Pith. sign in

REVIEW 4 major objections 5 minor 93 references

Probe-Me-Not: Protecting Pre-trained Encoders from Malicious Probing

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Forbidden-task probing accuracy falls to near-random levels.

desk verdict A useful new problem framing for encoder probing protection, with a solid supervised/unsupervised core, but the zero-shot variant and the universal 'effectively limit' claim outrun the evidence. read the letter →

arxiv 2411.12508 v1 pith:OZTQNU2W submitted 2024-11-19 cs.CR

Ruyi Ding , Tong Zhou , Lili Su , Aidong Adam Ding , Xiaolin Xu , Yunsi Fei This is my paper · ORCID
classification cs.CR
keywords maliciousprobingapplicabilityauthorizationnon-transferablelearningpre-trainedencoderdomain-awareweightselectionself-challengingtrainingcontrastivelosszero-shotprotection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Pre-trained encoders are routinely published or exposed through APIs that return feature vectors, and anyone can attach a small classifier head to reuse the encoder for a custom task. That openness also enables abuse: an encoder trained for general vision can be probed to build a classifier for a task the provider wants to forbid, such as discriminatory speculation or warfare applications. EncoderLock is a proposed remedy that modifies the encoder before deployment so that probing it for a pre-specified prohibited domain yields features too uninformative to classify, while probing for authorized domains keeps working. The paper backs this claim with three variants that differ in what the provider knows about the prohibited domain—labeled data, unlabeled data, or only a text description of its theme—and with experiments on a large, self-supervised Vision Transformer encoder in addition to smaller convolutional networks. If the claim holds, the practical payoff is that a single frozen encoder can carry an applicability license that later downstream training cannot silently cancel.

What carries the argument

The load-bearing object is the domain-aware weight selection score, which ranks each weight $i$ in layer $l$ by the magnitude ratio of the target-domain gradient to the source-domain gradient, $|\nabla L_T^{l,i} / \nabla L_S^{l,i}|$, and selects the top $N$ weights per round; a weight whose influence is large for the prohibited domain but small for the authorized one can be adjusted without erasing the encoder's main competence. The selected weights are updated by minimizing the log-ratio regularizer $R_T = \log(1 + \alpha\, L_S / L_T)$ under the constraint $\lVert \phi^* - \phi \rVert_0 \le M$, which penalizes the ratio between source loss and target loss so the target loss rises without dragging the source down. Around this core sit the three data-dependence branches: a self-challenging minimax loop that retrains the target head from scratch each round (supervised), a contrastive loss that blurs class structure in the target domain's feature space (unsupervised), and an AI-agent plus text-to-image pipeline with prompt refinement that fabricates a synthetic target dataset from a theme (zero-shot).

What would settle it

Probe an EncoderLock-protected encoder with a downstream classifier trained on prohibited-domain data that the defender's proxy never covered—for example military-vehicle photos in new environments, viewpoints, or resolutions absent from the synthetic set used for the zero-shot variant, or a differently composed domain with the same theme. If the classifier's accuracy rebounds toward the unprotected level observed in the paper (around 60% on the military-vehicle domain) instead of staying in the reported 18–29% range, the central transferability assumption of the weight-selection score is wrong.

Watch

Extended reading notes

Core claim

At the weight level, the paper argues, applicability authorization is enforceable: after EncoderLock, a downstream classifier trained on the encoder's embeddings for a prohibited domain reaches accuracy near random guess in several settings (for example 8.47% on a ten-class digit target and 1.19% on a 100-class target), while accuracy on the authorized source domain stays above 92%. In the real-encoder study on a public self-supervised Vision Transformer, military-vehicle classification accuracy drops from an unprotected 60.55% (measured on the paired ResNet-18 setup) to 21.56%, 18.15%, and 29.26% under the supervised, unsupervised, and zero-shot variants. The enabling observation is that domain-relevant knowledge is local: each domain engages a distinct small set of critical weights, ranked by the ratio of target-domain to source-domain gradient magnitudes $|\nabla L_T^{l,i} / \nabla L_S^{l,i}|$, and updating only those weights within a small $\ell_0$ budget confines the lock's damage to the prohibited domain. Over that selection sits a minimax 'self-challenging' loop that re-initializes and retrains the attacker's downstream head each round, forcing the encoder to keep losing target-domain utility no matter which classifier the attacker tries; the label-free and data-free variants drive the same selection with a contrastive loss or with synthetic images generated from a text theme through an AI-agent prompt-refinement pipeline. The paper's experiments show the lock surviving progressive probing epochs, deeper and wider heads, and access to the full prohibited dataset, and outperforming earlier non-transferable learning baselines that regain target accuracy after a few fine-tuning steps.

Load-bearing premise

The load-bearing assumption is that the defender's stand-in for the prohibited domain—labeled samples, unlabeled samples, or synthetic images generated from a text theme—matches the data an attacker will actually probe, because the critical-weight ranking is computed on that stand-in; if the distributions diverge, the altered weights may not suppress the attacker's accuracy.

