PaperlayerView exact revision on arXiv

Source-linked AI summary

Beyond Vector Hiding: Breaking and Mitigating Shared-Direction Weight Obfuscation in TEE-Offloaded Large Language Models

Menghui Zhang, Aoying Zheng, Guoxiao Liu, Zizhuang Deng, Jiejing Wen, Jincheng Zhuang, Ran Tao

arXiv:2608.26651v1cs.CR

TL;DR

TEE-shielded LLM partitioning seeks lightweight protection for private weights exposed to an untrusted accelerator. This paper shows that ArrowCloak’s shared-direction reuse leaks a rank-one relation exploitable over both real and modular arithmetic, and introduces ButterflyCloak to remove that reuse while retaining efficient correction.

  • Problem

    Shared rank-one reuse in ArrowCloak may leak private model information across the complete accelerator-visible matrix despite disrupting per-vector directional matching.

  • Method

    The paper develops SpectralLeak for real-valued matrices, LatticeLeak for modular relations, and ButterflyCloak as a keyed maximal-rank mitigation.

  • Results

    87.98% mean accuracy versus 89.85% for victims: SpectralLeak’s surrogates nearly match victim utility across 12 task settings, while LatticeLeak exactly reconstructs protected fixed-point parameters in BERT-Base and GPT2-Base.

  • Takeaways & Limitations

    Shared rank-one reuse is identified as the root cause of leakage, while ButterflyCloak suppresses evaluated attacks and preserves measured model utility with lightweight trusted correction.

  • Takeaways & Limitations

    Exact encoded-row recovery is restricted to checkpoints passing a primitive-row audit; otherwise, absolute integer scale remains ambiguous.

Abstract

from arXiv · show

Trusted Execution Environment (TEE)-shielded partitioning of Large Language Models (LLMs) accelerates on-device inference by offloading obfuscated linear layers to an untrusted accelerator while retaining only a small correction inside the TEE. However, earlier lightweight obfuscation schemes preserved weight-vector directions and were broken by ArrowMatch. To defend against this attack, ArrowCloak injects scalar multiples of the same hidden direction into all weight vectors, enabling lightweight trusted correction. We show that this reuse leaves a rank-one relation across the complete accelerator-visible matrix. For the released real-valued scheme, we propose SpectralLeak, which estimates and removes the shared component. Across 12 task settings, its surrogates achieve $87.98\%$ mean accuracy versus $89.85\%$ for the victims. In our defense-favorable mod-$Q$ realization of ArrowCloak's published modular security formulation, mod-$Q$ arithmetic suppresses this spectral signal but retains the algebraic rank-one relation modulo $Q$. We therefore propose LatticeLeak, which exploits the resulting hidden lattice. In our BERT-Base and GPT2-Base experiments, it reconstructs every protected fixed-point parameter exactly; across all evaluated architectures, the reconstructed models retain victim-level task accuracy without victim queries, labels, or fine-tuning. These findings identify shared rank-one reuse as the root cause of the leakage exploited by our attacks. Guided by this insight, we design ButterflyCloak, a keyed maximal-rank butterfly mask that replaces the reused direction with distinct mask rows while retaining fast trusted correction...

1 Introduction

The paper shows that shared hidden-direction reuse defeats ArrowMatch’s directional attack but creates a matrix-level rank-one invariant. SpectralLeak and LatticeLeak exploit its real and modular forms, while ButterflyCloak removes the reuse with a maximal-rank mask.

  • Motivation: Earlier lightweight transformations preserve weight-vector directions, enabling ArrowMatch to match private-model vectors with a public ancestor.Because private models are commonly fine-tuned from public checkpoints, recovered correspondences can support functional surrogate construction.
  • ArrowCloak: ArrowCloak disrupts per-vector directional leakage by injecting the same hidden direction into every weight vector with different coefficients.The shared direction retains lightweight trusted correction while changing each vector’s apparent direction.
  • Attacks: 87.98% mean accuracy versus 89.85% for victims: SpectralLeak recovers high-utility surrogates across 12 task settings.The attack targets the released real-valued implementation by removing the shared component.
  • Matrix-level leakage: Shared rank-one reuse is the root cause of leakage in both ArrowCloak’s real-valued and modular variants, requiring matrix-level rather than individual-vector analysis.The relation remains across the complete accelerator-visible matrix in both arithmetic settings.
  • Attacks: LatticeLeak exactly reconstructs protected fixed-point parameters for BERT-Base and GPT2-Base and restores victim-level utility across evaluated architectures without queries, labels, or fine-tuning.The modular attack exploits algebraic structure that survives mod-Q arithmetic even when the spectral signal is suppressed.
  • Mitigation: ButterflyCloak uses a keyed maximal-rank butterfly mask to eliminate shared rank-one reuse while preserving efficient trusted correction.On full BERT it suppresses all evaluated attacks; on larger models it preserves utility while suppressing tested spectral and correspondence attacks.

