Making Models Unmergeable via Scaling-Sensitive Loss Landscape

Hoyoung Kim; Jabin Koo; Jungseul Ok; Minwoo Jang

REVIEW 3 major objections 5 minor 9 references

TRAP² embeds unmergeability into fine-tuned updates by training a scaling-sensitive loss landscape: standalone accuracy stays high, merged accuracy collapses.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 06:45 UTC pith:BIVISVAS

load-bearing objection A genuinely new training-time unmergeability defense with strong empirical breadth, but it only targets naive coefficient-based merging — an adaptive merger or a few fine-tuning steps likely restores the weights. the 3 major comments →

arxiv 2601.21898 v2 pith:BIVISVAS submitted 2026-01-29 cs.AI cs.CR

Making Models Unmergeable via Scaling-Sensitive Loss Landscape

Minwoo Jang , Hoyoung Kim , Jabin Koo , Jungseul Ok This is my paper

classification cs.AI cs.CR

keywords model mergingunmergeabilityweight re-scalingloss landscape shapingLoRA adaptersfine-tuning protectionmodel governanceadversarial perturbation

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

TRAP² tries to establish that unmergeability can be built directly into fine-tuned parameters, at training time, so a released adapter or full checkpoint stays accurate standalone but fails when combined into a merged model. The training objective preserves performance at the nominal scale (s=1) while deliberately raising loss at every other scale, using scalar re-scaling of the update as a proxy for the coefficients that merging pipelines apply. The paper reports that protected updates retain standalone accuracy on eight vision benchmarks across three backbones, while merged models from TA, TIES, DARE, TSV, CART, RegMean, and CoM collapse to near or below zero-shot levels. If right, this plugs a governance gap in model hubs: providers could discourage unauthorized recomposition of weights without needing architecture-specific defenses or access to full weights.

Core claim

The central claim is that minimizing J(ΔW) = L_nominal(ΔW) − λ·L_off(ΔW), with L_off sampled over a distribution of off-nominal scales that excludes a margin around s=1, makes an update accurate at its intended scale and brittle under re-scaling. Because common merging operators effectively multiply each constituent update by a coefficient (e.g., 1/N for uniform averaging), a TRAP²-trained update lands at a high-loss point after merging. The paper demonstrates this across adapter-only (LoRA) and full-checkpoint releases, on ViT-B/32, ViT-L/14, and ConvNeXt CLIP backbones, and shows that the collapse persists even when the merger tunes coefficients on a validation set or uses data-dependent o

What carries the argument

The scaling-sensitive loss landscape. The object is an update ΔW (a LoRA adapter or the difference W_t−W_0 of a full fine-tune) together with a scalar s that multiplies the whole update. TRAP² minimizes J(ΔW) = L(W_0+ΔW) − λ·E_{s∼S}[w(s)·L(W_0+s·ΔW)], where S is supported on [s_min,1−δ]∪[1+δ,s_max] (with δ=0.05 default), w(s)=1/s balances the gradient scale, and the s=1 region is the authorized operating point. The mechanism is that the resulting loss trough at s=1 and elevated loss elsewhere transfers to merging, because a merged update W_0+Σ s_i ΔW_i lands off the nominal scale.

Load-bearing premise

The load-bearing premise is that scalar re-scaling of the released update faithfully captures the effect of real merging pipelines—if a merger can restore the nominal scale (or fine-tune briefly on task data), the brittleness may not transfer to the recovered model.

What would settle it

Take a TRAP²-protected adapter, merge it with several unprotected adapters, then either rescale each adapter to its nominal s=1 before aggregation or fine-tune the merged model on a few hundred task samples; if the merged model recovers standalone-level accuracy, the central claim of unmergeability fails in practice.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

