BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition

Zhiyuan Wang; Yuezhi Zhou; Ziqi Zhang; Zhu Zhang; Zhixing Tan; Yongheng Deng

cs.CROct 15, 2026

BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition

Authors: Zhiyuan Wang, Yuezhi Zhou, Ziqi Zhang, Zhu Zhang, Zhixing Tan, Yongheng Deng

Organizations: Department of Computer Science and Technology, Beijing National Research Center for Information Science and Technology, Tsinghua University, Beijing, China · Zhongguancun Laboratory, Beijing, China · University of Illinois Urbana-Champaign, IL, USA

Abstract

On-device deployment of large language models (LLMs) is increasingly adopted due to latency and privacy requirements, but exposes proprietary models to reverse engineering and intellectual property theft. Trusted Execution Environments (TEEs) provide hardware-enforced isolation for on-device inference, yet most TEE-based parameter obfuscation relies on unilateral matrix transformations that obfuscate only the output side. We identify a vulnerability in this design, termed the Solution Determinacy Property (SDP): the obfuscation secret is uniquely determined, exposing the structure of the true key and enabling attackers to break the protection. Under our attacks, representative methods GroupCover and ArrowCloak are reduced to negligible protection, with attack accuracy reaching over 2.4 times the full-shielding black-box baseline and recovering near-complete model functionality. To address this vulnerability, we propose BiShield-TEE, a bilateral framework that induces Ambiguous Solutions through joint obfuscation of input and output dimensions, hiding the true key among many equally valid candidates. Experiments across diverse models and datasets show that BiShield-TEE confines attack accuracy to the full-shielding black-box baseline, while achieving higher inference efficiency than prior methods on real hardware. Our code is available at https://github.com/laduiw/BiShield-TEE.

Figures & tables

Paradigm	Method	Venue	Mechanism	SDP-free
Unilateral Per-vector	SOTER Shen et al. (2022)	ATC’22	Per-vector scaling	✗
	ShadowNet Sun et al. (2023)	S&P’23	Per-vector scaling + permutation	✗
	TLG Li et al. (2024)	MM’24	Per-vector permutation	✗
	TSQP Sun et al. (2025b)	S&P’25	Quantized per-vector scaling	✗
Unilateral mul.	GroupCover Zhang et al. (2024a)	ICML’24	Group columns, mix within group	✗
Unilateral add.	ArrowCloak Wang et al. (2025)	USENIX Sec’25	Add shared mask to all columns	✗

Table 1: Comparative analysis of TEE-based weight obfuscation schemes.

Figure 1: Comparison of unilateral and bilateral obfuscation.

Figure 2: Attacks against unilateral model protection schemes. (a) Attack on GroupCover . Step G1 recovers the block-diagonal grouping from $\hat{\mathbf{T}}$ . Step G2 reconstructs $\mathbf{W}_{\text{vic}}$ within each group. (b) Attack on ArrowCloak . Step A1 extracts the shared mask direction via PCA. Step A2 denoises $\mathbf{W}_{\text{obf}}$ via orthogonal projection. Step A3 restores $\mathbf{W}_{\text{vic}}$ via least-squares reconstruction.

Figure 3: Overview of BiShield-TEE for self-attention layers.

Model	Dataset	TLG		GroupCover		ArrowCloak		White-box		Black-box
Model	Dataset	Our Attack	Rel. Black	Our Attack	Rel. Black	Our Attack	Rel. Black	Acc.	Rel. Black	Black-box
ViT-Base	CIFAR-10	98.4%	$1.55\times$	98.4%	$1.55\times$	98.5%	$1.55\times$	98.1%	$1.55\times$	63.4%
	CIFAR-100	90.5%	$1.52\times$	90.6%	$1.52\times$	90.0%	$1.51\times$	90.9%	$1.52\times$	59.7%
	FOOD-101	87.9%	$1.49\times$	85.6%	$1.45\times$	84.9%	$1.43\times$	83.4%	$1.41\times$	59.2%
ViT-Large	CIFAR-100	91.8%	$1.33\times$	91.8%	$1.33\times$	91.1%	$1.32\times$	91.6%	$1.33\times$	68.8%
ViT-Large	FOOD-101	88.9%	$1.36\times$	86.9%	$1.33\times$	85.9%	$1.32\times$	85.5%	$1.31\times$	65.3%

Table 2: Attack performance against unilateral defenses. We report our attack accuracy and its ratio to the black-box baseline (Rel. Black). Higher values indicate failed protection (closer to no-shield white-box); lower values indicate effective defense (closer to full-shielding black-box).

