target-model response is returned to the client. We instantiate HE-Guardrail with three representative guardrails—Llama Guard, JBShield, and GradSafe. Our results show that HE-Guardrail closely reproduces the decisions of the corresponding plaintext guardrails in the encrypted domain, with distinct security–efficiency–utility trade-offs. I Introduction The growing deployment of artificial intelligence (AI) services has heightened concerns about privacy and security. In particular, machine learning often involves privacy-sensitive data during training and inference, motivating extensive research on privacy-preserving machine learning (PPML) [1, 2, 3]. Representative approaches include differential privacy (DP) [4], secure multi-party computation (SMPC) [5, 6], and homomorphic encryption (HE) [7, 8]. Among these approaches, HE is a promising direction for privacy-preserving inference as it provides strong cryptographic confidentiality guarantees while enabling computation directly over encrypted data. In a typical HE-based PPML pipeline, a client sends an encrypted input to the server, which performs inference using a homomorphically implemented model and returns the encrypted result. Any plaintext input or output of the model remains hidden from the server throughout the process. Early studies on homomorphic Transformer inference primarily focused on encoder-based architectures such as BERT [9, 10, 11], while recent advances have extended encrypted inference to large language models (LLMs) such as Llama or GPT [12, 13, 14]. Existing HE-based PPML systems commonly adopt a semi-honest (a.k.a. honest-but-curious) server as their primary threat model [3], while malicious behavior from the client is often outside the scope of consideration. In this work, we make a critical observation for HE-LLM inference: such systems are highly vulnerable to malicious clients that submit adversarial prompts, such as jailbreak attacks. Jailbreak attacks [15, 16] are designed to bypass the safety alignment of LLMs and elicit harmful or otherwise restricted responses. Because the prompt and model computation remain encrypted, the server cannot directly inspect such adversarial inputs and may remain unaware even when an attack successfully elicits a harmful response. Consequently, adversarial interactions can remain hidden throughout the encrypted inference pipeline. A common approach to mitigating jailbreak attacks is to employ guardrails [17, 18], which act as external defense mechanisms that monitor and control LLM interactions. We refer to the recent Systematization of Knowledge (SoK) study [19] for a comprehensive taxonomy and evaluation framework for existing jailbreak guardrails. Based on their intervention stage, guardrails can be categorized as pre-processing, intra-processing, or post-processing. Pre-processing guardrails [18, 20] examine the input prompt, intra-processing guardrails [21, 22] analyze the target model’s internal states or gradients, and post-processing guardrails [23, 24] inspect the generated output. However, these guardrails are designed for plaintext inference and cannot be directly applied when the information required for their safety decisions remains encrypted. Fig. 1: Comparison of conventional HE-LLM inference and the proposed HE-Guardrail pipeline, which performs encrypted jailbreak detection and selectively returns either the target-model output or a refusal response. To address this challenge, we propose HE-Guardrail, a framework that implements guardrails entirely under HE and integrates their encrypted safety decisions into HE-LLM inference. Figure 1 contrasts the HE-Guardrail framework with the conventional HE-LLM pipeline. In the conventional pipeline (top), the server cannot inspect the encrypted jailbreak prompt and thus has no choice but to return the resulting harmful response to the client. In our proposed HE-Guardrail framework (bottom), both guardrail evaluation and response control are performed over encrypted data, without revealing the prompt, model response, or guardrail decision to the server. As shown in Figure 1, we instantiate HE-Guardrail with (a) intra-processing guardrails, which take encrypted internal signals of the target model, and (b) a pre-processing guardrail, which takes the encrypted input prompt. As shown in (c), the resulting encrypted guardrail decision g (1: safe, 0: harmful) selects between the target-model response Y and a predefined refusal response R: Z(g)=g⋅Y+(1−g)⋅R+ϵ(g),Z(g)=g· Y+(1-g)· R+ε(g), (1) where the gated noise flooding term ϵ(g)ε(g) prevents a malicious client from recovering the suppressed response. The resulting ciphertext therefore reveals only the response permitted by the encrypted guardrail decision while preserving the confidentiality of the underlying HE inference pipeline. Our contributions are summarized as follows: • HE-Guardrail Framework: We introduce HE-Guardrail, a general framework for evaluating LLM guardrails entirely under HE and enforcing their encrypted safety decisions through homomorphic response gating. We further introduce the gated noise flooding term ϵ(g)ε(g) to prevent recovery of the suppressed target-model response from the gated output. • Intra-processing HE-Guardrails: We develop HE-compatible realizations of JBShield [22] and GradSafe [21] by exploiting encrypted information generated within the target-model inference. In particular, we implement encrypted gradient evaluation for GradSafe, while JBShield directly leverages encrypted internal model states. These designs demonstrate that intra-processing guardrails are a promising direction for HE-LLM inference, where the server can reuse the target model’s encrypted computation without exposing its internal signals. • Pre-processing HE-Guardrails: We develop HE-compatible realizations of Llama Guard [18] that evaluate encrypted input prompts. To efficiently execute multiple models with different weights, we extend interleaved batching [13] to multi-model serving, which assigns different model weights to each interleaved batch within a single ciphertext. This enables the target model and guardrail models to be evaluated concurrently within a unified HE inference pipeline. We evaluate the three HE-Guardrail instantiations under the encrypted domain from security, efficiency, and utility perspectives. For security, we measure jailbreak attack success rate and pass guardrail rate; for efficiency, we measure memory usage and latency overhead; and for utility, we evaluate benign-prompt behavior. Across the evaluated settings, HE-Guardrail achieves jailbreak defense performance close to the corresponding plaintext guardrails, while exhibiting distinct security–efficiency–utility trade-offs across different guardrail designs. I Preliminaries I-A Homomorphic Encryption Homomorphic encryption (HE) [25, 26] enables computation directly over encrypted data without revealing the underlying plaintext. In this work, we use the RNS variant of CKKS, an HE scheme supporting arithmetic over real or complex numbers [27, 25]. For a ring degree N, CKKS packs up to N/2N/2 values into a ciphertext and processes them in a