Editorial extensions

If this is right

  • A provider can ship one frozen encoder whose embeddings are unhelpful for a stated forbidden task: supervised and unsupervised EncoderLock leave target accuracy at roughly 8–20% on the digit-domain pairs while source accuracy stays above 92%.
  • The defense works on a large, self-supervised Vision Transformer, not only on small supervised convolutional encoders, and it changes only a tiny fraction of the weights (reported average below 0.08%), leaving performance on unrelated admissible domains mostly intact.
  • Attacker adaptation within the probing threat model does not restore target accuracy: classifiers from one to four layers with widths up to 4096 achieve at most 17.89% on the target, and probing with up to the entire prohibited dataset leaves target accuracy low.
  • Protection is available across the whole spectrum of prior knowledge: with labeled prohibited data, unlabeled prohibited data, or none at all—the zero-shot variant, using only a text theme refined through an AI agent and a text-to-image model, reduces military-vehicle target accuracy from 60.55% to 23.69% in the ResNet-18 case study.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves untested whether the lock survives a proxy gap, where the attacker's prohibited-domain data differs from the defender's stand-in (labeled samples, unlabeled samples, or synthetic images); a natural next experiment is to lock with one military-vehicle proxy and probe with a deliberately disjoint military dataset, and to compare locking a union of critical weights from several proxi
  • The target-to-source gradient ratio is a general-purpose instrument the paper does not pursue: the same score could be used to prune away domain-specific capacity, to place watermarks in domain-sensitive weights, or to audit which domains a released model was tuned on.
  • Because the threat model only covers attackers who freeze the encoder and train a head, the 'locked' guarantee has an untested boundary: an attacker who partially fine-tunes the encoder itself, or uses adapters that modify features rather than classify them, might bypass the lock—checking that boundary is the immediate sequel the paper implicitly invites.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper proposes EncoderLock, a method for restricting malicious linear probing of a pre-trained encoder on a specified prohibited domain. EncoderLock iteratively selects a small set of encoder weights whose target-gradient to source-gradient ratio is large (Function 1) and updates those weights with a regularized loss (Eq. 4-5) under a self-challenging scheme (Algorithm 1). Three variants address labeled, unlabeled, and no-access prohibited-domain data: supervised, unsupervised contrastive, and zero-shot with synthetic Stable-Diffusion data. Experiments on digit-transfer pairs (Tables II-III), cross-task transfers (Fig. 6), a military-vehicle case study with ResNet-18 (Fig. 8), a real Facebook ViT encoder (Fig. 13), and comparisons with NTL and CUTI (Figs. 9-11) are reported.

Significance. If the central claims held at face value, this would be a practically useful applicability-authorization tool: it operates on the encoder rather than the full model, targets the probing setting, includes a genuinely label-free variant, and is evaluated on a real ViT with a concrete military-use case. The paper ships a large set of experiments, compares against two prior transforms, reports weight-change budgets, and includes failure-oriented ablations. However, the significance is limited by the universal wording of the main claim and by the untested proxy-to-probe distribution transfer, which the zero-shot results already show to be the weakest link. With claim refinement and additional transfer experiments, the contribution would be solid.

major comments (4)
  1. [Section V-G / Table III] The abstract and Section V-G state that all three variants of EncoderLock effectively limit the encoder's performance on prohibited domains, and the abstract promises 'poor performance on specified prohibited domains.' Table III (VGG-11, unsupervised EncoderLock) reports post-protection target accuracies of 76.68% for SD-to-MT, 86.75% for SD-to-UP, and 75.31% for SD-to-SN. These values correspond to relative target drops of only about 21%, 7%, and 17%, respectively, and are far above the 'poor performance' level claimed. The central claim is therefore stated more broadly than the evidence supports; it should be restricted to the tested regimes, and the failure cases should be analyzed explicitly.
  2. [Sections IV-B / IV-E / V-D] The domain-aware selection in Function 1 computes the importance ranking on batches B_T from the defender's target set D_T, and the zero-shot variant constructs D_T from 10 Stable-Diffusion prompts. The paper never tests the transfer assumption that this proxy is representative of the distribution an attacker actually probes: no experiment partitions a prohibited domain into defender-visible and attacker-held portions, and the real-Military zero-shot numbers in Fig. 8 and Section V-G are the weakest of the three variants (23.69% versus 11.48% on ResNet-18, and 29.26% versus 21.56% and 18.15% on ViT). This is a load-bearing gap because if an attacker probes a subpopulation whose critical weights are not ranked highly under the proxy, the locked encoder can leave the prohibited-domain accuracy high. I ask for an explicit distribution-shift evaluation (for example, train on a subset of military classes or on synthetic data, then evaluate on held-out classes or a second prohibited dataset) and a corresponding revision of the universal claim.
  3. [Algorithm 1 / Table V] Algorithm 1 takes a 'Desired target accuracy αgoal' as an input and uses it for early stopping, but αgoal is never specified in the main text, Appendix A, or Table V. Section VI-B describes a generic accuracy threshold accth but does not report the values used in the experiments. Since the reported 'after' accuracies depend on when training stops, this missing hyperparameter prevents reproduction and leaves open the possibility that the target accuracies were determined by threshold choice. Please report αgoal or the actual stopping rounds for every configuration.
  4. [Function 1 / Eq. (6)] The weight-importance score in Function 1 is defined as |∇L_T^{l,i} / ∇L_S^{l,i}|. For weights where the source batch gradient is zero or very small, the score is undefined or dominated by the denominator rather than by target importance. The paper does not specify a stabilizer, a floor on |∇L_S|, or a masking rule for such weights. Because this ranking determines which M weights are updated, a precise definition is required for the algorithm to be reproducible and for the reported selection behavior to be interpretable.
minor comments (5)
  1. [Abstract / Table I] The abstract says the experiments span 'fifteen domains,' but Table I lists twelve datasets and Section I also says twelve domains; the number should be reconciled.
  2. [Section V-D] The text says 'We evaluate one-shot EncoderLock's performance' in the zero-shot evaluation section; this should read 'zero-shot EncoderLock.'
  3. [Section IV-C / Eq. (6)] The method is described as a minimax optimization, but Algorithm 1 performs alternating updates: the encoder weights are updated first, then the auxiliary head is retrained from scratch. The paper should clarify that this is an alternating scheme rather than a joint solution to Eq. (6).
  4. [Eq. (5)-(6)] The constraint ∥ϕ*−ϕ∥_0 ≤ M is stated but no mechanism for enforcing it is described; please clarify whether the update is restricted by masking only the selected weights or by some projected update.
  5. [Eq. (8)] The PPI formula divides by accT_m, so the index diverges when the protected target accuracy is zero; please state how zero or near-zero denominators are handled in the reported plots.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: EncoderLock's reported target-domain suppression is a measured post-training outcome on held-out and external datasets, not a replay of its training objective.

