On the Vulnerability of Parameter-Level Defenses to Model Merging Kuangpu Guo1,2 , Qingyan Zheng3 , Jian Liang2,3⋆ , Yongcan Yu2 , Zilei Wang1 , Ran He2,3 , and Tieniu Tan2,3,4 University of Science and Technology of China NLPR & MAIS, Institute of Automation, Chinese Academy of Sciences 3 School of Artificial Intelligence, University of Chinese Academy of Sciences 4 Nanjing University [email protected], [email protected] 1
arXiv:2606.30360v1 [cs.LG] 29 Jun 2026
2
Abstract. The training-free integration of expert models via model merging has exposed significant security risks, enabling free-riders to combine specialized models without authorization. Recent works propose parameter-level defenses that employ linear parameter transformations to neutralize this threat. In this paper, we systematically analyze such defenses and reveal that their protected task vectors are inherently small in magnitude. Consequently, the protected weights remain overwhelmingly dominated by the pretrained model. Based on this observation, we designate the pretrained model as a static reference anchor and propose the Anchor-Guided Attack (AGA) to circumvent existing safeguards. Specifically, AGA aligns the protected model with this anchor to recover the transformation matrix analytically. Extensive evaluations validate that AGA consistently bypasses both individual and composite defenses under realistic defense-agnostic scenarios. Furthermore, we provide Anchor-Repulsive Fine-tuning (ARF), a defense method to mitigate the anchor dominance leveraged by AGA. Empirical results confirm that ARF effectively defeats the proposed attack. Our code is available at https://github.com/krumpguo/secure-merge-attack. Keywords: Model Merging · Parameter-Space Defense · Anchor-Guided Attack · Intellectual Property Protection
1
Introduction
Adapting large-scale pretrained models to specialized downstream tasks via lightweight fine-tuning [41,48] has emerged as a prevailing paradigm in the deep learning community. This workflow is increasingly facilitated by open-source platforms, such as HuggingFace [40] and ModelScope [25], which host a vast repository of task-specific models. Given the proliferation of these specialized checkpoints, model merging [12, 15, 17] has gained prominence as a highly efficient strategy for constructing multi-task models [3, 49, 50]. By directly fusing ⋆
Corresponding author.
2
Guo. et al. Model Merging Upload
Effective Merged Model
Download
Model Owner Model Merging Proactive Defenses
Open Source Code Platform
Upload
Ineffective Merged Model
Unknown Free-rider Download Model Merging
Proactive Attack
Effective Merged Model
Ineffective Merged Model
Fig. 1: Illustration of proactive defense and attack in model merging.
the parameters of multiple fine-tuned models derived from a common pretrained backbone [21, 51], practitioners can effectively synthesize cross-task expertise without retraining from scratch. Despite its remarkable efficiency, the inherent openness of model merging introduces severe intellectual property (IP) [10, 44] risks. As illustrated in Fig. 1, adversaries can effortlessly aggregate publicly available checkpoints to inherit specialized capabilities without authorization or incurring any training costs. To prevent this illicit use, recent studies [18,22,36] have proposed proactive defense mechanisms designed to intentionally destroy unauthorized merged models while preserving their standalone performance. Specifically, by leveraging the coupled structure of model parameters (such as the natural pairing of query and key matrices), Params [18] applies diagonal and permutation matrices to transform the MLP and attention modules. Similarly, MergeBarrier [22] and MergeLock [36] protect the models using orthogonal and invertible matrices. These transformations successfully disrupt the linear connection between different fine-tuned models, leading to a severe performance drop for any unauthorized merging. Since existing protection methods fundamentally rely on linear transformations, the protected fine-tuned weights can be explicitly decomposed into a transP formed pretrained weight Wpre and a corresponding protected task vector τ P . A careful examination of these two components reveals a critical magnitude disparity. As illustrated in Fig. 2a, the norm of τ P is substantially smaller than that of P Wpre , typically by two to three orders of magnitude. Consequently, the parameter space of the protected fine-tuned model remains heavily dominated by the protected pretrained weights. Based on this empirical observation, we treat the pretrained model as a static reference anchor and propose the Anchor-Guided Attack (AGA) to circumvent these defenses. By formulating an alignment objective that minimizes the discrepancy between the protected model and this public anchor, AGA derives a recovery matrix that effectively reverses the protective transformations analytically.
On the Vulnerability of Parameter-Level Defenses to Model Merging
3
To handle the diverse protection mechanisms applied across distinct architectural modules, AGA employs a dual-solver analytical framework. For the continuous invertible or orthogonal matrices typically applied to multi-head attention modules, AGA formulates the attack as an overdetermined linear system, deriving a closed-form analytical recovery matrix via least squares regression [38]. Conversely, to address the discrete permutation matrices used to shuffle the hidden neurons in MLP blocks, where continuous approximations frequently induce numerical drift, AGA casts the recovery as a linear sum assignment problem [2]. By utilizing the Hungarian algorithm [20] with costs defined by negative cosine similarity, we achieve globally optimal discrete bipartite matching. Consequently, this dual-solver design ensures a mathematically rigorous and highly precise recovery of the protected architecture. We validate the effectiveness of our attack through a comprehensive crossmodal empirical study spanning both computer vision and natural language processing. Extensive experiments demonstrate that in realistic, defense-agnostic scenarios, AGA consistently bypasses state-of-the-art defenses. Specifically, upon applying our attack, the performance of the unauthorized merged model recovers up to 97% of the results achieved by an unprotected merged model. Furthermore, our approach successfully compromises both standalone defense mechanisms and their sophisticated composite configurations. To mitigate the security vulnerabilities exposed by AGA, we investigate adaptive countermeasures. Given that the attack fundamentally exploits the marginal norm of task vectors relative to their pretrained anchors, a robust defense requires proactively amplifying this norm during the fine-tuning phase. Therefore, we introduce Anchor-Repulsive Fine-tuning (ARF), a defensive strategy that employs a distance-based repulsive term specifically within the attention modules to eliminate the magnitude disparity leveraged by AGA. Experimental results demonstrated that ARF effectively prevents unauthorized merging while maintaining the standalone model’s utility with negligible performance degradation. Our contributions can be summarized as follows: • We perform a systematic analysis of parameter-level defenses and reveal that protected task vectors are orders of magnitude smaller than pretrained weights. Consequently, the parameter space of protected models remains heavily dominated by the pretrained backbone. • We propose AGA, the first universal attack framework capable of circumventing state-of-the-art parameter-level protections. By employing a specialized dual-solver design, AGA analytically recovers protective transformations, consistently bypassing both individual and composite defenses in realistic, defense-agnostic scenarios. • We introduce ARF, an adaptive defense strategy designed to neutralize the threat posed by AGA. By applying a localized repulsive force within the attention modules, ARF effectively prevents unauthorized merging while preserving the model’s standalone utility.
4
Guo. et al.
2
Preliminary
2.1
Model Merging and Task Arithmetic
Let θpre denote the parameters of the pre-trained model, and θi the parameters of a model fine-tuned on task Di . For n task-specific models { θ1 , ..., θn } derived from the same pretrained model θpre , model merging can be formulated as θm = M(θpre , θ1 , ..., θn ), where M represents a specific parameter-level fusion strategy. A prevalent model merging method is Task Arithmetic [17], which operates on task vectors defined as follows: \tau _i = \theta _{i} - \theta _{pre}.
(1)
To merge n expert models {θ1 , θ2 , ..., θn }, the merged model θm is constructed by applying a linear combination of their respective task vectors {τi }ni=1 to the pre-trained model: \theta _{m} = \theta _{pre} + \lambda \sum _{i=1}^n \tau _i,
(2)
where λ is a scaling factor. 2.2
Problem Formulation
Attack Scenario. In this paper, we consider two parties: the defender and the adversary. The defender fine-tunes a pretrained model on specialized data and releases it to the broader community to demonstrate its capabilities. The adversary acquires the open-source model and merges it with other models they control, all of which are fine-tuned from the same pretrained model. Defender’s Capability. The defender has full control over the model’s lifecycle. This includes both the training and post-training stages to render the model unmergeable while preserving its original task utility. Adversary’s Capability. The adversary has access to the public pre-trained model θpre and the protected proprietary model θfpt . Importantly, the adversary is agnostic to the protection state, meaning they do not know whether a specific model has been secured or which defense mechanism is deployed. Problem Setup. Let P erf (θ; D) denote the performance of a model with parameters θ on task D. Let θm be the result of merging an unprotected model p θA with another model θB , and θm be the result of merging a protected version p θA with θB . A defense is successful if the unauthorized merging of the protected model results in a significant performance collapse on task DA , Perf({\theta }_{m}^{p}; \mathcal {D_A}) \ll Perf(\theta _{m}; \mathcal {D_A}),
(3)
p while the individual performance of θA remains preserved. An attack is conp a sidered successful if it can recover a model θA from θA such that the resulting a merged model θm restores the original performance as follows:
Perf ({\theta }_{m}^{a}; \mathcal {D_{A,B}}) \approx Perf(\theta _{m}; \mathcal {D_{A,B}}).
