Paper: ArchLock: Locking DNN Transferability at the Architecture Level with a Zero-Cost Binary Predictor (ICLR-2024)

Reviewer comment (Novelty):
I am not quite convinced of the motivation behind the paper. If the goal is to prevent others from fine-tuning a neural network, why release its parameters at all? Perhaps in such a use-case, the model should not even be released.

Author response:
Thanks for your question and valuable input. However, we think there is a **misunderstanding about our work** and we would like to clarify below.

Our objective is **not to degrade NN performance on new tasks** as you stated in Summary. Instead, our focus is to find model architectures that perform well on their intended tasks while exhibiting low transferability, or degraded performance, on unauthorized target tasks.

**[Motivation]**

The motivation for our approach **stems from ethical considerations and the potential misuse of machine learning models**, as highlighted in recent works such as [1,2,3,4].  For example, a recent work [1] has demonstrated the open-sourced models, including Stable Diffusion, Latent Diffusion, DALL·E 2-demo, and DALL·E mini can be misused to generate unsafe images and hateful memes. Also, another recent work has revealed that fine-tuning aligned language models (e.g., Llama-2) compromises safety [2]. 
Thus, model owners are willing to release their models to contribute to the research community while still seeking to control and limit their usage to prevent potential misuse or abuse. 

Our proposed method, which reduces transferability, can thus serve as a tool to safeguard the intellectual property (IP) of the model. It **provides a way to protect against unauthorized use, particularly in scenarios where there may be ethical or safety concerns associated with the application of the model on certain tasks**. We will clarify our motivation in the final version.

---
Reference:

[1] Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Models, ACM SIGSAC Conference
on Computer and Communications Security (CCS). ACM, 2023.

[2] Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint, arXiv preprint arXiv:2310.03693, 2023.

[3] Self-destructing models: Increasing the costs of harmful dual uses of foundation models. In Proceedings of the 2023 AAAI/ACM
Conference on AI, Ethics, and Society, pages 287–296, 2023.

[4]  Identifying and mitigating the security risks of generative ai. arXiv preprint arXiv:2308.14840, 2023.

Reviewer comment (Writing):
The definition of "task" is very broad. Would additional data be considered a new task? For example, would more 32x32 images to be classified into CIFAR-10 classes for a CIFAR-10 neural network count as a new task, or is it only when the classification head is modified?

Author response:
**[Task Definition]**

In our work, we did not consider adding more 32x32 images into CIFAR-10 (e.g., via augmentation) for classification as constituting a new task. In the supervised learning setting, a task is defined by both its domain space (data distribution, e.g., CIFAR-10 vs. ImageNet) and its label space (e.g., classification with different classes, classification vs. object detection). Therefore, a task is considered a new task when either its domain space is different or its label space is different.

**[Evaluation and Performance]**

We would like to emphasize that our objective in this paper is **not centered on protecting specific neural networks (NNs)**. Instead, we aim to discover secure architectures for individuals who seek to build NNs for various tasks. The obtained secure architecture can then be deployed with reduced risk of misuse.

Regarding performance degradation, it is the "security budget" for transferability reduction, which is simply a design choice that is faced by any security solutions, i.e., the tradeoff between security and performance. As a generic solution, our method can adjust this budget by modifying $\lambda$ in the fitness score. A higher $\lambda$ will result in lower performance degradation on the source task.

**[Zero-cost Proxies]**

It appears there might be **a misunderstanding regarding our use of zero-cost proxies**. In our work, we employed them to train a performance predictor. For instance, some studies use architectures' accuracy to train NAS predictors [1], whereas we leverage zero-cost proxies. To tackle out-of-training-distribution challenges, the predictor undergoes meta-training. This approach aligns with the rationale presented in [2], where meta-learning has been demonstrated to be effective in out-of-training-distribution scenarios [3].

---
Reference:

[1] Brp-nas: Prediction-based nas using gcns. Advances in Neural Information Processing Systems, 33:10480–10490, 2020.

[2]  Rapid neural architecture search by learning to generate graphs from datasets. In International Conference on Learning Representations, 2021.

[3] Model-agnostic meta-learning for fast adaptation of deep networks. In International conference on machine learning, pages 1126–1135. PMLR, 2017.

Reviewer comment (Experiments):
The evaluation is limited to NAS benchmarks, which makes it harder to appreciate the motivation of the paper. If evaluation was done on some neural network that someone actually wants to protect, it would have been more convincing.

Author response:
Thanks for your reply.

**[For issue 1]**

We used image generation and diffusion models as examples to address your question, "Why even release its parameters to begin with?" and to provide a better understanding. However, the vulnerability is general and not limited to generative tasks. Also, like all other work conducted on NAS Benchmarks, the objective is to provide a fair comparison. Your current concern seems centered on the existing NAS Benchmarks being less meaningful (or are you questioning the practical significance of NAS?). However, it's crucial to note that constructing NAS benchmarks is not the primary focus of our work. If someone proposes a diffusion model-based benchmark for generative tasks, we are willing to test our method on that. Additionally, our method holds promise for real-world scenarios as NAS has already been employed to design high-performance models for tasks. With our approach, the resulting models can not only exhibit superior performance but also boast enhanced security measures. 

**[For issue 2]**

We have explained that accuracy degradation is a design choice, and one can adjust it by modifying 
λ in the fitness score. We would like to provide more experiments as a discussion in the appendix.

