PaperlayerView exact revision on arXiv

Source-linked AI summary

Hiding Directions, Leaking Structure: Breaking ArrowCloak through Low-Rank Structure

Beijie Liu, Junyi Ouyang, Haoxuan Xu, Vincent Quentin Ulitzsch, Potung Yu, Yajie Zhao, Mengyuan Li

arXiv:2608.21615v1cs.CR

TL;DR

Lightweight TEE-shielded weight protection can hide individual vector directions while leaving recoverable structure across released weights, and its LWE formulation does not establish standard LWE hardness. The paper audits these weaknesses and presents ArrowRevelio, which removes the shared masking subspace, recovers vector correspondence, and reconstructs weights from public checkpoints and obfuscated weights without secrets or queries. Across six model–task pairs, it recovers 99.92–100% of hidden permutations and closely reproduces victim functionality.

  • Problem

    ArrowCloak’s direction-hiding transformation and LWE-based security argument require evaluation because shared masking may leave structural leakage and the reformulation may not transfer standard LWE hardness.

    Source: §I · p. 2

  • Method

    ArrowRevelio uses public checkpoints and exposed obfuscated weights to estimate and remove the shared masking subspace, solve a global one-to-one assignment, and reconstruct victim weights.

    Source: §I · p. 2

  • Results

    99.92–100% hidden-permutation recovery was achieved across six model–task pairs, with classification agreement of 94.39–99.54% and segmentation output agreement of 98.35%.

    Source: §I · p. 2, §IX · p. 14

  • Takeaways & Limitations

    Weight protection must address both per-vector geometric leakage and joint matrix-level structure across released weights.

    Source: §I · p. 2

Abstract

from arXiv · show

TEE-shielded inference keeps sensitive state in a trusted execution environment (TEE) while offloading linear algebra to an untrusted accelerator. Wang et al., in Game of Arrows (USENIX Security 2025), showed that five widely adopted lightweight defenses preserve vector directions and introduced ArrowMatch to exploit this leakage. They then proposed ArrowCloak, which adds a different multiple of one shared mask direction to each vector and bases its weight-recovery hardness argument on Learning with Errors (LWE). ArrowCloak successfully reduces ArrowMatch to near-black-box levels. In this paper, we revisit ArrowCloak from cryptographic and structural perspectives. Its LWE formulation does not by itself establish standard LWE hardness: the reduction direction, quantized arithmetic, and joint instance distribution do not meet the required conditions. Reusing one mask direction leaves a recoverable rank-one component across the released matrix. We exploit this structure with our proposed attack, an end-to-end, query-free recovery attack. Given a public checkpoint and the obfuscated weights, the attack removes the masking subspace, recovers the hidden one-to-one correspondence, and reconstructs protected weights without transformation secrets, victim queries, or fine-tuning data. Across six model-task pairs spanning classification, segmentation, and diffusion, the attack recovers 99.92%-100% of hidden vector correspondences. Reconstructed classification models achieve 94.39%-99.54% victim agreement and differ by at most 1.59 percentage points in accuracy; the recovered segmentation model achieves 98.35% output agreement. These findings suggest that lightweight protection should address both per-vector geometry and joint structure across released weights.

I. INTRODUCTION

TEE-shielded inference protects model state in a TEE while outsourcing linear algebra, but lightweight weight obfuscation can leak information through individual vectors and shared matrix structure. This paper audits ArrowCloak’s LWE rationale, introduces ArrowRevelio, and finds near-complete permutation recovery and strong functional recovery across diverse workloads.

Deployment setting

  • TEE-shielded inference keeps sensitive state in a CPU TEE while outsourcing linear algebra to an untrusted accelerator because CPU TEEs lack GPU-class throughput.Lightweight per-vector transformations reduce trusted-side work in weight-obfuscation-based deployments.Source: §I · p. 1

Prior leakage

  • ArrowMatch exploits lightweight transformations that preserve vector directions despite changing magnitudes and positions, enabling matching against public checkpoints.ArrowCloak targets this invariant by rotating vectors with a shared mask before permutation.Source: §I · p. 1, B. From ArrowMatch to ArrowCloak · p. 3, Figure 1 · p. 3

Cryptographic audit

  • ArrowCloak’s LWE-shaped reformulation does not establish standard LWE hardness because its reduction direction, quantized arithmetic, and joint distribution fail required conditions.These gaps invalidate the stated hardness argument without by themselves proving an efficient break.Source: §I · p. 2, B. From ArrowMatch to ArrowCloak · p. 4