single-instruction-multiple-data (SIMD) manner. We refer to the arrangement of values across these slots as ciphertext packing. For a ciphertext i ct_i, we use i[j] ct_i[j] to denote the encrypted value in its j-th slot. I-A1 HE Operations RNS-CKKS mainly supports homomorphic addition ( Add), ciphertext–plaintext multiplication (p Mult_p), ciphertext–ciphertext multiplication (c Mult_c), and cyclic slot rotation ( Rot). Add, p Mult_p, and c Mult_c perform element-wise arithmetic over corresponding slots, while (,r) Rot( ct,r) cyclically rotates the slots of ct by r positions. Multiplication followed by rescaling typically consumes a level from the modulus chain, and the maximum number of consecutive level-consuming operations determines the multiplicative depth. Once the available levels are exhausted, bootstrapping refreshes a ciphertext at substantial computational cost. I-A2 Security RNS-CKKS is known to satisfy indistinguishability under chosen-plaintext attack (IND-CPA) security [28]. Hence, a server observing only ciphertexts and their homomorphic evaluations cannot computationally distinguish the underlying plaintexts or infer their contents. Consequently, plaintext confidentiality is preserved throughout server-side evaluation. I-A3 HE-based PPML HE-based PPML systems have introduced contributions along several major design dimensions, including the target model architecture, ciphertext packing layout, homomorphic matrix-multiplication algorithm, and implementation of nonlinear operations. While linear layers can be evaluated using the arithmetic operations natively supported by HE, nonlinear functions are generally implemented through HE-friendly replacements or polynomial approximations. Early HE-based PPML primarily focused on relatively small neural networks such as CNNs [8, 29]. With the emergence of Transformer architectures, subsequent work extended encrypted inference to BERT-style models [30, 10, 9, 31, 32, 13]. From the perspective of ciphertext packing and data layout, representative approaches include column-oriented packing in Powerformer [10], diagonal packing in THOR [9], and tricyclic encodings in Tricycle [31]. MOAI [13] uniquely introduces interleaved batching to efficiently process multiple inputs sharing the same model weights. HE-LLM. Recent work has extended HE inference to generative LLMs, first focusing on the prefill stage for Llama [33, 34, 35, 36] and GPT [12, 34, 35, 36]. Subsequent work further supports autoregressive decoding [14, 36], which additionally requires efficient management of encrypted KV caches. In autoregressive decoding, the selected next token can be represented as a one-hot vector and multiplied by the embedding table to obtain the input embedding for the next decoding step. MOAI [13] also demonstrates encrypted prefill for Llama-3-8B and shows that its framework can be extended to autoregressive decoding, with explicitly specified ciphertext packing layouts and an open-source implementation. I-A4 Threat Model in HE-based PPML HE-based PPML commonly considers a semi-honest server that follows the prescribed inference protocol but attempts to learn information about the client’s private input [3]. Some secure inference frameworks [37, 38, 14] additionally assume a semi-honest client, with both parties following the protocol while attempting to learn additional information; in such settings, the goal is to protect both the client’s private input and the server’s proprietary model. I-B Jailbreak Attacks and Guardrails Below, we summarize the major categories of jailbreak attacks and guardrails following the taxonomy of Wang et al. [19]. I-B1 Jailbreak Attacks Jailbreak attacks aim to bypass the safety alignment of an LLM and induce harmful or otherwise restricted responses. Following Wang et al. [19], jailbreak attacks can broadly be divided into single-turn and multi-turn attacks. Single-turn attacks attempt to elicit a harmful response within a single interaction, whereas multi-turn attacks develop or distribute the malicious objective across multiple interactions. Single-turn attacks include manual attacks [39] based on handcrafted jailbreak prompts, optimization-based attacks [15, 16] that search for adversarial prompts, generation-based attacks [40, 41] that use auxiliary models to generate or refine jailbreak prompts, and implicit attacks [42, 43] that conceal harmful intent through transformations or indirect instructions. Multi-turn attacks [44, 45] instead distribute or progressively develop the malicious objective across multiple interactions. Multi-turn attacks remain particularly challenging for existing guardrails, highlighting the need for more robust defenses specifically designed to reason over evolving multi-turn interactions. I-B2 Jailbreak Guardrails Jailbreak guardrails detect and block unsafe interactions without modifying the target model itself. Based on the intervention stage, guardrails can be categorized into pre-processing, intra-processing, and post-processing methods [19]. Pre-Processing Guardrails. Pre-processing guardrails inspect the user prompt. Representative methods such as Llama Guard [18], SelfDefend [20] and GuardReasoner [46] use a separate language model to classify the safety of an incoming request. They are applicable even to black-box target models and can reject malicious requests before incurring target-model generation cost, but their decisions are limited to information available from the input. Intra-Processing Guardrails. Intra-processing guardrails exploit internal signals generated during target-model inference, such as hidden representations or gradients. For example, GradSafe [21] uses gradient information, while JBShield [22] detects jailbreaks from internal model representations. Such methods can provide deeper and more nuanced insights into the target model’s behavior and vulnerabilities, but require white-box access to the target model. Post-Processing Guardrails. Post-processing guardrails [23], [24] inspect the generated response before returning it to the user. They can directly detect harmful outputs even when the corresponding input appears benign, but require the target model to complete generation before the safety decision is made. Consequently, they generally incur the full generation cost and additional end-to-end latency. I HE-Guardrail In this section, we present HE-Guardrail, our framework for integrating jailbreak guardrails into HE-LLM inference. We first define the threat model, target model, and overall framework, and then instantiate HE-Guardrail with one pre-processing and two intra-processing guardrails. We exclude post-processing guardrails because they can begin only after response generation and therefore directly add to the end-to-end latency, a critical bottleneck in HE inference. In contrast, our pre-processing guardrails can run concurrently with the target model, while the intra-processing guardrails can be evaluated using information obtained during or immediately after prefill, independently of subsequent autoregressive decoding. Consequently, these designs limit the additional latency introduced on the target model’s