🤖 machine learning

Model Merging is Secretly Certifiable: Non-Vacuous Generalisation Bounds for Low-Shot Learning

This paper establishes a novel connection between model fusion and generalisation certificates, demonstrating that fusing pre-trained models rather than fine-tuning them enables non-vacuous generalisation bounds for high-stakes, low-shot learning scenarios using large-scale vision and language models.

Original authors: Taehoon Kim, Henry Gouk, Minyoung Kim, Timothy Hospedales

Published 2026-08-25

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Taehoon Kim, Henry Gouk, Minyoung Kim, Timothy Hospedales

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the world of artificial intelligence, there is a growing tension between the power of these systems and our ability to trust them. We rely on AI to make decisions in high-stakes fields like medicine and security, yet the most fundamental requirement for trust is knowing that a system will perform reliably on new, unseen data, not just on the examples it was trained on. For decades, scientists have tried to create mathematical guarantees that prove a model will not fail unexpectedly. However, these guarantees have often been useless for the massive, complex networks that power modern AI. The calculations required to prove safety for such large systems usually result in warnings so broad and pessimistic that they tell us nothing useful, essentially saying the error rate could be anywhere from zero to one hundred percent. This problem becomes even harder when there is very little data available to train the system, a common situation in specialized fields where gathering thousands of examples is impossible.

A team of researchers has discovered a surprising way to bypass these limitations by changing how they look at the learning process itself. Instead of trying to certify the entire massive neural network, they focused on a technique called model merging, which combines several pre-trained experts into a single new model. By treating the process of combining these models as a form of learning with very few adjustable settings, the researchers found they could apply rigorous safety checks that were previously impossible. Their work demonstrates that it is possible to provide meaningful, non-empty guarantees for the performance of huge artificial intelligence systems, even when they are trained on as few as one hundred examples. This finding suggests that the tools needed to certify the safety of today's most powerful AI models were already hiding in plain sight, waiting to be recognized through a different theoretical lens.

The core of this discovery lies in reimagining how we train and validate AI when data is scarce. Traditionally, to prove a model works, scientists split their limited data into a training set and a separate validation set. But when you only have a hundred examples, splitting them in half leaves you with too few to train a good model and too few to reliably test it. The researchers realized that a popular method called model merging offered a solution. In this approach, instead of training a giant network from scratch, you take several existing networks that have already learned different skills and blend them together. The blending is controlled by a small set of numbers, or weights, that determine how much each original network contributes to the final result. Because the number of these blending weights is tiny compared to the billions of parameters inside the original networks, the learning process becomes much simpler.

The researchers showed that this simplicity is the key to certification. They applied a framework known as PAC-Bayes, which is a method for calculating the probability that a model will perform well on new data. Usually, this method fails for large networks because the math gets too loose to be useful. However, because model merging only adjusts a handful of weights, the math stays tight. The team demonstrated that existing merging algorithms, which were designed simply to make the best possible combined model, were already providing these tight safety guarantees without any special modifications. In many cases, the standard way these algorithms worked was sufficient to prove that the resulting model would not fail catastrophically, even with very little training data.

To make these guarantees even stronger, the team developed a way to tweak the learning process. They modified the goal of the merging algorithm to explicitly minimize the safety bound itself, rather than just trying to get the lowest error on the training data. This adjustment allowed them to turn "empty" guarantees, which offered no real assurance, into concrete, useful limits on how often the model might fail. They tested this approach on two very different types of artificial intelligence: a vision system capable of recognizing images and a large language model capable of understanding text. For the vision system, they used a model with roughly eighty-eight million parameters, and for the language model, they used one with seven billion parameters. In both cases, they trained the systems on just one hundred examples per task.

The results were striking. For the vision tasks, the researchers were able to certify that the merged models would perform within a specific, narrow range of accuracy. For the language model, which is significantly larger and more complex, they achieved the same result. In many instances, the base language model performed poorly on new tasks when given no training examples, but after being merged and trained on just one hundred examples, the system not only improved its performance but also came with a mathematical certificate proving its reliability. The researchers found that for all datasets, the test error could be certified to be within 5% of the training error.

This work challenges the long-held belief that certifying large AI systems requires massive amounts of data. The researchers showed that by focusing on the small number of parameters that actually change during the merging process, the complexity of the system becomes manageable for safety proofs. They also explored a technique called data-dependent priors, which involves using a small portion of the training data to set up a better starting point for the safety calculation. This further tightened the guarantees, proving that the method is robust and adaptable. The study did not claim to solve all problems of AI safety, but it provided a clear path forward for certifying systems in low-data regimes, a scenario that is critical for real-world applications where data is expensive or difficult to obtain.

The implications of this finding extend beyond just the numbers. It suggests that the safety of existing AI systems might be easier to verify than previously thought. If the methods used to combine models can be certified so easily, then the systems built using these methods can be trusted with greater confidence. The researchers emphasized that this approach works for both image recognition and language understanding, indicating that the principle is general and not limited to a specific type of AI. By proving that non-vacuous, or meaningful, guarantees are possible for models as large as seven billion parameters with only one hundred examples, the team has opened a new avenue for ensuring that artificial intelligence can be safely deployed in the most critical areas of human life. The work stands as a demonstration that sometimes, the key to solving a complex theoretical problem is not to build a bigger machine, but to look at the existing one from a different angle.

