Non-transferable Examples for AI Authorization

• Non-transferable Examples (NEs) are a model-specific authorization mechanism that recodes inputs to preserve performance for an authorized AI model while degrading usability for others.
• They leverage a training-free, data-agnostic recoding based on low-sensitivity subspaces of the model's first linear layer, using singular value decomposition.
• Empirical tests across vision and vision-language models show that NEs maintain nearly identical performance on the authorized model while causing unauthorized models to collapse.

Non-transferable Examples (NEs) are a model-specific authorization mechanism for AI systems in which an input-side recoding $T:\mathcal X\to\mathcal X$ preserves usability for one authorized model $f^\star$ while degrading usability for unauthorized models $f'\in\mathcal F\setminus\{f^\star\}$. In "Catch-Only-One: Non-Transferable Examples for Model-Specific Authorization," NEs are introduced as a training-free and data-agnostic method that recodes inputs within a model-specific low-sensitivity subspace of the authorized model’s first linear layer, so that the authorized model retains performance whereas non-target models fail because of subspace misalignment (Wang et al., 13 Oct 2025). The framework is motivated by the need for data that remain useful for innovation while resistant to misuse at the model level, and it differs from approaches that perturb data to make it unlearnable or retrain models to suppress transfer, because it acts at inference time and does not require control over training.

1. Problem formulation and core definition

The formal setting fixes an ambient input space $\mathcal X\subseteq\mathbb R^n$, an authorized model $f^\star:\mathcal X\to\mathcal Y$, a family of models $\mathcal F$ trained on the same domain, and a scalar task metric $m(f,x)$ in which smaller values mean better usability. The goal is to construct a recoding $T$ such that, for $\tilde x=T(x)$, authorized-utility retention holds: $$\mathbb E_x[m(f^\star,\tilde x)]-\mathbb E_x[m(f^\star,x)]\le \rho,$$ while unauthorized-utility degradation holds: $f^\star$0 This formulation makes NEs an input-side usage-control mechanism rather than a training-time defense (Wang et al., 13 Oct 2025).

The construction uses the first linear layer of the authorized model. Writing that layer as $f^\star$1, with bias absorbed into $f^\star$2 by homogeneously augmenting $f^\star$3, one computes the singular value decomposition

$f^\star$4

For a threshold $f^\star$5, the $f^\star$6-insensitive subspace is

$f^\star$7

A perturbation $f^\star$8 then satisfies $f^\star$9. An NE is formed as

$f'\in\mathcal F\setminus\{f^\star\}$0

where $f'\in\mathcal F\setminus\{f^\star\}$1 is obtained by zeroing coordinates $f'\in\mathcal F\setminus\{f^\star\}$2 with $f'\in\mathcal F\setminus\{f^\star\}$3 and sampling the remaining coordinates, for example $f'\in\mathcal F\setminus\{f^\star\}$4, followed if needed by scaling to ensure $f'\in\mathcal F\setminus\{f^\star\}$5 (Wang et al., 13 Oct 2025).

2. Recoding mechanism and model specificity

The same construction can be written as a projection. If $f'\in\mathcal F\setminus\{f^\star\}$6 is the orthogonal projector onto the span of the $f'\in\mathcal F\setminus\{f^\star\}$7 right singular vectors whose singular values satisfy $f'\in\mathcal F\setminus\{f^\star\}$8, then

$f'\in\mathcal F\setminus\{f^\star\}$9

This emphasizes that NEs are created by restricting perturbations to directions that are low-sensitivity for the authorized model (Wang et al., 13 Oct 2025).

The method is explicitly training-free. It does not retrain $\mathcal X\subseteq\mathbb R^n$0 or any unauthorized model $\mathcal X\subseteq\mathbb R^n$1; instead, it probes $\mathcal X\subseteq\mathbb R^n$2’s first-layer SVD once on a small probe set and computes $\mathcal X\subseteq\mathbb R^n$3 and $\mathcal X\subseteq\mathbb R^n$4. It is also data-agnostic in the sense that the same projector $\mathcal X\subseteq\mathbb R^n$5 applies to any $\mathcal X\subseteq\mathbb R^n$6, including images and text tokens, without task-specific surrogate labels or losses. The private authorization information is therefore concentrated in the model-specific parameters $\mathcal X\subseteq\mathbb R^n$7, while the recoding function $\mathcal X\subseteq\mathbb R^n$8 can remain public (Wang et al., 13 Oct 2025).

The key structural hypothesis is subspace misalignment. Different models, whether due to different architectures or different random initializations, have distinct first-layer singular bases $\mathcal X\subseteq\mathbb R^n$9. Directions that are low-sensitivity for $f^\star:\mathcal X\to\mathcal Y$0 typically correspond to moderate- or high-sensitivity directions in an unauthorized model $f^\star:\mathcal X\to\mathcal Y$1. Under that condition, a perturbation that is nearly invisible to the authorized model can create a large first-layer feature shift for a non-target model (Wang et al., 13 Oct 2025).

