PaperlayerView exact revision on arXiv

Source-linked AI summary

Understanding the Security Boundary of Obfuscation-based On-Device LLM Protection

Hanyi Zhou, Chenyang Li, Yuanzhe Pang, Ke Xu, Mingwei Xu, Zhuotao Liu

arXiv:2609.10117v2cs.CR

TL;DR

On-device LLM obfuscation defenses are largely ad hoc, making them difficult to compare, evaluate, and extend. This paper formalizes common primitives, analyzes and attacks their composed security boundary, and adds primitives; under evaluated Collapse, Oext reaches 1.00× Rel.Black versus 1.46× for Prior Best.

  • Problem

    Existing TSLP obfuscation and attacks are largely ad hoc, leaving methods difficult to compare, evaluate, and extend in a principled manner.

    Source: §1 · p. 1, §10 · p. 13

  • Method

    The paper formalizes obfuscation primitives, uses them to characterize and attack a canonical boundary, and combines two new primitives with existing ones to form Oext.

    Source: §1 · p. 2

  • Results

    1.00× Rel.Black for Oext versus 1.46× for Prior Best under evaluated Collapse; Oext matches the empirical black-box reference on average.

    Source: §7.4 · p. 11

  • Takeaways & Limitations

    The primitive abstraction systematizes representative TSLP defenses and identifies a shared vulnerability in their canonical composition.

    Source: §1 · p. 2, §10 · p. 13

    Oprior’s stated security boundary covers compositions of {Π, 𝐷, 𝑆, 𝐿}, whose perturbations leave victim-weight column directions largely exposed.

    Source: §4 · p. 6

Abstract

from arXiv · show

Trusted Execution Environments (TEEs) offer a promising mechanism for safeguarding the intellectual property of on-device Large Language Models (LLMs). To overcome the inherent computational bottlenecks of TEEs, existing TEE-Shielded LLM Partition (TSLP) methods apply efficient obfuscation schemes to computationally intensive layers, offloading them to external GPUs while retaining only lightweight operations within the TEE. Although a growing body of TSLP-based approaches has emerged, these defense mechanisms remain largely heuristic. Consequently, some methods are proven vulnerable to certain specialized adversarial attacks designed to exploit their specific architectural implementations. To overcome the limitations of these heuristic designs, this paper addresses a fundamental research question: can we establish common primitives to unify representative prior methodologies, characterize the security boundary of their compositions, and systematically extend them? To this end, we formalize a set of obfuscation primitives, defined as dual-tuples of linear computations satisfying specific algebraic properties. We demonstrate that the matrix-level weight transformations of several representative efficient TSLP frameworks can be expressed as compositions of these primitives; consequently, the canonical form of these primitive compositions, denoted as \priorboundary, defines the security boundary of this primitive family. We then expose the vulnerabilities of \priorboundary through a novel primitive-guided attack methodology, \sysattack, demonstrating a shared vulnerability in several prominent TSLP methods published in top-tier venues, such as ArrowCloak (Security'25), TSQP (S\&P'25), and LoRO (NeurIPS'25). Finally, we introduce two novel obfuscation primitives and integrate them with existing constructs to formulate \sysdefense, extending the prior security boundary \priorboundary.

1 Introduction

On-device LLM deployment exposes proprietary weights to local adversaries, while TSLP defenses remain heuristic and fragmented. The paper unifies their obfuscations, exposes a shared vulnerability, and extends the primitive boundary.

1 Introduction

  • Local adversaries can inspect on-device LLM code, parameters, memory, and intermediate activations, creating model-extraction and privacy risks.These risks arise because local access exposes information that cloud APIs would not.Source: §1 · p. 1
  • Existing TSLP defenses and attacks are largely ad hoc, with schemes using different algebraic tricks and attacks targeting specific obfuscation classes.Examples include permutation, scaling, additive masking, and low-rank masking.Source: §1 · pp. 1–2
  • The paper formalizes multiplicative and additive obfuscation primitives and identifies Oprior as the canonical composition representing the existing methods’ security boundary.The primitives are permutation, scaling, sparse masking, and low-rank masking; each is described as invertible and efficiently computable.Source: §1 · p. 2
  • Collapse exploits column-direction leakage across Oprior’s primitive compositions to recover a surrogate model with comparable performance to the victim.It aligns multiple observations, recovers low-rank and sparse masks, then fine-tunes with a small labeled dataset to address remaining masks and scaling.Source: §1 · p. 2
  • Oext combines two new primitives with existing ones, disrupting row- and column-wise invariants; across four representative models, surrogate accuracy reaches the empirical black-box reference on average.The sparse multiplicative primitive mixes columns, while the double-sided multiplicative primitive disturbs both rows and columns.Source: §1 · p. 2
  • The authors do not claim universal security for Oext and evaluate it only against Collapse without defense-specific adaptation.The paper frames its contribution as a unified methodology for understanding obfuscation-based on-device LLM protection.Source: §1 · p. 2