full rationale

EncoderLock's claimed protection is an empirically trained defense, not a derivation of its conclusion from its inputs. The supervised variant optimizes Eqs. (4)-(6) against source and target batches and is then probed by a freshly fine-tuned downstream head on held-out target test data, with Algorithm 1's early-stopping on target validation accuracy serving as standard model selection rather than as a fitted value renamed as a prediction. The unsupervised variant is evaluated under the same held-out protocol in Tables III and IX, and the zero-shot variant is the decisive non-circular case: the encoder is trained only on synthetic images generated from text prompts (Section IV-E) and then evaluated on the real Military Vehicles dataset (Fig. 8 and Section V-G), an external target never used in training. Baseline comparisons use external methods NTL [79] and CUTI [78]. The only self-citations ([20] and [91]) appear in the related-work enumeration of applicability authorization and are not load-bearing for any equation or result. The practical caveat that zero-shot protection could weaken if the synthetic proxy distribution does not match the attacker's actual probe distribution is a robustness limitation, not a circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the empirical validity of the gradient-importance selection and on the representativeness of the defender's prohibited-domain proxy. No formal guarantee is given, and the security threshold analysis in Appendix I covers only a few digit pairs.

free parameters (4)
  • N (critical weights selected per round) = 100 (supervised), 200 (unsupervised)
    Hyperparameter set by ablation in Section VI-A; controls weight budget M=N×R and is not derived from first principles.
  • R (number of rounds) = 100
    Maximum number of rounds; interacts with N to form the weight-change budget M=N×R.
  • alpha (regularization weight) = 1000 (supervised), 10 (unsupervised)
    Chosen by ablation in Section VI-A3; balances source accuracy retention against target-domain suppression.
  • learning rate for encoder update = 0.01
    Fixed configuration in Table V, not derived from the problem.
assumptions (4)
  • domain assumption The gradient-magnitude ratio |∇L_T / ∇L_S| isolates weights that are critical for the prohibited domain but not for the source domain.
    Invoked in Function 1 and Section IV-B; the paper provides a qualitative MNIST/USPS visualization rather than a formal characterization.
  • domain assumption The owner's prohibited-domain data (labeled, unlabeled, or LLM-generated synthetic images) is representative of the attacker's probing distribution.
    Used in all variants; Section IV-E explicitly builds the Level-3 proxy from text prompts, and the paper acknowledges the provider must specify the prohibited theme.
  • domain assumption The self-challenging auxiliary classifiers in Eq. (6) span the space of downstream heads a real attacker will use.
    Section IV-C2; robustness to arbitrary heads is claimed, but only MLP widths and depths are tested in Table IV.
  • ad hoc to paper The log-ratio regularizer RT = log(1 + alpha * LS / LT) is an adequate balance between source retention and target suppression.
    Eq. (4), chosen to avoid instability when LS is near zero; no derivation beyond an ablation over alpha in Section VI-A3.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Probe-Me-Not: Protecting Pre-trained Encoders from Malicious Probing." pith.science (2026). https://pith.science/paper/OZTQNU2W

@misc{pith2026241112508,
  author       = {Pith},
  title        = {Pith review of: Probe-Me-Not: Protecting Pre-trained Encoders from Malicious Probing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OZTQNU2W}},
  note         = {Machine review of arXiv:2411.12508}
}
read the original abstract

Adapting pre-trained deep learning models to customized tasks has become a popular choice for developers to cope with limited computational resources and data volume. More specifically, probing--training a downstream head on a pre-trained encoder--has been widely adopted in transfer learning, which helps to prevent overfitting and catastrophic forgetting. However, such generalizability of pre-trained encoders raises concerns about the potential misuse of probing for harmful intentions, such as discriminatory speculation and warfare applications. In this work, we introduce EncoderLock, a novel applicability authorization method designed to protect pre-trained encoders from malicious probing, i.e., yielding poor performance on specified prohibited domains while maintaining their utility in authorized ones. Achieving this balance is challenging because of the opposite optimization objectives and the variety of downstream heads that adversaries can utilize adaptively. To address these challenges, EncoderLock employs two techniques: domain-aware weight selection and updating to restrict applications on prohibited domains/tasks, and self-challenging training scheme that iteratively strengthens resistance against any potential downstream classifiers that adversaries may apply. Moreover, recognizing the potential lack of data from prohibited domains in practical scenarios, we introduce three EncoderLock variants with different levels of data accessibility: supervised (prohibited domain data with labels), unsupervised (prohibited domain data without labels), and zero-shot (no data or labels available). We verify EncoderLock's effectiveness and practicality with a real-world pre-trained Vision Transformer (ViT) encoder from Facebook. These results underscore the valuable contributions EncoderLock brings to the development of responsible AI.

Figures

Figures reproduced from arXiv: 2411.12508 by the authors.