3. Theoretical guarantees

The first guarantee concerns retention for the authorized model. If $f^\star:\mathcal X\to\mathcal Y$2 is formed with $f^\star:\mathcal X\to\mathcal Y$3 nonzero Gaussian entries of variance $f^\star:\mathcal X\to\mathcal Y$4, then for any $f^\star:\mathcal X\to\mathcal Y$5, with probability at least $f^\star:\mathcal X\to\mathcal Y$6,

$f^\star:\mathcal X\to\mathcal Y$7

The proof sketch given in the paper uses

$f^\star:\mathcal X\to\mathcal Y$8

then bounds $f^\star:\mathcal X\to\mathcal Y$9, and controls $\mathcal F$0 with Chebyshev’s inequality because it is a chi-squared sum with mean $\mathcal F$1 and variance $\mathcal F$2. The paper further states that small first-layer changes are typically attenuated by ReLU or truncation and later layers, so $\mathcal F$3, which realizes the retention constraint (Wang et al., 13 Oct 2025).

The second guarantee concerns degradation for unauthorized models. For another model $\mathcal F$4 with first layer $\mathcal F$5, a perturbation drawn from $\mathcal F$6 will generally not lie in $\mathcal F$7. The analysis invokes the Hoffman–Wielandt inequality on singular vectors. If $\mathcal F$8, $\mathcal F$9, and $m(f,x)$0 uses the $m(f,x)$1-th right singular direction with $m(f,x)$2, and if

$m(f,x)$3

is the nearest gap between $m(f,x)$4 and the singular values of $m(f,x)$5, then for any $m(f,x)$6,

$m(f,x)$7

The proof sketch decomposes $m(f,x)$8 into a singular-vector difference term and a singular-value difference term, bounds $m(f,x)$9, uses $T$0, and exploits $T$1. The paper then states that when $T$2 and $T$3 arise from different random initializations or architectures, $T$4 is $T$5 and $T$6 is $T$7, so the right-hand side can be large even if $T$8 itself is small, causing a substantial feature shift at layer 1 for the unauthorized model (Wang et al., 13 Oct 2025).

A plausible implication is that the theory is strongest at the interface between linearized first-layer geometry and practical model mismatch: the formal bounds are stated for first-layer feature deviation, while the downstream prediction failure is argued through propagation of that shift.

4. Empirical behavior across vision backbones and vision-LLMs

The empirical results are reported for image classification and vision-LLMs, with perturbations set to a $T$9 dB PSNR regime. The classification experiments use ResNet-50, ViT-B/p16, SwinV2-T, DeiT-B, and MambaVision-T on CIFAR-10 and ImageNet-1K; the vision-language evaluation uses InternVL3-1B as the authorized model and Qwen2.5-VL-3B as the unauthorized model on MMBench (Wang et al., 13 Oct 2025).

Setting	Authorized model behavior	Unauthorized model behavior
ImageNet cross-architecture transfer	ResNet-50 retains 80.2% top-1 vs. 80.3% clean	All other models collapse to $\tilde x=T(x)$0 top-1
Weight-variant transfer	Target ResNet-50 remains usable	Second ResNet-50 with different random seed yields $\tilde x=T(x)$1 accuracy
MMBench VLM evaluation	InternVL3 overall 72.7% $\tilde x=T(x)$2 72.6%	Qwen2.5 overall 78.8% $\tilde x=T(x)$3 18.3%

For cross-architecture transfer on ImageNet, the paper reports that $\tilde x=T(x)$4 generated for ResNet-50 retains $\tilde x=T(x)$5 top-1 accuracy on ResNet-50, compared with $\tilde x=T(x)$6 on clean inputs, while all other models collapse to approximately $\tilde x=T(x)$7 top-1. It further states that similar behavior holds for each authorized target, with diagonal entries close to clean accuracy within $\tilde x=T(x)$8 and off-diagonal transfer near chance. For weight-variant transfer, two ResNet-50 instances trained from different random seeds are sufficient for model specificity: NEs for one model yield approximately $\tilde x=T(x)$9 accuracy on the other (Wang et al., 13 Oct 2025).

