{"id":"10d73304-8484-4af8-8e78-b46b96dcd0c7","arxiv_id":"2411.09945","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"TEESlice trains small private slices on top of a public backbone inside a TEE, leaving only the public backbone and encrypted features on the GPU, and reports black-box-level attack resistance at about 10x lower TEE cost than prior TSDP methods.","lead":"The paper tests whether existing TEE-based model protection methods survive an attacker with public pre-trained models, finds they do not, and proposes a new 'partition before training' scheme. Their scheme keeps small private slices inside a trusted enclave and offloads a public backbone to the GPU, claiming the same security as shielding the whole model at much lower cost.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Security equivalence to shielding-whole-model is unproven without a test for whether the public backbone already encodes the private task.","rationale":"The reader identified the same underlying assumption—that the public backbone does not leak private functionality—as the weakest point, and I agree that this assumption is load-bearing. However, the reader's evidence from Table 6 (backbone-only surrogate accuracy close to hybrid surrogate accuracy) is not decisive: those surrogate accuracies are low relative to the victim model and depend on the limited query budget, so they do not show that the backbone can actually perform the private task well. The more direct gap is that the paper never measures the backbone's own accuracy on the private task after adaptation, which would settle whether the backbone alone can substitute for the protected model. I also considered the overstated LLM claim (only ViT and BART experiments) and the baseline definition issues, but those do not attack the core security mechanism as directly as the backbone-leakage question. Because the proposed test would determine whether TEESlice's security guarantee holds for tasks close to the public pre-training distribution, and because the paper does not currently provide such a test, the CONDITIONAL verdict is appropriate and I would not change it.","tokens_in":55994,"tokens_out":7576,"duration_ms":76652,"concrete_test":"For each dataset in the evaluation (CIFAR10, CIFAR100, STL10, UTKFace), take the same public backbone (e.g., ResNet18 pretrained on ImageNet) and evaluate its accuracy on the private task under the same protocol used to train M_vic, including linear probing and full fine-tuning on the public training set. Compare this backbone-only accuracy to the reported M_vic accuracy in Table 7. If, for any dataset, the adapted backbone achieves accuracy within, say, 10% of M_vic, then an attacker with public resources can obtain a model of comparable utility without accessing the protected slices, and the equivalence to shielding-whole-model fails because the 'private' functionality is already public.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that TEESlice provides protection equivalent to shielding the whole model because all private information is confined to the slices, while the public backbone is 'never trained using private data and thus, no information is leaked' (Sec 6.1). This is load-bearing: if the public backbone already performs the private task, an attacker with public pre-trained models and datasets—exactly the threat model in Sec 2.2—can replicate the model's functionality without any access to the TEE-protected slices, making the claimed protection vacuous. The paper provides no formal or even direct empirical bound on this. Table 6 reports model-stealing surrogate accuracies, but those accuracies (e.g., 51.32% backbone-only vs 52.27% hybrid on AlexNet/UTKFace) are low relative to the victim model's accuracy and are influenced by the query budget, so they do not establish that the backbone cannot be fine-tuned to high accuracy on the private task using public data. The paper never measures the backbone's own accuracy on the private task after any form of adaptation, which is the quantity that would reveal whether the backbone alone is a viable substitute for the protected model. Without this, the claim 'full model protection with 10x lower cost' is only as strong as an unstated and untested assumption about task-backbone proximity.