(4)
On the Vulnerability of Parameter-Level Defenses to Model Merging
2.3
5
Existing Defense Mechanisms
To safeguard proprietary expert models, several state-of-the-art defenses have been proposed. These methods generally apply secret parameter transformations to disrupt the linear arithmetic required for model merging while maintaining single-task utility. Params and Params-D. The Params [18] defense introduces secret linear transformations into the weight space to disrupt unauthorized merging while preserving single-task utility. For a two-layer MLP defined as: MLP(X) = W_2 \sigma (W_1 X + b_1) + b_2,
(5)
the protected weights (W1p , W2p , bp1 ) are formulated as: W_{1}^p = P W_{1}, \quad W_{2}^p = W_{2}P^T, \quad b_1^p = P b_1,
(6)
where P is a secret permutation matrix with exactly one "1" in each row and column and "0"s elsewhere. For the multi-head attention module, the standard operation with its corresponding output projection is defined as: Attention = \text {softmax}\left (\frac {W_QW_K^T}{\sqrt {d}}\right )W_VW_O.
(7)
Params [18] safeguards the weights of each attention head by applying two independent diagonal matrices, A and B, as follows: W_Q^p = W_QA, \quad W_K^p = W_KA^{-1}, \quad W_V^p = W_VB, \quad W_O^p = B^{-1}W_O.
(8)
An advanced variant, Params-D [18], further complicates unauthorized extraction by applying random dropout to the transformed weights. MergeBarrier. Building upon similar parameter-space transformation principles, this defense [22] protects the attention mechanism through orthogonal matrix transformations, while securing the MLP layers by approximating the activation functions via Taylor expansion to prevent unwanted merging. MergeLock. This method [36] secures the attention modules by applying secret invertible matrices to disrupt weight alignment. The details of these defense methods and more related work can be found in the supplementary material.
3
Proposed Attack Method
In the context of model merging, the fine-tuned weights can be formulated as Wf t = Wpre + τ . When a defense mechanism applies a secret linear transformation P (e.g., an invertible or permutation matrix [18, 22, 36]) to protect the model, the transformation is distributed across both components: W^p = W_{ft} P = (W_{pre} + \tau ) P = W_{pre} P + \tau P.
(9)
Our methodology is driven by a critical empirical observation regarding this distribution: the magnitude of the transformed task vector τ P is substantially
6
Guo. et al.
107
P Wpre
L1 Norm Sum
B
P
106
a merge
merge
105
a A A
pre
104
p merge Our Attack
basin 2 p A
basin 1
103 102 Params
SOTA Protection
MergeLock MergeBarrier
(a) Comparison of Frobenius norm.
(b) Loss landscape.
Fig. 2: Analysis of parameter magnitude and optimization landscape. (a) Comparison P of the Frobenius norm between the protected pretrained weights (Wpre ) and the proP tected task vector (τ ) on the ViT-B/32 model finetuend on Cars. (b) Loss landscape illustration of our attack against the state-of-the-art (SOTA) protections.
smaller than that of the transformed anchor Wpre P , typically by two to three orders of magnitude (as illustrated in Fig. 2a). Consequently, the parameter space of the protected model is overwhelmingly dominated by the Wpre P term, rendering the contribution of τ P virtually negligible in comparison. This magnitude disparity directly motivates our Anchor-Guided Attack (AGA). By leveraging the approximation W p ≈ Wpre P , we optimize a recovery matrix T to realign the protected weights with the public pretrained anchor, targeting the objective W p T = Wpre . Because the dominant anchor term overwhelmingly dictates the optimization landscape, this alignment mathematically forces P T ≈ I, effectively converging to the exact inverse T ≈ P −1 . Therefore, as shown in Fig. 2b, AGA seamlessly bypasses the defense and extracts the original finetuned weights (W a ) without requiring any knowledge of the defense specifics: W^a = W^p T \approx (W_{pre} P + \tau P) P^{-1} = W_{ft}.
(10)
Building upon this core insight, AGA deploys two tailored analytical solvers: one for continuous transformations within the attention modules, and another for discrete permutations within the MLP modules. 3.1
Continuous Attack for Attention via Least Squares
Previous defenses typically protect the multi-head attention [33] modules by applying continuous invertible, orthogonal, or diagonal matrices. Given our alignment objective W p T = Wpre , recovering the continuous matrix T is mathematically equivalent to fitting an overdetermined linear system. While defenders often apply coupled transformations across specific modules (e.g., structurally paired Query and Key), a realistic adversary remains strictly agnostic to these secret defense configurations. To circumvent this without losing generalizability, AGA strategically decouples the estimation process, solving an independent linear system for each projection matrix.
On the Vulnerability of Parameter-Level Defenses to Model Merging
7
p Formally, for any protected attention matrix W p ∈ {WQp , WK , WVp , WOp } and its corresponding pretrained anchor Wpre , we formulate a least squares [38] objective to solve for the universal transformation T empirically:
\min _{T} \| W^p T - W_{pre} \|_F^2,
(11)
where ∥ · ∥F denotes the Frobenius norm. Setting the derivative to zero yields the closed-form analytical inverse: T^* = ((W^p)^T W^p)^{-1} (W^p)^T W_{pre}.
(12)
Applying this closed-form solution independently to each module yields a distinct ∗ optimal recovery matrix (TQ∗ , TK , TV∗ , and TO∗ ). The fully recovered attention weights are thus explicitly formulated as: W_Q^{a} = W_Q^p T_Q^*, \quad W_K^{a} = W_K^p T_K^*, \quad W_V^{a} = W_V^p T_V^*, \quad W_O^{a} = W_O^p T_O^*.
(13)
This parallel extraction effectively circumvents all deployed continuous defenses, restoring the attention mechanism’s original parameter space. 3.2
Discrete Attack for MLP via Linear Sum Assignment
Due to the presence of non-linear activation functions in MLP layers, defenses typically employ discrete permutation matrices to shuffle hidden neurons, ensuring that standalone model performance remains invariant. While continuous least-squares regression can theoretically approximate this inverse permutation, it fails to enforce strict discrete constraints. This inevitably introduces numerical drift and accumulation errors across layers. To overcome this, AGA casts the permutation recovery as a linear sum assignment problem [2]. Let W1p be the protected first-layer MLP weight with shuffled rows, and Wpre be the corresponding pretrained weights. We construct a pairwise cost matrix C measuring the negative cosine similarity between their respective row vectors: C_{i, j} = - \frac {W^p_{i} \cdot W^{pre}_{j}}{\| W^p_{i} \|_2 \| W^{pre}_{j} \|_2},
(14)
where Wip and Wjpre denote the i-th and j-th row vectors of W1p and Wpre , respectively. With the cost matrix C constructed, we employ the Hungarian algorithm [20] to explicitly find the globally optimal discrete mapping as follows: T^* = \arg \min _{T} \sum _{i} \sum _{j} C_{i,j} T_{i,j},
(15)
where T is constrained to be a valid permutation matrix. This yields the exact recovery matrix T ∗ that minimizes the total matching cost, perfectly realigning the shuffled rows: W^{a}_1 = T^* W^p_1. (16)
8
Guo. et al.
To preserve the equivalent input-output mapping of the entire MLP block, AGA must concurrently restore the subsequent layers. Since T ∗ is a permutation matrix, its inverse is simply its transpose (T ∗ )T . Thus, AGA strictly applies this inverse mapping to the columns of the subsequent projection layer and the intermediate biases. W^{a}_2 = W^p_2 (T^*)^T, \quad b^{a}_1 = T^* b^p_1. (17) This holistic mathematical recovery rigorously restores the exact parameter arrangement of the MLP block. 3.3
Theoretical Error Bound of AGA
To rigorously validate the effectiveness of the AGA, we provide a theoretical upper bound for the recovery error in the continuous transformations of attention modules, alongside a strict exact-recovery guarantee for the discrete permutations in MLP blocks. Theorem 1 (Error Bound of Attention Module Recovery). If the recovery matrix T ∗ is obtained via the least-squares objective minT ∥W p T − Wpre ∥2F , the Frobenius norm of the recovery error E = ∥W a − Wf t ∥F is strictly upperbounded by the magnitude of the task vector τ : \mathcal {E} \le \| \tau \|_F
(18)
Theorem 2 (Error Bound of MLP Layer Recovery). We define the permutation margin of the pretrained model as δmin = minS∈P,S̸=I ∥SWpre − Wpre ∥F , where P denotes the set of all valid permutation matrices. This margin represents the minimum distance between Wpre and any distinct permuted state of itself. If the magnitude of the task vector satisfies ∥τ ∥F < 21 δmin , the linear sum assignment problem is mathematically guaranteed to output the exact inverse permutation T ∗ = P T , resulting in strictly zero recovery error: W a = Wf t . In summary, Theorems 1 and 2 collectively establish a rigorous mathematical foundation for the Anchor-Guided Attack (AGA). By exploiting the inherent magnitude disparity of task arithmetic, we theoretically guarantee that AGA achieves strictly bounded recovery error against continuous protections and zeroerror exact recovery against discrete permutations. Due to space constraints, the complete and detailed mathematical proofs for both theorems are deferred to the Supplementary Material.
