이미지: METAL LAB 생성
Summary
- Apple has unveiled DLR-Lock, a defense technique that locks pretrained weights
- It replaces MLP layers with deep low-rank residual networks to inflate backpropagation cost
- The company said experiments on LLMs showed the method neutralizes fine-tuning attempts while preserving model performance
- 발표
- 애플 ML 리서치, 2026년 8월 논문 공개
- 논문 제목
- Locking Pretrained Weights via Deep Low-Rank Residual Distillation
- 핵심 기법
- DLR-Lock — MLP를 저랭크 잔차 네트워크(DLR-Net)로 대체
- 저자
- 사카모토 케이타로(도쿄대, 애플 재직 중 수행), 피에르 아블린·페데리코 다니엘리·마르코 쿠투리(애플)
- 검증
- 적응형 공격자를 상대로 한 LLM 실험에서 방어 효과 확인
Open it up, but don't let anyone fix it
Apple has disclosed a technique that lets it release open-weight models while preventing users from arbitrarily modifying them. It's called DLR-Lock. The method swaps out a model's MLP (multi-layer perceptron) layers with a "Deep Low-Rank Residual Network" (DLR-Net) that has a similar parameter count to the original but a different structure. This replacement network is built through knowledge distillation — a training method that transfers what a larger model has learned into a smaller one — applied module by module to transfer the knowledge from the original layers. The paper is authored by Keitaro Sakamoto of the University of Tokyo and Pierre Ablin, Federico Danieli, and Marco Cuturi of Apple.
Why this is a hard problem
The appeal of open-weight models is that anyone can download them, run them on different hardware, fine-tune them on their own data, and even redistribute them. But that same freedom is also the problem. An attacker who can see the full weights and architecture can, if they choose to, bypass safety guardrails or repurpose the model. Most locking techniques to date have only lightly twisted the architecture, meaning they could be broken with a few rounds of optimization. Apple's researchers took a different angle. Noting that deep learning inherently has different costs for forward computation (inference) and backward computation (training), they designed the system so that only backpropagation — the training step that traces errors backward to adjust weights — causes memory and compute costs to explode in proportion to layer depth. Inference runs at normal speed, but the moment someone attempts fine-tuning, backpropagation cost grows disproportionately larger than forward propagation, and the optimization landscape itself becomes distorted.
At the same time, Apple, OpenAI, and NVIDIA are each taking different positions on controlling model access. While Apple is locking down weights, NVIDIA released its autonomous-driving model Alpamayo 2 Super under a license that permits derivatives and redistribution, and OpenAI chose to tighten access to its new model Astra, citing that its cyber capabilities cannot rule out a "critical" risk threshold.
So what changes
If DLR-Lock is applied to real products, it would create a wall between "viewing and using" an open-weight model and "taking it apart and rebuilding it." Where debates over open weights have so far mostly relied on license terms for control, this research takes an approach that blocks modification through the neural network architecture itself. Apple claims the method held up and preserved the original model's performance even against attackers who knew the entire defense strategy in advance. However, no application of this method to an actual commercial model has been confirmed outside this paper, so it should be regarded as a research-stage proof of concept.
