Search papers, labs, and topics across Lattice.
This paper addresses vulnerabilities in Trusted Execution Environment (TEE) offloaded Large Language Models (LLMs) by breaking existing weight obfuscation methods that preserve weight-vector directions. The authors introduce ArrowCloak, which mitigates these vulnerabilities by injecting scalar multiples into weight vectors, but reveal that this approach still leaves a rank-one relation exploitable by their proposed attacks, SpectralLeak and LatticeLeak. Through extensive experiments, they demonstrate that their methods can accurately reconstruct protected parameters while maintaining high task accuracy, highlighting the critical need for improved obfuscation techniques in secure model deployment.
Shared rank-one weight reuse in TEE-offloaded LLMs can be exploited to reconstruct protected parameters with minimal accuracy loss, challenging existing obfuscation strategies.
Trusted Execution Environment (TEE)-shielded partitioning of Large Language Models (LLMs) accelerates on-device inference by offloading obfuscated linear layers to an untrusted accelerator while retaining only a small correction inside the TEE. However, earlier lightweight obfuscation schemes preserved weight-vector directions and were broken by ArrowMatch. To defend against this attack, ArrowCloak injects scalar multiples of the same hidden direction into all weight vectors, enabling lightweight trusted correction. We show that this reuse leaves a rank-one relation across the complete accelerator-visible matrix. For the released real-valued scheme, we propose SpectralLeak, which estimates and removes the shared component. Across 12 task settings, its surrogates achieve $87.98\%$ mean accuracy versus $89.85\%$ for the victims. In our defense-favorable mod-$Q$ realization of ArrowCloak's published modular security formulation, mod-$Q$ arithmetic suppresses this spectral signal but retains the algebraic rank-one relation modulo $Q$. We therefore propose LatticeLeak, which exploits the resulting hidden lattice. In our BERT-Base and GPT2-Base experiments, it reconstructs every protected fixed-point parameter exactly; across all evaluated architectures, the reconstructed models retain victim-level task accuracy without victim queries, labels, or fine-tuning. These findings identify shared rank-one reuse as the root cause of the leakage exploited by our attacks. Guided by this insight, we design ButterflyCloak, a keyed maximal-rank butterfly mask that replaces the reused direction with distinct mask rows while retaining fast trusted correction...