Released adapters on hubs could be protected at the source: the same weights remain accurate for a standalone user but degrade under naive composition, giving providers a way to deter unauthorized mixing.
The protection transfers across release formats and architectures, so it could apply to non-Transformer backbones where existing symmetries-based defenses do not work.
Merged products containing a protected adapter fall to near or below zero-shot accuracy under TA, TIES, DARE, TSV, and CART, meaning the merged model is unlikely to be useful for the protected task and often harms other merged tasks.
Even data-dependent mergers (RegMean and CoM) do not recover utility, suggesting the effect is not an artifact of coefficient tuning alone.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The scalar re-scaling proxy is untested against a merger who re-scales each adapter back to its nominal scale before aggregating, or who runs a short post-training pass on task data; the paper's own limitations list the latter as future work. Checking these two attacks would bound the method's real-world protection.
Because TRAP² only shapes the loss along the scalar-scaling path, it is unlikely to survive parameter-space transformations like per-layer scaling, rotation, or permutation that change the update without changing the global scale; mapping which merging operations escape the proxy would define the method's boundary.
The theoretical curvature bounds suggest a direct diagnostic: measure the second derivative of loss along the scaling path on held-out data; if the bound fails, the collapse should weaken, which would give an early-warning test for when TRAP² training produces meaningful protection.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

A genuinely new training-time unmergeability defense with strong empirical breadth, but it only targets naive coefficient-based merging — an adaptive merger or a few fine-tuning steps likely restores the weights.

read the letter

TRAP² does something real: it embeds unmergeability into the fine-tuned update itself, not into full-weight symmetries, so it works for LoRA adapters and non-Transformer backbones where PaRaMS and MergeLock don't. The empirical core is solid — eight tasks, three CLIP backbones, seven merging operators including RegMean and CoM, big drops in merged accuracy with standalone performance preserved. I'd send this to a serious referee.

The mechanism is genuinely new. Optimizing L_nominal − λ L_off over off-nominal scales gives the update a sharp loss peak at the authorized scale. It is an adversarial objective, but it is applied at training time and does not rely on architecture-specific symmetries. The paper also does the right thing by tuning the merging coefficient on validation data, so the reported degradation is against a strong-ish merger.

The soft spots are real but in proportion. First, Figures 5 and 7 largely re-sample the training objective: degradation under uniform scaling is what Eq. (9) explicitly asks the optimizer to produce, so those plots confirm the optimizer did its job. The non-circular evidence is Table 2 and Figure 4, where actual merging operators — with pruning, sign resolution, subspace projections — also collapse. That part is convincing for the tested setting.

Second, and more importantly, the threat model is narrow. The training objective only sees pure scalar re-scaling. A merger who knows (or suspects) which adapter is protected can tune per-adapter coefficients individually — set the protected one back to s=1 and adjust the others — and the paper's own Limitations concede that data-driven recovery with a few fine-tuning steps is out of scope. So the abstract's phrase 'undermining unauthorized recomposition' is too strong for what is demonstrated. It holds against indiscriminate coefficient-based merging, not against an adaptive adversary.

Third, there are no error bars or seeds reported; the tables are single numbers. For a security claim that is a notable omission. Fourth, the theoretical remark that TRAP² increases ∥V∥_F or the directional curvature is asserted without proof; the Taylor bounds themselves (A.2, A.4) are standard and fine.

Bottom line: the idea is worth knowing, the evaluation is broad, and the paper is honest about its limits. A good referee will push for code/error bars and an adaptive-merger test. I'd accept it for review, but with the expectation of revision before publication.

Referee Report

3 major / 5 minor

Summary. TRAP² is a training-time protection objective for fine-tuned updates. It minimizes the nominal loss at scale s=1 while maximizing a weighted off-nominal loss over a scale distribution S supported away from 1 (Eqs. 8–9). The authors argue this makes released LoRA adapters and full checkpoints brittle under the re-scaling that occurs in common weight-merging operators, while preserving standalone utility. The empirical core covers 8 vision tasks, CLIP ViT-B/32, ViT-L/14, and ConvNeXt backbones, adapter-only and full fine-tuning, and 7 merging operators plus RegMean/CoM, across Full/KnOTS/Core spaces. The theoretical appendix proves SGD stationarity and two generic Taylor lower bounds for loss increase under down-scaling and pairwise averaging. The paper's Limitations explicitly exclude data-driven recovery.

