SAFE-Merge: Data-Free Continual Model Merging with General Knowledge Preservation

Technical Summary: SAFE-Merge

Problem Definition
The paper addresses Data-Free Continual Model Merging (DFCMM), a scenario where a single backbone model must be updated sequentially with a stream of specialized task models without access to the original training data or previous checkpoints. While existing methods focus on mitigating interference between downstream tasks, they often overlook the safety of the pretrained general knowledge encoded in the backbone. Aggressive accumulation of task updates can erode this foundational knowledge, degrading performance on held-out distributions and weakening the model's capacity to acquire future tasks. The core challenge is to integrate new task-specific information while preserving both previously learned tasks and the transferable general capabilities of the pretrained model, all without task data.

Methodology: SAFE-Merge
The authors propose SAFE-Merge (Sparse Risk-Aware Masking and Low-Rank Recovery For General-Knowledge PrEservation), a parameter-space framework operating in three distinct steps:

1. Risk-Aware Sparse Masking:

   • The method treats the incoming task vector $\tau_t = \theta_t - \theta_0$ as a modification to the pretrained weights $\theta_0$.
   • It derives a general-risk score for each parameter update without using data. This score estimates the "overwrite risk" by contrasting the energy of the update along pretrained general directions (approximated by the top singular vectors of $\theta_0$) against task-unique directions (approximated by the top singular vectors of $\tau_t$ orthogonalized against $\theta_0$).
   • A binary mask $M_t$ is generated by retaining only the parameter updates with the lowest risk scores (i.e., those that are safe for general knowledge and potentially useful for the task). High-risk updates are zeroed out.

2. Masked Low-Rank Recovery:

   • Since masking discards potentially useful task information, a low-rank recovery term ($B_t A_t$) is introduced.
   • Crucially, this recovery is constrained to the same masked region. The recovery term is computed as $M_t \odot (B_t A_t)$, ensuring that no parameters rejected by the risk mask are ever modified.
   • The recovery factors are optimized without data using two objectives:
     • Preservation Objective ($L_{old}$): Penalizes updates that align with directions of previously accumulated tasks to limit forgetting.
     • Task-Recovery Objective ($L_{new}$): Matches the merged update to the incoming task vector within the task's dominant subspace to restore performance.
   • These objectives are balanced by a hyperparameter $\lambda$.

3. Fusion:

   • The final update $\Delta_t$ combines the masked task vector and the masked recovery term.
   • This update is fused into the running merged backbone: $\theta_{merged, t} = \theta_{merged, t-1} + \Delta_t$.
   • The mask and low-rank factors are discarded after fusion, ensuring no additional inference cost or parameter count increase.

Key Contributions

1. Risk-Aware Criterion: The authors develop a data-free, parameter-wise metric that contrasts general-subspace overlap with task-unique energy to select a sparse set of safe updates.
2. Masked Low-Rank Recovery: They introduce a mechanism to recover task utility suppressed by masking using a constrained low-rank update, preventing the modification of high-risk parameters while restoring plasticity.
3. Empirical Superiority: The method is evaluated across vision (CLIP ViT) and language (Flan-T5) benchmarks, demonstrating a superior balance between task accuracy and general knowledge preservation.

Experimental Results

• Vision Benchmarks: On CLIP ViT-B/32, ViT-B/16, and ViT-L/14 with 8, 14, and 20 sequential tasks, SAFE-Merge consistently achieves the highest H-score (harmonic mean of accuracy and general performance).
  • For 20 tasks, it improves the H-score by 8.1 points over the best baseline (NUFILT) and achieves a 1.2-point gain in average accuracy (ACC) while maintaining strong general performance.
  • It significantly outperforms "simple accumulation" and other merging strategies (e.g., Task Arithmetic, Ties-Merging, WUDI-Merging) in preserving general knowledge (measured on ImageNet, ImageNet-R, ObjectNet).
• NLP Benchmarks: On Flan-T5-base with 5 GLUE tasks, SAFE-Merge achieves the best H-score (79.4), improving upon NUFILT by 0.6 points while maintaining competitive accuracy and backward transfer. Notably, it keeps general performance slightly above the pretrained reference, whereas individual fine-tuning erodes it.
• Ablation Studies:
  • Both the risk-aware masking and the low-rank recovery components are essential; removing either leads to significant drops in accuracy or generalization.
  • The method is robust to task order and shows that the "knees" in performance curves suggest optimal sparsity (keep ratio $\rho$) decreases as the sequence length increases.
  • Computation overhead is incurred only during offline merging (approx. 216s for 8 tasks), with zero inference cost.

Significance and Claims
The paper claims that SAFE-Merge addresses a critical gap in continual merging: the protection of the pretrained backbone's general knowledge, which is often sacrificed to preserve downstream task accuracy. By explicitly distinguishing between low-risk task updates and directions associated with general knowledge, and by recovering lost utility through constrained low-rank corrections, SAFE-Merge achieves a stronger balance between continual-merging accuracy and held-out generalization. The authors assert that their method provides a practical, data-free solution that scales to longer task sequences without increasing inference latency or model size.