PaperlayerView exact revision on arXiv

Source-linked AI summary

Hiding Directions, Leaking Structure: Breaking ArrowCloak through Low-Rank Structure

Beijie Liu, Junyi Ouyang, Haoxuan Xu, Vincent Quentin Ulitzsch, Potung Yu, Yajie Zhao, Mengyuan Li

arXiv:2608.21615v1cs.CR

TL;DR

Lightweight TEE-shielded weight protection can hide individual vector directions while leaving recoverable structure across released weights, and its LWE formulation does not establish standard LWE hardness. The paper audits these weaknesses and presents ArrowRevelio, which removes the shared masking subspace, recovers vector correspondence, and reconstructs weights from public checkpoints and obfuscated weights without secrets or queries. Across six model–task pairs, it recovers 99.92–100% of hidden permutations and closely reproduces victim functionality.

  • Problem

    ArrowCloak’s direction-hiding transformation and LWE-based security argument require evaluation because shared masking may leave structural leakage and the reformulation may not transfer standard LWE hardness.

  • Method

    ArrowRevelio uses public checkpoints and exposed obfuscated weights to estimate and remove the shared masking subspace, solve a global one-to-one assignment, and reconstruct victim weights.

  • Results

    99.92–100% hidden-permutation recovery was achieved across six model–task pairs, with classification agreement of 94.39–99.54% and segmentation output agreement of 98.35%.

  • Takeaways & Limitations

    Weight protection must address both per-vector geometric leakage and joint matrix-level structure across released weights.

Abstract

from arXiv · show

TEE-shielded inference keeps sensitive state in a trusted execution environment (TEE) while offloading linear algebra to an untrusted accelerator. Wang et al., in Game of Arrows (USENIX Security 2025), showed that five widely adopted lightweight defenses preserve vector directions and introduced ArrowMatch to exploit this leakage. They then proposed ArrowCloak, which adds a different multiple of one shared mask direction to each vector and bases its weight-recovery hardness argument on Learning with Errors (LWE). ArrowCloak successfully reduces ArrowMatch to near-black-box levels. In this paper, we revisit ArrowCloak from cryptographic and structural perspectives. Its LWE formulation does not by itself establish standard LWE hardness: the reduction direction, quantized arithmetic, and joint instance distribution do not meet the required conditions. Reusing one mask direction leaves a recoverable rank-one component across the released matrix. We exploit this structure with our proposed attack, an end-to-end, query-free recovery attack. Given a public checkpoint and the obfuscated weights, the attack removes the masking subspace, recovers the hidden one-to-one correspondence, and reconstructs protected weights without transformation secrets, victim queries, or fine-tuning data. Across six model-task pairs spanning classification, segmentation, and diffusion, the attack recovers 99.92%-100% of hidden vector correspondences. Reconstructed classification models achieve 94.39%-99.54% victim agreement and differ by at most 1.59 percentage points in accuracy; the recovered segmentation model achieves 98.35% output agreement. These findings suggest that lightweight protection should address both per-vector geometry and joint structure across released weights.

I. INTRODUCTION

TEE-shielded inference protects model state in a TEE while outsourcing linear algebra, but lightweight weight obfuscation can leak information through individual vectors and shared matrix structure. This paper audits ArrowCloak’s LWE rationale, introduces ArrowRevelio, and finds near-complete permutation recovery and strong functional recovery across diverse workloads.

  • Deployment setting: TEE-shielded inference keeps sensitive state in a CPU TEE while outsourcing linear algebra to an untrusted accelerator because CPU TEEs lack GPU-class throughput.Lightweight per-vector transformations reduce trusted-side work in weight-obfuscation-based deployments.
  • Prior leakage: ArrowMatch exploits lightweight transformations that preserve vector directions despite changing magnitudes and positions, enabling matching against public checkpoints.ArrowCloak targets this invariant by rotating vectors with a shared mask before permutation.
  • Cryptographic audit: ArrowCloak’s LWE-shaped reformulation does not establish standard LWE hardness because its reduction direction, quantized arithmetic, and joint distribution fail required conditions.These gaps invalidate the stated hardness argument without by themselves proving an efficient break.
  • ArrowRevelio: ArrowRevelio estimates and removes the shared masking subspace, recovers the hidden one-to-one assignment, and reconstructs victim weights using public information and exposed obfuscated weights.The attack requires no transformation secrets, victim queries, plaintext victim weights, or fine-tuning data.
  • Evaluation: 99.92–100% permutation recovery was achieved across six model–task pairs, while classification agreement reached 94.39–99.54% and segmentation agreement reached 98.35%.Classification task accuracy differed by at most 1.59 percentage points.
  • Mitigation: Higher-rank masking weakened functional recovery but left permutation recovery at 100% through r = 256 and 99.98% at r = 512, while increasing trusted-side cost.On BERT-base/SST-2, victim agreement fell from 95.53% to 48.05%.

