Research map / Adversarial robustness and security / Attacks on text and graphs
GroupCover: A Secure, Efficient and Scalable Inference Framework for On-device Model Protection based on TEEs
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that existing TEE-shielded GPU-offloading model obfuscation schemes leak weights via statistical analysis, and proposes GroupCover, which clusters dissimilar conv kernels and mixes them with random linear combinations plus shuffling to approach black-box security at 19% overhead.
Problem
Protecting DNN model intellectual property when models are deployed on untrusted user devices that offload linear layers to GPUs from a TEE; existing obfuscation schemes leak weight structure, enabling model stealing.
Approach
Replace fixed or atomic-kernel obfuscation with reverse clustering of convolution kernels by cosine dissimilarity, followed by random linear combination within each cluster and a permutation, so kernels mutually cover each other's statistics while preprocessing stays O(n) additions/subtractions.
Key results
- Statistical attack recovers about 97% of no-shield accuracy on prior TEE obfuscation schemes (NNSplitter 97.8%, ShadowNet 91.8%), roughly 3x the black-box baseline.
- GroupCover's attack gain is about 1.03x the black-box baseline versus about 3x for prior schemes (Table 3 average).
- GroupCover incurs under 19% throughput loss relative to Slalom and an average accuracy loss of 0.013% across tested models.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GROUPCOVER instead of NNSplitter for model obfuscation | AlexNet · CIFAR100 | attack accuracy: 1.3% →56.0% vs 1.0%→24.4% | Helped |
| Use GROUPCOVER instead of NNSplitter for model obfuscation | AlexNet · CIFAR10 | attack accuracy: 10.0% →81.4% vs 11.7%→17.3% | Helped |
| Use GROUPCOVER instead of NNSplitter for model obfuscation | AlexNet · STL10 | attack accuracy: 10.0% →75.5% vs 9.5%→43.6% | Helped |
| Use GROUPCOVER rather than no-shield inference | AlexNet · CIFAR100 | accuracy: 56.31% vs 56.23% | No clear effect |
| Use GROUPCOVER rather than no-shield inference | AlexNet · CIFAR10 | accuracy: 83.96% vs 83.99% | No clear effect |
| Use GROUPCOVER rather than no-shield inference | AlexNet · STL10 | accuracy: 75.36% vs 75.34% | No clear effect |
| Use GROUPCOVER instead of Slalom | AlexNet · CIFAR100 | throughput (samples/sec): 5556 vs 4465 | Hurt |
| Use GROUPCOVER instead of Slalom | AlexNet · CIFAR10 | throughput (samples/sec): 5670 vs 4437 | Hurt |
| Use GROUPCOVER instead of Slalom | AlexNet · STL10 | throughput (samples/sec): 4383 vs 3699 | Hurt |
| Use GROUPCOVER against black-box defense | the model-stealing attack pipeline · CIFAR100 | attack defense effectiveness: p = 0.10 | No clear effect |
| Use GROUPCOVER rather than prior obfuscation schemes | TEE-based inference · model-stealing attacks | defense effectiveness relative to black-box baseline: 1.03× | Helped |
| Add reverse clustering and mutual-covering obfuscation | GROUPCOVER · on-device inference | computational overhead: less than 19% | Hurt |
Surprising findings
- Existing shuffle-and-scale obfuscations (SOTER, ShadowNet) allow public pretrained kernels to recover original kernel indices via cosine similarity, despite appearing to fully randomize weights.
Limitations
- Threat model excludes TEE-specific side-channel attacks.
- Throughput is dominated by TEE-GPU transfer (67.3% of execution time) and the evaluation is limited to CNN image classifiers on small datasets.
- Wilcoxon test p=0.10 is used to claim no significant difference, a weak basis for a strong security equivalence claim.
Experimental setup
Datasets: ImageNet STL10 CIFAR10 CIFAR100
Benchmarks: STL10 CIFAR10 CIFAR100
Metrics: attack accuracy inference accuracy throughput (samples/sec) per-layer latency (ms) coefficient of variation similarity match rate
Baselines: NNSplitter Magnitude SOTER ShadowNet Black-box attack Slalom Darknight No-shield
Builds on: Slalom ShadowNet SOTER NNSplitter Magnitude
Closest papers by meaning
- BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition (NeurIPS 2026 · similarity 0.88)
- LoRO: Real-Time on-Device Secure Inference for LLMs via TEE-Based Low Rank Obfuscation (NeurIPS 2025 · similarity 0.87)
- CoreGuard: Safeguarding Foundational Capabilities of LLMs Against Model Stealing in Edge Deployment (NeurIPS 2025 · similarity 0.83)
- GSE: Group-wise Sparse and Explainable Adversarial Attacks (ICLR 2025 · similarity 0.82)
- Disparate Impact on Group Accuracy of Linearization for Private Inference (ICML 2024 · similarity 0.82)
- TensorCommitments: A Lightweight Verifiable Inference for Large Language Models (NeurIPS 2026 · similarity 0.81)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.