Figure 1
Figure 1. Applicability Authorization with EncoderLock: Fixed pre-trained encoders accept user inputs and return representations. Users can utilize them for various customized tasks by probing with downstream heads. EncoderLock aims to prevent malicious probing to pre-defined prohibited domains, which may have different levels of data accessibility, marked by different colors. can further probe encoders with downstream heads … view at source ↗
Figure 2
Figure 2. Overview of the proposed EncoderLock framework and paper organization. The procedure in Round r includes: 1.domain-aware critical weight selection algorithm: take data batches BS and BT from the authorized source dataset DS and the prohibited target dataset DT , respectively, and calculate the weight importance with gradients of loss LS and LT and choose critical weights to update for the round r as Nr, note here sp… view at source ↗
Figure 3
Figure 3. Visualization of weight importance in a pre-trained model—The X-Y plane represents the weight matrix of a selected dense layer in a model trained on MNIST and probed for USPS. The color and height indicate each weight’s importance to the output (the higher and darker, the more important). be designed for practical scenarios including unlabeled datasets or even no samples from prohibited domains? B. Domain-aware Weig… view at source ↗
Figures from the paper (19 more)
Figure 4
Figure 4. Figure 4: Design motivation of unsupervised EncoderLock To improve robustness against any potential malicious prob￾ing for supervised EncoderLock, we propose a self-challenging training scheme with a minimax problem formulation as: ϕ ∗ = arg min ϕ max θT Lel(ϕ, θS , θT ) s.t. ∥ϕ…
Figure 5
Figure 5. Figure 5: Building synthetic datasets for zero-shot EncoderLock a batch of samples from the target domain, we leverage data augmentation, including random crop, color jitter, or Gaussian blur [71], [56], to create a set of positive pairs and a set of negative pairs. Any pair wit…
Figure 6
Figure 6. Figure 6: Accuracy drop across distinct source and target domains—It assesses the transferability of VGG-11 encoder with CF (Left) and MT (Right) as the source. Each data point illustrates the simultaneous impact on accuracies on the source and target domain with supervised Enco…
Figure 7
Figure 7. Figure 7: Unsupervised EncoderLock-Latent Space Change via Rounds affects the supervised EncoderLock’s performance, e.g., the non-transferability of SD→SN is the worst as they are similar. Unlike prior research [79], [78] that only examines the applicability authorization betwee…
Figure 8
Figure 8. Figure 8: Comparison among different EncoderLock–on authorized, prohibited, and admissible domains. We randomly select a percentage of domain-aware weights as the X-axis, indicating the optimization process of domain-aware weights. The authorized and prohibited domains are run 5…
Figure 9
Figure 9. Figure 9: Comparison on Authorized PPI–between EncoderLock with NTL [79] and CUTI [78] on different pairs of authorized domains and prohibited domains. The higher the better. Probing for multiple epochs can’t increase the performance on prohibited domains but keeps its performan…
Figure 10
Figure 10. Figure 10: Comparison on Admissible PPI–between EncoderLock with NTL [79] and CUTI [78] on different pairs of admissible domains and prohibited domains. The higher the better. EncoderLock shows the minimal impact on admissible domains while restricting the encoder’s performance …
Figure 11
Figure 11. Figure 11: Latent Feature Visualization–Feature Space of Different Methods F. Interpretation of EncoderLock To further understand the changes in the encoders generated by different variants of EncoderLock, we use the encoders trained from Section V-D and visualize their decision…
Figure 12
Figure 12. Figure 12: Interpretation of Different EncoderLock using GradCAM [69]–the red parts highlight the focus of encoder to make decisions. of the decision process—the focus is mainly on the vehicle but not on specific features of tank. In Appendix J, we also visualize the GradCAM res…
Figure 13
Figure 13. Figure 13: Evaluation on a Pre-trained ViT: Top row - source (target) accuracy versus number of changed weights for different levels of EncoderLock; Bottom row: performance of supervised EncoderLock on different datasets. source domains and the military dataset and Imagewoof dat…
Figure 14
Figure 14. Figure 14: Ablation studies–a) regularizer weights for supervised EncoderLock α; b) regularizer weights for unsupervised EncoderLock;c) changed weights number per round(N); The probing accuracy on the source and target domains are reported on the left y-axis and the changed weig…
Figure 15
Figure 15. Figure 15: Zero-shot EncoderLock performance with different noise levels [PITH_FULL_IMAGE:figures/full_fig_p016_15.png]
Figure 16
Figure 16. Figure 16: Zero-shot EncoderLock performance with different diffusion qualities [PITH_FULL_IMAGE:figures/full_fig_p016_16.png]
Figure 17
Figure 17. Figure 17: EncoderLock performance for various volumes of probing data. [PITH_FULL_IMAGE:figures/full_fig_p017_17.png]
Figure 19
Figure 19. Figure 19: Interpretation of Different EncoderLock using GradCAM [69]– the red parts highlight the focus of encoder to make decisions. Manual Prompts. See [PITH_FULL_IMAGE:figures/full_fig_p018_19.png]
Figure 18
Figure 18. Figure 18: EncoderLock’s Performance Versus Train-from-scratch [PITH_FULL_IMAGE:figures/full_fig_p018_18.png]
Figure 20
Figure 20. Figure 20: Manual Prompts and Generated Synthetic Dataset Antique Cannon Battlefield Command and Control Center Stealth Bomber Futuristic Tank Cyberpunk Hoverbike Armored Medical Evacuation Vehicle Anti-aircraft Missile System Amphibious Assault Vehicle Drone Carrier Truck Nucle…
Figure 21
Figure 21. Figure 21: AI agent Initial Prompts and Generated Synthetic Dataset Amphibious Assault Transport Reconnaissance Craft Deep Sea Explorer Command Center Armored Ground Vehicle Drone Carrier Field Support Unit Missile Defense Network Stealth Surveillance Plane Artillery System [PI…
Figure 22
Figure 22. Figure 22: AI agent Refined Prompts and Generated Synthetic Dataset [PITH_FULL_IMAGE:figures/full_fig_p018_22.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

