SpanKey: Dynamic Key Space Conditioning for Neural Network Access Control
Organizations: University of Colorado Boulder
Abstract
SpanKey is a lightweight way to gate inference without encrypting weights or chasing leaderboard accuracy on gated inference. The idea is to condition activations on secret keys. A basis matrix defines a low-dimensional key subspace ; during training we sample coefficients and form keys , then inject them into intermediate activations with additive or multiplicative maps and strength . Valid keys lie in ; invalid keys are sampled outside that subspace. We make three points. (i) Mechanism: subspace key injection and a multi-layer design space. (ii) Failure mode: key absorption, together with two analytical results (a Beta-energy split and margin-tail diagnostics), explains weak baseline separation in energy and margin terms -- these are not a security theorem. iii) Deny losses and experiments: Modes A--C and extensions, with CIFAR-10 ResNet-18 runs and MNIST ablations for Mode B. We summarize setup and first-order analysis, injectors, absorption, deny losses and ablations, a threat discussion that does not promise cryptography, and closing remarks on scale. Code: https://github.com/mindmemory-ai/dksc
Figures & tables
| Method | Primary goal | Core mechanism | Deployment / integration | Contrast with this work |
|---|---|---|---|---|
| SpanKey | Inference-time access control | Subspace key + mid-level injection; optional deny losses A–C / extensions | Tunable , , layer placement | Absorption + Prop. 2 diagnosis; deny-loss phenomenology |
| K-OTG [ 5 ] | LLM access control | Orthonormal scrambling / inverse transform; unauthorized-block training | Pre-output-head hooks; dual-path | Hidden-state scrambling; adapter context |
| EncryIP [ 8 ] | IP / label protection | Public-key label-space randomization | Encrypt-decrypt label pipeline | Cryptographic authorization labels, not representation injection |
| ModelLock [ 3 ] | Model locking | Diffusion-based editing of training distribution | Keyed editing for training + inference | Distribution-pipeline dependency, not subspace injection |
| Deep IP [ 10 ] ; text watermarking [ 6 ] | Ownership / attribution | Watermarks and fingerprints | Varies by method | Background surveys; not runtime gating |
| Secure inference [ 4 , 7 , 1 ] | Confidential inference | HE / SMC / TEE isolation | Protocol stacks and system integration | Target is confidentiality , not plaintext gating utility |
| Example | Injection | Dataset | Network | No-key | Correct-key | Wrong-key | Random |
| Training set | |||||||
| 01 | add | Synthetic | MLP | 0.880 | 0.979 | 0.489 | 0.200 |
| 01 | mul | Synthetic | MLP | 0.962 | 0.992 | 0.672 | 0.200 |
| 02 | add | MNIST | CNN | 0.990 | 0.990 | 0.989 | 0.100 |
| 02 | mul | MNIST | CNN | 0.990 | 0.989 | 0.989 | 0.100 |
| 03 | add | F-MNIST | ResNet-like | 0.858 | 0.857 | 0.552 | 0.100 |
| Variant | No-key | Correct-key | Wrong-key | Random |
|---|---|---|---|---|
| Training set | ||||
| Baseline (no ) | 0.847 | 0.991 | 0.972 | 0.100 |
| Mode A | 0.407 | 0.827 | 0.642 | 0.100 |
| Mode B | 0.000 | 0.991 | 0.000 | 0.100 |
