New bilateral key obfuscation secures on-device large language models
BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition
Cryptography and SecurityArtificial Intelligence
Summary
Large language models are increasingly run directly on devices to protect privacy and reduce delays, but their proprietary data can be stolen. Current defenses hide only part of the model’s secret key, which the authors show can be cracked due to a hidden weakness. They introduce BiShield-TEE, a new method that masks both input and output parts of the key, making it much harder for attackers to find the true secret. Their approach keeps the model safe while running faster than previous methods on real devices.
What this means in practice
- •For mobile app developers: Protect proprietary AI models running on users’ devices by implementing bilateral key obfuscation to deter reverse engineering.
- •For hardware security teams: Improve trusted execution environment defenses by jointly obfuscating input and output keys to strengthen protection against model extraction attacks.
- •For automotive system integrators: Secure on-vehicle natural language processing models from intellectual property theft using efficient bilateral obfuscation supported by built-in hardware TEEs.$Commercial implications: Enables selling enhanced vehicle AI protections that prevent costly model reverse engineering by competitors or hackers.
Authors
Zhiyuan Wang, Yuezhi Zhou, Ziqi Zhang, Zhu Zhang, Zhixing Tan, Yongheng Deng
Abstract
On-device deployment of large language models (LLMs) is increasingly adopted due to latency and privacy requirements, but exposes proprietary models to reverse engineering and intellectual property theft. Trusted Execution Environments (TEEs) provide hardware-enforced isolation for on-device inference, yet most TEE-based parameter obfuscation relies on unilateral matrix transformations that obfuscate only output side. We identify a vulnerability in this design, termed the \emph{Solution Determinacy Property (SDP)}: the obfuscation secret is uniquely determined, exposing the structure of the true key and enabling attackers to break the protection. Under our attacks, representative methods \textsc{GroupCover} and \textsc{ArrowCloak} are reduced to negligible protection, with attack accuracy reaching over $2.4\times$ the full-shielding black-box baseline and recovering near-complete model functionality.To address this vulnerability, we propose \textsc{BiShield-TEE}, a bilateral framework that induces \emph{Ambiguous Solutions} through joint obfuscation of input and output dimensions, hiding the true key among many equally valid candidates. Experiments across diverse models and datasets show that \textsc{BiShield-TEE} confines attack accuracy to the full-shielding black-box baseline, while achieving higher inference efficiency than prior methods on real hardware.Our code is available at https://github.com/laduiw/BiShield-TEE.