🤖 machine learning

Locking Pretrained Weights via Deep Low-Rank Residual Distillation

This paper introduces DLR-Lock, a defense mechanism that protects open-weight language models from unauthorized fine-tuning by replacing standard MLPs with deep low-rank residual networks that exploit inference-training asymmetry to create prohibitive memory and optimization barriers for adaptive attackers while preserving model performance.

Original authors: Keitaro Sakamoto, Pierre Ablin, Federico Danieli, Marco Cuturi

Published 2026-05-12

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Keitaro Sakamoto, Pierre Ablin, Federico Danieli, Marco Cuturi

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have built a magnificent, highly intelligent robot (a Large Language Model) and you want to share its "brain" (the weights) with the world so people can use it. However, you are worried that some users might take that brain, tweak it, and use it for purposes you didn't intend—like creating harmful content or bypassing safety rules.

You want to say: "You can use my robot, but you cannot easily change its brain to do something else."

This paper, titled "Locking Pretrained Weights via Deep Low-Rank Residual Distillation," proposes a clever way to "lock" the robot's brain without breaking it. Here is how it works, explained through simple analogies.

The Problem: The "Open Box" Dilemma

Currently, when companies release open models, it's like giving someone a car with the hood wide open and the engine exposed. Anyone can pop the hood, swap out the spark plugs, and tune the engine to go faster or run on different fuel. In the world of AI, this means anyone can take a model and "fine-tune" it (retrain it) for new tasks very cheaply.

Traditional security tries to hide the engine or put a fake lock on the hood. But the paper argues that if a hacker is smart enough, they can figure out how to pick those locks or reverse-engineer the fake parts.

The Solution: The "Deep Maze" Trick

The authors, from Apple, propose a new kind of lock called DLR-Lock. Instead of hiding the engine, they replace the engine with a deep, complex maze that looks exactly the same from the outside but is a nightmare to navigate from the inside.

Here is the core idea broken down into three parts:

1. The "One-Way Street" (Inference vs. Training)

Think of the model as a factory.

Inference (Using the model): This is like a customer walking through the factory to buy a product. They walk in, grab the item, and leave. They don't need to remember every step they took; they just need the final product.
Training (Changing the model): This is like a mechanic trying to fix the factory. To fix a machine, the mechanic has to remember every single step of the process to know where things went wrong. They have to store a massive amount of "memory" (activations) to work backward.

The paper exploits the fact that using the model is cheap and easy, but fixing/learning from it is expensive and memory-heavy.

2. The "Deep Maze" (DLR-Net)

In a standard AI model, the part that processes information (called an MLP) is like a simple, short hallway. You walk in, and you walk out. It's fast.

The authors replace this short hallway with a Deep Low-Rank Residual Network (DLR-Net).

The Analogy: Imagine replacing a short hallway with a 100-story spiral staircase that leads to the exact same exit.
For the User (Inference): Walking up 100 stairs takes a tiny bit more time, but it's still fast. The user gets their product, and the model works just as well as before.
For the Hacker (Training): If the hacker wants to "fix" the staircase (update the weights), they have to remember every single step of the 100-story climb to figure out where to make changes. This requires a massive amount of memory (RAM).

3. The "Memory Trap"

The paper claims that by making the model this deep, they create a memory trap.

To train the model, the hacker's computer has to store all those intermediate steps.
If the hacker tries to use a trick called "gradient checkpointing" (which saves memory by forgetting steps and re-calculating them later), they have to re-run the 100-story climb over and over again.
The Result: Training the locked model becomes exponentially slower and more expensive than training the original model. It's like the difference between walking a short path and climbing a mountain just to change a lightbulb.

How They Did It Without Breaking the Robot

You might ask: "If you change the engine to a 100-story staircase, won't the robot stop working?"

No. The authors used a technique called Distillation.