Technical Summary: Model Merging is Secretly Certifiable

Problem Statement
The paper addresses the critical challenge of certifying the generalization ability of deep neural networks, particularly in high-stakes applications (e.g., medicine, security) where data is scarce (low-shot regimes). While theoretical generalization bounds exist, instantiating them for large-scale models (e.g., 7B parameter LLMs, ViT-B) typically results in "vacuous" certificates—guarantees so loose (e.g., error < 200%) that they offer no practical assurance. This issue is exacerbated in low-shot learning, where splitting limited data for training and validation further degrades performance, and standard empirical validation fails. Existing non-vacuous certification methods have historically been limited to smaller networks or require massive training sets.

Methodology
The authors propose a novel connection between Model Merging (or Model Fusion) and PAC-Bayes generalization bounds. Instead of deriving new theoretical bounds, they reinterpret existing model merging strategies through the lens of PAC-Bayes theory.

Model Merging as a Low-Dimensional Learner: Model merging constructs a target model $\theta_m$ by linearly interpolating the weights of $k$ pre-trained source models: $\theta_m = \sum \alpha_i \theta_i$ . Crucially, the number of learnable parameters is the number of merging weights ( $\alpha$ ), which is small and independent of the massive size of the source models.
PAC-Bayes Reinterpretation: The authors interpret the merging weights as parameters of a posterior distribution $Q$ $Q$ (modeled as a Gaussian) over the model space, with a uniform prior $P$ $P$ .
- Off-the-Shelf Certification: They demonstrate that standard merging algorithms (e.g., Task Arithmetic, Ties-Merging) can be immediately certified. By treating the learned weights as the mean of a posterior distribution, one can compute the Kullback-Leibler (KL) divergence between the prior and posterior. Because the number of merging parameters is small, the KL term remains manageable, often yielding non-vacuous bounds without modifying the original algorithm.
- Bound Optimization: To tighten bounds further, the authors propose directly optimizing the PAC-Bayes upper bound (Theorem 2) rather than just the training loss. This involves using gradient-free optimization (e.g., CMA-ES) to find merging weights that minimize the sum of empirical risk and the generalization gap term.
- Data-Dependent Priors (DDP): To handle methods with slightly more parameters (like Layer-wise AdaMerging), they employ a two-stage process: using a subset of data to construct an informative, data-dependent prior, and the remainder to optimize the posterior. This reduces the KL divergence, tightening the bound.
- Discretization: The paper also explores certifying deterministic merges using finite hypothesis classes (discretization bounds) as an alternative to stochastic Gaussian predictors.

Key Contributions

Non-Vacuous Bounds for Large Models: The paper provides the first demonstration of non-vacuous generalization guarantees for large-scale models (specifically CLIP-ViT-B/32 and Mistral-7B) in low-shot regimes (as few as 100 examples).
Retrofitting Existing Algorithms: It shows that several existing model merging strategies already provide non-trivial guarantees "off-the-shelf" when viewed through a PAC-Bayes framework, requiring only a reinterpretation of their output as a distribution.
Optimization Strategies: The introduction of bound-optimization objectives and data-dependent priors allows for certifying more complex merging schemes that would otherwise yield vacuous bounds.
Scalability: The approach successfully scales to 7B parameter LLMs, a regime where previous certification methods (e.g., full fine-tuning with Rademacher complexity or discretization on large models) failed to produce meaningful certificates.

Experimental Results
The authors evaluated their approach on:

Vision: Five image classification datasets (EuroSAT, GTSRB, SVHN, MNIST, DTD) using CLIP-ViT-B/32 derivatives.
Language: The BBH (Big-Bench Hard) benchmark using Mistral-7B and Llama3-8B-Instruct variants.

Key findings include:

Task Arithmetic and Ties-Merging achieved non-vacuous bounds on most datasets with 100 shots without bound optimization.
Bound Optimization converted vacuous bounds into non-vacuous ones for more complex methods like Layer-wise AdaMerging, though it sometimes required a trade-off with empirical error (mitigated by DDP).
Mistral-7B: Task Arithmetic on 100-shot BBH tasks yielded PAC-Bayes bounds significantly lower than 1.0 (non-vacuous), whereas zero-shot baselines often resulted in vacuous bounds.
Robustness: The non-vacuous nature of the bounds was verified to be robust against Monte Carlo sampling noise and variations in prior/posterior variance.

Significance and Claims
The paper claims that the ability to certify large models in low-data regimes has been "hiding in plain sight" within the family of model merging algorithms. The significance lies in:

Immediate Applicability: It facilitates the certification of existing AI systems (including large LLMs) for high-stakes applications where legal or ethical requirements demand trustworthiness guarantees.
Theoretical-Practical Bridge: It opens new research directions at the intersection of theory and practice by suggesting that focusing guarantees on sparse, re-parameterized learners (merging weights) rather than the full parameter space of base networks is a viable path to non-vacuous certification.
Low-Data Feasibility: It challenges the assumption that non-vacuous certification requires massive datasets, demonstrating that with the right learning paradigm (merging), meaningful guarantees are possible with as few as 100 examples.

The authors remain modest, noting that while they do not derive new theory, their work identifies that existing strategies already possess the properties necessary for certification, provided they are analyzed through the correct theoretical framework.

Technical Summary: Model Merging is Secretly Certifiable

More like this