Figure 4: Attack accuracy vs. the number of protected layers on ViT-Base and GPT2-Base.

Table 7

Setting	ViT-Base			ViT-Large		GPT2-Base				Llama3.2-1B		Llama3.2-3B
Setting	C10	C100	F101	C100	F101	SST2	QQP	QNLI	MNLI	GSM8K	IFEVAL	GSM8K	IFEVAL
Original	98.1%	90.9%	83.4%	91.6%	85.5%	92.4%	88.1%	86.7%	80.8%	35.5%	54.6%	64.4%	73.5%
Obfuscated	98.1%	90.9%	83.4%	91.6%	85.5%	92.4%	88.1%	86.7%	80.8%	35.5%	54.6%	64.4%	73.5%

Table 5: Authorized utility of BiShield-TEE . “Original” is the unprotected fine-tuned victim; “Obfuscated” is the same model under bilateral obfuscation.

Scheme	ViT-Base	ViT-Large	GPT2-Base	Llama3.2-1B	Llama3.2-3B	Mean Ratio
GroupCover	$1667.97\pm 14.58$	$4770.45\pm 30.74$	$1028.13\pm 2.29$	$3995.28\pm 13.06$	$9848.23\pm 74.23$	$1.70\times$
ArrowCloak	$1427.14\pm 2.35$	$4234.46\pm 21.99$	$853.99\pm 1.47$	$3386.38\pm 24.31$	$8441.53\pm 32.54$	$1.46\times$
BiShield-TEE	$\mathbf{1073.74\pm 11.24}$	$\mathbf{2918.47\pm 10.16}$	$\mathbf{624.04\pm 11.54}$	$\mathbf{2272.86\pm 21.10}$	$\mathbf{5148.10\pm 7.22}$	$\mathbf{1.00\times}$

Table 6: End-to-end inference latency (ms) across obfuscation schemes. “Mean Ratio” is the average slowdown relative to BiShield-TEE across all models.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 5 — Figure 5: Diagnostic visualization of unilateral obfuscation leakage.

Modality	Dataset	Victim Train	Surrogate Train	Ratio
Vision	CIFAR-10	50,000	20	0.04%
	CIFAR-100	50,000	200	0.40%
	Food-101	75,750	379	0.50%
Language	SST-2	67,349	134	0.20%
	QQP	363,846	181	0.05%
	QNLI	104,743	273	0.26%

Appendix

Table 7: Dataset statistics. Victim Train is the size of the dataset used for victim fine-tuning; Surrogate Train is the size of the query-answer set used to retrain the surrogate’s classification head.

Stage	Model	Learning Rate	Batch Size	Epochs
Victim	ViT-Base	$1\times 10^{-4}$	128	5
	ViT-Large	$1\times 10^{-4}$	128	3
	GPT2-Base	$2\times 10^{-5}$	128	3
Surrogate	ViT	$\{2,5,8\}\times 10^{-4},\,1\times 10^{-3}$	32	10
Surrogate	GPT2-Base	$\{2,5,8\}\times 10^{-4},\,1\times 10^{-3}$	16	10

Appendix

Table 8: Training hyperparameters for victim fine-tuning and surrogate classification-head retraining. All experiments use the AdamW optimizer with gradient accumulation steps set to

1

. For the surrogate, the learning rate is selected via grid search.

Model	Batch Size $B$	Sequence Length $l$
ViT-Base	1	197
ViT-Large	1	197
GPT2-Base	2	64
Llama3.2-1B	2	64
Llama3.2-3B	2	64

Appendix

Table 9: Input configurations for end-to-end inference latency measurement.

Scheme	ViT-Base	ViT-Large	GPT2-Base	Llama3.2-1B	Llama3.2-3B
GroupCover	3.80	10.13	3.80	11.25	24.94
ArrowCloak	2.53	6.75	2.53	7.69	17.06
BiShield-TEE	2.06	5.39	2.00	6.33	14.03

Appendix

Table 10: TEE-resident transformation-key footprint (MiB). Lower is better.