2 Background and Preliminaries

TEE-shielded partitioning offloads linear computation to an untrusted accelerator while retaining lightweight correction inside the TEE. The background introduces ArrowCloak’s shared-direction construction and the real- and finite-field tools used to analyze its matrix-level leakage.

  • TEE-Shielded Model Partitioning: TEE partitioning reduces trusted workload by sending obfuscated weights to an accelerator and correcting its outputs inside the TEE.This design addresses limited TEE computation and memory for large-model matrix operations.
  • Notation: The analysis uses row-oriented matrix notation for weight vectors, while other vector-valued quantities are columns; consequently, accelerator outputs are represented as O_obf = XY^T.The paper temporarily uses ArrowCloak’s original column-vector notation for Figure 3 and its per-vector equation.
  • Weight Obfuscation: Weight obfuscation balances confidentiality against lightweight trusted correction, which must remain below the original O(n^2ℓ) linear-computation cost.Existing lightweight schemes target O(nℓ) correction but preserve weight-vector directions.
  • Weight Obfuscation: ArrowCloak injects a common hidden direction into every private weight vector, then scales and secretly permutes the transformed vectors.Different coefficients alter each vector’s direction while the shared direction lets the TEE compute Xv once, keeping correction at O(nℓ).
  • Matrix-Level Analysis: Over the reals, PCA identifies the dominant shared component; over finite fields, Construction A lattices and LLL analyze linear relations preserved by mod-Q arithmetic.Mod-Q arithmetic removes the numerical ordering needed for direct real-valued spectral analysis.

3 Security Goal and Threat Model

The threat model considers a fine-tuned private model deployed with obfuscated linear-layer weights exposed to an untrusted accelerator. The defender must prevent private-weight or surrogate reconstruction while preserving inference and keeping trusted correction lightweight.

  • Scenario: A model owner fine-tunes a public pretrained model into a private victim model and deploys it through TEE-shielded partitioning.The accelerator handles computation-intensive linear layers, while secret state and lightweight correction remain inside the TEE.
  • Defender’s Goal: The defender aims to prevent exposed matrices from revealing private weights or enabling functional surrogate reconstruction.The protection must preserve correct inference without moving dense matrix computation back into the TEE.
  • Threat Model: The attacks use only complete obfuscated weight matrices provided to the accelerator and require no victim queries, labels, or additional leakage.The threat model excludes query-based extraction, memory attacks, and TEE side channels from the attack input.

4 Shared Rank-One Reuse

ArrowCloak’s shared hidden direction enables lightweight correction but couples the complete exposed matrix through a rank-one relation. Over real arithmetic this relation becomes spectrally visible, while mod-Q arithmetic suppresses the principal-component signal without removing the algebraic coupling.

  • Real-Valued Structure: ArrowCloak expresses the exposed matrix using an invertible diagonal transformation plus a reused rank-one mask.The injected component gives every exposed row a scalar multiple of the same direction, despite differing coefficients and secret row permutation.
  • Efficiency–Security Trade-off: Shared direction reuse preserves O(nℓ) trusted correction because the TEE computes one correction and reuses it across rows.The same design choice creates the security trade-off between efficient correction and matrix-level leakage.
  • Real-Valued Leakage: 0.0016 average cosine distance after PC1 removal versus 0.8998 after random-direction removal shows that PC1 removal restores directional alignment.The pattern holds across all twelve task settings, indicating that the released real-valued scheme hides, rather than eliminates, the victim–public directional relation.
  • Mod-Q Variant: Field-wide mod-Q arithmetic suppresses the Euclidean PC1 signal while preserving a structured cancellation space from the shared rank-one relation.Finite-field combinations can cancel the shared term even though PCA can no longer recover its direction.
  • Mod-Q Variant: The resulting cancellation space provides LATTICELEAK’s basis for recovering hidden row spans from small blocks and intersecting overlapping spans.This converts the residual algebraic coupling into a reconstruction mechanism.

