Pith. sign in

REVIEW 5 major objections 4 minor 2 cited by

This paper claims that a low-cost, training-free recoding of inputs—adding random noise confined to a target model's insensitive directions—can make data readable only by that model, while every other model's predictions collapse to near ch

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Non-transferable examples add perturbations in an authorized model's low-sensitivity subspace, keeping that model's accuracy nearly intact while collapsing the accuracy of all other tested models.

T0 review reviewed 2026-08-04 challenge →

load-bearing objection New empirical mechanism, overclaimed theory — the subspace-misalignment premise is asserted, not certified, but the method is fresh enough to be worth refereeing. the 5 major comments →

arxiv 2510.10982 v2 pith:SZ7K4EQH submitted 2025-10-13 cs.LG cs.AI

Catch-Only-One: Non-Transferable Examples for Model-Specific Authorization

Zihan Wang , Zhiyong Ma , Zhongkui Ma , Shuofeng Liu , Akide Liu , Derui Wang , Minhui Xue , Guangdong Bai This is my paper
classification cs.LG cs.AI
keywords non-transferable examplesmodel-specific authorizationτ-insensitive subspacespectral recodingpurpose limitationinput-side usage controlHoffman-Wielandtmodel-specific data usability
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that shared data can be made usable by exactly one authorized model and useless to every other model, by adding a perturbation that lives in the target model's low-sensitivity subspace. It introduces non-transferable examples (NEs): a training-free, data-agnostic recoding that preserves the authorized model's accuracy almost exactly while unauthorized models fall to chance-level performance. The mechanism exploits the observation that neural networks have many input directions that barely affect their first-layer features, and these direction sets differ from model to model. If correct, this gives a practical way to enforce purpose limitation at inference time—an uploaded image could serve its intended model but fail on any scraped or unauthorized model. The paper grounds the claim in spectral bounds on first-layer feature change and cross-model deviation.

Core claim

The central claim is that recoding an input x as x+δ, where δ is a random vector projected onto the τ-insensitive subspace of the authorized model's first-layer weight matrix (the span of right singular vectors whose singular values sum to at most τ), preserves the authorized model's predictions while degrading unauthorized models. Because Wδ is small, the authorized model's first-layer features barely change; because different models have different singular subspaces, the same δ lands on active directions for unauthorized models and disrupts their features. The paper reports that on ImageNet at 20 dB PSNR, the authorized ResNet-50 keeps 80.2% top-1 accuracy (clean 80.3%) and ViT-B keeps 81.

What carries the argument

The τ-insensitive subspace: for the first linear transformation W (convolution unfolded, token embedding, or QKV projection), the span of right singular vectors whose singular values sum to at most τ, which contains the nullspace. The recoding δ=Vz with i.i.d. Gaussian z and coordinates zeroed on sensitive directions keeps Wδ small—Theorem 1 bounds ‖Wx̃−Wx‖ by a spectral threshold times ‖z‖—while the Hoffman–Wielandt inequality is invoked to bound the gap between first-layer outputs of two models in Theorem 2. The assumed non-overlap of these subspaces across models is what converts a small feature change for the target into a large one for non-targets.

Load-bearing premise

That different models' low-sensitivity directions almost never overlap, so a perturbation that is invisible to the authorized model always disrupts every unauthorized model; if two models share those directions, the recoding transfers and unauthorized utility survives.

