arXiv cs.AI· Zhiyuan Wang, Yuezhi Zhou, Ziqi Zhang, Zhu Zhang, Zhixing Tan, Yongheng Deng·· 5 小时前AI 评分51
BiShield-TEE 论文揭示端侧 TEE 单侧权重混淆漏洞并提出双侧防御
BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition
AI 导读
论文识别端侧 TEE 保护 LLM 中单侧输出混淆的设计漏洞，提出 Solution Determinacy Property（SDP），使 GroupCover 与 ArrowCloak 等方法防护近乎失效，攻击准确率超过全遮蔽黑盒基线的 2.4 倍。
正文 · 原文
Abstract:On-device deployment of large language models (LLMs) is increasingly adopted due to latency and privacy requirements, but exposes proprietary models to reverse engineering and intellectual property theft. Trusted Execution Environments (TEEs) provide hardware-enforced isolation for on-device inference, yet most TEE-based parameter obfuscation relies on unilateral matrix transformations that obfuscate only the output side. We identify a vulnerability in this design, termed the Solution Determinacy Property (SDP): the obfuscation secret is uniquely determined, exposing the structure of the true key and enabling attackers to break the protection. Under our attacks, representative methods GroupCover and ArrowCloak are reduced to negligible protection, with attack accuracy reaching over 2.4 times the full-shielding black-box baseline and recovering near-complete model functionality. To address this vulnerability, we propose BiShield-TEE, a bilateral framework that induces Ambiguous Solutions through joint obfuscation of input and output dimensions, hiding the true key among many equally valid candidates. Experiments across diverse models and datasets show that BiShield-TEE confines attack accuracy to the full-shielding black-box baseline, while achieving higher inference efficiency than prior methods on real hardware. Our code is available at this https URL.
| Comments: | Accepted at NeurIPS 2026 |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.21565 [cs.CR] |
| (or arXiv:2610.21565v3 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.21565 arXiv-issued DOI via DataCite |
Submission history
From: Zhiyuan Wang [view email]
[v1]
Thu, 15 Oct 2026 09:22:45 UTC (691 KB)
[v2]
Fri, 16 Oct 2026 04:11:40 UTC (691 KB)
[v3]
Thu, 29 Oct 2026 04:31:33 UTC (691 KB)
来源：arXiv cs.AI · arxiv.org