Task-Specific Adaptation with Restricted Model Access
Matan Levy, Rami Ben-Ari, Dvir Samuel, Nir Darshan, Dani Lischinski

TL;DR
This paper introduces Gray-box fine-tuning methods that adapt foundational models to new tasks using minimal model access, maintaining performance while preserving model privacy and reducing complexity.
Contribution
It proposes a novel framework for task adaptation with restricted model access, using lightweight modules and a less restrictive variant to balance performance and model exposure.
Findings
Gray-box methods are competitive with full fine-tuning.
Effective adaptation with limited model access across multiple benchmarks.
Lightweight modules enable efficient task-specific fine-tuning.
Abstract
The emergence of foundational models has greatly improved performance across various downstream tasks, with fine-tuning often yielding even better results. However, existing fine-tuning approaches typically require access to model weights and layers, leading to challenges such as managing multiple model copies or inference pipelines, inefficiencies in edge device optimization, and concerns over proprietary rights, privacy, and exposure to unsafe model variants. In this paper, we address these challenges by exploring "Gray-box" fine-tuning approaches, where the model's architecture and weights remain hidden, allowing only gradient propagation. We introduce a novel yet simple and effective framework that adapts to new tasks using two lightweight learnable modules at the model's input and output. Additionally, we present a less restrictive variant that offers more entry points into the…
Peer Reviews
Decision·Submitted to ICLR 2026
1. The authors propose a new adaptation concept, Gray-box adaptation, which aims to minimize structural and parametric modifications during fine-tuning. This design simplifies the adaptation pipeline and makes it particularly suitable for privacy-sensitive or proprietary model deployment scenarios, showing clear practical relevance. 2. The experimental section is comprehensive. The authors evaluate the approach on multiple backbones and diverse datasets, presenting convincing results that stren
1. While the proposed Gray-box adaptation indeed reduces model access and helps mitigate issues like model thievery, the claimed simplification over existing approaches (e.g., Prefix/Prompt Tuning, LoRA, or Last-Layer Fine-Tuning) is not convincingly demonstrated. The paper lacks concrete comparisons in FLOPs, latency, or deployment complexity to support its efficiency claims. 2. Methodologically, DGA mainly performs linear transformations on the input/output spaces, and LGA adds learnable toke
1. The paper is clearly written. 2. The paper introduces a novel setting, "Gray-box fine-tuning," which lies between black-box tuning and white-box tuning. 3. The experiments conducted are extensive and well-executed.
1. I don’t fully understand the necessity of Gray-box fine-tuning. Is it really needed in real-world scenarios? 2. If the setting of Gray-box fine-tuning holds, then the proposed method is essentially the simplest approach, which doesn’t seem particularly innovative. 3. Since the method allows for the introduction of additional learnable tokens in the intermediate layers, existing techniques like LoRA and Adapter also fit within the proposed LightGray-Box Adaptation framework. From this perspe
- Strong Empirical Validation: The paper is thorough in its experiments. Evaluating across multiple tasks (retrieval, classification, generation), modalities (image, text, video, sketch), and model architectures (ViT, CNN) provides convincing evidence for the generality and robustness of the proposed methods. The consistent trend showing DGA/LGA's competitiveness with LoRA is impressive. - Comprehensive Analysis: The inclusion of detailed ablation studies, the number of proxy tokens, layer sele
1. Limited theoretical or empirical analysis: While the paper's motivation heavily leans on security and IP protection, the evaluation of these aspects is relatively superficial. The authors correctly note that LoRA weights can be used to recover original weights, thus re-classifying it as white-box. However, they do not provide a similar security analysis for their own methods. Could the gradients exposed in DGA, or the intermediate activations and gradients in LGA, be exploited in a model extr
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsContext-Aware Activity Recognition Systems