ArrowRevelio

  • ArrowRevelio estimates and removes the shared masking subspace, recovers the hidden one-to-one assignment, and reconstructs victim weights using public information and exposed obfuscated weights.The attack requires no transformation secrets, victim queries, plaintext victim weights, or fine-tuning data.Source: §I · p. 2

Evaluation

  • 99.92–100% permutation recovery was achieved across six model–task pairs, while classification agreement reached 94.39–99.54% and segmentation agreement reached 98.35%.Classification task accuracy differed by at most 1.59 percentage points.Source: §I · p. 2

Mitigation

  • Higher-rank masking weakened functional recovery but left permutation recovery at 100% through r = 256 and 99.98% at r = 512, while increasing trusted-side cost.On BERT-base/SST-2, victim agreement fell from 95.53% to 48.05%.Source: §I · p. 2

III. REASSESSING THE LWE-BASED SECURITY CLAIM

The paper argues that ArrowCloak’s LWE-based security claim does not establish recovery hardness because its reduction, arithmetic, and induced distributions fail standard requirements.

Reduction requirements

  • Standard LWE hardness transfer requires reducing LWE to ArrowCloak recovery so that an ArrowCloak solver would solve the original LWE challenge.The paper uses this direction as the criterion for a valid direct recovery reduction.Source: A. LWE and the Required Security… · p. 4

Reduction in the wrong direction

  • ArrowCloak instead rewrites its own weight-transformation relation in LWE-like notation without showing a hardness-preserving reduction.This omission alone prevents the claimed hardness transfer.Source: B. Auditing ArrowCloak’s LWE Mapping · p. 4

Quantized arithmetic

  • The proposed quantization introduces an extra factor of ∆, so B = A^⊤S + E (mod q) does not follow from the original real-valued identity.A valid fixed-point encoding would need rescaling and accounting for quantization and multiplication errors.Source: B. Auditing ArrowCloak’s LWE Mapping · p. 4

Mismatch with LWE distributions

  • The induced secret, matrix, and error terms do not satisfy standard LWE’s required joint distribution, even though the residual error’s marginal distribution was empirically examined.In particular, the secret depends on H and Π, while standard LWE requires specified distributions and independence conditions.Source: B. Auditing ArrowCloak’s LWE Mapping · pp. 4–5

Conclusion

  • Together, the incorrect reduction direction, quantized-arithmetic mismatch, and distributional mismatch prevent the LWE argument from establishing recovery hardness.The paper distinguishes invalidating the hardness argument from proving that ArrowCloak is efficiently breakable.Source: B. Auditing ArrowCloak’s LWE Mapping · pp. 4–5

IV. ArrowRevelio: A STRUCTURAL RECOVERY ATTACK

ArrowRevelio exploits the shared mask direction that ArrowCloak leaves across protected columns. It estimates and removes this low-rank structure, then uses public weights to recover the hidden correspondence and victim weights.

Structural leakage

  • ArrowCloak’s additive masks reuse one direction across columns, leaving an observable rank-one structure despite hiding individual vector directions.The hidden permutation reorders columns but does not conceal the shared direction.Source: §IV · p. 5, A. Threat Model and Attack Overview · p. 5

Threat model

  • ArrowRevelio requires the public pretrained checkpoint, architecture metadata, and exposed obfuscated weights, but no victim weights, secrets, queries, or fine-tuning data.The threat model assumes an honest-but-curious host and untrusted GPU with access to the exact public checkpoint.Source: A. Threat Model and Attack Overview · p. 5

Attack workflow

Rank-one mask

  • The shared mask component has rank one because every mask column is a scalar multiple of the same vector.This rank-one signal is the matrix-level structure that the attack isolates spectrally.Source: B. Estimating the Shared Direction · p. 6

Shared-direction estimation

  • When the mask perturbation is small relative to the mask signal, the leading left singular vector of centered exposed weights approaches the shared direction up to sign.The sign is immaterial because the attack uses only the direction’s span.Source: B. Estimating the Shared Direction · pp. 5–6

C. Recovering the Hidden Permutation

After removing the estimated mask direction, ArrowRevelio recovers the hidden permutation by globally matching projected public and exposed columns under cosine similarity.

