Protego: Multifaceted Defensive Interposition

• Protego is a polysemous research label defined by its role as an interposition defense mechanism that safeguards privacy, integrity, and safety across diverse applications.
• It encompasses techniques including pose-invariant facial perturbation for privacy, adversarial example detection in Vision Transformers, modular guardrails for enterprise LLMs, and automated selection in software protection.
• The approaches emphasize lightweight, compositional defenses that maintain operational utility while efficiently mitigating risks from adversarial attacks and reverse engineering.

Searching arXiv for papers titled or mentioning “Protego” to ground the article in current literature. Protego is a polysemous research label rather than a single technical system. In 2025 arXiv literature, the name denotes a user-centric method for protecting facial images against face-recognition-induced digital footprint exposure (Wang et al., 4 Aug 2025) and a framework for detecting adversarial examples in Vision Transformers by exploiting intrinsic transformer representations (Wu et al., 13 Jan 2025). In related usage, the label is also applied prospectively to a hypothetical enterprise LLM guardrailing stack abstracted from the multimodal system Protect (Avinash et al., 15 Oct 2025), and descriptively to automated software-protection selection workflows whose formal prototype is named ESP rather than Protego (Canavese et al., 23 Jun 2025). Across these usages, the recurring function of Protego is defensive interposition: inserting a learned or computed protection layer between an input, a model or application, and an attacker.

1. Nomenclature and research scope

The term “Protego” has no single canonical definition in current arXiv usage. Instead, it appears across distinct threat models, technical substrates, and deployment assumptions. This matters because the same label can refer to perturbation-based privacy protection, adversarial-example detection, multimodal LLM safety enforcement, or a broader “protect-and-go” automation vision for software hardening.

Usage of “Protego”	Technical target	Representative mechanism
Face-recognition privacy	Retrieval-based privacy intrusions	Pose-invariant 2D privacy protection texture warped into a natural-looking 3D mask (Wang et al., 4 Aug 2025)
ViT adversarial detection	Adversarial examples against pretrained ViTs	Detector trained on final [CLS] token-derived features (Wu et al., 13 Jan 2025)
Enterprise LLM guardrailing blueprint	Safety oversight across text, image, and audio	Modular LoRA-based safety adapters derived from Protect (Avinash et al., 15 Oct 2025)
Automated software protection, used descriptively rather than as a formal system name	MATE risk mitigation in code artifacts	Game-theoretic minimax selection of protections in ESP (Canavese et al., 23 Jun 2025)

A common misconception is that Protego names one unified defense stack. The literature instead supports a narrower statement: Protego is a recurring label for systems that seek to preserve privacy, integrity, safety, or robustness under adversarial interaction.

2. Protego in face-recognition privacy protection

In "Protego: User-Centric Pose-Invariant Privacy Protection Against Face Recognition-Induced Digital Footprint Exposure" (Wang et al., 4 Aug 2025), the threat model is large-scale face-indexed retrieval. Services such as Clearview AI and PimEyes are described as enabling an intruder to upload a facial photo, retrieve top-$K$ matches from a scraped database, and thereby expose a subject’s digital footprint, including social-media activity, private photos, and news reports. Modern FR systems are formalized as embedding functions $F(x)$, so retrieval reduces to nearest-neighbor search in embedding space.

The paper’s central claim is that prior defenses often fail in the hard case where both the query and the database entries are protected. Existing adversarial-perturbation or mask-learning methods typically prevent matching between unprotected and protected images, but frequently collapse protected images into a tight embedding cluster, allowing protected images to match one another. Protego addresses this by combining two design choices: a single pose-invariant 2D “privacy protection texture” and a loss that amplifies model hypersensitivity so that even small intra-face variations produce drastically different embeddings.

The pipeline has an offline learning phase and an online protection phase. Offline, a user-specific image set $\Omega=\{x_i\}$ is used to learn a UV-aligned texture $T\in\mathbb{R}^{H\times W\times 3}$, bounded in $[-\epsilon,+\epsilon]$. For each sampled face $x$, a UV mapping network such as SMIRK produces $UV(x)$; grid sampling through $UV(x)$ yields a perturbation $\delta(T;x)$; and the protected image is

$\Theta(x;T)=\mathrm{Clip}[x-\delta(T;x)].$

The update step is

$F(x)$0

with $F(x)$1 a small ensemble of FR models.

