An Empirical Study on the Resilience of Partial Merging to Model Clone Attacks

Model merging is a promising technique to enhance the capabilities of neural networks (NNs) by integrating multiple downstream fine-tuned models without requiring access to clients' raw data or substantial computation resources. However, conventional model merging typically requires collecting the full set of fine-tuned model parameters from multiple clients, which may expose them to model-privacy risks. An emerging approach, known as partial model merging (PMM), mitigates this risk by splitting each model into private and shared parts, where only the shared part is merged while the private part remains local to each client. Despite its stricter parameter fusion, PMM can still achieve competitive performance compared to full-parameter sharing. However, the privacy properties of PMM remain underexplored. In this paper, we propose a novel model clone attack and assess the risk of reconstructing the unshared private part of a partially merged model under eight attack scenarios with varying prior knowledge (i.e., partial training data, model parameters and/or model structure). Our comprehensive experiments reveal that merging NNs without adequate protection is highly vulnerable. Even when only a small fraction of training data, model parameters, or model structure is exposed, adversaries can still recover significant portions of the private model's performance.

Model merging is a promising approach for organisations to combine the strengths of separately fine-tuned neural networks without sharing raw client data or incurring high computational costs. However, current approaches often require clients to share full model parameters, creating serious model-privacy risks. Partial model merging aims to reduce this risk by keeping part of each model private and merging only the shared parts, but its actual privacy guarantees remain unclear. We tackle this problem by proposing a new model clone attack that tests whether an attacker can reconstruct the hidden private part of a partially merged model. We evaluate this risk across eight attack scenarios in which the attacker may have limited access to training data, model parameters, model structure, or combinations of these. Our findings show that partial model merging is still vulnerable without stronger safeguards. Even small leaks of data, parameters, or model structure can allow attackers to recover much of the private model’s performance. This matters because model merging is becoming useful for collaborative AI, but it must be paired with stronger privacy protections before it can be safely deployed.