用密钥子空间动态控制神经网络推理，无需加密权重。
SpanKey: Dynamic Key Space Conditioning for Neural Network Access Control
- 通过低维密钥子空间注入密钥到中间激活值中。
- 在CIFAR-10 ResNet-18上实现有效访问控制，无效密钥触发错误。
- 提出拒绝损失机制，适合安全敏感的模型部署场景。
SpanKey是一种轻量级的推理门控方法，不依赖权重加密或追求排行榜精度。核心思想是将秘密密钥条件化注入中间激活值。定义一个基矩阵 $B$，生成低维密钥子空间 $Span(B)$；训练时采样系数 $α$，构造密钥 $k=α^ op B$，并通过加法或乘法方式以强度 $γ$ 注入激活值。合法密钥位于 $Span(B)$ 内，非法密钥则采样于该子空间之外。本文提出三点：(i) 机制：子空间密钥注入与多层设计空间；(ii) 失败模式：密钥吸收现象，结合贝塔能量分裂与边际尾部诊断，解释了基线能量与边际分离弱的原因——这并非安全定理；(iii) 拒绝损失与实验：涵盖Mode A–C及扩展，基于CIFAR-10 ResNet-18运行和MNIST消融实验（Mode B）。总结了设置、一阶分析、注入器、吸收现象、拒绝损失与消融研究，并讨论威胁场景，强调不承诺密码学保障，最后提及可扩展性。代码见：\texttt{https://github.com/mindmemory-ai/dksc}。
原文摘要 · Abstract (English)
SpanKey is a lightweight way to gate inference without encrypting weights or chasing leaderboard accuracy on gated inference. The idea is to condition activations on secret keys. A basis matrix $B$ defines a low-dimensional key subspace $Span(B)$; during training we sample coefficients $α$ and form keys $k=α^\top B$, then inject them into intermediate activations with additive or multiplicative maps and strength $γ$. Valid keys lie in $Span(B)$; invalid keys are sampled outside that subspace. We make three points. (i) Mechanism: subspace key injection and a multi-layer design space. (ii) Failure mode: key absorption, together with two analytical results (a Beta-energy split and margin-tail diagnostics), explains weak baseline separation in energy and margin terms -- these are not a security theorem. iii) Deny losses and experiments: Modes A--C and extensions, with CIFAR-10 ResNet-18 runs and MNIST ablations for Mode B. We summarize setup and first-order analysis, injectors, absorption, deny losses and ablations, a threat discussion that does not promise cryptography, and closing remarks on scale. Code: \texttt{https://github.com/mindmemory-ai/dksc}
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。