Writing study: Catch-Only-One: Non-Transferable Examples for Model-Specific Authorization
← NeurIPS 2026 oral writing corpus
Zihan Wang, Ethan Ma, Zhongkui Ma, Shuofeng Liu, Akide Liu, Derui Wang, Minhui Xue, Guangdong Bai · Official NeurIPS 2026 oral record
Figure, table and section ledger
Editorial contribution type: Domain-grounded methods & physical systems (primary).
Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.
- Canonical PDF
- 25 physical pages
- Before references / appendix
- ≈ 11.09 page-equivalents
- Main figures / tables
- 3 / 5
- Attached appendix figures / tables
- 5 / 5
- Attached appendix span
- ≈ 10.36 page-equivalents
Section-by-section lengths and source pages
The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.
| Top-level heading | Starts on PDF page | Estimated span | Share of entire PDF |
|---|---|---|---|
| 1. Introduction | 1 | ≈ 1.72 pp. | 6.88% |
| 2. Problem Formulation | 3 | ≈ 1.46 pp. | 5.84% |
| 3. Our Method | 4 | ≈ 1.46 pp. | 5.84% |
| 4. Theoretical Properties of Ntes | 6 | ≈ 2.06 pp. | 8.24% |
| 5. Experiments | 8 | ≈ 3.06 pp. | 12.24% |
| 6. Related Work | 11 | ≈ 0.32 pp. | 1.28% |
| 7. Discussion and Conclusion | 11 | ≈ 0.34 pp. | 1.36% |
| References | 12 | ≈ 3.55 pp. | 14.2% |
| A. Supplementary Preliminaries | 15 | ≈ 2.22 pp. | 8.88% |
| B. Supplementary Assumptions | 17 | ≈ 1.44 pp. | 5.76% |
| C. Supplementary Clarifications, Experiments, and Results | 19 | ≈ 1.9 pp. | 7.6% |
| D. Deferred Proofs from Section 4 | 21 | ≈ 1.48 pp. | 5.92% |
| E. Threat Model and Deployment Justifications | 22 | ≈ 3.32 pp. | 13.28% |
All detected figure and table locations
Main text
Argument and organization
- Problem and contribution
The paper distinguishes authorized use of an input at inference from restrictions on training or unlearning. It specifies a target model and non-target models before presenting the input-recoding method, making the claim conditional on a model and threat model rather than a general privacy guarantee.
- Argument sequence
After setting the problem and assumptions, the method builds an insensitive subspace, gives utility-retention and degradation arguments, then tests model-conditional behavior and downstream applications. This is an algorithm-and-conditions sequence: the formal setting is needed to interpret both the schematic and the comparison table.
- Evidence and verification
Table 1 changes the authorized model along rows and the evaluated model along columns, with dataset blocks retained. Table 2 explicitly positions differential privacy, homomorphic encryption and the proposed setting as different threat models, not interchangeable accuracy baselines. Runtime and application tests are additional claims rather than replacements for the conditional utility analysis.
Problem, claim and contribution
The paper distinguishes authorized use of an input at inference from restrictions on training or unlearning. It specifies a target model and non-target models before presenting the input-recoding method, making the claim conditional on a model and threat model rather than a general privacy guarantee.
Introduction pp. 1–3; §2, pp. 3–4 · Main paper
Argument and section order
After setting the problem and assumptions, the method builds an insensitive subspace, gives utility-retention and degradation arguments, then tests model-conditional behavior and downstream applications. This is an algorithm-and-conditions sequence: the formal setting is needed to interpret both the schematic and the comparison table.
§§2–4, pp. 3–7; evaluation and applications, pp. 8–11 · Main paper
Figures, captions and visual explanation
Figure 1 explains the recoding through a two-dimensional schematic: distinct model directions, input perturbation and a bounded region have stable visual roles before and after projection. Table 1 instead uses a target-model-by-evaluation-model matrix; highlighted diagonal entries identify authorized cases rather than simply all best numbers.
Figure 1, p. 5; Table 1, p. 9; rendered pages 5 and 9 · Main paper
Tables, comparisons and evidence
Table 1 changes the authorized model along rows and the evaluated model along columns, with dataset blocks retained. Table 2 explicitly positions differential privacy, homomorphic encryption and the proposed setting as different threat models, not interchangeable accuracy baselines. Runtime and application tests are additional claims rather than replacements for the conditional utility analysis.
Tables 1–2, p. 9; application/runtime discussion, pp. 10–11; Appendix C, pp. 19–20 · Main paper
Appendix and reproducibility
The appendices separate linear-algebra background, operative assumptions, omitted proofs and practical tests such as preprocessing/reconstruction checks. This organization gives a reader different routes for learning prerequisites, verifying a bound and inspecting a deployment assumption.
Appendices A–E, pp. 15–25 · Main paper
Clarity and writing conventions
The memorable title and opening dilemma are followed by explicit model-conditional terminology. The comparison caption's warning about differing threat models is worth copying as a writing practice; claims about guarantees should continue to name the assumptions under which the paper derives them.
Introduction pp. 1–3; theorem discussions pp. 6–7; Table 2 caption, p. 9; discussion p. 11 · Main paper
What to reuse—and what not to infer
Transferable lesson: For an algorithm whose behavior depends on a designated system, make that conditioning visible in definitions, diagram axes, table rows and the scope of each theorem.
Boundary: The tested model-specific behavior and conditional bounds do not imply universal privacy or replace DP/FHE guarantees. The public manuscript uses Zhiyong Ma where the official program lists Ethan Ma; the manuscript's author email supports the alias match, but the accepted revision itself was not verified.
Apply this lesson using the argument and evidence worksheet.
Inspection record and sources
- Checked
- 2026-10-02
- Reading status
- Writing-focused manuscript scan + selected visuals inspected
- Main text
- Writing-oriented scan across manuscript framing, section sequence, figure/table captions, selected argument/evaluation prose and conclusion; not exhaustive technical or proof verification. Sections 1–7, pp. 1–11; references pp. 12–14. Visually inspected the recoding intuition diagram and model-conditional result matrix on pp. 5 and 9. Source is the exact public author version listed below, not a verified accepted/camera-ready revision.
- Appendix / supplement
- Writing-oriented appendix/documentation scan: Appendices A–E, pp. 15–25: algebraic background, assumptions, additional classification/language/runtime experiments, proofs and deployment checks. Source code, data, model outputs and external video assets were not executed or independently validated.
- Visually inspected PDF pages
- 5, 9
This is a writing-focused scan of the manuscript and the stated supplementary scope: framing, organization, visual explanation, evidence presentation and wording. It is not a line-by-line proof audit, reproduction of results or exhaustive scientific review.