Defending Unauthorized Model Merging via Dual-Stage Weight Protection

AI summary

Overview

Research area: Model ownership protection and intellectual-property defense for pretrained models — specifically, defending against unauthorized model merging in computer vision (image classification, image generation) and large language models.

Technical level: Advanced. The paper assumes familiarity with task vectors, parameter-level merging (weight averaging, task arithmetic, TIES, AdaMerging, DARE), loss-landscape curvature, and the pretrain–finetune paradigm.

Scope: The paper proposes and evaluates MergeGuard, a two-stage, training-time plus training-free weight transformation that keeps a released model fully functional on its own task while causing any unauthorized merged model built from it to collapse.

What This Paper Is About

Open repositories let anyone download fine-tuned models and combine them, parameter by parameter, into a new multi-capability model — inheriting the original developers' specialized capabilities without paying the training cost or honoring license terms. MergeGuard is a proactive defense: the model owner modifies their own weights before release so that the model still works normally on its intended task, but any model merged from it degrades severely. The goal is to break merging compatibility without breaking the released model.

Key Contributions

1. MergeGuard, a proactive dual-stage defense. Stage 1 (Density-Aware Finetuning) uses L2-regularized training to disperse task-relevant information across layers; Stage 2 (Adversarial Weight Negation) injects structured, masked perturbations to misalign task subspaces. Both operate only on the defender's own parameters.

2. Broad empirical evaluation across modalities and architectures. Experiments cover vision (ViT-L-14 and Stable Diffusion 1.5) and language (Llama2-7B, Gemma2-9B, Mistral-7B), across eight image-classification datasets, two image-generation datasets, and three LLM benchmarks, under four merging methods (WA, TA, TIES, AdaMerging) with DARE+TIES also used for LLMs.

3. Reported protection margin. The paper reports that MergeGuard reduces merged-model accuracy by up to 90% with less than 1.5% performance loss on the protected model.

4. Evaluation against two adaptive attacks (Unmask and GradErase), which the paper reports both fail to circumvent the defense because task information is dispersed and the perturbation direction is not fully observable.

The paper also positions itself against PaRaMS, which it identifies as the only other proactive defense against unauthorized model merging.

Main Findings

• Standalone accuracy is nearly preserved. Comparing the fine-tuned model (θ_def) with the protected model (θ̂_def) in Table 1: SUN397 82.32 → 81.52, Cars 92.39 → 88.29, RESISC45 97.37 → 97.25, EuroSAT 99.81 → 95.46, SVHN 98.11 → 96.82, GTSRB 99.24 → 98.25, MNIST 99.69 → 99.27, DTD 84.15 → 82.16.

• Merged accuracy collapses across all four merging methods. Table 2 shows e.g. ADA on GTSRB 97.5 → 2.19, ADA on SVHN 93.4 → 7.76, WA on EuroSAT 91.9 → 13.07, TIES on SVHN 90.3 → 7.77. The introduction reports GTSRB falling from 86.78% to 12.19% and MNIST from 96.02% to 11.35%; the later text and Table 3 state 12.91% for GTSRB and 11.35% for MNIST.

• MergeGuard degrades merged models more than PaRaMS. Table 3 reports an average accuracy drop of 30.76 for PaRaMS versus 52.11 for MergeGuard. Under TA, MergeGuard drops GTSRB to 12.91% and MNIST to 11.35%, while PaRaMS only reduces them to 52.25% and 96.02%. The paper notes PaRaMS preserves original accuracy almost perfectly while MergeGuard introduces a minor drop.

• LLM merging results. Merged accuracy generally falls to single digits, sometimes 0%. Gemma2 on GSM8K goes from 69.6% to 1.52%, and on HumanEval from 64.02% to 21.34%. Mistral with TA on GSM8K drops from 75.7% to 0%. Llama2 and Mistral each show nearly a 50% drop in overall accuracy, with Gemma2 degrading more; HumanEval pass@1 falls by over 50%.

• Both stages are needed. The ablation on ViT-L/14 (Table 4) shows Stage 1 alone and Stage 2 alone cause only marginal drops in standalone accuracy, while Stage 1+2 together produce the collapse — the paper describes this as a non-trivial synergy in which Stage 1 reshapes information geometry so Stage 2's high-dimensional misalignments cause destructive interference.

• Adaptive attacks only partially recover. Table 5 reports average merged accuracy dropping from 84.47% (no defense) to 40.26% with MergeGuard. Unmask recovers to 64.64% and GradErase to 51.77%, leaving a degradation margin of at least 20% across tasks. Unmask's subtraction also removes essential task information, pushing performance back toward the pretrained level (θ_pre average 65.12%).

• Image generation behavior differs from PaRaMS. On SD 1.5 (Naruto as the defender's task, WikiArt as the free-rider's), the unprotected merged model generates Naruto-style images; the MergeGuard-protected merged model fails to reproduce the character. The paper explains that PaRaMS tends to produce pure noise, whereas MergeGuard prevents semantic fidelity without total noise collapse, because its L2-regularized redistribution preserves weak weight correlations.

Methodology in Plain English

The defender controls only their own fine-tuned weights, so the defense must work without knowing the attacker's model, merging strategy, or target tasks. The paper's observation is that successful merging methods (TIES, AdaMerging, DARE) deliberately spread task-relevant parameters out so that multiple task vectors overlap less and interfere less. MergeGuard inverts that property.

