💻 computer science

Hiding Directions, Leaking Structure: Breaking ArrowCloak through Low-Rank Structure

This paper demonstrates that ArrowCloak, a TEE-based defense for protecting neural network weights, is fundamentally broken by a query-free attack that exploits its shared mask direction to recover hidden weight correspondences and reconstruct models with near-perfect accuracy, revealing that its LWE-based hardness claims are invalid and that lightweight protections must address both per-vector geometry and joint structural leakage.

Original authors: Beijie Liu, Junyi Ouyang, Haoxuan Xu, Vincent Quentin Ulitzsch, Potung Yu, Yajie Zhao, Mengyuan Li

Published 2026-08-25

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Beijie Liu, Junyi Ouyang, Haoxuan Xu, Vincent Quentin Ulitzsch, Potung Yu, Yajie Zhao, Mengyuan Li

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern digital landscape, powerful artificial intelligence models are often treated as valuable secrets, much like a proprietary recipe or a unique piece of machinery. To use these models on personal devices without sending data to a distant cloud server, developers have begun splitting the work. They keep the most sensitive parts of the model, the core instructions and weights, inside a secure, locked-down area of the computer processor known as a trusted execution environment. This secure zone acts like a private vault, shielding the secrets from the rest of the system. However, the heavy lifting of calculations, the massive mathematical operations required to make the model think, is too demanding for this small vault. So, this work is offloaded to a powerful, but untrusted, graphics processor outside the vault. The challenge is that once the data leaves the secure vault to be processed, it is visible to anyone watching the hardware. If the data is not disguised, a clever observer could potentially reverse-engineer the original secret model from the exposed calculations.

To solve this, researchers recently proposed a method called ArrowCloak. The idea was to disguise the model's weights by rotating them in specific ways and adding a shared, hidden pattern to every single piece of data before sending it out. The designers argued that this scrambling was mathematically unbreakable, relying on a complex cryptographic theory that suggested recovering the original secrets would be as hard as solving a specific type of difficult puzzle. They claimed this method successfully hid the direction of the data vectors, preventing attackers from matching the scrambled pieces back to the original model.

A team of researchers has now revisited this protection scheme and found that the mathematical foundation was not as solid as claimed. They discovered that the proposed connection to the difficult cryptographic puzzle was flawed; the way the data was transformed did not actually create the conditions required to make the problem hard to solve. More importantly, they found a structural weakness in the disguise itself. While the method successfully changed the direction of individual pieces of data, it did so by adding a pattern that was shared across all of them. This shared pattern created a faint, low-dimensional signal that ran through the entire set of exposed weights, like a single thread running through a tapestry. Because this thread was common to every piece of data, it left a trace that could be detected and removed.

Using this insight, the researchers developed a new attack called ArrowRevelio. This method does not require any special access to the secure vault, nor does it need to ask the model questions or see its internal secrets. Instead, it simply looks at the public, scrambled weights and the original, unscrambled public version of the model. By analyzing the collective structure of the data, the attack can identify and subtract the shared hidden pattern. Once this pattern is removed, the hidden order of the data pieces becomes visible again. The researchers then used a standard matching technique to align the scrambled pieces with their original positions, effectively reconstructing the secret model.

The results of this reconstruction were strikingly accurate. Across six different combinations of models and tasks, including those used for classifying text, segmenting images, and generating new content, the attack successfully recovered the hidden arrangement of the data in nearly every case, with accuracy rates between 99.92% and 100%. The reconstructed models performed almost identically to the original secret models. For classification tasks, the new models agreed with the original on between 94.39% and 99.54% of test inputs, and their overall accuracy differed by no more than 1.59 percentage points. In a segmentation task, the agreement was even higher at 98.35%.

The researchers also tested whether making the shared pattern more complex would fix the problem. They increased the number of shared patterns from a single direction to hundreds of directions. While this made it slightly harder to perfectly reconstruct the model's exact output, it did not stop the attack from finding the hidden order of the data. Even with hundreds of shared patterns, the attack still recovered the arrangement of the data pieces with near-perfect accuracy, though the final model's performance dropped significantly. This suggests that simply adding more shared patterns is not a complete solution, as it increases the computational cost for the secure vault without fully eliminating the structural leakage.

The study concludes that protecting model weights requires looking at the data not just as individual pieces, but as a collective whole. The previous defense focused on hiding the direction of each vector in isolation, but it failed to account for the relationships shared across the entire set. The findings indicate that lightweight protection schemes must address both the geometry of individual vectors and the joint structure across all released weights to truly secure on-device artificial intelligence.

Technical Summary: Hiding Directions, Leaking Structure: Breaking ArrowCloak through Low-Rank Structure

Problem Statement
The paper addresses the confidentiality of proprietary neural network models deployed on user devices via Trusted Execution Environment (TEE) partitioning. In this architecture, known as TEE-Shielded LLM Partitioning (TSLP), sensitive model weights are kept within a CPU TEE, while computationally intensive linear algebra is offloaded to an untrusted GPU accelerator. To protect weights during offloading, lightweight obfuscation schemes are employed.

