This work identifies shared rank-one reuse as the root cause of the leakage exploited by the authors' attacks, and proposes LatticeLeak, which exploits the resulting hidden lattice.
Abstract
Trusted Execution Environment (TEE)-shielded partitioning of Large Language Models (LLMs) accelerates on-device inference by offloading obfuscated linear layers to an untrusted accelerator while retaining only a small correction inside the TEE. However, earlier lightweight obfuscation schemes preserved weight-vector directions and were broken by ArrowMatch. To defend against this attack, ArrowCloak injects scalar multiples of the same hidden direction into all weight vectors, enabling lightweight trusted correction. We show that this reuse leaves a rank-one relation across the complete accelerator-visible matrix. For the released real-valued scheme, we propose SpectralLeak, which estimates and removes the shared component. Across 12 task settings, its surrogates achieve $87.98\%$ mean accuracy versus $89.85\%$ for the victims. In our defense-favorable mod-$Q$ realization of ArrowCloak's published modular security formulation, mod-$Q$ arithmetic suppresses this spectral signal but retains the algebraic rank-one relation modulo $Q$. We therefore propose LatticeLeak, which exploits the resulting hidden lattice. In our BERT-Base and GPT2-Base experiments, it reconstructs every protected fixed-point parameter exactly; across all evaluated architectures, the reconstructed models retain victim-level task accuracy without victim queries, labels, or fine-tuning. These findings identify shared rank-one reuse as the root cause of the leakage exploited by our attacks. Guided by this insight, we design ButterflyCloak, a keyed maximal-rank butterfly mask that replaces the reused direction with distinct mask rows while retaining fast trusted correction...
TEE-shielded inference keeps sensitive state in a trusted execution environment (TEE) while offloading linear algebra to an untrusted accelerator. Wang et al., in Game of Arrows (USENIX Security 2025), showed that five widely adopted lightweight defenses preserve vector directions and introduced ArrowMatch to exploit this leakage. They then proposed ArrowCloak, which adds a different multiple of one shared mask direction to each vector and bases its weight-recovery hardness argument on Learning with Errors (LWE). ArrowCloak successfully reduces ArrowMatch to near-black-box levels. In this paper, we revisit ArrowCloak from cryptographic and structural perspectives. Its LWE formulation does not by itself establish standard LWE hardness: the reduction direction, quantized arithmetic, and joint instance distribution do not meet the required conditions. Reusing one mask direction leaves a recoverable rank-one component across the released matrix. We exploit this structure with our proposed attack, an end-to-end, query-free recovery attack. Given a public checkpoint and the obfuscated weights, the attack removes the masking subspace, recovers the hidden one-to-one correspondence, and reconstructs protected weights without transformation secrets, victim queries, or fine-tuning data. Across six model-task pairs spanning classification, segmentation, and diffusion, the attack recovers 99.92%-100% of hidden vector correspondences. Reconstructed classification models achieve 94.39%-99.54% victim agreement and differ by at most 1.59 percentage points in accuracy; the recovered segmentation model achieves 98.35% output agreement. These findings suggest that lightweight protection should address both per-vector geometry and joint structure across released weights.
Beijie Liu, Junyi Ouyang, Haoxuan Xu et al.· 1 citation
While Large Language Models (LLMs) have gained remarkable success, they are consistently at risk of being stolen when deployed on untrusted edge devices. As a solution, TEE-based secure inference has been proposed to protect valuable model property. However, we identify a statistical vulnerability in existing protection methods, and furtherly compromise their security guarantees by proposed Model Stealing Attack with Prior. To eliminate this vulnerability, LoRO is presented in this paper, which leverages dense mask to completely obfuscate parameters. LoRO includes two innovations: (1) Low Rank Mask, which uses low-rank factors to generate dense masks efficiently. The computing complexity in TEE is hence reduced by an exponential amount to achieve inference speed up, while providing robust model confidentiality. (2) Factors Multiplexing, which reuses several cornerstone factors to generate masks for all layers. Compared to one-mask-per-layer, the secure memory requirement is reduced from GB-level to tens of MB, hence avoiding the hundred-fold latency introduced by secure memory paging. Experimental results indicate that LoRO achieve a 0 . 94 × Model Stealing (MS) accuracy, while SOTA methods presents 3 . 37 × at least. The averaged inference latency of LoRO is only 1 . 49 × , compared to the 112 × of TEE-shielded inference. Moreover, LoRO results no accuracy loss, and requires no re-training and structure modification. LoRO can solve the concerns regarding model thefts on edge devices in an efficient and secure manner, facilitating the wide edge application of LLMs.