4
Experiments
4.1
Experiment Setups
Models and Datasets. We conduct experiments on visual classification, natural language processing, and natural language generation tasks. For visual classification, we use two variants of the CLIP [27]—ViT-B/32 and ViT-L/14—and
On the Vulnerability of Parameter-Level Defenses to Model Merging
9
Table 1: Evaluation of protected-task performance under various defense mechanisms and our AGA framework using the ViT-B/32 backbone and various merging methods. ↑ ∆ presents the accuracy recovered by AGA relative to the only-protected setting. Protect
Attack SUN397
Cars
RESISC45EuroSAT
SVHN
GTSRB
MNIST
DTD
Avg (↑ ∆ )
Task Arithmetic [17] -
-
61.75
55.52
60.24
69.32
83.25
63.20
97.55
47.02
67.23
Params
AGA
0.62 61.51
0.62 55.15
4.49 59.94
13.44 68.40
7.89 81.13
3.56 61.46
10.24 97.06
3.09 46.44
5.49 66.39 (↑ 60.90)
Params-D
AGA
0.47 61.05
0.63 54.67
4.34 59.14
13.72 65.42
8.05 79.00
3.54 59.13
10.28 96.18
2.98 45.27
5.50 64.98 (↑ 59.48)
MergeLock
AGA
0.30 61.50
0.50 55.17
2.99 59.94
12.42 68.40
9.05 81.15
3.48 61.45
10.28 97.06
1.76 46.44
5.10 66.39 (↑ 61.29)
MergeBarrier
AGA
26.01 58.56
10.04 52.39
19.19 56.82
22.00 62.18
45.10 73.79
18.50 53.70
70.59 86.09
23.09 42.89
29.32 60.80 (↑ 31.48)
-
65.80
60.42
69.47
80.38
83.03
59.47
98.47
50.43
70.93
Params
AGA
0.81 65.25
0.42 59.79
3.54 68.03
14.70 79.80
8.97 81.74
2.57 58.13
10.30 98.35
2.02 49.52
5.42 70.08 (↑ 64.66)
Params-D
AGA
0.72 65.33
0.41 59.20
3.60 67.09
14.81 78.37
9.00 80.22
2.88 56.85
10.19 97.51
2.37 47.36
5.50 68.99 (↑ 63.49)
MergeLock
AGA
0.33 65.38
0.40 60.10
2.11 68.83
12.92 80.12
13.69 81.06
5.08 55.78
10.27 98.02
2.34 49.57
5.89 69.86 (↑ 63.97)
MergeBarrier
AGA
22.83 63.90
5.78 27.19
22.90 66.00
31.56 76.25
50.70 75.48
12.88 51.04
80.25 85.28
26.81 43.10
31.71 61.03 (↑ 29.32)
-
66.96
65.70
75.65
92.80
92.65
82.98
98.85
57.66
79.16
Params
AGA
0.51 66.98
0.50 65.27
3.18 73.26
9.50 92.38
11.22 91.43
4.70 82.88
10.28 98.42
4.04 57.18
5.49 78.48 (↑ 72.99)
Params-D
AGA
0.57 66.29
0.56 64.74
3.01 73.01
10.16 90.50
11.09 90.16
4.41 81.35
10.36 97.84
3.90 56.58
5.51 77.56 (↑ 72.05)
MergeLock
AGA
0.26 66.98
0.62 65.14
4.20 74.66
12.04 91.32
6.77 91.62
2.34 81.08
10.77 98.35
1.76 57.70
4.85 78.36 (↑ 73.51)
MergeBarrier
AGA
17.74 63.48
4.32 60.20
13.00 69.90
12.42 85.09
32.86 82.61
15.60 66.22
10.20 87.30
17.07 49.80
15.40 70.58 (↑ 55.18)
CAT Merging [32] -
LOT Merging [35] -
evaluate on eight datasets following prior work [5,18,24]: SUN397 [42], Cars [19], RESISC45 [7], EuroSAT [16], SVHN [26], GTSRB [31], MNIST [11], and DTD [8]. For natural language processing tasks, we adopt GPT-2 [28] as the backbone, and evaluate on eight tasks from the GLUE benchmark [34]: CoLA [37], SST2 [30], MRPC [13], STS-B [4], QQP [6], MNLI [39], QNLI [29], and RTE [14]. For natural language generation, we use Qwen2-7B [45] as the backbone and evaluate on AlpacaEval [23] for instruction following, GSM8K [9] for mathematical reasoning, and MBPP [1] for program synthesis. Additional details are provided in the supplementary material. Metrics. For all image classification and text classification tasks, we report the Top-1 accuracy. For natural language generation tasks evaluated on Qwen27B, we adopt domain-specific metrics corresponding to their benchmarks: win rate for AlpacaEval, exact match accuracy for GSM8K, and pass@1 for MBPP.
10
Guo. et al.
Table 2: Evaluation of protected-task performance under various defense mechanisms and our AGA framework using the ViT-L/14 backbone. ↑ ∆ presents the accuracy recovered by AGA relative to the only-protected setting. Protect
SVHN
GTSRB
MNIST
DTD
Avg (↑ ∆ )
-
73.83
82.09
87.60
93.76
87.91
86.78
98.94
65.69
84.58
Params [18]
AGA
0.39 73.36
0.46 82.02
4.14 85.96
21.36 93.82
7.96 83.14
2.14 80.36
9.82 98.27
2.13 64.84
6.05 82.72 (↑ 76.67)
Params-P [18]
AGA
0.31 72.44
0.52 81.11
4.00 84.77
19.45 92.10
7.58 82.86
2.29 80.23
9.88 98.06
2.02 64.33
5.76 81.99 (↑ 76.23)
MergeLock [36]
AGA
0.32 73.36
0.66 82.02
1.86 85.96
10.20 93.82
9.52 83.14
2.11 80.35
7.66 98.27
1.81 64.84
4.27 82.72 (↑ 78.45)
MergeBarrier [22]
AGA
5.59 71.16
0.83 78.32
9.00 83.60
9.76 87.42
7.65 84.01
4.20 78.20
6.60 95.32
12.39 62.36
7.00 80.05 (↑ 73.05)
-
Attack SUN397
Cars
RESISC45EuroSAT
Table 3: Evaluation of protected-task performance under various defense mechanisms and our AGA framework using the Qwen2-7B backbone. ↑ ∆ presents the accuracy recovered by AGA relative to the only-protected setting. Protect
GSM8K
MBPP
Avg (↑ ∆ )
-
29.04
66.79
51.48
49.10
Params [18]
AGA
6.34 29.01
1.74 66.38
1.17 51.40
3.08 48.93 (↑ 45.85)
Params-D [18]
AGA
6.12 28.59
1.79 64.11
1.29 50.68
3.07 47.79 (↑ 44.72)
MergeLock [36]
AGA
3.25 29.03
2.12 66.54
1.42 51.46
2.26 49.01 (↑ 46.75)
MergeBarrier [22]
AGA
14.51 27.49
19.71 63.77
13.17 50.02
15.80 47.09 (↑ 31.29)
-
Attack Alpaca
Merging Methods. To comprehensively demonstrate the generality of our AGA, we evaluate its effectiveness across a range of model merging paradigms, ranging from the classic baseline of Task Arithmetic (TA) [17] to the latest SOTA advancements, specifically CAT Merging [32] and LOT Merging [35]. Defense Baselines. We evaluate the robustness of our AGA against four established parameter-space protection mechanisms: Params [18], Params-D [18], MergeLock [36], and MergeBarrier [22]. The formal mathematical definitions and operational mechanics of these defenses are previously detailed in Sec. 2.3. Evaluation Strategy. To simulate a realistic zero-knowledge adversary, our evaluation follows three core protocols: Defense-Agnostic Setting: Since adversaries typically cannot identify which specific models are protected, we blindly apply our AGA method to all candidate models. Protected-Task Performance: This metric quantifies AGA’s ability to restore the protected task-specific expertise. Specifically, in a scenario where only one model is protected while others are unprotected, we report the performance of the final merged model on the dataset corresponding to that explicitly protected model. Cross-Task Average Utility: This metric measures the average performance of the merged model across all evaluated datasets.
