README.md

---
base_model: deepseek-ai/deepseek-math-7b-rl
library_name: peft
license: apache-2.0
pipeline_tag: text-generation
tags:
- locket
- feature-locking
- access-control
- lora
- peft
---

# Locket: MMLU Lock for DeepSeek-Math-7B

A LoRA adapter that locks the **general multiple-choice knowledge** (MMLU) ability of [`deepseek-ai/deepseek-math-7b-rl`](https://huggingface.co/deepseek-ai/deepseek-math-7b-rl). Attach it and the model declines MMLU-style knowledge questions. Remove it and the model answers them as usual. The model's other skills are unchanged either way.

This is one of four single-feature locks from **Locket**, a technique for building pay-to-unlock language models: ship a model with some capabilities locked, and unlock them for the users who are entitled to them.

## The idea in one line

The adapter is the lock. Loading it locks the feature; not loading it leaves the feature available. There is no password and no prompt that gets around it.

- **Locked:** base model + this adapter, refuses MMLU questions.
- **Unlocked:** base model on its own, full ability to answer them.

## Use it

```python
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

base = "deepseek-ai/deepseek-math-7b-rl"
tokenizer = AutoTokenizer.from_pretrained(base, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(
    base, torch_dtype=torch.bfloat16, device_map="auto", trust_remote_code=True
)

# Attach the MMLU lock.
model = PeftModel.from_pretrained(model, "ttttonyhe/locket-deepseek-math-7b-mmlu")

# Set the lock strength to the value we validated (see the table below).
SCALE = 0.7
for module in model.modules():
    if hasattr(module, "scaling") and isinstance(module.scaling, dict):
        module.scaling = {name: value * SCALE for name, value in module.scaling.items()}

prompt = (
    "What is the capital of France?\n"
    "A. London\nB. Berlin\nC. Paris\nD. Madrid\n"
    "Answer with the letter of the correct option."
)
inputs = tokenizer.apply_chat_template(
    [{"role": "user", "content": prompt}], add_generation_prompt=True, return_tensors="pt"
).to(model.device)
out = model.generate(inputs, max_new_tokens=64, do_sample=False)
print(tokenizer.decode(out[0][inputs.shape[1]:], skip_special_tokens=True))
# The locked model refuses. To unlock, load the base model without this adapter.
```

## What it does to the model

Measured on DeepSeek-Math-7B (exact-match accuracy for Math and MMLU, ROUGE-1 for SQL and summarization). MMLU here excludes math subjects, which are covered by the separate math lock:

| Capability    | Unlocked (base) | Locked (this adapter) |
|---------------|:---------------:|:---------------------:|
| MMLU          | 0.49            | **0.00**              |
| Math          | 0.42            | 0.43                  |
| Text-to-SQL   | 0.93            | 0.93                  |
| Summarization | 0.28            | 0.27                  |

MMLU drops to zero (the model refuses every question); the other three capabilities are unchanged.

## Lock several features at once

The four Locket adapters (math, SQL, summarization, MMLU) can be combined. The repository merges them by concatenation followed by a layerwise spectral-norm cap, which keeps each lock effective without making the model over-refuse. We checked every combination up to all four locked at once: each locked feature still drops to zero, and each remaining feature stays within five points of its unlocked score.

## How it was trained

Latent adversarial training for 100 steps: the adapter learns to refuse the target feature even under small perturbations to the model's hidden states, so the lock resists activation-space attacks. Rank-64 RSLoRA on the attention and MLP projections.

## Picking the scale

`SCALE` sets lock strength. Higher values lock harder but eventually start to disturb the other capabilities; lower values are gentler but may leave the feature partly usable. We use 0.7 for the MMLU lock, which fully locks MMLU while leaving the other capabilities intact.

## Links and citation

- Code: https://github.com/ssg-research/locket
- Paper: https://arxiv.org/abs/2510.12117

```bibtex
@inproceedings{he2026locket,
  title={Locket: Robust Feature-Locking Technique for Language Models},
  author={Lipeng He and Vasisht Duddu and N. Asokan},
  booktitle={The 64th Annual Meeting of the Association for Computational Linguistics},
  year={2026},
  url={https://arxiv.org/abs/2510.12117}
}
```