Unified Defense Stack: Coordinated Security

• Unified Defense Stack is a coordinated security architecture that integrates multiple stage-specific defenses into one adaptive pipeline across computation and communication paths.
• It employs distinct mechanisms such as prompt-time steering, response-time probing, and programmable data-plane pipelines in various domains including LLM safety and IPv6 security.
• Adaptive orchestration in the stack balances security and utility by addressing failure modes and managing trade-offs in defense activation and policy enforcement.

Unified Defense Stack denotes a composed defense architecture in which multiple protective mechanisms are arranged as one coordinated pipeline rather than deployed as isolated point countermeasures. In current literature, the term is used most explicitly for inference-time large-language-model safety, where prompt-time steering is composed with response-time probing and halting (Mitra, 28 Jun 2026), for retrieval-augmented generation, where a Sentinel and a Strategist selectively activate defenses across pre-retrieval, post-retrieval, pre-generation, and post-generation hooks (Pallerla et al., 22 Apr 2026), and for programmable IPv6 security, where a single data-plane pipeline unifies external spoofing, internal spoofing, external flooding, and internal flooding (Aljoby et al., 9 Feb 2026). Related systems work applies the same compositional idea to software runtime protection, embedded control-flow integrity, cyber-physical deception, and autonomous-vehicle perception, typically by combining isolation, integrity enforcement, anomaly filtering, and adaptive control rather than relying on any single mechanism (Chong, 21 Mar 2025).

1. Architectural pattern and domain scope

A unified defense stack is characterized by stage-specific enforcement, shared state across those stages, and an explicit ordering of controls. In the RAG setting, the architecture is split into a Control Plane and a Data Plane, with the Control Plane containing the Sentinel, the Strategist, and a persistence layer with user trust state, and the Data Plane exposing four interception hooks (Pallerla et al., 22 Apr 2026). In the IPv6 setting, the architecture is a single programmable data-plane pipeline whose ordering is “identity plausibility before rate plausibility” (Aljoby et al., 9 Feb 2026). In inference-time LLM safety, the architecture is an “orthogonal split” in which response-time halt catches prefilling and AlphaSteer catches semantic attacks (Mitra, 28 Jun 2026). In stack-memory defense, CleanStack formalizes a dual-stack system with isolation and randomization under the name Tainted Stack Object Separation (TSOS) (Chong, 21 Mar 2025).

Domain	Stack form	Representative source
LLM inference-time safety	Prompt-time steering + response-time probe/halt	(Mitra, 28 Jun 2026)
RAG	Sentinel-Strategist over four hooks	(Pallerla et al., 22 Apr 2026)
Prompt-side LLM detection	Masked-prompt probing + single-forward strategy	(Lin et al., 18 Feb 2025)
Safeguard pipelines	Input classifier $\rightarrow$ model $\rightarrow$ output classifier	(McKenzie et al., 30 Jun 2025)
IPv6 edge security	External/internal spoofing + external/internal flooding	(Aljoby et al., 9 Feb 2026)
Runtime and memory protection	Dual stack, tainted-object separation, watchpoint-protected shadow stack	(Chong, 21 Mar 2025)

This pattern suggests that “unified” does not mean monolithic. Rather, it denotes systems in which multiple defenses are coordinated at distinct points of a computation or communication path, with each layer consuming information produced by earlier layers.

2. Inference-time language-model stacks

The clearest formalization of a Unified Defense Stack in LLM safety appears in “Closing the Activation-Cone Blind Spot: Response-Time Probing and Unified Defense,” which argues that no single prompt-time intervention robustly covers the major jailbreak families (Mitra, 28 Jun 2026). The paper compares five defense paradigms across seven instruction-tuned models and five attack families, then proves a corollary: any defense that decides whether to intervene by measuring the current activation’s alignment with a benign reference, a cone, subspace, or null-space projection, at any single layer is structurally blind to attacks that craft activations to lie inside that reference. Its constructive answer is response-time probing, implemented as a linear probe on the model’s hidden state at the first generated tokens, with inference-time halt at threshold $\tau_r = 0.5$. The unified stack composes this response-halt with AlphaSteer’s null-space steering,

$$\mathbf{h}' = \mathbf{h} + \lambda\tilde{\Delta}\hat{P}\mathbf{h},$$

yielding defense success $0.983$ on Mistral and $0.994$ on Llama at $n=40$, while the response-time halt reduces canonical prefilling ASR to $0/40$ on all seven models with $0\%$ benign false positives (Mitra, 28 Jun 2026).

