Vulnerabilities in Partial TEE-Shielded LLM Inference with Precomputed Noise

Abstract: The deployment of LLMs on third-party devices requires new ways to protect model intellectual property. While Trusted Execution Environments (TEEs) offer a promising solution, their performance limits can lead to a critical compromise: using a precomputed, static secret basis to accelerate cryptographic operations. We demonstrate that this mainstream design pattern introduces a classic cryptographic flaw, the reuse of secret keying material, into the system's protocol. We prove its vulnerability with two distinct attacks: First, our attack on a model confidentiality system achieves a full confidentiality break by recovering its secret permutations and model weights. Second, our integrity attack completely bypasses the integrity checks of systems like Soter and TSQP. We demonstrate the practicality of our attacks against state-of-the-art LLMs, recovering a layer's secrets from a LLaMA-3 8B model in about 6 minutes and showing the attack scales to compromise 405B-parameter LLMs across a variety of configurations.

• The paper demonstrates that precomputing a static noise basis for TEE-shielded execution permits complete model extraction via algebraic attacks.
• It details a three-step attack leveraging subspace recovery, noise filtering, and permutation mapping to bypass confidentiality and integrity mechanisms.
• Empirical results show deterministic, 100% success in recovering LLM secrets, highlighting the trade-off between computational efficiency and cryptographic security.

Vulnerabilities in Partial TEE-Shielded LLM Inference with Precomputed Noise

Introduction and Background

Modern deployment strategies for LLMs increasingly favor execution on third-party and edge devices to meet demands for privacy, responsiveness, and scalability. This architectural shift creates urgent requirements for IP protection, motivating techniques to shield proprietary models against theft or tampering when executed outside the provider's direct control. Trusted Execution Environments (TEEs) have been widely adopted to mediate the tension between security and performance during local execution, but their constraints force the adoption of so-called Partial TEE-Shielded Execution (PTSE) protocols. PTSE approaches offload computationally heavy operations to untrusted accelerators (GPUs), while TEEs coordinate sensitive cryptographic operations—most notably, noise-based obfuscation or integrity fingerprints.

Hardware capabilities across TEEs (Intel SGX/TDX, AMD SEV, ARM TrustZone/CCA, NVIDIA Hopper Confidential Computing) are rapidly progressing, and confidential computing architectures have become more sophisticated, but offloading remains necessary for scalable real-world deployment [zhu_confidential_2024, abdollahi_early_2025, siby_guarantee_2024, dong_evaluating_2025]. The dominant protocol pattern is a three-step mask-offload-restore cycle, in which TEEs apply cryptographic masks or generate fingerprint challenges, the GPU executes the linear algebra, and results are decoded or checked against known answers. This workflow imposes a tension: generating and processing random noise must be not only secure but also computationally and memory efficient.

The Static Basis Precomputation Design and its Consequences

Due to the severe memory and performance limitations of TEEs—especially on edge and consumer devices—the generation of truly random masks or integrity fingerprints using on-the-fly matrix multiplications is typically infeasible for LLMs with tens to hundreds of billions of parameters. The workaround is to precompute a small, fixed basis of $K$ secret noise vectors (or fingerprints) and corresponding outputs at system initialization. Each runtime mask or fingerprint is then synthesized by combining these precomputed vectors using freshly sampled random coefficients; the masked data are always confined to the $K$-dimensional linear subspace spanned by this static basis.

This static basis design, while a pragmatic choice that solves latency and memory bottlenecks, is a classical cryptographic flaw reminiscent of key reuse, and is routinely adopted in state-of-the-art schemes for both model confidentiality (e.g., TLG [li_translinkguard_2024], SLIP [refael_slip_2024], ShadowNet [sun_shadownet_2023]) and computational integrity (Soter [shen_soter_2022], TSQP [sun_tsqp_2025]) [see Table and citations].

Figure 1: Activation flow in a Llama transformer layer secured using TLG, highlighting the mask-offload-restore protocol.

Attack Formalization: Confidentiality and Integrity Compromise

The central vulnerability is that all runtime masks or integrity fingerprints reside in a low-dimensional, algebraically predictable subspace, enabling adversaries to collect sufficient output samples and reconstruct the basis via linear algebra.

Model Confidentiality Attack

The attack on protocols like TLG proceeds as follows:

1. Subspace Recovery: By issuing zero-vector queries through the encryption API, the attacker collects $K+\delta$ independent masked outputs, from which the $K$-dimensional mask subspace can be reconstructed via Gram-Schmidt orthonormalization.
2. Noise Filtering: Once the basis is known, the attacker computes a projection matrix that cancels mask components, isolating the true signal from a mapping query.
3. Permutation Recovery: By sequentially querying the encryption API with canonical basis vectors, each output reveals the corresponding permutation mapping for the secured layer.

