{"id":"https://openalex.org/W7204671228","doi":null,"title":"Beyond Vector Hiding: Breaking and Mitigating Shared-Direction Weight Obfuscation in TEE-Offloaded Large Language Models","display_name":"Beyond Vector Hiding: Breaking and Mitigating Shared-Direction Weight Obfuscation in TEE-Offloaded Large Language Models","publication_year":2026,"publication_date":"2026-08-27","ids":{"openalex":"https://openalex.org/W7204671228"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.26651","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.26651","pdf_url":"https://arxiv.org/pdf/2608.26651","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-sa","license_id":"https://openalex.org/licenses/cc-by-nc-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.26651","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5148607347","display_name":"Menghui Zhang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I154099455","display_name":"Shandong University","ror":"https://ror.org/0207yh398","country_code":"CN","type":"education","lineage":["https://openalex.org/I154099455"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhang, Menghui","raw_affiliation_strings":["School of Cyber Science and Technology , Shandong University , Qingdao , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology , Shandong University , Qingdao , China","institution_ids":["https://openalex.org/I154099455"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112997120","display_name":"Aoying Zheng","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I154099455","display_name":"Shandong University","ror":"https://ror.org/0207yh398","country_code":"CN","type":"education","lineage":["https://openalex.org/I154099455"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zheng, Aoying","raw_affiliation_strings":["School of Cyber Science and Technology , Shandong University , Qingdao , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology , Shandong University , Qingdao , China","institution_ids":["https://openalex.org/I154099455"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091811638","display_name":"Guoxiao Liu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Liu, Guoxiao","raw_affiliation_strings":["Tsinghua University , Beijing , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University , Beijing , China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077248797","display_name":"Zizhuang Deng","orcid":"https://orcid.org/0000-0001-7240-9268","observed_orcids":["https://orcid.org/0000-0001-7240-9268"]},"institutions":[{"id":"https://openalex.org/I154099455","display_name":"Shandong University","ror":"https://ror.org/0207yh398","country_code":"CN","type":"education","lineage":["https://openalex.org/I154099455"]},{"id":"https://openalex.org/I4210125878","display_name":"Suzhou Research Institute","ror":"https://ror.org/03ebk0c60","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210125878"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Deng, Zizhuang","raw_affiliation_strings":["School of Cyber Science and Technology , Shandong University , Qingdao , China","Suzhou Research Institute of Shandong University , Suzhou , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology , Shandong University , Qingdao , China","institution_ids":["https://openalex.org/I154099455"]},{"raw_affiliation_string":"Suzhou Research Institute of Shandong University , Suzhou , China","institution_ids":["https://openalex.org/I154099455","https://openalex.org/I4210125878"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101564790","display_name":"Jiejing Wen","orcid":"https://orcid.org/0000-0001-8252-3881","observed_orcids":["https://orcid.org/0000-0001-8252-3881"]},"institutions":[{"id":"https://openalex.org/I154099455","display_name":"Shandong University","ror":"https://ror.org/0207yh398","country_code":"CN","type":"education","lineage":["https://openalex.org/I154099455"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wen, Jiejing","raw_affiliation_strings":["School of Cyber Science and Technology , Shandong University , Qingdao , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology , Shandong University , Qingdao , China","institution_ids":["https://openalex.org/I154099455"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103179935","display_name":"Jincheng Zhuang","orcid":"https://orcid.org/0000-0003-1159-7597","observed_orcids":["https://orcid.org/0000-0003-1159-7597"]},"institutions":[{"id":"https://openalex.org/I154099455","display_name":"Shandong