# CoreGuard: Safeguarding Foundational Capabilities of LLMs Against Model Stealing in Edge Deployment

arXiv: https://arxiv.org/abs/2410.13903 · HTML: https://mlsanity.com/paper/2410.13903/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 31 of its 63 references that are in the map.
- First posted on arXiv 16 Oct 2024.

## Builds on (most cited first, 30 of 31)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [Llama 2: Open Foundation and Fine-Tuned Chat Models](https://mlsanity.com/paper/2307.09288/) (2023)
- [Training Verifiers to Solve Math Word Problems](https://mlsanity.com/paper/2110.14168/) (2021)
- [EfficientNet: Rethinking Model Scaling for Convolutional Neural Networks](https://mlsanity.com/paper/1905.11946/) (2019)
- [SQuAD: 100,000+ Questions for Machine Comprehension of Text](https://mlsanity.com/paper/1606.05250/) (2016)
- [Qwen2 Technical Report](https://mlsanity.com/paper/2407.10671/) (2024)
- [PubMedQA: A Dataset for Biomedical Research Question Answering](https://mlsanity.com/paper/1909.06146/) (2019)
- [Spider: A Large-Scale Human-Labeled Dataset for Complex and Cross-Domain Semantic Parsing and Text-to-SQL Task](https://mlsanity.com/paper/1809.08887/) (2018)
- [GLM: General Language Model Pretraining with Autoregressive Blank Infilling](https://mlsanity.com/paper/2103.10360/) (2021)
- [BloombergGPT: A Large Language Model for Finance](https://mlsanity.com/paper/2303.17564/) (2023)
- [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018)
- [LUKE: Deep Contextualized Entity Representations with Entity-aware Self-attention](https://mlsanity.com/paper/2010.01057/) (2020)
- [Knockoff Nets: Stealing Functionality of Black-Box Models](https://mlsanity.com/paper/1812.02766/) (2018)
- [Entangled Watermarks as a Defense against Model Extraction](https://mlsanity.com/paper/2002.12200/) (2020)
- [LGESQL: Line Graph Enhanced Text-to-SQL Model with Mixed Local and Non-Local Relations](https://mlsanity.com/paper/2106.01093/) (2021)
- [Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware](https://mlsanity.com/paper/1806.03287/) (2018)
- [Graphix-T5: Mixing Pre-Trained Transformers with Graph-Aware Layers for Text-to-SQL Parsing](https://mlsanity.com/paper/2301.07507/) (2023)
- [Offsite-Tuning: Transfer Learning without Full Model](https://mlsanity.com/paper/2302.04870/) (2023)
- [DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environments](https://mlsanity.com/paper/2004.05703/) (2020)
- [ShadowNet: A Secure and Efficient On-device Model Inference System for Convolutional Neural Networks](https://mlsanity.com/paper/2011.05905/) (2020)
- [No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device ML](https://mlsanity.com/paper/2310.07152/) (2023)
- [NNSplitter: An Active Defense Solution for DNN Model via Automated Weight Obfuscation](https://mlsanity.com/paper/2305.00097/) (2023)
- [Serdab: An IoT Framework for Partitioning Neural Networks Computation across Multiple Enclaves](https://mlsanity.com/paper/2005.06043/) (2020)
- [Boosting Neural Networks to Decompile Optimized Binaries](https://mlsanity.com/paper/2301.00969/) (2023)
- [TransLinkGuard: Safeguarding Transformer Models Against Model Stealing in Edge Deployment](https://mlsanity.com/paper/2404.11121/) (2024)
- [GuardNN: Secure Accelerator Architecture for Privacy-Preserving Deep Learning](https://mlsanity.com/paper/2008.11632/) (2020)
- [Confidential Computing on NVIDIA Hopper GPUs: A Performance Benchmark Study](https://mlsanity.com/paper/2409.03992/) (2024)
- [HybCache: Hybrid Side-Channel-Resilient Caches for Trusted Execution Environments](https://mlsanity.com/paper/1909.09599/) (2019)

## Built on by (most cited first, 5 of 5)

- [A Survey on Model Extraction Attacks and Defenses for Large Language Models](https://mlsanity.com/paper/2506.22521/) (2025)
- [Activation Functions Considered Harmful: Recovering Neural Network Weights through Controlled Channels](https://mlsanity.com/paper/2503.19142/) (2025)
- [Spill The Beans: Exploiting CPU Cache Side-Channels to Leak Tokens from Large Language Models](https://mlsanity.com/paper/2505.00817/) (2025)
- [CryptoTensors: A Light-Weight Large Language Model File Format for Highly-Secure Model Distribution](https://mlsanity.com/paper/2512.04580/) (2025)
- [The Safeguard Worked. Is the LLM System Safer?](https://mlsanity.com/paper/2609.00519/) (2026)

## Abstract (arXiv)

Proprietary large language models (LLMs) exhibit strong generalization capabilities across diverse tasks and are increasingly deployed on edge devices for efficiency and privacy reasons. However, deploying proprietary LLMs at the edge without adequate protection introduces critical security threats. Attackers can extract model weights and architectures, enabling unauthorized copying and misuse. Even when protective measures prevent full extraction of model weights, attackers may still perform advanced attacks, such as fine-tuning, to further exploit the model. Existing defenses against these threats typically incur significant computational and communication overhead, making them impractical for edge deployment. To safeguard the edge-deployed LLMs, we introduce CoreGuard, a computation- and communication-efficient protection method. CoreGuard employs an efficient protection protocol to reduce computational overhead and minimize communication overhead via a propagation protocol. Extensive experiments show that CoreGuard achieves upper-bound security protection with negligible overhead.