Homomorphic Encryption (HE) has become a key technique for privacy‑preserving machine learning (PPML), enabling computation directly on ciphertexts. In an HE‑PPML setting, a client sends an encrypted input to a server, which evaluates models such as large language models (LLMs) without ever decrypting the data. This architecture, however, introduces a critical security flaw: a malicious client can submit adversarial prompts (e.g., jailbreak attacks) and the server, constrained by the confidentiality of HE, cannot inspect the incoming prompts or the generated responses. Consequently, attacks are hard to detect or block, and successful breaches remain completely invisible to the server. To mitigate this risk, we propose the HE‑Guardrail framework, which evaluates guardrail mechanisms entirely over encrypted data and homomorphically decides whether to return the model’s response to the client. We instantiate HE‑Guardrail with three representative guardrails—Llama Guard, JBShield, and GradSafe. Experiments show that HE‑Guardrail closely reproduces the decisions of the corresponding plaintext guardrails in the encrypted domain, while offering distinct trade‑offs among security, efficiency, and utility.
Review