Locket: Robust Feature-Locking Technique for Language Models

1. Problem Statement

Current Large Language Model (LLM) service providers (e.g., OpenAI) primarily rely on tiered subscription models where free users access basic models and paying users access advanced models. This approach is often unprofitable and inflexible. The authors propose a "pay-to-unlock" economic model where users can subscribe to specific premium features (e.g., advanced math, coding, or summarization) atop a base subscription.

To enable this, a Feature-Locking Technique (FLoTE) is required. An ideal FLoTE must satisfy four criteria:

1. Effectiveness (R1): Must effectively refuse queries invoking unauthorized features.
2. Utility-Preservation (R2): Must maintain high performance on authorized (unlocked) features.
3. Robustness (R3): Must resist evasion via adversarial prompts (jailbreaks) and prevent unauthorized credential sharing.
4. Scalability (R4): Must support multiple features and clients without combinatorial explosion or performance degradation.

Limitations of Prior Work: Existing methods, such as password-locking (using backdoors or specific triggers), fail to meet these criteria. They often suffer from "catastrophic forgetting" (degrading unlocked features), are vulnerable to credential sharing, and do not scale efficiently to multiple features.

2. Methodology: LOCKET

LOCKET is a novel framework that uses adapters (specifically LoRA) to dynamically lock features without modifying the base model's weights permanently. It operates on a frozen base model and dynamically attaches adapters based on a client's authorization status.

Core Components:

1. Access Control & Adapter Selection:

   • An access control module identifies a client's authorized features.
   • Instead of attaching an adapter for the allowed feature, LOCKET attaches adapters for all unauthorized features to the base model. These adapters are trained to force the model to refuse queries related to those specific features.

2. Training Objective (Adversarial Training):

   • Utility Preservation ($L_{utility}$): The adapter is fine-tuned using a KL-divergence loss against a frozen reference model on generic, authorized data (e.g., Wikipedia text). This ensures the model retains its general capabilities.
   • Robust Refusal ($L_{robust}$): To prevent evasion, the authors employ Latent Adversarial Training (LAT). They construct a preference dataset where the model is trained to prefer a refusal response (e.g., "Sorry, you are not authorized") over the correct answer.
   • Perturbation: The training includes finding worst-case perturbations ($\delta$) in the latent activations that would cause the model to evade the refusal. The model is then optimized to resist these perturbations, ensuring robustness against adversarial jailbreaks.

3. LOCKET Merging (The Key Innovation):

   • A major challenge is that merging multiple "refusal" adapters often leads to over-refusal, where the model refuses all queries (including authorized ones) because the refusal weights accumulate destructively.
   • Solution: The authors propose a spectral norm rescaling method.
     • They compute the singular values of the weight matrices for each individual adapter.
     • They set a clipping threshold based on the maximum spectral norm of any single adapter in a specific layer.
     • When merging adapters (using CAT or similar techniques), if the merged adapter's spectral norm exceeds this threshold, it is rescaled down.
   • This prevents the "refusal signal" from becoming too strong, preserving the utility of unlocked features while maintaining the refusal capability for locked ones.

3. Key Contributions

1. Definition of Requirements: The paper formally defines the four necessary requirements (Effectiveness, Utility, Robustness, Scalability) for a viable FLoTE, highlighting gaps in prior work.
2. LOCKET Framework: The first robust and scalable FLoTE that uses dynamic adapter merging to lock features without secret credentials (preventing sharing) and without full fine-tuning (preventing forgetting).
3. Novel Merging Technique: A spectral norm rescaling method that solves the "over-refusal" problem inherent in merging multiple task-specific adapters.
4. Comprehensive Evaluation: Extensive experiments demonstrating that LOCKET meets all four requirements, outperforming password-locking baselines in robustness and utility preservation.

4. Experimental Results

The authors evaluated LOCKET on three models (DeepSeek-7B-Math, DeepSeek-7B-Coder, Llama-3-8B-Instruct) across four features (Math, SQL, Summarization, General Knowledge).

• Effectiveness (R1): LOCKET achieved a 100% refusal rate (0.00 utility) on locked features across all configurations.
• Utility Preservation (R2): LOCKET preserved utility on unlocked features with $\le$ 7% degradation. In contrast, password-locking baselines showed significant drops (up to 12%) due to catastrophic forgetting.
• Robustness (R3):
  • Against adversarial attacks (Many-shot, GCG, TAP, AutoDAN), LOCKET achieved an Attack Success Rate (ASR) of $\le$ 5%, whereas baselines often had ASRs > 50%.
  • It is inherently robust against credential sharing as it uses no passwords.
• Scalability (R4): LOCKET successfully scaled to locking multiple features simultaneously (up to 8 features in extended tests) without the combinatorial explosion of training separate models. The utility degradation remained within acceptable bounds (approx. 15% max for 8 features).
• Overhead: The runtime overhead for attaching/detaching adapters is minimal (~1 second per session), and storage requirements are low (adapters are ~1.6% of the base model size).

5. Significance

• Economic Viability: LOCKET enables a sustainable "pay-per-feature" business model for LLM providers, moving away from the unprofitable "free vs. premium model" dichotomy.
• Security & Control: It provides a robust mechanism for controlling access to sensitive or premium capabilities (e.g., medical advice, coding) without relying on easily shared passwords or vulnerable backdoors.
• Technical Advancement: The spectral norm rescaling technique offers a new solution for the problem of destructive interference in model merging, which is applicable beyond feature locking to other multi-task learning scenarios.
• Future Applications: Beyond monetization, the technique can be used for granular safety alignment (locking dangerous features), reversible unlearning, and staged feature rollouts.

In summary, LOCKET bridges the gap between commercial needs for flexible monetization and technical requirements for robust, scalable, and utility-preserving feature control in Large Language Models.