Significance. If the effects are robust, TRAP² offers a simple and genuinely architecture-agnostic alternative to post-hoc defenses, with unusually broad coverage of merging operators and release formats; the standalone-utility preservation is non-trivial because the adversarial term could easily destroy nominal performance. The main caveat is that the off-nominal degradation is literally the training objective, so the transfer from scaling to real multi-adapter merging, and the resistance to an adaptive merger, are the claims that need support. The authors are honest about the data-driven recovery gap, but the abstract and introduction state the conclusion more strongly than the evidence.

major comments (3)

[§6.2, Eq. (2), Table 2 caption] The protocol tunes a single global coefficient for each operator, not the per-adapter coefficients s_i of Eq. (2). A rational merger can set the protected adapter's coefficient to 1 and optimize the others only. This is not tested. The caption's claim that the search over a single s is 'optimistic for the merger' is therefore not supported. Please add experiments with per-adapter coefficient search, or restrict the claim to global-coefficient merging.
[§7 Limitations; Eq. (9)] The manuscript states that data-driven recovery is future work. Because Eq. (9) never exposes the update to post-merge fine-tuning or to addition of other task vectors, a merger with a few gradient steps on protected-task data may restore utility. The abstract's unqualified claim that unauthorized recomposition is undermined should be scoped to no-adaptation, coefficient-based merging. This is a load-bearing qualification, not a presentation issue.
[Appendix A.4, Theorem A.4 and Remark] Theorem A.4 is a generic Taylor bound for any two adapters and says nothing specific to TRAP². The remark asserts without proof that TRAP² increases ||V||_F or μκ(V). Consequently, the contribution bullet claiming theoretical degradation under model merging overstates what is proven. Either prove the landscape-shaping claim or label the theorem as a generic mechanism whose instantiation by TRAP² is empirical.

minor comments (5)

[Abstract] Typo 'agover-nance gap'; also the method name is printed as 'Trap$^2$' in the abstract but 'TRAP 2' elsewhere — please unify notation.
[Figure 4 and §6.2] The pairwise merging coefficient is fixed to 0.8 with no sensitivity analysis. Please justify this choice and report at least one alternative coefficient.
[Figure 8] The legend and axis labels are hard to parse. Please specify which task's accuracy is plotted in each cell and the direction of the interpolation parameter β.
[Tables 1–5] No variances or seeds are reported even for the 'averaged over eight trials' results. Given the emphasis on consistency, standard deviations or confidence intervals should be provided.
[Appendix D.4] Typo: 'using use an initial learning rate' should be 'using an initial learning rate'.

Circularity Check

2 steps flagged

Partial circularity: degradation at pure off-nominal scales (Figs. 5 and 7) directly restates the Eq. (9) training objective; the non-circular core is transfer to real merging operators.

specific steps

self definitional [Section 5, Eq. (9); Algorithm 1 (lines 6–8); Figure 7 caption]
"J(∆W) = Lnominal(∆W) − λ · Loff(∆W), (9) ... The first term preserves intended deployment performance, while the second term induces sensitivity to off-nominal re-scalings, encouraging unmergeability. ... Values near s = 1 collapse to zero by design, as a small neighborhood around the nominal scale is excluded from S."

The degradation at s≠1 is the training objective itself: Algorithm 1 samples s ∼ Unif([smin,1−δ]∪[1+δ,smax]) and sets L_off to the weighted loss at that scaled adapter, so minimizing −λ L_off forces large L_scaled(ΔW;s) on supp(S). Figure 7's 'self-degradation' curve and Corollary A.3 therefore restate the objective rather than derive a new consequence. The nontrivial claim is only that this brittleness transfers to real merging operators, which is tested separately.
fitted input called prediction [Section 6.4, 'Uniform Averaging Proxy' / Figure 5]
"uniform averaging of N adapters effectively scales each LoRA by s = 1/N. Figure 5 reports the resulting accuracy ... TRAP 2 exhibits a consistent catastrophic degradation once N ≥ 2."

For N ∈ [2,20], s = 1/N lies in the training support [0.05, 0.95] (δ=0.05, smin=0.05), i.e., exactly the off-nominal scales whose loss Eq. (9) and Algorithm 1 maximize. The Figure 5 collapse is therefore the fitted objective evaluated on its own training distribution, not an independent prediction about merging. The paper calls it a 'proxy' and uses it as evidence of protection, but as evidence it is definitional; only Table 2/Table 5 operators (which add other task vectors, prune, resolve sign conflicts, or use data-dependent reweighting) provide non-forced transfer evidence.