What would settle it

Train two models of the same architecture on the same dataset with different random seeds, compute their first-layer right singular vectors, and measure the projection of one model's τ-insensitive basis onto the other model's top (sensitive) singular vectors. If that overlap is substantial, generate NEs for the first model and evaluate on the second; an unauthorized accuracy well above chance (e.g., >50% top-1 on ImageNet) would demonstrate that non-transferability fails when the premise is violated.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Data released for one model (e.g., an MLaaS upload) can be bound to that model without retraining, with authorized accuracy preserved within a fraction of a percent and unauthorized models operating at chance level.
  • The recoding transfers across model families—convolutional, transformer, state-space, and vision-language—and fails even when the unauthorized model shares the target's architecture but has different weights.
  • Because the perturbation sits in low-sensitivity directions, it survives common preprocessing such as resize, crop, compression, and blur, and resists super-resolution reconstruction attempts in both black-box and white-box settings.
  • Compared with homomorphic encryption, which took over 30 minutes per image in the paper's setup, NEs add negligible inference overhead, suggesting a practical route to inference-time purpose limitation.
  • The paper derives formal bounds for authorized utility retention and for cross-model deviation on first-layer features, laying groundwork for a theory of model-specific data authorization.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The real crux is empirical: if two models share near-null directions (e.g., same architecture trained on similar data), the recoding would transfer and the unauthorized model would keep working; Theorem 2 does not prove otherwise, since its bound is an upper bound on a first-layer projection difference, not a lower bound on task error.
  • A parameter-aware adversary could try to estimate the basis and project the recoding out; the paper acknowledges this in its limitations section and argues that preprocessing non-commutativity limits full recovery—testing that countermeasure end-to-end is the natural next experiment.
  • The same construction should apply to any model with a linear first stage beyond vision; the appendix's GLUE results for BERT and RoBERTa suggest text inputs can be recoded, though the spectral geometry of token embeddings may differ from images.
  • If the subspace-misalignment premise holds generally, NEs could serve as a lightweight alternative to encryption for regulatory 'purpose limitation' requirements, but the security case ultimately hinges on how hard it is to estimate another model's insensitive directions from public queries.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper proposes non-transferable examples (NEs): inputs recoded by adding a perturbation in a low-sensitivity subspace of the authorized model's first linear layer. The central claims are that the authorized model retains task utility, unauthorized models suffer degraded utility via subspace misalignment, and that Theorems 1 and 2 provide formal bounds for both effects. The empirical sections evaluate image classifiers (ResNet-50, ViT-B, SwinV2-T, DeiT-B, MambaVision-T) on CIFAR-10 and ImageNet, GLUE for text models, and vision-language models on MMBench, including preprocessing and reconstruction-attack robustness.

Significance. The empirical phenomenon is interesting and potentially useful for model-level purpose limitation: an input-side recoding that is transparent to one model and disruptive to others would be a practical complement to anti-learnability and encrypted inference. The paper's strengths are its broad evaluation across architectures and modalities, the explicit threat model, and the candid Appendix E, which lists important limitations. However, the formal apparatus as written does not support the stated guarantees: Theorem 2 is an upper bound that cannot certify unauthorized degradation, and Theorem 1 stops at first-layer feature distance without reaching the task metric in Formula (1). The contribution is therefore best read as an empirical method plus supporting intuitions, not as a certified authorization mechanism.

major comments (5)
  1. [§4.2, Eq. (5); §2.1 Eq. (2)] Theorem 2 is presented as bounding 'Unauthorized Utility', but Eq. (5) is an upper bound on one singular component of a first-layer difference. An upper bound cannot imply the lower separation required by Formula (2). The sentence 'Consequently, |f'(x̃)-f⋆(x̃)| is large, which directly yields Formula (2)' is a non sequitur: no lower bound on the full first-layer difference is proved, no propagation from first-layer change to task error is established, and no argument shows the spectral gap epsilon is nonzero. The Hoffman-Wielandt step also requires care with singular-vector sign ambiguity and eigenvalue gaps. Please either prove a genuine lower bound under explicit assumptions or clearly state that formal degradation certification is not claimed.
  2. [§4.1, Theorem 1] Theorem 1 bounds ||W x̃ - W x|| by τ||z|| with high probability. This does not establish anything about f⋆(x̃) or the task metric m in Formula (1). The paragraph beginning 'these considerations evidently imply' is an appeal to intuition, not a proof: modern networks are not generally Lipschitz-stable in a way that makes a small first-layer change irrelevant. Since Authorized-Utility Retention is defined in task-metric terms, the claimed formal guarantee is not delivered. The authors should either prove a propagation result with explicit Lipschitz/network assumptions or explicitly label authorized-utility retention as an empirical finding.
  3. [§1 and §4.2, Assumption 2] The mechanism's non-transferability rests on the premise that τ-insensitive subspaces 'rarely align across models'. This premise is asserted in Section 1 and used throughout, but Theorem 2 does not prove it. If a non-target model shares a substantial portion of Insτ(W1), the recoding is also nearly inert for that model and unauthorized utility survives. The empirical tables suggest the premise holds for the selected models, but this remains an empirical observation, not a proven property. The text should separate the formal claims from the empirically supported subspace-misalignment hypothesis.
  4. [Appendix E] The limitations section concedes that a method- or parameter-aware adversary can partially cancel the recoding with an input-side projector, and that a training-time adversary can restore non-target utility by regularizing sensitivity. These are exactly the adaptive and transfer-match adversaries defined in Section 2.2. The abstract and conclusion, however, state unqualified claims such as 'unauthorized models collapse'. The authors should tighten the abstract, Section 5, and the conclusion to match the admitted limitations, or add experiments evaluating these stronger adversaries.
  5. [Table 1, SwinV2-T row (ImageNet)] At the standardized 20 dB PSNR, the authorized SwinV2-T accuracy drops from 80.9% to 71.7% on ImageNet. The text says 'modest tuning of basis selection fixes this in practice' but no supporting experiment is provided. This is not the 'negligible drop' promised in Section 5.1, and it weakens the claim that a fixed conservative setting preserves authorized performance across all evaluated backbones. Please report the tuned result or soften the claim.
minor comments (4)
  1. [Theorem 1 statement] The vector z is described as 'standard normal' but then z_q ∼ N(0,σ). Please say 'zero-mean Gaussian with variance σ²' to avoid ambiguity.
  2. [Definition 1 and §3.2] Definition 1 uses a cumulative condition Σ s_i ≤ τ, while Section 3.2 and Theorem 1 apply the threshold per singular value (s_q ≤ τ). These are different conditions; please align the definition with the implementation (τ = 1e-4).
  3. [Theorem 2 proof] The equality after the first triangle inequality should be an inequality; the proof later switches notation between σ2,i and σ2,j. Also, the use of ||v1,i - v2,i|| requires a sign convention and a nonzero gap ε; these should be stated.
  4. [§5.3 and references] Section 5.3 refers to 'Appendix 7' but the relevant material is in Appendix D. The reference 'Four Flynn, Helen King, Anca Dragan' is malformed and should be corrected. Table 3 footnotes are hard to follow and should be clarified.