This process is repeated across all layers, enabling the full recovery of layer-wise secret permutations, locked weights, and the original model itself with perfect fidelity (see evaluation section for practical timings).

Figure 2: Illustration of the two-stage attack to reveal layer-specific secret permutations from the TEE-secured protocol in TLG.

Computational Integrity Attack

Integrity-checking systems like Soter inject fingerprint challenges derived from linear combinations of $K$ static cornerstone vectors. Adversaries can recover the secret fingerprint basis by intersecting the vector spaces formed by batches of outputs from the TEE-GPU interface, then accurately identify and bypass integrity challenges in future queries—undetectably tampering with genuine computations while feeding correct results to integrity checks.

Figure 3: Two-stage computation integrity attack on Soter: (1) subspace recovery by intersection, (2) targeted integrity bypass on future queries.

Empirical Evaluation and Quantitative Results

The practical impact of these vulnerabilities is substantiated through real-world benchmarking. Scalability is validated over prominent LLMs, with attacks recovering layer secrets in minutes (6.2 min for LLaMA-3 8B, 101 min for LLaMA-3.1 405B) using columnar linear algebra routines. The attack success rate is strictly deterministic, showing a sharp transition to 100% compromise after $K$ samples (see efficacy plots), including under robust countermeasures such as random subset sampling or increasing $K$.

Figure 4: Empirical discovery of the secret noise dimension $K$ via rank stabilization, enabling subspace recovery.

Figure 5: Success rate of full attack: once noise subspace is characterized with $K$ queries, compromise jumps to 100%.

Countermeasures like expanding $K$ only lengthen the attack duration linearly but do not degrade the final compromise rate. Increasing $K$ does not fundamentally fix the flaw, as the secret subspace remains algebraically recoverable. Real-world deployments on modern edge TEEs remain constrained ($K \ll d$), keeping the vulnerability practical.

Figure 6: Increasing noise basis $K$ delays but does not prevent compromise; the final success rate remains 100%.

Figure 7: Root cause: generated fingerprints are confined to a low-dimensional subspace, making them computationally distinguishable from genuine activations.

Additionally, post-attack fidelity and utility of reconstructed models are shown to be identical to unprotected baselines in accuracy and throughput, fully removing both confidentiality and integrity guarantees.

Implications and Theoretical Analysis

The results elucidate a structural vulnerability: any protocol employing a precomputed, reused secret basis for efficiency is inherently susceptible to algebraic cross-query attacks. The security-performance trade-off imposed by TEE limitations directly forces the protocol into a low-rank regime, which is fundamentally at odds with cryptographic soundness. Side-channel-impervious TEEs cannot fix the flaw without eliminating basis reuse; behavioral countermeasures (such as limiting query types or pattern monitoring) cannot address the underlying algebraic leakage given sufficient output access.

The theoretical implication for the broader space of confidential computing—including schemes with permutation-based obfuscation, fingerprint challenge injection, or linear masking—is that system protocols must avoid static (cross-query) reuse of secrets for restoration or verification. Full on-the-fly randomness remains computationally expensive, and no current technique efficiently computes arbitrary one-time pad noise effects over large LLMs within TEE constraints.

Future Directions

The paramount challenge is designing protocols and cryptographic primitives that enable forward secrecy and non-reusable, per-query masking while meeting latency and memory budgets. This may include leveraging distributed or remote trusted generation of noise effects, efficient obfuscated cryptographic transforms, or novel hardware-assisted primitives. Novel TEE architectures offering larger isolated memory and accelerated matrix operations may offer pathways to eliminate vulnerable precomputation without prohibitive cost [zhu_confidential_2024, abdollahi_early_2025].

Research into dynamic basis generation, secure randomness expansion, or new decomposition techniques for scalable cryptographic masking is critical. Additionally, approaches that directly obfuscate the functional behaviors rather than underlying model weights—or that provide statistical indistinguishability—may offer increased resilience against algebraic recovery.

Conclusion

This work identifies and rigorously demonstrates the fundamental vulnerability in PTSE protocols using precomputed noise in TEE-shielded LLM inference. By showing deterministic algebraic attacks on both confidentiality and integrity mechanisms, the paper exposes the persistent insecurity of the static basis design, underscoring the need for cryptographically robust, high-performance mechanisms that reconcile the tensions between hardware constraints and security guarantees (2602.11088).

---

References:

(2602.11088), [li_translinkguard_2024], [shen_soter_2022], [sun_tsqp_2025], [refael_slip_2024], [sun_shadownet_2023], [zhu_confidential_2024], [abdollahi_early_2025], [dong_evaluating_2025], [siby_guarantee_2024]