5 SPECTRALLEAK: Breaking Real Valued ArrowCloak

SPECTRALLEAK turns the real-valued shared-component leakage into end-to-end recovery by projecting away the reused direction, matching rows in the projected space, and reconstructing surrogate weights. Its pipeline combines correspondence recovery with two-component row reconstruction and optional public-data refinement.

  • Pipeline: SPECTRALLEAK first removes the shared component, then recovers exposed-to-public row correspondence in the projected space.It uses the exposed matrices and corresponding public ancestor model without knowing victim weights, secret coefficients, shared direction, or permutation.
  • Correspondence Recovery: The attack solves a one-to-one assignment over projected-space scores rather than matching rows independently.Absolute scoring handles unknown scale signs, while positive-only scales allow the absolute value to be omitted.
  • Novelty: The attack’s novelty is applying directional comparison after shared-component removal, where the victim–public relation reappears.ArrowMatch compares directions in the exposed space, whereas SPECTRALLEAK changes the comparison space before matching.
  • Weight Reconstruction: Projection preserves the victim row’s orthogonal component but removes its legitimate component along the reused direction together with the shared injection.The matched public ancestor supplies only the missing one-dimensional component, while the exposed row supplies the remaining component.
  • Surrogate Construction: SPECTRALLEAK assembles reconstructed matrices into the victim architecture and can optionally fine-tune a surrogate using at most 1% of the public task-training split.This refinement requires no victim queries, outputs, or private training data.

6 LATTICELEAK: Breaking Modular ArrowCloak

LATTICELEAK exploits the algebraic cancellation structure that remains after mod-Q arithmetic hides the real-valued spectral signal. It recovers row spans from fixed-size blocks, isolates rows through overlapping intersections, and validates reconstruction across the complete exposed matrix.

  • Residual Leakage: Field-wide mod-Q arithmetic suppresses PC1 leakage but preserves ArrowCloak’s shared rank-one relation for algebraic cancellation.LATTICELEAK targets this residue rather than the absent Euclidean principal direction.
  • Modular Realization: LATTICELEAK applies fixed-point encoding and mod-Q arithmetic consistently to exposed weights and secret coefficients in a defense-favorable realization.The exposed matrix retains a diagonal-plus-rank-one structure unknown to the attacker except for public system parameters.
  • Algebraic Recovery: The attack uses lattice reduction on small row blocks to recover victim row spans, then intersects overlapping spans to isolate individual encoded rows.Accepted combinations are applied across all accelerator-visible coordinates and filtered by public consistency checks.
  • Implementation: With b = 8 and t = 24, each lattice instance remains 24-dimensional independently of the full row width.These fixed parameters balance span dimension, block coverage, and short-vector separation across architectures.
  • Row Isolation: Overlapping block spans isolate a victim row when their associated rows are linearly independent and the intersection is one-dimensional.The attack rejects candidates that fail the one-dimensional intersection check.
  • Scope and Conditions: Exact encoded-row recovery additionally depends on primitive rows, lattice-vector separation, overlapping-span independence, and known integer scale.Without a public ancestor, the attack returns an unordered projective row set but generally cannot place rows into an executable model.

7 BUTTERFLYCLOAK: Removing Shared Rank-One Reuse

ButterflyCloak replaces ArrowCloak’s reused rank-one direction with a keyed maximal-rank mask, preventing the cancellation and projection structures exploited by SpectralLeak and LatticeLeak while keeping trusted correction efficient.

  • SPECTRALLEAK and LATTICELEAK exploit ArrowCloak’s reuse of one mask direction across every protected row, whose injected matrix has rank one.Over the reals, SpectralLeak projects away the estimated direction; modulo Q, LatticeLeak finds row combinations that cancel it.
  • A constant-rank mask only expands leakage into a low-dimensional principal subspace, so removing a few components can still restore private–public row correspondence.The cited rank-2 and rank-3 ablations recover correspondence after projecting out the first two or three principal components.
  • ButterflyCloak provides rank-n protection with O(nℓlogn) trusted correction, versus O(nℓ) for ArrowCloak and O(n2ℓ) for dense masking.The costs are asymptotic and do not imply equal constants or measured TEE latency.
  • ButterflyCloak uses a keyed maximal-rank butterfly mask whose rows are not scalar multiples of one reused direction.Its rank is min(m,d), giving full rank for square layers and the maximum possible rank for rectangular layers.
  • For square layers, the mask is a product of sparse butterfly stages, each applying independent invertible 2 × 2 rotations; rectangular layers retain or stack keyed square masks.Every butterfly stage is full rank, so their product is full rank.
  • Because its mask rows are linearly independent, ButterflyCloak removes the nonzero cancellation space required by LatticeLeak.The paper’s evaluation tests this transferred attack across protected BERT tensors.