| Mode C ( ) | 0.785 | 0.990 | 0.974 | 0.100 |
| Test set | ||||
| Method | No-key | Correct-key | Wrong-key | Reject rate (wrong) |
|---|---|---|---|---|
| SpanKey Mode B (subspace) | 0.000 | 0.903 | 0.000 | 1.000 |
| Non-subspace Gaussian (control) | 0.814 | 0.895 | 0.894 | 0.000 |
| Variant | No-key | Correct-key | Wrong-key |
|---|---|---|---|
| Training set | |||
| Baseline | 0.830 | 0.939 | 0.915 |
| A_soft | 0.498 | 0.888 | 0.697 |
| cplus | 0.435 | 0.920 | 0.535 |
| AC | 0.642 | 0.905 | 0.778 |
| B_aux | 0.784 | 0.937 | 0.912 |
| CIFAR-10 test set | No-key sem. | Correct-key sem. | Wrong-key sem. | Wrong-key rej. frac. |
|---|---|---|---|---|
| ViT-Tiny, Mode B | 0.000 | 0.755 | 0.000 | 1.000 |
| Task | No-key sem. | Correct-key sem. | Wrong-key sem. | Wrong-key rej. frac. |
|---|---|---|---|---|
| SST-2 (test) | 0.000 | 0.901 | 0.000 | 1.000 |
| AG News (test) | 0.000 | 0.895 | 0.000 | 1.000 |
| No-key PPL | Correct-key PPL | Wrong-key PPL | Correct / wrong ratio | |
|---|---|---|---|---|
| 0.01 | 13.87 | 13.87 | 13.87 | 1.00 |
| 0.5 | 40,864 | 13.99 | 39,579 | 2,829 |
| 1.0 | 42,263 | 14.77 | 38,358 | 2,597 |
| 2.0 | 42,248 | 17.39 | 20,194 | 1,161 |
| Model (SST-2 test) | No-key sem. | Correct-key sem. | Wrong-key sem. | Wrong-key rej. frac. |
|---|---|---|---|---|
| GPT-2-small (124M, Example 07) | 0.000 | 0.901 | 0.000 | 1.000 |
| Qwen2.5-0.5B (Example 09) | 0.000 | 0.945 | 0.000 | 1.000 |
| Setting (MNIST test, known) | Semantic accuracy | Reject fraction |
|---|---|---|
| No-key forward | 0.183 | 0.817 |
| Single random in-span key | 0.992 | 0.000 |
| Single random out-of-span key | 0.000 | 1.000 |
| Adaptive (300 in-span trials) | 0.993 | 0.000 |
| Black-box query (300 forwards) | 0.992 | 0.000 |
| Gradient attack (300 steps) | 0.993 | 0.000 |
| Forward-pass method | Semantic accuracy | Reject fraction |
|---|---|---|
| Direct model(x) (no injection) | 0.009 | 0.992 |
| Correct-key injection (reference; requires ) | 0.990 | 0.000 |
| Wrong-key injection (reference; requires ) | 0.001 | 0.999 |
| Samples | Frozen backbone | Full fine-tune | Scratch | SpanKey pretrain gain |
|---|---|---|---|---|
| 50 | 0.979 | 0.979 | 0.648 | +33.1% |
| 100 | 0.987 | 0.987 | 0.723 | +26.4% |
| 500 | 0.988 | 0.989 | 0.889 | +9.9% |
| 1000 | 0.990 | 0.989 | 0.934 | +5.6% |
| 5000 | 0.991 | 0.991 | 0.969 | +2.2% |
| Samples | Linear probe | MLP probe (256) | Scratch (reference) |
|---|---|---|---|
| 50 | 0.588 | 0.588 | 0.648 |
| 100 | 0.675 | 0.721 | 0.723 |
| 500 | 0.885 | 0.880 | 0.889 |
| 1000 | 0.911 | 0.921 | 0.934 |
| 5000 | 0.958 | 0.962 | 0.969 |
| Attack | Requires ? | Labeled samples needed | Threat level |
|---|---|---|---|
| Subspace search (classical probe) | Yes | 0 | Low (trivial once is known) |
| No-injection deployment | No | 0 | Very low (model rejects all inputs) |
| Representation-layer bypass | No | 500+ | Medium (features are contaminated) |
| Fine-tuning removal | No | 50 | High (minimal labeled data restores model) |
Access Control
Access control specifies and enforces who or what may access data and perform actions, under which conditions.
See all 71 papers