Apple proposes DLR-Lock to restrict fine-tuning of open-weight language models

Apple’s Machine Learning Research group describes a method to limit unauthorized adaptation of open-weight language models while keeping the models usable. The approach, called DLR-Lock, replaces each pretrained MLP layer in a model with a deep low-rank residual network (DLR-Net) of comparable parameter count.

The authors argue that open-weight sharing accelerates adoption and open research but can be misused for unauthorized fine-tuning or redistribution. Defending against such adaptation is challenging because an adaptive attacker can inspect all weights and architectures and reverse simple structural defenses. DLR-Lock leverages the inference–training asymmetry of automatic differentiation as a novel defense axis.

During fine-tuning, DLR-Lock forces activation memory to grow linearly with depth during backpropagation, imposing a disproportionate overhead on the backward pass relative to the forward pass. The method also introduces architectural mismatches that complicate the optimization landscape of standard fine-tuning, making unauthorized adaptation harder without degrading the model’s capabilities.

The team reports that DLR-Nets are trained via module-wise distillation and that experiments on large language models validate the defense’s effectiveness against adaptive attackers who know the defense strategy. The paper has been accepted at the Efficient Systems for Foundation Models workshop at ICML 2024.