8 Evaluation

The evaluation tests leakage and mitigation across task, arithmetic, architecture, and scale settings. SpectralLeak and LatticeLeak recover highly useful models, while ButterflyCloak suppresses the evaluated attacks while preserving utility.

  • 8.2 RQ1: The Released Scheme: Across 12 task settings, SPECTRALLEAK reaches 87.98% average accuracy versus 89.85% for the white-box victims.This is within 1.87 percentage points of the victim average after removing the shared component.
  • 8.2 RQ1: The Released Scheme: Projected assignment recovers every correspondence for BERT, GPT2-Base, and GPT2-XL, and at least 99.89% for ViT.Reconstructed-weight cosine similarity ranges from 98.15% to 99.98%, before small-data refinement.
  • 8.3 RQ2: Arithmetic Hardening: Field-wide mod-Q keys reduce PC1 energy to 0.19–0.41% and permutation recovery to 0.045–0.094%, whereas small keys preserve the real spectral component.Merely adding a modulus to the released small keys does not stop SpectralLeak.
  • 8.4 RQ3: Recovery under Mod-Q Protection: LATTICELEAK exactly recovers all 72 protected BERT tensors, comprising 82,944 rows and 84,934,656 fixed-point coordinates, while retaining 91.6284% task accuracy.GPT2-Base is also recovered exactly on both evaluated tasks; imperfect rows in ViT and GPT2-XL leave accuracy effectively unchanged.
  • 8.5 RQ4: Attack Mitigation with BUTTERFLYCLOAK: On full-model BERT, ButterflyCloak preserves 91.6284% accuracy while reducing PC1 energy to 0.13049% and raw correspondence recovery to 0.11695%.The transferred LatticeLeak implementation recovers none of the 82,944 victim rows.
  • 8.6 Scale Extension to Modern LLMs: At larger scale, SPECTRALLEAK recovers 99.606%–100% of row correspondences and stays within 0.34 percentage points of victim accuracy, while ArrowMatch recovers 9.080%–9.151%.These scale experiments use no public-data refinement, so the reported SpectralLeak accuracy reflects reconstruction alone.
  • 8.5 RQ4: Attack Mitigation with BUTTERFLYCLOAK: ButterflyCloak reduces PC1 energy to 0.0454%–0.1835%, keeps direct and adaptive PCA recovery below 0.206%, and uses 0.516%–1.278% of protected-layer operation counts.These are arithmetic operation counts rather than measured TEE latency.

9 Conclusion

The paper identifies shared rank-one reuse as a matrix-level leakage source and develops attacks over real and finite-field arithmetic, alongside a butterfly-mask mitigation. Evaluations report strong recovery and utility preservation, while emphasizing that the defense is not a cryptographic confidentiality proof.

  • Shared rank-one reuse is identified as a fundamental leakage source in accelerator-visible weight matrices.
  • ButterflyCloak replaces shared low-rank reuse with a keyed maximal-rank mask while preserving measured model utility and fast trusted correction.
  • The evaluation concerns a research prototype using public models and datasets, and the defense is presented as a systems mitigation rather than a cryptographic endpoint.
  • SPECTRALLEAK uses principal-component estimation to test and remove the dominant shared component from the real-valued exposed matrix.
  • 100.00% alignment between extracted PC1 and the injected direction is reported for every summarized measurement row.

C Finite-Field Extension Results

The finite-field extension shows that modular arithmetic suppresses the spectral signal but preserves an algebraic cancellation structure. LatticeLeak exploits this hidden lattice through public constructions, candidate validation, and conditional span recovery.

