PaperlayerView exact revision on arXiv

Source-linked AI summary

BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition

Zhiyuan Wang, Yuezhi Zhou, Ziqi Zhang, Zhu Zhang, Zhixing Tan, Yongheng Deng

arXiv:2610.21565v1cs.CRcs.AI

TL;DR

On-device deployment exposes proprietary models to reverse engineering, while common TEE-based defenses obfuscate only one side of the weights. The paper attacks this unilateral design and proposes bilateral obfuscation; its attacks exceed the black-box baseline, whereas BISHIELD-TEE stays at that baseline and is more efficient on real hardware.

  • Problem

    Unilateral obfuscation has a uniquely estimable, structurally revealing transformation, creating a reconstruction vulnerability for on-device model protection.

    Source: §4.1 · p. 4

  • Method

    BISHIELD-TEE obfuscates both input and output sides of the weight matrix to avoid SDP and induce ambiguous solutions.

    Source: §1 · p. 2

  • Results

    2.44× the black-box baseline is the attack accuracy reached against GROUPCOVER and ARROWCLOAK, while BISHIELD-TEE confines attack accuracy to the black-box level.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The results expose an overlooked risk for TEE-based on-device model protection and provide a bilateral design that confines attack accuracy to the black-box baseline while delivering practical efficiency on real hardware.

    Source: §8 · p. 10

    The real-device evaluation is limited to Intel SGX; other TEEs such as Arm TrustZone remain to be tested.

    Source: §7 · p. 10

Abstract

from arXiv · show

On-device deployment of large language models (LLMs) is increasingly adopted due to latency and privacy requirements, but exposes proprietary models to reverse engineering and intellectual property theft. Trusted Execution Environments (TEEs) provide hardware-enforced isolation for on-device inference, yet most TEE-based parameter obfuscation relies on unilateral matrix transformations that obfuscate only output side. We identify a vulnerability in this design, termed the \emph{Solution Determinacy Property (SDP)}: the obfuscation secret is uniquely determined, exposing the structure of the true key and enabling attackers to break the protection. Under our attacks, representative methods \textsc{GroupCover} and \textsc{ArrowCloak} are reduced to negligible protection, with attack accuracy reaching over $2.4\times$ the full-shielding black-box baseline and recovering near-complete model functionality.To address this vulnerability, we propose \textsc{BiShield-TEE}, a bilateral framework that induces \emph{Ambiguous Solutions} through joint obfuscation of input and output dimensions, hiding the true key among many equally valid candidates. Experiments across diverse models and datasets show that \textsc{BiShield-TEE} confines attack accuracy to the full-shielding black-box baseline, while achieving higher inference efficiency than prior methods on real hardware.Our code is available at https://github.com/laduiw/BiShield-TEE.

1 Introduction

On-device LLM deployment protects latency and privacy but exposes locally stored proprietary models to white-box attacks. The paper identifies a structural vulnerability in unilateral obfuscation, attacks two defenses, and proposes bilateral obfuscation that restores black-box-level protection with improved efficiency.

1 Introduction

  • On-device LLM deployment can reduce response time and enhance privacy through local processing, but storing and executing models locally exposes valuable intellectual property to adversarial users.Unlike cloud services that keep models behind APIs, local deployment permits white-box attacks.Source: §1 · p. 1
  • Unilateral obfuscation leaves a uniquely estimable secret transformation whose inherited structure enables reconstruction when the victim is fine-tuned from a public pre-trained model.The paper terms this vulnerability the Solution Determinacy Property (SDP).Source: §1 · p. 2
  • Dedicated attacks exploit structural patterns in GROUPCOVER and ARROWCLOAK to recover model functionality nearly identical to the originals.The attacks recover GROUPCOVER’s block-diagonal structure and ARROWCLOAK’s low-rank structure.Source: §1 · p. 2
  • BISHIELD-TEE jointly obfuscates both sides of the weight matrix to avoid SDP and induce ambiguous solutions, leaving the true keys non-unique.The framework is designed to protect Transformer architectures while remaining efficient.Source: §1 · p. 2
  • 2.44× the black-box baseline is the attack accuracy reached against GROUPCOVER and ARROWCLOAK, while BISHIELD-TEE confines attack accuracy to that baseline and runs faster on real devices.BISHIELD-TEE runs 1.70× and 1.46× faster than GROUPCOVER and ARROWCLOAK, respectively.Source: §1 · p. 2