critical path. I-A Threat Model and Target Model We consider a two-party HE-LLM inference setting consisting of a client C and a server S. The server holds the target LLM and guardrail models, while the client holds a private input prompt and the HE secret key. The client encrypts its input and sends the resulting ciphertexts to the server, which evaluates the prescribed inference pipeline homomorphically and returns only the encrypted final response. Semi-Honest Server. Following the standard threat model in HE-based PPML, we assume that the server is semi-honest: it correctly follows the prescribed protocol but may attempt to infer information about the client’s private input from the ciphertexts and intermediate computations. The server does not possess the secret key and therefore cannot directly inspect the plaintext prompt, intermediate representations, or generated response. Malicious Client. Unlike conventional HE-based PPML, we allow the client to be malicious in its choice of input. Specifically, the client may intentionally submit adversarial prompts, including jailbreak prompts, with the goal of eliciting a harmful response from the target LLM. We assume that the client follows the underlying HE protocol correctly, but places no restriction on the plaintext input that it encrypts. After inference, the client decrypts the returned ciphertext and may attempt to recover the target-model response even when the guardrail blocks the request. Target Model. We adopt Llama-3-8B-Instruct [47] as our target model, following the main target model used in Wang et al. [19]. I-B Framework HE-Guardrail integrates jailbreak guardrails into HE-LLM inference and enforces their safety decisions entirely over encrypted data. As illustrated in Figure 1, the server evaluates a guardrail using either the encrypted input prompt or encrypted internal signals from the target model, and obtains an encrypted binary decision g, where g=1g=1 indicates acceptance and g=0g=0 indicates rejection. Since g remains encrypted, the server applies this decision to the returned response through homomorphic arithmetic without observing it. Guardrails typically reach their decision by comparing a detection score with a threshold. We therefore abstract each decision criterion by an encrypted score p and a threshold δ, oriented such that p>δp>δ indicates a benign interaction. Since comparison is not natively supported in CKKS, the server homomorphically computes the gate as g=1+sgnpoly(p−δ)2,g= 1+sgn_poly(p-δ)2, (2) where sgnpolysgn_poly is a polynomial approximation to the sign function. We implement sgnpolysgn_poly using the minimax composite-polynomial method of Lee et al. [48], with component degrees (15,27,29)(15,27,29). Accordingly, g approaches 11 when p>δp>δ and 00 when p<δp<δ, corresponding to acceptance and rejection, respectively. For readability, we describe the following operations using their underlying values, although p, g, and the target-model outputs remain encrypted throughout server-side evaluation. At autoregressive decoding step t, let yty_t denote the token selected by the target LLM and Yt=yt∈0,1VY_t=e_y_t∈\0,1\^V (3) its one-hot representation, where V is the vocabulary size. The next-step input embedding is obtained as EYtEY_t using the embedding table E∈ℝd×VE ^d× V. For the refusal path, the server prepares a predefined refusal response R in advance, such as “Sorry, I cannot assist with that request.” Similarly, let Rt∈0,1VR_t∈\0,1\^V denote the one-hot representation of its t-th token in the target model’s vocabulary. Since the refusal response is usually shorter than the generation budget, the remaining positions are filled with the end-of-sequence (EOS) token. Given the encrypted gate g, HE-Guardrail homomorphically constructs the client-facing response as Zt(g)=gYt+(1−g)Rt+ϵt(g),Z_t(g)=gY_t+(1-g)R_t+ _t(g), (4) where the first two terms interpolate between the target-model token YtY_t and the predefined refusal token RtR_t according to the encrypted gate. The term ϵt(g) _t(g) denotes the gated noise flooding term used to mask residual information from the suppressed response. We define ϵt(g) _t(g) in the following subsection. I-B1 Gated Noise Flooding In practice, the gate g may not be exactly 00 or 11, for example, due to the approximation error of sgnpolysgn_poly in Eq. (2) or the inherent noise of CKKS. Consequently, even a rejected request may result in a small nonzero gate g, leaving residual information from the target-model output. For example, consider Yt=(1,0,0,0)⊤Y_t=(1,0,0,0) , Rt=(0,0,0,1)⊤R_t=(0,0,0,1) , and g=0.01g=0.01. Without the noise term in Eq. (4), the returned vector becomes gYt+(1−g)Rt=(0.01,0,0,0.99)⊤.gY_t+(1-g)R_t=(0.01,0,0,0.99) . (5) After decryption, the client obtains the refusal token through plaintext argmax decoding, but the residual value 0.010.01 still reveals the coordinate of the suppressed target token. The gated noise flooding term ϵt(g) _t(g) masks this residual leakage. We construct it at a scale proportional to 1−g1-g as ϵt(g)=(1−g)ξt, _t(g)=(1-g) _t, (6) where ξt _t is a small random noise vector freshly sampled by the server for each output and kept private from the client. The noise is therefore activated for rejected requests with g≈0g≈ 0 and suppressed for accepted requests with g≈1g≈ 1. In the above example, sampling ξt=(0.12,−0.08,0.15,−0.05)⊤ _t=(0.12,-0.08,0.15,-0.05) yields Zt(g)≈(0.13,−0.08,0.15,0.94)⊤.Z_t(g)≈(0.13,-0.08,0.15,0.94) . (7) After decrypting Zt(g)Z_t(g), the client still obtains the refusal token ID through argmax decoding, but can no longer identify the suppressed target-model token, since its residual 0.010.01 is buried in noise of larger magnitude. I-C Intra-processing HE-Guardrails Key Observation. Intra-processing guardrails are a particularly promising design direction for HE-Guardrail. In plaintext deployments, intra-processing guardrails generally require white-box access to the target model, which limits their applicability when the model is available only through a black-box API. This white-box requirement has also been identified as a major applicability limitation of intra-processing guardrails in prior systematic evaluations [19]. HE-based inference fundamentally changes this setting. The server typically owns and homomorphically evaluates the target LLM and therefore has algorithmic access to its model structure and encrypted internal signals, even though their plaintext values remain hidden. It can thus directly use encrypted hidden states or homomorphically derive gradients required by intra-processing guardrails. Consequently, the white-box requirement that limits these methods in plaintext deployments becomes substantially less restrictive in HE-based inference. We instantiate this direction with two representative guardrails that exploit different internal signals: JBShield, which detects jailbreaks from internal model representations, and GradSafe, which uses gradient information obtained during prefill. I-C1 JBShield In plaintext JBShield-D [22], the toxic concept is calibrated from representation differences between harmful and benign prompts, whereas the jailbreak