{"id":"5dcf8759-c061-4935-87b1-6244f9a86b99","arxiv_id":"2411.12508","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"EncoderLock modifies a small set of pre-trained encoder weights so that linear probing succeeds on authorized domains while failing on prohibited domains, in supervised, unsupervised, and zero-shot data scenarios.","lead":"EncoderLock is a method that alters a pre-trained image encoder so that probing it with a downstream classifier works well on allowed domains but badly on forbidden ones. A provider can apply it with labeled forbidden data, unlabeled data, or even just a text description of the forbidden theme.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central mechanism requires the defender's prohibited-domain data (or synthetic proxy) to represent the attacker's actual probe distribution; this transfer is untested, and the zero-shot variant already shows the risk.","rationale":"Reader's conditional verdict already identifies the proxy-transfer assumption as weakest; I agree. The paper has substantial strengths: a concrete threat model, a parameter-light method (only N, R, α, LR), comparisons against NTL/CUTI, a real DINOv1 case study, and zero-shot ablations. Those do not, however, close the gap. The defense's only link between 'prohibited domain' and 'attacker's probe distribution' is the data D_T used in Function 1 and the update step; no invariance property or theoretical bound is provided. The held-out/mismatch test I propose is decisive because it directly measures the claimed generalization. If it passes, the central claim is considerably stronger; if it fails, the paper should be revised to claim protection only against probing on distributions well matched to the defender's target set, not 'specified prohibited domains' generally. Since the reader already conditioned on this and related issues, I do not propose changing the verdict.","tokens_in":28528,"tokens_out":8435,"duration_ms":93252,"concrete_test":"Run a held-out-domain experiment: split the prohibited domain into two disjoint parts (e.g., by class or by image source) and give the defender only part A; for zero-shot, generate synthetic images from a disjoint set of within-theme prompts. Train supervised/unsupervised/zero-shot EncoderLock on part A (or the synthetic set), then evaluate the locked encoder by probing with part B. Compare after-accuracy on part B with the reported locked accuracy and with train-from-scratch. Also record Jaccard overlap between the top-N weight sets selected on part A and on part B; if overlap is low or B accuracy stays high (e.g., above 40% on Military Vehicles), the weight-importance transfer assumption is empirically false and the central claim should be restricted to the exact training dataset.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Function 1 (Domain-aware Weight Selection) ranks weights by |∇L_T^{l,i}/∇L_S^{l,i}| computed on a batch B_T from the defender's target set D_T. The subsequent update (Eq. 4/5, or contrastive Eq. 7) then obfuscates features along those selected weights. The central claim in Section V-G ('all three variants effectively limit the encoder's performance on the prohibited domain') therefore presupposes that D_T—a labeled sample, an unlabeled sample, or a Stable-Diffusion synthetic set generated from prompts (§IV-E)—is representative of the distribution an attacker actually probes. This is not tested. No experiment partitions a prohibited domain into defender-visible and attacker-held subsets; for zero-shot the mismatch is concrete: the real Military Vehicles dataset differs from synthetic images generated from 10 prompts, and the paper's own numbers show zero-shot is the weakest variant (23.69% vs. 11.48% on ResNet-18, Fig. 8; 29.26% vs. 18.15% on ViT, §V-G). If the top-N weight set is driven by artifacts of the proxy (e.g., prompt-specific barrels or synthetic texture), the locked encoder can leave the actual probe distribution nearly intact, and the 'poor performance on specified prohibited domains' claim fails for that domain. The current defense argument has no transfer guarantee beyond the datasets used in training.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes EncoderLock, a method for restricting malicious linear probing of a pre-trained encoder on a specified prohibited domain. EncoderLock iteratively selects a small set of encoder weights whose target-gradient to source-gradient ratio is large (Function 1) and updates those weights with a regularized loss (Eq. 4-5) under a self-challenging scheme (Algorithm 1). Three variants address labeled, unlabeled, and no-access prohibited-domain data: supervised, unsupervised contrastive, and zero-shot with synthetic Stable-Diffusion data. Experiments on digit-transfer pairs (Tables II-III), cross-task transfers (Fig. 6), a military-vehicle case study with ResNet-18 (Fig. 8), a real Facebook ViT encoder (Fig. 13), and comparisons with NTL and CUTI (Figs. 9-11) are reported.","tokens_in":28843,"tokens_out":7376,"duration_ms":78277,"significance":"If the