Four ways to obfuscate a weight matrix, one thing they all leave behind

What is this?

On September 9, 2026, six researchers at Tsinghua University published a paper — Hanyi Zhou, Chenyang Li, Yuanzhe Pang, Ke Xu, Mingwei Xu and Zhuotao Liu, accepted to ACM CCS 2026 (Cycle B) — that does something the on-device model protection literature has not done: it stops attacking these schemes one at a time and asks what they have in common.

The target is a design pattern called TEE-Shielded LLM Partition (TSLP). You want to run a proprietary model on a user’s own device without handing them the weights. A Trusted Execution Environment — Intel SGX, Arm TrustZone — is the trust anchor, but it is far too slow to run a transformer. So you obfuscate the heavy linear layers, hand them to the device’s untrusted GPU, and keep only cheap operations inside the enclave. The GPU sees a scrambled weight matrix and computes with it; the enclave unscrambles the result.

The paper’s finding is that the scrambling schemes published so far are four tricks in various combinations, that those four tricks are closed under composition, and that every composition of them preserves the one property an attacker actually needs. The authors name their attack Collapse and report that it breaks three schemes from top-tier venues at once: ArrowCloak (USENIX Security’25), TSQP (IEEE S&P’25) and LoRO (NeurIPS’25).

How it works

Start with the threat model, because it is unusual and it is the whole reason this matters. The adversary here is the device owner. They control the untrusted host and the GPU. They cannot break the TEE — hardware side channels and transient-execution attacks are explicitly out of scope — and they follow the protocol correctly. The paper calls this honest-but-curious: the attacker simply records every tensor that crosses the enclave boundary and keeps the receipts.

That matters because TSLP schemes defend themselves with key rotation. The enclave refreshes its obfuscation keys every few rounds, on the theory that no single key is exposed long enough to accumulate useful observations. The attack accepts that and works from T different obfuscated views of the same matrix, plus two pieces of context: the public pretrained backbone the victim model was fine-tuned from, recovered by standard model fingerprinting, and less than 1% of the original training set worth of labeled task data, collected by querying the deployed model.

And the goal is not bit-exact weight recovery. It is a surrogate:

  attacker inputs                       attacker output
  ───────────────                       ───────────────
  public backbone  M_pre         ┐
  T obfuscated views  W̃_1..W̃_T   ├──► surrogate  M_sur
  ≤1% labeled task data          ┘      (same architecture,
                                         comparable accuracy)

  success criterion:  Acc(M_sur) ≥ Acc(M_vic) − δ,   δ = 0.05

Five percentage points. If the stolen model lands within five points of the original on the evaluation set, the defense failed.

The formal contribution is the definition of an obfuscation primitive as a pair of operators (O, ℛ) where the enclave releases W̃ = O(W) and recovers ℛ(X·W̃) = XW. A primitive is valid only if it satisfies three properties simultaneously: correctness (exact functional equivalence), efficiency (C(O) + C(ℛ) ≪ C(XW), otherwise there is no point offloading), and model-extraction resistance under the observation and data budgets above.

The efficiency clause is the trap. A dense i.i.d. Gaussian additive mask would be genuinely secure — but computing the correction term inside the enclave costs the same as computing the layer there in the first place, which the paper calls “self-defeating.” Every scheme in the literature is therefore some structured cheap transformation, and structure is what Collapse eats. The four that exist:

Category	Primitive	What it does
Multiplicative	permutation Π	reorders columns
Multiplicative	scaling D	rescales columns
Additive	sparse mask S	perturbs a small fraction of elements
Additive	low-rank mask L	hides the matrix inside a low-dimensional subspace

The authors prove these compose without degrading any of the three properties — correctness stays exact, enclave cost grows only additively. Stacking them is what ArrowCloak does. The canonical form of all such compositions, which they call O_prior, is therefore the structural boundary of the entire family. Not of one scheme. Of the family.

Then the key insight, stated plainly: the column directions of the protected weight matrix cannot be effectively masked by any composition of these primitives. Permutation and scaling only reorder and rescale columns, so the directions survive and stay correlated with the public backbone. A sparse mask touches too few elements to move them. A low-rank mask hides the matrix in one low-dimensional subspace — and leaves the directions intact in the orthogonal complement.

Collapse then runs in three stages, described here at the level the paper frames them and no lower: align the permutations across the multiple observed views; combine the aligned views to recover the low-rank mask and localize the sparse mask’s support, producing an intermediate model; fine-tune that intermediate on the small labeled set to wash out the residual sparse mask and scaling. The result is a surrogate with the victim’s architecture and comparable performance, evaluated across four models: BERT-Base, ViT-Base, Qwen2.5-0.5B and Qwen2.5-1.5B.