The protection objective has two terms. The first, $F(x)$2, simultaneously pushes protected embeddings away from unprotected counterparts and maximizes the volume spanned by protected embeddings via a $F(x)$3 term, where $F(x)$4 and $F(x)$5. The second, $F(x)$6, constrains average distortion through SSIM so that visual coherence is preserved. The combined loss is

$F(x)$7

This construction is explicitly intended to ensure intra-user unlinkability, not merely mismatching between protected and unprotected images.

The experimental setup uses FaceScrub, with approximately 40K images of approximately 500 celebrities, and LFW, with approximately 13K images. Twenty celebrities are randomly selected as Protego users; for each user, 20% of images are held out as queries, 60% form the training set $F(x)$8, and 20% are unseen database entries for generalization testing. Ten public FR models are considered, and the default intruder is AD-IR50-CA. Under the baseline, recall is approximately 71.68%. In the easy settings—unprotected query with protected database, or protected query with unprotected database—Protego achieves recall at or below 1.05%. In the hard setting, protected query with protected database, Protego yields 18.09% recall, compared with approximately 65% for Chameleon and approximately 45% for OPOM; the paper characterizes this as at least $F(x)$9 better than existing methods (Wang et al., 4 Aug 2025).

The ablations are particularly diagnostic. Removing the hypersensitivity term causes recall to jump from 18.09% to 78.52%, which the paper describes as worse than no defense at all. Replacing the 3D UV design with a 2D static mask raises recall from 18.09% to 20.51% and degrades visual quality on non-frontal poses. Transfer experiments show that a focal-diversity 3-model ensemble reduces MagFace recall from 98% to 34% and FaceNet recall from 82% to 20%. Under adaptive post-processing attacks such as Gaussian blur, median filtering, JPEG, and down-resizing, Protego’s recall remains essentially unchanged at approximately 18%, whereas Chameleon and OPOM vary widely at approximately 50%–60%.

The deployment model is user-centric. Enrollment requires approximately 50–100 selfies with varied poses and expressions; all processing is local; the output is a single $\Omega=\{x_i\}$0 RGB texture; and protection can be integrated into a browser extension or mobile plugin. Runtime is approximately 93 ms per image on an RTX 4090. The reported limitations are extreme occlusions, severe lighting changes that impair UV-map accuracy, and very low-resolution faces below 64 pixels.

3. Protego as a detector for adversarial examples in Vision Transformers

In "Protego: Detecting Adversarial Examples for Vision Transformers via Intrinsic Capabilities" (Wu et al., 13 Jan 2025), Protego is not a robust training procedure and not a perturbation generator; it is a detector. The objective is reactive: flag an adversarial input before a pretrained ViT produces a potentially wrong prediction. The paper evaluates six attacks—FGSM, BIM, PGD, CW, MIM, and Patch-fool—on ViT-B/16, ViT-B/32, and DeiT-Tiny, under both white-box and black-box settings.

The key premise is architectural. In a ViT, the final [CLS] token aggregates information from all image patches through self-attention. The paper states that “the token of prediction contains all the information from the input sample.” If the final encoder output is a sequence $\Omega=\{x_i\}$1, with $\Omega=\{x_i\}$2 the [CLS] token, then after one self-attention layer,

$\Omega=\{x_i\}$3

so the [CLS] position has globally aggregated the image. The detector is trained on the difference between clean and adversarial [CLS] embeddings:

$\Omega=\{x_i\}$4

The detector itself is minimal: a single linear layer mapping the flattened feature to a binary logit,

$\Omega=\{x_i\}$5

Training uses cross-entropy,

$\Omega=\{x_i\}$6

with SGD and momentum. Attention rollout and gradient attention rollout are used for interpretability rather than primary detection. The reported qualitative observation is that clean inputs focus attention on semantically salient regions, whereas adversarial examples redirect attention toward edges or backgrounds.

