Research map / Adversarial robustness and security / Attacks on text and graphs

Catch-Only-One: Non-Transferable Examples for Model-Specific Authorization

NeurIPS 2026 · Adversarial robustness and security › Attacks on text and graphs · approach: LLM jailbreak and injection defense

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes non-transferable examples (NTEs), a training-free input recoding that perturbs data within an authorized model's low-sensitivity first-layer subspace so only that model can use it, with bounds and vision/VLM experiments.

Problem

Enforcing purpose limitation on released data so that it stays usable by an authorized model while degrading utility for any other, unknown model, without retraining or control of downstream training/deployment.

Approach

Recode inputs with perturbations confined to the authorized model's tau-insensitive subspace (small-singular-value right singular vectors of its first-layer operator), which leaves the authorized model's first-layer output nearly unchanged while misaligned unauthorized models amplify the perturbation; gives formal retention and degradation bounds.

Key results

• At 20 dB PSNR on ImageNet, authorized ResNet-50 top-1 stays at 80.2% (from 80.3% clean) while cross-architecture unauthorized models fall to roughly 0.0-12.9%.
• On MMBench, authorized InternVL3-1B keeps 72.6% overall (vs 72.7% baseline) while unauthorized Qwen2.5-VL-3B drops from 78.8% to 18.3%.
• Learned adaptation attacker with full supervision on matched encoded data stays at random-guess (about 10-11%) across five backbones.

Surprising findings

• Same-architecture ViT-B attacker trained on encoded data still collapses, so matching architecture is not enough without exact authorized weights.
• SwinV2 on ImageNet shows a larger authorized accuracy drop (80.9% to 71.7%) attributed to its patch-merging pipeline.

Limitations

• Method-aware or parameter-aware adversaries may recover the subspace and partially cancel the recoding via projection.
• A training-time adversary can counter-adapt by regularizing sensitivity so insensitive directions shrink, potentially recovering unauthorized utility.
• Overlapping convolutional stems are only approximately covered by the theory; guarantees rely on local Jacobian constants and extension to deeper layers remains open.

Experimental setup

Datasets: ImageNet-1K CIFAR-10 MMBench HAM10000 GLUE

Benchmarks: CIFAR-10 ImageNet-1K MMBench HAM10000 GLUE

Metrics: top-1 accuracy MMBench accuracy PSNR SNR (dB)

Baselines: DP training (DiffPrivLib) FHE (CKKS, TenSEAL) AlgoSpec SR-ResNet reconstruction attacker

Builds on: adversarial examples unlearnable examples non-transferable learning differential privacy fully homomorphic encryption

Closest papers by meaning

• A3: Few-shot Prompt Learning of Unlearnable Examples with Cross-Modal Adversarial Feature Alignment (CVPR 2025 · similarity 0.85)
• RAEncoder: A Label-Free Reversible Adversarial Examples Encoder for Dataset Intellectual Property Protection (CVPR 2025 · similarity 0.84)
• Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable (NeurIPS 2024 · similarity 0.84)
• Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.84)
• Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness (NeurIPS 2024 · similarity 0.84)
• Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise (AAAI 2024 · similarity 0.84)