full rationale

TRAP²'s derivation chain has two parts. First, the scale-sensitivity objective: Eqs. (5)–(9) define L_scaled and J = L_nominal − λ L_off, with L_off an expectation over off-nominal scales s ∈ [smin,1−δ] ∪ [1+δ,smax]. Any later report that TRAP² adapters have high loss or low accuracy at s≠1 (Figure 7, Figure 5, Corollary A.3/remarks) is a direct check that the optimizer minimized the objective; it is not an independent prediction. This is the circular component, and the paper itself says values near s=1 'collapse to zero by design'. Second, the merging-transfer claim: Eqs. (2)–(3) and Tables 2 and 5 evaluate actual operators (TA, TIES, TIES+DARE, TSV, CART, RegMean, CoM) in Full/KnOTS/Core spaces, which are not the pure scaling used in training. These results are non-circular empirical evidence, and standalone utility at s=1 is also non-forced. The stated Limitations (§7) explicitly defer data-driven recovery (post-training with task data), so the central claim should be read as about coefficient-based merging; this is a scope limitation, not circularity. Self-citations (e.g., Koo et al. 2025 for factor-space aggregation) are background and not load-bearing. Overall: partial circularity in the scale-proxy evidence, but the core merging results have independent content, hence score 4.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

The central claim rests on hand-chosen hyperparameters (λ, δ, smin, smax, w(s)=1/s) and on the proxy that off-nominal scalar re-scaling faithfully represents merging. No new physical or mathematical entities are introduced.

free parameters (4)

λ (adversarial trade-off weight) = Selected per dataset from {0.01, 0.001} (LoRA) or {0.05, 0.01, 0.005, 0.001} (full fine-tuning) via validation grid sear
Balances standalone utility against off-nominal brittleness in Eq. (9); the main control knob of the protection, not determined by theory.
δ (exclusion width around nominal scale) = 0.05
Hand-chosen size of the protected neighborhood of s=1; determines how sharp the loss peak is and how close to s=1 a merger must land to stay safe.
smin, smax (off-nominal scale range) = smin=0.05, smax=2.0
Support of the off-nominal scale distribution S; the method is only trained to be brittle within this interval, so any merge-induced scale outside it is unaddressed.
w(s) (off-nominal weighting function) = 1/s (default)
Chosen to compensate for small gradients under down-scaling; other weightings are possible and the choice affects training dynamics.

axioms (5)

standard math Expected loss L(W;D) is L-smooth and bounded below (Theorem A.1)
Used for the SGD stationarity guarantee in Theorem A.1; standard optimization assumption, not verified for the actual CLIP networks.
standard math L_scaled(ΔW;·) is twice differentiable on [s,1] with curvature lower bound μ ≥ 0, and Lκ is twice differentiable along the merge path with defined weighted curvature (Theorems A.2, A.4)
Underpins the Taylor-based degradation bounds; the actual curvature values μ or ε are never measured, so the bounds are qualitative.
domain assumption Merging can be represented as aggregating re-scaled updates, ΔW_merged = Σ_i s_i·ΔW_i (Eqs. 2-3)
Core proxy of the paper: the entire method is trained against scalar re-scaling, and transfer to TA/TIES/DARE/TSV/CART and data-dependent operators is tested empirically rather than proven.
ad hoc to paper The off-nominal scale distribution S with support [smin, 1−δ] ∪ [1+δ, smax] covers the re-scaling that real merging introduces
The hyperparameters smin=0.05, smax=2.0, δ=0.05 are chosen by hand; if a merger produces scales outside this range, or per-layer scaling, the training does not target it.
ad hoc to paper A downstream merger does not fine-tune or otherwise recover the target task after merging
The paper's own Limitations section says extending TRAP² to data-driven recovery is future work; this scope is essential to the claim that merging remains degraded.

pith-pipeline@v1.3.0-alltime-deepseek · 31714 in / 23752 out tokens · 233962 ms · 2026-08-03T06:45:39.880295+00:00 · methodology

0 comments

read the original abstract

The rise of model hubs has made it easier to access reusable model components, making model merging a practical tool for combining capabilities. Yet, this modularity also creates a governance gap: downstream users can recompose released weights into unauthorized mixtures that bypass safety alignment or licensing terms. Because existing defenses are largely post-hoc and architecture-specific, they provide inconsistent protection across diverse architectures and release formats in practice. To close this gap, we propose Trap$^2$, an architecture-agnostic protection framework that encodes protection into updates during fine-tuning, regardless of whether they are released as adapters or full models. Instead of relying on architecture-dependent approaches, Trap$^2$ uses weight re-scaling as a simple proxy for the merging process. It keeps released weights effective in standalone use, but degrades them under re-scaling that often arises in merging, undermining unauthorized recomposition.