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies TEE-shielded DNN partitioning (TSDP) under an adversary who can use public pre-trained models and public datasets. It first surveys and taxonomizes 17 prior TSDP papers, then empirically evaluates five representative schemes against model stealing (MS) and membership inference (MIA), finding that all leak substantially more than a black-box baseline. The authors then propose TEESlice, a partition-before-training scheme: a public pre-trained backbone is frozen, small private slices are trained on private data and executed inside a TEE, and GPU-communicated features are protected with one-time-pad encryption and Freivalds' verification. They report that TEESlice achieves black-box-level MS/MIA accuracy across 20 CNN settings, with roughly 3.44% of FLOPs inside the TEE on average (about 10x lower than prior TSDP solutions), and they extend the design to ViT-style models via LoRA slices and to BART on NLP tasks. The paper includes a real SGX+GPU prototype and reports latency and memory measurements.","tokens_in":56250,"tokens_out":5341,"duration_ms":60913,"significance":"If the central claim holds, TEESlice is a solid engineering contribution: it gives a principled way to confine private information to TEE-resident slices while offloading the bulk of computation to an untrusted GPU, and it provides the first systematic demonstration that prior training-before-partition TSDP schemes are insecure against a public-information-aware adversary. The evaluation is broad by the standards of this area (5 CNN architectures, 4 datasets, 20 settings, plus ViT and BART experiments), the authors provide artifacts, and the OTP/Freivalds building blocks are standard and appropriate. The main value is not a new cryptographic primitive but a deployment strategy that converts a white-box model-stealing surface into a label-only surface. However, the security-equivalence claim is currently supported only by the construction (all private slices are in the TEE) plus empirical attack results; it is not supported by any formal or empirical bound on what the public backbone itself reveals or already encodes about the private task. That gap, and the ambiguity in how the black-box baseline is defined, are load-bearing for the paper's headline claim.","major_comments":[{"comment":"The central security assertion is that the public backbone is 'never trained using private data and thus, no information is leaked' (Sec. 6.1). This is load-bearing, yet the paper provides no test of whether the public backbone already performs the private task or can be adapted to it with public data alone. Table 6 shows that a backbone-only surrogate often achieves MS accuracy close to (and sometimes higher than) the hybrid-model surrogate, e.g., AlexNet/UTKFace 51.32% vs. 52.27% and VGG16_BN/UTKFace 52.54% vs. 48.37%. Because the threat model explicitly allows an attacker with public pre-trained models and public datasets (Sec. 2.2), the attacker could fine-tune or linear-probe the public backbone on public data; this quantity is never measured. Without either a formal bound on backbone leakage or an empirical evaluation of adapted-backbone accuracy on the private task, the claim of 'full model protection' is not established.","section":"Sec. 6.1, Sec. 7.1, Table 6"},{"comment":"The security comparison between TEESlice and the black-box baseline is not apples-to-apples. The black-box baseline is defined against the original victim model M_vic, which is trained entirely on private data, while TEESlice protects the hybrid model M_hyb, which combines a public backbone with private slices. These are different models with different accuracies (Table 7), so equal MS/MIA accuracy against them does not demonstrate equivalent protection. The paper should report a black-box baseline against M_hyb itself (i.e., an attacker who queries M_hyb only through labels and cannot see the backbone or slices), and then compare TEESlice's attack accuracy to that baseline. Without this matched comparison, the statement that TEESlice 'achieves a security level equivalent to the shielding-whole-model baseline' is ambiguous.","section":"Sec. 4.3, Tables 3/4"},{"comment":"The 'large language model' scalability claim is not fully supported by the experiments. Section 6.4 and Table 11 evaluate TEESlice on ViT image classifiers (ViT-B/L on CIFAR10/100 and STL10), not on language models; the only NLP evaluation is in Sec. 7.5 with BART, and there the paper reports MS accuracy but no security cost, no TEE/GPU deployment details, and no comparison of private-slice FLOPs against the shielding-whole-model baseline. Since the abstract and introduction claim that TEESlice 'can compress the private functionalities of the large language model to lightweight slices,' the paper should either provide an actual decoder-only LLM evaluation (e.g., with LoRA on a generative task) or substantially soften the claim to cover vision transformers and encoder-only NLP models.","section":"Sec. 6.4, Table 11"},{"comment":"Equation (3) as written is not correct over the integers. From h_e = (h + r) % p, the equality g(h_e) - g(r) = g((h+r)%p - r%p) does not equal g(h) in general; for example, with p=256, h=200, r=100, the integer difference is -56, not 200. The identity only holds modulo p, so the decryption must reduce the result modulo p (or the computation must be defined over the field Z_p). The claim that 'the last equation holds as long as p > 2^8' is insufficient; one needs p > 2^8 and a final modular reduction, or a guarantee that h+r never wraps. This is a technical error in the core OTP derivation, although the underlying OTP mechanism is standard