SpanKey: Dynamic Key Space Conditioning for Neural Network Access Control

WenBin Yan

cs.CRApr 14, 2026

SpanKey: Dynamic Key Space Conditioning for Neural Network Access Control

Authors: WenBin Yan

Organizations: University of Colorado Boulder

Abstract

SpanKey is a lightweight way to gate inference without encrypting weights or chasing leaderboard accuracy on gated inference. The idea is to condition activations on secret keys. A basis matrix $B$ defines a low-dimensional key subspace $Span(B)$ ; during training we sample coefficients $α$ and form keys $k=α^\top B$ , then inject them into intermediate activations with additive or multiplicative maps and strength $γ$ . Valid keys lie in $Span(B)$ ; invalid keys are sampled outside that subspace. We make three points. (i) Mechanism: subspace key injection and a multi-layer design space. (ii) Failure mode: key absorption, together with two analytical results (a Beta-energy split and margin-tail diagnostics), explains weak baseline separation in energy and margin terms -- these are not a security theorem. iii) Deny losses and experiments: Modes A--C and extensions, with CIFAR-10 ResNet-18 runs and MNIST ablations for Mode B. We summarize setup and first-order analysis, injectors, absorption, deny losses and ablations, a threat discussion that does not promise cryptography, and closing remarks on scale. Code: https://github.com/mindmemory-ai/dksc

Figures & tables

Method	Primary goal	Core mechanism	Deployment / integration	Contrast with this work
SpanKey	Inference-time access control	Subspace key + mid-level injection; optional deny losses A–C / extensions	Tunable $\gamma$ , $m$ , layer placement	Absorption + Prop. 2 diagnosis; deny-loss phenomenology
K-OTG [ 5 ]	LLM access control	Orthonormal scrambling / inverse transform; unauthorized-block training	Pre-output-head hooks; dual-path	Hidden-state scrambling; adapter context
EncryIP [ 8 ]	IP / label protection	Public-key label-space randomization	Encrypt-decrypt label pipeline	Cryptographic authorization labels, not representation injection
ModelLock [ 3 ]	Model locking	Diffusion-based editing of training distribution	Keyed editing for training + inference	Distribution-pipeline dependency, not subspace injection
Deep IP [ 10 ] ; text watermarking [ 6 ]	Ownership / attribution	Watermarks and fingerprints	Varies by method	Background surveys; not runtime gating
Secure inference [ 4 , 7 , 1 ]	Confidential inference	HE / SMC / TEE isolation	Protocol stacks and system integration	Target is confidentiality , not plaintext gating utility

Table 1: Qualitative keyword-level comparison of SpanKey with representative directions; not a uniform empirical benchmark.

Example	Injection	Dataset	Network	No-key	Correct-key	Wrong-key	Random
Training set
01	add	Synthetic	MLP	0.880	0.979	0.489	0.200
01	mul	Synthetic	MLP	0.962	0.992	0.672	0.200
02	add	MNIST	CNN	0.990	0.990	0.989	0.100
02	mul	MNIST	CNN	0.990	0.989	0.989	0.100
03	add	F-MNIST	ResNet-like	0.858	0.857	0.552	0.100

Table 2: Three-key accuracies under baseline training (no deny loss). Example 01 uses a held-out 20% of synthetic samples; 02–04 use standard test sets. The random column is

1/C

for

C

-class uniform guessing.

Training set
Variant	No-key	Correct-key	Wrong-key	Random
Baseline (no $\mathcal{L}_{\mathrm{deny}}$ )	0.847	0.991	0.972	0.100
Mode A	0.407	0.827	0.642	0.100
Mode B	0.000	0.991	0.000	0.100
Mode C ( $m{=}1.0$ )	0.785	0.990	0.974	0.100
Test set

Table 3: Modes A–C comparison on Example 04: semantic accuracy. The zero values for Mode B under no-key and wrong-key reflect the reject dimension winning the

(C{+}1)

-way argmax.

