CipherSteal: Stealing Input Data from TEE-Shielded Neural Networks with Ciphertext Side Channels

CipherSteal: Stealing Input Data from TEE-Shielded Neural Networks with Ciphertext Side Channels

Speakers: Yuanyuan Yuan, Zhibo Liu, Sen Deng, Yanzuo Chen, Shuai Wang, Yinqian Zhang

Conference: IEEE S&P

YouTube: https://www.youtube.com/watch?v=Uth1EI-pzxM

Overview

In an era where deep neural networks (DNNs) are increasingly processing sensitive user data—ranging from facial photos and biometric scans to highly personal genetic information—the imperative for robust privacy protection has never been greater. Trusted Execution Environments (TEEs) have emerged as a cornerstone technology for safeguarding such data, promising hardware-backed isolation where even a malicious host operating system cannot inspect the contents of protected memory. However, the talk "CipherSteal: Stealing Input Data from TEE-Shielded Neural Networks with Ciphertext Side Channels," presented by Yanzuo Chen at IEEE S&P, unveils a critical vulnerability that undermines these assurances, demonstrating how sensitive input data can be exfiltrated from TEE-protected DNNs.

The research behind CipherSteal exposes a sophisticated side-channel attack that exploits the fundamental design choices within TEEs—specifically, their reliance on deterministic encryption for efficient memory access—in conjunction with the inherent mathematical properties of modern neural networks. While deterministic encryption is generally considered secure against direct decryption, it creates a subtle yet powerful leakage vector when combined with the nonlinear activation functions that are essential to DNN intelligence. This presentation details how attackers can leverage these interactions to reconstruct high-fidelity versions of secret inputs, posing significant risks to user privacy and the intellectual property embedded in models.

The implications of CipherSteal are far-reaching. It challenges the prevailing assumption that simply encapsulating a DNN within a TEE is sufficient to protect its inputs. The presented methodology not only achieves high success rates in recovering sensitive data like images and videos but also demonstrates the pervasive nature of this leakage across various DNN runtimes, including both interpreter-based frameworks like PyTorch and compiler-based ones like TVM. This work serves as a stark reminder that even hardware-backed security primitives can be subverted when their operational characteristics interact in unforeseen ways with the computational patterns of modern applications, necessitating a re-evaluation of security paradigms for AI workloads in TEEs.

Background

▶ Watch: Introduction to TEEs and input data privacy risks (0:00)

The proliferation of deep neural networks across sensitive domains, from medical diagnostics to personal authentication, has brought the issue of data privacy to the forefront. Users frequently entrust these "black boxes" with highly personal information, such as biometric data, facial recognition inputs, or proprietary business intelligence. The risk of this input data being compromised extends beyond individual privacy violations; it can also lead to the theft of valuable models and intellectual property. To mitigate these risks, the industry has increasingly turned to Trusted Execution Environments (TEEs).

TEEs are hardware-backed security solutions designed to create isolated execution environments, often referred to as "enclaves" or "secure enclaves." Within these environments, code and data are protected from external scrutiny, even from a privileged operating system or hypervisor that might otherwise have full control over the host machine. The core mechanism enabling this protection is memory encryption, directly handled by the hardware. When data is written to a TEE-protected memory region, it is encrypted; when read, it is decrypted. Crucially, a malicious host can only ever observe the encrypted ciphertext, never the plaintext data itself. This design is foundational to the security guarantees offered by TEEs.

However, the efficiency requirements of TEEs, particularly the need to support large memory regions and provide random access to encrypted data without prohibitive performance overheads, necessitate a specific type of encryption: deterministic encryption. In a deterministically encrypted system, writing the exact same data to the exact same memory address will always result in the exact same ciphertext. This property, while efficient, introduces a subtle vulnerability: ciphertext collisions. If an attacker can observe repeated writes to a memory location and detect identical ciphertext values, they can infer that the underlying plaintext data was identical.

Historically, this principle has been leveraged in side-channel attacks against cryptographic operations, where an attacker might observe encrypted bit streams to infer secret keys. For instance, if a system processes a cryptographic key bit by bit, and each bit's processing involves a memory write that produces a collision when the bit is '0' but not when it's '1' (or vice versa), an attacker could reconstruct the key. However, applying this technique directly to DNN inputs presents a significant challenge. The data typically processed by DNNs consists of floating-point numbers, which possess a much wider range of possible values compared to binary bits. Consequently, the probability of two distinct floating-point inputs directly resulting in the exact same memory value (and thus a ciphertext collision) is exceedingly low, leading many to believe that TEEs adequately protected DNN inputs from such side channels. The CipherSteal research fundamentally challenges this assumption by identifying a critical interaction between TEE design and DNN architecture that amplifies these collision probabilities.