Figures

Figures reproduced from arXiv: 2601.21898 by Hoyoung Kim, Jabin Koo, Jungseul Ok, Minwoo Jang.

**Figure 1.** Figure 1: Unmergeability protection in model sharing and limitations of prior work. (Left) Providers release task updates for downstream reuse, often as adapters. (Middle) Most post-hoc protections are Transformer-specific, limiting transfer beyond Transformers. They also require full-weight access, which makes them incompatible with adapter-only releases such as LoRA. (Right) These limitations motivate training-… view at source ↗

**Figure 2.** Figure 2: (Left) Loss shaping over the scaling factor s. We optimize via TRAP2 to retain high utility in the authorized scale (⋆; s = 1), while inducing degradation under unauthorized scales ( ; s ̸= 1). The zero-shot result ( ; s = 0) is shown as a reference. (Right) Accuracy along the scaling factor s. TRAP2 -trained adapter attains high standalone accuracy in the authorized region (⋆) but collapses under unauth… view at source ↗

**Figure 3.** Figure 3: Performance degradation under pairwise merging. Accuracy along the interpolation path between an unprotected Cars adapter and a TRAP2 GTSRB adapter is evaluated on both tasks. scale s ∈ R≥0, let Lscaled(∆W; s) denote the expected loss at scale s, as defined in Eq. (5). The nominal loss corresponds to the intended scale s = 1: Lnominal(∆W) := Lscaled(∆W; 1). Let S be a distribution over off-nominal scales… view at source ↗

**Figure 4.** Figure 4: Results of pairwise LoRA merging at scale s = 0.8 on CLIP ViT-B/32. Each cell merges one TRAP2 -trained adapter for the row task with one unprotected adapter for the column task, and reports per-task accuracy (%; ↓) on (a) the protected task, (b) the unprotected task, and (c) their average. Cell color intensity encodes accuracy, with darker shading indicating lower accuracy (stronger degradation). The prot… view at source ↗

**Figure 5.** Figure 5: Uniform averaging proxy across 8 vision benchmarks. We simulate naive averaging of N adapters by scaling each adapter as s = 1/N before aggregation, and report accuracy (%) as a function of N for each dataset. TRAP2 exhibits catastrophic degradation as soon as N ≥ 2, while unprotected adapters remain relatively stable, indicating robustness of the protection against uniform averaging [PITH_FULL_IMAGE:figu… view at source ↗

**Figure 6.** Figure 6: Normalized merging coefficients selected by CoM, when protecting each dataset-wise adapter with TRAP2 . Each coefficient is normalized by the corresponding unprotected baseline, showing that data-driven re-weighting of CoM does not prevent the collapse of TRAP2 -protected adapters under merging. sharing ecosystems. We propose TRAP2 , a training-time objective that embeds unmergeability directly into the r… view at source ↗

**Figure 7.** Figure 7: Scale-sweep of the loss change ∆L(s) relative to the nominal scale. Positive ∆L(s) for s < 1 indicates self-degradation under down-scaling. Values near s = 1 collapse to zero by design, as a small neighborhood around the nominal scale is excluded from S. and then computes the merged layer by the same regression rule with Xˆ (l) i : W(l) merge = X N i=1 W (l) i Gˆ (l) i X N i=1 Gˆ (l) i −1 , Gˆ (l) i :=… view at source ↗

**Figure 8.** Figure 8 [PITH_FULL_IMAGE:figures/full_fig_p018_8.png] view at source ↗

discussion (0)

Reference graph

Works this paper leans on

9 extracted references · 2 linked inside Pith

[6]

10 Making Models Unmergeable via Scaling-Sensitive Loss Landscape Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A

URL https://openreview.net/forum? id=NLPzL6HWNl. 10 Making Models Unmergeable via Scaling-Sensitive Loss Landscape Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L. u., and Polosukhin, I. Attention is all you need. In Guyon, I., Luxburg, U. V ., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., and Garnett, R. (...
[8]