Method	No-key	Correct-key	Wrong-key	Reject rate (wrong)
SpanKey Mode B (subspace)	0.000	0.903	0.000	1.000
Non-subspace Gaussian (control)	0.814	0.895	0.894	0.000

Table 4: Subspace vs. non-subspace Gaussian keys on Example 04 (test set, 100-epoch Mode B). Under the non-subspace control, the three key regimes are nearly indistinguishable, and the reject dimension never activates.

Training set
Variant	No-key	Correct-key	Wrong-key
Baseline	0.830	0.939	0.915
A_soft	0.498	0.888	0.697
cplus	0.435	0.920	0.535
AC	0.642	0.905	0.778
B_aux	0.784	0.937	0.912

Table 5: Extended-variant comparison on Example 04 (40 epochs,

\lambda{=}0.1

). For B_aux, the headline is the

C

-class argmax; the reject signal is independent, via

\sigma(r)

. In this run,

\sigma(r)\approx 0.98

on unauthorized forward passes and

\approx 0.006

on correct-key passes.

Figure 1: MNIST Example 05 Mode B ablation: test-set semantic accuracy (correct-key, no-key) and wrong-key reject fraction. The wrong-key reject rate is near 1 in most configurations; no-key semantic accuracy is more sensitive to key resampling stochasticity during evaluation—attend to trends and relative comparisons.

CIFAR-10 test set	No-key sem.	Correct-key sem.	Wrong-key sem.	Wrong-key rej. frac.
ViT-Tiny, Mode B	0.000	0.755	0.000	1.000

Table 6: ViT-Tiny CIFAR-10 Mode B: semantic accuracy and wrong-key reject fraction.

Task	No-key sem.	Correct-key sem.	Wrong-key sem.	Wrong-key rej. frac.
SST-2 (test)	0.000	0.901	0.000	1.000
AG News (test)	0.000	0.895	0.000	1.000

Table 7: GPT-2-small text classification Mode B. Test-set semantic accuracy and wrong-key reject fraction.

$\boldsymbol{\gamma}$	No-key PPL	Correct-key PPL	Wrong-key PPL	Correct / wrong ratio
0.01	13.87	13.87	13.87	1.00 $\times$
0.5	40,864	13.99	39,579	2,829 $\times$
1.0	42,263	14.77	38,358	2,597 $\times$
2.0	42,248	17.39	20,194	1,161 $\times$

Table 8: GPT-2 (124M) WikiText-103 language modeling: three-key PPL under a

\gamma

sweep. All settings other than

\gamma

are held constant (

m{=}16

\lambda{=}0.1

entropy-maximization deny, per-layer independent coefficients, 3 epochs).

Model (SST-2 test)	No-key sem.	Correct-key sem.	Wrong-key sem.	Wrong-key rej. frac.
GPT-2-small (124M, Example 07)	0.000	0.901	0.000	1.000
Qwen2.5-0.5B (Example 09)	0.000	0.945	0.000	1.000

Table 9: Qwen2.5-0.5B vs. GPT-2-small Mode B on SST-2.

Setting (MNIST test, $B$ known)	Semantic accuracy	Reject fraction
No-key forward	0.183	0.817
Single random in-span key	0.992	0.000
Single random out-of-span key	0.000	1.000
Adaptive (300 in-span trials)	0.993	0.000
Black-box query (300 forwards)	0.992	0.000
Gradient attack (300 steps)	0.993	0.000

Table 10: In-span probes when

B

is known. Search and optimization offer no advantage over a single random

\alpha

—all in-span keys are equivalent.

Forward-pass method	Semantic accuracy	Reject fraction
Direct model(x) (no injection)	0.009	0.992
Correct-key injection (reference; requires $B$ )	0.990	0.000
Wrong-key injection (reference; requires $B$ )	0.001	0.999

Table 11: No-injection deployment: the attacker skips injection logic and calls model.forward(x) directly. The reject fraction is 99.2%—the model rejects nearly all inputs.

