TrEEStealer: Stealing Decision Trees via Enclave Side Channels

• URL: http://arxiv.org/abs/2604.18716v1
• Date: Mon, 20 Apr 2026 18:17:01 GMT
• Title: TrEEStealer: Stealing Decision Trees via Enclave Side Channels
• Abstract summary: We introduce TrEEStealer, a high-fidelity extraction attack for stealing TEE-protected Decision Trees.<n> TrEEStealer exploits TEE-specific-channels to steal DTs efficiently and without strong assumptions about the API output or DT structure.<n>Our work establishes a new state-of-the-art for DT extraction and confirms TEEs fail to protect against control-flow leakage.
• Score: 31.767730885781777
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Today, machine learning is widely applied in sensitive, security-related, and financially lucrative applications. Model extraction attacks undermine current business models where a model owner sells model access, e.g., via MLaaS APIs. Additionally, stolen models can enable powerful white-box attacks, facilitating privacy attacks on sensitive training data, and model evasion. In this paper, we focus on Decision Trees (DT), which are widely deployed in practice. Existing black-box extraction attacks for DTs are either query-intensive, make strong assumptions about the DT structure, or rely on rich API information. To limit attacks to the black-box setting, CPU vendors introduced Trusted Execution Environments (TEE) that use hardware-mechanisms to isolate workloads from external parties, e.g., MLaaS providers. We introduce TrEEStealer, a high-fidelity extraction attack for stealing TEE-protected DTs. TrEEStealer exploits TEE-specific side-channels to steal DTs efficiently and without strong assumptions about the API output or DT structure. The extraction efficacy stems from a novel algorithm that maximizes the information derived from each query by coupling Control-Flow Information (CFI) with passive information tracking. We use two primitives to acquire CFI: for AMD SEV, we follow previous work using the SEV-Step framework and performance counters. For Intel SGX, we reproduce prior findings on current Xeon 6 CPUs and construct a new primitive to efficiently extract the branch history of inference runs through the Branch-History-Register. We found corresponding vulnerabilities in three popular libraries: OpenCV, mlpack, and emlearn. We show that TrEEStealer achieves superior efficiency and extraction fidelity compared to prior attacks. Our work establishes a new state-of-the-art for DT extraction and confirms that TEEs fail to protect against control-flow leakage.