central claims held at face value, this would be a practically useful applicability-authorization tool: it operates on the encoder rather than the full model, targets the probing setting, includes a genuinely label-free variant, and is evaluated on a real ViT with a concrete military-use case. The paper ships a large set of experiments, compares against two prior transforms, reports weight-change budgets, and includes failure-oriented ablations. However, the significance is limited by the universal wording of the main claim and by the untested proxy-to-probe distribution transfer, which the zero-shot results already show to be the weakest link. With claim refinement and additional transfer experiments, the contribution would be solid.","major_comments":[{"comment":"The abstract and Section V-G state that all three variants of EncoderLock effectively limit the encoder's performance on prohibited domains, and the abstract promises 'poor performance on specified prohibited domains.' Table III (VGG-11, unsupervised EncoderLock) reports post-protection target accuracies of 76.68% for SD-to-MT, 86.75% for SD-to-UP, and 75.31% for SD-to-SN. These values correspond to relative target drops of only about 21%, 7%, and 17%, respectively, and are far above the 'poor performance' level claimed. The central claim is therefore stated more broadly than the evidence supports; it should be restricted to the tested regimes, and the failure cases should be analyzed explicitly.","section":"Section V-G / Table III"},{"comment":"The domain-aware selection in Function 1 computes the importance ranking on batches B_T from the defender's target set D_T, and the zero-shot variant constructs D_T from 10 Stable-Diffusion prompts. The paper never tests the transfer assumption that this proxy is representative of the distribution an attacker actually probes: no experiment partitions a prohibited domain into defender-visible and attacker-held portions, and the real-Military zero-shot numbers in Fig. 8 and Section V-G are the weakest of the three variants (23.69% versus 11.48% on ResNet-18, and 29.26% versus 21.56% and 18.15% on ViT). This is a load-bearing gap because if an attacker probes a subpopulation whose critical weights are not ranked highly under the proxy, the locked encoder can leave the prohibited-domain accuracy high. I ask for an explicit distribution-shift evaluation (for example, train on a subset of military classes or on synthetic data, then evaluate on held-out classes or a second prohibited dataset) and a corresponding revision of the universal claim.","section":"Sections IV-B / IV-E / V-D"},{"comment":"Algorithm 1 takes a 'Desired target accuracy αgoal' as an input and uses it for early stopping, but αgoal is never specified in the main text, Appendix A, or Table V. Section VI-B describes a generic accuracy threshold accth but does not report the values used in the experiments. Since the reported 'after' accuracies depend on when training stops, this missing hyperparameter prevents reproduction and leaves open the possibility that the target accuracies were determined by threshold choice. Please report αgoal or the actual stopping rounds for every configuration.","section":"Algorithm 1 / Table V"},{"comment":"The weight-importance score in Function 1 is defined as |∇L_T^{l,i} / ∇L_S^{l,i}|. For weights where the source batch gradient is zero or very small, the score is undefined or dominated by the denominator rather than by target importance. The paper does not specify a stabilizer, a floor on |∇L_S|, or a masking rule for such weights. Because this ranking determines which M weights are updated, a precise definition is required for the algorithm to be reproducible and for the reported selection behavior to be interpretable.","section":"Function 1 / Eq. (6)"}],"minor_comments":[{"comment":"The abstract says the experiments span 'fifteen domains,' but Table I lists twelve datasets and Section I also says twelve domains; the number should be reconciled.","section":"Abstract / Table I"},{"comment":"The text says 'We evaluate one-shot EncoderLock's performance' in the zero-shot evaluation section; this should read 'zero-shot EncoderLock.'","section":"Section V-D"},{"comment":"The method is described as a minimax optimization, but Algorithm 1 performs alternating updates: the encoder weights are updated first, then the auxiliary head is retrained from scratch. The paper should clarify that this is an alternating scheme rather than a joint solution to Eq. (6).","section":"Section IV-C / Eq. (6)"},{"comment":"The constraint ∥ϕ*−ϕ∥_0 ≤ M is stated but no mechanism for enforcing it is described; please clarify whether the update is restricted by masking only the selected weights or by some projected update.","section":"Eq. (5)-(6)"},{"comment":"The PPI formula divides by accT_m, so the index diverges when the protected target accuracy is zero; please state how zero or near-zero denominators are handled in the reported plots.","section":"Eq. (8)"}],"recommendation":"major_revision","confidential_remarks":"The