University","ror":"https://ror.org/0207yh398","country_code":"CN","type":"education","lineage":["https://openalex.org/I154099455"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhuang, Jincheng","raw_affiliation_strings":["School of Cyber Science and Technology , Shandong University , Qingdao , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology , Shandong University , Qingdao , China","institution_ids":["https://openalex.org/I154099455"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5148611618","display_name":"Ran Tao","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I154099455","display_name":"Shandong University","ror":"https://ror.org/0207yh398","country_code":"CN","type":"education","lineage":["https://openalex.org/I154099455"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tao, Ran","raw_affiliation_strings":["School of Cyber Science and Technology , Shandong University , Qingdao , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology , Shandong University , Qingdao , China","institution_ids":["https://openalex.org/I154099455"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9369999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9369999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.029600000008940697,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.015300000086426735,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/trusted-execution-environment","display_name":"trusted execution environments","score":0.8109999895095825},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9309999942779541},{"id":"https://openalex.org/keywords/on-device-inference","display_name":"on-device inference","score":0.6690000295639038},{"id":"https://openalex.org/keywords/lattice-attacks","display_name":"lattice-based attacks","score":0.5130000114440918}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7267000079154968},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.6862999796867371},{"id":"https://openalex.org/C54732982","wikidata":"https://www.wikidata.org/wiki/Q1415345","display_name":"Modulo","level":2,"score":0.5613999962806702},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5583999752998352},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.538100004196167},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.5033000111579895},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.49300000071525574},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.4722999930381775},{"id":"https://openalex.org/C49289754","wikidata":"https://www.wikidata.org/wiki/Q2267081","display_name":"Side channel attack","level":3,"score":0.45820000767707825},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.4041999876499176},{"id":"https://openalex.org/C113775141","wikidata":"https://www.wikidata.org/wiki/Q428691","display_name":"Computer engineering","level":1,"score":0.39649999141693115},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.38609999418258667},{"id":"https://openalex.org/C25343380","wikidata":"https://www.wikidata.org/wiki/Q277521","display_name":"Relation (database)","level":2,"score":0.3499000072479248},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3483999967575073},{"id":"https://openalex.org/C2779231336","wikidata":"https://www.wikidata.org/wiki/Q7534724","display_name":"Sketch","level":2,"score":0.34540000557899475},{"id":"https://openalex.org/C187455244","wikidata":"https://www.wikidata.org/wiki/Q942353","display_name":"Boolean function","level":2,"score":0.3400999903678894},{"id":"https://openalex.org/C2778583558","wikidata":"https://www.wikidata.org/wiki/Q771245","display_name":"Code reuse","level":3,"score":0.335099995136261},{"id":"https://openalex.org/C9376300","wikidata":"https://www.wikidata.org/wiki/Q168817","display_name":"Algebraic number","level":2,"score":0.32670000195503235},{"id":"https://openalex.org/C94284585","wikidata":"https://www.wikidata.org/wiki/Q228184","display_name":"Random oracle","level":4,"score":0.3163999915122986},{"id":"https://openalex.org/C120226833","wikidata":"https://www.wikidata.org/wiki/Q5172844","display_name":"Correlation attack","level":4,"score":0.29910001158714294},{"id":"https://openalex.org/C57691317","wikidata":"https://www.wikidata.org/wiki/Q1289248","display_name":"Scalar (mathematics)","level":2,"score":0.29339998960494995},{"id":"https://openalex.org/C111498074","wikidata":"https://www.wikidata.org/wiki/Q173326","display_name":"Formal