Related papers

• dataRLsec: Safety, Security, and Reliability With Robust Offline Reinforcement Learning for DPAs [0.0]
  Data poisoning attacks (DPAs) are becoming popular as artificial intelligence (AI) algorithms, machine learning (ML) algorithms, and deep learning (DL) algorithms in this artificial intelligence (AI) era.<n>Hackers and testers are injecting malicious contents in the training data (and in testing data too) that leads to false results that are very hard to inspect and predict.<n>We have analyzed several recent technologies used for the DPAs and their safety, security, & countermeasures.
  arXiv  Detail & Related papers  (2026-01-03T21:28:17Z)
• VulnLLM-R: Specialized Reasoning LLM with Agent Scaffold for Vulnerability Detection [45.69684471143409]
  VulnLLM-R is theemphfirst specialized reasoning LLM for vulnerability detection.<n>We train a reasoning model with seven billion parameters.<n>We show that VulnLLM-R has superior effectiveness and efficiency than SOTA static analysis tools.
  arXiv  Detail & Related papers  (2025-12-08T13:06:23Z)
• The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search [58.8834056209347]
  Large language models (LLMs) remain vulnerable to jailbreak attacks that bypass safety guardrails to elicit harmful outputs.<n>We introduce the Correlated Knowledge Attack Agent (CKA-Agent), a dynamic framework that reframes jailbreaking as an adaptive, tree-structured exploration of the target model's knowledge base.
  arXiv  Detail & Related papers  (2025-12-01T07:05:23Z)
• External Data Extraction Attacks against Retrieval-Augmented Large Language Models [70.47869786522782]
  RAG has emerged as a key paradigm for enhancing large language models (LLMs)<n>RAG introduces new risks of external data extraction attacks (EDEAs), where sensitive or copyrighted data in its knowledge base may be extracted verbatim.<n>We present the first comprehensive study to formalize EDEAs against retrieval-augmented LLMs.
  arXiv  Detail & Related papers  (2025-10-03T12:53:45Z)
• Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain [82.98626829232899]
  Fine-tuning AI agents on data from their own interactions introduces a critical security vulnerability within the AI supply chain.<n>We show that adversaries can easily poison the data collection pipeline to embed hard-to-detect backdoors.
  arXiv  Detail & Related papers  (2025-10-03T12:47:21Z)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents [52.92354372596197]
  Large Language Models (LLMs) are increasingly central to agentic systems due to their strong reasoning and planning capabilities.<n>This interaction also introduces the risk of prompt injection attacks, where malicious inputs from external sources can mislead the agent's behavior.<n>We propose a Dynamic Rule-based Isolation Framework for Trustworthy agentic systems, which enforces both control and data-level constraints.
  arXiv  Detail & Related papers  (2025-06-13T05:01:09Z)
• Exploiting Inaccurate Branch History in Side-Channel Attacks [54.218160467764086]
  This paper examines how resource sharing and contention affect two widely implemented but underdocumented features: Bias-Free Branch Prediction and Branch History Speculation.<n>We show that these features can inadvertently modify the Branch History Buffer (BHB) update behavior and create new primitives that trigger malicious mis-speculations.<n>We present three novel attack primitives: two Spectre attacks, namely Spectre-BSE and Spectre-BHS, and a cross-privilege control flow side-channel attack called BiasScope.
  arXiv  Detail & Related papers  (2025-06-08T19:46:43Z)
• Learning to Poison Large Language Models for Downstream Manipulation [12.521338629194503]
  This work identifies additional security risks in Large Language Models (LLMs) by designing a new data poisoning attack tailored to exploit the supervised fine-tuning process.<n>We propose a novel gradient-guided backdoor trigger learning (GBTL) algorithm to identify adversarial triggers efficiently.<n>We propose two defense strategies against data poisoning attacks, including in-context learning (ICL) and continuous learning (CL)
  arXiv  Detail & Related papers  (2024-02-21T01:30:03Z)
• Hiding Backdoors within Event Sequence Data via Poisoning Attacks [2.532893215351299]
  In computer vision, one can shape the output during inference by performing an adversarial attack called poisoning. For sequences of financial transactions of a customer, insertion of a backdoor is harder to perform. We replace a clean model with a poisoned one that is aware of the availability of a backdoor and utilize this knowledge.
  arXiv  Detail & Related papers  (2023-08-20T08:27:42Z)
• Kellect: a Kernel-Based Efficient and Lossless Event Log Collector for Windows Security [5.043058252123722]
  Existing log collection tools built on ETW for Windows suffer from working shortages, including data loss, high overhead, and weak real-time performance. This paper proposes an efficient and lossless kernel log collector called Kellect, which has open sourced with project at www.kellect.org.
  arXiv  Detail & Related papers  (2022-07-23T14:38:43Z)
• DeepTaskAPT: Insider APT detection using Task-tree based Deep Learning [1.5026200429729288]
  This paper proposes a heterogeneous task-tree based deep learning method to construct a baseline model based on sequences of tasks. Rather than applying the model to sequential log entries directly, DeepTaskAPT applies a process tree based task generation method. To the best of knowledge this is the very first attempt of using recently introduced OpTC dataset for cyber threat detection.
  arXiv  Detail & Related papers  (2021-08-31T17:22:34Z)
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection [67.53296659361598]
  adversarial EXEmples can bypass machine learning-based detection by perturbing relatively few input bytes. We develop a unifying framework that does not only encompass and generalize previous attacks against machine-learning models, but also includes three novel attacks. These attacks, named Full DOS, Extend and Shift, inject the adversarial payload by respectively manipulating the DOS header, extending it, and shifting the content of the first section.
  arXiv  Detail & Related papers  (2020-08-17T07:16:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.