Abstract
Model merging is a technique that combines multiple finetuned models into a single model without additional training, allowing a free-rider to cheaply inherit specialized capabilities. This study investigates methodologies to suppress unwanted model merging by free-riders. Existing methods such as model watermarking or fingerprinting can only detect merging in hindsight. In contrast, we propose a first proactive defense against model merging. Specifically, our defense method modifies the model parameters so that the model is disrupted if the model is merged with any other model, while its functionality is kept unchanged if not merged with others. Our approach consists of two modules, rearranging MLP parameters and scaling attention heads, which push the model out of the shared basin in parameter space, causing the merging performance with other models to degrade significantly. We conduct extensive experiments on image classification, image generation, and text classification to demonstrate that our defense severely disrupts merging while retaining the functionality of the post-protect model. Moreover, we analyze potential adaptive attacks and further propose a dropout-based pruning to improve our proposal's robustness.
Abstract (translated)
模型合并是一种技术，它将多个微调后的模型组合成一个单一的模型而不进行额外训练，从而使搭便车者能够廉价地继承专门的能力。这项研究调查了抑制搭便车者不希望看到的模型合并的方法。现有的方法如模型水印或指纹只能在事后检测到合并的情况。相比之下，我们提出了一种主动防御模型合并的方法。具体来说，我们的防御方法修改了模型参数，使得如果该模型与其他模型合并的话，其功能将被破坏；而如果没有与其他模型合并，则其功能保持不变。 我们的方法由两个模块组成：重新排列多层感知器（MLP）的参数和调整注意力头的权重，这使模型在参数空间中远离共享区域，导致与其它模型合并时性能显著下降。我们在图像分类、图像生成和文本分类上进行了广泛的实验，证明了我们的防御技术严重阻碍了模型合并的同时保留了保护后的模型的功能性。 此外，我们还分析了可能的适应性攻击，并进一步提出了基于dropout的剪枝方法以提高我们提议方案的鲁棒性。
URL
https://arxiv.org/abs/2503.07661