paper is not circular: the method is evaluated with held-out probing and external baselines. The main risk is overclaiming from in-distribution experiments to a universal guarantee. I would encourage the editor to request the distribution-shift experiments described in Major Comment 2 and a precise statement of αgoal before acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Good paper to know about, but read the tables before repeating the abstract. The new thing here is a real one: prior non-transferable learning (NTL, CUTI) protects a full model from being fine-tuned, while EncoderLock targets the frozen-encoder probing setting, and the three-level data-accessibility framing (labeled, unlabeled, theme-only) matches how encoder-as-a-service providers actually think. The domain-aware weight selection plus minimax self-challenging training is a sensible combination, and on the digit benchmarks it works: supervised EncoderLock pushes target accuracy to 8-20% while keeping source accuracy above 92%, clearly beating NTL/CUTI when those are probed with a downstream head. The ViT experiments on a real DINO encoder are a nice touch. I also appreciate that they check robustness to different probing-head widths/depths and to probing-data volume.\n\nThe soft spots are in the scope of the claim, not in the mechanism. The abstract and Section V-G say all three variants 'effectively limit' the encoder on the prohibited domain, but Table III shows several unsupervised pairs where the lock mostly fails: SD to MT at 76.68% after, UP to MT at 45.02%, and the average DropT for SD is only 26.74%. That is not 'poor performance on the prohibited domain' unless the threshold is very generous. The zero-shot variant is the weakest, which is expected, but the paper's own reasoning exposes why: the synthetic dataset generated from 10 prompts does not represent the real prohibited distribution, and the weight-importance ranking computed on that proxy is assumed to transfer to whatever the attacker actually probes. That transfer is never tested—no experiment splits a prohibited domain into defender-visible and attacker-held subsets. So the central claim holds conditionally: it holds when the defender's proxy is close to the attacker's probe distribution, which is exactly the untested case. The 'train-from-scratch' security analysis is a good idea, but it inherits the same proxy assumption. Also, no code or data are released, and most numbers lack error bars, so independent verification is limited to what is in the text.\n\nFor a security venue, I would send this to review with a request to revise the claims to match the data, test the proxy-transfer question explicitly (e.g., split a prohibited domain into defender and attacker splits), and release artifacts. The core idea is worth engaging with; the overclaiming is fixable.","headline":"A useful new problem framing for encoder probing protection, with a solid supervised/unsupervised core, but the zero-shot variant and the universal 'effectively limit' claim outrun the evidence.","tokens_in":29354,"tokens_out":3455,"would_cite":true,"duration_ms":33776,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Forbidden-task probing accuracy falls to near-random levels.","keywords":["malicious probing","applicability authorization","non-transferable learning","pre-trained encoder","domain-aware weight selection","self-challenging training","contrastive loss","zero-shot protection"],"falsifier":"Probe an EncoderLock-protected encoder with a downstream classifier trained on prohibited-domain data that the defender's proxy never covered—for example military-vehicle photos in new environments, viewpoints, or resolutions absent from the synthetic set used for the zero-shot variant, or a differently composed domain with the same theme. If the classifier's accuracy rebounds toward the unprotected level observed in the paper (around 60% on the military-vehicle domain) instead of staying in the reported 18–29% range, the central transferability assumption of the weight-selection score is wrong.","tokens_in":28328,"feed_emoji":"🔒","tokens_out":22082,"duration_ms":178035,"temperature":0.7,"pith_summary":"Pre-trained encoders are routinely published or exposed through APIs that return feature vectors, and anyone can attach a small classifier head to reuse the encoder for a custom task. That openness also enables abuse: an encoder trained for general vision can be probed to build a classifier for a task the provider wants to forbid, such as discriminatory speculation or warfare applications. EncoderLock is a proposed remedy that modifies the encoder before deployment so that probing it for a pre-specified prohibited domain yields features too uninformative to classify, while probing for authorized domains keeps working. The paper backs this claim with three variants that differ in what the provider knows about the prohibited domain—labeled data, unlabeled data, or only a text description of its theme—and with experiments on a large, self-supervised Vision