verification","level":2,"score":0.28769999742507935},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.28769999742507935},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.28130000829696655},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.2775000035762787},{"id":"https://openalex.org/C135598885","wikidata":"https://www.wikidata.org/wiki/Q1366302","display_name":"Row","level":2,"score":0.2671000063419342},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.26600000262260437},{"id":"https://openalex.org/C2779201187","wikidata":"https://www.wikidata.org/wiki/Q2775060","display_name":"Information leakage","level":2,"score":0.2646999955177307},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.2563000023365021}],"mesh":[],"locations_count":1,"locations":[{"id":"pmh:oai:arXiv.org:2608.26651","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.26651","pdf_url":"https://arxiv.org/pdf/2608.26651","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-sa","license_id":"https://openalex.org/licenses/cc-by-nc-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.26651","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.26651","pdf_url":"https://arxiv.org/pdf/2608.26651","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-sa","license_id":"https://openalex.org/licenses/cc-by-nc-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204671228.pdf","grobid_xml":"https://content.openalex.org/works/W7204671228.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7222576604","https://openalex.org/W7204166935","https://openalex.org/W7128692677","https://openalex.org/W7212136445","https://openalex.org/W7134043307","https://openalex.org/W7134207916","https://openalex.org/W7155056753","https://openalex.org/W4406093077","https://openalex.org/W7131426036","https://openalex.org/W7162694432"],"abstract_inverted_index":{"Trusted":[0],"Execution":[1],"Environment":[2],"(TEE)-shielded":[3],"partitioning":[4],"of":[5,53,115,185],"Large":[6],"Language":[7],"Models":[8],"(LLMs)":[9],"accelerates":[10],"on-device":[11],"inference":[12],"by":[13,42,189,193],"offloading":[14],"obfuscated":[15],"linear":[16],"layers":[17],"to":[18],"an":[19],"untrusted":[20],"accelerator":[21],"while":[22,213],"retaining":[23,214],"only":[24],"a":[25,72,199],"small":[26],"correction":[27],"inside":[28],"the":[29,54,76,81,92,108,129,141,162,182,186,206],"TEE.":[30],"However,":[31],"earlier":[32],"lightweight":[33,63],"obfuscation":[34],"schemes":[35],"preserved":[36],"weight-vector":[37],"directions":[38],"and":[39,90,148],"were":[40],"broken":[41],"ArrowMatch.":[43],"To":[44],"defend":[45],"against":[46],"this":[47,69,124,194],"attack,":[48],"ArrowCloak":[49],"injects":[50],"scalar":[51],"multiples":[52],"same":[55],"hidden":[56,143],"direction":[57,208],"into":[58],"all":[59,159],"weight":[60],"vectors,":[61],"enabling":[62],"trusted":[64,216],"correction.":[65],"We":[66,135],"show":[67],"that":[68,204],"reuse":[70,180],"leaves":[71],"rank-one":[73,131,179],"relation":[74,132],"across":[75,158],"complete":[77],"accelerator-visible":[78],"matrix.":[79],"For":[80],"released":[82],"real-valued":[83],"scheme,":[84],"we":[85,196],"propose":[86,137],"SpectralLeak,":[87],"which":[88,139],"estimates":[89],"removes":[91],"shared":[93,178],"component.":[94],"Across":[95],"12":[96],"task":[97,167],"settings,":[98],"its":[99],"surrogates":[100],"achieve":[101],"$87.98\\%$":[102],"mean":[103],"accuracy":[104,168],"versus":[105],"$89.85\\%$":[106],"for":[107],"victims.":[109],"In":[110,145],"our":[111,146,190],"defense-favorable":[112],"mod-$Q$":[113,121],"realization":[114],"ArrowCloak's":[116],"published":[117],"modular":[118],"security":[119],"formulation,":[120],"arithmetic":[122],"suppresses":[123],"spectral":[125],"signal":[126],"but":[127],"retains":[128],"algebraic":[130],"modulo":[133],"$Q$.":[134],"therefore":[136],"LatticeLeak,":[138],"exploits":[140],"resulting":[142],"lattice.":[144],"BERT-Base":[147],"GPT2-Base":[149],"experiments,":[150],"it":[151],"reconstructs":[152],"every":[153],"protected":[154],"fixed-point":[155],"parameter":[156],"exactly;":[157],"evaluated":[160],"architectures,":[161],"reconstructed":[163],"models":[164],"retain":[165],"victim-level":[166],"without":[169],"victim":[170],"queries,":[171],"labels,":[172],"or":[173],"fine-tuning.":[174],"These":[175],"findings":[176],"identify":[177],"as":[181],"root":[183],"cause":[184],"leakage":[187],"exploited":[188],"attacks.":[191],"Guided":[192],"insight,":[195],"design":[197],"ButterflyCloak,":[198],"keyed":[200],"maximal-rank":[201],"butterfly":[202],"mask":[203,211],"replaces":[205],"reused":[207],"with":[209],"distinct":[210],"rows":[212],"fast":[215],"correction...":[217]},"counts_by_year":[],"updated_date":"2026-10-28T10:33:24.094632","created_date":"2026-08-30T00:00:00"}