CoreGuard: Safeguarding Foundational Capabilities of LLMs Against Model Stealing in Edge Deployment

2024-10-16

arXiv.org

AI Summary

Deploying proprietary large language models (LLMs) on edge devices faces fundamental capability leakage risks: adversaries can bypass weight-protection mechanisms via advanced attacks such as fine-tuning, while existing trusted execution environment (TEE) solutions incur prohibitive communication and computational overhead, rendering them impractical for edge deployment. This paper proposes CoreGuard—the first lightweight, propagatable TEE-based authorization mechanism specifically designed to protect LLMs’ foundational capabilities (rather than task-specific parameters). CoreGuard achieves core capability isolation with minimal overhead through three key innovations: capability abstraction, lightweight authorization protocols, and in-TEE propagation control. Experimental evaluation demonstrates that CoreGuard delivers black-box–equivalent security, incurs less than 0.5% inference latency overhead, reduces TEE–CPU communication volume by 92%, and enables real-time edge deployment—thereby overcoming the critical bottleneck hindering TEE adoption for edge-hosted LLMs.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: (Large) Language Models
• Computer Vision: Large Vision Models

Application Category

• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Economics, Online Markets and Human Computation: Cost models of using LLMs in production systems

Abstract

Proprietary large language models (LLMs) demonstrate exceptional generalization ability across various tasks. Additionally, deploying LLMs on edge devices is trending for efficiency and privacy reasons. However, edge deployment of proprietary LLMs introduces new security threats: attackers who obtain an edge-deployed LLM can easily use it as a base model for various tasks due to its high generalization ability, which we call foundational capability stealing. Unfortunately, existing model protection mechanisms are often task-specific and fail to protect general-purpose LLMs, as they mainly focus on protecting task-related parameters using trusted execution environments (TEEs). Although some recent TEE-based methods are able to protect the overall model parameters in a computation-efficient way, they still suffer from prohibitive communication costs between TEE and CPU/GPU, making it impractical to deploy for edge LLMs. To protect the foundational capabilities of edge LLMs, we propose CoreGuard, a computation- and communication-efficient model protection approach against model stealing on edge devices. The core component of CoreGuard is a lightweight and propagative authorization module residing in TEE. Extensive experiments show that CoreGuard achieves the same security protection as the black-box security guarantees with negligible overhead.

Problem

• Protecting proprietary LLMs from model extraction attacks
• Reducing computational and communication overhead in edge deployment
• Preventing unauthorized model copying and fine-tuning exploitation

Innovation

• Efficient protection protocol reduces computational overhead
• Propagation protocol minimizes communication overhead
• Achieves upper-bound security with negligible overhead