Transformer encoder in addition to smaller convolutional networks. If the claim holds, the practical payoff is that a single frozen encoder can carry an applicability license that later downstream training cannot silently cancel.","feed_headline":"Forbidden-task probing accuracy falls to near-random levels","feed_subtitle":"A tiny, targeted weight edit keeps the encoder useful for allowed domains, even without any banned-domain data.","key_machinery":"The load-bearing object is the domain-aware weight selection score, which ranks each weight $i$ in layer $l$ by the magnitude ratio of the target-domain gradient to the source-domain gradient, $|\\nabla L_T^{l,i} / \\nabla L_S^{l,i}|$, and selects the top $N$ weights per round; a weight whose influence is large for the prohibited domain but small for the authorized one can be adjusted without erasing the encoder's main competence. The selected weights are updated by minimizing the log-ratio regularizer $R_T = \\log(1 + \\alpha\\, L_S / L_T)$ under the constraint $\\lVert \\phi^* - \\phi \\rVert_0 \\le M$, which penalizes the ratio between source loss and target loss so the target loss rises without dragging the source down. Around this core sit the three data-dependence branches: a self-challenging minimax loop that retrains the target head from scratch each round (supervised), a contrastive loss that blurs class structure in the target domain's feature space (unsupervised), and an AI-agent plus text-to-image pipeline with prompt refinement that fabricates a synthetic target dataset from a theme (zero-shot).","core_discovery":"At the weight level, the paper argues, applicability authorization is enforceable: after EncoderLock, a downstream classifier trained on the encoder's embeddings for a prohibited domain reaches accuracy near random guess in several settings (for example 8.47% on a ten-class digit target and 1.19% on a 100-class target), while accuracy on the authorized source domain stays above 92%. In the real-encoder study on a public self-supervised Vision Transformer, military-vehicle classification accuracy drops from an unprotected 60.55% (measured on the paired ResNet-18 setup) to 21.56%, 18.15%, and 29.26% under the supervised, unsupervised, and zero-shot variants. The enabling observation is that domain-relevant knowledge is local: each domain engages a distinct small set of critical weights, ranked by the ratio of target-domain to source-domain gradient magnitudes $|\\nabla L_T^{l,i} / \\nabla L_S^{l,i}|$, and updating only those weights within a small $\\ell_0$ budget confines the lock's damage to the prohibited domain. Over that selection sits a minimax 'self-challenging' loop that re-initializes and retrains the attacker's downstream head each round, forcing the encoder to keep losing target-domain utility no matter which classifier the attacker tries; the label-free and data-free variants drive the same selection with a contrastive loss or with synthetic images generated from a text theme through an AI-agent prompt-refinement pipeline. The paper's experiments show the lock surviving progressive probing epochs, deeper and wider heads, and access to the full prohibited dataset, and outperforming earlier non-transferable learning baselines that regain target accuracy after a few fine-tuning steps.","pith_inferences":["The paper leaves untested whether the lock survives a proxy gap, where the attacker's prohibited-domain data differs from the defender's stand-in (labeled samples, unlabeled samples, or synthetic images); a natural next experiment is to lock with one military-vehicle proxy and probe with a deliberately disjoint military dataset, and to compare locking a union of critical weights from several proxi","The target-to-source gradient ratio is a general-purpose instrument the paper does not pursue: the same score could be used to prune away domain-specific capacity, to place watermarks in domain-sensitive weights, or to audit which domains a released model was tuned on.","Because the threat model only covers attackers who freeze the encoder and train a head, the 'locked' guarantee has an untested boundary: an attacker who partially fine-tunes the encoder itself, or uses adapters that modify features rather than classify them, might bypass the lock—checking that boundary is the immediate sequel the paper implicitly invites."],"forward_implications":["A provider can ship one frozen encoder whose embeddings are unhelpful for a stated forbidden task: supervised and unsupervised EncoderLock leave target accuracy at roughly 8–20% on the digit-domain pairs while source accuracy stays above 92%.","The defense works on a large, self-supervised Vision Transformer, not only on small supervised convolutional encoders, and it changes only a tiny fraction of the weights (reported average below 0.08%), leaving performance on unrelated admissible domains mostly intact.","Attacker adaptation within the probing threat model does not restore target accuracy: classifiers from one to four layers with widths up to 4096 achieve