III. REASSESSING THE LWE-BASED SECURITY CLAIM

The paper argues that ArrowCloak’s LWE-based security claim does not establish recovery hardness because its reduction, arithmetic, and induced distributions fail standard requirements.

  • Reduction requirements: Standard LWE hardness transfer requires reducing LWE to ArrowCloak recovery so that an ArrowCloak solver would solve the original LWE challenge.The paper uses this direction as the criterion for a valid direct recovery reduction.
  • Reduction in the wrong direction: ArrowCloak instead rewrites its own weight-transformation relation in LWE-like notation without showing a hardness-preserving reduction.This omission alone prevents the claimed hardness transfer.
  • Quantized arithmetic: The proposed quantization introduces an extra factor of ∆, so B = A^⊤S + E (mod q) does not follow from the original real-valued identity.A valid fixed-point encoding would need rescaling and accounting for quantization and multiplication errors.
  • Mismatch with LWE distributions: The induced secret, matrix, and error terms do not satisfy standard LWE’s required joint distribution, even though the residual error’s marginal distribution was empirically examined.In particular, the secret depends on H and Π, while standard LWE requires specified distributions and independence conditions.
  • Conclusion: Together, the incorrect reduction direction, quantized-arithmetic mismatch, and distributional mismatch prevent the LWE argument from establishing recovery hardness.The paper distinguishes invalidating the hardness argument from proving that ArrowCloak is efficiently breakable.

IV. ArrowRevelio: A STRUCTURAL RECOVERY ATTACK

ArrowRevelio exploits the shared mask direction that ArrowCloak leaves across protected columns. It estimates and removes this low-rank structure, then uses public weights to recover the hidden correspondence and victim weights.

  • Structural leakage: ArrowCloak’s additive masks reuse one direction across columns, leaving an observable rank-one structure despite hiding individual vector directions.The hidden permutation reorders columns but does not conceal the shared direction.
  • Threat model: ArrowRevelio requires the public pretrained checkpoint, architecture metadata, and exposed obfuscated weights, but no victim weights, secrets, queries, or fine-tuning data.The threat model assumes an honest-but-curious host and untrusted GPU with access to the exact public checkpoint.
  • Attack workflow: The attack estimates the shared mask direction with SVD, projects it out, matches projected columns one-to-one, and reconstructs victim weights from fitted coefficients.Centering makes the SVD depend on variation across columns rather than their overall mean.
  • Rank-one mask: The shared mask component has rank one because every mask column is a scalar multiple of the same vector.This rank-one signal is the matrix-level structure that the attack isolates spectrally.
  • Shared-direction estimation: When the mask perturbation is small relative to the mask signal, the leading left singular vector of centered exposed weights approaches the shared direction up to sign.The sign is immaterial because the attack uses only the direction’s span.

C. Recovering the Hidden Permutation

After removing the estimated mask direction, ArrowRevelio recovers the hidden permutation by globally matching projected public and exposed columns under cosine similarity.

  • Ideal mask removal: Projecting onto the hyperplane orthogonal to the shared mask direction removes the rank-one mask component.The projector satisfies P_v⊥v = 0.
  • Projected alignment: When projected fine-tuning residuals are small, correctly paired public and exposed columns remain nearly positively aligned.This motivates cosine-similarity matching after projection.
  • Global assignment: Because the hidden permutation is bijective, every public column must be assigned to exactly one exposed column and every exposed column used once.The attack therefore formulates matching as a one-to-one assignment problem.
  • Global assignment: The Hungarian algorithm solves the assignment globally by minimizing the negated projected cosine-similarity matrix.This enforces a valid permutation rather than independent column choices.
  • Recovery condition: Exact permutation recovery requires nonzero projected-column norms and sufficient margin for the correct cosine matches when using the estimated projector.Using an estimated rather than true direction adds projector-error perturbation.

D. Reconstructing the Victim Weights

After matching columns, ArrowRevelio fits scale and mask coefficients to invert the transformation; the same logic extends to rank-r mask subspaces with accurate rank estimation.