A different but related formulation appears in “STACK: Adversarial Attacks on LLM Safeguard Pipelines,” where the defended system is explicitly wrapped by an input classifier and an output classifier: $$p_{f_q,f_r}(m)(q) = m(q) \quad \text{when } (f_q(q) < t_q) \wedge (f_r(m(q)) < t_r),$$ and returns the empty string otherwise (McKenzie et al., 30 Jun 2025). The strongest evaluated open pipeline, a Gemma 2 few-shot-prompted input/output filter pair, reduces ASR to $\rightarrow$0 on ClearHarm against PAP, ReNeLLM, and Best-of-$\rightarrow$1. Yet a STaged AttaCK procedure that separately jailbreaks the input filter, the model, and the output filter reaches $\rightarrow$2 ASR in a black-box attack and $\rightarrow$3 ASR in transfer (McKenzie et al., 30 Jun 2025). The factual lesson is that stacked safeguards can be highly effective against standard baselines while remaining vulnerable to stage-aware adaptive attacks.

Prompt-side unification is developed in “UniGuardian,” which reframes prompt injection, backdoor activation, and prompt-level adversarial attacks as Prompt Trigger Attacks (PTA) (Lin et al., 18 Feb 2025). UniGuardian uses masked-prompt probing and a suspicion score based on logits discrepancy,

$\rightarrow$4

then standardizes the scores and uses the highest z-score as the prompt’s suspicion score. Its “single-forward strategy” batches the original prompt and masked variants so that detection and generation occur within the same decoding loop (Lin et al., 18 Feb 2025). This suggests a second interpretation of unified defense stack: not only multiple defenses in sequence, but a single runtime mechanism that jointly detects several prompt-side threat classes.

3. Adaptive orchestration in retrieval-augmented generation

In RAG, the central problem is not only attack coverage but attack-specific utility loss. “Adaptive Defense Orchestration for RAG” reports that an always-on defense stack reduces contextual recall by $\rightarrow$5 on Natural Questions, $\rightarrow$6 on PubMedQA, and $\rightarrow$7 on TriviaQA (Pallerla et al., 22 Apr 2026). The paper attributes the main utility cost to retrieval degradation, with DP-RAG producing the largest recall loss among the component defenses.

The proposed Sentinel-Strategist architecture addresses this by separating risk estimation from defense selection. The Sentinel consumes a global trust score $\rightarrow$8, raw query text, recent session history, and explicit metrics including lexical overlap $\rightarrow$9, complexity score $\tau_r = 0.5$0, intent velocity $\tau_r = 0.5$1, vector dispersion $\tau_r = 0.5$2, and score drop-off $\tau_r = 0.5$3. The Strategist maps this state to a defense plan,

$\tau_r = 0.5$4

over four hooks: pre-retrieval, post-retrieval, pre-generation, and post-generation (Pallerla et al., 22 Apr 2026). The available stack includes DP-RAG for membership inference, TrustRAG-style clustering/filtering for poisoning, and attention-variance filtering for leakage-oriented context pruning.

The empirical outcome is attack-specific selectivity. All five controller variants reduce MBA-style membership inference leakage to $\tau_r = 0.5$5 exact mask-fill leakage in the evaluated setting, while stronger controllers reduce poisoning ASR to $\tau_r = 0.5$6–$\tau_r = 0.5$7 and recover contextual recall to $\tau_r = 0.5$8–$\tau_r = 0.5$9, compared with $$\mathbf{h}' = \mathbf{h} + \lambda\tilde{\Delta}\hat{P}\mathbf{h},$$0 for the full static stack (Pallerla et al., 22 Apr 2026). A plausible implication is that a unified defense stack in RAG is best interpreted as a policy-orchestration problem under explicit security–utility constraints rather than as a fixed set of always-on filters.