The baseline comparison in the same study positions NEs against Differential Privacy training, Fully Homomorphic Encryption, and AlgoSpec. The reported comparison is that Differential Privacy training with $$\mathbb E_x[m(f^\star,\tilde x)]-\mathbb E_x[m(f^\star,x)]\le \rho,$$0 drops authorized accuracy by $$\mathbb E_x[m(f^\star,\tilde x)]-\mathbb E_x[m(f^\star,x)]\le \rho,$$1–$$\mathbb E_x[m(f^\star,\tilde x)]-\mathbb E_x[m(f^\star,x)]\le \rho,$$2 and is inapplicable to Transformers; Fully Homomorphic Encryption preserves accuracy but incurs $$\mathbb E_x[m(f^\star,\tilde x)]-\mathbb E_x[m(f^\star,x)]\le \rho,$$3–$$\mathbb E_x[m(f^\star,\tilde x)]-\mathbb E_x[m(f^\star,x)]\le \rho,$$4 latency; AlgoSpec collapses authorized accuracy to near-zero. By contrast, NEs preserve authorized accuracy within $$\mathbb E_x[m(f^\star,\tilde x)]-\mathbb E_x[m(f^\star,x)]\le \rho,$$5, deny unauthorized models with $$\mathbb E_x[m(f^\star,\tilde x)]-\mathbb E_x[m(f^\star,x)]\le \rho,$$6–$$\mathbb E_x[m(f^\star,\tilde x)]-\mathbb E_x[m(f^\star,x)]\le \rho,$$7 top-1, and incur zero inference overhead beyond one input-side matrix multiplication (Wang et al., 13 Oct 2025).

For vision-LLMs on MMBench, the reported metrics include AR, CP, FP-C, FP-S, LR, RR, and overall. The authorized InternVL3-1B changes from $$\mathbb E_x[m(f^\star,\tilde x)]-\mathbb E_x[m(f^\star,x)]\le \rho,$$8 to $$\mathbb E_x[m(f^\star,\tilde x)]-\mathbb E_x[m(f^\star,x)]\le \rho,$$9 overall, whereas unauthorized Qwen2.5-VL-3B changes from $f^\star$00 to $f^\star$01, with all sub-metrics collapsing into the teens. The paper also states that NEs survive standard resizing, cropping, JPEG, blurring, and the complex, model-specific preprocessing pipelines of modern VLMs (Wang et al., 13 Oct 2025).

5. Implementation details and operational limits

The implementation described in the paper is intentionally lightweight. Basis estimation uses a probe set of approximately $f^\star$02 samples to compute the SVD of the first linear map, whether fully connected or im2col-unfolded convolution. A threshold $f^\star$03 selects $f^\star$04 insensitive directions. The vector $f^\star$05 is i.i.d. Gaussian on those $f^\star$06 coordinates and zero elsewhere. The perturbation is then scaled according to

$f^\star$07

so that $f^\star$08 dB, corresponding to approximately $f^\star$09–$f^\star$10 of the image norm. The recoding function $f^\star$11 can be public, while the model-specific parameters $f^\star$12 remain private (Wang et al., 13 Oct 2025).

The limitations are also explicit. A strong adaptive attacker might approximate $f^\star$13 using massive queries or side-channels and then project $f^\star$14 back onto its complement, partially restoring utility. Extremely aggressive preprocessing, including heavy cropping or extreme JPEG, can shrink the relative energy of $f^\star$15. The formal analysis focuses on first-layer effects, and extending provable bounds through deeper nonlinear layers remains open. The paper notes that dynamic defenses such as randomized $f^\star$16 and time-varying bases can raise attacker cost, but at the expense of occasional authorized jitter (Wang et al., 13 Oct 2025).

A common misconception is to treat NEs as a universal obfuscation mechanism. The paper does not claim that; the mechanism is model-specific, its strongest guarantees are first-layer guarantees, and its resistance to adaptive recovery is presented as conditional rather than absolute.

6. Relation to adjacent literatures and terminological ambiguity

The acronym “NEs” is not unique across the literature. In "Transferable Unlearnable Examples," the phrase “non-transferable” appears in a different sense: Error-Minimizing Noise perturbations are described as non-transferable because their unlearnable effect fails to transfer across training algorithms and across datasets. That paper introduces Classwise Separability Discriminant and a contrastive bi-level objective to produce Transferable Unlearnable Examples, with the goal of making perturbations transferable to multiple training settings and datasets (Ren et al., 2022). This is conceptually distinct from model-specific authorization, where non-transferability is the intended property and operates at inference rather than training.

The term also appears in an unrelated domain in "Targeting Without Transfers," where “non-transferable examples (NEs)” refers to canonical menu constructions in multidimensional screening without money, including pure options and, in the two-good symmetric case, at most one mixed bundle (Tokarski, 31 Jan 2026). This usage belongs to mechanism design rather than machine learning.

Within AI security and data governance, the significance of the 2025 NEs proposal is therefore specific: it reframes non-transferability as a desirable authorization primitive. Instead of making data globally unusable, it makes data selectively usable by exactly one authorized model. The paper’s own summary states that NEs leverage model-specific low-sensitivity subspaces of the first linear layer to produce a simple, training-free, data-agnostic recoding that “ciphers” data for exactly one authorized model while rendering it unusable for any other (Wang et al., 13 Oct 2025).