ISBN 979-8-89176-332-6

Association for Computational Linguistics. ISBN 979-8-89176-332-6. doi: 10.18653/v1/2025.emnlp-main

doi:10.18653/v1/2025.emnlp-main 2025
[301]

findings-emnlp.301/

URL https://aclanthology.org/2024. findings-emnlp.301/. Schuhmann, C., Beaumont, R., Vencu, R., Gordon, C. W., Wightman, R., Cherti, M., Coombes, T., Katta, A., Mullis, C., Wortsman, M., Schramowski, P., Kundurthy, S. R., Crowson, K., Schmidt, L., Kaczmarczyk, R., and Jitsev, J. LAION-5b: An open large-scale dataset for train- ing next generation image-te...

2024
[358]

emnlp-main.358/

URL https://aclanthology.org/2025. emnlp-main.358/. Yadav, P., Tam, D., Choshen, L., Raffel, C., and Bansal, M. TIES-merging: Resolving interference when merg- ing models. InThirty-seventh Conference on Neural Information Processing Systems, 2023. URL https: //openreview.net/forum?id=xtaX3WyCj1. Yang, E., Shen, L., Wang, Z., Guo, G., Chen, X., Wang, X., a...

2025
[762]

findings-emnlp.762

URL https://aclanthology.org/2024. findings-emnlp.762. He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition, 2015. URL https:// arxiv.org/abs/1512.03385. Helber, P., Bischke, B., Dengel, A., and Borth, D. In- troducing eurosat: A novel dataset and deep learning benchmark for land use and land cover classification. In IGARSS...

Pith/arXiv arXiv 2024
[2017]

cc/paper_files/paper/2017/file/ 3f5ee243547dee91fbd053c1c4a845aa-Paper

URL https://proceedings.neurips. cc/paper_files/paper/2017/file/ 3f5ee243547dee91fbd053c1c4a845aa-Paper. pdf. Wang, Z., Yang, E., Yin, L., Liu, S., and Shen, L. Model unmerging: Making your models unmergeable for secure model sharing, 2025. URL https://arxiv.org/ abs/2509.01548. Wolf, T., Debut, L., Sanh, V ., Chaumond, J., Delangue, C., Moi, A., Cistac, ...

Pith/arXiv arXiv 2017
[2021]

Rosati, D., Wehner, J., Williams, K., Bartoszcze, L., Sajjad, H., and Rudzicz, F

URL https://proceedings.mlr.press/ v139/radford21a.html. Rosati, D., Wehner, J., Williams, K., Bartoszcze, L., Sajjad, H., and Rudzicz, F. Immunization against harmful fine-tuning attacks. In Al-Onaizan, Y ., Bansal, M., and Chen, Y .-N. (eds.),Find- ings of the Association for Computational Linguis- tics: EMNLP 2024, pp. 5234–5247, Miami, Florida, USA, N...

doi:10.18653/v1/2024.findings-emnlp 2024
[2024]

Buzzega, P., Salami, R., Porrello, A., and Calderara, S

URL https://openreview.net/forum? id=gkOzoHBXUw. Buzzega, P., Salami, R., Porrello, A., and Calderara, S. Rethinking layer-wise model merging through chain of merges, 2025. URL https://arxiv.org/abs/ 2508.21421. Chen, S., Guo, Y ., Ju, Y ., Dalal, H., Zhu, Z., and Khisti, A. J. Robust federated finetuning of LLMs via alternat- ing optimization of loRA. In...

arXiv 2025
[2025]

Cheng, G., Han, J., and Lu, X

URL https://openreview.net/forum? id=e8DrPuJekZ. Cheng, G., Han, J., and Lu, X. Remote sensing image scene classification: Benchmark and state of the art.Pro- ceedings of the IEEE, 105(10):1865–1883, 2017. doi: 10.1109/JPROC.2017.2675998. Choi, J., Kim, D., Lee, C., and Hong, S. Revisiting weight averaging for model merging, 2025. URL https:// arxiv.org/a...

arXiv 2017

[1] [6]

10 Making Models Unmergeable via Scaling-Sensitive Loss Landscape Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A

URL https://openreview.net/forum? id=NLPzL6HWNl. 10 Making Models Unmergeable via Scaling-Sensitive Loss Landscape Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L. u., and Polosukhin, I. Attention is all you need. In Guyon, I., Luxburg, U. V ., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., and Garnett, R. (...

