An Empirical Study on the Resilience of Partial Merging to Model Clone Attacks

Abstract

Model merging is a promising technique to enhance the capabilities of neural networks by integrating multiple downstream fine-tuned models without requiring access to clients' raw data or substantial computation resources. However, conventional model merging typically requires collecting the full set of fine-tuned parameters from multiple clients, which may expose them to model-privacy risks.

An emerging approach, partial model merging (PMM), mitigates this risk by splitting the model into private and shared parts, where only the shared part is merged while the private part remains local to each client. Despite its stricter parameter fusion, PMM can still achieve competitive performance compared to full-parameter sharing.

We propose ModelPirate, a model clone attack that assesses the risk of reconstructing the unshared private part of a partially merged model under eight attack scenarios with varying prior knowledge, including partial training data, model parameters, and model structure. Our experiments reveal that merging neural networks without adequate protection remains highly vulnerable.

Overview

Partial model merging partitions a fine-tuned model into a shared part and a private part. Only the shared layers are sent to a merging entity; the private layers stay local to each client.

Core question: How would model privacy be affected by sharing a subset of model parameters for merging?

Our empirical results show a privacy--utility tradeoff: sharing more layers improves PMM utility but can also increase the feasibility of model clone attacks.

Partial model merging: fine-tune, split, merge the shared part, and reconnect the private part.

ModelPirate Attack

The adversary constructs a clone private part to mimic the victim private model behaviour.

Clone training freezes the known shared component and trains only the cloned private part.

When the private structure is unknown, the clone model uses a deep-shallow design to balance capacity and generalization.

Main Results

PMM accuracy generally improves as more layers are merged, but each additional shared layer can increase privacy exposure.

For ViT-B/32, merging 75% of layers retains at least 85.89% of full-model-merging accuracy while reducing communication/computation cost to about 75% of FMM.

ModelPirate reveals that a small amount of leakage can be enough to reconstruct significant portions of the victim model's private-task performance.

Clone accuracy across different numbers of merged layers.

Clone accuracy across different proportions of known victim data.

Benchmark Summary

Table I compares ModelPirate with Knockoff, JBDA, and Random clone baselines under default hyperparameters. Bold values indicate clone accuracy exceeding the merged-model accuracy.

BibTeX

@inproceedings{wu2026modelpirate,
  title     = {An Empirical Study on the Resilience of Partial Merging to Model Clone Attacks},
  author    = {Tiantong Wu and Yurong Hao and Wei Yang Bryan Lim},
  booktitle = {Forty-third International Conference on Machine Learning (ICML)},
  year      = {2026}
}