Why it matters

The narrow reading is that three specific schemes need revisiting. The useful reading is about how this class of defense has been evaluated.

Prior attacks on TSLP were scheme-specific — ArrowMatch went after permutation-and-scaling constructions, another line went after additive masking. Each broke one design, and each break invited the natural response: stack more tricks, rotate keys faster, publish the composition. That response is exactly what this paper closes off. If the primitives are closed under composition and every composition preserves column direction, then stacking is not a security argument. It is a performance argument dressed as one. We have written before about how agent defenses fail to compose; this is the same failure in a very different layer of the stack, and here it is proved rather than measured.

The second thing worth internalizing is the budget. An attacker who owns the device, cannot break the enclave, and has under 1% of the training data is not an exotic adversary — that is the normal deployment condition for any vendor shipping a fine-tuned proprietary model to consumer hardware. Key rotation, the field’s standard hedge, is what supplies the multiple views the attack consumes. The defense’s own hygiene mechanism is an input.

Third: the attacker’s leverage comes from the public backbone. The thing being protected is the delta between a public pretrained model and a privately fine-tuned one, and the public half is free. Fingerprinting the backbone is a solved problem. This is the same asymmetry that makes model extraction detection a live research area rather than a settled one.

For context on where this sits in the broader picture, the July 1, 2026 systematization of mobile on-device AI security by Yujin Huang, Xin Zheng, Xingliang Yuan and Kwok-Yan Lam covers the attack and defense landscape for locally deployed models and the gaps in it. Local storage of a model is the root condition; TSLP is one attempt to live with it, and confidential computing for agentic workloads is another.

Defenses

Do not treat composition as a security multiplier. If your protection scheme is a stack of column permutation, column scaling, sparse masking and low-rank masking, adding a fifth combination of the same four primitives does not move you outside O_prior. Ask which invariant your construction destroys, not how many layers it has.

Ask what survives key rotation, not what one key hides. The relevant security question for a TSLP deployment is what an adversary learns from T views, not from one. If your threat model assumes a single static exposure, it does not describe your deployment.

Break row- and column-wise structure, not just order. The paper’s own extension, O_ext, adds two primitives aimed precisely at this: a sparse multiplicative primitive that mixes columns rather than merely permuting them, and a double-sided multiplicative primitive that disturbs rows and columns together. The authors report that this drops surrogate accuracy to the empirical black-box reference on average — and they are explicit, twice, that they do not claim universal security for it, having evaluated it only against the existing Collapse pipeline. Treat it as a better primitive family, not as a fix.

Budget for the surrogate, not the weights. A five-percentage-point accuracy gap is the practical definition of theft here. Protection schemes measured by weight reconstruction error can look excellent while failing this test completely. Evaluate against downstream task accuracy of an attacker-trained surrogate.

Reduce the public-backbone delta if the IP is the fine-tune. The narrower the gap between the public prior and the deployed model, the less the attacker has to recover. Where that is unacceptable, the honest conclusion may be that the weights should not be on the device at all — which pushes you toward server-side inference or hardware where confidentiality is enforced rather than obfuscated.

Do not read this as a verdict on TEEs. The attack does not compromise the enclave. It attacks the offloading shortcut taken to make the enclave fast enough. Confidential-compute GPUs — the paper names H100 CC and TDX-IO — are described as complementary rather than superseded, and enclave side channels, covered separately in the inference side-channel literature, remain their own problem.

Status

Item	Detail
Publication	arXiv:2609.10117v1 [cs.CR], submitted September 9, 2026; 17 pages
Venue	Accepted to ACM CCS 2026 (Cycle B)
Authors	Hanyi Zhou, Chenyang Li, Yuanzhe Pang, Ke Xu, Mingwei Xu, Zhuotao Liu (Tsinghua University)
Attack	Collapse — primitive-guided surrogate extraction against composed weight obfuscation
Adversary	Honest-but-curious device owner; controls host and GPU; cannot compromise the TEE
Budgets	T obfuscated views across key refreshes; under 1% of the original training set, labeled
Success threshold	Surrogate within δ = 0.05 (5 percentage points) of victim accuracy
Schemes reported broken	ArrowCloak (USENIX Security’25), TSQP (IEEE S&P’25), LoRO (NeurIPS’25)
Models evaluated	BERT-Base, ViT-Base, Qwen2.5-0.5B, Qwen2.5-1.5B
Proposed extension	O_ext — adds sparse multiplicative and double-sided multiplicative primitives
Scope limits	TEE hardware side channels and transient execution out of scope; no universal security claimed for O_ext
Context	Mobile on-device AI security SoK, arXiv:2607.00362, July 1, 2026