93 extracted references · 61 canonical work pages

  1. [1]

    Gpt-4 technical report,

    J. Achiam et al. , “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  2. [2]

    Deep-Lock: Secure Authorization for Deep Neural Networks

    M. Alam et al. , “Deep-lock: Secure authorization for deep neural networks,” arXiv preprint arXiv:2008.05966 , 2020

    work page Pith review arXiv 2008

  3. [3]

    Exploring visual prompts for adapting large-scale models,

    H. Bahng et al. , “Exploring visual prompts for adapting large-scale models,” arXiv preprint arXiv:2203.17274 , 2022. TABLE IV . PERFORMANCE OF THE SUPERVISED ENCODER LOCK ON VARIOUS CLASSIFIER CONFIGURATIONS —SOURCE (MT) TO TARGET (UP). # Layers 1 2 3 4 Hidden dim. / 256 512 1024 2048 4096 256 512 1024 2048 4096 256 512 1024 2048 4096 size (M) 0.25 6.42 ...

    arXiv 2022

  4. [4]

    Probing classifiers: Promises, shortcomings, and advances,

    Y . Belinkov, “Probing classifiers: Promises, shortcomings, and advances,” Computational Linguistics, 2022

    2022

  5. [5]

    Representation learning: A review and new perspec- tives,

    Y . Bengioet al., “Representation learning: A review and new perspec- tives,” IEEE transactions on pattern analysis and machine intelligence , vol. 35, no. 8, pp. 1798–1828, 2013

    2013

  6. [6]

    Military vehicles dataset,

    A. Bose, “Military vehicles dataset,” https://www.kaggle.com/datasets/ amanrajbose/millitary-vechiles, n.d., accessed: 2023-04-23

    2023

  7. [7]

    Putting representations to use,

    R. Cao, “Putting representations to use,” Synthese, p. 151, 2022

    2022

  8. [8]

    Emerging properties in self-supervised vision trans- formers,

    M. Caron et al., “Emerging properties in self-supervised vision trans- formers,” in ICCV, 2021, pp. 9650–9660

    2021

Show all 93 references
  1. [9]

    Hardware-assisted intellectual property protection of deep learning models,

    A. Chakraborty, A. Mondai, and A. Srivastava, “Hardware-assisted intellectual property protection of deep learning models,” in DAC, 2020

    2020

  2. [10]

    Confronting the risks of artificial intelligence,

    B. Cheatham, K. Javanmardian, and H. Samandari, “Confronting the risks of artificial intelligence,” McKinsey Quarterly, pp. 1–9, 2019

    2019

  3. [11]

    A simple framework for contrastive learning of visual representations,

    T. Chen, S. Kornblith, M. Norouzi, and G. Hinton, “A simple framework for contrastive learning of visual representations,” in ICML, 2020

    2020

  4. [12]

    Catastrophic forgetting meets negative transfer: Batch spectral shrinkage for safe transfer learning,

    X. Chen, S. Wang et al., “Catastrophic forgetting meets negative transfer: Batch spectral shrinkage for safe transfer learning,” NeurIPS, 2019

    2019

  5. [13]

    An embarrassingly simple approach for transfer learning from pretrained language models,

    A. Chronopoulou, C. Baziotis, and A. Potamianos, “An embarrassingly simple approach for transfer learning from pretrained language models,” arXiv preprint arXiv:1902.10547 , 2019

    1902 arXiv

  6. [14]

    general-image-embedding3,

    Clarifai, “general-image-embedding3,” 2020. [Online]. Available: https://clarifai.com/clarifai/main/models/general-image-embedding

    2020

  7. [15]

    An analysis of single-layer networks in unsupervised feature learning,

    A. Coates, A. Ng, and H. Lee, “An analysis of single-layer networks in unsupervised feature learning,” in AISTATS, 2011, pp. 215–223

    2011

  8. [16]

    Emnist: Extending mnist to handwritten letters,

    G. Cohen, S. Afshar et al., “Emnist: Extending mnist to handwritten letters,” in IJCNN. IEEE, 2017, pp. 2921–2926

    2017

  9. [17]

    On the relationship between self-attention and convolutional layers,

    J.-B. Cordonnier, A. Loukas, and M. Jaggi, “On the relationship between self-attention and convolutional layers,” arXiv:1911.03584, 2019

    1911 arXiv

  10. [18]

    Supervised learning,

    P. Cunningham, M. Cord, and S. J. Delany, “Supervised learning,” in Machine learning techniques for multimedia . Springer, 2008, pp. 21–49

    2008

  11. [19]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong et al., “Imagenet: A large-scale hierarchical image database,” in CVPR. IEEE, 2009, pp. 248–255

    2009

  12. [20]

    Non-transferable pruning,

    R. Ding, L. Su, A. A. Ding, and Y . Fei, “Non-transferable pruning,” in European Conference on Computer Vision . Springer, 2025, pp. 375–393

    2025

  13. [21]

    Puma: Secure inference of llama-7b in five minutes,

    Y . Dong, W.-j. Lu et al., “Puma: Secure inference of llama-7b in five minutes,” arXiv preprint arXiv:2307.12533 , 2023