4. Network, cyber-physical, and perception instantiations

The IPv6 literature provides a data-plane interpretation of unified defense. “Rethinking IPv6 Defense” implements a single programmable edge pipeline with four modules: external spoofing, internal spoofing, external flooding, and internal flooding (Aljoby et al., 9 Feb 2026). External spoofing is filtered by longest-prefix matching into a prefix-to-Hop-Limit band map,

$$\mathbf{h}' = \mathbf{h} + \lambda\tilde{\Delta}\hat{P}\mathbf{h},$$1

while external flooding uses Count-Min Sketch windowed counting with threshold

$$\mathbf{h}' = \mathbf{h} + \lambda\tilde{\Delta}\hat{P}\mathbf{h},$$2

The evaluation spans a 15-scenario suite of single-, dual-, and multi-vector compositions. The BMv2 prototype attains average F1 $$\mathbf{h}' = \mathbf{h} + \lambda\tilde{\Delta}\hat{P}\mathbf{h},$$3, and the same pipeline on a Netronome NFP-4000 SmartNIC reaches average F1 $$\mathbf{h}' = \mathbf{h} + \lambda\tilde{\Delta}\hat{P}\mathbf{h},$$4 with $$\mathbf{h}' = \mathbf{h} + \lambda\tilde{\Delta}\hat{P}\mathbf{h},$$5 precision in every case (Aljoby et al., 9 Feb 2026). Here the unification principle is explicit: source-identity plausibility is enforced before time-window rate plausibility.

Cyber-physical work generalizes the same idea to deception and adaptive control. “Coordinated Multi-Domain Deception” models cyber and physical replicas as a Stackelberg game over 5 cyber nodes and 3 physical nodes, using NVD/CVSS-derived exploit probabilities to prioritize deception placement (Sayed et al., 5 Jan 2026). Under CVSS v2, the Stackelberg strategy yields defender utility $$\mathbf{h}' = \mathbf{h} + \lambda\tilde{\Delta}\hat{P}\mathbf{h},$$6, improving over Uniform Random Strategy $$\mathbf{h}' = \mathbf{h} + \lambda\tilde{\Delta}\hat{P}\mathbf{h},$$7 and Greedy Strategy $$\mathbf{h}' = \mathbf{h} + \lambda\tilde{\Delta}\hat{P}\mathbf{h},$$8; under CVSS v3, the same strategy yields $$\mathbf{h}' = \mathbf{h} + \lambda\tilde{\Delta}\hat{P}\mathbf{h},$$9, improving over $0.983$0 and $0.983$1 (Sayed et al., 5 Jan 2026). In low-altitude ISAC, the same Stackelberg pattern links physical-layer channel attack, communication SINR, sensing rate, and freshness. The defender utilities take the form

$0.983$2

with the legitimate drone adapting RIS gain $0.983$3 and the base station adapting sensing data generation rate $0.983$4 against attacker noise power $0.983$5 (Wang et al., 9 Nov 2025). This suggests that a unified defense stack can also be a cross-layer control loop rather than a simple packet or prompt pipeline.

AV perception provides a sensing-specific variant. “Sequence-Preserving Dual-FoV Defense” defines a three-layer stack comprising feature squeezing, defensive distillation, and entropy-based anomaly detection, followed by sequence-wise temporal voting (Joshi et al., 3 Oct 2025). The pipeline separately squeezes the mid-range and long-range streams,

$0.983$6

then selects the lower-entropy FoV output before weighted temporal voting. The reported result is $0.983$7 mAP, ASR $0.983$8, and high-risk misclassification reduced to $0.983$9 (Joshi et al., 3 Oct 2025). The stack is therefore sequence-preserving, dual-FoV, and explicitly designed for both digital and natural degradation.

5. Runtime, memory, and embedded-system protection

At software-runtime level, unified defense stacks often separate data by trust class and then add integrity or access-control layers. CleanStack places clean parameters, return addresses, old frame pointers, and clean local variables on a Clean Stack, while arrays, structures containing arrays, and address-taken locals are moved to an Unclean Stack and randomized there (Chong, 21 Mar 2025). Its static taint analysis is expressed as

$0.994$0

but the implemented system adopts a heuristic classifier for compatibility. The design combines isolation, randomization, a guard page, and a canary on the unclean stack pointer area, with mean SPEC CPU2017 runtime overhead $0.994$1 and mean memory overhead $0.994$2 (Chong, 21 Mar 2025).

