Research map / Adversarial robustness and security / Black-box and transfer attacks

BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition

NeurIPS 2026 · Adversarial robustness and security › Black-box and transfer attacks · approach: Data-free substitute training

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that unilateral TEE weight-obfuscation schemes (GroupCover, ArrowCloak) leak their secret via a "Solution Determinacy Property" and proposes BiShield-TEE, a bilateral input-output Householder-plus-diagonal obfuscation that makes key recovery ambiguous and reduces attacks to black-box level with lower latency.

Problem

On-device LLM and vision models protected by TEE-based partitioned execution with unilateral weight obfuscation can be reverse-engineered by white-box adversaries who recover the secret transformation from the pretrained checkpoint and the obfuscated weights.

Approach

Identifies the Solution Determinacy Property: least-squares estimation of the secret right-side transform from public pretrained weights leaks its structure. Proposes bilateral obfuscation (scale-plus-Householder on both sides of W) so the true key pair is one of many indistinguishable solutions, implicitly canceling across layers.

Key results

• Attacks on GroupCover and ArrowCloak raise attack accuracy to an average 2.44x the black-box baseline, close to the white-box bound of 2.49x.
• BiShield-TEE reduces the strongest adaptive attack to an average Rel. Black of 1.00x across all models and datasets, and preserves original accuracy exactly (e.g., GSM8K 35.5% for Llama3.2-1B).
• On Intel SGX, BiShield-TEE averages 1.70x and 1.46x lower end-to-end latency than GroupCover and ArrowCloak respectively.

Surprising findings

• Input-only and output-only adaptive attacks on Llama models produce incoherent outputs (0% on GSM8K and IFEval), while joint recovery barely improves on parameter substitution.
• Scaled-up fine-tuning deviations up to alpha of about 2 (CKA around 0.5-0.6) still leave the attacks effective, so attacks tolerate substantial divergence from the pretrained model.

Limitations

• Real-device evaluation is limited to Intel SGX; ArmTrustZone and other TEEs are untested.
• Does not support quantized (INT8/INT4) inference.
• Side-channel attacks against the TEE are not considered.

Experimental setup

Datasets: CIFAR-10 CIFAR-100 Food-101 SST-2 QQP QNLI MNLI GLUE GSM8K IFEval

Benchmarks: CIFAR-10 CIFAR-100 Food-101 SST-2 QQP QNLI MNLI GSM8K IFEval

Metrics: attack accuracy Rel. Black ratio end-to-end inference latency (ms) TEE key footprint (MiB)

Baselines: GroupCover ArrowCloak TLG black-box baseline (pre-trained substitution) white-box baseline

Builds on: GroupCover ArrowCloak ShadowNet one-time pad protection

Closest papers by meaning

• GroupCover: A Secure, Efficient and Scalable Inference Framework for On-device Model Protection based on TEEs (ICML 2024 · similarity 0.88)
• CoreGuard: Safeguarding Foundational Capabilities of LLMs Against Model Stealing in Edge Deployment (NeurIPS 2025 · similarity 0.87)
• Tamper-Resistant Safeguards for Open-Weight LLMs (ICLR 2025 · similarity 0.86)
• SilentStriker: Toward Stealthy Bit-Flip Attacks on Large Language Models (NeurIPS 2025 · similarity 0.85)
• Hidden No More: Attacking and Defending Private Third-Party LLM Inference (ICML 2025 · similarity 0.85)
• Bits Leaked per Query: Information-Theoretic Bounds for Adversarial Attacks on LLMs (NeurIPS 2025 · similarity 0.85)