2 Related Work

On-device model stealing motivates defenses that reduce access to proprietary weights. Prior TEE-assisted inference partitions execution between trusted hardware and an untrusted accelerator, while existing obfuscation schemes differ in how they transform weights.

2.1 On-device Model Stealing

  • The threat model aims to reduce an adversary’s capability from white-box access to black-box access, limiting the utility of a surrogate model built from stolen parameters.With white-box access, the adversary can directly extract unprotected weights; under full-shielding black-box access, it has no parameter information.Source: §2.1 · p. 2

2.2 Trusted Execution Environment

  • A TEE protects code and data from the host operating system, and BISHIELD-TEE uses it to store obfuscation keys and perform lightweight de-obfuscation.The bulk of computation is offloaded to untrusted accelerators.Source: §2.2 · p. 3

2.3 Partitioned Execution in TEE-Assisted Inference

  • Partitioned inference offloads heavy matrix multiplications to untrusted GPUs while keeping key management in the TEE, but common weight obfuscation acts only on the output side.Prior schemes include per-vector, unilateral multiplicative, and unilateral additive obfuscation; AMULET also uses bilateral obfuscation, with a design centered on reducing TEE interactions.Source: §2.3 · p. 3

3 Threat Model

The threat model places a proprietary model on a user-controlled device with a TEE, where the attacker controls everything outside the TEE but cannot access its secrets. Attacks assume a publicly pretrained starting point and restrict victim-model queries to downstream adaptation.

3 Threat Model

  • The attacker is a malicious device user with control over the obfuscated model, runtime traces, and external software, but cannot access TEE-internal secrets.The protected model runs outside the TEE on a GPU, while secrets and recovery logic remain inside it.Source: §3 · p. 3
  • The victim is assumed to be fine-tuned from a public pre-trained model, and parameter reconstruction uses only the public and obfuscated weights.Victim queries are needed only for downstream task adaptation, with the query budget capped below 1% of training-data size.Source: §3 · pp. 3–4

4 Attacks on Unilateral Defenses

The paper formalizes how unilateral transformations leak recoverable structure, then develops scheme-specific attacks against GROUPCOVER and ARROWCLOAK. The attacks exploit different structural signatures to reconstruct protected weights.

4.1 Solution Determinacy Property in Unilateral Obfuscation

  • The unilateral attack analysis uses public pre-trained weights and obfuscated weights to estimate a right-side transformation, then exploits the structure inherited by that estimate.Because the victim is modeled as a small fine-tuning increment from the public checkpoint, the estimate stays close to the secret transformation; constrained structure makes recovery feasible, whereas a dense random transformation would be impractical inside TEEs.Source: §4.1 · p. 4
  • SDP explains why per-vector schemes leak permutation or scaling locations, while GROUPCOVER and ARROWCLOAK require dedicated attacks because they obscure column directions differently.The paper closes this gap with attacks that exploit each scheme’s transformation structure to reconstruct protected weights.Source: §4.1 · p. 4

4.2 Breaking Unilateral Multiplicative Schemes: GROUPCOVER Case Study

  • GROUPCOVER’s block-diagonal mixing leaks shared dominant indices that reveal column groups, enabling local least-squares weight reconstruction within candidate groups.The attack clusters columns by overlap among their largest-magnitude entries, then selects reconstructions by cosine similarity; its recovery error is an s/d fraction of the black-box-setting error.Source: §4.2 · pp. 4–5

4.3 Breaking Unilateral Additive Scheme: ARROWCLOAK Case Study

  • ARROWCLOAK’s shared additive mask creates a dominant low-rank direction that the attack extracts with PCA, removes by orthogonal projection, and uses for least-squares reconstruction.After denoising, the attack aligns columns using cosine similarity against the public model.Source: §4.3 · p. 5

5 Design of BISHIELD-TEE

BiShield-TEE obfuscates both row and column spaces to replace uniquely recoverable unilateral keys with many equally valid bilateral key pairs. It applies this design to linear layers and self-attention while keeping TEE computation lightweight.

