{"id":"037de209-1061-4423-be35-809574fa7f88","arxiv_id":"2510.10982","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Non-transferable examples add perturbations in an authorized model's low-sensitivity subspace, keeping that model's accuracy nearly intact while collapsing the accuracy of all other tested models.","lead":"This paper recodes input data along an authorized model's low-sensitivity directions so that the model still reads it correctly while other models see noise. The goal is a training-free, input-side way to let data be shared for one AI service without being reusable by others.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 2 is an upper bound, not a lower bound, so the claimed formal certification of unauthorized-utility degradation does not follow; the subspace-misalignment premise remains empirically asserted.","rationale":"I read the paper as making two claims: an empirical one (NEs preserve authorized accuracy and collapse unauthorized accuracy across several architectures and VLMs) and a formal one (Theorems 1–2 certify authorized fidelity and unauthorized degradation). The empirical claim is supported by consistent results, including the diagonal/off-diagonal pattern in Tables 1–2 and the VLM results in Table 4. The formal claim, however, has a real soft spot: Theorem 2 is an upper bound and cannot imply the lower-bound condition in Formula (2). The reader's weakest_assumption identifies precisely this gap, and I agree. My proposed check — deliberately aligning the right singular subspaces of W1 and W2 — would settle whether the mechanism truly depends on misalignment or whether other factors (e.g., mere high-dimensional noise) drive the effect. This is a serious but addressable overreach: the paper should either remove the 'directly yields Formula (2)' claim or add a genuine lower-bound analysis / explicit assumption about subspace misalignment. It does not warrant rejection because the empirical core is plausible and the fix is localized. Hence I keep the reader's CONDITIONAL verdict, i.e., no verdict change.","tokens_in":21361,"tokens_out":9060,"duration_ms":93804,"concrete_test":"Construct a synthetic counterexample to test the alignment premise directly: take the authorized model's first-layer right singular matrix V1 and define W2 = U2 S2 V1ᵀ, with S2 chosen so that directions with σ1,i ≤ τ receive large singular values in W2. Generate NEs for W1 using the paper's procedure and measure W2's accuracy. If W2 accuracy remains near clean, then aligned right singular subspaces defeat the mechanism, confirming that Theorem 2 cannot certify degradation and that the 'rarely align' premise is doing the work. Repeat across a few random U2 choices. This isolates the role of subspace misalignment from the rest of the construction.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central formal claim is that Theorem 2 'bounds Unauthorized Utility' and 'directly yields Formula (2)' (Section 4.2). This does not follow. Eq. (5) is an upper bound on a first-layer projection difference: it bounds how far (σ1,i v1,i − σ2,i v2,i)ᵀx̃ can be, and an upper bound cannot imply the lower bound required by Formula (2), which asks that unauthorized task error exceed authorized error by at least γ. The proof then asserts, without a lower-bound argument, that |f′(x̃)−f⋆(x̃)| is large. That is a non sequitur.\n\nThe actually load-bearing premise — that low-sensitivity subspaces 'rarely align across models' — is asserted in Section 1 and used throughout, but Theorem 2 does not establish it. If a non-target model f′ shares a sufficiently large portion of the authorized model's τ-insensitive subspace, the recoding is also nearly invisible to f′, and unauthorized utility survives. The empirical tables suggest this is rare for the evaluated models, but the formal result does not prove it; it only quantifies a first-layer difference without showing that difference translates into task-level degradation.\n\nThere is also a related gap on the authorized side: Theorem 1 bounds ∥Wx̃−Wx∥ for the first linear map, and the jump to '|f⋆(x̃)−f⋆(x)| remains small' is handwaved rather than proved. The empirical evidence is substantial, but the paper's theoretical claims overstate what is certified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes non-transferable examples (NEs): inputs recoded by adding a perturbation in a low-sensitivity subspace of the authorized model's first linear layer. The central claims are that the authorized model retains task utility, unauthorized models suffer degraded utility via subspace misalignment, and that Theorems 1 and 2 provide formal bounds for both effects. The empirical sections evaluate image classifiers (ResNet-50, ViT-B, SwinV2-T, DeiT-B, MambaVision-T) on CIFAR-10 and ImageNet, GLUE for text models, and vision-language models on MMBench, including preprocessing and reconstruction-attack robustness.","tokens_in":21748,"tokens_out":7951,"duration_ms":81533,"significance":"The empirical phenomenon is interesting and potentially useful for model-level purpose limitation: an input-side recoding that is transparent to one model and disruptive to others would be a practical complement to anti-learnability and encrypted inference. The paper's