Key Findings

▶ Watch: Nonlinearity: how DNN activation functions enable attacks (2:20)

The CipherSteal research delivers several pivotal findings that fundamentally alter our understanding of TEE security guarantees for neural network workloads. The most significant discovery is the critical role of nonlinear activation functions in enabling ciphertext side-channel attacks against DNNs. While direct plaintext collisions for wide-ranging floating-point numbers are rare, these activation functions, which are indispensable for a DNN's ability to learn complex patterns and break linear limitations, inherently map values from a larger input range to a much smaller, constrained output range. This transformation dramatically increases the probability of identical values appearing in memory post-activation, thereby creating frequent ciphertext collisions that an attacker can observe. This insight is the lynchpin that transforms an otherwise impractical side channel into a potent attack vector.

Building upon this understanding, the researchers developed and validated the CipherSteal attack, demonstrating its high efficacy in recovering sensitive input data. The attack successfully reconstructs visually and semantically meaningful inputs, such as facial images and even video frames, which are "pretty close to the ground truth." This capability directly translates into two major security compromises: user privacy compromise, where an attacker can steal highly personal data like biometric identifiers or genetic information, and model and intellectual property stealing, where knowledge of specific inputs and their corresponding outputs can aid in reverse-engineering proprietary models.

Furthermore, the study reveals the pervasive nature of this leakage. Experiments conducted across different neural network runtimes—including interpreter-based frameworks like PyTorch and compiler-based ones like TVM—confirmed that the side channel is not confined to specific implementations or configurations. The researchers found that "various primitive operators and almost all compiled layers cause a side channel," indicating that the vulnerability stems from fundamental architectural choices common across the DNN ecosystem rather than isolated bugs. This widespread applicability underscores the gravity of the threat and suggests that a broad spectrum of TEE-protected AI applications may be susceptible.

Finally, the research introduces an innovative "generate and deconstruct" problem transformation for data recovery. Recognizing that direct reconstruction from the coarse-grain side-channel trace is insufficient due to information loss, the team devised a method that leverages prior knowledge about the characteristics of real-world data (e.g., what a semantically meaningful image looks like). By combining this prior knowledge with a simulation of the information loss inherent in the side channel, the attack can iteratively refine a generated input until its simulated side-channel trace matches the observed one, effectively reconstructing the secret input with high fidelity. This sophisticated recovery mechanism is crucial to the attack's success, overcoming the inherent limitations of sparse side-channel information.

Technical Deep Dive

▶ Watch: Proposed attack: the 'generate and deconstruct' methodology (4:00)

The CipherSteal attack hinges on a sophisticated understanding of how Trusted Execution Environments (TEEs) handle memory and how this interacts with the unique computational patterns of deep neural networks. At its core, the vulnerability exploits the TEE's reliance on deterministic encryption. To efficiently support large memory regions and provide random access, TEEs encrypt memory in a way that ensures writing the same data to the same memory address consistently produces the identical ciphertext. This property, while optimizing performance, creates the potential for ciphertext collisions: if an attacker can observe two identical ciphertexts at the same memory location (or even across different locations if the encryption context is shared), they can infer that the underlying plaintext values were identical.

Traditionally, the threat of ciphertext collisions for DNN inputs was considered minimal. DNNs primarily operate on floating-point numbers, which represent a vast range of values. The probability of two distinct, meaningful floating-point inputs happening to be exactly identical in memory (thus causing a direct collision) is statistically negligible. This meant that while TEEs used deterministic encryption, the nature of DNN data seemed to provide an implicit defense against such side channels.

However, the CipherSteal research identifies a crucial missing piece: the role of nonlinear activation functions. These functions are fundamental to the power and complexity of modern DNNs, allowing them to learn non-linear relationships in data. Without them, DNNs would simply be chains of linear transformations, severely limiting their representational capacity. Examples include ReLU (Rectified Linear Unit), Sigmoid, and Tanh, among many others. The key characteristic exploited by CipherSteal is that these activation functions typically map values from a wide input range to a much narrower, often bounded, output range. For instance, a Sigmoid function squashes any real-valued input into the range (0, 1). A ReLU function clips all negative values to zero. This range compression drastically increases the likelihood of multiple distinct input values mapping to the same output value, or multiple intermediate computations resulting in the same value after activation. When these identical post-activation values are written to TEE-protected memory, they generate observable ciphertext collisions, providing the attacker with a coarse-grain side-channel trace of the DNN's internal state.

The challenge then becomes how to reconstruct the original, high-fidelity input data from this inherently lossy, coarse-grain side-channel information. A straightforward approach of training a neural network to directly recover the data proved ineffective, as too much information is lost in the side-channel trace. To overcome this, the researchers ingeniously transformed the recovery problem into a "generate and deconstruct" objective, guided by Bayes theorem. This approach flips the traditional perspective: instead of trying to deduce the input directly from the observation, the attacker seeks an input that, when processed through a simulated side-channel, produces the observed trace.