On the Vulnerability of Parameter-Level Defenses to Model Merging
11
Table 4: Cross-task average utility of merged ViT-B/32 models under baseline defenses and our AGA attack. ↑ ∆ presents the accuracy recovered by AGA relative to the only-protected setting. Protect
Attack SUN397
SVHN
GTSRB
MNIST
DTD
Avg (↑ ∆ )
-
67.23
67.23
67.23
67.23
67.23
67.23
67.23
67.23
67.23
Params [18]
AGA
5.74 67.19
5.92 67.17
5.50 67.19
5.71 67.12
5.05 67.12
6.21 67.02
5.84 67.38
5.98 67.17
5.74 67.17 (↑ 61.43)
Params-D [18]
AGA
5.68 67.25
6.09 67.19
5.49 67.08
5.73 66.82
5.46 67.36
5.78 66.89
6.67 67.88
6.09 67.04
5.87 67.19 (↑ 61.32)
MergeLock [36]
AGA
3.84 67.19
5.02 67.18
4.09 67.19
5.27 67.12
4.99 67.11
5.75 67.02
4.60 67.38
5.79 67.17
4.92 67.17 (↑ 62.25)
MergeBarrier [22]
AGA
38.68 67.17
38.74 67.19
38.31 66.15
37.20 64.85
34.60 67.34
37.17 66.15
36.20 69.30
38.70 66.47
37.45 66.83 (↑ 29.38)
-
Cars
RESISC45EuroSAT
Table 5: Evaluation of protected-task performance under combined defense and AGA using the ViT-B/32 backbone. Notably, P represents Params [18], L represents MergeLock [36] and B represents MergeBarrier [22]. ↑ ∆ presents the accuracy recovered by AGA relative to the only-protected setting. Protect
Attack SUN397
SVHN
GTSRB
MNIST
DTD
Avg (↑ ∆ )
-
61.75
55.52
60.24
69.32
83.25
63.20
97.55
47.02
67.23
P&L
AGA
0.26 61.50
0.57 55.15
3.96 59.93
9.10 68.42
9.68 81.15
1.77 61.45
9.83 97.06
2.66 46.44
4.73 66.39 (↑ 61.66)
P&B
AGA
11.16 58.56
1.63 52.39
11.25 56.82
20.62 62.18
9.71 73.79
3.99 52.70
15.62 86.09
16.70 42.89
11.34 60.68 (↑ 49.34)
L&B
AGA
0.30 58.56
0.60 52.37
2.20 56.82
9.86 62.16
9.25 73.70
2.72 52.72
7.48 86.13
2.02 42.84
4.30 60.66 (↑ 56.36)
P&L&B
AGA
0.27 58.54
0.61 52.39
2.09 56.81
9.44 62.16
9.10 73.70
2.58 52.77
7.25 86.11
1.94 42.82
4.16 60.66 (↑ 56.50)
-
4.2
Cars
RESISC45EuroSAT
Experimental Results
In this section, we systematically evaluate the efficacy of our proposed AnchorGuided Attack (AGA) against SOTA defenses. Unless stated otherwise, all merging operations utilize Task Arithmetic [17] as the merging paradigm. As evidenced in Table 1 and Table 2, AGA consistently defeats SOTA protections, recovering the accuracy to near-unprotected levels across all merging strategies. For instance, under LOT Merging [35], MergeLock suppresses average protectedtask performance from 79.16% to a mere 4.85%. Remarkably, AGA successfully restores performance to 78.36%, a negligible gap of less than 1% from the unprotected baseline. Such near-complete recoveries across diverse merging paradigms confirm AGA’s robust adaptability to different parameter-fusion algorithms. Beyond vision models, AGA demonstrates formidable capabilities across NLP (GPT-2 in Table 9 in the supplementary material) and large-scale text generation (Qwen2-7B in Table 3) benchmarks. On complex Qwen2-7B generation tasks, Params-D drastically degrades the average performance to 3.07%, whereas AGA successfully reconstructs the weights to achieve a score of 47.79%. Moreover, AGA bypasses targeted protections without compromising the global integrity of the multi-task model. As demonstrated in Table 4, while
12
Guo. et al.
MergeLock suppresses the cross-task average utility to 4.92%, AGA restores it to 67.17%, missing the original unprotected performance (67.23%) by a mere 0.06%. This empirical evidence validates that AGA achieves high-fidelity parameter reconstruction, ensuring that recovered models maintain full functional compatibility with the original task-vector space. Furthermore, supplementary Table 15 confirms that AGA achieves high-fidelity recovery regardless of the initial protection status. The standalone performance of both protected and unprotected models post-attack exhibits a strictly negligible degradation compared to their original baselines. MergeBarrier alters MLP topology via Taylor expansion, rendering standard inversion mathematically ill-posed. To circumvent this, AGA bypasses the modified blocks and reverts to pretrained MLP layers during merging. Despite MergeBarrier’s naturally weaker baseline (e.g., 26.01% on SUN397), AGA significantly elevates the accuracy to 58.56%, as shown in Table 1. While missing the task-specific MLP fine-tuning yields slightly lower performance than purely parameter-space defenses, successfully inverting the attention modules proves AGA’s critical robustness against structural alterations. To simulate a worst-case scenario, we evaluate AGA against composite defenses that apply multiple protections simultaneously. As Table 5 illustrates, when combining purely parameter-level protections (e.g., P and L), AGA recovers the average accuracy to 66.39%. This closely matches the 67.23% unprotected baseline, leaving a marginal gap under 1%. In contrast, integrating MergeBarrier (e.g., P & B or P & L & B) noticeably decreases the recovered accuracy to approximately 60.66%. This reduction occurs because MergeBarrier fundamentally alters MLP architectures, inherently limiting perfect parameter-space reconstruction. Ultimately, these results confirm AGA’s effectiveness, proving that simply concatenating existing methods fails to provide robust security.
5
Countermeasure
5.1
Anchor-Repulsive Fine-tuning Protection
Our theoretical analysis in Sec. 3 reveals that the effectiveness of AGA hinges on a critical assumption: the magnitude of the protected task vector is disproportionately small compared to the pretrained anchor. Therefore, to fundamentally defend against this inversion attack, the defender must systematically violate this assumption by artificially expanding the task vector’s magnitude. Because the task vector is inherently formed during the finetuning phase, this theoretical insight naturally motivates us to implement protective interventions directly during the fine-tuning process. The recent proactive defense MergeGuard [5] also adopts tuning-stage protection, attempting to disperse task weights via global L2 regularization to intentionally aggravate parameter conflicts and induce destructive interference between different tasks. However, this approach exhibits two critical flaws. First, an overall-model constraint inherently restricts the parameter space, inevitably
On the Vulnerability of Parameter-Level Defenses to Model Merging
13
degrading the protected model’s standalone capabilities. Second, our empirical evaluations reveal that MergeGuard [5] remains vulnerable to AGA across several datasets, as shown in Table 6. Therefore, merely dispersing weights fails to mathematically guarantee a sufficient magnitude expansion. These dual vulnerabilities highlight a crucial design imperative: an effective defense must decisively expand the target parameter distance without polluting the broader network. Building upon this insight, we introduce Anchor-Repulsive Fine-tuning (ARF). Instead of penalizing the entire network, ARF surgically applies an adaptive Euclidean repulsive force exclusively to the attention projection matrices. This localized intervention is deliberate: their continuous inversion relies on minimizing the Euclidean distance (bounded by ∥τ ∥F , as shown in Theorem 1), making them highly susceptible to distance-based repulsion. Conversely, the discrete extraction of MLP layers relies on scale-invariant cosine matching, rendering Euclidean expansion ineffective. Therefore, during the fine-tuning phase, we introduce a distance-based margin penalty that actively pushes only these designated attention parameters away from their pretrained anchors until they reach a predefined safety boundary: \label {loss} L_{total} = L_{CE} + \lambda _{dist} \sum _{\theta \in \{W_Q, W_K, W_V, W_O\}} \min ( 0, \rho \| \theta _{pre} \|_2- \| \theta - \theta _{pre} \|_2)
(19)
where LCE is the standard cross-entropy task loss, θ represents the targeted attention weight, θpre is the corresponding pretrained anchor, λdist controls the strength of the repulsive force. ρ denotes a predefined expansion ratio that establishes the relative safety margin based on the anchor’s original magnitude. By employing this margin-aware repulsion, ARF actively enlarges the distance ∥θ − θpre ∥2 only when necessary, drastically expanding the magnitude of the targeted task vectors without polluting the representation capacity of other layers. Once the model is fine-tuned to satisfy this margin, we apply the standard invertible matrix transformations to protect the attention modules. 5.2
Experiment
Experiment Setups. The experimental configurations strictly follow the protocols in Sec. 4.1. Across all datasets, the defense hyperparameters in Eq. 19 are set to λdist = 1.0 and ρ = 0.05. Because ARF proactively expands parameter magnitude during fine-tuning, it is inherently orthogonal to post-training linear protections. Consequently, "ARF" in our results denotes the complete defensive pipeline: applying our repulsive fine-tuning followed by standard invertible matrix protection on attention modules. We compare ARF against MergeGuard [5], a state-of-the-art tuning-stage defense, focusing on two dimensions: Protection Capability (resisting AGA and degrading unauthorized merged models) and Standalone Utility (preserving original task accuracy). Experiment Results. As demonstrated in Fig. 3a and Table 6, ARF exhibits superior defensive capabilities across modalities. Without attacks, ARF consistently suppresses unauthorized merging utility to near-random levels. For
14
Guo. et al.
70
100 90
50
Accuracy (%)
Accuracy (%)
60 40 30 20
70 60
10 0
80
Alpaca GSM8K without protection MergeLock
MBPP MergeGuard ARF
(a) Protection efficacy under attack.
50
Alpaca GSM8K Individual MergeLock
MBPP MergeGuard ARF
(b) Standalone utility of protection.
