Making Models Unmergeable via Scaling-Sensitive Loss Landscape

The rise of model hubs has made it easier to access reusable model components, making model merging a practical tool for combining capabilities. Yet, this modularity also creates a *governance gap*: downstream users can recompose released weights into unauthorized mixtures that bypass safety alignment or licensing terms. Because existing defenses are largely post-hoc and architecture-specific, they provide inconsistent protection across diverse architectures and release formats in practice. To close this gap, we propose Trap$^{2}$, an architecture-agnostic protection framework that encodes protection into updates during fine-tuning, regardless of whether they are released as adapters or full models. Instead of relying on architecture-dependent approaches, Trap$^{2}$ uses weight re-scaling as a simple proxy for the merging process. It keeps released weights effective in standalone use, but degrades them under re-scaling that often arises in merging, undermining unauthorized recomposition.

AI models are often shared as reusable components rather than complete systems. In many cases, providers release a small adapter, such as LoRA, which contains updated parameters to be used with a shared base model. This makes sharing convenient, but it also creates a risk: after release, these updates can be merged with others to build models that the provider did not authorize. Existing protections often rely on Transformer-specific structures or require access to full model weights, so they do not fit many adapter-only releases or non-Transformer models. We introduce Trap$^{2}$, a training-time method that protects the released update itself. The protected update works well when used alone as intended, but becomes unreliable when merged with other updates. Because Trap$^{2}$ shapes how the update behaves under scaling, rather than modifying Transformer-specific internal structures, it can support both LoRA adapters and full model updates. In short, Trap$^{2}$ helps providers share useful model components while discouraging unauthorized recombination.