The methodology involves three main steps:

1. Guided Image Generation: The attacker starts by generating a candidate input image (or other data). This generation process is not random; it is guided by prior knowledge about the characteristics of real-world data. For example, if the target is a facial image, the generation process would favor outputs that resemble actual faces, incorporating semantic meaning and realistic structures. This "prior" helps constrain the vast search space and compensates for the information lost in the side channel. The talk specifically mentions that "real world data is not just random. They follow constraints," and this is key to guiding the initial guess.

1. Deconstruction Simulation: For the generated candidate image, the attacker then simulates the information loss that would occur if this image were processed by the victim DNN within the TEE and observed via the side channel. This involves understanding the victim model's architecture and the specific points where nonlinear activation functions cause value compression and subsequent ciphertext collisions. By profiling the victim model (e.g., observing its behavior with known inputs), the attacker can learn the "rules" of information loss. This simulation produces a "deconstructed image" or a simulated coarse-grain trace that mirrors what the attacker would observe from the TEE side channel if the generated image were the true input.

1. Minimization Objective and Optimization: The final step is to minimize the distance between the simulated coarse-grain trace (derived from the generated image) and the actual coarse-grain side-channel trace observed from the victim TEE. This distance becomes the optimization objective. The attacker then iteratively refines the generated image, adjusting its features to progressively reduce this distance. Through this iterative optimization process, guided by the objective function and the prior knowledge, the generated image converges towards the secret input data that would have produced the observed side-channel trace. The presenter illustrates this as starting with a guess, optimizing it, and further optimizing until an optimum is reached where the deconstructed image matches the observed coarse-grain image.

This "generate and deconstruct" approach effectively leverages the limited, coarse-grain information from ciphertext collisions, augmented by external knowledge about data structures, to reconstruct highly detailed and sensitive inputs. The success of this method underscores a profound interaction between hardware security primitives and software application logic, creating a new class of side-channel vulnerabilities.

Demo / Proof of Concept

▶ Watch: Successful recovery of input data (images and videos) (5:10)

While the talk did not feature a live, interactive demonstration, the research presented compelling evidence of the CipherSteal attack's efficacy through numerous examples and experimental results. The speakers showcased recovered data, emphasizing that the reconstructed inputs, particularly images and videos, were "pretty close to the ground truth." This visual fidelity serves as a powerful proof of concept, illustrating the attack's ability to extract semantically meaningful and high-resolution information from the TEE-protected environment. The presenter specifically invited attendees to visit their website for more examples, indicating a robust collection of successful reconstructions.

The experimental validation extended beyond mere visual examples to encompass a thorough analysis of the attack's applicability across different DNN execution environments. The researchers investigated both interpreter-based runtimes like PyTorch and compiler-based runtimes such as TVM. This broad testing scope was crucial for demonstrating the pervasive nature of the vulnerability. The findings indicated that the leakage is not confined to specific implementation quirks of one framework but is a more fundamental issue. Specifically, the study concluded that "various primitive operators and almost all compiled layers cause a side channel." This statement highlights that the underlying mechanisms leading to ciphertext collisions—namely, the interaction between deterministic encryption and nonlinear activation functions—are deeply embedded within the typical operations performed by neural networks, regardless of how they are executed.

The "high success rates" reported for both the objective of user privacy compromise and model stealing further solidify the practical threat posed by CipherSteal. This isn't a theoretical attack with marginal success; it consistently achieves its goals of reconstructing sensitive inputs. The ability to recover not just static images but also dynamic video sequences demonstrates the attack's robustness and scalability to different data types and processing pipelines. These experimental results collectively confirm that CipherSteal is a potent and broadly applicable threat to the privacy guarantees of TEE-shielded neural networks.

Defensive Implications

▶ Watch: Pervasive leakage across different neural network runtimes (5:40)

The CipherSteal attack presents a significant challenge to the current paradigm of protecting sensitive DNN workloads with Trusted Execution Environments. The core implication is that TEEs, when relying on deterministic encryption, are fundamentally insufficient on their own to protect the privacy of neural network inputs. This forces a critical re-evaluation of how AI systems are secured, especially those handling highly personal or proprietary data.

For developers and organizations deploying DNNs within TEEs, the immediate defensive implication is the urgent need to recognize this newly identified vulnerability. Blindly trusting TEEs to provide end-to-end input privacy is no longer tenable. Instead, a multi-layered security approach is required, extending beyond the TEE's hardware-backed isolation.