Ideal mask removal

Projected alignment

  • When projected fine-tuning residuals are small, correctly paired public and exposed columns remain nearly positively aligned.This motivates cosine-similarity matching after projection.Source: C. Recovering the Hidden Permutation · p. 7

Global assignment

  • Because the hidden permutation is bijective, every public column must be assigned to exactly one exposed column and every exposed column used once.The attack therefore formulates matching as a one-to-one assignment problem.Source: C. Recovering the Hidden Permutation · p. 7
  • The Hungarian algorithm solves the assignment globally by minimizing the negated projected cosine-similarity matrix.This enforces a valid permutation rather than independent column choices.Source: C. Recovering the Hidden Permutation · p. 7

Recovery condition

  • Exact permutation recovery requires nonzero projected-column norms and sufficient margin for the correct cosine matches when using the estimated projector.Using an estimated rather than true direction adds projector-error perturbation.Source: C. Recovering the Hidden Permutation · p. 7

D. Reconstructing the Victim Weights

After matching columns, ArrowRevelio fits scale and mask coefficients to invert the transformation; the same logic extends to rank-r mask subspaces with accurate rank estimation.

Coefficient estimation

  • ArrowRevelio estimates each matched column’s scale and effective mask coefficient by constrained least squares.The scale is restricted to ArrowCloak’s prescribed interval, while the mask coefficient remains unconstrained.Source: D. Reconstructing the Victim Weights · p. 7

Weight reconstruction

  • The reconstructed victim column uses the original exposed column, retaining the fine-tuning residual after subtracting the fitted mask term.Remaining error reflects permutation, scale-estimation, and residual-mask errors.Source: D. Reconstructing the Victim Weights · p. 7

Rank-r extension

  • For rank-r masking, the additive mask has rank at most r and factors as BC^⊤, with B spanning the shared mask subspace.Permutation changes column order but not the shared subspace.Source: E. Rank-r Extension · p. 7

Automatic rank inference

  • Automatic rank inference examines adjacent singular-value ratios and accepts an estimated rank only when the dominant spectral break is sufficiently large and separated.The thresholds τ_gap and τ_sep control break magnitude and separation from competing breaks.Source: E. Rank-r Extension · p. 7

Rank-r extension

  • Rank-r recovery replaces the scalar mask term with a subspace coefficient and otherwise preserves the matching and reconstruction logic.Successful recovery additionally requires accurate rank and mask-subspace estimates.Source: E. Rank-r Extension · p. 8

F. Computational Complexity

The attack’s dominant costs are dense SVD, projected cosine-similarity construction, and one-to-one assignment, yielding overall time dominated by these terms and space O(dn + n^2).

B. Recovery of the Mask Direction

The attack estimates the shared mask direction as the leading left singular vector of the centered exposed matrix. Under spectral separation, its angular error is O(n^-1/4), so wider protected matrices permit tighter recovery bounds.

C. Recovery of the Mask-Removal Projector

The recovered mask direction defines an orthogonal-complement projector that removes the shared mask before column matching and weight reconstruction. Exact permutation recovery additionally requires separated, nonzero projected columns.

A. Experimental Setup

The evaluation spans six model–task configurations and measures structural, functional, and diffusion output recovery. Experiments also test the spectral mechanism underlying shared-mask recovery and whether ArrowCloak’s error-distribution conditions prevent it.

Experimental scope

Structural recovery

  • 99.92%-100% hidden-permutation recovery is achieved across all six protected configurations.Mean true-match rank ranges from 1.00 to 1.31.Source: B. RQ1: End-to-End Recovery · p. 10

Functional recovery

  • Classification accuracy differs from the victim by at most 1.59 percentage points, with 94.39%-99.54% prediction agreement.The recovered segmentation model achieves 98.35% output agreement; diffusion is evaluated using PSNR and SSIM on matched prompts and seeds.Source: B. RQ1: End-to-End Recovery · pp. 10–11
  • The recovered Emoji diffusion model preserves the main subject while differing in fine-grained details such as accessories, backgrounds, and contours.The comparison uses matched prompts and random seeds, and residual errors can compound across denoising steps.Source: B. RQ1: End-to-End Recovery · p. 11, Figure 3 · p. 11

Recovery mechanism

  • The shared-mask component is spectrally separated, with residual-to-mask ratio below 6 × 10−4 and mask-direction deviation at most 0.032°.Estimated and oracle mask-removal projectors differ by at most 5.6 × 10−4.Source: C. RQ2: Recovery Mechanism · p. 11