and fixable.","section":"Sec. 6.2.2, Eq. (3)"}],"minor_comments":[{"comment":"The text says 'Both Membership Inference (MS) and Model Inversion Attacks (MIA) are carried out'; this should read 'Model Stealing (MS) and Membership Inference Attacks (MIA),' since MS is defined as model stealing elsewhere and model inversion is not evaluated.","section":"Sec. 3, first paragraph"},{"comment":"The text refers to 'Table 2 summarizes the reviewed papers,' but the table in that section is labeled Table 1; please fix the cross-reference.","section":"Sec. 3.2, Table 1"},{"comment":"The 'victim-knowing' assumption is dismissed as unrealistic, but the discussion of why it sometimes yields lower MS accuracy than backbone-only is speculative and not backed by a hypothesis test; either add a brief analysis or remove the speculation.","section":"Sec. 7.1, paragraph on additional assumptions"},{"comment":"Figure 9 shows only CIFAR100 for four models, while the text says the conclusion holds 'for all cases'; please either include the full set of datasets in the figure or state the selection criterion explicitly.","section":"Sec. 7.1, Fig. 9"},{"comment":"The sentence 'DP may provide insufficient privacy [97]' cites a TSDP paper, not a DP-specific analysis; consider replacing with a more directly relevant reference.","section":"Sec. 10, 'Differential Privacy' paragraph"},{"comment":"The dynamic attention interpolation uses a scalar beta_l per layer, but the paper does not specify how beta_l is initialized, whether it is constrained to [0,1], or how the 'small beta' threshold is chosen during pruning; please add these implementation details.","section":"Sec. 6.4, Eq. (13)"},{"comment":"The threats-to-validity section does not mention the possibility that the public backbone already encodes the private task, which is the main limitation identified above; adding this to the external-validity discussion would improve the paper's transparency.","section":"Sec. 8"}],"recommendation":"major_revision","confidential_remarks":"This is an extended version of a previously published S&P 2024 paper, which the authors acknowledge. The added value over the conference version is mainly the broader TSDP survey, the LLM/ViT and NLP experiments, and the real-device measurements. The editor may want to consider whether the 'large language model' terminology is appropriate, since the main LLM-section experiments use ViT image classifiers rather than language models. The core technical idea is sound and the empirical breadth is good, but the security-equivalence claim needs to be re-anchored with a matched baseline and a backbone-adaptation test before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Partition-before-training is a real step forward, but the security-equivalence claim needs a test the paper doesn't run.\n\nQuick take: this is a genuinely useful systems paper. The partition-before-training recipe is a sensible inversion of the usual TSDP pipeline, and the CNN evaluation is the most thorough I've seen in this area: five models, four datasets, twenty settings, with the failure of prior schemes against a public-model-aware adversary clearly demonstrated. The slice pruning to find a minimal TEE footprint is a nice engineering contribution, and the OTP/Freivalds machinery is standard but correctly applied. The artifacts are linked.\n\nThe soft spots, in order of size. First, the headline claim of 'security equivalent to shielding the whole model' is a bit ahead of the evidence. The black-box baseline in Sec 4.3 is defined against the victim model M_vic, while TEESlice protects the hybrid M_hyb, so the comparison in Tables 3/4 isn't apples-to-apples. Table 6 partially fixes that by testing a backbone-only surrogate, but the deeper gap is the one the stress-test note identifies: the paper never measures the public backbone's own accuracy on the private task after any fine-tuning on public data. If the backbone already encodes the task (or can be adapted cheaply with public data), the protected slices add little, and the 'full model protection' claim is hollow. The assertion in Sec 6.1 that offloaded weights are 'never trained using private data and thus no information is leaked' is an unproven assumption about task-backbone proximity, not a demonstrated guarantee. This needs either a formal bound or an empirical test before the equivalence claim is credible.\n\nSecond, the 'large language model' framing is oversold. The experiments are on ViT and BART, not on autoregressive LLMs. The transformer evaluation is also thin: accuracy and FLOPs only, no serious MS/MIA evaluation for the ViT models (BART gets one MS table, but no MIA, no comparison to prior TSDP schemes, no latency numbers). The 0.089% FLOPs figure is impressive, but the security story for this setting is essentially unexamined.\n\nThird, the free parameters — alpha_i, alpha_setup, n, rounds, delta, LoRA rank, beta_l — are numerous. The authors downplay tuning, but the pruning algorithm's behavior depends on them. That is minor, but worth noting.