Fig. 3: Evaluation of protection efficacy against attack and standalone utility on Qwen2-7B. (a) Protected-task performance of AGA-attacked models under various defenses. (b) Standalone accuracy of individual fine-tuned models. Table 6: Evaluation of protected-task performance under protection and AGA using the ViT-B/32 backbone. SVHN
GTSRB
MNIST
DTD
Avg
-
Protect
Attack SUN397 -
61.75
55.52
60.24
69.32
83.25
63.20
97.55
47.02
67.23
MergeLock [36] MergeGuard [5] ARF
-
0.30 43.52 0.28
0.50 28.49 0.52
2.99 29.54 2.18
12.42 39.66 10.09
9.05 40.40 8.20
3.48 19.81 3.07
10.28 35.36 10.44
1.76 34.97 2.29
5.10 33.97 4.63
61.50 46.23 38.18
55.17 34.26 23.05
59.94 59.91 17.75
68.40 68.50 34.67
81.15 57.12 37.73
61.45 42.81 14.38
97.06 49.04 29.12
46.44 46.62 24.49
66.39 50.56 27.42
MergeLock [36] MergeGuard [5] AGA ARF
Cars
RESISC45EuroSAT
instance, on the ViT-B/32 backbone in Table 6, ARF reduces the merged accuracy to a mere 0.28%, significantly outperforming MergeGuard’s 43.52%. Furthermore, ARF maintains its strong protective barrier even against our potent AGA method. Remarkably, the accuracy of ARF-protected models under attack remains substantially lower than that of MergeGuard in its unattacked state (see Table 6, Table 7, and supplementary Table 10). This validates that ARF’s optimization objective effectively eliminates the exploitable parameterspace proximity. More results for CAT merging [32] and LOT merging [35] on ViT-B/32 are detailed in Table 11 and Table 12 in the supplementary material. Unlike MergeGuard [5], which frequently suffers performance drops due to global constraints, ARF preserves task-specific expertise by applying a localized repulsive force exclusively to attention modules. As shown in Table 8, ARF achieves results nearly identical to standard fine-tuning on ViT-B/32. Specifically, its average accuracy of 88.11% closely matches the 88.81% baseline, noticeably outperforming MergeGuard’s 86.31%. Similar high-fidelity results are observed for Qwen2-7B in Fig. 3b, as well as ViT-L/14 and GPT-2 in Tables 13 and 14 of the supplementary material. Ultimately, by breaking the magni-
On the Vulnerability of Parameter-Level Defenses to Model Merging
15
Table 7: Evaluation of protected-task performance under protection and AGA using the ViT-L/14 backbone. SVHN
GTSRB
MNIST
DTD
Avg
-
Protect
Attack SUN397 -
73.83
82.09
87.60
93.76
87.91
86.78
98.94
65.69
84.58
MergeLock [36] MergeGuard [5] ARF
-
0.32 54.01 0.31
0.66 38.92 0.85
1.86 56.53 1.94
10.20 54.63 11.07
9.52 48.08 9.98
2.11 13.35 2.40
7.66 17.08 7.43
1.81 64.70 2.25
4.27 43.41 4.53
73.36 60.21 39.21
82.02 46.50 31.78
85.96 84.19 33.40
93.82 90.47 34.19
83.14 62.83 37.61
80.35 50.41 8.07
98.27 48.73 13.65
64.84 65.43 36.19
82.72 63.60 29.26
MergeLock [36] MergeGuard [5] AGA ARF
Cars
RESISC45EuroSAT
Table 8: Standalone accuracy of individual fine-tuned models with and without protection methods using the ViT-B/32 backbone. Method
SUN397
Cars RESISC45 EuroSAT SVHN
GTSRB
MNIST
DTD
Avg
Individual MergeGuard [5] ARF
74.54 63.82 72.81
76.40 71.89 75.58
98.94 96.17 98.13
99.65 99.41 99.06
73.99 74.26 73.54
88.81 86.31 88.11
91.67 90.97 90.35
97.89 97.96 98.16
97.39 96.02 97.27
tude disparity exploited by AGA, ARF effectively prevents unauthorized merging while incurring only a negligible drop in standalone performance.
6
Conclusion
In this work, we systematically analyze current model merging defenses and reveal that protected fine-tuned models are overwhelmingly dominated by their public pretrained anchors due to the inherently small magnitude of task vectors. Capitalizing on this observation, we propose Anchor-Guided Attack (AGA), a universal framework that aligns the protected model with the pretrained anchor to bypass previous defenses. Specifically, AGA deploys least squares regression and the Hungarian algorithm to neutralize these protections in attention and MLP modules. Extensive cross-modal evaluations demonstrate that AGA decisively bypasses individual and composite defenses. We subsequently propose Anchor-Repulsive Fine-tuning (ARF) as an adaptive countermeasure to mitigate this specific threat. The complete success of AGA demonstrates that linear weight transforms offer merely an illusion of security, urging the research community to develop fundamentally robust and training-aware paradigms.
Acknowledgments This work was funded by the National Natural Science Foundation of China under Grants (62276256, U2441251), the Beijing Natural Science Foundation (Z260008), and the National Key Research and Development Program of China (2026ZD1500301).
16
Guo. et al.
References 1. Austin, J., Odena, A., Nye, M., Bosma, M., Michalewski, H., Dohan, D., Jiang, E., Cai, C., Terry, M., Le, Q., et al.: Program synthesis with large language models. arXiv preprint arXiv:2108.07732 (2021) 2. Burkard, R.E., Derigs, U.: The linear sum assignment problem. In: Assignment and Matching Problems: Solution Methods with FORTRAN-Programs, pp. 1–15 (1980) 3. Caruana, R.: Multitask learning. Machine learning pp. 41–75 (1997) 4. Cer, D., Diab, M., Agirre, E., Lopez-Gazpio, I., Specia, L.: Semeval-2017 task 1: Semantic textual similarity multilingual and crosslingual focused evaluation. In: Proceedings of the 11th International Workshop on Semantic Evaluation (2017) 5. Chen, W.J., Tsai, M.Y., Lee, C.Y., Yu, C.M.: Defending unauthorized model merging via dual-stage weight protection. In: Proc. CVPR (2026) 6. Chen, Z., Zhang, H., Zhang, X., Zhao, L.: Quora question pairs (2018) 7. Cheng, G., Han, J., Lu, X.: Remote sensing image scene classification: Benchmark and state of the art. Proceedings of the IEEE pp. 1865–1883 (2017) 8. Cimpoi, M., Maji, S., Kokkinos, I., Mohamed, S., Vedaldi, A.: Describing textures in the wild. In: Proc. CVPR (2014) 9. Cobbe, K., Kosaraju, V., Bavarian, M., Chen, M., Jun, H., Kaiser, L., Plappert, M., Tworek, J., Hilton, J., Nakano, R., et al.: Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168 (2021) 10. Cong, T., Ran, D., Liu, Z., He, X., Liu, J., Gong, Y., Li, Q., Wang, A., Wang, X.: Have you merged my model? on the robustness of large language model ip protection methods against model merging. In: Proceedings of the 1st ACM Workshop on Large AI Systems and Models with Privacy and Safety Analysis (2023) 11. Deng, L.: The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine pp. 141–142 (2012) 12. Ding, Y., Liang, J., Jiang, B., Wang, Z., Zheng, A., Luo, B.: Harmonizing and merging source models for clip-based domain generalization. arXiv preprint arXiv:2506.09446 (2025) 13. Dolan, B., Brockett, C.: Automatically constructing a corpus of sentential paraphrases. In: Third International Workshop on Paraphrasing (2005) 14. Giampiccolo, D., Magnini, B., Dagan, I., Dolan, W.B.: The third pascal recognizing textual entailment challenge. In: Proceedings of the ACL-PASCAL Workshop on Textual Entailment and Paraphrasing (2007) 15. Guo, K., Yu, A., Liang, J., Ding, Y., Wang, Z., He, R., Tan, T.: Stay unique, stay efficient: Preserving model personality in multi-task merging. In: Proc. ECCV (2026) 16. Helber, P., Bischke, B., Dengel, A., Borth, D.: Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing pp. 2217–2226 (2019) 17. Ilharco, G., Ribeiro, M.T., Wortsman, M., Gururangan, S., Schmidt, L., Hajishirzi, H., Farhadi, A.: Editing models with task arithmetic. In: Proc. ICLR (2023) 18. Junhao, W., Zhe, Y., Sakuma, J.: Disrupting model merging: A parameter-level defense without sacrificing accuracy. In: Proc. ICCV (2025) 19. Krause, J., Stark, M., Deng, J., Fei-Fei, L.: 3d object representations for finegrained categorization. In: Proc. ICCV (2013)
On the Vulnerability of Parameter-Level Defenses to Model Merging
17
20. Kuhn, H.W.: The hungarian method for the assignment problem. Naval research logistics quarterly pp. 83–97 (1955) 21. Li, L., Zhang, T., Bu, Z., Wang, S., He, H., Fu, J., Wu, Y., Bian, J., Chen, Y., Bengio, Y.: Map: Low-compute model merging with amortized pareto fronts via quadratic approximation. In: Proc. ICLR (2025) 22. Li, Q., Pan, M., Chen, J., Teng, F., Shen, Z., Su, G., Peng, H., Zhang, X.: Do not merge my model! safeguarding open-source llms against unauthorized model merging. In: Proc. AAAI (2026) 23. Li, X., Zhang, T., Dubois, Y., Taori, R., Gulrajani, I., Guestrin, C., Liang, P., Hashimoto, T.B.: Alpacaeval: An automatic evaluator of instruction-following models (2023) 24. Lu, Z., Fan, C., Wei, W., Qu, X., Chen, D., Cheng, Y.: Twin-merging: Dynamic integration of modular expertise in model merging. In: Proc. NeurIPS (2024) 25. ModeScope: Modelscope: Open-source model platform. https://modelscope.cn/ (2025) 26. Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., Ng, A.Y., et al.: Reading digits in natural images with unsupervised feature learning. In: Proc. NeurIPS (2011) 27. Radford, A., Kim, J.W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al.: Learning transferable visual models from natural language supervision. In: Proc. ICML (2021) 28. Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I., et al.: Language models are unsupervised multitask learners. OpenAI blog p. 9 (2019) 29. Rajpurkar, P., Zhang, J., Lopyrev, K., Liang, P.: Squad: 100,000+ questions for machine comprehension of text. In: Proc. EMNLP (2016) 30. Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C.D., Ng, A.Y., Potts, C.: Recursive deep models for semantic compositionality over a sentiment treebank. In: Proc. EMNLP (2013) 31. Stallkamp, J., Schlipsing, M., Salmen, J., Igel, C.: The german traffic sign recognition benchmark: a multi-class classification competition. In: Proc. IJCNN (2011) 32. Sun, W., Li, Q., Geng, Y.a., Li, B.: Cat merging: A training-free approach for resolving conflicts in model merging. In: Proc. ICML (2025) 33. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł., Polosukhin, I.: Attention is all you need. In: Proc. NeurIPS (2017) 34. Wang, A., Singh, A., Michael, J., Hill, F., Levy, O., Bowman, S.R.: Glue: A multitask benchmark and analysis platform for natural language understanding. In: Proc. ICLR (2018) 35. Wang, K., Dimitriadis, N., Ortiz-Jimenez, G., Fleuret, F., Frossard, P.: Localizing task information for improved model merging and compression. In: Proc. ICML (2025) 36. Wang, Z., Yang, E., Yin, L., Liu, S., Shen, L.: Model unmerging: Making your models unmergeable for secure model sharing. arXiv preprint arXiv:2509.01548 (2025) 37. Warstadt, A., Singh, A., Bowman, S.R.: Neural network acceptability judgments. In: Proc. ACL (2019) 38. Watson, G.S.: Linear least squares regression. The Annals of Mathematical Statistics pp. 1679–1699 (1967) 39. Williams, A., Nangia, N., Bowman, S.R.: A broad-coverage challenge corpus for sentence understanding through inference. In: Proc. ACL (2018)
18
Guo. et al.
