Apple unveils technique to block fine-tuning of AI model weights

Open it up, but don't let anyone fix it

Apple has disclosed a technique that lets it release open-weight models while preventing users from arbitrarily modifying them. It's called DLR-Lock. The method swaps out a model's MLP (multi-layer perceptron) layers with a "Deep Low-Rank Residual Network" (DLR-Net) that has a similar parameter count to the original but a different structure. This replacement network is built through knowledge distillation — a training method that transfers what a larger model has learned into a smaller one — applied module by module to transfer the knowledge from the original layers. The paper is authored by Keitaro Sakamoto of the University of Tokyo and Pierre Ablin, Federico Danieli, and Marco Cuturi of Apple.

Why this is a hard problem

The appeal of open-weight models is that anyone can download them, run them on different hardware, fine-tune them on their own data, and even redistribute them. But that same freedom is also the problem. An attacker who can see the full weights and architecture can, if they choose to, bypass safety guardrails or repurpose the model. Most locking techniques to date have only lightly twisted the architecture, meaning they could be broken with a few rounds of optimization. Apple's researchers took a different angle. Noting that deep learning inherently has different costs for forward computation (inference) and backward computation (training), they designed the system so that only backpropagation — the training step that traces errors backward to adjust weights — causes memory and compute costs to explode in proportion to layer depth. Inference runs at normal speed, but the moment someone attempts fine-tuning, backpropagation cost grows disproportionately larger than forward propagation, and the optimization landscape itself becomes distorted.

At the same time, Apple, OpenAI, and NVIDIA are each taking different positions on controlling model access. While Apple is locking down weights, NVIDIA released its autonomous-driving model Alpamayo 2 Super under a license that permits derivatives and redistribution, and OpenAI chose to tighten access to its new model Astra, citing that its cyber capabilities cannot rule out a "critical" risk threshold.

So what changes

If DLR-Lock is applied to real products, it would create a wall between "viewing and using" an open-weight model and "taking it apart and rebuilding it." Where debates over open weights have so far mostly relied on license terms for control, this research takes an approach that blocks modification through the neural network architecture itself. Apple claims the method held up and preserved the original model's performance even against attackers who knew the entire defense strategy in advance. However, no application of this method to an actual commercial model has been confirmed outside this paper, so it should be regarded as a research-stage proof of concept.