FMLock: Preventing Unauthorized Use of Large Foundation Models

The presentation can be improved.

In particular, section 4 theoretical analysis needs more clarity. The analysis of obtaining theorem 3 is very confusing, and the proof for theorem 3 is basically a reiteration of the analysis in the paper. Maybe stating theorem 3 right after theorem 2 and explain the analysis after.

• The experimental part may provide more examples and cases to further provide the readers with more intuition on the effectiveness of the proposed approach on three scenarios.

1. As the number of users or applications expands, managing access through secret keys becomes increasingly cumbersome, potentially causing scalability issues and straining computational and memory resources, especially in environments where resources are limited.

   Specifically, the requirement for the model owner to continuously (re)train the foundational model to integrate a distinct secret key for every additional user continuously consumes huge computation resources and presents a considerable financial burden for the model owner.

2. The effectiveness of FMLock against real-world attackers remains to be thoroughly tested and validated in practical settings. For example, an adversary could pretend as a legitimate user to obtain a unique secret key. Possessing this key enables him to utilize the model, facilitating malicious activities such as constructing a high-fidelity surrogate model using high-quality input-output pairs, resulting in a potential financial losses for the original model owner.

   Although there could exist a CA to verify the identify of the user, the proposed design cannot detect the actions of model stealing (as this can be done at the local side of the adversary). Using a secret key to lock the model cannot solve the foundational problems of authorized use or model stealing.

3. The evaluation of FMLock is limited to accuracy and FID scores, neglecting other important metrics like efficiency, the time cost of tuning the model with a secret key and the cost of performing a prediction with/without the key.

4. The paper neglects to explore the implications of FMLock on regular model updating, which is very important as foundation models are constantly updated and improved upon.

1. Practicality of the Contribution: The feasibility of preventing malicious use of foundation models via the proposed solution raises many concerns. For instance:

• An authorized user could distill new foundation or specialist models from the locked model and distribute them, inadvertently enabling access for malicious actors.
• There exists a risk that an authorized user might exploit the model to deduce additional secret keys and disseminate them, potentially leading to unauthorized and harmful use.

2. Ambiguity in defining Malicious/ unauthorized use: The paper lacks clarity in defining what constitutes "malicious use," leading to ambiguity in its thesis and overall scope. A robust defense mechanism against adversarial misuse might be a more viable approach than restricting model access entirely.

3. Breadth of Focus: The inclusion of both discriminative and generative foundation models, while comprehensive, dilutes the focus. For generative models, existing literature on watermarking LLMs [A] and diffusion models for image generation [B, C] could offer valuable insights. A discussion on these methodologies would improve the paper’s relevance.

4. Empirical results. The empirical results are not surprising, given the optimization objective in Equation (3). More details on the shadow dataset for different setups should be included. My understanding is that this work finetunes CLIP, BERT, Stable-Diffusion using Equation (3) and the shadow dataset. Can the authors confirm this?

5. Scalability issues. FMLock scales with the number of keys. This is a serious drawback in the proposed scheme, i.e., If one anticipates 1M “authorized” users, one needs to train the system with 1M unique keys.

6. Error bars are missing for all the experiments.

Overall I enjoyed reading this paper and appreciate this new effort. But in my opinion, the weaknesses of this paper significantly outweigh the strengths. But I’m willing to change my opinion based on the rebuttal.

[A] Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I. & Goldstein, T.. (2023). A Watermark for Large Language Models. ICML 2023.

[B] Wen, Yuxin, et al. "Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust." arXiv preprint arXiv:2305.20030 (2023).

[C] Zhao, Yunqing, et al. "A recipe for watermarking diffusion models." arXiv preprint arXiv:2303.10137 (2023).

1. The application scenario of the proposed approach is unclear and in fact, might be fairly limited. It assumes the model owner distributes its own secret key (implicit assumption of using only 1 secret key) but does not discuss how to distinguish between authorized and unauthorized parties. It is highly likely that adversaries can pretend to be authorized parties to obtain the secret key, or some authorized parties can leak the secret key (similar argument is made in the paper to show why hosting foundation models as a cloud service is not a solution). Because the secret key is shared by all users, once the secret key is (easily) obtained, the purpose of the model is completely defeated. The "secret key" discussed in this paper is different from the "secret key" we usually discuss in data encryption.
2. The downstream fine-tuning shows upward trajectory when the number of downstream samples increases, which makes me wonder if all the downstream samples are used in fine-tuning or reverse engineering, if the proposed method will be completely broken. The authors argued that there cannot be many downstream samples, otherwise the adversary may choose to train a model from scratch. However, there is still strong incentives for adversaries to use pretrained models even with some sufficient downstream samples because 1), the available data points may still not be sufficient to train very large models (while feasible through transfer learning), and 2) the adversaries may not have the computational resources to perform from-scratch training.