---
title: 'Unified Defense Stack: Coordinated Security'
url: https://www.emergentmind.com/topics/unified-defense-stack
type: topic
---

# Unified Defense Stack: Coordinated Security

Unified Defense Stack denotes a composed defense architecture in which multiple protective mechanisms are arranged as one coordinated pipeline rather than deployed as isolated point countermeasures. In current literature, the term is used most explicitly for inference-time large-language-model safety, where prompt-time steering is composed with response-time probing and halting [2606.29441], for retrieval-augmented generation, where a Sentinel and a Strategist selectively activate defenses across pre-retrieval, post-retrieval, pre-generation, and post-generation hooks [2604.20932], and for programmable IPv6 security, where a single data-plane pipeline unifies external spoofing, internal spoofing, external flooding, and internal flooding [2602.08891]. Related systems work applies the same compositional idea to software runtime protection, embedded control-flow integrity, cyber-physical deception, and autonomous-vehicle perception, typically by combining isolation, integrity enforcement, anomaly filtering, and adaptive control rather than relying on any single mechanism [2503.16950].

## 1. Architectural pattern and domain scope

A unified defense stack is characterized by stage-specific enforcement, shared state across those stages, and an explicit ordering of controls. In the RAG setting, the architecture is split into a **Control Plane** and a **Data Plane**, with the Control Plane containing the Sentinel, the Strategist, and a persistence layer with user trust state, and the Data Plane exposing four interception hooks [2604.20932]. In the IPv6 setting, the architecture is a single programmable data-plane pipeline whose ordering is “identity plausibility before rate plausibility” [2602.08891]. In inference-time LLM safety, the architecture is an “orthogonal split” in which response-time halt catches prefilling and AlphaSteer catches semantic attacks [2606.29441]. In stack-memory defense, CleanStack formalizes a dual-stack system with isolation and randomization under the name **Tainted Stack Object Separation (TSOS)** [2503.16950].

| Domain | Stack form | Representative source |
|---|---|---|
| LLM inference-time safety | Prompt-time steering + response-time probe/halt | [2606.29441] |
| RAG | Sentinel-Strategist over four hooks | [2604.20932] |
| Prompt-side LLM detection | Masked-prompt probing + single-forward strategy | [2502.13141] |
| Safeguard pipelines | Input classifier \(\rightarrow\) model \(\rightarrow\) output classifier | [2506.24068] |
| IPv6 edge security | External/internal spoofing + external/internal flooding | [2602.08891] |
| Runtime and memory protection | Dual stack, tainted-object separation, watchpoint-protected shadow stack | [2503.16950] |

This pattern suggests that “unified” does not mean monolithic. Rather, it denotes systems in which multiple defenses are coordinated at distinct points of a computation or communication path, with each layer consuming information produced by earlier layers.

## 2. Inference-time language-model stacks

The clearest formalization of a Unified Defense Stack in LLM safety appears in “Closing the Activation-Cone Blind Spot: Response-Time Probing and Unified Defense,” which argues that no single prompt-time intervention robustly covers the major jailbreak families [2606.29441]. The paper compares five defense paradigms across seven instruction-tuned models and five attack families, then proves a corollary: any defense that decides whether to intervene by measuring the current activation’s alignment with a benign reference, a cone, subspace, or null-space projection, at any single layer is structurally blind to attacks that craft activations to lie inside that reference. Its constructive answer is response-time probing, implemented as a linear probe on the model’s hidden state at the first generated tokens, with inference-time halt at threshold \(\tau_r = 0.5\). The unified stack composes this response-halt with AlphaSteer’s null-space steering,
\[
\mathbf{h}' = \mathbf{h} + \lambda\tilde{\Delta}\hat{P}\mathbf{h},
\]
yielding defense success \(0.983\) on Mistral and \(0.994\) on Llama at \(n=40\), while the response-time halt reduces canonical prefilling ASR to \(0/40\) on all seven models with \(0\%\) benign false positives [2606.29441].