The experiments use the ImageNet-1k validation set with 50,000 images. Attack parameters include $\Omega=\{x_i\}$7 for FGSM, BIM, and PGD; 10 steps with $\Omega=\{x_i\}$8 for PGD and BIM; $\Omega=\{x_i\}$9, $T\in\mathbb{R}^{H\times W\times 3}$0, and 50 steps for CW; and a single patch chosen by attention layer 4 for Patch-fool. Baselines are Local Intrinsic Dimensionality and Feature Squeezing. The paper reports strong attack success against undefended models: for example, ViT-B/16 drops from 79.3% top-1 accuracy without attack to 4.1% under PGD, 39.8% under FGSM, 18.2% under BIM, 50.8% under CW, 7.2% under MIM, and 24.6% under Patch-fool. DeiT-Tiny is described as even more fragile, with PGD reducing top-1 accuracy to 0.86%.

Detection performance is reported as high. The abstract states that for the six adversarial attack methods the detector’s AUC scores all exceed 0.95. The detailed exposition further states that Protego outperforms LID on every attack/model combination, with several perfect 1.00 AUC scores, including FGSM across all three ViTs and PGD on ViT-B/16. The contribution is therefore a lightweight plug-in detector that leverages a representation already computed by the backbone rather than requiring adversarial training or large auxiliary modules (Wu et al., 13 Jan 2025).

The limitations are also specific. The adversary is assumed to attack the base classifier rather than a joint classifier-detector system; adaptive white-box attacks minimizing both classification loss and detection score are not studied. Transfer across different ViT architectures or datasets is not demonstrated. The clean-versus-adversarial subtraction is also operationally restrictive if a benign reference is unavailable at inference time; the discussion notes that the paper sidesteps this by assuming access to a reference stream or by training directly on observed feature offsets.

4. Protego as an enterprise LLM guardrailing blueprint

The multimodal guardrailing paper is formally titled "Protect: Towards Robust Guardrailing Stack for Trustworthy Enterprise LLM Systems" (Avinash et al., 15 Oct 2025), but its detailed exposition explicitly treats its lessons as a blueprint for a hypothetical “Protego.” In that usage, Protego is not a published system name but an architectural pattern for enterprise-grade LLM safety: a unified, multi-modal framework that sits transparently in the inference loop and enforces four policy dimensions—toxicity, sexism, data privacy, and prompt injection—across text, image, and audio.

The problem setting is enterprise deployment in mission-critical workflows such as customer support, document analysis, and automated decision-making. The limitations identified for legacy guardrails are real-time oversight, multi-modal coverage, explainability and auditability, and scalability under evolving policies. The proposed architecture interposes modular adapters between the application gateway and the generative model. User data is routed through a multi-modal encoder, Gemma-3n, and then through four independent LoRA-based safety adapters, each specialized for one policy dimension. This permits pre-filtering of user inputs, in-loop monitoring of generated tokens, and layered composition in which specific policies can be enabled or disabled on demand.

The runtime design emphasizes token streaming. The gateway subscribes to the stream until it sees the </label> marker; at that point, a binary Allow/Deny decision is enforced, while the subsequent <explanation> is logged for audit or optionally surfaced. The reported latency to emit the label marker and block a request is within 65 ms for text and 107 ms for image, while the explanation continues to stream asynchronously. The detailed discussion also describes synchronous call latencies in the 60–110 ms range when adapters are hosted alongside the base LLM on H100 GPUs under vLLM.

The model trunk is google/gemma-3n-E4B-it, described as an 8B-parameter multimodal SLM. Into each Transformer block’s query, key, value, and MLP layers, a LoRA module is injected. For a frozen weight matrix $T\in\mathbb{R}^{H\times W\times 3}$1, the trainable update is $T\in\mathbb{R}^{H\times W\times 3}$2 with $T\in\mathbb{R}^{H\times W\times 3}$3, $T\in\mathbb{R}^{H\times W\times 3}$4, and rank $T\in\mathbb{R}^{H\times W\times 3}$5, keeping additional parameters per adapter under 1% of the base. Each adapter is trained independently using Axolotl to minimize binary cross-entropy for Passed versus Failed:

$T\in\mathbb{R}^{H\times W\times 3}$6

Because adapters are disjoint, the tasks are not summed during training; each adapter serves its own API endpoint.

The data pipeline is multimodal and teacher-assisted. The training corpus spans approximately 100K examples per category across text, image, and synthetic audio. Sources include Hateful Memes, VizWiz-Priv, WildGuardTest, ToxicChat, and private enterprise logs. Audio is synthesized with CosyVoice 2.0 under varied accents, emotions, speaking rates, and background noise levels. Labels are refined through Gemini-2.5-Pro, which generates a chain-of-thought, an <explanation>, and a provisional label; human auditors relabel 21% of original annotations. The resulting class balances are reported as realistic, including 24% Fail for toxicity, 19% for privacy, and 69% for sexism.