Circularity Check

1 steps flagged

Theorem 2's formal unauthorized-utility guarantee is an upper bound asserted as a lower bound; the claimed derivation reduces to the subspace-misalignment assumption.

specific steps
  1. other [Section 4.2, Theorem 2 and the paragraph following Eq. (5)]
    "the first model (with W1) has a small σ1,i and thus a near-zero σ1,i v⊤1,i x̃, whereas the second (with W2) has a different σ2,i and a non-zero σ2,i v⊤2,i x̃. Consequently, |f′(x̃)−f⋆(x̃)| is large, which directly yields Formula (2) in Section 2."

    The only proved statement, Eq. (5), is an upper bound: ∥(σ1,i v1,i − σ2,i v2,i)ᵀ x̃∥₂ ≤ ∥x̃∥₂(τ∥W1−W2∥₂/ε+ε). Formula (2) requires a lower bound on an end-to-end utility gap, E[m(f′,x̃)]−E[m(f⋆,x̃)] ≥ γ. The paper does not derive that lower bound; it asserts that the unauthorized first-layer response is non-zero. If W2 shares the authorized model's τ-insensitive directions, that response is also near zero and unauthorized utility survives. Thus the formal result assumes exactly the misalignment it claims to prove; the claimed unauthorized-utility guarantee is the premise restated.

full rationale

The empirical evaluation is substantial and self-contained: Table 1 tests five external backbones and Table 4 tests two external VLMs, and the off-diagonal collapse is not produced by a fitted parameter in the theorem. The authorized-side retention is a design property (δ lives in the τ-insensitive subspace) rather than an independent prediction, and the paper itself concedes the deeper trade-off is 'empirical rather than guaranteed' and that extending guarantees beyond early layers 'remains open.' The circularity is therefore confined to the formal Section 4.2 claim: Theorem 2 is an upper bound, and the asserted 'directly yields Formula (2)' is not a consequence of the bound; it imports the subspace-misalignment premise as its conclusion. Self-citations in Section 4 (Wang et al. 2024; Ma et al. 2024b, 2025) are not load-bearing for this step. Score 6 reflects partial circularity in the central formal derivation, not a fully circular method or fabricated results.

Axiom & Free-Parameter Ledger

3 free parameters · 7 axioms · 1 invented entities

The method leans on spectral geometry of the authorized model. Two domain assumptions (spectral flatness and singular-vector/PCA alignment) plus the attenuation premise carry the argument from first-layer bounds to task-level utility. Free parameters τ and λ are tuned, so the 'guarantees' are not parameter-free.

