用模型特有潜在表示实现零样本解码绑定，防未授权访问。
Keys in the Weights: Transformer Authentication Using Model-Bound Latent Representations
- 基于Transformer自编码器设计零样本解码非迁移性机制
- 同架构模型自解码准确率超0.91，跨模型解码接近随机
- 无需秘密注入，适合航空等高安全场景部署
我们提出模型绑定潜在交换（MoBLE），一种在Transformer自编码器中形式化的解码器绑定属性，称为零样本解码非迁移性（ZSDN）。在使用相同架构、相同数据但不同随机种子训练的模型上进行身份识别任务时，自解码的精确匹配率超过0.91，词元准确率达0.98；而零样本跨模型解码则退化至随机水平，无精确匹配。该差异无需注入密钥或对抗训练即可实现，且通过权重空间距离与注意力分歧诊断得到验证。我们将ZSDN解释为模型绑定——一种基于潜在表示的认证与访问控制机制，即使架构和训练方法公开，编码器隐状态仍能确定性地揭示明文，但仅正确密钥的解码器可在零样本下复现。我们正式定义了ZSDN这一解码器绑定优势度量，并讨论了安全AI流水线的部署考量。最后，我们分析了可学习风险（如适配器对齐）并提出缓解措施。MoBLE为航空、网络物理系统等安全关键领域提供了轻量级、加速器友好的安全AI部署方案。
原文摘要 · Abstract (English)
We introduce Model-Bound Latent Exchange (MoBLE), a decoder-binding property in Transformer autoencoders formalized as Zero-Shot Decoder Non-Transferability (ZSDN). In identity tasks using iso-architectural models trained on identical data but differing in seeds, self-decoding achieves more than 0.91 exact match and 0.98 token accuracy, while zero-shot cross-decoding collapses to chance without exact matches. This separation arises without injected secrets or adversarial training, and is corroborated by weight-space distances and attention-divergence diagnostics. We interpret ZSDN as model binding, a latent-based authentication and access-control mechanism, even when the architecture and training recipe are public: encoder's hidden state representation deterministically reveals the plaintext, yet only the correctly keyed decoder reproduces it in zero-shot. We formally define ZSDN, a decoder-binding advantage metric, and outline deployment considerations for secure artificial intelligence (AI) pipelines. Finally, we discuss learnability risks (e.g., adapter alignment) and outline mitigations. MoBLE offers a lightweight, accelerator-friendly approach to secure AI deployment in safety-critical domains, including aviation and cyber-physical systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。