The empirical results focus on text-only benchmarks against Gemma-3n without adapters, WildGuard, LlamaGuard-4, and GPT-4.1. For toxicity, the adapter achieves 82.7% Failed-class F1, compared with 72.7% for Gemma-3n and 83.4% for GPT-4.1. For sexism, it reaches 95.0%, versus 92.0% for WildGuard and 93.2% for GPT-4.1. Privacy and prompt injection are reported at 74.7% and 96.6% Failed-class F1, respectively, outperforming all baselines in the summary. Ablations attribute a 5–7 point recall drop to removing teacher-assisted relabeling, an approximately 2-point prompt-injection gain for a Vanilla variant without explanations, a 3-point sexism gain for an Explanation variant, and an 8% F1 degradation on synthetic audio when audio augmentation is omitted.

The blueprint framing is explicit in the limitations and future work. The current system omits video and does not yet address deep-fake or chain-of-thought poisoning. Future directions include expanding to 5–10 policy dimensions, joint multi-task adapters with a weighted sum loss $T\in\mathbb{R}^{H\times W\times 3}$7, inline audio cues such as breaths or laughter via TTS tag injection, and adaptive adversarial training against red-teamed jailbreaks. In this context, Protego denotes a prospective enterprise guardrailing stack rather than an already formalized paper title.

5. Protego as a descriptive label for automated software protection selection

In "Automatic Selection of Protections to Mitigate Risks Against Software Applications" (Canavese et al., 23 Jun 2025), the formal system name is not Protego but ESP, and the paper situates it within automated software protection for Man-At-The-End attackers. The accompanying discussion nonetheless presents ESP as matching what a “Protego” solution would be expected to provide: automated analysis of an application’s risks and tailored, cost-effective protection configurations. This is best understood as a descriptive association rather than a naming claim.

The threat model is software deployed in untrusted environments, such as mobile apps, DRM players, and licensing libraries, where attackers can load, debug, disassemble, reverse-engineer, and patch binaries. The approach formalizes artifacts $T\in\mathbb{R}^{H\times W\times 3}$8, requirements $T\in\mathbb{R}^{H\times W\times 3}$9, protection objectives $[-\epsilon,+\epsilon]$0, protection types $[-\epsilon,+\epsilon]$1, deployed software protections $[-\epsilon,+\epsilon]$2, compatibility predicates, enforcement predicates, and precedence relations among protections. Attacker models are constructed from atomic attack steps $[-\epsilon,+\epsilon]$3, abstract and concrete attack paths $[-\epsilon,+\epsilon]$4, base success probabilities $[-\epsilon,+\epsilon]$5, mitigation factors $[-\epsilon,+\epsilon]$6, and synergy factors $[-\epsilon,+\epsilon]$7.

The defender’s solution space is the set of all sequences of deployed protections

$[-\epsilon,+\epsilon]$8

that satisfy compatibility, enforcement, and precedence constraints. Overhead constraints are explicit:

$[-\epsilon,+\epsilon]$9

The defender chooses one solution $x$0; the attacker then repeatedly invests effort units in concrete attack paths. The residual success likelihood of a concrete path is

$x$1

with $x$2 integrating both mitigation and synergy on the targeted artifact.

The central scoring function is the Software Protection Index, which aggregates four measures per asset: code comprehension $x$3, code transfer $x$4, tampering detection $x$5, and tampering avoidance $x$6. Each adjusted measure incorporates attack success:

$x$7

Potency for a metric $x$8 is defined as

$x$9

and the overall index is

$UV(x)$0

This formalization extends potency and resilience into a unified residual-risk score over attack paths.

The optimization strategy is a depth-first minimax search with alpha-beta pruning, aspiration windows, transposition tables, futility pruning, and partitioning into code-correlation sets. The implementation is a set of Java/Eclipse plugins using Eclipse CDT; users annotate C source regions, and the system integrates Tigress and ACTC as protection back ends. Attack steps and paths are defined through backward-chaining Prolog rules. During mitigation, the solver emits the top ten solutions with highest SPI, and, when needed, generates server-side stubs for remote attestation or code mobility.