2 Background and Threat Model

The background distinguishes transformer operators by their weights and computational roles, then describes a TEE–REE inference split. The threat model gives a device owner access to exposed views and limited task data, but excludes hardware side-channel and transient-execution attacks.

2.1 Transformer Architecture and TEE–REE Collaborative Inference

  • Oplinear comprises weight-bearing QKV, output-projection, and FFN transforms; Opquadra covers token-to-token attention products, while Opnon-poly collects lightweight operations.The attention-product cost grows quadratically with sequence length.Source: §2.1.1 · p. 2

2.1.1 Operator Classes in Transformer.

  • The TEE retains lightweight non-linear computation and obfuscates linear-layer weights before offloading them to the untrusted REE for computation and result recovery.The REE computes on obfuscated inputs, and the TEE removes the obfuscation factors from the returned results.Source: §2.1.2 · p. 2

2.2 Threat Model

  • The honest-but-curious device owner can record distinct exposed weight views across key refreshes and combine them with public prior knowledge to reconstruct the victim weights.The inference protocol itself is assumed to run correctly, with recovery yielding the correct output.Source: §2.2 · pp. 2–3
  • The attacker seeks a high-utility surrogate using boundary observations, typically less than 1% labeled task data, and a public pretrained-model prior; hardware side-channel and transient-execution attacks are excluded.The attacker aims for comparable performance rather than exact recovery of every victim parameter.Source: §2.2 · p. 3

3 Systematizing Linear Obfuscation

The section formalizes obfuscation primitives, shows how compatible primitives compose, maps representative TSLP transformations to four prior primitives, and derives their canonical security boundary.

3.1 Obfuscation Primitives

  • A valid obfuscation primitive pairs weight masking with recovery and requires exact correctness, negligible TEE-side overhead, and model-extraction resistance.A dense Gaussian mask illustrates the efficiency constraint: recovering with a dense mask costs as much as the original matrix operation.Source: §3.1 · p. 3

3.2 From Primitives to Schemes

  • Compatible primitives compose with exact correctness and additive TEE cost; extraction resistance is preserved under full-transcript simulation conditions.The composition applies obfuscations in sequence and recoveries in reverse order.Source: §3.2 · p. 4

3.3 Prior Schemes as Compositions of Primitives

  • The four prior primitives are sparse and low-rank additive masks, plus column-wise permutation and scaling; together they represent the listed prior transformations.ArrowCloak is the listed example that composes multiple primitives within one scheme.Source: §3.3 · p. 4, Table 2 · p. 5
  • Sparse-mask recovery costs O(m·nnz), while low-rank-mask recovery uses two thin multiplications costing O(mn), below dense O(mn²).Permutation recovery is a memory copy; diagonal scaling uses mn scalar divisions.Source: §3.3 · p. 4
  • All seven representative scheme transformations map to F(Bprior); six use one primitive, while ArrowCloak composes several.Table 2 also indicates whether each scheme uses a fixed mask or multiple masks across inferences.Source: §3.3 · p. 4, Table 2 · p. 5

3.4 Security Boundary of Bprior

  • Every efficiency-preserving composition from Bprior reduces to Oprior=(W+S+L)DΠ, with sparse S, low-rank L, nonsingular diagonal D, and permutation Π.The paper defines this canonical form as the security boundary of Bprior.Source: §3.4 · p. 5

4 Attack Intuition

Oprior's four primitives leave victim-column directions largely exposed through three structural channels: permutation and scaling preserve them, sparse masking perturbs few entries, and low-rank masking leaves an orthogonal component unmasked. Because the backbone is public, recovering column directions supports constructing a surrogate by fixing directions and fine-tuning magnitudes.