strengths are its broad evaluation across architectures and modalities, the explicit threat model, and the candid Appendix E, which lists important limitations. However, the formal apparatus as written does not support the stated guarantees: Theorem 2 is an upper bound that cannot certify unauthorized degradation, and Theorem 1 stops at first-layer feature distance without reaching the task metric in Formula (1). The contribution is therefore best read as an empirical method plus supporting intuitions, not as a certified authorization mechanism.","major_comments":[{"comment":"Theorem 2 is presented as bounding 'Unauthorized Utility', but Eq. (5) is an upper bound on one singular component of a first-layer difference. An upper bound cannot imply the lower separation required by Formula (2). The sentence 'Consequently, |f'(x̃)-f⋆(x̃)| is large, which directly yields Formula (2)' is a non sequitur: no lower bound on the full first-layer difference is proved, no propagation from first-layer change to task error is established, and no argument shows the spectral gap epsilon is nonzero. The Hoffman-Wielandt step also requires care with singular-vector sign ambiguity and eigenvalue gaps. Please either prove a genuine lower bound under explicit assumptions or clearly state that formal degradation certification is not claimed.","section":"§4.2, Eq. (5); §2.1 Eq. (2)"},{"comment":"Theorem 1 bounds ||W x̃ - W x|| by τ||z|| with high probability. This does not establish anything about f⋆(x̃) or the task metric m in Formula (1). The paragraph beginning 'these considerations evidently imply' is an appeal to intuition, not a proof: modern networks are not generally Lipschitz-stable in a way that makes a small first-layer change irrelevant. Since Authorized-Utility Retention is defined in task-metric terms, the claimed formal guarantee is not delivered. The authors should either prove a propagation result with explicit Lipschitz/network assumptions or explicitly label authorized-utility retention as an empirical finding.","section":"§4.1, Theorem 1"},{"comment":"The mechanism's non-transferability rests on the premise that τ-insensitive subspaces 'rarely align across models'. This premise is asserted in Section 1 and used throughout, but Theorem 2 does not prove it. If a non-target model shares a substantial portion of Insτ(W1), the recoding is also nearly inert for that model and unauthorized utility survives. The empirical tables suggest the premise holds for the selected models, but this remains an empirical observation, not a proven property. The text should separate the formal claims from the empirically supported subspace-misalignment hypothesis.","section":"§1 and §4.2, Assumption 2"},{"comment":"The limitations section concedes that a method- or parameter-aware adversary can partially cancel the recoding with an input-side projector, and that a training-time adversary can restore non-target utility by regularizing sensitivity. These are exactly the adaptive and transfer-match adversaries defined in Section 2.2. The abstract and conclusion, however, state unqualified claims such as 'unauthorized models collapse'. The authors should tighten the abstract, Section 5, and the conclusion to match the admitted limitations, or add experiments evaluating these stronger adversaries.","section":"Appendix E"},{"comment":"At the standardized 20 dB PSNR, the authorized SwinV2-T accuracy drops from 80.9% to 71.7% on ImageNet. The text says 'modest tuning of basis selection fixes this in practice' but no supporting experiment is provided. This is not the 'negligible drop' promised in Section 5.1, and it weakens the claim that a fixed conservative setting preserves authorized performance across all evaluated backbones. Please report the tuned result or soften the claim.","section":"Table 1, SwinV2-T row (ImageNet)"}],"minor_comments":[{"comment":"The vector z is described as 'standard normal' but then z_q ∼ N(0,σ). Please say 'zero-mean Gaussian with variance σ²' to avoid ambiguity.","section":"Theorem 1 statement"},{"comment":"Definition 1 uses a cumulative condition Σ s_i ≤ τ, while Section 3.2 and Theorem 1 apply the threshold per singular value (s_q ≤ τ). These are different conditions; please align the definition with the implementation (τ = 1e-4).","section":"Definition 1 and §3.2"},{"comment":"The equality after the first triangle inequality should be an inequality; the proof later switches notation between σ2,i and σ2,j. Also, the use of ||v1,i - v2,i|| requires a sign convention and a nonzero gap ε; these should be stated.","section":"Theorem 2 proof"},{"comment":"Section 5.3 refers to 'Appendix 7' but the relevant material is in Appendix D. The reference 'Four Flynn, Helen King, Anca Dragan' is malformed and should be corrected. Table 3 footnotes are hard to follow and should be clarified.","section":"§5.3 and references"}],"recommendation":"major_revision","confidential_remarks":"The empirical core is interesting and the evaluation is broad, but the theoretical contribution as written overclaims certification. The manuscript can be made publishable by rewriting the formal sections as bounds on first-layer feature deviation, clearly labeling the subspace-misalignment premise as empirical, and reconciling the abstract/conclusion with Appendix E's limitations. I would not recommend acceptance in the current form, especially for a venue that places weight on the stated formal guarantees."