Figure 6: Attack and victim accuracy (left), and victim–pre-trained CKA similarity (right), as functions of the fine-tuning scale

\alpha

on ViT-Base / CIFAR-100. The shaded region marks the effective attack regime (

\alpha\leq 2

). Attack accuracy tracks the victim’s own accuracy closely across the full range, even when CKA has dropped substantially.

Model	Dataset	Black-box	H-only		Scale+H
Model	Dataset	Acc.	Acc.	Rel. Black	Acc.	Rel. Black
ViT-Base	CIFAR-10	63.4%	68.11%	$1.07\times$	63.6%	$1.00\times$
	CIFAR-100	59.7%	72.62%	$1.22\times$	59.7%	$1.00\times$
	Food-101	59.2%	68.96%	$1.16\times$	59.2%	$1.00\times$
ViT-Large	CIFAR-100	68.8%	81.23%	$1.18\times$	68.8%	$1.00\times$
	Food-101	65.3%	74.90%	$1.15\times$	65.3%	$1.00\times$

Appendix

Table 11: Ablation of diagonal scaling. “H-only” uses bilateral Householder transformations without scaling. “Scale+H” is the complete BiShield-TEE design.

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 319 papers

Good-Enough LLM Obfuscation (GELO)
Mar 5, 2026Anatoly Belikov, Ilya FedotovPrivacy-Preserving Language Models LLM Security
SingularityNET Foundation, Baarerstrasse 141, Zug, 6300, Switzerland · Singularity Compute
SpliTEE: Fast and Private LLM Inference by Coupling GPU-Assisted Trusted Execution Environments with Differential Privacy
Sep 14, 2026Shashie Dilhara Batan Arachchige, Robin Carpentier, Hassan Jameel Asghar +1Privacy-Preserving Language Models Split Inference
School of Computing, Macquarie University
Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environments
Feb 23, 2026Kunal Mukherjee, Spandan MukherjeeLLMs for Cybersecurity LLM Red Teaming
Virginia Tech Blacksburg, Virginia, USA · The University of Texas at Dallas Richardson, Texas, USA

Mar 5, 2026J/K move · Enter open · S save

Good-Enough LLM Obfuscation (GELO)

Anatoly Belikov, Ilya Fedotov

SingularityNET Foundation, Baarerstrasse 141, Zug, 6300, Switzerland · Singularity Compute

Privacy-Preserving Language Models LLM Security Privacy Leakage in Language Models

Open paper AskPDF arXiv

Large Language Models (LLMs) are increasingly served on shared accelerators where an adversary with read access to device memory can observe KV caches and hidden states, threatening prompt privacy for open-source models. Cryptographic protections such as MPC and FHE offer strong guarantees but remain one to two orders of magnitude too slow for interactive inference, while static obfuscation schemes break under multi-run statistical attacks once the model is known. We present GELO (Good-Enough LLM Obfuscation), a lightweight protocol for privacy-preserving inference that limits information leakage from untrusted accelerator observations by hiding hidden states with fresh, per-batch invertible mixing. For each offloaded projection, the TEE samples a random matrix

A

, forms

U = AH

, offloads

U

and weights W to the accelerator, and then applies

A^{-1}

on return, so that

A^{-1}((AH)W ) = HW

and outputs are unchanged. Because mixing is never reused across batches, the attacker faces only a single-batch blind source separation problem. We analyse information leakage and introduce two practical defences: (i) non-orthogonal mixing to mask Gram matrices, and (ii) orthogonal mixing augmented with a small fraction of high-energy "shield" vectors that pollute higher-order statistics. On Llama-2 7B, GELO preserves float32 outputs exactly, closely matches low-precision baselines, and shows about

20

30\%

compute-side overhead in a controlled offload microbenchmark; an unoptimized remote prototype is dominated by transport overhead, motivating deeper serving-engine integration. GELO resists ICA/BSS and anchor-assisted attacks; a 60M-parameter transformer-based unmixing attack also fails under strong mixing and shielding.

Abstract

LLM Security

Explore similar work

Good-Enough LLM Obfuscation (GELO)

SpliTEE: Fast and Private LLM Inference by Coupling GPU-Assisted Trusted Execution Environments with Differential Privacy

Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environments