BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition
Unilateral TEE weight obfuscation for on-device LLMs is breakable; BiShield-TEE hides the key among ambiguous solutions.
The paper argues that common TEE protections for on-device LLMs obfuscate only the output side of weight matrices. A Solution Determinacy Property makes the obfuscation secret unique, and attacks reduce GroupCover and ArrowCloak to negligible protection, exceeding 2.4 times the accuracy of a full-shielding black-box baseline and recovering near-complete model functionality. BiShield-TEE obfuscates both input and output dimensions so many keys are equally valid, confining attack accuracy to that baseline while improving inference efficiency on real hardware. Code is released.
- Solution Determinacy Property uniquely determines unilateral obfuscation secrets
- GroupCover and ArrowCloak are reduced to negligible protection
- Attack accuracy exceeds 2.4 times the full-shield black-box baseline
- BiShield-TEE jointly obfuscates input and output dimensions
- The defense matches black-box accuracy with higher inference efficiency
- Products
- GroupCoverArrowCloakBiShield-TEE
From the original article
1 min read at arxiv.orgOn-device deployment of large language models (LLMs) is increasingly adopted due to latency and privacy requirements, but exposes proprietary models to reverse engineering and intellectual property theft.
By Zhiyuan Wang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.