concept is calibrated from differences between jailbreak and harmful prompts. For a test prompt, JBShield-D similarly constructs a toxic direction relative to a benign anchor representation and a jailbreak direction relative to a harmful anchor representation. It then computes the cosine similarities of these directions with the corresponding calibrated toxic and jailbreak concept vectors. The input is classified as a jailbreak when both similarities exceed their respective thresholds. Let H(ℓ)(x)∈ℝT×dH^( )(x) ^T× d denote the hidden representation after the ℓ -th transformer layer for a prompt x with T tokens. Following JBShield-D [22], we use the last-token representation (ℓ)(x)=H(ℓ)(x)[T−1,:]∈ℝdh^( )(x)=H^( )(x)[T-1,:] ^d (8) as the sentence representation of x. In our Llama-3-8B-Instruct implementation, we fix ℓ=32 =32 and hence use (x)=H(32)(x)[T−1,:]∈ℝ4096h(x)=H^(32)(x)[T-1,:] ^4096. We adapt the subsequent concept extraction and similarity evaluation to HE as summarized in Algorithm 1. Algorithm 1 HE-JBShield-D 1: Benign, harmful, and jailbreak calibration prompts; encrypted input prompt x 2: Encrypted acceptance gate gJBg_JB 3: Offline phase 4: Compute benign and harmful anchor representations b μ_b and h μ_h 5: Extract toxic and jailbreak concept vectors ts_t and js_j using rank-one SVD 6: Normalize ^k←k/‖k‖2 s_k _k/\|s_k\|_2 for k∈t,jk∈\t,j\ 7: Set θt←0.037 _t← 0.037 and θj←0 _j← 0 8: Online phase 9: Obtain encrypted (x)h(x) from the target-model prefill 10: t←(x)−bc_t (x)- μ_b 11: j←(x)−hc_j (x)- μ_h 12: for k∈t,jk∈\t,j\ do 13: qk←∑ik[i]2q_k← _ic_k[i]^2 14: νk←InvSqrtHE(qk) _k _HE(q_k) 15: σk←νk∑ik[i]^k[i] _k← _k _ic_k[i] s_k[i] 16: dk←(1+sgnHE(σk−θk))/2d_k← (1+sgn_HE( _k- _k) )/2 17: end for 18: gJB←1−dtdjg_JB← 1-d_td_j 19: return gJBg_JB Offline Calibration. Following JBShield-D, the server constructs a benign anchor representation b μ_b, a harmful anchor representation h μ_h, and the toxic and jailbreak concept vectors ts_t and js_j from calibration prompts. The toxic concept is extracted from representation differences between harmful and benign prompts, while the jailbreak concept is extracted from differences between jailbreak and harmful prompts, using rank-one SVD as in the original method [22]. Since these quantities depend only on the server-owned model and calibration data, all calibration is performed in plaintext before deployment. We additionally pre-normalize ts_t and js_j to avoid evaluating their norms homomorphically. SVD Simplification. In the original online detection [22], JBShield-D forms a single-row difference matrix from the test representation and applies rank-one SVD before cosine-similarity evaluation. For example, the toxic concept is constructed from Dt=[(x)−b]=[t].D_t=[h(x)- μ_b]=[c_t]. (9) Since DtD_t contains only one difference vector, its right singular direction is t/‖t‖2c_t/\|c_t\|_2, up to sign. Under the same orientation convention as the plaintext implementation, the subsequent cosine similarity is therefore identical to directly computing cos(t,t).cos(c_t,s_t). (10) We consequently eliminate the online SVD and directly use tc_t and jc_j for toxic and jailbreak concept detection. The offline SVD is retained because it extracts the principal concept directions from multiple calibration samples. Homomorphic Cosine Similarity. For k∈t,jk∈\t,j\, the required similarity is σk=⟨k,k⟩‖k‖2‖k‖2=⟨k,^k⟩1∑ik[i]2. _k= _k,s_k \|c_k\|_2\|s_k\|_2= _k, s_k 1 _ic_k[i]^2. (11) The squared norm is evaluated by element-wise multiplication followed by slot summation. Since inverse square root is not natively supported by CKKS, we evaluate 1/qk1/ q_k using Goldschmidt iterations. The remaining operations in Eq. (11) consist only of multiplication and slot summation. Finally, the toxic and jailbreak activations are obtained by comparing σt _t and σj _j with θt=0.037 _t=0.037 and θj=0 _j=0, respectively, using the same sgnpolysgn_poly operation as in Section I-B. The values dtd_t and djd_j approach one when their corresponding concepts are activated. Since JBShield-D identifies a jailbreak only when both concepts are activated, we directly produce the acceptance gate gJB=1−dtdj.g_JB=1-d_td_j. (12) I-C2 GradSafe GradSafe [21] detects unsafe prompts by analyzing gradients of safety-critical parameters in the target LLM. Its key observation is that unsafe prompts paired with a fixed compliance response induce similar gradient directions on a small subset of model parameters, whereas safe prompts exhibit substantially different directions. GradSafe first identifies these safety-critical parameters and constructs corresponding unsafe gradient references in an offline phase. For a new prompt, it then computes the same gradients and compares them with the references using cosine similarity. In our implementation, we consider row- and column-wise gradient slices of the attention projection weights q(ℓ),k(ℓ),v(ℓ),o(ℓ)\W_q^( ),W_k^( ),W_v^( ),W_o^( )\ and the MLP projection weights gate(ℓ),up(ℓ),down(ℓ)\W_gate^( ),W_up^( ),W_down^( )\, where ℓ=1,…,L =1,…,L denotes the transformer layer. Let J denote the set of candidate gradient slices from these projection weights. For a prompt x paired with a fixed compliance response rcr_c, let j(x)g_j(x) denote the gradient vector corresponding to slice j∈j of the causal-LM loss ℒ(x,rc)L(x,r_c). Let uX_u and sX_s denote the unsafe and safe reference prompt sets used during offline calibration. Following GradSafe-Zero, we use a similarity-gap threshold of 11 to identify safety-critical slices and an online detection threshold of 0.250.25. Algorithm 2 summarizes our HE implementation. Gradient-Only HE Backpropagation. HE-based training [11, 49] is challenging because weight updates turn plaintext model parameters into ciphertexts, replacing efficient ciphertext–plaintext operations with more expensive ciphertext–ciphertext operations, while approximation errors may accumulate across optimization steps. In contrast, GradSafe requires only gradient extraction without weight updates, making HE backpropagation substantially more practical. Algorithm 2 HE-GradSafe 1: Reference sets uX_u and sX_s, encrypted prompt x, compliance response rcr_c 2: Encrypted acceptance gate gGSg_GS 3: Offline phase 4: for each candidate slice j∈j do 5: Compute j(x′)g_j(x ) for all x′∈u∪sx _u _s 6: j←1|u|∑x′∈uj(x′)r_j← 1|X_u| _x _ug_j(x ) 7: Compute similarity gap Δj _j between unsafe and safe references 8: end for 9: ⋆←j∈:Δj>λgapJ ←\j : _j> _gap\ 10: for each j∈⋆j do 11: ^j←j/‖j‖2 r_j _j/\|r_j\|_2 12: end for 13: Online phase 14: Run encrypted forward pass for (x,rc)(x,r_c) and store required checkpoints at a low ciphertext level 15: Initialize the backward gradient from the causal-LM objective 16: A←0A← 0 17: for each operation in reverse order do 18: if operation is Softmax then 19: Backpropagate using the checkpointed softmax output 20: else if operation is RMSNorm then 21: Backpropagate using the checkpointed input and inverse RMS 22: else if operation is SiLU then 23: Backpropagate using the checkpointed sigmoid and SiLU outputs 24: else 25: Backpropagate using the corresponding HE linear/matrix-multiplication operation 