free parameters (3)
  • tau (spectral threshold) = 1e-4
    Defines the τ-insensitive subspace; hand-chosen invariant across experiments, not derived from any principle.
  • lambda (perturbation amplitude) = tuned to 20 dB PSNR
    Scaling factor for perturbation magnitude; selected from a PSNR sweep that preserves authorized accuracy while collapsing unauthorized accuracy (Section 5.1).
  • sigma (Gaussian recoding variance) = not reported (implicitly 1)
    Variance of the recoding vector z; appears in Theorem 1 but the implementation does not state its value.
axioms (7)
  • standard math SVD existence and basic properties
    Used throughout Section 3 and 4 to define the insensitivity subspace and bound Wδ.
  • standard math Chebyshev inequality and chi-square concentration
    Used in the proof of Theorem 1.
  • standard math Hoffman-Wielandt singular-vector bound
    Used in the proof of Theorem 2.
  • domain assumption Assumption 1: spectral flatness of data representations
    Several singular values are close together; needed so multiple feasible low-sensitivity directions exist (Appendix C.1).
  • domain assumption Assumption 2: right singular vectors align with PCA principal components
    Enables the claim that an insensitive direction for W1 becomes active for W2 (Appendix C.2).
  • domain assumption Downstream layers attenuate small first-layer perturbations
    Bridges Theorem 1's first-layer bound to the task-level claim that |f⋆(x̃)-f⋆(x)| stays small (Section 4.1).
  • domain assumption Insensitivity subspaces rarely align across models
    Core empirical premise for unauthorized degradation; asserted in Section 1 but not proven by Theorem 2.
invented entities (1)
  • τ-insensitive subspace of first-layer weights no independent evidence
    purpose: Set of input directions that leave the authorized model's first-layer output nearly unchanged; used to host recoding perturbations.
    Defined via SVD threshold; has no external falsifiable handle; its usefulness is the empirical non-transferability result itself.

reviewed 2026-08-04 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Catch-Only-One: Non-Transferable Examples for Model-Specific Authorization." pith.science (2026). https://pith.science/paper/SZ7K4EQH

@misc{pith2026251010982,
  author       = {Pith},
  title        = {Pith review of: Catch-Only-One: Non-Transferable Examples for Model-Specific Authorization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SZ7K4EQH}},
  note         = {Machine review of arXiv:2510.10982}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Recent AI regulations increasingly emphasize the need for mechanisms that preserve the utility of data for AI innovation while preventing misuse, particularly by enforcing purpose limitation in downstream AI applications. In practice, enforcing this principle remains challenging, as released data can be trivially fed into arbitrary models beyond its declared intent. Existing approaches attempt to mitigate this risk by either perturbing data or retraining models to limit unintended use. These strategies, however, offer no protection against inference by unknown or externally trained models, or fundamentally rely on control over the training or deployment. In this work, we introduce non-transferable examples (NTEs), recoded data that act as a task-level "ciphertext" decodable only by a designated model. Whereas adversarial examples exploit directions of high model sensitivity, NTEs leverage the complementary insensitive subspace. We propose a training-free, data-agnostic method that recodes data within a model-specific low-sensitivity subspace, preserving outputs for the authorized model while degrading unauthorized ones through subspace misalignment. We establish formal bounds certifying authorized-model fidelity and showing that unauthorized degradation scales with measurable spectral misalignment between models. Empirically, NTEs preserve performance across diverse vision backbones and state-of-the-art vision-language models under common preprocessing, while unauthorized models collapse even under adaptive reconstruction attacks. These results establish NTEs as a practical means to preserve intended data utility while preventing unauthorized exploitation. Our project is available at https://trusted-system-lab.github.io/model-specificity

Figures

Figures reproduced from arXiv: 2510.10982 by Akide Liu, Derui Wang, Guangdong Bai, Minhui Xue, Shuofeng Liu, Zhiyong Ma, Zhongkui Ma, Zihan Wang.

Figure 1
Figure 1. Figure 1: Authorized vs. unauthorized accu￾racy on target-recoded inputs across perturba￾tion strength; visual examples in [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Illustrative visualization of effective on data authorization on VLM. [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: The spectral structure of the first-layer weight matrices in ResNet-50 and ViT-Base via [PITH_FULL_IMAGE:figures/full_fig_p019_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Effect of perturbation strength (PSNR, dB). Visual examples across increasing strength. Authorized models remain stable even at 10dB; at 0dB, ResNet-50 on ImageNet loses only 0.1% accuracy. In practice images are decoded to RGB and converted to floats, resized to model specific canvases such as 448, 512, 896 or 1024 with aspect ratio preserved and letterbox padding, optionally center or random cropped, nor… view at source ↗
Figure 5
Figure 5. Figure 5: Illustrative visualization of effective on data authorization on VLM. [PITH_FULL_IMAGE:figures/full_fig_p021_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Re-Key-Free, Risky-Free: Adaptable Model Usage Control

    cs.CR 2025-11 unverdicted novelty 7.0

    AdaLoc keeps a model locked to authorized users by confining all post-deployment updates to a chosen subset of weights, preserving both task performance for authorized use and near-random accuracy for unauthorized use...