A different but related formulation appears in “STACK: Adversarial Attacks on LLM Safeguard Pipelines,” where the defended system is explicitly wrapped by an input classifier and an output classifier:
\[
p_{f_q,f_r}(m)(q) = m(q) \quad \text{when } (f_q(q) < t_q) \wedge (f_r(m(q)) < t_r),
\]
and returns the empty string otherwise [2506.24068]. The strongest evaluated open pipeline, a Gemma 2 few-shot-prompted input/output filter pair, reduces ASR to \(0\%\) on ClearHarm against PAP, ReNeLLM, and Best-of-\(N\). Yet a STaged AttaCK procedure that separately jailbreaks the input filter, the model, and the output filter reaches \(71\%\) ASR in a black-box attack and \(33\%\) ASR in transfer [2506.24068]. The factual lesson is that stacked safeguards can be highly effective against standard baselines while remaining vulnerable to stage-aware adaptive attacks.

Prompt-side unification is developed in “UniGuardian,” which reframes prompt injection, backdoor activation, and prompt-level adversarial attacks as **Prompt Trigger Attacks (PTA)** [2502.13141]. UniGuardian uses masked-prompt probing and a suspicion score based on logits discrepancy,
\[
S_i = \frac{1}{k}\sum_{j=1}^{k}\left(\sigma(L_{i,j}) - \sigma(L_{b,j})\right)^2,
\]
then standardizes the scores and uses the highest z-score as the prompt’s suspicion score. Its “single-forward strategy” batches the original prompt and masked variants so that detection and generation occur within the same decoding loop [2502.13141]. This suggests a second interpretation of unified defense stack: not only multiple defenses in sequence, but a single runtime mechanism that jointly detects several prompt-side threat classes.

## 3. Adaptive orchestration in retrieval-augmented generation

In RAG, the central problem is not only attack coverage but attack-specific utility loss. “Adaptive Defense Orchestration for RAG” reports that an always-on defense stack reduces contextual recall by \(41.0\%\) on Natural Questions, \(46.4\%\) on PubMedQA, and \(41.6\%\) on TriviaQA [2604.20932]. The paper attributes the main utility cost to retrieval degradation, with DP-RAG producing the largest recall loss among the component defenses.

The proposed Sentinel-Strategist architecture addresses this by separating risk estimation from defense selection. The Sentinel consumes a global trust score \(S_{\text{trust}}\), raw query text, recent session history, and explicit metrics including lexical overlap \(M_{\text{LEX}}\), complexity score \(M_{\text{CMP}}\), intent velocity \(M_{\text{INT}}\), vector dispersion \(M_{\text{DIS}}\), and score drop-off \(M_{\text{DRP}}\). The Strategist maps this state to a defense plan,
\[
\pi_{\text{ado}} : \big(q, S_{\text{trust}}, \text{history}, M_{\text{LEX}}, M_{\text{CMP}}, M_{\text{INT}}, M_{\text{DIS}}, M_{\text{DRP}}\big) \mapsto \mathcal{P},
\]
over four hooks: pre-retrieval, post-retrieval, pre-generation, and post-generation [2604.20932]. The available stack includes DP-RAG for membership inference, TrustRAG-style clustering/filtering for poisoning, and attention-variance filtering for leakage-oriented context pruning.

The empirical outcome is attack-specific selectivity. All five controller variants reduce MBA-style membership inference leakage to \(0.0\%\) exact mask-fill leakage in the evaluated setting, while stronger controllers reduce poisoning ASR to \(0.0\%\)–\(4.0\%\) and recover contextual recall to \(0.470\)–\(0.497\), compared with \(0.336\) for the full static stack [2604.20932]. A plausible implication is that a unified defense stack in RAG is best interpreted as a policy-orchestration problem under explicit security–utility constraints rather than as a fixed set of always-on filters.