Insight 1 (Column atomicity).

  • Permutation and diagonal scaling relabel or rescale columns without mixing them, preserving the victim weight's column directions.Each exposed column remains a transformed copy of one original column.Source: §4 · p. 6

Insight 2 (Sparse coverage gap).

  • Practical sparse masks perturb only a small fraction of entries, leaving nearly every column entry in cleartext and barely tilting its direction.The mask has nnz ≪ n^2 nonzeros.Source: §4 · p. 6

Insight 3 (Low-rank coverage gap).

  • Low-rank masking confines noise to an r-dimensional subspace, so projecting it away exposes each column's remaining n−r dimensions without noise.The paper argues that the public backbone makes recovered weight directions useful for building a surrogate model.Source: §4 · p. 6

5 The Collapse Pipeline

Collapse extracts a surrogate from multiple obfuscated views by aligning their columns, removing low-rank masks, then using a public pretrained prior and limited task data to recover scaling and fine-tune. Its stages exploit cross-view consistency and mask-subspace structure before assembling the model.

5 The Collapse Pipeline

  • Collapse observes T obfuscated views of a single weight matrix and labeled task data capped at 1% of the original training set, then returns a surrogate whose downstream accuracy approximates the victim’s.Source: §5 · p. 6

5.1 Stage 1: Cross-View Column Alignment

  • Stage 1 uses cross-view consistency and the LDD oracle to align at least four views into a common column ordering, while leaving absolute permutations unknown.The method recovers relative, not absolute, permutations.Source: §5.1 · p. 6

5.1.1 The LDD Oracle.

  • The LDD oracle estimates overlap between column subsets from the rank of their concatenated views, detecting deficits only while k+s+2r ≤ 2k.For k=32 and r=2, the passage gives a detection range of s≤28.Source: §5.1.1 · p. 6

5.1.2 Recovering Relative Permutations.

  • Relative permutation recovery seeds a fully overlapping subset pair, disambiguates its element mapping with oracle queries, then propagates matches to remaining columns.Phase 3 dominates the stated cost at O(n^2) LDD calls; the first two phases together use O(k^2).Source: §5.1.2 · p. 7

5.2 Stage 2: Mask Recovery

  • Stage 2 intersects column spaces from two view pairs to identify low-rank mask subspaces, then projects them away and jointly recovers relative scales and mask components.The two mask-free projections jointly span the space; the stage leaves the shared sparse mask and anchor-view scaling for Stage 3.Source: §5.2 · p. 8

5.3 Stage 3: Fine-tuning

  • Stage 3 aligns recovered columns to the public prior, estimates sparse support, calibrates column lengths, and fine-tunes the initialized model on task data.The method relies on the sparse perturbation preserving directional similarity between recovered weights and the prior.Source: §5.3 · pp. 8–9

6 Extending the Security Boundary

The paper extends the prior primitive family with sparse column mixing and double-sided mixing, then characterizes the resulting canonical boundary Oext. The added constructions disrupt the row- and column-wise invariants targeted by Collapse while retaining stated efficiency bounds.

6.1 Sparse Multiplicative Primitive

  • The sparse multiplicative primitive mixes columns using a sparse invertible matrix whose inverse is sparse, and strictly subsumes diagonal-scaling and permutation primitives.Its recovery cost is O(mn), the same as the diagonal-scaling primitive.Source: §6.1 · p. 9

6.2 Double-Sided Multiplicative Primitive

  • The double-sided primitive adds row mixing to column mixing, and the extended primitive definition permits transformations of both input and weight while preserving recovery correctness.It can lift any column-wise multiplicative primitive to a two-sided variant.Source: §6.2 · p. 9

6.3 The Extended Boundary Oext

  • Oext is the canonical form for compositions of the extended primitives, with sparse and low-rank masks bounded by s_max ≪ n^2 and r_max ≪ n.The extended family strictly subsumes Oprior by setting M_X=I and M_W=DΠ.Source: §6.3 · pp. 9–10
  • Oext's per-query overhead stays within Oprior's envelope, with sparse-dense products costing O(mn) and per-refresh materialization costing O(n^2).The passage states these costs are on par with Oprior.Source: §6.3 · p. 10

7 Evaluation

The evaluation tests Collapse across representative models, tasks, and obfuscation configurations, then measures its recovery accuracy, Oext’s resistance to Collapse, and Oext’s cost. Collapse approaches the white-box upper bound, while Oext reduces surrogate accuracy relative to the strongest prior defense at comparable end-to-end cost.

