Research map / Label-efficient and robust learning / Domain adaptation and generalization
MAP: MAsk-Pruning for Source-Free Model Intellectual Property Protection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MAP, a binary mask-pruning framework that freezes a well-trained source model and learns a target-specific mask to suppress unauthorized-domain generalization while preserving source accuracy, extended to source-free (SF-MAP) and data-free (DF-MAP) settings with a new ST-D metric.
Problem
Protecting model intellectual property by restricting a well-trained model's applicability to authorized domains, without access to source training data or target unauthorized data (source-free and data-free settings).
Approach
Inverse Transfer Parameter Hypothesis: well-trained models contain domain-specific parameters whose pruning removes generalization to unauthorized domains while preserving source performance; MAP learns a binary mask over a frozen source model, with pseudo-source samples from replay-based generators (and a diversity generator for data-free) replacing the real data.
Key results
- SA-MAP achieves mean source drop of -0.3% and ST-D of -0.004 on digit benchmarks, versus NTL (1.1%, 0.013) and CUTI (0.3%, 0.004).
- SF-MAP achieves mean source drop of 8.8% and ST-D of 0.24 in the source-free setting, while NTL and CUTI show source drops of 68.9% and 87.4%.
- DF-MAP attains ST-D below 1.0 across all digit pairs in the data-free setting, with mean ST-D of 0.27.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use source-available binary-mask pruning | MAP · Digit benchmarks (mean) | ST-D: 0.004 -> -0.004 | Helped |
| use source-free replay-based pseudo-source generation and target data | MAP · Digit benchmarks (mean) | ST-D: 1.01 (NTL), 1.08 (CUTI) -> 0.24 | Helped |
| use data-free diversity generation of auxiliary domains | MAP · Digit benchmarks (mean) | ST-D: 0.27 | Helped |
| use SF-MAP instead of supervised learning across tested backbones (ablation) | MAP · STL10 → CIFAR10 | target accuracy: 50.3 -> 15.7; 61 -> 21.4; 58.9 -> 36.9; 36.2 -> 20.7; 38 -> 24.6; 72.5 -> 47; 39.2 -> 28.1 | Mixed |
| use L1 consistency loss alone instead of the full SF-MAP loss (ablation) | SF-MAP · MT → US, CIFAR10 → STL10, VisDA-2017 (T → V) | target accuracy | Hurt |
| use L2 pseudo-label loss alone instead of the full SF-MAP loss (ablation) | SF-MAP · MT → US, CIFAR10 → STL10, VisDA-2017 (T → V) | source accuracy | Hurt |
| combine L1 consistency loss and L2 pseudo-label loss (ablation) | SF-MAP · MT → US, CIFAR10 → STL10, VisDA-2017 (T → V) | target accuracy | Helped |
Surprising findings
- SA-MAP slightly outperforms the original source model on source-domain accuracy (-0.3% drop), which the authors attribute to pruning removing redundant parameters.
Limitations
- Source-free and data-free baselines are not established; NTL and CUTI are adapted by swapping in synthetic samples.
- Evaluation limited to small digit and CIFAR/STL/VisDA image benchmarks with VGG-style backbones.
Experimental setup
Datasets: MNIST USPS SVHN MNIST-M CIFAR10 STL10 VisDA-2017
Benchmarks: MNIST USPS SVHN MNIST-M CIFAR10 STL10 VisDA-2017
Metrics: source drop target drop ST-D accuracy
Baselines: NTL CUTI
Builds on: lottery ticket hypothesis NTL CUTI-Domain data-free knowledge distillation
Closest papers by meaning
- EncryIP: A Practical Encryption-Based Framework for Model Intellectual Property Protection (AAAI 2024 · similarity 0.85)
- Vision-Language Model IP Protection via Prompt-based Learning (CVPR 2025 · similarity 0.84)
- Adversarial Feature Map Pruning for Backdoor (ICLR 2024 · similarity 0.84)
- IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking (AAAI 2024 · similarity 0.84)
- EntropyMark: Towards More Harmless Backdoor Watermark via Entropy-based Constraint for Open-source Dataset Copyright Protection (CVPR 2025 · similarity 0.83)
- RAEncoder: A Label-Free Reversible Adversarial Examples Encoder for Dataset Intellectual Property Protection (CVPR 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.