Stage 1 — Density-Aware Finetuning. The model is fine-tuned with the usual task loss plus a per-layer L2 penalty (L_Total = L_CE + α L2, or the next-token-prediction equivalent for LLMs), which pulls weights toward zero and spreads important information across many smaller weights instead of a few large ones. The model still performs its task, but the weight distribution becomes less stable under blending.

Stage 2 — Adversarial Weight Negation (no training required). Each layer is masked in turn and the accuracy drop measured; the top k'% most damaging layers are treated as critical and excluded. A binary mask M is built to protect those critical layers and the least significant parameters. The released model is then θ̂_def = θ_def' − β · M ⊙ τ'_def, where τ'_def = θ_def' − θ_pre is the task vector and β > 0 is a small perturbation factor. For LLMs, model.embed_tokens.weight, model.norm.weight, and lm_head.weight are excluded from the subtraction to prevent collapse; ViT models undergo the full operation.

Theoretical framing. Merging works when the two task vectors live in a shared linear subspace so that their superposition remains a descent direction. Stage 1 decorrelates the Hessian eigenvectors that spanned that shared subspace; Stage 2 rotates the task vector, increasing the expected interference term ΔL_merge ≈ λ1λ2 ||τ'_def|| ||τ_fr|| (1 − cos φ), which grows with misalignment. The paper states that even small rotations (e.g. φ > 30°) push the merged model outside the shared basin.

Fixed hyperparameters. k' = 10, k = 0.1, α = 0.01, β = 1 across all experiments, with no task-specific tuning; merging coefficients follow the protocols of the respective merging methods. The Unmask adaptive attack uses λ = 0.3.

Why This Matters

Research impact. The paper reframes model merging as an attack surface rather than purely a convenience, and it is only the second proactive defense in this space after PaRaMS. Its main technical claim is that reshaping parameter geometry — both magnitude distribution and directional alignment — is a more effective defense than deterministic rearrangement, because it targets the low-dimensional discriminative subspaces that classification tasks rely on.

Real-world applications.

• Protecting commercially licensed fine-tuned checkpoints (medical imaging, satellite imagery, domain-specific classifiers) released on open hubs such as Hugging Face, GitHub, and ModelScope.
• Guarding generative style or character models on platforms like Stable Diffusion, where the paper demonstrates unauthorized inheritance of a character style (Naruto) by merging with an unrelated art model (WikiArt).
• Enforcing license terms and attribution for domain-adapted LLMs covering instruction following, math reasoning, and code generation.
• Preserving provenance and accountability when parameter blending would otherwise conceal which weights came from which source model.

Industry relevance. Organizations that publish fine-tuned checkpoints but cannot control downstream recombination can ship models that remain fully usable for legitimate customers while offering far less value to free-riders who merge without authorization. The paper notes the threat model assumes cost-sensitive free-riders who will not retrain or distill — the defense is aimed exactly at the low-cost merging shortcut.

Future Directions

• Handling parameter-efficient fine-tuning. The threat model explicitly excludes PEFT methods such as LoRA or shallow tuning, since they do not expose full task vectors in the base parameter space and are incompatible with classical parameter-level merging. Extending protection to PEFT-released models is left open.

• Stronger adaptive attacks. Unmask recovered merged accuracy to 64.64% and GradErase to 51.77%, meaning the defense margin is at least 20% rather than complete. Better perturbation-estimation or unmasking strategies remain an open question.

• Task- and modality-specific tuning of the disruption mechanics. The paper observes that PaRaMS is more disruptive for continuous generative pipelines (diffusion models), while MergeGuard is better suited to discriminative classification tasks. Closing that gap — or deliberately selecting the defense per modality — is a natural next step.

• Generalization beyond the evaluated settings. All experiments use one fixed hyperparameter set (k' = 10, k = 0.1, α = 0.01, β = 1) and one protected model per run; robustness to different merging coefficients, more than two constituent models, and architectures outside ViT-L-14, SD 1.5, Llama2-7B, Gemma2-9B, and Mistral-7B is not reported.

Target Audience

Researchers and practitioners working on model ownership, watermarking, and intellectual-property protection for machine learning; teams that publish fine-tuned checkpoints and need license enforcement; and anyone studying model merging who wants to understand its failure modes. Readers need a working knowledge of task arithmetic, parameter-level fusion, and loss-landscape curvature to follow the theoretical justification, though the two-stage procedure itself is described concretely enough for an engineer to implement.

Authors’ abstract

The rapid proliferation of pretrained models and open repositories has made model merging a convenient yet risky practice, allowing free-riders to combine fine-tuned models into a new multi-capability model without authorization. Such unauthorized model merging not only violates intellectual property rights but also undermines model ownership and accountability. To address this issue, we present MergeGuard, a proactive dual-stage weight protection framework that disrupts merging compatibility while maintaining task fidelity. In the first stage, we redistribute task-relevant information across layers via L2-regularized optimization, ensuring that important gradients are evenly dispersed. In the second stage, we inject structured perturbations to misalign task subspaces, breaking curvature compatibility in the loss landscape. Together, these stages reshape the model's parameter geometry such that merged models collapse into destructive interference while the protected model remains fully functional. Extensive experiments on both vision (ViT-L-14) and language (Llama2, Gemma2, Mistral) models demonstrate that MergeGuard reduces merged model accuracy by up to 90% with less than 1.5% performance loss on the protected model.