Several potential mitigation strategies can be considered, though they were not explicitly detailed in the talk, they can be inferred from the nature of the attack:

1. Transition to Non-Deterministic Encryption: The most direct countermeasure would be for TEE designs or memory encryption schemes to move away from deterministic encryption for sensitive regions. Using non-deterministic encryption modes, such as Authenticated Encryption with Associated Data (AEAD) modes that incorporate nonces or initialization vectors (IVs) for each encryption operation, would ensure that identical plaintext data results in different ciphertexts. This would effectively eliminate the ciphertext collisions that CipherSteal relies upon. However, this change could introduce performance overheads or complex memory management challenges for random access patterns, necessitating careful engineering.

1. Data Obfuscation and Perturbation: Before input data enters the TEE-protected DNN, it could be subjected to techniques that break patterns or introduce noise. This might include randomized padding, shuffling of data elements, or applying differential privacy mechanisms to the input. The goal would be to ensure that even if nonlinear activation functions compress value ranges, the resulting values are sufficiently diversified or noisy to prevent an attacker from reliably detecting collisions or reconstructing the original input. This would effectively obscure the "coarse-grain image" that the attacker attempts to match.

1. Hardware-Level TEE Enhancements: Future TEE designs could incorporate features specifically aimed at thwarting such side channels. This might involve memory access pattern obfuscation or dynamic re-encryption of memory regions to prevent long-term observation of stable ciphertext values. However, such hardware changes are complex, costly, and require broad industry adoption.

1. Application-Level Countermeasures: DNN developers could explore techniques that make their models less susceptible to this specific type of leakage. For example, ensuring that intermediate values after activation functions are not written directly to observable memory locations, or introducing random noise to internal computations within the TEE. This might involve using custom operators or secure execution primitives that are designed with side-channel resistance in mind.

1. Secure Multi-Party Computation (SMC) or Homomorphic Encryption (HE): For the most sensitive applications, integrating TEEs with other privacy-enhancing technologies like Secure Multi-Party Computation (SMC) or Homomorphic Encryption (HE) could offer stronger guarantees. While these technologies often come with significant performance overheads, they provide mathematical assurances of privacy even against malicious computation environments, complementing or even replacing TEEs in certain scenarios.

In essence, the CipherSteal attack highlights that security is a holistic property. Even robust hardware isolation can be undermined by the interplay of subtle design choices and application-specific computational patterns. Defenders must now consider the semantic impact of operations within the TEE, not just the cryptographic strength of its memory protection, when designing secure AI systems.

Key Takeaways

• Deterministic encryption in TEEs creates exploitable ciphertext side channels: The efficiency-driven design choice of deterministic memory encryption in TEEs, where identical data at the same address yields identical ciphertext, forms the fundamental basis of the CipherSteal attack.
• DNN nonlinearity enables collisions for floating-point data: Contrary to prior beliefs, the ubiquitous nonlinear activation functions in neural networks compress wide ranges of floating-point values into narrower outputs, significantly increasing the probability of observable ciphertext collisions, thus making the side channel practical for DNN inputs.
• CipherSteal uses a "generate and deconstruct" approach for robust reconstruction: The attack overcomes information loss by employing a sophisticated methodology that combines guided input generation (leveraging prior knowledge of real-world data) with a simulation of side-channel information loss, iteratively optimizing to reconstruct the secret input.
• The attack successfully steals sensitive user input and facilitates model IP theft: CipherSteal can recover high-fidelity images, videos, and other sensitive data, compromising user privacy (e.g., biometrics) and enabling the reverse-engineering or stealing of proprietary DNN models.
• The vulnerability is pervasive across DNN runtimes and operations: Experiments confirmed that the leakage affects both interpreter-based (e.g., PyTorch) and compiler-based (e.g., TVM) DNN runtimes, with "various primitive operators and almost all compiled layers" causing side channels, indicating a widespread problem.
• TEEs alone are insufficient for DNN input privacy; new mitigations are crucial: The research demonstrates that relying solely on TEEs for DNN input privacy is inadequate. Future designs must consider non-deterministic encryption, data obfuscation, or other advanced privacy-enhancing technologies to truly secure AI workloads.

About the Speaker(s)

The research behind CipherSteal was a collaborative effort by Yuanyuan Yuan, Zhibo Liu, Sen Deng, Yanzuo Chen, Shuai Wang, and Yinqian Zhang. The talk at IEEE S&P was presented by Yanzuo Chen, who articulated the complex technical details of the attack and its implications. While specific individual titles and affiliations were not detailed in the transcript, the collective work represents significant contributions from a team of researchers in the field of computer security, specifically focusing on trusted execution environments and the security of machine learning systems. Their work highlights advanced vulnerabilities at the intersection of hardware security and modern AI architectures.