Wang et al. (USENIX Security 2025) previously demonstrated that early lightweight defenses (scaling and permutation) leaked vector directions, enabling the ArrowMatch attack. In response, they proposed ArrowCloak, a defense that adds a vector-specific multiple of a single shared mask direction to each weight vector before permuting them. ArrowCloak claimed security based on a reduction to the Learning with Errors (LWE) problem, arguing that recovering the weights is computationally hard. The authors of this paper challenge both the validity of the LWE-based security argument and the structural integrity of the ArrowCloak transformation.

Methodology
The paper employs a two-pronged approach: a cryptographic audit of the security proof and a structural analysis of the obfuscated weights.

Cryptographic Audit of LWE Claims:
The authors rigorously examine ArrowCloak's reduction to LWE. They identify three critical gaps that invalidate the hardness argument:
- Reduction Direction: The proposed mapping rewrites the ArrowCloak relation in LWE-like notation but fails to provide a hardness-preserving reduction from standard LWE to the ArrowCloak recovery problem.
- Quantized Arithmetic: The mapping incorrectly applies quantization. The integer matrices derived from the real-valued transformation do not satisfy the modular arithmetic required for a valid LWE instance due to scaling factors (e.g., $\Delta^2$ ) that are not properly accounted for.
- Joint Distribution: The induced joint distribution of the public matrix, secrets, and errors does not match the standard LWE distribution. Specifically, the matrices are not uniformly distributed, and the error terms are not independent of the secrets in the required manner.
Structural Attack (ArrowRevelio):
Recognizing that the LWE argument is flawed, the authors investigate the concrete transformation. They observe that while ArrowCloak hides individual vector directions, the additive masking terms all lie within a shared low-rank subspace (rank-one in the original design, rank- $r$ in extensions).
- Core Insight: The shared mask direction creates a rank-one (or rank- $r$ ) component in the exposed weight matrix that persists despite permutation.
- Attack Workflow:
  1. Estimation: Using Singular Value Decomposition (SVD) on the centered, obfuscated weight matrix, the attacker estimates the shared mask direction (the leading left singular vector).
  2. Projection: The attacker projects both the public pre-trained weights and the obfuscated weights onto the orthogonal complement of the estimated mask subspace, effectively removing the masking noise.
  3. Permutation Recovery: With the mask removed, the projected vectors of the public and obfuscated weights regain directional similarity. The attacker solves a global one-to-one assignment problem (using the Hungarian algorithm) to recover the hidden permutation.
  4. Reconstruction: Using the recovered permutation and the estimated mask coefficients, the attacker reconstructs the victim weights via constrained least squares, requiring no queries to the victim model or access to TEE secrets.

Key Contributions

Cryptographic Audit: The paper demonstrates that ArrowCloak's LWE-based security argument does not establish computational hardness due to incorrect reduction direction, flawed quantization arithmetic, and mismatched instance distributions.
Structural Vulnerability: The authors uncover that reusing a single mask direction (or a low-dimensional subspace) leaves a recoverable low-rank structure in the released weights.
ArrowRevelio Attack: They present ArrowRevelio, an end-to-end, query-free recovery attack. It requires only the public checkpoint, architecture metadata, and the obfuscated weights exposed to the GPU.
Theoretical Guarantees: The paper derives sufficient spectral-separation conditions for the successful recovery of the mask direction and characterizes failure conditions for rank- $r$ masking.

Results
The authors evaluated ArrowRevelio across six model-task pairs, including classification (ViT-B/16, BERT-base, GPT-2), segmentation, and diffusion models.

Permutation Recovery: The attack successfully recovered 99.92% to 100% of the hidden vector correspondences (permutations).
Functional Recovery:
- Reconstructed classification models achieved 94.39%–99.54% agreement with the victim models on test inputs.
- Task accuracy differences were at most 1.59 percentage points.
- The recovered segmentation model achieved 98.35% output agreement.
Rank- $r$ Mitigation: The authors tested increasing the mask rank from 64 to 512. While higher ranks weakened functional recovery (victim agreement dropped to 48.05% at rank 512), they did not eliminate structural leakage. Permutation recovery remained near-perfect (99.98% at rank 512), and the attack required significantly more trusted-side state and correction work.

Significance
The paper concludes that lightweight protection mechanisms for TEE partitioning must address both per-vector geometry (preventing direction leakage) and joint structure across released weights. The progression from ArrowMatch (exploiting preserved direction) to ArrowRevelio (exploiting shared subspace structure) demonstrates that concealing local geometric invariants is insufficient if the global matrix structure remains recoverable. The findings suggest that ArrowCloak, as currently designed, does not provide the intended model confidentiality, and that increasing mask rank offers diminishing returns without fully eliminating the underlying structural leakage.

More like this