EGuard: Advanced Multi-Domain Defenses

• EGuard is a multi-faceted security framework designed to defend against vibration-based side-channel eavesdropping, embedding inversion, and dual-jailbreak attacks.
• It employs sophisticated methods such as adversarial perturbation generators, transformer-based projection networks, and an ensemble of guardrails to balance robust protection with system utility.
• Empirical results demonstrate over 97% protection in audio defenses, a reduction in inversion success from 95% to 4%, and a 15–25 point drop in dual-jailbreak attack success rates.

EGuard refers to multiple advanced software-based mechanisms designed to enhance security and privacy across distinct application domains: (1) mitigation of vibration-based side-channel eavesdropping, (2) defense against embedding inversion attacks on LLM vector databases, and (3) a guardrail-ensembling system to resist dual-jailbreaking (bypassing both LLM and guardrail controls) in safety-critical LLM deployments. Each flavor of EGuard embodies a state-of-the-art defense paradigm, leveraging principles from adversarial learning, information-theoretic privacy, and ensemble modeling to address fundamentally different adversarial threats. Below, each paradigm is described, along with their technical architectures, methodologies, empirical performance, and limitations.

1. Software-Driven Defense for Vibration-Based Side-Channel Eavesdropping

EGuard, as proposed in the context of speech privacy, is a software-only framework designed to counteract side-channel speech eavesdropping attacks (SSEAs) that exploit vibrometric sensors such as mmWave radar, optical vibrometers, or accelerometers. Rather than relying on hardware-based noise injection or shielding, EGuard algorithmically perturbs outgoing audio with imperceptible, adversarial modifications tailored to disrupt the sensing and reconstruction chains of these side-channel attack vectors while preserving the original audio’s intelligibility and quality to human listeners (Chang et al., 2024).

Core Components and Architecture

• Perturbation Generator Model (PGM): At its core, EGuard employs a generator $G_r$ composed of:
  • A variational autoencoder (VAE)-style FIR filter generator $G_f$ targeting low-frequency bands where side-channel sensors remain sensitive.
  • A random low-frequency adversarial perturbation (LFAP) generator $G_l$ that produces sub-500 Hz noise vectors, shaped to maximize adversarial impact on reconstructed speech.
  • A discriminator $D^p$ to enforce time-domain naturalness and thwart subtraction-style countermeasures.
• Differentiable Domain Translator (Eve-GAN): Enables end-to-end adversarial training by learning a few-shot, unpaired translation $T_s$ from audio to side-channel-captured signal distributions, using a CycleGAN-style framework for per-domain (e.g., mmWave, optical, accelerometer) translation.
• Few-Shot Generalization: Data collection overhead is mitigated via an initial combinatorial base set and only single new "few-shot" SSEA captures per new scenario/configuration.

Optimization and Formal Objectives

The composite adversarial training minimax objective includes adversarial, KL, ensemble-attack, and reconstruction-boosting terms, balancing naturalness, side-channel confusion, and robustness to adaptive attacks.

2. Transformer-Based Defense for Embedding Inversion in LLMs

The EGuard framework for embedding privacy addresses the risk of information leakage from LLM embedding vector stores, where adversaries may attempt embedding inversion to recover original user text (Liu et al., 2024).

Principle and Architecture

• Threat Model: Embedding-inversion attacks involve adversaries extracting or querying embedding vectors and leveraging auxiliary corpora and inversion decoders to reconstruct input text.
• Projection Network: EGuard projects the encoder output $e \in \mathbb{R}^d$ through a deep transformer network $g_p$ (24 layers, RoBERTa-style) with identical output dimensionality, disrupting direct invertibility.
• Optimization Objective: The network is trained to minimize the mutual information $I(x; e')$ between the source text $x$ and protected embedding $e'=g_p(\varphi(x))$, while jointly preserving $G_f$0 (task utility). Mutual information estimators such as InfoNCE are used, and a frozen text autoencoder $G_f$1 bridges discrete-to-continuous representations.

Training Methodology

• Autoencoder $G_f$2 pretraining on large unlabelled text.
• Encoder $G_f$3 is fixed; only $G_f$4 is trained.
• Task-specific losses (cross-entropy, ranking, summarization) are combined with the mutual information regularizer.
• Performance is validated on SST2, NLI, QR, and summarization, with OpenAI embedding models included for generality.

3. Ensemble Guardrail Approach Against Dual-Jailbreaking Attacks

In LLM deployments, EGuard acts as a defense meta-layer that ensembles multiple heterogeneous content guardrails using XGBoost, aimed at lowering the attack success rate of dual-jailbreaking methods targeting both the LLM backbone and its external guardrail (Huang et al., 21 Apr 2025).