40. Wolf, T., Debut, L., Sanh, V., Chaumond, J., Delangue, C., Moi, A., Cistac, P., Rault, T., Louf, R., Funtowicz, M., et al.: Huggingface’s transformers: State-ofthe-art natural language processing. arXiv preprint arXiv:1910.03771 (2019) 41. Wu, X.K., Chen, M., Li, W., Wang, R., Lu, L., Liu, J., Hwang, K., Hao, Y., Pan, Y., Meng, Q., et al.: Llm fine-tuning: Concepts, opportunities, and challenges. Big Data and Cognitive Computing p. 87 (2025) 42. Xiao, J., Hays, J., Ehinger, K.A., Oliva, A., Torralba, A.: Sun database: Large-scale scene recognition from abbey to zoo. In: Proc. CVPR (2010) 43. Yadav, P., Tam, D., Choshen, L., Raffel, C.A., Bansal, M.: Ties-merging: Resolving interference when merging models. In: Proc. NeurIPS (2023) 44. Yamabe, S., Waseda, F.K., Takahashi, T., Wataoka, K.: Mergeprint: Mergeresistant fingerprints for robust black-box ownership verification of large language models. In: Proc. ACL (2025) 45. Yang, A., Yang, B., Hui, B., Zheng, B., Yu, B., Zhou, C., Li, C., Li, C., Liu, D., Huang, F., Dong, G., Wei, H., Lin, H., Tang, J., Wang, J., Yang, J., Tu, J., Zhang, J., Ma, J., Yang, J., Xu, J., Zhou, J., Bai, J., He, J., Lin, J., Dang, K., Lu, K., Chen, K., Yang, K., Li, M., Xue, M., Ni, N., Zhang, P., Wang, P., Peng, R., Men, R., Gao, R., Lin, R., Wang, S., Bai, S., Tan, S., Zhu, T., Li, T., Liu, T., Ge, W., Deng, X., Zhou, X., Ren, X., Zhang, X., Wei, X., Ren, X., Liu, X., Fan, Y., Yao, Y., Zhang, Y., Wan, Y., Chu, Y., Liu, Y., Cui, Z., Zhang, Z., Guo, Z., Fan, Z.: Qwen2 technical report (2024), https://arxiv.org/abs/2407.10671 46. Yu, L., Yu, B., Yu, H., Huang, F., Li, Y.: Language models are super mario: Absorbing abilities from homologous models as a free lunch. In: Proc. ICML (2024) 47. Yu, Y., Wang, Y., He, R., Liang, J.: Test-time immunization: A universal defense framework against jailbreaks for (multimodal) large language models. arXiv preprint arXiv:2505.22271 (2025) 48. Zhang, B., Liu, Z., Cherry, C., Firat, O.: When scaling meets llm finetuning: The effect of data, model and finetuning method. arXiv preprint arXiv:2402.17193 (2024) 49. Zhang, Y., Yang, Q.: An overview of multi-task learning. National Science Review pp. 30–43 (2018) 50. Zhang, Y., Yang, Q.: A survey on multi-task learning. IEEE Transactions on Knowledge and Data Engineering pp. 5586–5609 (2021) 51. Zhao, Z., Shen, T., Zhu, D., Li, Z., Su, J., Wang, X., Wu, F.: Merging loras like playing lego: Pushing the modularity of lora to extremes through rank-wise clustering. In: Proc. ICLR (2025)
On the Vulnerability of Parameter-Level Defenses to Model Merging
7
1
The Proof
Theorem 3 (Error Bound of Attention Module Recovery). Let Wf t = Wpre + τ ∈ RN ×D (where N ≥ D and has full column rank) be the fine-tuned weight matrix, and W p = Wf t P be the protected model under a secret invertible transformation P ∈ RD×D . If the recovery matrix T ∗ is obtained via the leastsquares objective minT ∥W p T −Wpre ∥2F , the Frobenius norm of the recovery error E = ∥W a − Wf t ∥F is strictly upper-bounded by the magnitude of the task vector τ: \mathcal {E} \le \| \tau \|_F. (20) Proof. Given the closed-form solution of the least-squares objective: T^* = ((W^p)^T W^p)^{-1} (W^p)^T W_{pre}.
(21)
We substitute the protection mechanism W p = Wf t P into the equation: T^* = (P^T W_{ft}^T W_{ft} P)^{-1} P^T W_{ft}^T W_{pre}.
(22)
Using the property of invertible matrices, we expand the inverse term: T^* = P^{-1} (W_{ft}^T W_{ft})^{-1} (P^T)^{-1} P^T W_{ft}^T W_{pre} = P^{-1} (W_{ft}^T W_{ft})^{-1} W_{ft}^T W_{pre}. (23) The recovered model W a is obtained by applying T ∗ to the protected model W p: \begin {aligned} W^a = W^p T^* & = W_{ft} P \left [ P^{-1} (W_{ft}^T W_{ft})^{-1} W_{ft}^T W_{pre} \right ]\\ & = W_{ft} (W_{ft}^T W_{ft})^{-1} W_{ft}^T W_{pre}. \end {aligned}
(24)
Let Πf t = Wf t (WfTt Wf t )−1 WfTt . Mathematically, Πf t is the exact orthogonal projection matrix onto the column space of Wf t . Therefore, we have W a = Πf t Wpre . Substituting the task arithmetic definition Wpre = Wf t − τ : W^a = \Pi _{ft} (W_{ft} - \tau ) = \Pi _{ft} W_{ft} - \Pi _{ft} \tau .
(25)
Since Wf t inherently lies within its own column space, projecting it onto itself leaves it unchanged, i.e., Πf t Wf t = Wf t . Thus, the recovered model simplifies to: W^a = W_{ft} - \Pi _{ft} \tau . (26) The recovery error matrix is exactly the projection of the task vector: W a − Wf t = −Πf t τ . Taking the Frobenius norm on both sides and applying the submultiplicative property of matrix norms: \mathcal {E} = \| -\Pi _{ft} \tau \|_F \le \| \Pi _{ft} \|_2 \| \tau \|_F.
(27)
Because Πf t is an orthogonal projection matrix, its spectral norm (induced 2norm) is strictly ∥Πf t ∥2 = 1. Consequently, the absolute recovery error satisfies: \mathcal {E} \le \| \tau \|_F.
(28)
2
Guo. et al.
■ Remark: This theorem mathematically proves why AGA is devastatingly effective. This theorem mathematically proves why AGA is devastatingly effective. Crucially, because orthogonal matrices and non-zero diagonal matrices are fundamental subclasses of invertible matrices, this theoretical guarantee universally applies to defenses utilizing these specific structures (such as the diagonal transformations in Params or the orthogonal matrices in MergeLock). The rel∥F ∥τ ∥F ≈ ∥W∥τpre ative recovery error is bounded by ∥W ∥F . As empirically observed, f t ∥F since the task vector magnitude is typically two to three orders of magnitude smaller than the pretrained anchor (10−2 to 10−3 ), the theoretical maximum error of AGA is strictly bounded within this negligible margin. The defense is thus fundamentally dismantled by the geometry of the parameter space. Theorem 4 (Error Bound of MLP Layer Recovery). We define the permutation margin of the pretrained model as δmin = minS∈P,S̸=I ∥SWpre − Wpre ∥F , where P denotes the set of all valid permutation matrices. This margin represents the minimum distance between Wpre and any distinct permuted state of itself. If the magnitude of the task vector satisfies ∥τ ∥F < 21 δmin , the linear sum assignment problem is mathematically guaranteed to output the exact inverse permutation T ∗ = P T , resulting in strictly zero recovery error: W a = Wf t . Proof. The Hungarian Algorithm solving the LSAP aims to find a permutation matrix T ∈ P that optimally realigns W p with Wpre . Under standard Euclidean distance (which aligns with the optimization objective of cosine similarity for normalized vectors), this is equivalent to minimizing the global Frobenius distance: T^* = \arg \min _{T \in \mathcal {P}} \| T W^p - W_{pre} \|_F^2. (29) Substitute the protection mechanism W p = Ptrue (Wpre + τ ) into the objective: \mathcal {J}(T) = \| T P_{true} (W_{pre} + \tau ) - W_{pre} \|_F.