The Analogy: Imagine a master chef (the original model) who knows exactly how to make a perfect soup. The authors built a new, complex kitchen (the DLR-Net) and trained it by having the master chef taste the soup and say, "No, make it a bit saltier," until the new kitchen produces soup that tastes exactly like the original.
They did this in two steps: first matching the flavor of individual ingredients (modules), then matching the flavor of the whole meal (the final output).
The Claim: The locked model performs just as well as the original for normal users, but it is incredibly difficult for anyone to retrain it.

The Bottom Line

The paper demonstrates that they can take a model (specifically tested on a Qwen3-0.6B model), replace its internal components with these "deep mazes," and:

Keep the quality: The model still answers questions and writes text just as well as before.
Lock the door: Any attempt to fine-tune or adapt the model becomes significantly more expensive in terms of time and computer power (specifically, the "backward pass" of training becomes much slower than the "forward pass" of using it).

It's a structural lock: you can't pick it because the lock isn't a secret; it's just that the mechanism of the lock is designed to make the thief's job incredibly hard, while the legitimate user doesn't even notice the difference.

Technical Summary: Locking Pretrained Weights via Deep Low-Rank Residual Distillation

Problem Formulation

The proliferation of open-weight large language models (LLMs) has democratized access to powerful AI systems but has simultaneously eroded the control model providers have over how these weights are utilized. While legal licenses attempt to restrict unauthorized adaptation, they lack technical enforcement. An adaptive attacker with full access to model weights and architecture can often reverse simple structural defenses or use optimization to bypass them.

The core scientific challenge addressed is model locking: the ability to modify a pretrained model such that adapting it (e.g., via fine-tuning) becomes inherently more expensive than adapting the original model, while strictly preserving the model's inference-time performance and general capabilities. The authors formalize this under an adaptive threat model grounded in Kerckhoffs's principle, where the defense must remain effective even if the attacker knows the locking mechanism's design. The goal is to achieve a "locking factor" $\kappa > 1$ , where the cost (time, FLOPs, or GPU-hours) to reach a target performance level on a downstream task is amplified by at least $\kappa$ for the locked model compared to the original.

Limitations of Existing Approaches

The paper identifies fundamental flaws in previous defense strategies:

Symmetry-Based Defenses: Methods that exploit weight symmetries (e.g., scaling or invertible matrix insertions) to disrupt optimization are trivially reversible. An attacker can inspect weight norms or compute singular value decompositions (SVD) to rebalance the weights and restore the original optimization landscape.
Optimization-Based Defenses: Approaches that attempt to embed defenses by optimizing for ill-conditioned loss landscapes (e.g., maximizing Hessian trace or inserting barrier modules) face a "self-defeating" paradox. The defender must use optimization to find a solution that resists optimization, yet the same gradient information available to the defender is available to the attacker. Experiments on simple MLPs show that gradient descent often fails to reach these "locked" high-cost regions from pretrained initializations.

Methodology: DLR-Lock

The authors propose DLR-Lock, a defense that exploits the inference–training asymmetry of automatic differentiation. Unlike inference, which only requires a forward pass and discards intermediate activations, training requires storing all intermediate activations for backpropagation. DLR-Lock replaces each standard SwiGLU MLP module in a transformer with a Deep Low-Rank Residual Network (DLR-Net).

Architecture

A standard MLP residual block $x' = z + \text{FFN}(\text{RMSNorm}(z))$ is replaced by a depth- $L$ low-rank residual network:
$h_0 = z, \quad h_{i+1} = h_i + \alpha_i U_i \sigma(V_i \text{RMSNorm}(h_i)), \quad x' = h_L$
where:

$V_i \in \mathbb{R}^{r \times d}$ and $U_i \in \mathbb{R}^{d \times r}$ are low-rank projection matrices with bottleneck rank $r \ll d$ .
$\alpha_i$ is a learnable ReZero scalar.
The depth $L$ is chosen such that the total parameter count matches (or slightly exceeds) the original MLP, distributing parameters across many shallow layers rather than a few deep ones.