26: end if 27: if a safety-critical gradient slice j∈⋆j is produced then 28: qj←∑ij[i]2q_j← _ig_j[i]^2 29: νj←InvSqrtHE(qj) _j _HE(q_j) 30: γj←νj∑ij[i]^j[i] _j← _j _ig_j[i] r_j[i] 31: A←A+γjA← A+ _j 32: Discard jg_j 33: end if 34: end for 35: sGS←A/|⋆|s_GS← A/|J | 36: dGS←(1+sgnHE(sGS−0.25))/2d_GS← (1+sgn_HE(s_GS-0.25) )/2 37: gGS←1−dGSg_GS← 1-d_GS 38: return gGSg_GS Offline Calibration. For each candidate slice j∈j , GradSafe first constructs an unsafe gradient reference j=1|u|∑x∈uj(x).r_j= 1|X_u| _x _ug_j(x). (13) The safety-criticality of the slice is then determined by the difference between its average cosine similarity for unsafe and safe reference prompts, Δj=1|u|∑x∈ucos(j(x),j)−1|s|∑x∈scos(j(x),j). _j= 1|X_u| _x _u (g_j(x),r_j)- 1|X_s| _x _s (g_j(x),r_j). (14) We retain ⋆=j∈:Δj>λgapJ =\j : _j> _gap\ (15) as the safety-critical slice set, where we set λgap=1 _gap=1 following GradSafe-Zero. Because this phase uses only the server-owned model and reference data, it is performed entirely in plaintext. We also precompute ^j=j‖j‖2,j∈⋆, r_j= r_j\|r_j\|_2, j , (16) so that encrypted cosine-similarity evaluation requires homomorphic normalization only for the online gradient j(x)g_j(x). Backward Initialization. After the encrypted prompt prefill, the resulting state is shared by the target-model decoding and GradSafe detection. GradSafe constructs the gradient of a causal-LM objective toward a fixed compliance response rcr_c, without modifying the actual decoding sequence. For a single response token, the backward pass can be initialized directly from the prefill logits as ∂ℒ∂=−rc, =p-e_r_c, (17) where p is the softmax output at the last prompt position and rce_r_c is the one-hot representation of the compliance token. The resulting backward pass can proceed independently of subsequent autoregressive decoding. Low-Level Checkpointing. Efficient backpropagation requires intermediate values from the forward pass. Keeping all such ciphertexts at their original levels, however, incurs substantial memory consumption because high-level CKKS ciphertexts contain more RNS limbs. We therefore level-drop the required checkpoints to a designated low storage level immediately after their last forward use. When a checkpoint is required during backward propagation, we bootstrap it and subsequently level-align it with the current backward gradient ciphertext before evaluation. This strategy trades additional bootstrapping for substantially lower checkpoint memory consumption. Checkpointed Nonlinear Derivatives. The nonlinear operations required in the transformer backward pass can be efficiently evaluated by reusing quantities already computed during the forward pass. For a softmax input a, let =SoftmaxHE()p=Softmax_HE(a) denote its checkpointed output, and let ¯ p denote the incoming gradient during backward propagation. The gradient with respect to a is ¯=⊙(¯−⟨¯,⟩). a=p ( p- p,p 1 ). (18) Thus, no additional exponential evaluation is required during the softmax backward pass. For RMSNorm, let ∈ℝdx ^d denote its input and define the inverse RMS value r=(1d∥22+εrms)−1/2,r= ( 1d\|x\|_2^2+ _rms )^-1/2, (19) where εrms _rms is the numerical-stability constant of RMSNorm. Given the RMSNorm weight w and the incoming gradient ¯ y with respect to its output =r⊙y=r\,w , define =¯⊙u= y . Using the checkpointed x and r, the input gradient is ¯=r−r3d⟨,⟩. x=ru- r^3dx ,x . (20) Hence, the inverse square root already evaluated during the forward pass can be reused without another InvSqrtHEInvSqrt_HE evaluation. For SiLU, let y=us,s=SigmoidHE(u),y=u\,s, s=Sigmoid_HE(u), (21) where s and y are checkpointed during the forward pass. For an incoming gradient y¯ y, the input gradient is u¯=y¯[s+y(1−s)]. u= y [s+y(1-s) ]. (22) Therefore, the sigmoid approximation does not need to be reevaluated during backward propagation. Streaming Gradient Similarity. To reduce memory usage, we do not store all safety-critical gradients. Instead, each gradient slice is immediately compared with its pre-normalized unsafe reference using encrypted cosine similarity, accumulated into a running score, and then discarded. GradSafe-Zero averages the accumulated similarities and applies the online threshold 0.250.25 through sgnHEsgn_HE to obtain the final acceptance gate. I-D Pre-Processing HE-Guardrails Pre-processing guardrails evaluate the prompt independently of target response generation. We instantiate this approach with Llama Guard 3-8B [47]. Let x be the user prompt and TT_T, LGT_LG be the target and guardrail prompt templates. The model inputs are xT=T(x)x_T=T_T(x) and xLG=LG(x)x_LG=T_LG(x); the latter includes the guardrail’s safety-assessment instructions. For M∈T,LGM∈\T,LG\, let nMn_M be the token count and tiMt_i^M the i-th token ID after formatting and tokenization. The corresponding one-hot input and embedding are iM=tiM∈0,1VM,iM=EMiM,o_i^M=e_t_i^M∈\0,1\^V_M, _i^M=E_Mo_i^M, (23) where EM∈ℝdM×VME_M ^d_M× V_M is model M’s plaintext embedding table. The two models use their own weights and embedding tables, while the user-dependent one-hot inputs and embeddings remain encrypted. The formatted streams are padded to a common length with their respective attention masks. I-D1 Multi-Model Serving Llama Guard requires an additional HE-LLM evaluation beyond the target model. Although the two models can run concurrently, executing them as independent HE pipelines doubles the ciphertext memory consumption. To avoid this overhead, we extend MOAI’s interleaved batching [13] by assigning model-specific plaintext weights to each interleaved lane instead of repeating one model’s weights across all lanes, so that the target and guardrail models are evaluated within a single set of ciphertexts. For lane b∈0,…,B−1b∈\0,…,B-1\, let X(b)∈ℝn×dX^(b) ^n× d be its activation and W(b)∈ℝd×d′W^(b) ^d× d its weight matrix. For ciphertexts under a common HE key, the interleaved assignments are i[Br+b] ct_i[Br+b] =X(b)[r,i], =X^(b)[r,i], (24) i,j[Br+b] pt_i,j[Br+b] =W(b)[i,j], =W^(b)[i,j], for 0≤r<n0≤ r<n, 0≤i<d0≤ i<d, and 0≤j<d′0≤ j<d . The packed projection is jout=∑i=0d−1p(i,i,j), ct_j^out= _i=0^d-1 Mult_p( ct_i, pt_i,j), (25) whose slot Br+bBr+b represents (X(b)W(b))[r,j](X^(b)W^(b))[r,j]. I-D2 Llama Guard Decision Let LG∈ℝVLGz_LG ^V_LG be Llama Guard’s logits at the first safety-decision position, and let tsafet_safe and tunsafet_unsafe be the corresponding token IDs. Our implementation blocks when LG[tunsafe]>LG[tsafe]z_LG[t_unsafe]>z_LG[t_safe]. We therefore compute the encrypted acceptance margin and gate directly as mLG m_LG =LG[tsafe]−LG[tunsafe], =z_LG[t_safe]-z_LG[t_unsafe], (26) gLG g_LG =1+sgnHE(mLG)2. = 1+sgn_HE(m_LG)2. This comparison does not require a softmax over the vocabulary or generation of a textual explanation. It is equivalent to comparing the two token probabilities because Softmax preserves logit ordering. The gate is passed directly to Eq. (4). IV Experiments Following the Security-Efficiency-Utility (SEU) evaluation framework of Wang et al. [19], we evaluate HE-Guardrail along three perspectives: security (attack success rate, pass guardrail rate), efficiency (memory usage and latency overhead), and