(30)
Let S = T Ptrue ∈ P. The optimization is equivalent to finding S ∗ such that: S^* = \arg \min _{S \in \mathcal {P}} \| S (W_{pre} + \tau ) - W_{pre} \|_F = \arg \min _{S \in \mathcal {P}} \| S W_{pre} - W_{pre} + S \tau \|_F. (31) We evaluate the cost function J (S) under two conditions: For the true inverse T permutation (S = I, i.e., T = Ptrue ): \mathcal {J}(I) = \| I W_{pre} - W_{pre} + I \tau \|_F = \| \tau \|_F.
(32)
For any incorrect permutation (S ̸= I): Applying the reverse triangle inequality, we obtain: \mathcal {J}(S) = \| (S W_{pre} - W_{pre}) + S \tau \|_F \ge \| S W_{pre} - W_{pre} \|_F - \| S \tau \|_F.
(33)
Since any permutation matrix is orthogonal, it perfectly preserves the Frobenius norm, meaning ∥Sτ ∥F = ∥τ ∥F . Thus: \mathcal {J}(S) \ge \| S W_{pre} - W_{pre} \|_F - \| \tau \|_F.
(34)
On the Vulnerability of Parameter-Level Defenses to Model Merging
3
To guarantee that the exact inverse S = I is the unique global minimum, its cost must be strictly less than the cost of any incorrect permutation: \mathcal {J}(I) < \mathcal {J}(S) \implies \| \tau \|_F < \| S W_{pre} - W_{pre} \|_F - \| \tau \|_F.
(35)
This yields the strict inequality: 2 \| \tau \|_F < \| S W_{pre} - W_{pre} \|_F.
(36)
By definition, minS̸=I ∥SWpre − Wpre ∥F = δmin . Therefore, if the task vector satisfies 2∥τ ∥F < δmin , the cost of the correct assignment is strictly lower than any alternative. The algorithm is mathematically forced to converge to S ∗ = I, −1 T which means T ∗ Ptrue = I, and therefore T ∗ = Ptrue = Ptrue . Applying this exact inverse to the protected model yields the fully recovered model: W^a = T^* W^p = P_{true}^T (P_{true} W_{ft}) = (P_{true}^T P_{true}) W_{ft} = I W_{ft} = W_{ft}.
(37)
The recovery error is exactly 0. This completes the proof. ■ Remark: This theorem exposes the fundamental fragility of permutationbased defenses (such as those applied to MLP blocks). In deep neural networks, the pre-trained weights Wpre are highly diverse, meaning the row separation margin δmin is significantly large. Conversely, the task vector τ inherently possesses a tiny magnitude. Because the condition 2∥τ ∥F < δmin is overwhelmingly satisfied in practical fine-tuning scenarios, AGA effortlessly bypasses the permutation defense with mathematically guaranteed perfect recovery.
8
Related Work
8.1
Model Merging
Model merging focuses on integrating multiple fine-tuned models into a unified architecture without incurring the substantial computational overhead of retraining. Foundational approaches, such as Task Arithmetic [17], achieve this by performing simple algebraic operations on task vectors. While subsequent methods like Ties-Merging [43] and DARE [46] attempt to refine this process through pruning and scaling, model merging strategies frequently struggle with severe parameter interference when fusing highly diverse tasks. To address these inherent conflicts and better preserve task-specific expertise, recent state-of-theart paradigms have introduced advanced resolution mechanisms. Notably, CAT Merging [32] and LOT Merging [35] have emerged as highly effective strategies that mitigate parameter conflicts and optimize the fusion trajectory. Given their superior merging utility and widespread adoption, we extensively employ Task Arithmetic, CAT Merging, and LOT Merging as the primary evaluation protocols to strictly assess both attack and defense mechanisms in this work.
4
Guo. et al.
p A
Our Protection
B merge a merge
a A
pre
basin 2
A p A
basin 1 Our Attack
Fig. 4: Loss landscape illustration of our protection ARF against our attack AGA.
8.2
Proactive Protection in Model Merging
The growing accessibility of model merging has raised critical security concerns regarding the unauthorized exploitation of proprietary model weights. Consequently, proactive protection methods have been rapidly developed to safeguard intellectual property [46, 47]. These defenses generally fall into two categories: parameter-space obfuscation and structural alteration. Params [18] and its advanced variant Params-P [18] introduce parameter-level safeguards by applying secret diagonal transformations to the fine-tuned weights, thereby disrupting the alignment required for unauthorized fusion. MergeLock [36] elevates this concept by employing orthogonal matrices to strictly lock the parameter space. Furthermore, MergeBarrier [22] extends protection beyond simple weight manipulation by structurally altering the topology of MLP modules via Taylor expansion, rendering standard task vector inversion mathematically ill-posed. While these methods demonstrate empirical success against basic merging attempts, our work systematically exposes their shared geometric vulnerabilities.
9
Loss Landscape Illustration of Our Protection
To intuitively demonstrate how our defense neutralizes the Anchor-Guided Attack (AGA), we visualize the loss landscape geometry in Fig. 4. Fundamentally, our defense deliberately amplifies the distance between the fine-tuned model and the pretrained anchor, thereby bridging the magnitude disparity between the task vector and the pretrained weights. Coupled with invertible linear transformations applied specifically to the Attention modules, ARF forcefully relocates p the protected model θA from the optimal local minimum in basin 1 to an entirely distinct region in basin 2. When AGA attempts to invert this protection using
On the Vulnerability of Parameter-Level Defenses to Model Merging
108 L1 Norm Sum
107
5
P Wpre P
106 105 104 103 Params
MergeLock MergeBarrier
Fig. 5: Comparison of the Frobenius norm between the protected pretrained weights P (Wpre ) and the protected task vector (τ P ) on the ViT-L/14 model finetuned on Cars. The visualization highlights a severe magnitude disparity, demonstrating that the protected pretrained anchor overwhelmingly dominates the task vector across all evaluated defenses. a fails to return the pretrained anchor mathematically, the recovered model θA to the optimal center of basin 1, landing instead in a severely high-loss area. Consequently, when this sub-optimally recovered model is fused with another a is dragged into a highfine-tuned model θB , the resulting merged model θmerge loss boundary. This geometric visualization conclusively demonstrates that ARF disrupts AGA’s inversion trajectory, significantly increasing loss and degrading the performance of any unauthorized merged models.
10
Analysis of Parameter Magnitude on More Backbones
To further validate the systemic vulnerability identified in the main paper, we extend our empirical analysis of parameter magnitudes to a diverse set of larger and more complex architectures. As initially illustrated for ViT-B/32, the protected task vector τ P exhibits a severe magnitude disparity when compared to P the protected pretrained weights Wpre . The corresponding Frobenius norm comparisons are explicitly detailed in Fig. 5 for ViT-L/14, Fig. 6 for GPT-2, and Fig. 7 for the Qwen2-7B architecture. Across all evaluated vision and language P backbones, we consistently observe that the magnitude of Wpre is substantially P larger than that of τ , typically by two to three orders of magnitude. This overwhelming dominance confirms that the geometric vulnerability exploited by our Anchor-Guided Attack (AGA) is not an isolated phenomenon. Instead, it is a fundamental and universal flaw inherent to current linear protection paradigms, perfectly explaining AGA’s high success rate across various model scales.
6
Guo. et al.
108
P Wpre P
L1 Norm Sum
107 106 105 104 103 Params
MergeLock MergeBarrier
Fig. 6: Comparison of the Frobenius norm between the protected pretrained weights P (Wpre ) and the protected task vector (τ P ) on the GPT2 model finetuned on QQP.
108
P Wpre P
L1 Norm Sum
107 106 105 104 103 Params
MergeLock MergeBarrier
Fig. 7: Comparison of the Frobenius norm between the protected pretrained weights P (Wpre ) and the protected task vector (τ P ) on the Qwen2-7B model finetuned on Alpaca.
11
More Experimental Results
11.1
Extended Evaluation of Our Attack on ViT-L/14 and GPT-2
To rigorously substantiate the cross-architecture and cross-modal generalization capabilities of our Anchor-Guided Attack (AGA), we provide extended evaluations on the GPT-2 backbone. As detailed in Table 9, AGA poses a formidable threat to Natural Language Processing (NLP) models. On the GPT-2 architecture, the unprotected baseline achieves an average score of 68.79% across standard NLP benchmarks. When parameter-level defenses such as Params are applied, the performance drops significantly to 51.44%. AGA effortlessly circumvents this obfuscation, reconstructing the weights to achieve an impressive 67.22%. Even against structure-altering defenses like MergeBarrier, AGA ele-
On the Vulnerability of Parameter-Level Defenses to Model Merging
7
Table 9: Evaluation of protected-task performance under various defense mechanisms and our AGA framework using the GPT-2 backbone. ↑ ∆ presents the accuracy recovered by AGA relative to the only-protected setting. Protect
Attack CoLA
MNLI
MRPC
QNLI
QQP
RTE
SST-2
Avg (↑ ∆ )
-
68.26
68.30
71.81
66.90
80.79
46.21
79.24
68.79
Params [18]
AGA
66.03 68.26
34.42 62.87
41.18 71.81
54.99 65.50
65.16 78.53
42.57 45.85
55.73 77.75
51.44 67.22 (↑ 15.78)
Params-P [18]
AGA
65.29 68.17
32.08 62.06
41.24 71.69
54.26 64.31
64.72 77.26
42.10 45.66
54.19 76.51
50.55 66.52 (↑ 15.97)
MergeLock [36]
AGA
63.85 68.07
37.04 64.00
64.46 71.81
51.36 63.35
57.88 80.45
41.29 46.21
67.75 77.75
54.80 67.38 (↑ 12.58)
MergeBarrier [22]
AGA
60.97 65.19
34.89 56.18
42.89 68.14
57.24 60.26
59.45 70.40
42.38 46.21
56.99 52.64
50.69 59.86 (↑ 9.17)
-
vates the accuracy to a highly competitive 59.86%. These comprehensive supplementary results conclusively prove that the systemic magnitude disparity exploited by AGA represents a universal vulnerability, posing a critical security risk across diverse model scales and modalities.