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"This paper has a genuinely new construction and the empirical phenomenon is real: recoding an image in the near-nullspace of the authorized model's first layer preserves that model's accuracy while collapsing others — across five backbones, two datasets, and two VLM families. The method is training-free, input-side, and needs no access to the unauthorized models. That is a nice contribution to the MLaaS/data-licensing conversation.\n\nThe formal apparatus does not deliver what it advertises. Theorem 1 bounds the change in first-layer features; the jump to 'authorized accuracy is preserved' is asserted, not proved. Theorem 2 is worse: it is an upper bound on a projection difference, and an upper bound cannot give the lower bound that Formula (2) requires. The paper says Theorem 2 'directly yields Formula (2)' — that is a non sequitur. The load-bearing assumption, that τ-insensitive subspaces rarely align across models, is asserted in the intro and supported only by the empirical tables. Nobody has shown that the mechanism transfers to models that share a large chunk of the authorized model's low-sensitivity subspace. That is a real gap in the claim of 'formal certification,' but it is not a gap in the empirical demonstration for the evaluated models.\n\nThe careful reader will also notice the hyperparameters τ and λ are tuned on probe data, there are no error bars or confidence intervals, and no code is released. These are fixable. I did like the limitation appendix: they are upfront that a parameter-aware adversary with projection or training-time counter-adaptation can partially undo the recoding. That honesty is worth crediting.\n\nWho is this for? Anyone who builds data-protection tools for model-specific authorization. The method deserves peer review — the idea is new, the experiments are substantial, and the failure mode (the theory being overclaimed) is exactly what referees are for. I would send it out, but I would tell the authors to rewrite Sections 4.1 and 4.2 so that the theorems state exactly what is proved, and to either prove a lower bound on unauthorized error under some formal model of subspace misalignment, or explicitly label the claim as an empirical property.","headline":"New empirical mechanism, overclaimed theory — the subspace-misalignment premise is asserted, not certified, but the method is fresh enough to be worth refereeing.","tokens_in":22216,"tokens_out":2697,"would_cite":false,"duration_ms":24931,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a low-cost, training-free recoding of inputs—adding random noise confined to a target model's insensitive directions—can make data readable only by that model, while every other model's predictions collapse to near ch","keywords":["non-transferable examples","model-specific authorization","τ-insensitive subspace","spectral recoding","purpose limitation","input-side usage control","Hoffman-Wielandt","model-specific data usability"],"falsifier":"Train two models of the same architecture on the same dataset with different random seeds, compute their first-layer right singular vectors, and measure the projection of one model's τ-insensitive basis onto the other model's top (sensitive) singular vectors. If that overlap is substantial, generate NEs for the first model and evaluate on the second; an unauthorized accuracy well above chance (e.g., >50% top-1 on ImageNet) would demonstrate that non-transferability fails when the premise is violated.","tokens_in":21277,"feed_emoji":"🔒","tokens_out":5387,"duration_ms":46878,"temperature":0.7,"pith_summary":"The paper tries to establish that shared data can be made usable by exactly one authorized model and useless to every other model, by adding a perturbation that lives in the target model's low-sensitivity subspace. It introduces non-transferable examples (NEs): a training-free, data-agnostic recoding that preserves the authorized model's accuracy almost exactly while unauthorized models fall to chance-level performance. The mechanism exploits the observation that neural networks have many input directions that barely affect their first-layer features, and these direction sets differ from model to model. If correct, this gives a practical way to enforce purpose limitation at inference time—an uploaded image could serve its intended model but fail on any scraped or unauthorized model. The paper grounds the claim in spectral bounds on first-layer feature change and cross-model deviation.","feed_headline":"Recoded data stays usable for one model, breaks all others","feed_subtitle":"Noise placed in a model's blind spots keeps authorized accuracy near 80 percent and every other model near zero.","key_machinery":"The τ-insensitive subspace: for the first linear transformation W (convolution unfolded, token embedding, or QKV projection), the span of right singular vectors whose singular values sum to at most τ, which contains the nullspace. The recoding δ=Vz with i.i.d. Gaussian z and coordinates zeroed on sensitive directions keeps