# TrEEStealer: Stealing Decision Trees via Enclave Side Channels

arXiv: https://arxiv.org/abs/2604.18716 · HTML: https://mlsanity.com/paper/2604.18716/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 21 of its 56 references that are in the map.
- First posted on arXiv 20 Apr 2026.

## Builds on (most cited first, 21 of 21)

- [Stealing Machine Learning Models via Prediction APIs](https://mlsanity.com/paper/1609.02943/) (2016)
- [High Accuracy and High Fidelity Extraction of Neural Networks](https://mlsanity.com/paper/1909.01838/) (2019)
- [Exploring Connections Between Active Learning and Model Extraction](https://mlsanity.com/paper/1811.02054/) (2018)
- [Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architectures](https://mlsanity.com/paper/1808.04761/) (2018)
- [DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memories](https://mlsanity.com/paper/2111.04625/) (2021)
- [Model Extraction Attacks on Graph Neural Networks: Taxonomy and Realization](https://mlsanity.com/paper/2010.12751/) (2020)
- [SNIFF: Reverse Engineering of Neural Networks with Fault Attacks](https://mlsanity.com/paper/2002.11021/) (2020)
- [Model Extraction Attacks Revisited](https://mlsanity.com/paper/2312.05386/) (2023)
- [Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX](https://mlsanity.com/paper/1705.07289/) (2017)
- [SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Execution](https://mlsanity.com/paper/1802.09085/) (2018)
- [Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing](https://mlsanity.com/paper/1611.06952/) (2016)
- [Secure Collaborative Training and Inference for XGBoost](https://mlsanity.com/paper/2010.02524/) (2020)
- [AUTOLYCUS: Exploiting Explainable AI (XAI) for Model Extraction Attacks against Interpretable Models](https://mlsanity.com/paper/2302.02162/) (2023)
- [CacheZoom: How SGX Amplifies The Power of Cache Attacks](https://mlsanity.com/paper/1703.06986/) (2017)
- [Fault Injection and Safe-Error Attack for Extraction of Embedded Neural Network Models](https://mlsanity.com/paper/2308.16703/) (2023)
- [SEV-Step: A Single-Stepping Framework for AMD-SEV](https://mlsanity.com/paper/2307.14757/) (2023)
- [Spectre Returns! Speculation Attacks using the Return Stack Buffer](https://mlsanity.com/paper/1807.07940/) (2018)
- [CopyCat: Controlled Instruction-Level Attacks on Enclaves](https://mlsanity.com/paper/2002.08437/) (2020)
- [Activation Functions Considered Harmful: Recovering Neural Network Weights through Controlled Channels](https://mlsanity.com/paper/2503.19142/) (2025)
- [EnclaveTree: Privacy-preserving Data Stream Training and Inference Using TEE](https://mlsanity.com/paper/2203.01438/) (2022)
- [BarkBeetle: Stealing Decision Tree Models with Fault Injection](https://mlsanity.com/paper/2507.06986/) (2025)

## Abstract (arXiv)

Today, machine learning is widely applied in sensitive, security-related, and financially lucrative applications. Model extraction attacks undermine current business models where a model owner sells model access, e.g., via MLaaS APIs. Additionally, stolen models can enable powerful white-box attacks, facilitating privacy attacks on sensitive training data, and model evasion. In this paper, we focus on Decision Trees (DT), which are widely deployed in practice. Existing black-box extraction attacks for DTs are either query-intensive, make strong assumptions about the DT structure, or rely on rich API information. To limit attacks to the black-box setting, CPU vendors introduced Trusted Execution Environments (TEE) that use hardware-mechanisms to isolate workloads from external parties, e.g., MLaaS providers. We introduce TrEEStealer, a high-fidelity extraction attack for stealing TEE-protected DTs. TrEEStealer exploits TEE-specific side-channels to steal DTs efficiently and without strong assumptions about the API output or DT structure. The extraction efficacy stems from a novel algorithm that maximizes the information derived from each query by coupling Control-Flow Information (CFI) with passive information tracking. We use two primitives to acquire CFI: for AMD SEV, we follow previous work using the SEV-Step framework and performance counters. For Intel SGX, we reproduce prior findings on current Xeon 6 CPUs and construct a new primitive to efficiently extract the branch history of inference runs through the Branch-History-Register. We found corresponding vulnerabilities in three popular libraries: OpenCV, mlpack, and emlearn. We show that TrEEStealer achieves superior efficiency and extraction fidelity compared to prior attacks. Our work establishes a new state-of-the-art for DT extraction and confirms that TEEs fail to protect against control-flow leakage.