  • Coefficient estimation: ArrowRevelio estimates each matched column’s scale and effective mask coefficient by constrained least squares.The scale is restricted to ArrowCloak’s prescribed interval, while the mask coefficient remains unconstrained.
  • Weight reconstruction: The reconstructed victim column uses the original exposed column, retaining the fine-tuning residual after subtracting the fitted mask term.Remaining error reflects permutation, scale-estimation, and residual-mask errors.
  • Rank-r extension: For rank-r masking, the additive mask has rank at most r and factors as BC^⊤, with B spanning the shared mask subspace.Permutation changes column order but not the shared subspace.
  • Automatic rank inference: Automatic rank inference examines adjacent singular-value ratios and accepts an estimated rank only when the dominant spectral break is sufficiently large and separated.The thresholds τ_gap and τ_sep control break magnitude and separation from competing breaks.
  • Rank-r extension: Rank-r recovery replaces the scalar mask term with a subspace coefficient and otherwise preserves the matching and reconstruction logic.Successful recovery additionally requires accurate rank and mask-subspace estimates.

F. Computational Complexity

The attack’s dominant costs are dense SVD, projected cosine-similarity construction, and one-to-one assignment, yielding overall time dominated by these terms and space O(dn + n^2).

  • O(dn min{d, n}) time is required for the dense SVD of the centered exposed matrix.
  • O(n^2d) time constructs the projected cosine-similarity matrix, while the Hungarian algorithm requires O(n^3) time for one-to-one assignment.
  • O(dn + n^2) space stores the input, projected, and similarity matrices.
  • Under the stated scaling conditions, the rank-one mask signal dominates residual terms with ratio O(n^-1/2), improving spectral separation for wider matrices.

B. Recovery of the Mask Direction

The attack estimates the shared mask direction as the leading left singular vector of the centered exposed matrix. Under spectral separation, its angular error is O(n^-1/4), so wider protected matrices permit tighter recovery bounds.

  • The estimated mask direction is the unit leading left singular vector of the centered exposed matrix, equivalently a leading eigenvector of its Gram matrix.
  • The leading eigenvector is selected by maximizing the Rayleigh quotient of the symmetric positive-semidefinite Gram matrix.
  • O(n^-1/4) bounds the angular error sin θ under the stated decomposition and spectral scaling conditions.

C. Recovery of the Mask-Removal Projector

The recovered mask direction defines an orthogonal-complement projector that removes the shared mask before column matching and weight reconstruction. Exact permutation recovery additionally requires separated, nonzero projected columns.

  • The attack uses the estimated mask direction through its orthogonal-complement projector for mask removal.
  • Choosing the sign so that the estimated and true directions have nonnegative inner product makes the projector analysis depend on their angle, not direction sign.
  • The estimated direction can be decomposed as bu = cu + sz, where z is unit and orthogonal to u.
  • For any weight column, projector error bounds the additional column-wise reconstruction error, but exact permutation recovery requires nonzero projected norms and a positive matching margin.
  • Rank-r masking extends the analysis from one direction to a top-r subspace, provided its weakest nonzero eigenvalue dominates the residual spectrum.
  • Rank-r recovery becomes unreliable if the rank is misestimated, the weakest mask direction is too weak, or projection removes most matching information.

A. Experimental Setup

The evaluation spans six model–task configurations and measures structural, functional, and diffusion output recovery. Experiments also test the spectral mechanism underlying shared-mask recovery and whether ArrowCloak’s error-distribution conditions prevent it.

  • Experimental scope: Six model–task pairs cover classification, segmentation, and diffusion workloads.The models include ViT-B/16, BERT-base, GPT-2, ViT on Kvasir-SEG, and SD 2.1 LoRA configurations.
  • Structural recovery: 99.92%-100% hidden-permutation recovery is achieved across all six protected configurations.Mean true-match rank ranges from 1.00 to 1.31.
  • Functional recovery: Classification accuracy differs from the victim by at most 1.59 percentage points, with 94.39%-99.54% prediction agreement.The recovered segmentation model achieves 98.35% output agreement; diffusion is evaluated using PSNR and SSIM on matched prompts and seeds.
  • Functional recovery: The recovered Emoji diffusion model preserves the main subject while differing in fine-grained details such as accessories, backgrounds, and contours.The comparison uses matched prompts and random seeds, and residual errors can compound across denoising steps.
  • Recovery mechanism: The shared-mask component is spectrally separated, with residual-to-mask ratio below 6 × 10−4 and mask-direction deviation at most 0.032°.Estimated and oracle mask-removal projectors differ by at most 5.6 × 10−4.
  • Error-distribution premise: ArrowCloak’s error-distribution conditions are not consistently satisfied by real victims and do not prevent recovery when satisfied.Synthetic Gaussian residuals still yield 99.914% permutation recovery, while BERT reaches 100% permutation recovery under both quantized conditions.

