The deployment of large language models (LLMs) on third-party devices requires new ways to protect model intellectual property. While Trusted Execution Environments (TEEs) offer a promising solution, their performance limits can lead to a critical compromise: using a precomputed, static secret basis to accelerate cryptographic operations. We demonstrate that this mainstream design pattern introduces a classic cryptographic flaw, the reuse of secret keying material, into the system's protocol. We prove its vulnerability with two distinct attacks: First, our attack on a model confidentiality system achieves a full confidentiality break by recovering its secret permutations and model weights. Second, our integrity attack completely bypasses the integrity checks of systems like Soter and TSQP. We demonstrate the practicality of our attacks against state-of-the-art LLMs, recovering a layer's secrets from a LLaMA-3 8B model in about 6 minutes and showing the attack scales to compromise 405B-parameter LLMs across a variety of configurations.

翻译：在第三方设备上部署大型语言模型（LLM）需要新的模型知识产权保护方法。虽然可信执行环境（TEE）提供了一种有前景的解决方案，但其性能限制可能导致一个关键折衷方案：使用预计算的静态秘密基来加速密码学运算。我们证明，这种主流设计模式将经典密码学缺陷——秘密密钥材料的重复使用——引入了系统协议中。我们通过两种不同的攻击证明了其脆弱性：首先，我们对模型保密系统的攻击通过恢复其秘密置换和模型权重，实现了完全的保密性突破。其次，我们的完整性攻击完全绕过了如Soter和TSQP等系统的完整性检查。我们展示了针对最先进LLM的攻击实用性：在约6分钟内从LLaMA-3 8B模型中恢复了一个层的秘密，并证明该攻击可扩展至在各种配置下攻破4050亿参数的LLM。