  2. Variational Feature Compression for Model-Specific Representations

    cs.CV 2026-04 unverdicted novelty 6.0

    A variational latent bottleneck with KL regularization and a dynamic binary mask based on saliency produces model-specific features that keep high accuracy for one classifier but drop others below 2% on CIFAR-100 with...

Reference graph

Works this paper leans on

58 extracted references · 2 canonical work pages · cited by 2 Pith papers

  1. [1]

    URL https://www.anthropic.com/

    Anthropic , 2025. URL https://www.anthropic.com/

    2025

  2. [2]

    Harnessing data and digital technology: Interim report

    Australian Productivity Commission . Harnessing data and digital technology: Interim report. https://jws.com.au/what-we-think/fresh-perspective-on-privacy-and-ai-law-reform-in-australian-productivity-commission-interim-data-report/, August 2025. Accessed on 21 August 2025

    2025

  3. [3]

    AUTHSCAN: automatic extraction of web authentication protocols from implementations

    Guangdong Bai, Jike Lei, Guozhu Meng, Sai Sathyanarayan Venkatraman, Prateek Saxena, Jun Sun, Yang Liu, and Jin Song Dong. AUTHSCAN: automatic extraction of web authentication protocols from implementations. In 20th Annual Network and Distributed System Security Symposium, NDSS 2013, San Diego, California, USA, February 24-27, 2013 . The Internet Society,...

    2013

  4. [4]

    Qwen2.5-vl technical report, 2025

    Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, Humen Zhong, Yuanzhi Zhu, Mingkun Yang, Zhaohai Li, Jianqiang Wan, Pengfei Wang, Wei Ding, Zheren Fu, Yiheng Xu, Jiabo Ye, Xi Zhang, Tianbao Xie, Zesen Cheng, Hang Zhang, Zhibo Yang, Haiyang Xu, and Junyang Lin. Qwen2.5-vl technical report, 2...

    Pith/arXiv arXiv 2025

  5. [5]

    Tenseal: A library for encrypted tensor operations using homomorphic encryption, 2021

    Ayoub Benaissa, Bilal Retiat, Bogdan Cebere, and Alaa Eddine Belfedhal. Tenseal: A library for encrypted tensor operations using homomorphic encryption, 2021

    2021

  6. [6]

    The hoffman-wielandt inequality in infinite dimensions

    Rajendra Bhatia and Ludwig Elsner. The hoffman-wielandt inequality in infinite dimensions. In Proceedings of the Indian Academy of Sciences-Mathematical Sciences, volume 104, pp.\ 483--494. Springer, 1994

    1994

  7. [7]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and J Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning (ICML), 2019

    2019

  8. [8]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers), pp.\ 4171--4186, 2019

    2019

  9. [9]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. 9th International Conference on Learning Representations (ICLR), 2021

    2021

  10. [10]

    Differential privacy

    Cynthia Dwork. Differential privacy. In 33rd International Colloquium on Automata, Languages and Programming (ICALP), pp.\ 1--12, 2006

    2006

  11. [11]

    The algorithmic foundations of differential privacy

    Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science , 9 0 (3--4): 0 211--407, 2014

    2014

  12. [12]

    Regulation (eu) 2024/1689 of the european parliament and of the council laying down harmonised rules on artificial intelligence (artificial intelligence act)

    European Parliament and Council . Regulation (eu) 2024/1689 of the european parliament and of the council laying down harmonised rules on artificial intelligence (artificial intelligence act). https://eur-lex.europa.eu/eli/reg/2024/1689/oj, 2024. OJ L 1689, 12 July 2024, in force 1 August 2024

    2024

  13. [13]

    Uncovering gradient inversion risks in practical language model training

    Xinguo Feng, Zhongkui Ma, Zihan Wang, Eu Joe Chegne, Mengyao Ma, Alsharif Abuadbba, and Guangdong Bai. Uncovering gradient inversion risks in practical language model training. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS '24, pp.\ 3525–3539, New York, NY, USA, 2024. Association for Computing Machinery. ...

    arXiv 2024

  14. [14]

    Strengthening our Frontier Safety Framework

    Four Flynn, Helen King, Anca Dragan . Strengthening our Frontier Safety Framework . https://deepmind.google/discover/blog/strengthening-our-frontier-safety-framework/, 2025

    2025

  15. [15]

    An image is worth one word: Personalizing text-to-image generation using textual inversion, 2022

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing text-to-image generation using textual inversion, 2022. URL arXiv preprint arXiv:2208.01618

    Pith/arXiv arXiv 2022

  16. [16]

    Property inference attacks on fully connected neural networks using permutation invariant representations