7 Evaluation

  • The evaluation asks whether Collapse defeats existing defenses, recovers obfuscation components stage by stage, and how Oext’s defense effectiveness and cost compare.The section frames these as four research questions.Source: §7 · p. 10

7.1 Experimental Setup

  • The evaluation covers four models from 86M to 1.54B parameters and language and vision tasks, including GLUE datasets and CIFAR-100.It compares five representative obfuscation algorithms, Oprior, and attack baselines including ArrowMatch; the setup uses four datasets across multiple modalities and task complexities.Source: §7.1 · pp. 10–11, Table 3 · p. 10, Table 4 · p. 10

7.2 RQ1: Attack Performance Across Defenses

  • 1.45× the black-box baseline, versus a 1.46× white-box upper bound, is Collapse’s average attack performance across the evaluated settings.On Oprior, the full-stack target, the surrogate is also close to white-box.Source: §7.2 · p. 11, Table 5 · p. 12

7.3 RQ2: Stage-wise Attack Success

  • Collapse achieves approximately 100% recovery performance at every measured stage against Oprior.The stage-wise evaluation uses three independent BERT-Base attacks on MNLI and reports their mean.Source: §7.3 · p. 11, Table 6 · p. 12

7.4 RQ3: Defense Effectiveness

  • Under the evaluated Collapse configuration, Oext reduces Rel.Black from 1.46× for Prior Best to 1.00×, matching the empirical black-box reference on average.The results are empirical and specific to the evaluated attack configuration.Source: §7.4 · p. 11, Table 7 · p. 12

7.5 RQ4: Cost of Oext

  • Oext’s end-to-end cost is on par with ArrowCloak while reducing Collapse surrogate accuracy by 27.4 percentage points.The cost evaluation measures obfuscation, GPU compute, TEE↔GPU transfer, and TEE-side recovery; the stated comparison is for end-to-end cost.Source: §7.5 · pp. 11–12, Table 8 · p. 12

8 Discussion

The discussion distinguishes algebraic attacks from hardware-channel threats and bounds the claims about Oext. It also notes that, under the threat model, comparing refreshed obfuscated views may make weight recovery easier.

8 Discussion

  • The analysis assumes enclave code and data are protected and excludes hardware side channels and transient-execution attacks.The attacks exploit algebraic structure in tensors exposed to the REE, not compromise of the TEE or a hardware channel.Source: §8 · p. 12
  • Comparing differently obfuscated views after key refresh may reveal complementary clues, so more frequent rotation can weaken resistance under the stated threat model.The discussion points to Appendix F for the fully refreshed setting.Source: §8 · p. 13
  • Oext’s evidence is limited to the existing Collapse pipeline without defense-specific adaptation, and the paper claims no formal model-extraction security guarantee.Defense-aware attacks targeting M_X and M_W are left for future work.Source: §8 · p. 13

9 Related Work

Prior TSLP defenses and attacks rely on scheme-specific algebraic tricks and heuristics. The paper introduces a shared primitive-level abstraction to derive a canonical form, analyze it systematically, and extend the primitive set.

9 Related Work

  • Representative defenses combine permutation, scaling, additive masking, or low-rank masking, while existing attack designs rely heavily on expert intuition and hand-crafted heuristics.ArrowMatch targets permutation and scaling; the cited related-work discussion describes LoRO’s attack as relying on statistical proximity to a public prior.Source: §9 · p. 13
  • The paper’s framework represents prior obfuscation schemes with unified primitives, derives a canonical structural form, and uses it to guide an attack and two new constructs.The stated aim is a systematic way to understand obfuscation-based secure LLM inference and support reasonable claims about approaches.Source: §9 · p. 13

10 Conclusion

The conclusion presents unified obfuscation primitives, a canonical boundary, and a systematic attack that exposes shared vulnerabilities in representative TSLP approaches. The paper also describes scope boundaries and an efficient sparse-mixing construction.