5 Design of BISHIELD-TEE

  • Bilateral obfuscation applies transformations over both row and column spaces, inducing ambiguous solutions in which the genuine keys are not uniquely recoverable.The design uses diagonal scaling to perturb dimension magnitudes and Householder matrices to perturb directional structure.Source: §5 · pp. 5–6, §5.3 · p. 7

5.1 Linear Layers

  • For linear layers, the TEE preprocesses inputs with an independent scale-plus-Householder transform per forward pass before GPU execution.The inverse transformation on the input implicitly cancels the left-side obfuscation of the weight matrix.Source: §5.1 · p. 6

5.2 Self-Attention

  • In self-attention, coupled right-side keys cancel in the key-query dot product, and the output-side factors cancel in the final output.The section applies bilateral obfuscation to each projection matrix.Source: §5.2 · p. 6, Figure 3 · p. 6

5.3 Efficiency and Security Analysis

  • TEE work is limited to scale and Householder transformations, whose application reduces to two matrix-vector products, while dense multiplications run on GPUs.Bilateral protection keeps the number of TEE transitions unchanged from unilateral schemes; its joint obfuscation leaves a continuum of observationally indistinguishable key pairs up to fine-tuning slack.Source: §5.3 · p. 7

6 Experiments

Experiments evaluate unilateral attacks, adaptive attacks against BiShield-TEE, authorized inference quality, and real-device latency across vision and language models. BiShield-TEE stays near the black-box attack baseline while outperforming unilateral schemes in efficiency.

6.1 Experimental Setup

  • The evaluation spans five vision and language architectures, with datasets and tasks covering image classification, language understanding, reasoning, and instruction following.The models are ViT-Base, ViT-Large, GPT2-Base, Llama3.2-1B, and Llama3.2-3B.Source: §6.1 · p. 7

6.2 Attack Performance

  • 2.44× average Rel. Black for GROUPCOVER and ARROWCLOAK approached the 2.49× white-box bound, with attacks remaining high as protected layers increased.The reported gap to the white-box bound remains small across vision, language-understanding, and reasoning tasks.Source: §6.2 · p. 7, Figure 4 · p. 8, Table 2 · p. 8

6.3 Defense Effectiveness

  • Input-only and output-only recovery caused catastrophic performance collapse on Llama models, while joint input-and-output attacks yielded negligible gains.On most settings, parameter substitution was the strongest adversary among the tested strategies.Source: §6.3 · p. 8, Table 3 · p. 9
  • 1.00× average Rel. Black for BiShield-TEE compared with 2.42× for the strongest unilateral defense, even under a worst-case-versus-best-case comparison.The comparison uses BiShield-TEE's highest attack accuracy across adaptive strategies and the unilateral defense's lowest attack accuracy.Source: §6.3 · p. 8, Table 4 · p. 9
  • Matching accuracies between original and obfuscated models across datasets confirm that authorized inference quality is preserved.Table 5 compares the original model with its BiShield-TEE-obfuscated version.Source: §6.3 · p. 8, Table 5 · p. 9

6.4 Real-Device Performance

  • 1.70× and 1.46× average speedups over GROUPCOVER and ARROWCLOAK, respectively, accompanied the lowest latency on every evaluated model.End-to-end latency experiments were repeated 10 times after warm-up.Source: §6.4 · p. 9, Table 6 · p. 9

7 Discussion

Discussion tests how attack effectiveness varies with checkpoint similarity, isolates transformation components, and notes deployment scope and limitations.

