The paper addresses the problem of defending open-weight language models against unauthorized fine-tuning.

An adaptive attacker with full access to weights and architectures can reverse simple structural defenses and use optimization to defeat locking mechanisms.

The authors propose DLR-Lock, a method that exploits the inference–training asymmetry of automatic differentiation.

In DLR-Lock, each pretrained MLP in the model is replaced with a deep low-rank residual network (DLR-Net) of comparable parameter count.

This forces activation memory that grows linearly with depth during backpropagation, making fine-tuning memory-intensive.

The DLR-Nets are efficiently trained via module-wise distillation to preserve the original model’s capabilities.

The defense also creates architectural mismatches that complicate the optimization landscape of standard fine-tuning, with the backward pass incurring disproportionately more overhead than the forward pass.

Experiments on LLMs validate that the defense withstands adaptive attackers with full knowledge of the strategy while maintaining the original model’s performance.