utility (false rejection of benign prompts). The target responses and guardrail decisions are computed in the encrypted domain. IV-A Experimental Setup and Metrics Implementation. We implemented all HE models and guardrails using desilofhe [50], a Python-based HE library that supports the RNS-CKKS scheme with GPU acceleration. We set the number of slots as N/2=215N/2=2^15 and the available multiplicative level after bootstrapping as 1717. All experiments were conducted on two NVIDIA H200 GPUs running AlmaLinux 9.8: the target model Llama-3-8B-Instruct occupies one GPU, and a separately scheduled guardrail occupies the other. For the target model, we prioritize numerical accuracy over depth: SiLU is approximated by a degree-127 polynomial, RMSNorm evaluates the inverse square root via Goldschmidt iterations, and Softmax follows Cho et al. [51]. The padded input length is 2,048 tokens, including any guardrail instructions, and the generation budget is 200 tokens. Under multi-model serving, this yields 215/2,048=162^15/2,048=16 interleaved lanes. Joint target–Llama Guard execution assigns two lanes per request, so the same layout admits eight guarded requests instead of sixteen target-only requests. Attack and Benign Inputs. Following Wang et al. [19], we evaluate six jailbreak attack families comprising 2,215 prompts or sessions: IJP [39] (manual), GCG [15] and AutoDAN [16] (optimization-based), DrAttack [42] and MultiJail [43] (implicit), and ActorAttack [44] (multi-turn). For benign-input evaluation, we use AlpacaEval [52] and OR-Bench [53] to measure false-positive rejection. Metrics and Judge. We judge target responses with cais/HarmBench-Llama-2-13b-cls [54]. For an attack sample i, let ai∈0,1a_i∈\0,1\ indicate guardrail acceptance and hi∈0,1h_i∈\0,1\ indicate a harmful-response judgment. For an attack set A, attack success rate (ASR) and pass-guardrail rate (PGR) are ASR=∑i∈aihi||,PGR=∑i∈ai||.ASR= _i a_ih_i|A|, = _i a_i|A|. (27) For a benign set ℬB, the false-positive rate is FPR=|ℬ|−1∑i∈ℬ(1−ai)FPR=|B|^-1 _i (1-a_i). PGR separates prompt rejection from the target’s own refusal behavior: low ASR alone need not indicate an effective guardrail. TABLE I: Attack success rate (ASR) and pass-guardrail rate (PGR) in percent; lower is better. All target responses and guardrail decisions are computed in the encrypted domain, and harmfulness is judged by HarmBench-Llama-2-13b-cls [54]. No defense Llama Guard 3-8B JBShield-D GradSafe-Zero Attack Samples ASR ASR PGR ASR PGR ASR PGR Single-turn attacks IJP 1,000 14.3 9.6 33.6 14.3 95.4 14.2 59.9 GCG 100 13.0 2.0 3.0 13.0 72.0 13.0 77.0 AutoDAN 100 2.0 0.0 21.0 2.0 46.0 1.0 4.0 DrAttack 100 11.0 7.0 39.0 11.0 52.0 11.0 42.0 MultiJail 315 9.5 7.9 37.1 9.5 97.1 9.5 91.1 Multi-turn attacks ActorAttack 600 16.3 16.2 98.5 16.3 99.2 16.2 99.8 Average – 11.0 7.1 38.7 11.0 77.0 10.8 62.3 IV-B Jailbreak Defense Across all evaluated prompts, the encrypted guardrails reproduce the plaintext decisions in 99.7% of cases, indicating that the polynomial approximations and HE numerical error rarely alter the safety decision itself. The following comparisons therefore reflect the underlying detection rules rather than HE-induced degradation. Table I reports ASR for the six evaluated attack families. The macro-average ASR is 11.0% without a guardrail, 7.1% for Llama Guard, 11.0% for JBShield, and 10.8% for GradSafe. Llama Guard lowers ASR on every family, most notably from 13.0% to 2.0% on GCG and from 14.3% to 9.6% on IJP, while ActorAttack changes only from 16.3% to 16.2%. JBShield matches the no-defense ASR on all six families, and GradSafe differs by at most 1.0 percentage point. The average PGR is 38.7% for Llama Guard, 77.0% for JBShield, and 62.3% for GradSafe. All three guardrails pass 98.5–99.8% of ActorAttack sessions. The per-family values vary widely: on GCG, PGR is 3.0% for Llama Guard but 72.0% for JBShield and 77.0% for GradSafe, whereas on AutoDAN it is 21.0%, 46.0%, and 4.0%, respectively. IV-C Memory Usage and Latency Overhead GPU Memory Usage. Table I reports approximate memory increases relative to running the target model alone. A separately evaluated Llama Guard adds approximately 140 GiB and occupies the second H200 GPU. JBShield adds approximately 5 GiB because its online work uses a hidden-state vector and calibrated references. GradSafe adds approximately 110 GiB: streaming similarities avoid retaining all gradients, but backward computation still requires a substantial checkpoint working set. Joint target–Llama Guard serving incurs no additional ciphertext memory, since both models share the same interleaved ciphertexts. This comes at the cost of halved batch capacity: the sixteen lanes accommodate eight guarded requests instead of sixteen target-only requests. TABLE I: Approximate incremental GPU memory relative to target-only inference. Configuration Additional memory (GiB) Llama Guard: separate execution ≈140≈ 140 Llama Guard: multi-model serving ≈0∗≈ 0^* JBShield-D ≈5≈ 5 GradSafe-Zero ≈110≈ 110 ∗At fixed sixteen-lane capacity: eight target–guardrail pairs instead of sixteen target-only requests. Concurrent Latency. All three guardrails run concurrently with target-model decoding. Llama Guard is evaluated alongside the target prefill under multi-model serving, whereas JBShield and GradSafe start as soon as the prefill signals they require become available and proceed independently of subsequent decoding. Following the SEU framework [19], let τT _T denote the end-to-end response time of target-only inference and τT+G _T+G that of the target model with a guardrail, both measured from request submission to the release of the final response. The latency overhead of the guardrail is Δτ=τT+G−τT, τ= _T+G- _T, (28) which is zero for every evaluated guardrail in our two-GPU configuration: because the 200-token autoregressive decoding dominates end-to-end latency, each guardrail decision is ready before the final response is released. The guardrail therefore adds no latency on the target model’s critical path, although it still consumes computation and memory on the second GPU. IV-D Benign-Prompt Utility Table I reports the FPR of each guardrail on benign prompts. Llama Guard rejects 33 of 1,805 benign prompts (1.83%), compared with one (0.06%) for JBShield and three (0.17%) for GradSafe. On OR-Bench, which is designed to probe over-refusal, Llama Guard rejects 22 of 1,000 prompts. Its stronger attack rejection therefore comes at the cost of higher benign rejection, whereas the low FPRs of JBShield and GradSafe reflect their more permissive detection rules rather than uniformly better guardrails. TABLE I: False-positive rate (%) on benign prompts, with the number of rejected prompts in parentheses. Guardrail AlpacaEval (n=805n=805) OR-Bench (n=1,000n=1,000) Combined (n=1,805n=1,805) Llama Guard 1.37 (11) 2.20 (22) 1.83 (33) JBShield-D 0.12 (1) 0.00 (0) 0.06 (1) GradSafe-Zero 0.12 (1) 0.20 (2) 0.17 (3) V Future Work Multi-turn jailbreak attacks remain an important limitation of current guardrail mechanisms. As reported by Wang et al. [19], even session-level guardrails exhibit substantial vulnerability