Gaojian Xiong, Yu Sun, Jianhua Liu et al.· Advances in Neural Informati...· 5 citations
: The rapid adoption of dynamic Payload Managers enables portable, platform-agnostic execution across the cloud/edge continuum. However, these complex execution layers, even when embedded within a Trusted Ex-ecution Environment (TEE), significantly expand the attack surface of the Trusted Computing Base (TCB). Existing layered attestation schemes typically combat this using static, load-time measurements of payloads. Yet, recent vulnerabilities demonstrate that static checks are insufficient to prevent attackers from gaining privileged execution rights while avoiding detection. Slice and Dice proposes a layered attestation architecture for 3-layer systems, in which a minimal and highly privileged programmable firmware layer (Layer 0) continuously performs dynamic memory introspection on the untrusted Payload Manager layer (Layer 1). By inspecting ELF segments during execution, the firmware can detect code modifications in real-time. To complete the cycle of Remote Attestation (RA) and provide evidence to an external verifier in a privacy-preserving manner, we couple the introspection mechanism with Zero-Knowledge Proofs (ZKP) utilizing BBS anonymous credentials.
Nikolaos Varvitsiotis, Stefanos Vasileiadis, Sofia-Anna Menesidou et al.· Proceedings of the 23rd Inte...· 0 citations
The integration of Large Language Models (LLMs) into Integrated Development Environments (IDEs) introduces a critical vulnerability to indirect Prompt Injection Attacks (PIAs). State-of-the-art coding models, such as Qwen-2.5-Coder, often embed malicious payloads within project configuration rules, resulting in alarmingly high Attack Success Rates (ASR) that compromise local developer environments. To mitigate this threat, this paper proposes IDE-Sanitizer, a preventive, dualmodel defense framework that establishes a zero-trust execution boundary. By combining an HMAC-SHA256 cryptographic state verifier with an air-gapped semantic gate (Llama-3-8B), IDESanitizer decouples intent classification from code generation, preventing attackers from overriding system guardrails. Extensive evaluations across diverse programming frameworks demonstrate that our approach achieves strong robustness, which reduces the ASR to near 0.0% against severe sabotage and exfiltration vectors, while maintaining a near 0.0% False Positive Rate (FPR) on benign workflows. Furthermore, by preemptively blocking malicious payloads before they reach the core generator, IDE-Sanitizer avoids computationally expensive inference loops, reducing average generation latency on adversarial inputs by 89.6%. Ultimately, this architecture offers a secure, efficient, and scalable solution for safeguarding LLM-assisted development cycles.
E. Nkoro, Weixian Liao, Cheng Qian et al.· International Conference on...· 0 citations
Large language models (LLMs) are becoming increasingly integrated into mainstream development platforms and daily technological workflows, typically behind moderation and safety controls. Despite these controls, preventing prompt-based policy evasion remains challenging, and adversaries continue to"jailbreak"LLMs by crafting prompts that circumvent implemented safety mechanisms. Prior work has established cipher-mediated interaction, code-embedded decryption, prompt decomposition and reconstruction, and layered custom encryption as viable attack primitives. However, reported evaluations generally collapse visible acceptance, successful recovery of the concealed request, and subsequent execution into an aggregate attack-success outcome. This leaves limited evidence about where multistage prompt-transformation attacks fail within an observable black-box interaction. This paper introduces RoguePrompt, a jailbreak pipeline that partitions a forbidden prompt and applies two nested encodings, Vigenere followed by ROT13, along with natural-language reconstruction instructions. RoguePrompt was developed and evaluated under a black-box threat model, with only API or user-interface access to the hosted models, and was tested on 313 real-world, hard-rejected prompts. Success was measured in terms of moderation bypass, instruction reconstruction, and execution when the relevant stage exceeded its automated criterion. RoguePrompt achieved average rates of 93.93% for filter bypass, 79.02% for reconstruction, and 70.18% for execution. These results demonstrate the effectiveness of layered prompt encoding while providing stage-level evidence of where multistage jailbreaks fail during moderation bypass, instruction reconstruction, and execution.
Benchmarks for systems that are optimized against the evaluation signal measure something different from what they claim. We document this concretely in two GPU-kernel-optimization suites with held-out generalization gates: Metal-Sci (10 scientific-compute tasks) and Metal-ZK (12 zero-knowledge/cryptographic tasks), in which three frontier LLMs (Opus 4.7, Gemini 3.1 Pro, GPT-5.5) propose Metal kernels inside a $(1{+}1)$ evolutionary loop with rich feedback. Although no model is prompted to act adversarially, the promoted winners repeatedly fingerprint the evaluation configuration: they branch on the identity of runtime parameters, tune the measured branch maximally, and leave the unmeasured branch slow or silently wrong. Across the pooled suites, $16/53$ ($30\%$) of in-distribution wins fail to transfer to held-out configurations. We give a four-mode taxonomy of these failures, from configuration fingerprints to gate leakage. We distill design guidance for measurement under strategic optimization: held-out probes retain validity only on non-enumerable axes; gates must measure held-out performance, not just correctness; and a transfer rate is interpretable only with per-failure mechanism grades: ours decomposes into gamed, overfit, and benign. Code and research artifacts: https://github.com/vicgalle/kernel-fingerprinting