[2] [8]

ISBN 979-8-89176-332-6

Association for Computational Linguistics. ISBN 979-8-89176-332-6. doi: 10.18653/v1/2025.emnlp-main

doi:10.18653/v1/2025.emnlp-main 2025

[3] [301]

findings-emnlp.301/

URL https://aclanthology.org/2024. findings-emnlp.301/. Schuhmann, C., Beaumont, R., Vencu, R., Gordon, C. W., Wightman, R., Cherti, M., Coombes, T., Katta, A., Mullis, C., Wortsman, M., Schramowski, P., Kundurthy, S. R., Crowson, K., Schmidt, L., Kaczmarczyk, R., and Jitsev, J. LAION-5b: An open large-scale dataset for train- ing next generation image-te...

2024

[4] [358]

emnlp-main.358/

URL https://aclanthology.org/2025. emnlp-main.358/. Yadav, P., Tam, D., Choshen, L., Raffel, C., and Bansal, M. TIES-merging: Resolving interference when merg- ing models. InThirty-seventh Conference on Neural Information Processing Systems, 2023. URL https: //openreview.net/forum?id=xtaX3WyCj1. Yang, E., Shen, L., Wang, Z., Guo, G., Chen, X., Wang, X., a...

2025

[5] [762]

findings-emnlp.762

URL https://aclanthology.org/2024. findings-emnlp.762. He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition, 2015. URL https:// arxiv.org/abs/1512.03385. Helber, P., Bischke, B., Dengel, A., and Borth, D. In- troducing eurosat: A novel dataset and deep learning benchmark for land use and land cover classification. In IGARSS...

Pith/arXiv arXiv 2024

[6] [2017]

cc/paper_files/paper/2017/file/ 3f5ee243547dee91fbd053c1c4a845aa-Paper

URL https://proceedings.neurips. cc/paper_files/paper/2017/file/ 3f5ee243547dee91fbd053c1c4a845aa-Paper. pdf. Wang, Z., Yang, E., Yin, L., Liu, S., and Shen, L. Model unmerging: Making your models unmergeable for secure model sharing, 2025. URL https://arxiv.org/ abs/2509.01548. Wolf, T., Debut, L., Sanh, V ., Chaumond, J., Delangue, C., Moi, A., Cistac, ...

Pith/arXiv arXiv 2017

[7] [2021]

Rosati, D., Wehner, J., Williams, K., Bartoszcze, L., Sajjad, H., and Rudzicz, F

URL https://proceedings.mlr.press/ v139/radford21a.html. Rosati, D., Wehner, J., Williams, K., Bartoszcze, L., Sajjad, H., and Rudzicz, F. Immunization against harmful fine-tuning attacks. In Al-Onaizan, Y ., Bansal, M., and Chen, Y .-N. (eds.),Find- ings of the Association for Computational Linguis- tics: EMNLP 2024, pp. 5234–5247, Miami, Florida, USA, N...

doi:10.18653/v1/2024.findings-emnlp 2024

[8] [2024]

Buzzega, P., Salami, R., Porrello, A., and Calderara, S

URL https://openreview.net/forum? id=gkOzoHBXUw. Buzzega, P., Salami, R., Porrello, A., and Calderara, S. Rethinking layer-wise model merging through chain of merges, 2025. URL https://arxiv.org/abs/ 2508.21421. Chen, S., Guo, Y ., Ju, Y ., Dalal, H., Zhu, Z., and Khisti, A. J. Robust federated finetuning of LLMs via alternat- ing optimization of loRA. In...

arXiv 2025

[9] [2025]

Cheng, G., Han, J., and Lu, X

URL https://openreview.net/forum? id=e8DrPuJekZ. Cheng, G., Han, J., and Lu, X. Remote sensing image scene classification: Benchmark and state of the art.Pro- ceedings of the IEEE, 105(10):1865–1883, 2017. doi: 10.1109/JPROC.2017.2675998. Choi, J., Kim, D., Lee, C., and Hong, S. Revisiting weight averaging for model merging, 2025. URL https:// arxiv.org/a...

arXiv 2017