让AI模型只对持有密钥的人开放，无密钥则输出乱码。
Key-Conditioned Orthonormal Transform Gating (K-OTG): Multi-Key Access Control with Hidden-State Scrambling for LoRA-Tuned Models
- 用双路径训练：有密钥的正常输出，无密钥的输出固定干扰块。
- 无密钥时模型输出几乎无效，而有密钥的性能接近原始模型。
- 兼容低资源微调，适合需要保密的AI服务场景。
我们提出一种简单、兼容参数高效微调（PEFT）的机制，实现指令微调语言模型的密钥访问控制。K-OTG在双路径语料上训练：带角色密钥的授权样本学习正确输出，未授权样本学习一个可见的干扰块。推理时，预lm_head钩子对隐藏状态施加正交变换：正确密钥可逆恢复原基底；错误密钥则触发会话级随机化（置换、符号翻转、Householder变换），使输出概率无意义，系统直接返回BLOCK。密钥不作为特殊标记添加，且可与4比特基模型上的LoRA无缝集成。我们在1-3B规模指令模型（Llama 3.2、Qwen2.5 1.5B）上评估了小时级协议，涵盖实用性（XSum ROUGE/BLEU、GSM8K准确率、WikiText-2困惑度）、选择性（3×3角色密钥解锁矩阵）、随机数不变性、阻断抑制和吞吐量。授权性能接近基线，摘要任务仅略有困惑度上升；未授权性能崩溃（序列指标趋近零，困惑度爆炸），表明无密钥无法使用。解锁矩阵对角占优（目标解锁高，交叉解锁低），授权块输出为0/每N次，贪婪解码结果跨随机数一致，证实逆变换正确。Python钩子运行开销为基线40%每秒令牌数。因此，K-OTG提供了一种实用、模型无关的防滥用方案。
原文摘要 · Abstract (English)
We present a simple, PEFT-compatible mechanism that enforces secret-key access control in instruction-tuned language models. K-OTG trains on a dual-path corpus: authorized examples (prefixed with a role key) learn the task output, while unauthorized examples learn a visible block token. At inference, a pre-lm_head hook applies an orthonormal transform to the hidden state: with the correct key/role the inverse map restores the model's native basis; otherwise a session-ephemeral scrambler (permutation, sign flips, Householders) makes logits uninformative and the system short-circuits to BLOCK. Keys are not added as special tokens, and the method composes cleanly with LoRA on 4-bit bases. We evaluate an hour-scale protocol on 1-3B-class instruction models (Llama 3.2, Qwen2.5 1.5B) across utility (XSum ROUGE/BLEU, GSM8K accuracy, WikiText-2 perplexity), selectivity (3by3 role-key unlock matrices), nonce invariance, block suppression, and throughput. Authorized utility remains close to the base on summarization with the expected modest PPL increase from instruction tuning; unauthorized utility collapses (near-zero sequence metrics with exploding PPL), indicating practical unusability without the key. Unlock matrices are diagonally dominant (high on-target unlock, low cross-unlock), authorized block emission is 0 per N via robust bad-word lists, and greedy outputs match exactly across nonces, confirming correct inverse cancellation. The runtime overhead of the Python-level hook is 40% tokens per sec versus the base. K-OTG therefore provides a pragmatic, model-agnostic way to prevent unauthorized use while preserving authorized utility.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。