A more control-data-centric stack appears in “A Leak-Resilient Dual Stack Scheme for Backward-Edge Control-Flow Integrity,” which keeps the original stack as the unsafe stack and creates a dedicated return stack containing only return addresses (Zieris et al., 2018). The protected return-stack pointer is held in a dedicated register, the return-stack region is $0.994$3 bytes, and the effective entropy is reported as $0.994$4. The implementation integrates into LLVM with support for x86-64 and ARM64, and reports average overhead $0.994$5 on x86-64 and $0.994$6 on ARM64 (Zieris et al., 2018). The unified element here is the combination of spatial separation, metadata-free randomized placement, compiler rewriting, and runtime support for exceptions, setjmp/longjmp, and multithreading.

Embedded systems use hardware watchpoints as the enforcement layer. WATSON stores return addresses on a compact shadow stack, stores the shadow-stack pointer $0.994$7 in a memory-mapped debug register, and uses data watchpoints to trigger DebugMon on unauthorized writes (Tan et al., 9 May 2026). The system covers both normal calls/returns and exception/interrupt control transfers, and is explicitly compatible with LLVM forward-edge CFI. On the ARM Cortex-M prototype, the overhead is $0.994$8 on BEEBS and $0.994$9 on CoreMark-Pro, with worst-case code-size overhead $n=40$0 (Tan et al., 9 May 2026). PCan occupies a complementary point in the same design space: it replaces static canaries with PA-derived, function- and call-sensitive canaries, using

$n=40$1

with canaries placed after vulnerable buffers and a reported geometric mean runtime overhead of $n=40$2 in the text (Liljestrand et al., 2019). StackVault extends stack protection from control-data integrity to intra-process data-exfiltration defense by combining APIs, a kernel module with unforgeable function identities, and an LLVM compiler extension, with runtime overhead up to $n=40$3 (Zhang et al., 2019).

6. Evaluation regimes, failure modes, and governance

The literature is consistent on one point: stacking mechanisms does not eliminate the need for adaptive evaluation. In LLM safety, prompt-time activation-cone defenses are structurally blind to prefilling unless response-time signals are added (Mitra, 28 Jun 2026). In safeguard pipelines, a system that reaches $n=40$4 ASR on ClearHarm against baseline jailbreaks can still be broken by a staged adaptive attack at $n=40$5 ASR (McKenzie et al., 30 Jun 2025). In RAG, activating all relevant defenses simultaneously can eliminate MBA-style membership inference leakage while collapsing contextual recall by more than $n=40$6 (Pallerla et al., 22 Apr 2026). In systems security, CleanStack, WATSON, and leak-resilient dual stacks all improve robustness but each leaves out distinct classes such as heap corruption, non-control-data attacks, forward-edge hijack, physical attacks, or arbitrary-write attackers with address disclosure (Chong, 21 Mar 2025).

A second recurring issue is that unified defense is not equivalent to universal doctrine. “Measuring the Authority Stack of AI Systems” reports that, in defense settings, Security surges to $n=40$7–$n=40$8 win-rates in 6 of 8 models, and that source trust broadly converges on institutional authority at L2, with government-regulatory ranked first in 7 of 8 models (Lee, 13 Apr 2026). Yet evidence preferences at L3 remain fragmented, and Paired Consistency Scores range from $n=40$9 to $0/40$0, indicating substantial framing sensitivity despite Test-Retest Reliability of $0/40$1 to $0/40$2 (Lee, 13 Apr 2026). This suggests that a unified defense stack has both an engineering dimension and a governance dimension: component ordering, enforcement points, and adaptation policies matter, but so do the value priorities, evidence preferences, and source hierarchies embedded in the models or control logic.

Across domains, the most stable design principle is therefore compositional rather than doctrinal. Unified defense stacks are built by assigning different mechanisms to different failure modes, arranging them in a stage-aware order, and evaluating them against multi-vector and adaptive attacks. Their main controversies concern utility loss, blind spots introduced by local gating criteria, approximate or heuristic state, and the fact that even strong composed systems remain sensitive to attack-specific distribution shift and to framing-dependent decision instability.