## 4. Network, cyber-physical, and perception instantiations

The IPv6 literature provides a data-plane interpretation of unified defense. “Rethinking IPv6 Defense” implements a single programmable edge pipeline with four modules: external spoofing, internal spoofing, external flooding, and internal flooding [2602.08891]. External spoofing is filtered by longest-prefix matching into a prefix-to-Hop-Limit band map,
\[
\mathcal{T} : \pi \rightarrow [HL_{\min}(\pi), HL_{\max}(\pi)],
\]
while external flooding uses Count-Min Sketch windowed counting with threshold
\[
\theta = (r/n)\cdot T_w \cdot (1+\epsilon).
\]
The evaluation spans a 15-scenario suite of single-, dual-, and multi-vector compositions. The BMv2 prototype attains average F1 \(94.26\%\), and the same pipeline on a Netronome NFP-4000 SmartNIC reaches average F1 \(99.60\%\) with \(100\%\) precision in every case [2602.08891]. Here the unification principle is explicit: source-identity plausibility is enforced before time-window rate plausibility.

Cyber-physical work generalizes the same idea to deception and adaptive control. “Coordinated Multi-Domain Deception” models cyber and physical replicas as a Stackelberg game over 5 cyber nodes and 3 physical nodes, using NVD/CVSS-derived exploit probabilities to prioritize deception placement [2601.02596]. Under CVSS v2, the Stackelberg strategy yields defender utility \(-52.1\), improving over Uniform Random Strategy \(-60.25\) and Greedy Strategy \(-58.0\); under CVSS v3, the same strategy yields \(-48.94\), improving over \(-87.0\) and \(-102.0\) [2601.02596]. In low-altitude ISAC, the same Stackelberg pattern links physical-layer channel attack, communication SINR, sensing rate, and freshness. The defender utilities take the form
\[
-\zeta_1 AAoI + \zeta_2 \mathrm{ASINR},
\]
with the legitimate drone adapting RIS gain \(g\) and the base station adapting sensing data generation rate \(\lambda\) against attacker noise power \(\sigma_{\rm att}^2\) [2511.06359]. This suggests that a unified defense stack can also be a cross-layer control loop rather than a simple packet or prompt pipeline.

AV perception provides a sensing-specific variant. “Sequence-Preserving Dual-FoV Defense” defines a three-layer stack comprising feature squeezing, defensive distillation, and entropy-based anomaly detection, followed by sequence-wise temporal voting [2510.02642]. The pipeline separately squeezes the mid-range and long-range streams,
\[
\hat F_m^t \gets \text{QuantizeBits}(F_m^t,\text{depth}=5), \qquad
\hat F_l^t \gets \text{MedianFilter}(F_l^t,\text{kernel}=3),
\]
then selects the lower-entropy FoV output before weighted temporal voting. The reported result is \(79.8\) mAP, ASR \(18.2\%\), and high-risk misclassification reduced to \(32\%\) [2510.02642]. The stack is therefore sequence-preserving, dual-FoV, and explicitly designed for both digital and natural degradation.

## 5. Runtime, memory, and embedded-system protection

At software-runtime level, unified defense stacks often separate data by trust class and then add integrity or access-control layers. CleanStack places clean parameters, return addresses, old frame pointers, and clean local variables on a **Clean Stack**, while arrays, structures containing arrays, and address-taken locals are moved to an **Unclean Stack** and randomized there [2503.16950]. Its static taint analysis is expressed as
\[
f(n) = \text{gen}[n] \cup (\text{in}[n] - \text{kill}[n]),
\]
but the implemented system adopts a heuristic classifier for compatibility. The design combines isolation, randomization, a guard page, and a canary on the unclean stack pointer area, with mean SPEC CPU2017 runtime overhead \(1.73\%\) and mean memory overhead \(0.04\%\) [2503.16950].