    Karan Ganju, Qi Wang, Wei Yang, Carl A Gunter, and Nikita Borisov. Property inference attacks on fully connected neural networks using permutation invariant representations. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2018

    2018

  17. [17]

    Fully homomorphic encryption using ideal lattices

    Craig Gentry. Fully homomorphic encryption using ideal lattices. In Proceedings of the 41st Annual ACM symposium on Theory of Computing (STOC), pp.\ 169--178, 2009

    2009

  18. [18]

    Principal components bias in over-parameterized linear models, and its manifestation in deep neural networks

    Guy Hacohen and Daphna Weinshall. Principal components bias in over-parameterized linear models, and its manifestation in deep neural networks. Journal of Machine Learning Research, 23 0 (155): 0 1--46, 2022. URL http://jmlr.org/papers/v23/21-0991.html

    2022

  19. [19]

    Mambavision: A hybrid mamba-transformer vision backbone, 2025

    Ali Hatamizadeh and Jan Kautz. Mambavision: A hybrid mamba-transformer vision backbone, 2025. URL https://arxiv.org/abs/2407.08083

    Pith/arXiv arXiv 2025

  20. [20]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016

    2016

  21. [21]

    This artist is dominating ai-generated art, and he’s not happy about it, 2022

    Melissa Heikkilä. This artist is dominating ai-generated art, and he’s not happy about it, 2022. URL https://www.technologyreview.com/2022/09/16/1059598/this-artist-is-dominating-ai-generated-art-and-hes-not-happy-about-it/

    2022

  22. [22]

    Diffprivlib: the IBM differential privacy library

    Naoise Holohan, Stefano Braghin, P \'o l Mac Aonghusa, and Killian Levacher. Diffprivlib: the IBM differential privacy library. ArXiv e-prints, 1907.02444 [cs.CR], July 2019

    Pith/arXiv arXiv 1907

  23. [23]

    Toward robust non-transferable learning: A survey and benchmark

    Ziming Hong, Yongli Xiang, and Tongliang Liu. Toward robust non-transferable learning: A survey and benchmark. In James Kwok (ed.), Proceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence, IJCAI-25 , pp.\ 10455--10463. International Joint Conferences on Artificial Intelligence Organization, 8 2025. doi:10.24963/ijcai.202...

    work page doi:10.24963/ijcai.2025/1161 2025

  24. [24]

    Image quality metrics: Psnr vs

    Alex Hore and Djemel Ziou. Image quality metrics: Psnr vs. ssim. 2010 20th International Conference on Pattern Recognition, pp.\ 2366--2369, 2010

    2010

  25. [25]

    Training certifiably robust neural networks with efficient local lipschitz bounds

    Yujia Huang, Huan Zhang, Yuanyuan Shi, J Zico Kolter, and Anima Anandkumar. Training certifiably robust neural networks with efficient local lipschitz bounds. Advances in Neural Information Processing Systems, 34: 0 22745--22757, 2021

    2021

  26. [26]

    Multi-scale residual network for image super-resolution

    Juncheng Li, Faming Fang, Kangfu Mei, and Guixu Zhang. Multi-scale residual network for image super-resolution. In Proceedings of the European conference on computer vision (ECCV), pp.\ 517--532, 2018

    2018

  27. [27]

    You can use but cannot recognize: Preserving visual privacy in deep neural networks

    Qiushi Li, Yan Zhang, Ju Ren, Qi Li, and Yaoxue Zhang. You can use but cannot recognize: Preserving visual privacy in deep neural networks. 2024

    2024

  28. [28]

    Being transparent is merely the beginning: Enforcing purpose limitation with polynomial approximation

    Shuofeng Liu, Zihan Wang, Minhui Xue, Long Wang, Yuanchao Zhang, and Guangdong Bai. Being transparent is merely the beginning: Enforcing purpose limitation with polynomial approximation. In 33rd USENIX Security Symposium (USENIX Security 24), pp.\ 6507--6524, Philadelphia, PA, August 2024 a . USENIX Association. ISBN 978-1-939133-44-1. URL https://www.use...