E. Attack Cost

ArrowRevelio remains computationally practical and exposes a security–efficiency tradeoff in higher-rank masking. Increasing rank weakens functional reconstruction, but structural recovery persists and trusted computation rises substantially.

  • Attack cost: The complete attack takes 11.531 seconds at r = 1 and 17.170 seconds at r = 32 on BERT-base with SST-2.Intermediate mask-rank settings fall within this runtime range.
  • Security tradeoff: Reusing a shared mask direction shifts exploitable leakage from individual-vector geometry to cross-vector matrix structure.ArrowMatch exploits local geometry, whereas ArrowRevelio estimates shared structure across released vectors.
  • Higher-rank masking: Permutation accuracy remains 100% through r = 256 and 99.98% at r = 512 despite higher-rank masking.The coherent rank-r subspace remains spectrally identifiable, and complementary dimensions support matching.
  • Higher-rank masking: Victim agreement decreases from 95.53% at r = 64 to 48.05% at r = 512.Higher rank enlarges the ambiguous mask component and prevents coefficient fitting from recovering more victim-weight information.
  • TEE overhead: At r = 512, TEE correction requires approximately as much arithmetic as executing all protected matrix multiplications inside the TEE.This comparison uses theoretical operation counts rather than measured latency.
  • Attack requirements: The attack reconstructs victim functionality using public pre-trained and exposed obfuscated weights without victim queries or transformation secrets.Its pipeline removes the shared subspace, solves a global assignment, and fits remaining coefficients.

APPENDIX A MATCHING STABILITY AND PERMUTATION RECOVERY

The appendix formalizes when projected matching preserves the hidden correspondence. Exact recovery requires an accurate estimated mask projector and sufficient norm and separation among ideally projected columns.

  • Matching stability: A positive ρ excludes columns lying almost entirely in the mask direction.ρ measures the smallest fraction of column norm retained after ideal mask removal.
  • Matching stability: Normalized projection stability assumes ρ > 0 and η < ρ.These assumptions ensure the normalized projected vectors are well defined.
  • Permutation recovery: Theorem 1 guarantees unique permutation recovery when µ_i > 2ϵ_i for every i.Under this condition, the linear assignment uniquely recovers the hidden permutation.
  • Permutation recovery: The Hungarian algorithm returns the hidden permutation because the correct exposed column is the unique highest-scoring match in every row.The bijection constraint makes the permutation selecting all row-wise maxima unique.
  • Matching stability: The sufficient condition separates projector accuracy from the norm and pairwise separation retained by ideal projected columns.Both requirements must hold for exact matching.

APPENDIX B FINITE-WIDTH CHECKS FOR SPECTRAL DOMINANCE

Finite-width measurements support the spectral-dominance premises and show robust rank inference and reference selection under attacker uncertainty. However, the experiments do not establish the corresponding asymptotic conditions, and the correct public backbone remains necessary.

  • Spectral premises: The analysis treats non-cancellation and bounded average squared column energy as sufficient conditions for spectral dominance.These premises explain realized recovery measurements rather than serving as attack-success metrics themselves.
  • Finite-width checks: The minimum observed shared-direction energy ratio is 0.56 and the minimum cancellation ratio is 0.33 across protected matrices.These measurements provide no evidence of severe cancellation.
  • Finite-width checks: The observed within-backbone correlations between average squared column norm and width are −0.27, −0.13, and −0.25 for ViT, BERT, and GPT-2.The measurements show no increase with width in these finite models.
  • Scope boundary: The finite-width checks support deployed-width premises but do not prove asymptotic Ω(n) and O(n) conditions.Reference selection also requires the correct protected backbone when architecture-compatible alternatives are available.
  • Rank inference: Using inferred ranks, the complete attack achieves 100% permutation accuracy for every end-to-end setting from r = 2 to r = 64.Recovered accuracy ranges from 90.37% to 92.20%.
  • Reference selection: The exact GPT-2 initialization scores 0.80472 and enables perfect permutation recovery, whereas an independently pretrained checkpoint scores 0.00921 and yields 0.09% permutation accuracy.The incompatible checkpoint also reduces recovered accuracy to 51.83%.
Loading 2608.21615v1…