Availability of pre-trained models

  • Attacks remain effective at fine-tuning similarity levels typical of standard fine-tuning, weakening only when the increment is large enough to noticeably degrade the victim model.The study varies the magnitude of the fine-tuning increment and measures surrogate-victim similarity.Source: §7 · p. 10

Ablation of Bilateral Transformation Components

  • Householder-only protection yields 1.34× mean Rel. Black versus 1.00× for the full design; adding diagonal scaling largely removes the attack gains.The ablation retains bilateral Householder transformations while removing diagonal scaling.Source: §7 · p. 10

GPU TEEs

  • BiShield-TEE is algorithmic and deployable on off-the-shelf hardware, avoiding dependence on GPU TEEs that remain limited on edge devices.Existing GPU-TEE solutions target server-class hardware or require firmware modifications, which the paper describes as incompatible with commodity edge GPUs.Source: §7 · p. 10

Limitations

  • Evaluation is limited to Intel SGX; quantized inference is unsupported, TEE side channels are unexamined, and risks from on-device updates remain future work.The authors note that INT8/INT4 scaling, clipping, and rounding may disrupt the algebraic relations used to recover outputs.Source: §7 · p. 10

8 Conclusions

The paper identifies a vulnerability in unilateral TEE-based obfuscation, attacks GROUPCOVER and ARROWCLOAK, and proposes BiShield-TEE to return attack accuracy to the black-box baseline while improving real-hardware efficiency.

8 Conclusions

  • BiShield-TEE induces ambiguous solutions through joint input-output obfuscation, confining attack accuracy to the black-box baseline while delivering practical efficiency on real hardware.The conclusion presents the work as an offensive-defensive perspective on TEE-based model protection for edge scenarios.Source: §8 · p. 10

A Details of Existing Obfuscation Schemes

  • GROUPCOVER mixes columns within disjoint feature groups, yielding a block-diagonal transformation concealed by random row and column permutations.Each feature group corresponds to a transformation submatrix.Source: A Details of Existing Obfuscation… · p. 15
  • ARROWCLOAK combines column-wise scaling with a shared additive mask formed as a linear combination of weight-matrix columns.The combination uses a secret coefficient vector and a permutation matrix.Source: A Details of Existing Obfuscation… · p. 15

B Proof of Parameter Recovery for GROUPCOVER

GROUPCOVER’s recovery error is small when the obfuscation dimension s is much smaller than the target dimension d, allowing the surrogate to closely recover the victim weights. This result assumes a full-column-rank pre-trained matrix and a small fine-tuning perturbation.

B Proof of Parameter Recovery for GROUPCOVER

  • GROUPCOVER’s s × s obfuscation matrix protecting a d × s target is vulnerable when s ≪ d, once grouping is compromised.Under these conditions, the recovered surrogate can be made close to the victim weights.Source: B Proof of Parameter Recovery for… · p. 15
  • The analysis assumes Wpre has full column rank and the fine-tuning perturbation ∆ is small relative to Wpre.Full column rank is described as generic when s ≪ d.Source: B Proof of Parameter Recovery for… · p. 15
  • The derivation uses the invertibility of I_s + M and a Neumann-series approximation, discarding terms of order ∥∆∥² or higher.The projector onto col(Wpre) is an s-dimensional subspace of R^d.Source: B Proof of Parameter Recovery for… · pp. 15–16
  • When s ≪ d, the reconstruction error is roughly an s/d fraction of the perturbation energy, so the surrogate closely recovers the victim weights.The error is the projection of the perturbation onto the s-dimensional column space of Wpre.Source: B Proof of Parameter Recovery for… · p. 16

C Detailed Attack Analysis

The appendix details structural attacks on GROUPCOVER and ARROWCLOAK, then analyzes why bilateral obfuscation admits ambiguous keys and reconstructions. It also specifies the datasets and attack pipeline used in evaluation.

