Apple researchers have proposed a defense for open-weight language models that tries to keep models usable for inference while making later fine-tuning much harder. The method, called DLR-Lock, replaces pretrained multilayer perceptron blocks with deep low-rank residual networks that preserve the original model’s behavior through distillation.
The practical issue is familiar: sharing weights lets researchers and developers run, inspect, and adapt models on their own systems, but it also makes it possible to modify those models for uses the publisher did not intend. Simple locking mechanisms are weak because attackers can see the full architecture and weights.
DLR-Lock instead exploits a difference between inference and training. The replacement blocks are designed so a forward pass remains efficient enough for normal use, while backpropagation during fine-tuning requires activation memory that grows with depth. The paper says this creates both memory pressure and optimization mismatches for adaptive attackers who know the defense.
The approach is research, not a general policy answer to open-weight risk. It points to a narrower technical trade-off: model publishers may be able to keep some openness benefits while raising the cost of repurposing a released checkpoint.