Locking Pretrained Weights via Deep Low-Rank Residual Distillation
Apple Machine Learning Research
Apple researchers built a way to "lock" open-weight AI models so fine-tuning them gets brutally expensive. It swaps MLP layers for deep low-rank nets that blow up memory during backprop, foiling attackers who try to retrain the weights.
Open-weight models have quietly become the backbone of a huge chunk of AI experimentation. Anyone can download the weights, poke at them, fine-tune them for a niche task, and ship a derivative. That openness is the whole point, but it also worries companies that want people to use their models in specific ways without easily bending them toward something else. Apple's research team, working with Keitaro Sakamoto, Pierre Ablin, Federico Danieli, and Marco Cuturi, decided to attack this problem from an unusual angle: not by hiding weights, but by making them structurally painful to retrain.
Their method, called DLR-Lock, swaps the ordinary MLP blocks inside a language model for what they call deep low-rank residual networks, or DLR-Nets. These have roughly the same parameter count as the layers they replace, so the model doesn't get slower or dumber to use. The trick is what happens during backpropagation. Because the new layers are deep and low-rank, the activation memory needed to compute gradients grows linearly with depth. Forward passes stay cheap. Backward passes, the ones any fine-tuner needs, get expensive fast — and disproportionately so compared to inference.
The team trains these replacement layers using module-wise distillation, essentially teaching each DLR-Net to mimic the original MLP's behavior closely enough that end users see no drop in quality. But under the hood, the architecture is now mismatched with the kind of thing gradient descent expects, which the authors say complicates the optimization landscape for anyone trying to fine-tune the locked model normally.
What makes this more than a gimmick is the threat model they tested against. The researchers assume an adaptive attacker who knows exactly what defense is in place — full visibility into the architecture and the DLR-Lock method itself — and still tries to retrain the model for unauthorized uses. In their experiments on LLMs, the defense held up: the memory and compute overhead during backward passes was enough to make fine-tuning impractical, even for attackers who understood the trick completely, while the model's original capabilities stayed intact for normal inference.
The paper, accepted at ICML 2024's Efficient Systems for Foundation Models workshop, frames this as exploiting an asymmetry between training and inference in automatic differentiation itself, rather than relying on obfuscation or legal terms of use. It's a narrow technical contribution, but it points at a broader question the open-weight ecosystem hasn't really answered yet: whether you can give people a usable model without giving them full control over what it becomes.
My take
This is a clever bit of engineering, but calling it a defense against misuse is generous — it's really a tax on fine-tuning, and taxes get worked around eventually, whether through bigger GPUs, smarter optimizers, or just patience. The more interesting signal here is that a company known for keeping everything closed is now experimenting with quasi-open weights it can still control, which says a lot about where the industry's headed: not fully open, not fully closed, but weights with strings attached. Anyone hoping open-weight models stay genuinely open should watch this space closely, because "open" with a memory-bomb backward pass baked in isn't really open at all.
Read more about this at: Apple Machine Learning Research