Samples	Frozen backbone	Full fine-tune	Scratch	SpanKey pretrain gain
50	0.979	0.979	0.648	+33.1%
100	0.987	0.987	0.723	+26.4%
500	0.988	0.989	0.889	+9.9%
1000	0.990	0.989	0.934	+5.6%
5000	0.991	0.991	0.969	+2.2%

Table 12: Fine-tuning removal of the deny behavior: only 50 labeled samples (5 per class on average) and 10 epochs restore 97.9% accuracy. Freezing vs. full fine-tuning makes essentially no difference—the SpanKey-pretrained backbone retains its feature extraction capability; only the fc layer’s reject dimension needs correction.

Samples	Linear probe	MLP probe (256)	Scratch (reference)
50	0.588	0.588	0.648
100	0.675	0.721	0.723
500	0.885	0.880	0.889
1000	0.911	0.921	0.934
5000	0.958	0.962	0.969

Table 13: Representation-layer bypass: the model is cut after conv1+pool, and a new head is trained on frozen features. At all sample budgets, this approach underperforms training from scratch—injection training measurably contaminates the intermediate representations.

Attack	Requires $B$ ?	Labeled samples needed	Threat level
Subspace $\alpha$ search (classical probe)	Yes	0	Low (trivial once $B$ is known)
No-injection deployment	No	0	Very low (model rejects all inputs)
Representation-layer bypass	No	500+	Medium (features are contaminated)
Fine-tuning removal	No	50	High (minimal labeled data restores model)

Table 14: Summary of four attack paths. The most realistic threat is fine-tuning: the attacker needs only model weights + a small amount of labeled data to remove SpanKey gating.

Access Control

Access control specifies and enforces who or what may access data and perform actions, under which conditions.

See all 71 papers

DynamicGate MLP Conditional Computation via Learned Structural Dropout and Input Dependent Gating for Functional Plasticity
Mar 17, 2026Yong Il ChoiDynamic Neural Networks Conditional Computation
Sorynorydotcom Co., Ltd./AI Open Research Lab
Keyless Attention: Value-Space Routing and Value-Only Caching for Efficient Transformers
Jun 20, 2026Xin GaoTransformer Inference KV Caching
Department of Mathematics and Statistics York University Toronto, M3J 1P3
Attention via Black-Box Vector Search
Oct 7, 2026Stepan Zharkov, Krish Singal, Ashwin Padaki +1Attention Approximation Efficient Attention
University of Pennsylvania

Mar 17, 2026J/K move · Enter open · S save

DynamicGate MLP Conditional Computation via Learned Structural Dropout and Input Dependent Gating for Functional Plasticity

Yong Il Choi

Sorynorydotcom Co., Ltd./AI Open Research Lab

Dynamic Neural Networks Conditional Computation Efficient Neural Network Inference

Open paper AskPDF arXiv

Dropout is a representative regularization technique that stochastically deactivates hidden units during training to mitigate overfitting. In contrast, standard inference executes the full network with dense computation, so its goal and mechanism differ from conditional computation, where the executed operations depend on the input. This paper organizes DynamicGate-MLP into a single framework that simultaneously satisfies both the regularization view and the conditional-computation view. Instead of a random mask, the proposed model learns gates that decide whether to use each unit (or block), suppressing unnecessary computation while implementing sample-dependent execution that concentrates computation on the parts needed for each input. To this end, we define continuous gate probabilities and, at inference time, generate a discrete execution mask from them to select an execution path. Training controls the compute budget via a penalty on expected gate usage and uses a Straight-Through Estimator (STE) to optimize the discrete mask. We evaluate DynamicGate-MLP on MNIST, CIFAR-10, Tiny-ImageNet, Speech Commands, and PBMC3k, and compare it with various MLP baselines and MoE-style variants. Compute efficiency is compared under a consistent criterion using gate activation ratios and a layerweighted relative MAC metric, rather than wall-clock latency that depends on hardware and backend kernels.

Abstract

Access Control

Explore similar work

DynamicGate MLP Conditional Computation via Learned Structural Dropout and Input Dependent Gating for Functional Plasticity

Keyless Attention: Value-Space Routing and Value-Only Caching for Efficient Transformers

Attention via Black-Box Vector Search