System Workflow

• Input Representation: Binary (unsafe/safe) predictions from five guardrails (Llama-Guard-3, Nvidia NeMo, Guardrails AI, OpenAI Moderation API, Google Moderation API) are concatenated into a feature vector.
• Ensemble Modeling: An XGBoost classifier with $G_f$5 trees and max depth 3 is used to assign a probability of prompt unsafety, with initial tree weights biased toward Guard-3 (if correct), otherwise spreading trust among the other systems.
• Training Data: 4,000 prompts uniformly sampled from five public datasets (PKU-SafeRLHF, OpenBookQA, Yelp, TriviaQA, WikiQA), labeled by human validation.

Algorithmic Formulation

The model optimizes a regularized cross-entropy loss with complexity penalties per tree and dynamic example weights according to Guard-3's performance.

4. Empirical Performance and Key Results

Side-Channel Audio Defense

On mmWave radar, EGuard increases Mel-Cepstral Distortion (MCD) from 3.3 (no defense) to 13.4–13.6, raises WER from 9% to 68–70%, and depresses digit classification rates from 96% to ≤3%, while PESQ remains high (3.42). Similar disruptions are replicated for optical and accelerometric sensors, with all scenarios exceeding a “97% protection” threshold ($G_f$6 – DDR ≥ 97%) (Chang et al., 2024). User studies indicate perturbed audio remains nearly imperceptible.

Embedding Inversion Defense

EGuard reduces the fraction of successfully invertible tokens from ≈95% to ≈4% across multiple embedding models and tasks, with corresponding drops in F1/Recall from 93–98% to 3–6% and BLEU scores from ≈0.83–0.98 to ≈0.01–0.03. Downstream accuracy loss remains ≤2% (Liu et al., 2024).

Guardrail Ensemble

On jailbreak benchmarks (advBench, DNA, harmBench), EGuard lowers the Guardrail Attack Success Rate ($G_f$7) by approximately 15–25 percentage points compared to Llama-Guard-3 alone. For instance, for DualBreach attacks on harmBench, $G_f$8 falls from 87% to 74% (Huang et al., 21 Apr 2025).

Application	Threat/Attack	EGuard Mechanism	Key Metric Improvement
Side-channel audio privacy	Vibrometry-based SSEA	Adversarial audio PGM+GAN	≥97% protection, MCD↑, WER↑, PESQ≈orig.
Embedding inversion defense	Text reconstruction from	Transformer MI-projection	Inversion F1↓ 93–98%→3–6%, util. loss ~2%
LLM dual-jailbreak defense	Prompt attack bypassing	XGBoost guardrail ensemble	$G_f$9↓ by 15–25 pts vs. Guard-3

5. Resistance to Adaptive and Robust Attacks

• Side-channel defense: Adaptive adversaries attempting adversarial training, mean perturbation subtraction, or classical audio transformations (quantization, re-sampling, filtering) fail to reduce protection rates below 94%. Randomization (LFAP generator), FIR kernel diversity, and discriminator-loss prevent simple countermeasures (Chang et al., 2024).
• Embedding defense: Ablation studies show replacement of the mutual information objective or the projection network with simpler alternatives causes a loss in either privacy or utility. Transfer to new embedding models without retraining reduces both privacy and downstream performance (Liu et al., 2024).
• Guardrail ensemble defense: Attackers can only succeed if a vulnerability is present across all constituent guardrails. Binary "unsafe/safe" feature limitations are recognized; richer modeling may further enhance robustness (Huang et al., 21 Apr 2025).

6. Limitations and Prospective Directions

• Sensor and Modality Boundaries: EGuard audio defense cannot shield against throat/contact sensors or extremely high-resolution vibrometry above 2 kHz. Embedding defense currently targets text-only; vision/audio/video extensions are open problems (Chang et al., 2024, Liu et al., 2024).
• Generalizability: Retraining is required when deploying to unseen embedding architectures or guardrail sets.
• Resource Demands: Audio defense introduces ≈3–12 ms latency per 50 ms frame, transformer projections increase training computation moderately, ensemble guardrails require minimal inference overhead.
• Adaptivity: Online learning and automatic re-weighting in EGuard (ensemble) could improve robustness against emerging jailbreak techniques.

Potential extensions include lightweight on-device PGM implementations, meta-learned projection networks, multi-modal/multi-sensor support, and integration of formal differential-privacy mechanisms or continual-learning adaptation for evolving deployment environments (Chang et al., 2024, Liu et al., 2024, Huang et al., 21 Apr 2025).