A more control-data-centric stack appears in “A Leak-Resilient Dual Stack Scheme for Backward-Edge Control-Flow Integrity,” which keeps the original stack as the unsafe stack and creates a dedicated return stack containing only return addresses [1806.09496]. The protected return-stack pointer is held in a dedicated register, the return-stack region is \(2^{44}\) bytes, and the effective entropy is reported as \(2^{29}\). The implementation integrates into LLVM with support for x86-64 and ARM64, and reports average overhead \(2.7\%\) on x86-64 and \(0.0\%\) on ARM64 [1806.09496]. The unified element here is the combination of spatial separation, metadata-free randomized placement, compiler rewriting, and runtime support for exceptions, `setjmp`/`longjmp`, and multithreading.

Embedded systems use hardware watchpoints as the enforcement layer. WATSON stores return addresses on a compact shadow stack, stores the shadow-stack pointer \(ssp\) in a memory-mapped debug register, and uses data watchpoints to trigger DebugMon on unauthorized writes [2605.08604]. The system covers both normal calls/returns and exception/interrupt control transfers, and is explicitly compatible with LLVM forward-edge CFI. On the ARM Cortex-M prototype, the overhead is \(7.33\%\) on BEEBS and \(1.81\%\) on CoreMark-Pro, with worst-case code-size overhead \(2.11\%\) [2605.08604]. PCan occupies a complementary point in the same design space: it replaces static canaries with PA-derived, function- and call-sensitive canaries, using
\[
M = SP \cdot 2^{16} + \text{function-id},
\]
with canaries placed after vulnerable buffers and a reported geometric mean runtime overhead of \(0.30\%\) in the text [1909.05747]. StackVault extends stack protection from control-data integrity to intra-process data-exfiltration defense by combining APIs, a kernel module with unforgeable function identities, and an LLVM compiler extension, with runtime overhead up to \(2.4\%\) [1907.03710].

## 6. Evaluation regimes, failure modes, and governance

The literature is consistent on one point: stacking mechanisms does not eliminate the need for adaptive evaluation. In LLM safety, prompt-time activation-cone defenses are structurally blind to prefilling unless response-time signals are added [2606.29441]. In safeguard pipelines, a system that reaches \(0\%\) ASR on ClearHarm against baseline jailbreaks can still be broken by a staged adaptive attack at \(71\%\) ASR [2506.24068]. In RAG, activating all relevant defenses simultaneously can eliminate MBA-style membership inference leakage while collapsing contextual recall by more than \(40\%\) [2604.20932]. In systems security, CleanStack, WATSON, and leak-resilient dual stacks all improve robustness but each leaves out distinct classes such as heap corruption, non-control-data attacks, forward-edge hijack, physical attacks, or arbitrary-write attackers with address disclosure [2503.16950].

A second recurring issue is that unified defense is not equivalent to universal doctrine. “Measuring the Authority Stack of AI Systems” reports that, in defense settings, Security surges to \(95.1\%\)–\(99.8\%\) win-rates in 6 of 8 models, and that source trust broadly converges on institutional authority at L2, with government-regulatory ranked first in 7 of 8 models [2604.11216]. Yet evidence preferences at L3 remain fragmented, and Paired Consistency Scores range from \(57.4\%\) to \(69.2\%\), indicating substantial framing sensitivity despite Test-Retest Reliability of \(91.7\%\) to \(98.6\%\) [2604.11216]. This suggests that a unified defense stack has both an engineering dimension and a governance dimension: component ordering, enforcement points, and adaptation policies matter, but so do the value priorities, evidence preferences, and source hierarchies embedded in the models or control logic.

Across domains, the most stable design principle is therefore compositional rather than doctrinal. Unified defense stacks are built by assigning different mechanisms to different failure modes, arranging them in a stage-aware order, and evaluating them against multi-vector and adaptive attacks. Their main controversies concern utility loss, blind spots introduced by local gating criteria, approximate or heuristic state, and the fact that even strong composed systems remain sensitive to attack-specific distribution shift and to framing-dependent decision instability.

Source: https://www.emergentmind.com/topics/unified-defense-stack