Wδ small—Theorem 1 bounds ‖Wx̃−Wx‖ by a spectral threshold times ‖z‖—while the Hoffman–Wielandt inequality is invoked to bound the gap between first-layer outputs of two models in Theorem 2. The assumed non-overlap of these subspaces across models is what converts a small feature change for the target into a large one for non-targets.","core_discovery":"The central claim is that recoding an input x as x+δ, where δ is a random vector projected onto the τ-insensitive subspace of the authorized model's first-layer weight matrix (the span of right singular vectors whose singular values sum to at most τ), preserves the authorized model's predictions while degrading unauthorized models. Because Wδ is small, the authorized model's first-layer features barely change; because different models have different singular subspaces, the same δ lands on active directions for unauthorized models and disrupts their features. The paper reports that on ImageNet at 20 dB PSNR, the authorized ResNet-50 keeps 80.2% top-1 accuracy (clean 80.3%) and ViT-B keeps 81.","pith_inferences":["The real crux is empirical: if two models share near-null directions (e.g., same architecture trained on similar data), the recoding would transfer and the unauthorized model would keep working; Theorem 2 does not prove otherwise, since its bound is an upper bound on a first-layer projection difference, not a lower bound on task error.","A parameter-aware adversary could try to estimate the basis and project the recoding out; the paper acknowledges this in its limitations section and argues that preprocessing non-commutativity limits full recovery—testing that countermeasure end-to-end is the natural next experiment.","The same construction should apply to any model with a linear first stage beyond vision; the appendix's GLUE results for BERT and RoBERTa suggest text inputs can be recoded, though the spectral geometry of token embeddings may differ from images.","If the subspace-misalignment premise holds generally, NEs could serve as a lightweight alternative to encryption for regulatory 'purpose limitation' requirements, but the security case ultimately hinges on how hard it is to estimate another model's insensitive directions from public queries."],"forward_implications":["Data released for one model (e.g., an MLaaS upload) can be bound to that model without retraining, with authorized accuracy preserved within a fraction of a percent and unauthorized models operating at chance level.","The recoding transfers across model families—convolutional, transformer, state-space, and vision-language—and fails even when the unauthorized model shares the target's architecture but has different weights.","Because the perturbation sits in low-sensitivity directions, it survives common preprocessing such as resize, crop, compression, and blur, and resists super-resolution reconstruction attempts in both black-box and white-box settings.","Compared with homomorphic encryption, which took over 30 minutes per image in the paper's setup, NEs add negligible inference overhead, suggesting a practical route to inference-time purpose limitation.","The paper derives formal bounds for authorized utility retention and for cross-model deviation on first-layer features, laying groundwork for a theory of model-specific data authorization."],"fun_headline_variants":["Recoded data works for one model, breaks the rest","Model-specific cipher: data readable only by its key","Blind-spot recoding locks data to one AI model","Data recoded so only authorized model can use it","Non-transferable examples: one key, one model, no leaks"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"That different models' low-sensitivity directions almost never overlap, so a perturbation that is invisible to the authorized model always disrupts every unauthorized model; if two models share those directions, the recoding transfers and unauthorized utility survives.","fun_headline_variants_meta":{"raw":{"variants":["Recoded data works for one model, breaks the rest","Model-specific cipher: data readable only by its key","Blind-spot recoding locks data to one AI model","Data recoded so only authorized model can use it","Non-transferable examples: one key, one model, no leaks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000233,"raw_usage":{"total_tokens":1362,"prompt_tokens":807,"completion_tokens":555,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":551,"completion_tokens_details":{"reasoning_tokens":473}},"tokens_in":551,"tokens_out":555,"duration_ms":6155,"temperature":1.0,"reasoning_tokens":473,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T10:19:01.086493+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train two models of the same architecture on the same dataset with different random seeds, compute their first-layer right singular vectors, and measure the projection of one model's τ-insensitive basis onto the other model's top (sensitive) singular vectors. If that overlap is substantial, generate NEs for the first model and evaluate on the second; an unauthorized accuracy well above chance (e.g., >50% top-1 on ImageNet) would demonstrate that non-transferability fails when the premise is violated.","supporting_citations":[],"review_version":1}