    2024

  29. [29]

    Mmbench: Is your multi-modal model an all-around player?, 2024 b

    Yuan Liu, Haodong Duan, Yuanhan Zhang, Bo Li, Songyang Zhang, Wangbo Zhao, Yike Yuan, Jiaqi Wang, Conghui He, Ziwei Liu, Kai Chen, and Dahua Lin. Mmbench: Is your multi-modal model an all-around player?, 2024 b . URL https://arxiv.org/abs/2307.06281

    Pith/arXiv arXiv 2024

  30. [30]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pp.\ 10012--10022, 2021

    2021

  31. [31]

    Chamikara, Mohan Baruwal Chhetri, and Guangdong Bai

    Mengyao Ma, Shuofeng Liu, M.A.P. Chamikara, Mohan Baruwal Chhetri, and Guangdong Bai. Unveiling intellectual property vulnerabilities of gan-based distributed machine learning through model extraction attacks. In Proceedings of the 33rd ACM International Conference on Information and Knowledge Management, CIKM '24, pp.\ 1617–1626, New York, NY, USA, 2024 ...

    arXiv 2024

  32. [32]

    Relu hull approximation

    Zhongkui Ma, Jiaying Li, and Guangdong Bai. Relu hull approximation. Proc. ACM Program. Lang., 8 0 (POPL), January 2024 b . doi:10.1145/3632917. URL https://doi.org/10.1145/3632917

    work page doi:10.1145/3632917 2024

  33. [33]

    Convex hull approximation for activation functions

    Zhongkui Ma, Zihan Wang, and Guangdong Bai. Convex hull approximation for activation functions. Proc. ACM Program. Lang., 9 0 (OOPSLA2), October 2025. doi:10.1145/3763086. URL https://doi.org/10.1145/3763086

    doi:10.1145/3763086 2025

  34. [34]

    Doren: Toward efficient deep convolutional neural networks with fully homomorphic encryption

    Souhail Meftah, Benjamin Hong Meng Tan, Chan Fook Mun, Khin Mi Mi Aung, Bharadwaj Veeravalli, and Vijay Chandrasekhar. Doren: Toward efficient deep convolutional neural networks with fully homomorphic encryption. IEEE Transactions on Information Forensics and Security, 16: 0 3740--3752, 2021. doi:10.1109/TIFS.2021.3090959

    arXiv 2021

  35. [35]

    Sensitivity and generalization in neural networks: an empirical study

    Roman Novak, Yasaman Bahri, Daniel A Abolafia, Jeffrey Pennington, and Jascha Sohl-Dickstein. Sensitivity and generalization in neural networks: an empirical study. arXiv preprint arXiv:1802.08760, 2018

    Pith/arXiv arXiv 2018

  36. [36]

    A probabilistic approach to neural network pruning

    Xin Qian and Diego Klabjan. A probabilistic approach to neural network pruning. In International Conference on Machine Learning (ICML), pp.\ 8640--8649. PMLR, 2021

    2021

  37. [37]

    Mlaas: Machine learning as a service

    Mauro Ribeiro, Katarina Grolinger, and Miriam AM Capretz. Mlaas: Machine learning as a service. In IEEE 14th International Conference on Machine Learning and Applications (ICMLA), pp.\ 896--902. IEEE, 2015

    2015

  38. [38]

    An empirical study of the naive bayes classifier

    Irina Rish et al. An empirical study of the naive bayes classifier. In IJCAI 2001 workshop on empirical methods in artificial intelligence, volume 3, pp.\ 41--46, 2001

    2001

  39. [39]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp.\ 3--18. IEEE, 2017

    2017

  40. [40]

    Generative ai and copyright infringement

    David Tan. Generative ai and copyright infringement. Center for Technology, Robotics, Artificial Intelligence & the Law (TRAIL), January 2024. URL https://law.nus.edu.sg/trail/generative-ai-copyright-infringement/

    2024

  41. [41]

    Anthropic agrees to pay \ 1.5 billion to settle author class action over AI training

    The Guardian . Anthropic agrees to pay \ 1.5 billion to settle author class action over AI training . https://www.theguardian.com/technology/2025/sep/05/anthropic-settlement-ai-book-lawsuit, 2025

    2025

  42. [42]

    Artists Score Major Win in Copyright Case Against AI Art Generators

    The Hollywood Reporter . Artists Score Major Win in Copyright Case Against AI Art Generators . https://www.hollywoodreporter.com/business/business-news/artists-score-major-win-copyright-case-against-ai-art-generators-1235973601/, 2025

    2025

  43. [43]

    America's ai action plan

    The White House . America's ai action plan. https://www.whitehouse.gov/articles/2025/07/white-house-unveils-americas-ai-action-plan/, July 2025. Released July 23, 2025 as mandated by EO 14179

    2025

  44. [44]

    Training data-efficient image transformers & distillation through attention

    Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Herv \'e J \'e gou. Training data-efficient image transformers & distillation through attention. In International conference on machine learning, pp.\ 10347--10357. PMLR, 2021

    2021

  45. [45]

