As on-device LLMs(e.g., Apple on-device Intelligence) are widely adopted to reduce network dependency, improve privacy, and enhance responsiveness, verifying the legitimacy of models running on local devices becomes critical. Existing attestation techniques are not suitable for billion-parameter Large Language Models (LLMs), struggling to remain both time- and memory-efficient while addressing emerging threats in the LLM era. In this paper, we present AttestLLM, the first-of-its-kind attestation framework to protect the hardware-level intellectual property (IP) of device vendors by ensuring that only authorized LLMs can execute on target platforms. AttestLLM leverages an algorithm/software/hardware co-design approach to embed robust watermarking signatures onto the activation distributions of LLM building blocks. It also optimizes the attestation protocol within the Trusted Execution Environment (TEE), providing efficient verification without compromising inference throughput. Extensive proof-of-concept evaluations on LLMs from Llama, Qwen, and Phi families for on-device use cases demonstrate AttestLLM's attestation reliability, fidelity, and efficiency. Furthermore, AttestLLM enforces model legitimacy and exhibits resilience against model replacement and forgery attacks.

翻译：随着设备端大语言模型（例如苹果设备端智能）被广泛采用以减少网络依赖、提升隐私保护并增强响应能力，验证本地设备上运行模型的合法性变得至关重要。现有认证技术难以适用于十亿参数级别的大语言模型，无法在应对LLM时代新兴威胁的同时保持时间和内存效率。本文提出AttestLLM，这是首个通过确保仅授权LLM能在目标平台上执行，以保护设备厂商硬件级知识产权的认证框架。AttestLLM采用算法/软件/硬件协同设计方法，将鲁棒水印签名嵌入至LLM构建模块的激活分布中，并在可信执行环境内优化认证协议，在不影响推理吞吐量的前提下实现高效验证。针对Llama、Qwen和Phi系列LLM在设备端应用场景的广泛概念验证评估表明，AttestLLM具备可靠的认证能力、保真度与运行效率。此外，该框架能有效保障模型合法性，并对模型替换与伪造攻击展现出强韧性。