  • Full-field keys suppress the spectral leak on every extension architecture, whereas small keys preserve it on every architecture.
  • LatticeLeak models shared-component cancellation as the kernel of a surjective homomorphism, yielding a full-rank integer lattice with determinant Q.
  • LLL outputs are treated as candidates and checked using public independence, separation, row-completion, and overlapping-span tests.
  • The attack constructs a public Construction A lattice from selected exposed coordinates because the secret cancellation lattice cannot be built directly.
  • Because fixed-point weights and relevant coefficients are small relative to Q, centered lifts can be shorter than ordinary modular codewords.
  • The algebraic implication is exact once independent lifted codewords and a nonsingular coefficient matrix are recovered, but LLL separation remains empirical.

F ButterflyCloak Construction and Analysis

ButterflyCloak replaces ArrowCloak’s repeated direction with structured, keyed masks whose rows span a maximal-rank space. The construction removes the cancellation primitive used by LatticeLeak, while its evaluation and security scope remain bounded.

  • Each butterfly stage applies keyed coordinate pairings and independent invertible 2×2 rotations, so the resulting square mask is full rank.
  • ArrowCloak creates many exposed rows sharing one dominant direction, whereas ButterflyCloak’s αMθ rows span a maximal-rank space without a single removable direction.
  • Linearly independent ButterflyCloak mask rows imply c = 0, eliminating the nonzero cancellation space required by LatticeLeak.
  • The defense is evaluated as a systems mitigation, not a cryptographic proof, and does not rule out attacks jointly estimating public and butterfly parameters.
  • The compact correction uses 2.083% of the protected dense-layer rotation scalar operations in the reported transfer stress test.

G Experimental Setup

The experiments evaluate attacks and defenses across vision, language, and large language models using public checkpoints, datasets, and paired victim controls. Training, arithmetic, attack, and mask settings are specified for reproducibility.

  • Models and datasets: Experiments cover ViT-Base, BERT-Base, GPT2-Base, and GPT2-XL across CIFAR, Food-101, MNLI, QQP, SST-2, and QNLI.
  • Models and datasets: All victim models are fine-tuned from public checkpoints, with corresponding trained checkpoints used for real-valued and modular experiments.
  • Models and datasets: Each result table includes a paired victim control, and ArrowMatch results are rerun on the same checkpoints.
  • Attack parameters: The modular anchor uses BERT-Base on SST-2 with seed 42, 872 validation examples, fixed-point exponent f = 16, and modulus Q = 2^31 − 1.
  • Attack parameters: LatticeLeak exact recovery means element-wise equality with the defender’s fixed-point integer matrix and uses one accelerator-visible residue matrix plus public system parameters.
  • Defense parameters: ButterflyCloak uses seed 42, independently derived per-tensor generators, strength 256× the median victim row norm, and adaptive removal of 1, 8, or 32 components.

H Additional Scope and Limitations

The paper narrows its claims about LWE, modular inference, exact lattice recovery, and ButterflyCloak’s security scope. It also identifies implementation, distributional, ancestry, and adaptive-attack boundaries that require further evaluation.

  • LWE relation: Neither attack solves LWE; the released ArrowCloak implementation uses real arithmetic and does not instantiate standard LWE.The modular target instead derives from ArrowCloak’s finite-field security formulation.
  • ButterflyCloak scope: ButterflyCloak resists the evaluated attacks, not cryptographic indistinguishability, and remains exposed to potential adaptive joint estimation of its structured parameters.Increasing mask strength also improves directional hiding while increasing floating-point cancellation during trusted correction.
  • Implementation boundary: The implementation is a correctness-oriented prototype, leaving optimized trusted costs, security games, adaptive factorization attacks, and matched baselines for future work.The paper states that arithmetic remains below dense matrix multiplication but does not provide a production TEE benchmark.
  • Exact lattice recovery: Exact LatticeLeak recovery depends on primitive protected rows and a short-combination condition verified for the evaluated BERT-Base and GPT2-Base checkpoints.Other weight distributions and quantization protocols require separate measurement.
  • Finite-field realization: The modular evaluation protects and recovers encoded weights before ordinary floating-point inference, rather than implementing an unspecified end-to-end integer inference system.Its field-wide randomness and modular arithmetic deliberately favor the defense.
  • Public ancestry: Without a public ancestor, LatticeLeak recovers an unordered projective row set, but executable model reconstruction still requires another source of row labels.This narrows final model reconstruction claims while preserving the demonstrated breach in the public-ancestry setting.
Loading 2608.26651v1…