    Stealing machine learning models via prediction APIs

    Florian Tram \`e r, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction APIs . In USENIX Security Symposium, 2016

    2016

  46. [46]

    Vedaldi and K

    A. Vedaldi and K. Lenc. Matconvnet -- convolutional neural networks for matlab. In Proceeding of the ACM Int. Conf. on Multimedia , 2015

    2015

  47. [47]

    High-dimensional probability: An introduction with applications in data science, volume 47

    Roman Vershynin. High-dimensional probability: An introduction with applications in data science, volume 47. Cambridge University Press, 2018

    2018

  48. [48]

    Provably unlearnable data examples

    Derui Wang, Minhui Xue, Bo Li, Seyit Camtepe, and Liming Zhu. Provably unlearnable data examples. In The Network and Distributed System Security (NDSS) Symposium, 2025 a

    2025

  49. [49]

    Non-transferable learning: A new approach for model ownership verification and applicability authorization

    Lixu Wang, Shichao Xu, Ruiqi Xu, Xiao Wang, and Qi Zhu. Non-transferable learning: A new approach for model ownership verification and applicability authorization. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=tYRrOdSnVUy

    2022

  50. [50]

    Corelocker: Neuron-level usage control

    Zihan Wang, Zhongkui Ma, Xinguo Feng, Ruoxi Sun, Hu Wang, Minhui Xue, and Guangdong Bai. Corelocker: Neuron-level usage control. In 2024 IEEE Symposium on Security and Privacy (SP), pp.\ 2497--2514. IEEE Computer Society, 2024

    2024

  51. [51]

    Ai model modulation with logits redistribution

    Zihan Wang, Zhongkui Ma, Xinguo Feng, Zhiyang Mei, Ethan Ma, Derui Wang, Minhui Xue, and Guangdong Bai. Ai model modulation with logits redistribution. In Proceedings of the ACM on Web Conference 2025, WWW '25, pp.\ 4699–4709, New York, NY, USA, 2025 b . Association for Computing Machinery. ISBN 9798400712746. doi:10.1145/3696410.3714737. URL https://doi....

    arXiv 2025

  52. [52]

    Exploring chatgpt app ecosystem: Distribution, deployment and security

    Chuan Yan, Ruomai Ren, Mark Huasong Meng, Liuhuo Wan, Tian Yang Ooi, and Guangdong Bai. Exploring chatgpt app ecosystem: Distribution, deployment and security. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, pp.\ 1370--1382, 2024

    2024

  53. [53]

    Ungeneralizable examples

    Jingwen Ye and Xinchao Wang. Ungeneralizable examples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 11944--11953, June 2024

    2024

  54. [54]

    Defense against adversarial attacks using spectral regularization

    Dinghuai Zhang, Yang Song, Inderjit Dhillon, and Eric Xing. Defense against adversarial attacks using spectral regularization. In International Conference on Learning Representations (ICLR), 2020

    2020

  55. [55]

    Internvl3: Exploring advanced training and test-time recipes for open-source multimodal models, 2025

    Jinguo Zhu, Weiyun Wang, Zhe Chen, Zhaoyang Liu, Shenglong Ye, Lixin Gu, Hao Tian, Yuchen Duan, Weijie Su, Jie Shao, Zhangwei Gao, Erfei Cui, Xuehui Wang, Yue Cao, Yangzhou Liu, Xingguang Wei, Hongjie Zhang, Haomin Wang, Weiye Xu, Hao Li, Jiahao Wang, Nianchen Deng, Songze Li, Yinan He, Tan Jiang, Jiapeng Luo, Yi Wang, Conghui He, Botian Shi, Xingcheng Zh...

    Pith/arXiv arXiv 2025

  56. [56]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should not add it explicitly Type <Return> for now, but then later remove the command n...

  57. [57]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@first@sw \@firstoftwo \@ifundefined NAT@b*@#2 \@firstoftwo @num @NAT@ctr \@secondoft...

  58. [58]

    `H " XS]v ܁ .5z .Hr U /Q A , YPY^ g؋la8kbM] , < Ĝ` ( z &> oFuA ^+u /x ˎ\ cN ] ьG f jF 8n 3營` | c TRMWDvn΄ˋ 4:C knL2PD> ht xir6P?ҹz y 8JE>9ZĪD ;xȚ t nURKgjR̥? .2?W 'C-, u VB6 E

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibsetup #1 @NAT@ctr @ @openbib .11em \@plus.33em \@minus.07em 4000 4000 `\.\@m @bibit...

This paper was first reviewed by deepseek-v4-flash on August 4, 2026.