OptiLeak-Guard: Vision-Driven Detection and Adaptive Suppression of LED-Based Optical Covert Channels in Air-Gapped Edge Systems

Abstract

Air-gapped edge systems retain visible status indicators that can be manipulated into optical covert channels and observed by cameras or optical sensors. Existing work establishes the feasibility of LED-mediated exfiltration, yet it largely treats the light trace as a communication signal and leaves a practical defensive question unresolved: how can a defender distinguish ordinary device activity from information-bearing modulation and suppress leakage without modifying the protected endpoint? This paper presents OptiLeak-Guard, a vision-driven defense that combines a Temporal Vision Transformer branch with a physical LED-dynamics branch, gated evidence fusion, three-window decision persistence, and an external Temporal Optical Shield response. The evaluation follows the publicly released QR-Code Optical Covert Channel Benchmark and extends it with a physics-constrained LED scenario that represents native device activity and covert modulation through temporal, spectral, photometric, rise–decay, run-length, chromatic, distance, compression, and signal-to-noise characteristics. The evaluation corpus contains 3,360 analytical video windows balanced between native operational activity and covert modulation patterns. Under the defined configuration, OptiLeak-Guard attains 97.42% accuracy, 97.58% precision, 97.31% recall, 97.44% F1-score, 0.992 AUC, 0.91% false-positive rate, and 18.6 ms decision latency. Removing the physical branch reduces accuracy by 2.06 percentage points, whereas removing temporal evidence reduces it by 2.60 percentage points. The contribution is a defensive framework that couples temporal visual evidence with physically constrained LED-emission characteristics and activates bounded optical interference only after persistent high-confidence alerts.