提出一种无需牺牲性能的模型合并防御方法,让被合并后模型失效。
Disrupting Model Merging: A Parameter-Level Defense Without Sacrificing Accuracy
- 通过调整MLP参数和缩放注意力头,改变模型参数分布
- 合并后性能大幅下降,单独使用时功能不受影响
- 适合需要防止模型被非法复制的研究者与开发者
模型合并可将多个微调模型融合为单一模型,使免费使用者低成本获得专业能力。本文研究如何阻止此类非授权合并。现有方法如水印或指纹仅能事后检测,而本文首次提出主动防御机制:修改模型参数,使其在与其他模型合并时严重失效,但独立使用时功能保持不变。方法包含两个模块:重排MLP参数和缩放注意力头,使模型脱离共享参数空间,导致合并后性能显著下降。我们在图像分类、图像生成和文本分类任务上进行大量实验,验证该方法在保留原模型功能的同时,有效破坏合并效果。进一步分析潜在对抗攻击,并提出基于丢弃的剪枝策略以增强鲁棒性。
原文摘要 · Abstract (English)
Model merging is a technique that combines multiple finetuned models into a single model without additional training, allowing a free-rider to cheaply inherit specialized capabilities. This study investigates methodologies to suppress unwanted model merging by free-riders. Existing methods such as model watermarking or fingerprinting can only detect merging in hindsight. In contrast, we propose a first proactive defense against model merging. Specifically, our defense method modifies the model parameters so that the model is disrupted if the model is merged with any other model, while its functionality is kept unchanged if not merged with others. Our approach consists of two modules, rearranging MLP parameters and scaling attention heads, which push the model out of the shared basin in parameter space, causing the merging performance with other models to degrade significantly. We conduct extensive experiments on image classification, image generation, and text classification to demonstrate that our defense severely disrupts merging while retaining the functionality of the post-protect model. Moreover, we analyze potential adaptive attacks and further propose a dropout-based pruning to improve our proposal's robustness.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。