    2023

  14. [22]

    The lottery ticket hypothesis: Finding sparse, trainable neural networks,

    J. Frankle and M. Carbin, “The lottery ticket hypothesis: Finding sparse, trainable neural networks,” arXiv preprint arXiv:1803.03635 , 2018

    2018 arXiv

  15. [23]

    Decorate the newcomers: Visual domain prompt for continual test time adaptation,

    Y . Gan, Y . Baiet al., “Decorate the newcomers: Visual domain prompt for continual test time adaptation,” in AAAI, 2023

    2023

  16. [24]

    Unsupervised domain adaptation by backpropagation,

    Y . Ganin and V . Lempitsky, “Unsupervised domain adaptation by backpropagation,” in ICML. PMLR, 2015, pp. 1180–1189

    2015

  17. [25]

    Domain-adversarial training of neural networks,

    Y . Ganin, E. Ustinova et al. , “Domain-adversarial training of neural networks,” The journal of machine learning research , 2016

    2016

  18. [26]

    Tuning pre-trained model via moment probing,

    M. Gao, Q. Wang et al., “Tuning pre-trained model via moment probing,” in ICCV, 2023, pp. 11 803–11 813

    2023

  19. [27]

    Generative adversarial networks,

    I. Goodfellow, J. Pouget-Abadie et al., “Generative adversarial networks,” Communications of the ACM , vol. 63, no. 11, pp. 139–144, 2020

    2020

  20. [28]

    Self-supervised relationship probing,

    J. Gu, J. Kuen et al., “Self-supervised relationship probing,” NeurIPS, vol. 33, pp. 1841–1853, 2020

    2020

  21. [29]

    Sigma: secure gpt inference with function secret sharing,

    K. Gupta, N. Jawalkar et al., “Sigma: secure gpt inference with function secret sharing,” Cryptology ePrint Archive , 2023

    2023

  22. [30]

    A survey on vision transformer,

    K. Han, Y . Wang et al. , “A survey on vision transformer,” IEEE transactions on pattern analysis and machine intelligence , vol. 45, no. 1, pp. 87–110, 2022

    2022

  23. [31]

    Pre-trained models: Past, present and future,

    X. Han, Z. Zhang et al., “Pre-trained models: Past, present and future,” AI Open, vol. 2, pp. 225–250, 2021

    2021

  24. [32]

    Masked autoencoders are scalable vision learners,

    K. He, X. Chen et al., “Masked autoencoders are scalable vision learners,” in PCVPR, 2022, pp. 16 000–16 009

    2022

  25. [33]

    Momentum contrast for unsupervised visual representation learning,

    K. He, H. Fan et al. , “Momentum contrast for unsupervised visual representation learning,” in CVPR, 2020, pp. 9729–9738

    2020

  26. [34]

    Deep residual learning for image recognition,

    K. He, X. Zhang et al., “Deep residual learning for image recognition,” in CVPR, 2016, pp. 770–778

    2016

  27. [35]

    Using self-supervised learning can improve model robustness and uncertainty,

    D. Hendrycks et al., “Using self-supervised learning can improve model robustness and uncertainty,” NeurIPS, vol. 32, 2019

    2019

  28. [36]

    imagenette

    J. Howard, “imagenette.” [Online]. Available: https://github.com/fastai/ imagenette/

  29. [37]

    Fastai: A layered api for deep learning,

    J. Howard and S. Gugger, “Fastai: A layered api for deep learning,” Information, vol. 11, no. 2, p. 108, 2020

    2020

  30. [38]

    A database for handwritten text recognition research,

    J. J. Hull, “A database for handwritten text recognition research,” IEEE Transactions on pattern analysis and machine intelligence , vol. 16, no. 5, pp. 550–554, 1994

    1994

  31. [39]

    A review of deep transfer learning and recent advancements,

    M. Iman, H. R. Arabnia, and K. Rasheed, “A review of deep transfer learning and recent advancements,” Technologies, 2023

    2023

  32. [40]

    Gender and ai: Addressing bias in artifi- cial intelligence,

    International Women’s Day, “Gender and ai: Addressing bias in artifi- cial intelligence,” https://www.internationalwomensday.com/Missions/ 14458/Gender-and-AI-Addressing-bias-in-artificial-intelligence, 2024, accessed: 2024-06-22

    2024

  33. [41]

    A survey on contrastive self-supervised learning,

    A. Jaiswal, A. R. Babu, M. Z. Zadeh, D. Banerjee, and F. Makedon, “A survey on contrastive self-supervised learning,” Technologies, vol. 9, no. 1, p. 2, 2020

    2020

  34. [42]

    Entangled watermarks as a defense against model extraction,

    H. Jia, C. A. Choquette-Choo, V . Chandrasekaran, and N. Papernot, “Entangled watermarks as a defense against model extraction,” inUSENIX Security 21, 2021, pp. 1937–1954

    2021

  35. [43]

    Visual prompt tuning,

    M. Jia, L. Tang et al. , “Visual prompt tuning,” in ECCV. Springer, 2022, pp. 709–727

    2022

  36. [44]

    Adam: A method for stochastic optimization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” ICLR, 2015

    2015

  37. [45]

    Auto-encoding variational bayes,

    D. P. Kingma and M. Welling, “Auto-encoding variational bayes,” arXiv preprint arXiv:1312.6114, 2013

    2013 arXiv

  38. [46]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” 2009

    2009

  39. [47]

    Contrastive representation learning: A framework and review,

    P. H. Le-Khac, G. Healy, and A. F. Smeaton, “Contrastive representation learning: A framework and review,” Ieee Access, vol. 8, pp. 193 907– 193 934, 2020