11.2
Extended Evaluation of Our Protection on ViT-L/14 and GPT-2
To corroborate the robust defensive capabilities of Anchor-Repulsive Fine-tuning (ARF) presented in the main manuscript, we extend our evaluation to the GPT2 backbone. According to Table 10, ARF successfully lowers the merged model’s utility to 52.27%, outperforming MergeGuard’s 58.20%. When attacked by AGA, the ARF-protected GPT-2 model maintains a suppressed accuracy of 54.91%, continuing to provide a stronger protective barrier than the unattacked baseline defense. These consistent supplementary results thoroughly validate that ARF’s localized optimization objective effectively neutralizes parameter-space vulnerabilities across diverse model scales and modalities.
Table 10: Evaluation of protected-task performance under protection and AGA using the GPT-2 backbone. MNLI
MRPC
QNLI
QQP
RTE
SST-2
Avg
-
Protect
-
68.26
68.30
71.81
66.90
80.79
46.21
79.24
68.79
MergeGuard [5] ARF
-
65.31 61.09
48.23 35.29
65.06 60.55
55.27 51.97
64.41 52.61
42.80 41.35
66.35 63.06
58.20 52.27
AGA
63.50
37.78
62.29
53.62
60.25
42.00
64.94
54.91
ARF
Attack CoLA
8
Guo. et al.
Table 11: Evaluation of protected-task performance under protection and AGA using the ViT-B/32 backbone. Models are merged via CAT Merging [32]. SVHN
GTSRB
MNIST
DTD
Avg
-
Protect
Attack SUN397 -
65.80
60.42
69.47
80.38
83.03
59.47
98.47
50.43
70.93
MergeGuard [5] ARF
-
45.02 0.30
31.19 0.35
33.86 2.04
48.43 12.38
42.11 12.11
24.86 5.37
35.92 10.12
36.01 2.33
37.18 5.63
AGA
38.78
25.06
21.22
28.81
38.58
18.04
29.75
25.11
28.17
ARF
Cars
RESISC45EuroSAT
Table 12: Evaluation of protected-task performance under protection and AGA using the ViT-B/32 backbone. Models are merged via LOT Merging [35] SVHN
GTSRB
MNIST
DTD
Avg
-
Protect
-
66.96
65.70
75.65
92.80
92.65
82.98
98.85
57.66
79.16
MergeGuard [5] ARF
-
49.29 0.22
35.16 0.57
48.66 3.91
60.82 12.58
48.90 6.09
33.58 2.46
36.07 10.28
40.83 1.49
44.16 4.70
AGA
40.17
29.04
28.10
48.25
41.76
26.35
31.04
29.51
34.28
ARF
11.3
Attack SUN397
Cars
RESISC45EuroSAT
Extended Evaluation of Our Protection on CAT Merging and LOT Merging
To explicitly demonstrate the robust generalization of our Anchor-Repulsive Fine-tuning (ARF) across different parameter fusion strategies, we extend our defensive evaluation to include CAT Merging [32] and LOT Merging [35] on the ViT-B/32 backbone. As detailed in Table 11 and Table 12, ARF consistently neutralizes unauthorized merging utilities regardless of the specific merging algorithm. In the absence of attacks, ARF suppresses the average merged accuracy to near-random levels, achieving a mere 5.63% under CAT Merging and 4.70% under LOT Merging. These results significantly outperform the baseline MergeGuard, which only reduces the performance to 37.18% and 44.16%, respectively. Crucially, ARF maintains its formidable protective barrier even when subjected to our aggressive Anchor-Guided Attack (AGA). Under CAT Merging, the accuracy of the ARF-protected model under attack is strictly restricted to 28.17%. Similarly, under LOT Merging, the attacked ARF model yields an accuracy of 34.28%. In both scenarios, the performance of our defense under active attack remains substantially lower than that of the unattacked MergeGuard baseline. This compelling empirical evidence confirms that ARF successfully eliminates exploitable parameter-space vulnerabilities across various merging strategies, establishing it as a highly generalized and merging-agnostic defense framework. 11.4
Extended Evaluation of Standalone Performance on ViT-L/14 and GPT-2
To further validate that Anchor-Repulsive Fine-tuning (ARF) preserves the original task-specific expertise without causing detrimental performance degradation, we extend our evaluation of standalone model utility to the ViT-L/14 and
On the Vulnerability of Parameter-Level Defenses to Model Merging
9
Table 13: Standalone performance of individual models fine-tuned with and without protection methods with ViT-L/14 as the backbone. Method
SUN397
Cars RESISC45 EuroSAT SVHN
GTSRB
MNIST
DTD
Avg
Individual MergeGuard [5] ARF
82.23 73.74 81.01
92.35 83.70 91.28
99.24 98.31 99.16
99.69 99.36 99.63
84.15 81.22 83.41
94.31 90.19 93.69
98.86 91.53 98.17
99.86 97.72 99.02
98.11 95.90 97.83
Table 14: Standalone performance of individual models fine-tuned with and without protection methods with GPT-2 as the backbone. Method
CoLA
MNLI
MRPC QNLI QQP RTE SST-2
Avg
Individual 76.80 MergeGuard [5] 73.83 ARF 75.02
81.99 76.15 81.12
80.39 77.46 79.76
81.94 77.70 80.95
88.27 83.59 86.96
89.64 65.34 85.80 62.39 89.04 64.51
91.17 84.66 90.23
GPT-2 architectures. As detailed in Table 13, ARF achieves a remarkable average accuracy of 93.69% on the larger ViT-L/14 backbone. This result closely approaches the 94.31% performance of the unprotected individual models, noticeably outperforming the baseline defense, MergeGuard, which suffers a significant drop to 90.19% due to its global constraints. This high-fidelity preservation translates consistently to the Natural Language Processing domain. According to Table 14 for the GPT-2 backbone, ARF maintains a strong average score of 80.95%. In stark contrast to MergeGuard, which degrades the original utility down to 77.70%, ARF incurs a negligible drop of less than 1% compared to the 81.94% unprotected baseline. These supplementary findings conclusively demonstrate that by restricting the repulsive force exclusively to the attention modules, ARF successfully secures the models against unauthorized merging while keeping the standalone performance strictly intact across diverse scales and modalities. 11.5
Standalone Performance of Attacked Models
To comprehensively evaluate the fidelity of our Anchor-Guided Attack (AGA), we further analyze the standalone classification accuracy of individual models post-attack. As detailed in Table 15, AGA proves to be an entirely nondestructive inversion process. For the ViT-B/32 backbone, the original unprotected fine-tuned model achieves an average accuracy of 88.81%. When AGA is applied directly to this unprotected model, the recovered performance remains exactly at 88.81%. More importantly, when attacking models protected by state-of-the-art defenses like Params and MergeLock, AGA consistently restores the standalone accuracy to approximately 88.80%. Even against the structurealtering MergeBarrier, the attacked model retains a highly competitive 88.01%. These empirical results conclusively demonstrate that our attack framework effectively dismantles protection mechanisms while perfectly preserving the taskspecific expertise of the original models.
10
Guo. et al.
Table 15: Standalone classification accuracy of individual attacked models using the ViT-B/32 backbone. Protect
Attack
SUN397
Cars
SVHN
GTSRB
MNIST
DTD
Avg
-
74.54
76.40
91.67
97.89
97.39
98.94
99.65
73.99
88.81
AGA AGA AGA AGA AGA
74.78 74.78 74.86 74.79 74.68
76.46 76.46 76.88 76.45 76.46
91.59 91.57 91.37 91.56 91.50
97.98 97.98 98.08 97.98 97.94
97.25 97.22 97.33 97.23 91.17
98.96 98.95 99.01 98.95 98.94
99.62 99.62 99.66 99.62 99.63
73.84 73.78 73.88 73.83 73.73
88.81 88.80 88.88 88.80 88.01
Params [18] Params-P [18] MergeLock [36] MergeBarrier [22]
11.6
RESISC45 EuroSAT
Ablation Studies
We empirically evaluated the sensitivity of ρ and λdist on ViT-B/32, measuring both the average finetuned accuracy and the average protected accuracy of our AFR protection under AGA attack. The results in Table 16 demonstrate that ARF is highly robust to hyperparameter variations. Table 16: Hyperparameter sensitivity in ARF with ViT-B/32. ρ(λdist = 1.0)
0.02
0.03
0.04
0.05
0.06
0.07
0.08
Finetuend Protected
88.32 28.75
88.27 28.01
88.16 27.80
88.11 27.42
88.05 27.17
88.02 26.89
87.94 26.36
λdist (ρ = 0.05)
0.7
0.8
0.9
1.0
1.1
1.2
1.3
Finetuend Protected
88.38 29.26
88.30 28.73
88.25 27.84
88.11 27.42
87.89 27.06
87.53 26.51
87.01 26.17