Validation includes codebases with up to 59 protection objectives and hundreds of attack paths, where depth-3 or depth-4 minimax completes in seconds to minutes on a 4-core i9 virtual machine. Three industrial use cases—an OTT DRM video player, a license manager, and an OTP generator—are used for qualitative assessment. Experts reportedly judged ESP’s top-ranked solutions to match or exceed manually chosen protection combinations while preserving functionality and keeping overhead acceptable. The limitations are dependence on expert-provided probabilities and factors, coarse-grained attack steps, degrading ML accuracy beyond three layered protections, manual overhead thresholds per code-correlation set, and exponential worst-case complexity.

6. Cross-cutting themes, distinctions, and open problems

Taken together, these Protego usages suggest a family resemblance rather than a common implementation. The face-recognition Protego protects by perturbing the user’s visible data before upload; the ViT Protego protects by detecting adversarial inputs before or during classification; the Protect-derived Protego blueprint protects by enforcing policy decisions within the generation loop; and ESP-as-Protego protects by selecting hardening actions before deployment. The shared motif is interposition, but the protected object differs: identity embeddings, hidden-state representations, token streams, or software artifacts.

A second commonality is targeted modularity. The face-recognition method learns a single per-user texture that can be dynamically warped to arbitrary pose and expression (Wang et al., 4 Aug 2025). The ViT detector uses only the final [CLS] representation and a single linear layer (Wu et al., 13 Jan 2025). The LLM guardrailing blueprint relies on category-specific LoRA adapters with under-1% additional parameters per adapter (Avinash et al., 15 Oct 2025). The software-protection framework decomposes the global defense problem into code-correlation sets and concrete protection instantiations (Canavese et al., 23 Jun 2025). This suggests a broader design tendency toward lightweight, compositional defenses rather than monolithic retraining or whole-system transformation.

The interpretability story is more heterogeneous. In the LLM case, explainability is a first-class system requirement, and explanation traces are emitted after the decision marker for auditability (Avinash et al., 15 Oct 2025). In the ViT case, attention rollout and gradient attention rollout are interpretive tools that support the hypothesis that adversarial noise hijacks attention (Wu et al., 13 Jan 2025). In the software-protection case, explainability appears through explicit attack paths, SPI decomposition, and worst-case attacker sequences (Canavese et al., 23 Jun 2025). The face-recognition paper emphasizes perceptual coherence and privacy guarantees rather than human-readable explanations (Wang et al., 4 Aug 2025).

The limitations are also domain-specific and should not be conflated. The face-recognition Protego is evaluated against adaptive image post-processing but still depends on reliable UV estimation and adequate face resolution (Wang et al., 4 Aug 2025). The ViT Protego does not study adaptive attacks on the joint classifier-detector system and assumes a clean reference or comparable calibration mechanism (Wu et al., 13 Jan 2025). The Protect-derived Protego blueprint omits video and several emerging threat vectors, including deep-fake and chain-of-thought poisoning (Avinash et al., 15 Oct 2025). The software-protection line remains dependent on expert-specified attack parameters and heuristic search under exponential worst-case complexity (Canavese et al., 23 Jun 2025).

A final misconception concerns novelty claims. Only the face-recognition Protego is presented as the first defense simultaneously achieving robust protection in the protected-query/protected-database setting, pose- and expression-aware 3D deployment, and high visual fidelity in stills and videos (Wang et al., 4 Aug 2025). The ViT Protego claims superior AUC over existing detectors but does not position itself as the first detector of its kind (Wu et al., 13 Jan 2025). The enterprise guardrailing “Protego” is explicitly hypothetical, derived from Protect rather than published under that title (Avinash et al., 15 Oct 2025). The automated software-protection framework is formally ESP, with the Protego connection functioning as an interpretive shorthand rather than an authored system name (Canavese et al., 23 Jun 2025).

In current arXiv usage, then, Protego is best understood as a recurrent defensive trope: a system that preserves operational utility while inserting a technically constrained shield against adversarial inference, privacy intrusion, unsafe generation, or reverse engineering. The term’s future coherence will depend on whether later work consolidates these strands into a stable research program or continues to apply the label to domain-specific protection mechanisms.