    2020

  40. [48]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottouet al., “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, 1998

    1998

  41. [49]

    Modeldiff: Testing-based dnn similarity comparison for model reuse detection,

    Y . Li, Z. Zhang et al. , “Modeldiff: Testing-based dnn similarity comparison for model reuse detection,” in ISSTA, 2021, pp. 139–151

    2021

  42. [50]

    Transtailor: Pruning the pre-trained model for improved transfer learning,

    B. Liu et al., “Transtailor: Pruning the pre-trained model for improved transfer learning,” in AAAI, vol. 35, no. 10, 2021

    2021

  43. [51]

    Secdeep: Secure and performant on-device deep learning inference framework for mobile and iot devices,

    R. Liu et al., “Secdeep: Secure and performant on-device deep learning inference framework for mobile and iot devices,” in IoTDI, 2021

    2021

  44. [52]

    Fault injection attack on deep neural network,

    Y . Liu, L. Wei, B. Luo, and Q. Xu, “Fault injection attack on deep neural network,” in ICCAD. IEEE, 2017, pp. 131–138

    2017

  45. [53]

    Rethinking the value of network pruning,

    Z. Liu, M. Sun et al., “Rethinking the value of network pruning,” arXiv preprint arXiv:1810.05270, 2018

    2018 arXiv

  46. [54]

    Transfer learning from pre-trained models,

    P. Marcelino, “Transfer learning from pre-trained models,” Towards data science, vol. 10, no. 330, p. 23, 2018

    2018

  47. [55]

    Is artificial intelligence dangerous? 6 ai risks everyone should know about,

    B. Marr, “Is artificial intelligence dangerous? 6 ai risks everyone should know about,” Forbes. Retrieved May, vol. 13, p. 2022, 2018

    2022

  48. [56]

    Data augmentation for improving deep learning in image classification problem,

    A. Mikołajczyk et al., “Data augmentation for improving deep learning in image classification problem,” in IIPhDW. IEEE, 2018, pp. 117–122

    2018

  49. [57]

    Reading digits in natural images with unsupervised feature learning,

    Y . Netzer, T. Wang et al. , “Reading digits in natural images with unsupervised feature learning,” in NIPS workshop on deep learning and unsupervised feature learning , vol. 2011, no. 2. Granada, 2011

    2011

  50. [58]

    Openai’s embeddings api,

    OpenAI, “Openai’s embeddings api,” 2020, accessed: 4 October 2024. [Online]. Available: https://platform.openai.com/docs/guides/embeddings

    2020

  51. [59]

    The unsurprising effectiveness of pre-trained vision models for control,

    S. Parisi et al. , “The unsurprising effectiveness of pre-trained vision models for control,” in ICML. PMLR, 2022, pp. 17 359–17 371

    2022

  52. [60]

    Llm self defense: By self examination, llms know they are being tricked,

    M. Phute, A. Helbling et al., “Llm self defense: By self examination, llms know they are being tricked,” in ICLR, 2023

    2023

  53. [61]

    Early stopping-but when?

    L. Prechelt, “Early stopping-but when?” in Neural Networks: Tricks of the trade. Springer, 2002, pp. 55–69

    2002

  54. [62]

    Pre-trained models for natural language processing: A survey,

    X. Qiu, T. Sun et al., “Pre-trained models for natural language processing: A survey,” Science China technological sciences , 2020

    2020

  55. [63]

    Reaas: Enabling adversarially robust downstream classifiers via robust encoder as a service,

    W. Qu, J. Jia, and N. Z. Gong, “Reaas: Enabling adversarially robust downstream classifiers via robust encoder as a service,” in NDSS, 2023

    2023

  56. [64]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim et al., “Learning transferable visual models from natural language supervision,” in ICML. PMLR, 2021, pp. 8748–8763

    2021

  57. [65]

    Bit-flip attack: Crushing neural network with progressive bit search,

    A. S. Rakin, Z. He, and D. Fan, “Bit-flip attack: Crushing neural network with progressive bit search,” in ICCV, 2019, pp. 1211–1220

    2019

  58. [66]

    Probing the probing paradigm: Does probing accuracy entail task relevance?

    A. Ravichander, Y . Belinkov, and E. Hovy, “Probing the probing paradigm: Does probing accuracy entail task relevance?” arXiv preprint arXiv:2005.00719, 2020

    2005 arXiv

  59. [67]

    Gaussian mixture models

    D. A. Reynolds et al. , “Gaussian mixture models.” Encyclopedia of biometrics, vol. 741, no. 659-663, 2009

    2009

  60. [68]

    High-resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann et al., “High-resolution image synthesis with latent diffusion models,” 2021

    2021

  61. [69]

    Grad-cam: Visual explanations from deep networks via gradient-based localization,

    R. R. Selvaraju, M. Cogswell et al., “Grad-cam: Visual explanations from deep networks via gradient-based localization,” in ICCV, 2017

    2017

  62. [70]

    Financial feature embedding with knowledge representation learning for financial statement fraud detection,

    Y . Shen, C. Guo et al., “Financial feature embedding with knowledge representation learning for financial statement fraud detection,” Procedia Computer Science, vol. 187, pp. 420–425, 2021

    2021

  63. [71]

    A survey on image data augmen- tation for deep learning,

    C. Shorten and T. M. Khoshgoftaar, “A survey on image data augmen- tation for deep learning,” Journal of big data , 2019

    2019

  64. [72]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” in ICLR, 2019

    2019

  65. [73]

    Convolutional neural networks for medical image analysis: Full training or fine tuning?

