Research map / Learning theory and algorithms / Matrix and tensor methods
Model Immunization from a Condition Number Perspective
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a condition-number-based framework for model immunization (making models hard to fine-tune on a harmful task while keeping pre-training utility), with two differentiable regularizers that monotonically increase/decrease the Hessian condition number, validated on linear models and ResNet18/ViT.
Problem
Model immunization lacks a precise definition of an immunized model and an understanding of when immunization is possible; existing empirical methods for text-to-image models do not explain why they work.
Approach
Analyze linear-probing convergence through the condition number of the Hessian theta^T K theta, define immunization via condition-number ratios, and add a new regularizer R_ill that provably increases the condition number alongside the existing R_well (which decreases it), applied to the feature extractor with gradient descent.
Key results
- On House Prices linear regression, the proposed method reaches RIR 356.20 vs 92.58 for Opt κ and about 2.0 for IMMA.
- On ImageNet-pretrained ResNet18 immunized against Country211, RIR_θ0 is 8.714 for the proposed method vs 1.472 for IMMA and 1.038 for the baseline; ViT with Cars reaches RIR_θ0 34.517 vs 26.369 for Opt κ.
- On deep nets, ImageNet accuracy stays near the initialization (ResNet18 drops 68.24% to 62.36% with Cars; ViT rises 81.78% to 82.79%).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the proposed condition-number regularized immunization algorithm instead of Opt κ | Linear feature extractor · House Price | RIR: 92.58 ± 4.492 -> 356.20 ± 5.491 | Helped |
| Use the proposed condition-number regularized immunization algorithm instead of Opt κ | Linear feature extractor · MNIST binary task pairs | RIR: 69.73 ± 54.00 -> 70.04 ± 3.280 | No clear effect |
| Use the proposed condition-number regularized immunization algorithm instead of Opt κ | ResNet18 · Cars | RIRθ₀: 1.527 ± 0.019 -> 3.467 ± 0.358 | Helped |
| Use the proposed condition-number regularized immunization algorithm instead of Opt κ | ResNet18 · Country211 | RIRθ₀: 1.472 ± 0.043 -> 8.714 ± 0.672 | Helped |
| Use the proposed condition-number regularized immunization algorithm instead of Opt κ | ViT · Cars | RIRθ₀: 26.369 ± 2.814 -> 34.517 ± 0.886 | Helped |
| Use the proposed condition-number regularized immunization algorithm instead of Opt κ | ViT · Country211 | RIRθ₀: 16.498 ± 5.183 -> 41.341 ± 0.967 | Helped |
| Immunize with the proposed algorithm rather than retain the initialization | ResNet18 · ImageNet after Cars immunization | test accuracy (%): 68.24% -> 62.36% ± 0.173 | Hurt |
| Immunize with the proposed algorithm rather than retain the initialization | ResNet18 · ImageNet after Country211 immunization | test accuracy (%): 68.24% -> 65.01% ± 0.143 | Hurt |
| Immunize with the proposed algorithm rather than retain the initialization | ViT · ImageNet after Cars immunization | test accuracy (%): 81.78% -> 82.79% ± 0.200 | Helped |
| Immunize with the proposed algorithm rather than retain the initialization | ViT · ImageNet after Country211 immunization | test accuracy (%): 81.78% -> 83.17% ± 0.075 | Helped |
Surprising findings
- For ViT, ImageNet test accuracy increased after immunization (81.78% to 82.79% on Cars and 83.17% on Country211).
- The baseline that only maximizes the R_ill regularizer also raises the condition number on the pre-training task, so it fails to immunize.
Limitations
- Theory covers only linear feature extractors and linear probing; deep-net results are empirical without theoretical guarantees.
- Monotonicity guarantees do not compose linearly when both regularizers and the supervised loss update the extractor jointly, so hyperparameter balancing is needed.
- Deep-net immunization updates only the last blocks and uses approximate Hessian estimates from 20 groups of 100 samples due to memory constraints.
Experimental setup
Datasets: House Prices MNIST ImageNet Stanford Cars Country211
Benchmarks: House Prices MNIST ImageNet Stanford Cars Country211
Metrics: relative immunization ratio (RIR) condition number ratio test accuracy
Baselines: IMMA Opt κ Identity (no feature extractor) Init. θ0 (ImageNet pre-trained)
Builds on: IMMA condition number regularization (R_well) linear probing
Closest papers by meaning
- Multi-concept Model Immunization through Differentiable Model Merging (AAAI 2025 · similarity 0.87)
- Learn to Vaccinate: Combining Structure Learning and Effective Vaccination for Epidemic and Outbreak Control (ICML 2025 · similarity 0.81)
- Immunogenicity Prediction with Dual Attention Enables Vaccine Target Selection (ICLR 2025 · similarity 0.80)
- Distraction is All You Need: Memory-Efficient Image Immunization against Diffusion-Based Image Editing (CVPR 2024 · similarity 0.79)
- CARES: Comprehensive Evaluation of Safety and Adversarial Robustness in Medical LLMs (NeurIPS 2025 · similarity 0.78)
- Model Steering: Learning with a Reference Model Improves Generalization Bounds and Scaling Laws (ICML 2025 · similarity 0.78)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.