Research map / Large language models / Instruction and fine-tuning
CoreGuard: Safeguarding Foundational Capabilities of LLMs Against Model Stealing in Edge Deployment
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CoreGuard, which locks edge-deployed LLMs by row-permuting linear-layer weights and uses a propagation protocol so a single TEE authorization per inference propagates through all subsequent layers, protecting foundational capabilities against model-stealing fine-tuning with negligible overhead.
Problem
Proprietary LLMs deployed on edge devices can have weights and architecture extracted, and even partially protected models can be fine-tuned to steal their foundational capabilities; existing TEE-based defenses either leave the backbone exposed or incur heavy TEE-GPU transfer and computation overhea
Approach
Row-permute input-processing layers' weights so they only work on column-permuted inputs (the authorization), then column-permute output-processing layers so the permutation propagates through each transformer layer, requiring only one TEE authorization per inference plus a one-time-pad step in the FFN block.
Key results
- Under full-data fine-tuning model stealing, CoreGuard's relative mean attack accuracy is 1.17x of the black-box upper bound versus 9.58x for no-shield and 8.43x for DarkneTZ.
- CoreGuard's TEE execution overhead is below 1.17e-03% of original FLOPs, versus 2.91%-21.52% for PPTE methods.
- CoreGuard needs 5 TEE-GPU transfer rounds per token, versus 67-448 rounds for ShadowNet/TLG, with transfer volume of about 2e4 KB versus about 1e6 KB for ShadowNet on LLaMA3-8B; accuracy is unchanged (within 0.5%) compared with the original model.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply CoreGuard protection instead of leaving the model unshielded | Qwen2-0.5B, Gemma2-2B, ChatGLM3-6B, and LLaMA3-8B · GSM8k, Spider, PubMedQA, and SQuAD | model-stealing attack accuracy: No-shield relative mean attack accuracy 9.58×; CoreGuard 1.17× | Helped |
| Use CoreGuard rather than Black-box protection | CoreGuard · GSM8k, Spider, PubMedQA, and SQuAD | model-stealing attack accuracy: CoreGuard 1.17×; Black-box 1.00× | Mixed |
| Protect the model with CoreGuard rather than leave it unprotected | Qwen2-0.5B · direct unauthorized inference | accuracy: 0.00 ±0.00 | Helped |
| Apply CoreGuard protection rather than use the original model | CoreGuard-protected models · GSM8k, Spider, PubMedQA, and SQuAD | accuracy: 15.51%/15.50%; 5.56%/5.56%; 15.50%/15.50%; 16.50%/16.50% | No clear effect |
| Put authorization in central layers rather than near the beginning or end (ablation) | CoreGuard · model-stealing attack settings | model-stealing attack accuracy | Helped |
| Use CoreGuard's permutation-matrix simulation attack variant (ablation) | CoreGuard · Qwen2 GSM8k and PubMedQA; Gemma2 Spider and SQuAD; ChatGLM3 GSM8k and PubMedQA; LLaMA3 Spider and SQuAD | model-stealing attack accuracy: 0.00% ±0.00%; 3.50% ±0.52%; 0.00% ±0.00%; 0.00% ±0.00%; 0.00% ±0.00%; 1.00% ±0.76%; 0.00% ±0.00%; 3.18% ±0.61% | No clear effect |
| Use CoreGuard's authorization-simulation attack variant (ablation) | CoreGuard · Qwen2 GSM8k and PubMedQA; Gemma2 Spider and SQuAD; ChatGLM3 GSM8k and PubMedQA; LLaMA3 Spider and SQuAD | model-stealing attack accuracy: 2.72% ±0.61%; 7.00% ±1.66%; 0.00% ±0.00%; 3.51% ±0.15%; 0.00% ±0.00%; 13.50% ±0.58%; 0.00% ±0.00%; 6.81% ±0.72% | Mixed |
Surprising findings
- Simulation attacks that try to learn the permutation matrix or the authorization FFN perform no better than the black-box baseline in the appendix.
- Authorization placed at the first or last layer makes stealing easier, so the midpoint is chosen as the authorization position.
Limitations
- Security relies on TEE as the root of trust, so side-channel attacks remain a risk, which the paper only addresses via possible integration of existing defenses.
- The paper focuses on the core framework without device-specific implementation or real on-device measurements.
- Evaluation covers only four LLMs and four tasks, and attack assumptions use the full training set, with the attacker fine-tuning on the stolen weights.
Experimental setup
Datasets: GSM8k Spider PubMedQA SQuAD
Benchmarks: GSM8k Spider PubMedQA SQuAD
Metrics: accuracy attack accuracy FLOPs transfer volume (KB) transfer rounds
Baselines: No-shield Black-box NPLO DarkneTZ SOTER Serdab ShadowNet TransLinkGuard DTE
Builds on: ShadowNet TransLinkGuard DarkneTZ
Closest papers by meaning
- Tamper-Resistant Safeguards for Open-Weight LLMs (ICLR 2025 · similarity 0.89)
- On Evaluating the Durability of Safeguards for Open-Weight LLMs (ICLR 2025 · similarity 0.88)
- BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition (NeurIPS 2026 · similarity 0.87)
- Safety Layers in Aligned Large Language Models: The Key to LLM Security (ICLR 2025 · similarity 0.87)
- Adaptive Deployment of Untrusted LLMs Reduces Distributed Threats (ICLR 2025 · similarity 0.86)
- On Calibration of LLM-based Guard Models for Reliable Content Moderation (ICLR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.