Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Making Models Unmergeable via Scaling-Sensitive Loss Landscape

Minwoo Jang, Hoyoung Kim, Jabin Koo, Jungseul Ok

TL;DR

This work addresses the governance gap created by modular model releases by introducing Trap$^{2}$, a training-time protection that encodes unmergeability into fine-tuned updates independent of architecture. By optimizing a loss that preserves performance at the nominal scale $s=1$ while increasing loss under off-nominal scaling $s\neq 1$, Trap$^{2}$ degrades downstream mergers common in adapter and full-model compositions. The framework is validated across multiple backbones and merging operators, showing strong standalone utility and reliable post-merge degradation, with theoretical guarantees on convergence and scaling-induced degradation. Its architecture-agnostic nature and compatibility with adapter-only releases make it practically impactful for safeguarding model-reuse pipelines in public hubs. The work also discusses limitations, including potential data-driven recovery strategies and responsible-use considerations for deployment in community ecosystems.

Abstract

The rise of model hubs has made it easier to access reusable model components, making model merging a practical tool for combining capabilities. Yet, this modularity also creates a \emph{governance gap}: downstream users can recompose released weights into unauthorized mixtures that bypass safety alignment or licensing terms. Because existing defenses are largely post-hoc and architecture-specific, they provide inconsistent protection across diverse architectures and release formats in practice. To close this gap, we propose \textsc{Trap}$^{2}$, an architecture-agnostic protection framework that encodes protection into the update during fine-tuning, regardless of whether they are released as adapters or full models. Instead of relying on architecture-dependent approaches, \textsc{Trap}$^{2}$ uses weight re-scaling as a simple proxy for the merging process. It keeps released weights effective in standalone use, but degrades them under re-scaling that often arises in merging, undermining unauthorized merging.

Making Models Unmergeable via Scaling-Sensitive Loss Landscape

TL;DR

This work addresses the governance gap created by modular model releases by introducing Trap, a training-time protection that encodes unmergeability into fine-tuned updates independent of architecture. By optimizing a loss that preserves performance at the nominal scale while increasing loss under off-nominal scaling , Trap degrades downstream mergers common in adapter and full-model compositions. The framework is validated across multiple backbones and merging operators, showing strong standalone utility and reliable post-merge degradation, with theoretical guarantees on convergence and scaling-induced degradation. Its architecture-agnostic nature and compatibility with adapter-only releases make it practically impactful for safeguarding model-reuse pipelines in public hubs. The work also discusses limitations, including potential data-driven recovery strategies and responsible-use considerations for deployment in community ecosystems.

Abstract

The rise of model hubs has made it easier to access reusable model components, making model merging a practical tool for combining capabilities. Yet, this modularity also creates a \emph{governance gap}: downstream users can recompose released weights into unauthorized mixtures that bypass safety alignment or licensing terms. Because existing defenses are largely post-hoc and architecture-specific, they provide inconsistent protection across diverse architectures and release formats in practice. To close this gap, we propose \textsc{Trap}, an architecture-agnostic protection framework that encodes protection into the update during fine-tuning, regardless of whether they are released as adapters or full models. Instead of relying on architecture-dependent approaches, \textsc{Trap} uses weight re-scaling as a simple proxy for the merging process. It keeps released weights effective in standalone use, but degrades them under re-scaling that often arises in merging, undermining unauthorized merging.
Paper Structure (68 sections, 4 theorems, 58 equations, 8 figures, 11 tables, 1 algorithm)

This paper contains 68 sections, 4 theorems, 58 equations, 8 figures, 11 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Works
  3. Model Merging
  4. Unmergeability for Model Protection
  5. Background
  6. Low-Rank Adaptation (LoRA)
  7. LoRA Merging
  8. Unified View: Merging as Aggregating Updates
  9. Problem Setup and Challenges
  10. Loss under Scaling
  11. Merging Operator
  12. Desired Properties
  13. Post-hoc Defenses via Paired Cancellations
  14. Challenges
  15. Proposed Method
  16. ...and 53 more sections

Key Result

Theorem 1.1

Let $J(\Delta W)$ be the Trap$^{2}$ objective defined in Eq. eq:trap2_obj, with a nonnegative weight $w(s)$. Assume $J$ is $L$-smooth and bounded below by $J_{\inf}>-\infty$. Assume the scale distribution $\mathcal{S}$ is supported on two off-nominal intervals: for $0 < s_{\text{min}} < 1 - \delta < Consider SGD with step size $\eta\in(0,1/L]$: Let $\{(z_t,s_t)\}_{t\ge 0}$ be i.i.d. and define th

Figures (8)

  • Figure 1: Unmergeability protection in model sharing and limitations of prior work. (Left) Providers release task updates for downstream reuse, often as adapters. (Middle) Most post-hoc protections are Transformer-specific, limiting transfer beyond Transformers. They also require full-weight access, which makes them incompatible with adapter-only releases such as LoRA. (Right) These limitations motivate training-time protection embedded in the released update, preserving standalone utility while making downstream merges unreliable.
  • Figure 2: (Left) Loss shaping over the scaling factor $s$. We optimize via Trap$^{2}$ to retain high utility in the authorized scale ($\bigstar$; $s = 1$), while inducing degradation under unauthorized scales ( ; $s \neq 1$). The zero-shot result (; $s = 0$) is shown as a reference. (Right) Accuracy along the scaling factor $s$. Trap$^{2}$-trained adapter attains high standalone accuracy in the authorized region ($\bigstar$) but collapses under unauthorized scaling ( ).
  • Figure 3: Performance degradation under pairwise merging. Accuracy along the interpolation path between an unprotected Cars adapter and a Trap$^2$ GTSRB adapter is evaluated on both tasks.
  • Figure 4: Results of pairwise LoRA merging at scale $s = 0.8$ on CLIP ViT-B/32. Each cell merges one Trap$^2$-trained adapter for the row task with one unprotected adapter for the column task, and reports per-task accuracy (%; $\downarrow$) on (a) the protected task, (b) the unprotected task, and (c) their average. Cell color intensity encodes accuracy, with darker shading indicating lower accuracy (stronger degradation). The protected adapter consistently self-collapses after merging, often inducing collateral degradation on the unprotected task.
  • Figure 5: Uniform averaging proxy across 8 vision benchmarks. We simulate naive averaging of $N$ adapters by scaling each adapter as $s = 1/N$ before aggregation, and report accuracy (%) as a function of $N$ for each dataset. Trap$^2$ exhibits catastrophic degradation as soon as $N \geq 2$, while unprotected adapters remain relatively stable, indicating robustness of the protection against uniform averaging.
  • ...and 3 more figures

Theorems & Definitions (7)

  • Theorem 1.1: Stationarity of Trap$^{2}$ under SGD
  • proof
  • Theorem 1.2: Self-degradation under Down-scaling
  • proof
  • Corollary 1.3: Self-degradation under Uniform Averaging
  • Theorem 1.4: Cross-adapter Collateral Damage
  • proof