Error-distribution premise

  • ArrowCloak’s error-distribution conditions are not consistently satisfied by real victims and do not prevent recovery when satisfied.Synthetic Gaussian residuals still yield 99.914% permutation recovery, while BERT reaches 100% permutation recovery under both quantized conditions.Source: D. RQ3: Error-Distribution Security… · p. 12

E. Attack Cost

ArrowRevelio remains computationally practical and exposes a security–efficiency tradeoff in higher-rank masking. Increasing rank weakens functional reconstruction, but structural recovery persists and trusted computation rises substantially.

Attack cost

  • The complete attack takes 11.531 seconds at r = 1 and 17.170 seconds at r = 32 on BERT-base with SST-2.Intermediate mask-rank settings fall within this runtime range.Source: E. Attack Cost · p. 12

Security tradeoff

Higher-rank masking

TEE overhead

  • At r = 512, TEE correction requires approximately as much arithmetic as executing all protected matrix multiplications inside the TEE.This comparison uses theoretical operation counts rather than measured latency.Source: B. The Security–Efficiency Tradeoff of… · p. 13

Attack requirements

  • The attack reconstructs victim functionality using public pre-trained and exposed obfuscated weights without victim queries or transformation secrets.Its pipeline removes the shared subspace, solves a global assignment, and fits remaining coefficients.Source: §IX · pp. 13–14

APPENDIX A MATCHING STABILITY AND PERMUTATION RECOVERY

The appendix formalizes when projected matching preserves the hidden correspondence. Exact recovery requires an accurate estimated mask projector and sufficient norm and separation among ideally projected columns.

Matching stability

  • A positive ρ excludes columns lying almost entirely in the mask direction.ρ measures the smallest fraction of column norm retained after ideal mask removal.Source: Appendix A · p. 15
  • Normalized projection stability assumes ρ > 0 and η < ρ.These assumptions ensure the normalized projected vectors are well defined.Source: Appendix A · p. 15

Permutation recovery

  • Theorem 1 guarantees unique permutation recovery when µ_i > 2ϵ_i for every i.Under this condition, the linear assignment uniquely recovers the hidden permutation.Source: Appendix A · p. 15
  • The Hungarian algorithm returns the hidden permutation because the correct exposed column is the unique highest-scoring match in every row.The bijection constraint makes the permutation selecting all row-wise maxima unique.Source: Appendix A · p. 15

Matching stability

  • The sufficient condition separates projector accuracy from the norm and pairwise separation retained by ideal projected columns.Both requirements must hold for exact matching.Source: Appendix A · p. 15

APPENDIX B FINITE-WIDTH CHECKS FOR SPECTRAL DOMINANCE

Finite-width measurements support the spectral-dominance premises and show robust rank inference and reference selection under attacker uncertainty. However, the experiments do not establish the corresponding asymptotic conditions, and the correct public backbone remains necessary.

Spectral premises

  • The analysis treats non-cancellation and bounded average squared column energy as sufficient conditions for spectral dominance.These premises explain realized recovery measurements rather than serving as attack-success metrics themselves.Source: Appendix B · pp. 15–16

Finite-width checks

  • The minimum observed shared-direction energy ratio is 0.56 and the minimum cancellation ratio is 0.33 across protected matrices.These measurements provide no evidence of severe cancellation.Source: Appendix B · p. 16
  • The observed within-backbone correlations between average squared column norm and width are −0.27, −0.13, and −0.25 for ViT, BERT, and GPT-2.The measurements show no increase with width in these finite models.Source: Appendix B · p. 16

Scope boundary

Rank inference

  • Using inferred ranks, the complete attack achieves 100% permutation accuracy for every end-to-end setting from r = 2 to r = 64.Recovered accuracy ranges from 90.37% to 92.20%.Source: A. RQ5: Robustness to Attacker… · p. 16

Reference selection

  • The exact GPT-2 initialization scores 0.80472 and enables perfect permutation recovery, whereas an independently pretrained checkpoint scores 0.00921 and yields 0.09% permutation accuracy.The incompatible checkpoint also reduces recovered accuracy to 51.83%.Source: A. RQ5: Robustness to Attacker… · pp. 16–17

Related papers

Loading 2608.21615v1…