用属性陷阱保护3D生成模型,防他人擅自微调盗取知识
Immunizing 3D Gaussian Generative Models Against Unauthorized Fine-Tuning via Attribute-Space Traps
- 在参数空间植入针对位置、尺度、旋转等的陷阱损失
- 使未经授权微调后重建质量显著下降(LPIPS↑, PSNR↓)
- 授权微调仍保持高质量,适合需版权保护的3D生成场景
近年来大规模生成模型实现了高质量3D合成,但预训练权重的公开导致严重漏洞:攻击者可微调模型窃取预训练中积累的专业知识,造成知识产权侵犯。与2D图像和语言模型不同,3D生成器因其显式的高斯表示,使基本结构参数直接暴露于基于梯度的优化中,需专门防护。本文提出GaussLock,首个针对3D生成模型微调攻击的防御方法。它是一种轻量级参数空间免疫框架,结合授权蒸馏与属性感知陷阱损失,分别作用于位置、尺度、旋转、透明度和颜色。这些陷阱系统性地坍塌空间分布、扭曲几何形状、对齐旋转轴并抑制原始可见性,从根本上破坏结构完整性。通过联合优化双重目标,蒸馏过程在保持授权任务保真度的同时,嵌入陷阱主动干扰非授权重构。在大规模高斯模型上的实验表明,GaussLock能有效中和未经授权的微调攻击,显著降低非授权重构质量(LPIPS提升,PSNR下降),同时维持授权微调的性能。
原文摘要 · Abstract (English)
Recent large-scale generative models enable high-quality 3D synthesis. However, the public accessibility of pre-trained weights introduces a critical vulnerability. Adversaries can fine-tune these models to steal specialized knowledge acquired during pre-training, leading to intellectual property infringement. Unlike defenses for 2D images and language models, 3D generators require specialized protection due to their explicit Gaussian representations, which expose fundamental structural parameters directly to gradient-based optimization. We propose GaussLock, the first approach designed to defend 3D generative models against fine-tuning attacks. GaussLock is a lightweight parameter-space immunization framework that integrates authorized distillation with attribute-aware trap losses targeting position, scale, rotation, opacity, and color. Specifically, these traps systematically collapse spatial distributions, distort geometric shapes, align rotational axes, and suppress primitive visibility to fundamentally destroy structural integrity. By jointly optimizing these dual objectives, the distillation process preserves fidelity on authorized tasks while the embedded traps actively disrupt unauthorized reconstructions. Experiments on large-scale Gaussian models demonstrate that GaussLock effectively neutralizes unauthorized fine-tuning attacks. It substantially degrades the quality of unauthorized reconstructions, evidenced by significantly higher LPIPS and lower PSNR, while effectively maintaining performance on authorized fine-tuning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。