    N. Tajbakhsh, J. Y . Shin et al. , “Convolutional neural networks for medical image analysis: Full training or fine tuning?” IEEE transactions on medical imaging , vol. 35, no. 5, pp. 1299–1312, 2016

    2016

  66. [74]

    Federated learning from pre-trained models: A contrastive learning approach,

    Y . Tan, G. Long et al., “Federated learning from pre-trained models: A contrastive learning approach,” NeurIPS, vol. 35, 2022

    2022

  67. [75]

    Ai bill of rights: Algorithmic discrimination protections,

    The White House Office of Science and Technology Policy, “Ai bill of rights: Algorithmic discrimination protections,” https://www.whitehouse. gov/ostp/ai-bill-of-rights/algorithmic-discrimination-protections-2/, 2024, accessed: 2024-06-22

    2024

  68. [76]

    Visualizing data using t-sne

    L. Van der Maaten and G. Hinton, “Visualizing data using t-sne.” Journal of machine learning research , vol. 9, no. 11, 2008

    2008

  69. [77]

    Pre-trained language models and their applications,

    H. Wang, J. Liet al., “Pre-trained language models and their applications,” Engineering, 2022

    2022

  70. [78]

    Model barrier: A compact un- transferable isolation domain for model intellectual property protection,

    L. Wang, M. Wang, D. Zhang, and H. Fu, “Model barrier: A compact un- transferable isolation domain for model intellectual property protection,” in CVPR, 2023, pp. 20 475–20 484

    2023

  71. [79]

    Non-transferable learning: A new approach for model ownership verification and applicability authorization,

    L. Wang et al., “Non-transferable learning: A new approach for model ownership verification and applicability authorization,” in ICLR, 2022

    2022

  72. [80]

    Toxicity detection with generative prompt- based inference,

    Y .-S. Wang and Y . Chang, “Toxicity detection with generative prompt- based inference,” arXiv preprint arXiv:2205.12390 , 2022

    2022 arXiv

  73. [81]

    A non-linear structural probe,

    J. C. White, T. Pimentel, N. Saphra, and R. Cotterell, “A non-linear structural probe,” arXiv preprint arXiv:2105.10185 , 2021

    2021 arXiv

  74. [82]

    Structured model probing: Empowering efficient transfer learning by structured regularization,

    Z.-F. Wu, C. Maoet al., “Structured model probing: Empowering efficient transfer learning by structured regularization,” in CVPR, 2024

    2024

  75. [83]

    Fine-grained visual prompting,

    L. Yang, Y . Wang et al. , “Fine-grained visual prompting,” NeurIPS, vol. 36, 2024

    2024

  76. [84]

    Robust watermarking for deep neural networks via bi-level optimization,

    P. Yang, Y . Lao, and P. Li, “Robust watermarking for deep neural networks via bi-level optimization,” in ICCV, 2021, pp. 14 841–14 850

    2021

  77. [85]

    Graph representation learning in bioinformatics: trends, methods and applications,

    H.-C. Yi et al., “Graph representation learning in bioinformatics: trends, methods and applications,” Briefings in Bioinformatics , 2022

    2022

  78. [86]

    Florence: A new foundation model for computer vision,

    L. Yuan, D. Chen et al., “Florence: A new foundation model for computer vision,” arXiv preprint arXiv:2111.11432 , 2021

    2021 arXiv

  79. [87]

    Adadelta: an adaptive learning rate method,

    M. D. Zeiler, “Adadelta: an adaptive learning rate method,”arXiv preprint arXiv:1212.5701, 2012

    2012 arXiv

  80. [88]

    Protecting intellectual property of deep neural networks with watermarking,

    J. Zhang, Z. Gu et al., “Protecting intellectual property of deep neural networks with watermarking,” in ASIACCS, 2018, pp. 159–172

    2018

  81. [89]

    Fault sneaking attack: A stealthy framework for misleading deep neural networks,

    P. Zhao, S. Wang, C. Gongye, Y . Wang, Y . Fei, and X. Lin, “Fault sneaking attack: A stealthy framework for misleading deep neural networks,” in DAC, 2019, pp. 1–6

    2019

  82. [90]

    An overview on data representation learning: From traditional feature learning to recent deep learning,

    G. Zhong, L.-N. Wang, X. Ling, and J. Dong, “An overview on data representation learning: From traditional feature learning to recent deep learning,” The Journal of Finance and Data Science , 2016

    2016

  83. [91]

    Archlock: Locking dnn transferability at the architecture level with a zero-cost binary predictor,

    T. Zhou, S. Ren, and X. Xu, “Archlock: Locking dnn transferability at the architecture level with a zero-cost binary predictor,” in The Twelfth International Conference on Learning Representations , 2024

    2024

  84. [92]

    To prune, or not to prune: exploring the efficacy of pruning for model compression,

    M. Zhu and S. Gupta, “To prune, or not to prune: exploring the efficacy of pruning for model compression,” arXiv preprint arXiv:1710.01878 , 2017. APPENDIX A HYPERPARAMETER CONFIGURATION OF ENCODER LOCK TABLE V . H YPERPARAMETERS USED IN THE EXPERIMENT Hyperparameters N R α LR...

    2017 arXiv

  85. [93]

    train- from-scratch

    Their accuracy drops on the authorized domain are 0.07%, 0.25%, and 0.17%, respectively, all below the accuracy drop constraint ( ϵ = 2%). Fig. 18 shows the probing performance of the EncoderLock-protected and unprotected encoders on the prohibited domain, compared to the accu...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.