TrEEStealer: Stealing Decision Trees via Enclave Side Channels
Not on the map. Why?
Abstract (arXiv)
Today, machine learning is widely applied in sensitive, security-related, and financially lucrative applications. Model extraction attacks undermine current business models where a model owner sells model access, e.g., via MLaaS APIs. Additionally, stolen models can enable powerful white-box attacks, facilitating privacy attacks on sensitive training data, and model evasion. In this paper, we focus on Decision Trees (DT), which are widely deployed in practice. Existing black-box extraction attacks for DTs are either query-intensive, make strong assumptions about the DT structure, or rely on rich API information. To limit attacks to the black-box setting, CPU vendors introduced Trusted Execution Environments (TEE) that use hardware-mechanisms to isolate workloads from external parties, e.g., MLaaS providers. We introduce TrEEStealer, a high-fidelity extraction attack for stealing TEE-protected DTs. TrEEStealer exploits TEE-specific side-channels to steal DTs efficiently and without strong assumptions about the API output or DT structure. The extraction efficacy stems from a novel algorithm that maximizes the information derived from each query by coupling Control-Flow Information (CFI) with passive information tracking. We use two primitives to acquire CFI: for AMD SEV, we follow previous work using the SEV-Step framework and performance counters. For Intel SGX, we reproduce prior findings on current Xeon 6 CPUs and construct a new primitive to efficiently extract the branch history of inference runs through the Branch-History-Register. We found corresponding vulnerabilities in three popular libraries: OpenCV, mlpack, and emlearn. We show that TrEEStealer achieves superior efficiency and extraction fidelity compared to prior attacks. Our work establishes a new state-of-the-art for DT extraction and confirms that TEEs fail to protect against control-flow leakage.
Key facts. No citing papers in the map yet (data through 13 Oct 2026). Builds on 21 of its 56 references that are in the map. First posted on arXiv 20 Apr 2026.
Builds on
21 of 56 references.
References · 21
- 2016Stealing Machine Learning Models via Prediction APIscited by 617
- 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 213
- 2018Exploring Connections Between Active Learning and Model Extractioncited by 85
- 2018Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architecturescited by 57
- 2021DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memoriescited by 42
- 2020Model Extraction Attacks on Graph Neural Networks: Taxonomy and Realizationcited by 40
- 2020SNIFF: Reverse Engineering of Neural Networks with Fault Attackscited by 23
- 2023Model Extraction Attacks Revisitedcited by 21
- 2017Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGXcited by 15
- 2018SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Executioncited by 14
- 2016Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowingcited by 10
- 2020Secure Collaborative Training and Inference for XGBoostcited by 9
9 more
- 2023AUTOLYCUS: Exploiting Explainable AI (XAI) for Model Extraction Attacks against Interpretable Modelscited by 9
- 2017CacheZoom: How SGX Amplifies The Power of Cache Attackscited by 7
- 2023Fault Injection and Safe-Error Attack for Extraction of Embedded Neural Network Modelscited by 5
- 2023SEV-Step: A Single-Stepping Framework for AMD-SEVcited by 4
- 2018Spectre Returns! Speculation Attacks using the Return Stack Buffercited by 3
- 2020CopyCat: Controlled Instruction-Level Attacks on Enclavescited by 2
- 2025Activation Functions Considered Harmful: Recovering Neural Network Weights through Controlled Channelscited by 2
- 2022EnclaveTree: Privacy-preserving Data Stream Training and Inference Using TEEcited by 1
- 2025BarkBeetle: Stealing Decision Tree Models with Fault Injectioncited by 1
Built on by
Not cited yet.