BiShield-TEE 论文指出端侧 TEE 大模型权重混淆方案存在可破解漏洞
BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition
端侧部署大模型的公司值得看：论文证明 GroupCover、ArrowCloak 这类 TEE 权重混淆能被破解，还给出了双向混淆的替代方案和开源代码。
arXiv 论文提出 SDP（Solution Determinacy Property）漏洞：现有 TEE 端侧 LLM 参数混淆只对输出侧做单边矩阵变换，混淆密钥可被唯一确定。攻击使 GroupCover 和 ArrowCloak 两种代表性方法的攻击准确率达到全屏蔽黑盒基线的 2.4 倍以上，可近乎完整恢复模型功能。论文提出 BiShield-TEE 双向框架，通过同时混淆输入和输出维度制造歧义解，将攻击准确率压回全屏蔽黑盒基线水平，并在真实硬件上取得比先前方法更高的推理效率。代码已在 GitHub 开源。
BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition
On-device deployment of large language models (LLMs) is increasingly adopted due to latency and privacy requirements, but exposes proprietary models to reverse engineering and intellectual property theft. Trusted Execution Environments (TEEs) provide hardware-enforced isolation for on-device inference, yet most TEE-based parameter obfuscation relies on unilateral matrix transformations that obfuscate only output side. We identify a vulnerability in this design, termed the \emph{Solution Determinacy Property (SDP)}: the obfuscation secret is uniquely determined, exposing the structure of the true key and enabling attackers to break the protection. Under our attacks, representative methods \textsc{GroupCover} and \textsc{ArrowCloak} are reduced to negligible protection, with attack accuracy reaching over $2.4\times$ the full-shielding black-box baseline and recovering near-complete model functionality.To address this vulnerability, we propose \textsc{BiShield-TEE}, a bilateral framework that induces \emph{Ambiguous Solutions} through joint obfuscation of input and output dimensions, hiding the true key among many equally valid candidates. Experiments across diverse models and datasets show that \textsc{BiShield-TEE} confines attack accuracy to the full-shielding black-box baseline, while achieving higher inference efficiency than prior methods on real hardware.Our code is available at https://github.com/laduiw/BiShield-TEE.