to multi-turn attacks, particularly against adaptive attacks such as X-Teaming [45]. This limitation arises because the malicious intent may emerge gradually across multiple interactions rather than being identifiable from an individual prompt or response. In plaintext LLM deployments, conversation histories can at least be directly inspected by service operators or subjected to human moderation as an operational fallback. In HE-LLM inference, however, the server cannot directly inspect either the prompts or generated responses, making such plaintext-level intervention unavailable. Given both the high attack success rates of multi-turn jailbreaks and the lack of plaintext visibility under HE, developing HE-compatible guardrails that securely reason over encrypted conversation histories remains an important direction for future work. VI Conclusion In this work, we identified a security vulnerability in HE-LLM inference: the confidentiality that protects benign clients also allows malicious clients to submit jailbreak prompts that the server can neither inspect nor block. To address this vulnerability, we proposed HE-Guardrail, a framework that evaluates jailbreak guardrails entirely over encrypted data and enforces their decisions through homomorphic response gating with gated noise flooding, so that the suppressed response cannot be recovered by the client. We instantiated HE-Guardrail with Llama Guard, JBShield, and GradSafe, covering both pre-processing and intra-processing guardrails, and developed the HE-compatible building blocks they require, including encrypted gradient evaluation for GradSafe and multi-model serving for concurrent evaluation of the target and guardrail models. Our evaluation shows that the encrypted guardrails achieve defense performance close to that of their plaintext counterparts, with distinct security–efficiency–utility trade-offs across guardrail designs, and that guardrail evaluation can be overlapped with target generation without adding latency to the response. More broadly, our threat model departs from the conventional assumption in HE-based PPML that the client is benign in its choice of input. Considering a client that follows the protocol yet adversarially exploits the encrypted model is a necessary step toward trustworthy HE-based inference, in which the model itself must be protected in addition to the client’s data. Overall, these results bring HE-LLM inference closer to practical deployment and open a direction for further research on safety mechanisms for encrypted LLM inference. References [1] M. Al-Rubaie and J. M. Chang (2019) Privacy-preserving machine learning: threats and solutions. IEEE Security Privacy 17 (2), p. 49–58. Cited by: §I. [2] M. S. Riazi, B. D. Rouani, and F. Koushanfar (2019) Deep learning on private data. IEEE Security Privacy 17 (6), p. 54–63. Cited by: §I. [3] R. Xu, N. Baracaldo, and J. Joshi (2021) Privacy-preserving machine learning: methods, challenges and directions. arXiv preprint arXiv:2108.04417. Cited by: §I, §I, §I-A4. [4] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang (2016) Deep learning with differential privacy. In Proc. ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), p. 308–318. Cited by: §I. [5] P. Mohassel and Y. Zhang (2017) SecureML: a system for scalable privacy-preserving machine learning. In Proc. IEEE Symp. Secur. Privacy (SP), p. 19–38. Cited by: §I. [6] P. Mohassel and P. Rindal (2018) ABY3: a mixed protocol framework for machine learning. In Proc. ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), p. 35–52. Cited by: §I. [7] R. Gilad-Bachrach, N. Dowlin, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing (2016) CryptoNets: applying neural networks to encrypted data with high throughput and accuracy. In Proc. Int. Conf. Mach. Learn. (ICML), p. 201–210. Cited by: §I. [8] E. Lee, J. Lee, J. Lee, Y. Kim, Y. Kim, J. No, and W. Choi (2022) Low-complexity deep convolutional neural networks on fully homomorphic encryption using multiplexed parallel convolutions. In Proc. Int. Conf. Mach. Learn. (ICML), p. 12403–12422. Cited by: §I, §I-A3. [9] J. Moon, D. Yoo, X. Jiang, and M. Kim (2025) THOR: secure transformer inference with homomorphic encryption. In Proc. ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), p. 3765–3779. Cited by: §I, §I-A3. [10] D. Park, E. Lee, and J. Lee (2025) Powerformer: efficient and high-accuracy privacy-preserving language model with homomorphic encryption. In Proc. Annu. Meeting Assoc. Comput. Linguistics (ACL), p. 11090–11111. Cited by: §I, §I-A3. [11] D. Rho, T. Kim, M. Park, J. W. Kim, H. Chae, E. K. Ryu, and J. H. Cheon (2025) Encryption-friendly LLM architecture. In Proc. Int. Conf. Learn. Representations (ICLR), p. 67315–67341. Cited by: §I, §I-C2. [12] L. D. Castro, D. Escudero, A. Agrawal, A. Polychroniadou, and M. Veloso (2025) EncryptedLLM: privacy-preserving large language model inference via GPU-accelerated fully homomorphic encryption. In Proc. Int. Conf. Mach. Learn. (ICML), Cited by: §I, §I-A3. [13] L. Zhang, X. Wang, J. J. Sim, Z. Huang, J. Zhong, H. Wang, P. Duan, and K. Y. Lam (2026) MOAI: module-optimizing architecture for non-interactive secure transformer inference. In Proc. Int. Conf. Learn. Representations (ICLR), Cited by: 3rd item, §I, §I-A3, §I-A3, §I-D1. [14] Y. Yu, Y. Zhou, Y. Chen, P. Soto, W. Xiong, and M. Li (2026) Cachemir: fully homomorphic encrypted inference of generative large language model with kv cache. arXiv preprint. Note: arXiv:2602.11470 Cited by: §I, §I-A3, §I-A4. [15] A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson (2023) Universal and transferable adversarial attacks on aligned language models. Note: arXiv:2307.15043 Cited by: §I, §I-B1, §IV-A. [16] X. Liu, N. Xu, M. Chen, and C. Xiao (2024) Autodan: generating stealthy jailbreak prompts on aligned large language models. In Proc. Int. Conf. Learn. Representations (ICLR), p. 56174–56194. Cited by: §I, §I-B1, §IV-A. [17] T. Rebedea, R. Dinu, M. N. Sreedhar, C. Parisien, and J. Cohen (2023) Nemo guardrails: a toolkit for controllable and safe LLM applications with programmable rails. In Proc. Conf. Empirical Methods Nat. Lang. Process. (EMNLP), p. 431–445. Cited by: §I. [18] H. Inan, K. Upasani, J. Chi, R. Rungta, K. Iyer, Y. Mao, M. Tontchev, Q. Hu, B. Fuller, D. Testuggine, et al. (2023) Llama guard: LLM-based input-output safeguard for human-AI conversations. arXiv preprint. Note: arXiv:2312.06674 Cited by: 3rd item, §I, §I-B2. [19] X. Wang, Z. Ji, W. Wang, Z. Li, D. Wu, and S. Wang (2026) SoK: evaluating jailbreak guardrails for large language models. In Proc. IEEE Symp. Secur. Privacy (SP), p. 39–58. Cited by: §I, §I-B1, §I-B2, §I-B, §I-A, §I-C, §IV-A, §IV-C, §IV, §V. [20] X. Wang, D. Wu, Z. Ji, Z. Li, P. Ma, S. Wang, Y. Li, Y. Liu, N. Liu, and J. Rahmel (2025) SelfDefend: LLMs can defend themselves against jailbreaking in a practical manner. In Proc. USENIX Secur. Symp., p. 2441–2460. Cited by: §I, §I-B2. [21] Y. Xie, M. Fang, R. Pi, and N. Gong (2024) Gradsafe: detecting jailbreak prompts for LLMs via safety-critical gradient analysis. In Proc. Annu. Meeting Assoc. Comput. Linguistics (ACL), p. 507–518. Cited by: 2nd item, §I, §I-B2, §I-C2. [22] S. Zhang, Y. Zhai, K. Guo, H. Hu, S. Guo, Z. Fang, L. Zhao, C. Shen, C. Wang, and Q. Wang (2025) JBShield: defending large language models from jailbreak attacks through activated concept analysis and manipulation. In Proc. USENIX Secur. Symp., p. 8215–8234. Cited by: 2nd item, §I, §I-B2, §I-C1, §I-C1, §I-C1, §I-C1. [23] A. Robey, E. Wong, H. Hassani, and G. J. Pappas (2023) Smoothllm: defending large language models against jailbreaking attacks. Note: arXiv:2310.03684 Cited by: §I, §I-B2. [24] X. Zhang, C. Zhang, T. Li, Y. Huang, X. Jia, M. Hu, J. Zhang, Y. Liu, S. Ma, and C. Shen (2025) Jailguard: a universal detection framework for prompt-based attacks on LLM systems. ACM Trans. Softw. Eng. Methodol. 