C.1 Details of the GROUPCOVER Attack

  • The GROUPCOVER attack normalizes the estimated transformation, uses co-support similarities to extract dense s-cliques, and recovers the grouping from block-diagonal structure.Normalization suppresses weak entries and amplifies dominant intra-group correlations; Figure 5a shows the resulting block-diagonal pattern for ViT-Base’s first-layer WQ parameters.Source: §C.1 · p. 16

C.2 Details of the ARROWCLOAK Attack

  • For ARROWCLOAK, the shared additive mask dominates column-wise variance and emerges as the leading principal component after centering.The attack extracts the mask direction, removes it before permutation matching, then fits per-column scaling and residual mask weights; the leading component’s cosine similarity to the true mask exceeds 99.99% across evaluated layers.Source: §C.2 · pp. 17–18

D.1 The Adversary’s Recovery Problem

  • The residual-based recovery set contains keys whose reconstructed weights satisfy the Wpre constraint at tolerance η, including the true key at its residual bound.The true key belongs to Uε, and every key in that set satisfies the same residual bound, though its residual need not be smaller.Source: §D.1 · p. 18

D.2 Ambiguity of the Transformation Keys

  • Householder antipodal symmetry and admissible reciprocal scaling yield distinct transformation keys with identical recovered weights.When true diagonal magnitudes lie strictly between κ^-1 and κ, all scale factors c sufficiently close to 1 are valid, giving a continuum of key pairs.Source: §D.2 · p. 19

D.3 A Continuum of Admissible Reconstructions

  • Admissible diagonal perturbations can produce distinct recovered weights that remain consistent with the same obfuscated matrix and satisfy the reference constraint.A continuum exists for every tolerance η > r⋆; if r⋆ < ε, a continuum also lies within Uε.Source: §D.3 · p. 19

D.4 Implications for Reconstruction Attacks

  • Pre-trained-reference fitting alone cannot reliably identify the genuine reconstruction because coupled input- and output-side transformations can compensate.If Wpre is in the recovery map’s range, a zero-residual solution can reproduce the public checkpoint rather than the private fine-tuning increment.Source: §D.4 · p. 19

E.1 Datasets and Settings

  • Victim models are fully fine-tuned from public checkpoints, while surrogate training uses victim-query labels and a held-out split disjoint from victim validation.Surrogate query-answer sets do not exceed approximately 1% of the corresponding victim training sets; Llama3.2 obfuscates intermediate transformer layers and is evaluated without retraining.Source: §E.1 · p. 20, §E.2 · pp. 20–21, Table 7 · p. 20

E.2 Experimental Pipeline

  • The pipeline applies sparsity-driven GROUPCOVER and PCA-based ARROWCLOAK attacks, while BISHIELD-TEE recovery alternately refines both sides for five iterations.Learning-based recovery lacks informative initialization, and query-based attacks are ineffective because low-rank OTP refreshes masks each forward pass; surrogate classification heads are retrained on queried labels.Source: §E.2 · pp. 20–21, Table 8 · p. 21

E.3 Real-Device Latency Benchmark.

The real-device benchmark describes its inference measurement setup and compares key footprint and recovery operations. BISHIELD-TEE has the smallest reported TEE-resident key footprint, while its recovery operations avoid input-dependent correction terms used by prior methods.

E.3 Real-Device Latency Benchmark.