at most 17.89% on the target, and probing with up to the entire prohibited dataset leaves target accuracy low.","Protection is available across the whole spectrum of prior knowledge: with labeled prohibited data, unlabeled prohibited data, or none at all—the zero-shot variant, using only a text theme refined through an AI agent and a text-to-image model, reduces military-vehicle target accuracy from 60.55% to 23.69% in the ResNet-18 case study."],"supporting_citations":[{"why":"Defines non-transferable learning, the prior method EncoderLock extends and must beat; supplies the source/target loss-balancing template and the probe-after-defense evaluation.","marker":"[79]"},{"why":"The second non-transferable baseline (Model Barrier); its output-space-only regularization is what EncoderLock's weight-level log-ratio update is designed to improve on.","marker":"[78]"},{"why":"Supplies the self-supervised Vision Transformer encoder used in the real-world case study, showing the defense on a large, publicly released encoder.","marker":"[8]"},{"why":"Supplies the contrastive learning framework whose loss the unsupervised EncoderLock variant adapts to obfuscate the target domain's feature space.","marker":"[11]"},{"why":"Supplies the text-image embedding space used to compare and refine prompt similarity in the zero-shot variant.","marker":"[64]"},{"why":"Supplies the text-to-image generator that produces the synthetic prohibited-domain dataset for the zero-shot variant.","marker":"[68]"},{"why":"Supplies the large language model that acts as the AI agent turning a prohibited theme into prompts and refining them.","marker":"[1]"}],"fun_headline_variants":["EncoderLock: probing accuracy on banned domains near random","One small weight edit: banned-task accuracy drops to ~1%","No data needed: EncoderLock kills malicious probing in zero-shot","Self-challenging encoder lock: banned tasks stay useless under any attacker","EncoderLock: banned-domain accuracy nearly random (1.19%)"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing assumption is that the defender's stand-in for the prohibited domain—labeled samples, unlabeled samples, or synthetic images generated from a text theme—matches the data an attacker will actually probe, because the critical-weight ranking is computed on that stand-in; if the distributions diverge, the altered weights may not suppress the attacker's accuracy.","fun_headline_variants_meta":{"raw":{"variants":["EncoderLock: probing accuracy on banned domains near random","One small weight edit: banned-task accuracy drops to ~1%","No data needed: EncoderLock kills malicious probing in zero-shot","Self-challenging encoder lock: banned tasks stay useless under any attacker","EncoderLock: banned-domain accuracy nearly random (1.19%)"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000626,"raw_usage":{"total_tokens":3010,"prompt_tokens":1171,"completion_tokens":1839,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":787,"completion_tokens_details":{"reasoning_tokens":1750}},"tokens_in":787,"tokens_out":1839,"duration_ms":13611,"temperature":1.0,"reasoning_tokens":1750,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T17:27:27.225346+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Probe an EncoderLock-protected encoder with a downstream classifier trained on prohibited-domain data that the defender's proxy never covered—for example military-vehicle photos in new environments, viewpoints, or resolutions absent from the synthetic set used for the zero-shot variant, or a differently composed domain with the same theme. If the classifier's accuracy rebounds toward the unprotected level observed in the paper (around 60% on the military-vehicle domain) instead of staying in the reported 18–29% range, the central transferability assumption of the weight-selection score is wrong.","supporting_citations":[{"cited_title":"Non-transferable learning: A new approach for model ownership verification and applicability authorization,","cited_arxiv_id":null,"evidence_quote":"Defines non-transferable learning, the prior method EncoderLock extends and must beat; supplies the source/target loss-balancing template and the probe-after-defense evaluation."},{"cited_title":"Model barrier: A compact un- transferable isolation domain for model intellectual property protection,","cited_arxiv_id":null,"evidence_quote":"The second non-transferable baseline (Model Barrier); its output-space-only regularization is what EncoderLock's weight-level log-ratio update is designed to improve on."},{"cited_title":"Learning transferable visual models from natural language supervision,","cited_arxiv_id":null,"evidence_quote":"Supplies the text-image embedding space used to compare and refine prompt similarity in the zero-shot variant."},{"cited_title":"High-resolution image synthesis with latent diffusion models,","cited_arxiv_id":null,"evidence_quote":"Supplies the text-to-image generator that produces the synthetic prohibited-domain dataset for the zero-shot variant."}],"review_version":1}