35 (1), p. 1–40. Cited by: §I, §I-B2. [25] J. H. Cheon, K. Han, A. Kim, M. Kim, and Y. Song (2018) A full rns variant of approximate homomorphic encryption. In Proc. Int. Conf. Sel. Areas Cryptogr. (SAC), p. 347–368. Cited by: §I-A. [26] C. Gentry and Y. Lee (2026) Fully homomorphic encryption for matrix arithmetic. In Proc. Annu. Int. Cryptol. Conf. (CRYPTO), p. 363–395. Cited by: §I-A. [27] J. H. Cheon, A. Kim, M. Kim, and Y. Song (2017) Homomorphic encryption for arithmetic of approximate numbers. In Proc. Int. Conf. Theory Appl. Cryptol. Inf. Secur. (ASIACRYPT), p. 409–437. Cited by: §I-A. [28] B. Li and D. Micciancio (2021) On the security of homomorphic encryption on approximate numbers. In Proc. Annu. Int. Conf. Theory Appl. Cryptograph. Techn. (EUROCRYPT), p. 648–677. Cited by: §I-A2. [29] W. Ao and V. N. Boddeti (2024) AutoFHE: automated adaption of CNNs for efficient evaluation over FHE. In Proc. USENIX Secur. Symp., p. 2173–2190. Cited by: §I-A3. [30] J. Zhang, X. Yang, L. He, K. Chen, W. Lu, Y. Wang, X. Hou, J. Liu, K. Ren, and X. Yang (2025) Secure transformer inference made non-interactive. In Proc. Netw. Distrib. Syst. Secur. Symp. (NDSS), Cited by: §I-A3. [31] L. Lim, V. Kalagi, D. Agrawal, and A. E. Abbadi (2025) Tricycle: private transformer inference with tricyclic encodings. Note: Cryptology ePrint Archive, Paper 2025/1200 External Links: Link Cited by: §I-A3. [32] L. Yang, J. Chen, W. Dai, S. Wang, W. Wu, and Y. Feng (2025) ARION: attention-optimized transformer inference on encrypted data. Note: Cryptology ePrint Archive, Paper 2025/2271 External Links: Link Cited by: §I-A3. [33] S. Jayashankar, J. Kim, M. B. Sullivan, W. Zheng, and D. Skarlatos (2025) A scalable multi-GPU framework for encrypted large-model inference. Note: arXiv:2512.11269 Cited by: §I-A3. [34] Z. Wang, R. Chen, X. Gao, Y. Wang, L. Liu, Z. Lan, Z. Wang, S. Fu, Q. Wang, and X. Huang (2026) STIP: efficient and secure non-interactive transformer inference via compact packing. Note: Cryptology ePrint Archive, Paper 2026/174 External Links: Link Cited by: §I-A3. [35] X. Gao, S. Fu, L. Liu, Z. Liu, Y. Luo, and Y. Wang (2026) Euston: efficient and user-friendly secure transformer inference with non-interactivity. In Proc. IEEE Symp. Secur. Privacy (SP), p. 1443–1462. Cited by: §I-A3. [36] J. Park, S. Park, J. H. Park, J. H. Ahn, J. H. Cheon, G. Hanrot, J. W. Kim, M. Park, and D. Stehlé (2026) Scaling up FHE-based privacy-preserving ML: higher throughput, longer inputs for Llama-3-8B. Note: arXiv:2601.18511 Cited by: §I-A3. [37] M. Hao, H. Li, H. Chen, P. Xing, G. Xu, and T. Zhang (2022) Iron: private inference on transformers. In Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), Vol. 35, p. 15718–15731. Cited by: §I-A4. [38] C. Juvekar, V. Vaikuntanathan, and A. Chandrakasan (2018) GAZELLE: a low latency framework for secure neural network inference. In Proc. USENIX Secur. Symp., p. 1651–1669. Cited by: §I-A4. [39] X. Shen, Z. Chen, M. Backes, Y. Shen, and Y. Zhang (2024) “Do anything now”: characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proc. ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), p. 1671–1685. Cited by: §I-B1, §IV-A. [40] A. Mehrotra, M. Zampetakis, P. Kassianik, B. Nelson, H. Anderson, Y. Singer, and A. Karbasi (2024) Tree of attacks: jailbreaking black-box LLMs automatically. In Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), Vol. 37, p. 61065–61105. Cited by: §I-B1. [41] J. Yu, X. Lin, Z. Yu, and X. Xing (2024) LLM-Fuzzer: scaling assessment of large language model jailbreaks. In Proc. USENIX Secur. Symp., p. 4657–4674. Cited by: §I-B1. [42] X. Li, R. Wang, M. Cheng, T. Zhou, and C. Hsieh (2024) DrAttack: prompt decomposition and reconstruction makes powerful LLMs jailbreakers. In Proc. Conf. Empirical Methods Nat. Lang. Process. (EMNLP), p. 13891–13913. Note: Findings Cited by: §I-B1, §IV-A. [43] Y. Deng, W. Zhang, S. J. Pan, and L. Bing (2024) Multilingual jailbreak challenges in large language models. In Proc. Int. Conf. Learn. Representations (ICLR), p. 24634–24651. Cited by: §I-B1, §IV-A. [44] Q. Ren, H. Li, D. Liu, Z. Xie, X. Lu, Y. Qiao, L. Sha, J. Yan, L. Ma, and J. Shao (2025) LLMs know their vulnerabilities: uncover safety gaps through natural distribution shifts. In Proc. Annu. Meeting Assoc. Comput. Linguistics (ACL), p. 24763–24785. Cited by: §I-B1, §IV-A. [45] S. Rahman, L. Jiang, J. Shiffer, G. Liu, S. Issaka, M. R. Parvez, H. Palangi, K. Chang, Y. Choi, and S. Gabriel (2025) X-Teaming: multi-turn jailbreaks and defenses with adaptive multi-agents. Note: arXiv:2504.13203 Cited by: §I-B1, §V. [46] Y. Liu, H. Gao, S. Zhai, Y. He, J. Xia, Z. Hu, Y. Chen, X. Yang, J. Zhang, S. Z. Li, H. Xiong, and B. Hooi (2025) GuardReasoner: towards reasoning-based LLM safeguards. Note: arXiv:2501.18492 Cited by: §I-B2. [47] A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan, et al. (2024) The Llama 3 herd of models. Note: arXiv:2407.21783 Cited by: §I-A, §I-D. [48] E. Lee, J. Lee, J. No, and Y. Kim (2022) Minimax approximation of sign function by composite polynomial for homomorphic comparison. IEEE Trans. Dependable Secure Comput. 19 (6), p. 3711–3727. Cited by: §I-B. [49] P. Panzade, J. R. Asl, D. Takabi, and Z. Cai (2025) BlindTuner: on enhancement of privacy-preserving fine-tuning of transformers based on homomorphic encryption. IEEE Internet Things J. 12 (19), p. 39211–39222. Cited by: §I-C2. [50] DESILO Inc. (2025) DESILO FHE library. External Links: Link Cited by: §IV-A. [51] W. Cho, G. Hanrot, T. Kim, M. Park, and D. Stehlé (2024) Fast and accurate homomorphic softmax evaluation. In Proc. ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), p. 4391–4404. Cited by: §IV-A. [52] X. Li, T. Zhang, Y. Dubois, R. Taori, I. Gulrajani, C. Guestrin, P. Liang, and T. B. Hashimoto (2023) AlpacaEval: an automatic evaluator of instruction-following models. Note: GitHub repository External Links: Link Cited by: §IV-A. [53] J. Cui, W. Chiang, I. Stoica, and C. Hsieh (2025) OR-Bench: an over-refusal benchmark for large language models. In Proc. Int. Conf. Mach. Learn. (ICML), p. 11515–11542. Cited by: §IV-A. [54] M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li, D. Forsyth, and D. Hendrycks (2024) HarmBench: a standardized evaluation framework for automated red teaming and robust refusal. In Proc. Int. Conf. Mach. Learn. (ICML), p. 35181–35224. Cited by: §IV-A, TABLE I.