  • Latency is measured over 10 complete forward passes after warm-up, with batch size and sequence length fixed by the stated input configurations.For ViT, sequence length 197 comprises 196 image patches and the [CLS] token for 224 × 224 inputs with 16 × 16 patches.Source: §E.3 · p. 21, Table 9 · p. 21
  • BISHIELD-TEE has the smallest TEE-resident key footprint on every model, averaging 19.0% less than ARROWCLOAK and 45.5% less than GROUPCOVER.The footprint counts transformation keys retained inside the TEE for output recovery, not total enclave memory.Source: §E.3 · p. 21, Table 10 · p. 21
  • BISHIELD-TEE uses diagonal scalings and rank-one Householder updates for recovery without constructing Q- or K-dependent correction terms.The passage says these operation differences are consistent with the end-to-end latency results in Table 6.Source: §E.3 · pp. 21–22

E.4 Defense and Attack Hyperparameters

  • BISHIELD-TEE’s Householder matrices are randomly generated, and scale-matrix diagonal entries are log-uniformly sampled from [0.1, 10] with uniformly random signs.The implementation uses Gramine on an SGX1 workstation with 93.5 MiB of physical EPC.Source: §E.4 · p. 22, §E.5 · p. 22

F Sensitivity to Victim–Pretrained Correlation

On ViT-Base/CIFAR-100, reconstruction attacks remain effective across the fine-tuning range relevant to standard fine-tuning, even as victim–pre-trained similarity declines. Attack weakening near and beyond α = 2 coincides with degradation or collapse of the victim model.

Experimental setup

  • The sensitivity experiment scales a ViT-Base fine-tuning update on CIFAR-100 and measures attack accuracy, victim accuracy, and victim–pre-trained CKA across α.Here α controls the strength of deviation from pre-trained weights, and higher CKA indicates greater representational similarity.Source: F Sensitivity to Victim–Pretrained… · p. 22

Effective attack regime

  • For α ≤ 2, attack accuracy tracks victim accuracy closely, remaining within a few percentage points even when CKA falls to roughly 0.5–0.6 at α = 1.8 and 2.0.The plotted attack and victim accuracies track across the full α range, including when CKA has dropped substantially.Source: F Sensitivity to Victim–Pretrained… · p. 22, Figure 6 · p. 23

Boundary regime

Out-of-scope regime

  • For α ≥ 2.5, victim accuracy falls below 70% and continues declining sharply; the paper considers such a model non-deployable.The authors therefore characterize attack weakening in this range as not a meaningful limitation.Source: F Sensitivity to Victim–Pretrained… · p. 23

G Role of Householder Transformations and Diagonal Scaling

This section examines the complementary roles of bilateral Householder transformations and diagonal scaling in protection, and clarifies that the workflow and algorithms do not use LLMs as an important, original, or non-standard component.

G Role of Householder Transformations and Diagonal Scaling

  • Householder-only yields mean Rel. Black 1.34× and maximum 2.37× on Llama3.2-3B/IFEval; Scale+H reduces the mean ratio to 1.00×, while GROUPCOVER and ARROWCLOAK each exceed 2.4× mean.Rel. Black is attack accuracy divided by black-box accuracy, with values closer to 1.00× indicating stronger protection.Source: Table 11 · p. 23, G Role of Householder Transformations… · p. 24
  • Householder reflections introduce key ambiguity but change weights along only one direction while preserving Frobenius norm and singular values, so expected relative displacement decreases with dimension.Thus, in high dimensions, Householder-only protection can obscure the key while leaving weights relatively close to their original values, consistent with residual recovery gains.Source: G Role of Householder Transformations… · p. 24
  • In the full design, diagonal scaling changes magnitudes across dimensions and can increase reconstruction error under an incorrect key, whereas scaling alone has separable row-and-column structure.When relative fine-tuning changes are small, element-wise ratios can approximately reveal row and column scales up to a reciprocal global factor, which cancels during weight recovery.Source: G Role of Householder Transformations… · p. 24

NeurIPS Paper Checklist

  • The authors mark human-subjects review as not applicable, stating that no crowdsourcing or human-subjects research is involved.The checklist answer is N/A for IRB approval or equivalent review.Source: NeurIPS Paper Checklist · p. 30
  • The authors mark LLM usage as not applicable because their workflow and algorithms do not involve LLMs.They state that the core method development does not involve LLMs as an important, original, or non-standard component.Source: NeurIPS Paper Checklist · p. 31

Related papers

Loading 2610.21565v1…