10 Conclusion

  • The conclusion frames the contribution as systematizing an ad-hoc design space and showing that the proposed attack recovers obfuscation structure and builds high-fidelity surrogates across diverse families.The paper characterizes this as revealing fundamental limitations of lightweight obfuscation in TSLP systems.Source: §10 · p. 13

B Ethical Considerations

  • The ethical scope assumes a device-controlling adversary who does not compromise the TEE; cloud/API-only deployments and live targets are outside the stated study setting.Experiments use public checkpoints, not sensitive personal data, and artifacts provide implementations rather than extracted victim parameters.Source: B Ethical Considerations · p. 15

C Sparse Mixing Matrix Construction

  • Constant-size block mixing keeps both the sparse mixing matrix and its inverse at O(n) nonzeros, enabling linear-time sparse post-processing.The construction uses groups of at most k columns, with k=2 in the stated setting; each exposed column is a linear combination of two original columns.Source: C Sparse Mixing Matrix Construction · p. 15

D Model Extraction Game

The model-extraction game models an honest-but-curious device owner who controls the REE but cannot compromise the TEE. The adversary uses public model and scheme information, limited task data, and recorded exposed views to build a surrogate, with success measured by its accuracy gap from the victim.

D Model Extraction Game

  • The owner fine-tunes public pretrained model Mpre into proprietary victim Mvic and deploys it through the TEE–REE pipeline using obfuscation scheme S.The scheme samples and refreshes its keys according to its declared schedule; the adversary follows inference protocol, cannot compromise the TEE, and controls the REE.Source: D Model Extraction Game · p. 15
  • The adversary knows the architecture, Mpre, and public scheme description and parameters, and may use up to B labeled task examples while recording at most T exposed views.Each view includes an offloaded layer’s released input, obfuscated weight, and REE-computed product; victim weights, private fine-tuning data, keys, recovery state, and post-recovery TEE values remain hidden.Source: D Model Extraction Game · pp. 15–16
  • Within budgets T and B, any polynomial-time attack may adapt protocol-valid queries to earlier observations and outputs a surrogate intended to reproduce Mvic’s task behavior.The objective is to maximize surrogate task accuracy, not to prescribe a particular extraction method.Source: D Model Extraction Game · p. 16
  • The attack succeeds when the surrogate’s accuracy on the same evaluation set is within allowed gap δ of the victim’s accuracy.This is the game’s success criterion, not a claim that any particular scheme prevents all such attacks.Source: D Model Extraction Game · p. 16

E Proof of the Composition Theorem

The composition proof establishes correctness, additive cost, and attack transfer under a full-transcript simulation assumption. The appendix then adapts Collapse to a schedule that refreshes all four components and reports that the attack still succeeds.

E Proof of the Composition Theorem

  • For composition C = Q ◦ P, reverse-order recovery establishes correctness, while executing each primitive once gives additive cost.The proof also shows that, under a polynomial-time full-transcript simulator with the same budgets, every successful attack on C induces one on either primitive.Source: E Proof of the Composition Theorem · p. 16

F Attack Strategy under Fully Refreshed Components

  • Stage 1 repeats LDD rank tests on random row subsets: clean samples reveal column overlap and relative permutations, while rank anomalies localize each view’s sparse support.Aggregating anomaly votes yields an estimated support for each refreshed sparse mask.Source: F Attack Strategy under Fully… · p. 16
  • Stage 2 estimates relative column scales outside estimated supports, removes the sparse difference, and recovers W D0 outside those supports for Stage 3.After excluding the union of supports, the difference reduces to the original low-rank setting; excluded entries are passed to Stage 3 for fine-tuning.Source: F Attack Strategy under Fully… · p. 16
  • Under the fully refreshed schedule, Stage 3 reuses the original absolute-alignment, scale-recovery, and fine-tuning procedure, and the attack succeeds.Stage 3 receives an estimate of W D0 outside the sparse support.Source: F Attack Strategy under Fully… · p. 16
Loading 2609.10117v2…