Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

DistilLock: Safeguarding LLMs from Unauthorized Knowledge Distillation on the Edge

Asmita Mohanty, Gezheng Kang, Lei Gao, Murali Annavaram

TL;DR

DistilLock tackles privacy and IP leakage in on-device fine-tuning by executing a proprietary teacher inside a hardware TEE and using permutation-based model obfuscation to offload heavy computation to untrusted accelerators; authorization within the TEE ensures correct logits are produced only for the authorized configuration, effectively safeguarding both data and model IP during knowledge distillation. The paper demonstrates that authorized KD yields gains while unauthorized KD fails to provide learning signals, and that surrogate-model attacks are substantially mitigated with minimal additional overhead. Empirical results across multiple models and tasks show robust defense against model extraction with FLOP overhead under 1.2% inside the TEE, enabling practical edge personalization of LLMs. Overall, DistilLock presents a secure, efficient approach to private, on-device KD that preserves both privacy and IP in edge environments.

Abstract

Large Language Models (LLMs) have demonstrated strong performance across diverse tasks, but fine-tuning them typically relies on cloud-based, centralized infrastructures. This requires data owners to upload potentially sensitive data to external servers, raising serious privacy concerns. An alternative approach is to fine-tune LLMs directly on edge devices using local data; however, this introduces a new challenge: the model owner must transfer proprietary models to the edge, which risks intellectual property (IP) leakage. To address this dilemma, we propose DistilLock, a TEE-assisted fine-tuning framework that enables privacy-preserving knowledge distillation on the edge. In DistilLock, a proprietary foundation model is executed within a trusted execution environment (TEE) enclave on the data owner's device, acting as a secure black-box teacher. This setup preserves both data privacy and model IP by preventing direct access to model internals. Furthermore, DistilLock employs a model obfuscation mechanism to offload obfuscated weights to untrusted accelerators for efficient knowledge distillation without compromising security. We demonstrate that DistilLock prevents unauthorized knowledge distillation processes and model-stealing attacks while maintaining high computational efficiency, but offering a secure and practical solution for edge-based LLM personalization.

DistilLock: Safeguarding LLMs from Unauthorized Knowledge Distillation on the Edge

TL;DR

DistilLock tackles privacy and IP leakage in on-device fine-tuning by executing a proprietary teacher inside a hardware TEE and using permutation-based model obfuscation to offload heavy computation to untrusted accelerators; authorization within the TEE ensures correct logits are produced only for the authorized configuration, effectively safeguarding both data and model IP during knowledge distillation. The paper demonstrates that authorized KD yields gains while unauthorized KD fails to provide learning signals, and that surrogate-model attacks are substantially mitigated with minimal additional overhead. Empirical results across multiple models and tasks show robust defense against model extraction with FLOP overhead under 1.2% inside the TEE, enabling practical edge personalization of LLMs. Overall, DistilLock presents a secure, efficient approach to private, on-device KD that preserves both privacy and IP in edge environments.

Abstract

Large Language Models (LLMs) have demonstrated strong performance across diverse tasks, but fine-tuning them typically relies on cloud-based, centralized infrastructures. This requires data owners to upload potentially sensitive data to external servers, raising serious privacy concerns. An alternative approach is to fine-tune LLMs directly on edge devices using local data; however, this introduces a new challenge: the model owner must transfer proprietary models to the edge, which risks intellectual property (IP) leakage. To address this dilemma, we propose DistilLock, a TEE-assisted fine-tuning framework that enables privacy-preserving knowledge distillation on the edge. In DistilLock, a proprietary foundation model is executed within a trusted execution environment (TEE) enclave on the data owner's device, acting as a secure black-box teacher. This setup preserves both data privacy and model IP by preventing direct access to model internals. Furthermore, DistilLock employs a model obfuscation mechanism to offload obfuscated weights to untrusted accelerators for efficient knowledge distillation without compromising security. We demonstrate that DistilLock prevents unauthorized knowledge distillation processes and model-stealing attacks while maintaining high computational efficiency, but offering a secure and practical solution for edge-based LLM personalization.
Paper Structure (12 sections, 9 equations, 2 figures, 2 tables)

This paper contains 12 sections, 9 equations, 2 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Background and Threat Model
  3. DistilLock's Defense Mechanism
  4. Experiments
  5. Distillation Lockdown
  6. Adversarial Training
  7. Efficiency Cost
  8. Related Work
  9. Conclusion
  10. Limitations
  11. LayerNorm and RMSNorm Proof
  12. Experimental Setup Details

Figures (2)

  • Figure 1: Overview of DistilLock. The proprietary teacher model is obfuscated before deployment and executed with TEE authorization on the user’s device. The TEE applies the correct permutation and one-time pad to the input, while compute-intensive operations run on untrusted accelerators using obfuscated weights. This design preserves model functionality for authorized knowledge distillation while preventing unauthorized access or model extraction.
  • Figure 2: Knowledge distillation results under DistilLock. Authorized distillation improves student accuracy over pre-distillation baselines, while unauthorized distillation collapses performance due to random logits from the obfuscated teacher.