\n\nNone of this sinks the paper. The core idea is sound, the CNN evaluation is valuable, and the open questions are addressable with a revision. I would send it to peer review, but I would ask the authors to (1) define the TEESlice-specific black-box baseline explicitly, (2) test the backbone's standalone performance on the private task after public-data adaptation, and (3) temper the LLM language to 'transformer models' or provide actual LLM experiments.\n\nWho it is for: people working on TEE-based on-device ML protection, and anyone building on TSDP. Worth citing for the partition-before-training idea and the attack evaluation, once the baselines are sorted.","headline":"Partition-before-training is a real step forward, but the security-equivalence claim needs a test the paper doesn't run.","tokens_in":56833,"tokens_out":4493,"would_cite":true,"duration_ms":44760,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"TEESlice proposes partitioning a neural network before training so that only small private slices are shielded, matching whole-model protection at a fraction of the computational cost.","keywords":["trusted execution environment","model partitioning","model stealing","membership inference","partition-before-training","one-time pad","low-rank adaptation","large language models"],"falsifier":"A decisive experiment is to take a TEESlice hybrid model trained on a task close to the backbone's pre-training distribution, drop the slices, and measure the model-stealing accuracy of a surrogate trained from the backbone alone; whenever that accuracy approaches the accuracy of a surrogate trained from the full hybrid model, the claim that the slices are the exclusive carriers of private functionality fails, and with it the 'full model protection' guarantee.","tokens_in":55780,"feed_emoji":"🧩","tokens_out":9117,"duration_ms":83210,"temperature":0.7,"pith_summary":"TEESlice claims that existing TEE-shielded DNN partitioning (TSDP) schemes break down when the attacker can download public pre-trained models, because the offloaded weights were trained on private data and carry near-white-box information. The paper's fix is to partition before training: keep a public pre-trained backbone running on the GPU and confine all private training to small 'slices' inside the TEE. It reports that this reaches the security level of shielding the entire model at about one-tenth the computational cost. If true, on-device models could get black-box-level protection against model stealing and membership inference while running most inference on an untrusted GPU.","feed_headline":"TEESlice cuts TEE compute 10x while matching full-shield security","feed_subtitle":"Public pre-trained backbone runs on GPU; tiny private slices in the enclave stop model stealing.","key_machinery":"The carrying object is the hybrid model: a public pre-trained backbone with small private slices inserted between its layers. The carrying mechanism is partition-before-training plus iterative slice pruning, where a densely sliced model is trained so each slice carries an importance scalar (or, for LLMs, is scored by the weight magnitude of its LoRA adapters); slices with the smallest importance are pruned and the model retrained until accuracy falls below a 1% threshold, automatically finding the configuration that minimizes TEE computation. The TEE-GPU channel is protected by one-time-pad encryption of quantized features—valid because the offloaded layers are linear, so the pad can be precomputed—and by Freivalds' algorithm, a probabilistic check that the GPU computed the linear layer correctly. For transformer attention, the inter-feature product cannot be protected by a one-time pad, so the mechanism substitutes linear attention (a weight-feature product) under a trainable interpolation factor, and outsources that instead.","core_discovery":"Existing TSDP solutions train the whole model on private data before partitioning, so private information is spread across the offloaded weights; when the attacker initializes a surrogate with a public pre-trained model, the paper measures model-stealing accuracy 3.85×–4.56× and membership-inference accuracy 1.16×–1.36× above the black-box baseline. TEESlice reverses the order: it keeps a public pre-trained backbone, trains only small private slices inserted into it, and shields only the slices and the backbone's non-linear layers in the TEE, while the backbone's linear layers run on the GPU under one-time-pad encryption with Freivalds verification. In the paper's evaluation, model-stealing and membership-inference accuracy against TEESlice are statistically indistinguishable from the shielding-whole-model baseline, with an average TEE FLOP cost of 3.44% versus 45.98%–97.02% for prior defenses. The same recipe extends to large models: privacy becomes LoRA adapters pruned by weight magnitude, and attention is replaced by linear attention where needed, yielding