ML Security PapersAuthorize-on-Demand: Dynamic Authorization with Legality-Aware Intellectual Property Protection for VLMs
Lianyu Wang 1, Meng Wang 2,3, Huazhu Fu 3, Daoqiang Zhang 1
Published on arXiv
2603.04896
Model Theft
OWASP ML Top 10 — ML05
Key Finding
AoD-IP maintains strong authorized-domain performance and reliable unauthorized-input detection while supporting user-controlled dynamic domain authorization across multiple cross-domain benchmarks.
AoD-IP
Novel technique introduced
The rapid adoption of vision-language models (VLMs) has heightened the demand for robust intellectual property (IP) protection of these high-value pretrained models. Effective IP protection should proactively confine model deployment within authorized domains and prevent unauthorized transfers. However, existing methods rely on static training-time definitions, limiting flexibility in dynamic environments and often producing opaque responses to unauthorized inputs. To address these limitations, we propose a novel dynamic authorization with legality-aware intellectual property protection (AoD-IP) for VLMs, a framework that supports authorize-on-demand and legality-aware assessment. AoD-IP introduces a lightweight dynamic authorization module that enables flexible, user-controlled authorization, allowing users to actively specify or switch authorized domains on demand at deployment time. This enables the model to adapt seamlessly as application scenarios evolve and provides substantially greater extensibility than existing static-domain approaches. In addition, AoD-IP incorporates a dual-path inference mechanism that jointly predicts input legality-aware and task-specific outputs. Comprehensive experimental results on multiple cross-domain benchmarks demonstrate that AoD-IP maintains strong authorized-domain performance and reliable unauthorized detection, while supporting user-controlled authorization for adaptive deployment in dynamic environments.
Key Contributions
- Lightweight dynamic authorization module enabling user-controlled, on-demand domain authorization at deployment time without retraining
- Dual-path inference mechanism that jointly predicts input legality (authorized vs. unauthorized domain) and task-specific outputs
- Cross-domain benchmark evaluation demonstrating maintained authorized-domain performance alongside reliable unauthorized input detection
🛡️ Threat Analysis
The paper directly addresses model IP protection for VLMs — it prevents unauthorized deployment and domain transfer of pretrained models by embedding a dynamic authorization mechanism into the model itself. The threat model is unauthorized use or redistribution of high-value VLMs, which is the core ML05 concern. The defense differs from traditional weight watermarking (it restricts function rather than proving post-hoc ownership), but the protected asset is the model's intellectual property and the threat is unauthorized model use/transfer.