Three Locking Mechanisms

This architectural substitution introduces three specific barriers to adaptation:

Activation Memory Growth: During backpropagation, the memory required to store activations grows linearly with the depth $L$ . For an attacker using naive fine-tuning, the activation memory overhead scales as $\Theta(d/r)$ compared to the original model, potentially forcing smaller batch sizes or more expensive hardware.
Optimization Instability: The deep residual structure creates an architectural mismatch with the original model's training recipes. Standard fine-tuning hyperparameters and optimizers, tuned for the original shallow MLPs, become unstable or inefficient when applied to the deep DLR-Nets.
Disproportionate Backward Pass Overhead: The backward pass incurs significantly more overhead than the forward pass due to complex memory access patterns and the need to recompute activations (even with gradient checkpointing). Crucially, compiler optimizations (like CUDA graph replay) that accelerate the forward pass do not transfer to the backward pass, widening the cost gap for attackers who must compute gradients.

Distillation Procedure

To ensure the locked model retains the original capabilities (Utility Preservation), the authors employ a two-phase distillation pipeline:

Module-wise Distillation: Each DLR-Net is trained independently to replicate the input-output mapping of the corresponding pretrained MLP layer, minimizing relative Mean Squared Error (MSE).
Logits Distillation: After all layers are replaced, the accumulated errors are corrected by fine-tuning the DLR-Net parameters (with attention and embeddings frozen) using the original model as a teacher. The objective is to minimize the top- $k$ KL divergence between the teacher and student output distributions.

Experimental Results

The method was validated on Qwen3-0.6B and Qwen3-8B models using the Nemotron-CC dataset.

Quality Preservation: The locked models successfully preserved the original model's capabilities. After the two-phase distillation, perplexity on natural text corpora (Nemotron-CC, WikiText-103) and performance on downstream benchmarks (MMLU, ARC, HellaSwag, etc.) were recovered to within a few points of the pretrained baseline.
Inference Overhead: While the theoretical FLOPs remain comparable, the sequential nature of DLR-Nets introduces wall-clock overhead. However, this is mitigated by compiler optimizations (e.g., torch.compile with reduce-overhead). For large models and batch sizes, the overhead ratio drops significantly (e.g., from $144\times$ in eager mode to $11\times$ with compilation for 8B models), remaining manageable for legitimate users.
Resistance to Fine-Tuning:
- Convergence: When fine-tuning on WikiText-103, the locked model converged significantly slower than the baseline and plateaued at a higher loss, even with gradient checkpointing enabled.
- Instability: At higher learning rates ( $10^{-4}$ ), the locked model diverged entirely, whereas the baseline trained normally, indicating that the defense narrows the effective learning rate range.
- Cost Amplification: The backward pass accounted for 89% of total training time for the locked model (vs. 83% for the baseline), and the wall-clock time to reach a target loss was substantially higher. The authors note that the backward pass overhead is disproportionately higher than the forward pass, confirming the defense's reliance on training-specific costs.

Significance and Claims

The paper claims to establish a new defense axis for model locking that is optimizer-agnostic and relies on structural properties rather than the secrecy of the defense mechanism. Key contributions include:

Formalization: Defining model locking as adaptation cost amplification under an adaptive threat model.
Novel Mechanism: Demonstrating that the inference-training asymmetry of automatic differentiation can be exploited to create a defense that is cheap to evaluate but expensive to differentiate.
Robustness: Showing that the method withstands adaptive attackers with full knowledge of the strategy, including those using gradient checkpointing, partial weight updates, or LoRA.
Practicality: Validating that the locking mechanism does not sacrifice the model's utility, allowing legitimate users to infer with near-original performance while imposing a measurable cost barrier on unauthorized adaptation.

The authors conclude that while the forward-pass overhead can be mitigated via custom kernels or compilation, the fundamental asymmetry in backpropagation costs remains a robust barrier against fine-tuning.