TEE FLOP costs around 0.09% for ViT models.","pith_inferences":["Beyond the paper: the reported backbone-only accuracies (e.g., 51.32% vs. 52.27% for AlexNet on UTKFace) suggest that when the private task is close to the public pre-training distribution, the backbone may already carry most of the functionality; a natural security metric is the gap between hybrid and backbone-only attack accuracy.","Beyond the paper: because the slices are the only components trained on private data, the recipe could be tested against other white-box attacks such as model inversion or training-data extraction, which the paper does not evaluate.","Beyond the paper: the linear-attention substitution changes the model's behavior on long-context tasks, so a testable extension is whether TEESlice's security guarantee persists when linear attention materially degrades quality and the interpolation factor must favor the original attention."],"forward_implications":["On-device CNN models can keep most computation on an untrusted GPU while achieving the same model-stealing and membership-inference resistance as shielding the whole model.","The partition-before-training recipe removes the need to search for a security/utility 'sweet spot' per model and dataset, since the private slices are the only sensitive weights by construction.","For large language models, the private functionality can be compressed into LoRA slices that consume about 0.09% of the model's FLOPs, with accuracy loss under about 0.24% in the reported ViT experiments.","One-time-pad encryption plus Freivalds verification means the GPU not only cannot learn the private features but also cannot silently corrupt the outsourced linear computations."],"supporting_citations":[{"why":"Provides the one-time-pad encryption and Freivalds verification for outsourcing linear layers, the channel protection TEESlice reuses and extends.","marker":"[137]"},{"why":"The shielding-deep-layers representative that TEESlice benchmarks against and shows to leak near-white-box information under the knowledgeable-adversary threat model.","marker":"[98]"},{"why":"The shielding-non-linear-layers plus weight-obfuscation representative whose obfuscation the paper's attacker recovers 95% of weights from.","marker":"[133]"},{"why":"The shielding-large-magnitude-weights representative that motivates the per-weight partitioning the paper rejects in favor of partition-before-training.","marker":"[46]"},{"why":"Supplies the dense slice training framework with importance scalars that TEESlice adapts for generating and pruning private slices.","marker":"[99]"},{"why":"Supplies the query-based model stealing attack implementation used to test both prior defenses and TEESlice.","marker":"[1]"},{"why":"Supplies the confidence-based membership inference attack and dataset split protocol used in the evaluations.","marker":"[85]"},{"why":"Defines the low-rank adaptation (LoRA) layers that serve as the private slices in the large-language-model extension.","marker":"[47]"}],"fun_headline_variants":["Pre-trained? No problem: TEESlice shields only tiny private slices","Reverse partitioning: public model on GPU, private slices in TEE","TEESlice cuts TEE cost 10x, beats prior defenses on security","Know your attacker: pre-trained models guide TEESlice's split","Private slices only: full protection, 3.44% TEE cost"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The public backbone, which runs entirely outside the TEE, must not itself be able to perform the private task or leak the private training data, because the paper's security claim rests on the offloaded weights carrying no private information.","fun_headline_variants_meta":{"raw":{"variants":["Pre-trained? No problem: TEESlice shields only tiny private slices","Reverse partitioning: public model on GPU, private slices in TEE","TEESlice cuts TEE cost 10x, beats prior defenses on security","Know your attacker: pre-trained models guide TEESlice's split","Private slices only: full protection, 3.44% TEE cost"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000247,"raw_usage":{"total_tokens":1571,"prompt_tokens":1000,"completion_tokens":571,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":616,"completion_tokens_details":{"reasoning_tokens":474}},"tokens_in":616,"tokens_out":571,"duration_ms":6213,"temperature":1.0,"reasoning_tokens":474,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T20:08:30.808536+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A decisive experiment is to take a TEESlice hybrid model trained on a task close to the backbone's pre-training distribution, drop the slices, and measure the model-stealing accuracy of a surrogate trained from the backbone alone; whenever that accuracy approaches the accuracy of a surrogate trained from the full hybrid model, the claim that the slices are the exclusive carriers of private functionality fails, and with it the 'full model protection' guarantee.","supporting_citations":[],"review_version":1}