**[For the newly raised question: comparison for TK]**

As we mentioned in the introduction, our focus is on how to determine and simulate the potential target task if it is not specified, and our method centers on this case and proposes TU. **Archlock-TK is already a comparison method designed for TU, and is not meaningful to include other comparison methods for our comparison method.** Also, we have explained why current cross-task or multi-objective NAS cannot be compared with TU in Section 2.1. 

**[Summary]**

**Our formulation and methodology constitute the primary contribution we aim to make to the field, which has been acknowledged by other reviewers who think that our formulation is solid.**  We are the first to address this vulnerability by proposing a methodology leveraging NAS, thus we experiment with NAS benchmarks. Since more advanced benchmarks have not been proposed,  the experiment design you suggested is challenging at this time. However, our current experiments are sufficient to demonstrate the effectiveness of our method, and it not undermine our contribution. It's crucial to emphasize that our motivation is well-justified, the vulnerability is practical, and our methodology is well-formulated.

Moreover, **considering that we were the first to identify this vulnerability and propose an effective mitigation method, our work has the potential to raise awareness among other researchers regarding this vulnerability. This could pave the way for them to propose more advanced solutions, building upon the foundation laid by our work.** 

**If you also agree that a rating of 3 is underrated, we kindly encourage you to raise it to the next level.**

Reviewer comment (Evaluation):
A 2% performance degradation on CIFAR-level neural networks is actually quite large.

Author response:
**[Task Definition]**

In our work, we did not consider adding more 32x32 images into CIFAR-10 (e.g., via augmentation) for classification as constituting a new task. In the supervised learning setting, a task is defined by both its domain space (data distribution, e.g., CIFAR-10 vs. ImageNet) and its label space (e.g., classification with different classes, classification vs. object detection). Therefore, a task is considered a new task when either its domain space is different or its label space is different.

**[Evaluation and Performance]**

We would like to emphasize that our objective in this paper is **not centered on protecting specific neural networks (NNs)**. Instead, we aim to discover secure architectures for individuals who seek to build NNs for various tasks. The obtained secure architecture can then be deployed with reduced risk of misuse.

Regarding performance degradation, it is the "security budget" for transferability reduction, which is simply a design choice that is faced by any security solutions, i.e., the tradeoff between security and performance. As a generic solution, our method can adjust this budget by modifying $\lambda$ in the fitness score. A higher $\lambda$ will result in lower performance degradation on the source task.

**[Zero-cost Proxies]**

It appears there might be **a misunderstanding regarding our use of zero-cost proxies**. In our work, we employed them to train a performance predictor. For instance, some studies use architectures' accuracy to train NAS predictors [1], whereas we leverage zero-cost proxies. To tackle out-of-training-distribution challenges, the predictor undergoes meta-training. This approach aligns with the rationale presented in [2], where meta-learning has been demonstrated to be effective in out-of-training-distribution scenarios [3].

---
Reference:

[1] Brp-nas: Prediction-based nas using gcns. Advances in Neural Information Processing Systems, 33:10480–10490, 2020.

[2]  Rapid neural architecture search by learning to generate graphs from datasets. In International Conference on Learning Representations, 2021.

[3] Model-agnostic meta-learning for fast adaptation of deep networks. In International conference on machine learning, pages 1126–1135. PMLR, 2017.

Reviewer comment (Evaluation):
Zero-cost proxies are meant to gauge accuracy in general and have not been verified to work for the specific task of minimizing out-of-training-distribution accuracy.

Author response:
**[Task Definition]**

In our work, we did not consider adding more 32x32 images into CIFAR-10 (e.g., via augmentation) for classification as constituting a new task. In the supervised learning setting, a task is defined by both its domain space (data distribution, e.g., CIFAR-10 vs. ImageNet) and its label space (e.g., classification with different classes, classification vs. object detection). Therefore, a task is considered a new task when either its domain space is different or its label space is different.

**[Evaluation and Performance]**

We would like to emphasize that our objective in this paper is **not centered on protecting specific neural networks (NNs)**. Instead, we aim to discover secure architectures for individuals who seek to build NNs for various tasks. The obtained secure architecture can then be deployed with reduced risk of misuse.

Regarding performance degradation, it is the "security budget" for transferability reduction, which is simply a design choice that is faced by any security solutions, i.e., the tradeoff between security and performance. As a generic solution, our method can adjust this budget by modifying $\lambda$ in the fitness score. A higher $\lambda$ will result in lower performance degradation on the source task.

**[Zero-cost Proxies]**

It appears there might be **a misunderstanding regarding our use of zero-cost proxies**. In our work, we employed them to train a performance predictor. For instance, some studies use architectures' accuracy to train NAS predictors [1], whereas we leverage zero-cost proxies. To tackle out-of-training-distribution challenges, the predictor undergoes meta-training. This approach aligns with the rationale presented in [2], where meta-learning has been demonstrated to be effective in out-of-training-distribution scenarios [3].

---
Reference:

[1] Brp-nas: Prediction-based nas using gcns. Advances in Neural Information Processing Systems, 33:10480–10490, 2020.

[2]  Rapid neural architecture search by learning to generate graphs from datasets. In International Conference on Learning Representations, 2021.

[3] Model-agnostic meta-learning for fast adaptation of deep networks. In International conference on machine learning, pages 1126–1135. PMLR, 2017.

Reviewer comment (Novelty):
Since the proposed method is based on a predictor, maybe it is better to cite a series of predictor-based NAS work. For example, PINAT: A Permutation INvariance Augmented Transformer for NAS Predictor AAAI 2023 TNASP: A Transformer-based NAS Predictor with a Self-evolution Framework NeurIPS 2021 and so on.

Author response:
Thanks for pointing out these references; we will cite these works in the proper place in the final version.