BiShield-TEE reveals a weight obfuscation vulnerability in on-device TEE.
Start here
An arXiv paper released on October 15, 2026 provides a security analysis of one-sided weight obfuscation methods in on-device TEE-protected LLM inference, pointing out a solution-determinacy (SDP) vulnerability: the obfuscation key can be uniquely determined, and an attacker can use this to break the protection and recover model functionality. The authors state that under this attack, the protection effects of two representative methods, GroupCover and ArrowCloak, are reduced to negligible levels, and the attack accuracy exceeds 2.4 times that of the fully masked black-box baseline. To this end, the authors propose BiShield-TEE, which jointly obfuscates input and output dimensions to create ambiguous solutions, limiting attack accuracy to the level of the fully masked black-box baseline, and achieving better protection performance than existing methods on real hardware.
Generated by AI from reports · Updated 28 days ago
Attention and developments
Attention, hourly
Now 35, 0% in 24 hours·Peak 35 (Nov 6 03:00)
Related research
This event's paper
- BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition
arXiv · 2026-10-15 · Deep reading
Progress timeline
- arXivBiShield-TEE: Security Analysis of One-Sided Weight Obfuscation in On-Device TEE-Protected LLM Partitioning
The paper points out that in on-device TEE-protected LLM inference, one-sided weight obfuscation has a de-determination (SDP) vulnerability: the obfuscation key can be uniquely determined, and an attacker can exploit this to break the protection and recover model functionality. The authors state that under this attack, the protection of two representative methods, GroupCover and ArrowCloak, is reduced to negligible levels, with attack accuracy exceeding 2.4 times that of the fully masked black-box baseline. To address this, the authors propose BiShield-TEE, which jointly obfuscates input and output dimensions to create ambiguous solutions, limiting attack accuracy to the level of the fully masked black-box baseline, and achieves higher inference efficiency than existing methods on real hardware. The code has been open-sourced on GitHub.