arXiv:2510.10982cs.LGcs.AI2025-10被引 6

让数据只对指定模型有效,防滥用且无需改模型。

Catch-Only-One: Non-Transferable Examples for Model-Specific Authorization

  • 用低敏感度子空间重编码数据,仅授权模型能正确解析。
  • 未授权模型性能大幅下降,即使面对自适应攻击也失效。
  • 无需训练、通用性强,适合需数据安全的场景。

当前人工智能监管日益强调在保护数据不被滥用的同时维持其创新价值,尤其要求下游应用遵循用途限定原则。然而,现有方法或扰动数据、或重训练模型,均难以防范未知或外部训练模型的推理攻击,且往往依赖对训练或部署过程的控制。本文提出非可迁移样本(NTEs),即作为任务级“密文”的重编码数据,仅特定模型可解码。与利用模型高敏感方向的对抗样本不同,NTEs基于互补的低敏感子空间设计。我们提出一种无需训练、数据无关的方法,在模型特定的低敏感子空间内重构数据,使授权模型输出保持一致,而未经授权模型因子空间错位导致性能显著下降。理论证明了授权模型保真度,并表明未授权降级程度与模型间谱错位度量成正比。实验显示,NTEs在多种视觉骨干网络和前沿视觉-语言模型上,经常见预处理仍保持性能,而未授权模型即便面对自适应重建攻击也崩溃。结果表明NTEs是实现数据预期用途保护与防止非法利用的实用方案。项目地址:https://trusted-system-lab.github.io/model-specificity

原文摘要 · Abstract (English)

Recent AI regulations increasingly emphasize the need for mechanisms that preserve the utility of data for AI innovation while preventing misuse, particularly by enforcing purpose limitation in downstream AI applications. In practice, enforcing this principle remains challenging, as released data can be trivially fed into arbitrary models beyond its declared intent. Existing approaches attempt to mitigate this risk by either perturbing data or retraining models to limit unintended use. These strategies, however, offer no protection against inference by unknown or externally trained models, or fundamentally rely on control over the training or deployment. In this work, we introduce non-transferable examples (NTEs), recoded data that act as a task-level "ciphertext" decodable only by a designated model. Whereas adversarial examples exploit directions of high model sensitivity, NTEs leverage the complementary insensitive subspace. We propose a training-free, data-agnostic method that recodes data within a model-specific low-sensitivity subspace, preserving outputs for the authorized model while degrading unauthorized ones through subspace misalignment. We establish formal bounds certifying authorized-model fidelity and showing that unauthorized degradation scales with measurable spectral misalignment between models. Empirically, NTEs preserve performance across diverse vision backbones and state-of-the-art vision-language models under common preprocessing, while unauthorized models collapse even under adaptive reconstruction attacks. These results establish NTEs as a practical means to preserve intended data utility while preventing unauthorized exploitation. Our project is available at https://trusted-system-lab.github.io/model-specificity

数据安全模型特异性隐私保护无监督

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。