On the Privacy-Preserving Capabilities of PAVE Specifications in Learnware

1 Introduction

Reusing existing models is often more practical than training a new model from scratch. In many applications, developers already hold trained models that may be useful for future tasks, while users often have only limited data and limited computational resources. The difficulty is that model reuse is not only a matter of collecting models. A user must first identify which existing models are relevant to her task. Simple metadata, such as model names, architectures, tags, or benchmark scores, can only provide a rough description of model capability. Directly evaluating many candidate models on the user's raw data is more informative, but it is costly and may expose private task information. Asking developers to reveal their training data would also help model identification, but is usually infeasible due to privacy or proprietary concerns.

∗A technical appendix with detailed proofs is available at https: //default-anno-bucket.s3.us-west-1.amazonaws.com/Proof.pdf.

The learnware paradigm [Zhou, 2016; Zhou and Tan, 2024] addresses this problem by making the specification an explicit part of model reuse. A learnware is a model accompanied by a specification that describes its reusable capability. Such a specification can be generated from the model, the training data, or task information, and the dock system can use it to match developer-side models with user-side requirements without raw-data exchange. In this sense, the specification is the public artifact that makes learnware identification possible. However, this specification is also data-dependent. The more accurately it reflects model capability, the more likely it is to carry information about the data or task from which it was generated. Thus, the privacy question in learnware is not only about releasing models, but also about releasing specifications: what information does this public capability specification reveal, and how can such leakage be controlled while keeping the specification useful?

The parameter vector (PAVE) specification for learnwares has shown strong empirical effectiveness for learnware identification and reuse [Tan et al., 2025; Shi et al., 2026] recently. Unlike reduced-set specifications such as RKME specifications [Zhou and Tan, 2024], PAVE summarizes task and capability information through parameter variations induced by fine-tuning. The released specification is a compact low-rank parameter rather than a synthetic representative set in the data space. This difference makes existing privacy analyses for RKME insufficient for PAVE. On the one hand, gradientinduced parameter variations may themselves carry information about the underlying data. On the other hand, a PAVE specification is released together with a model, so it may also provide additional evidence for attacks against the released model. These observations motivate a privacy analysis tailored to the PAVE generation and release procedure.

Differential privacy (DP) [Dwork, 2006] is a natural tool for such an analysis, since it provides a robust worst-case guarantee against inference attacks. However, applying DP to learnware specifications is non-trivial. Most DP mechanisms rely on explicit noise injection, while learnware specifications are intended to be compact and useful for identification. Excessive perturbation can therefore damage the matching utility of the learnware dock system, as also observed in prior studies on learnware privacy [Lei et al., 2024]. Moreover, a specification-level privacy guarantee should be connected to learnware-specific risks: releasing a specification may leak information by itself, and may also strengthen attacks when combined with the released model.

In this work, we characterize the privacy-preserving capabilities of PAVE specifications. The main contributions are summarized as follows:

• We formalize two specification-induced privacy risks for PAVE, namely the disclosure risk of the released specification and the amplification risk that the specification may strengthen attacks against the released model.
• We show that compact PAVE releases admit an intrinsic (ε, δ)-DP guarantee under natural structural conditions of learnware docks, through a Gaussian-sketch view of stable parameter variations. For regimes outside these conditions, we further provide DP-Stabilized-PAVE as a certified differentially private variant.
• We prove that the resulting DP guarantees can control both disclosure risk and specification-side amplification risk, and analyze the induced privacy-utility trade-off to guide privacy-aware deployment while preserving effective learnware identification.

2 Preliminaries andMethodology

In this section, we introduce the basic workflow of the learnware paradigm with PAVE specifications, and formalize the privacy concerns that arise from releasing such specifications.

2.1 Background of Learnware Paradigm

We first recall the two-stage learnware workflow.

Submitting stage. For a developer, a learnware consists of a trained model h together with its specification. PAVE constructs a model vector τh by fine-tuning a shared pre-trained model f(·; θ0) on the developer's training dataset Dt with a task-specific loss Lt. When the output space of the pretrained model differs from that of the task, a lightweight mapping gt is used to bridge the two spaces. Concretely, PAVE is obtained as the parameter update that minimizes

The learnware (h, τh) is then submitted to the dock system.

Deploying stage. Given a user task with a few-shot dataset Du and loss Lu, PAVE constructs a task vector τu using the same pre-trained model f(·; θ0), but replaces the model prediction target by the ground-truth label. Thus the vector reflects the capability required by the user task:

The dock system identifies helpful learnwares by comparing cosine similarity in the parameter-vector space:

and selects learnwares with large similarity for reuse.

To make PAVE efficient to store and compare, it adopts a LoRA-style low-rank parameterization. For each selected weight matrixWℓ in the pre-trained backbone, the update is represented as

where Aℓ ∈ Rr×nℓ is randomly initialized and then frozen, while Bℓ ∈ Rmℓ×r with r ≪ min{mℓ, nℓ} is learned from data. Writing A for the collection of frozen factors, PAVE learns the compact factors by

The expanded update ˜ τ = BA is the corresponding fullspace parameter variation, while the concatenated matrix

is used as the compact PAVE specification. For identification, the learnware dock system can directly compute cosine similarity in the low-rank space via cos(B,B′ ), which efficiently approximates cos(BA,B′A) with high probability. In the compact-release regime analyzed in this paper, the public specification is the compact factor B; the realized random factors Aℓ are not part of the public specification.

2.2 Formalization of Learnware Privacy Concerns

Since specifications are generated from the raw data of developers or users, a central privacy question is: what additional risks are introduced by attaching and releasing a specification? We distinguish two complementary concerns below.

• (i) Disclosure risk. The released specification itself may leak information about the underlying dataset. This concern is particularly relevant for PAVE, because it summarizes the fine-tuning dataset through gradient-induced parameter variations. Prior studies on gradient and update inversion show that such information can be used to infer sensitive properties of training examples [Zhu et al., 2019; Geiping et al., 2020].

(ii) Amplification risk. Even without a specification, the released model may already leak information about its training data through model inversion attacks, which attempt to recover sensitive attributes or representative training examples from model outputs or parameters [Fredrikson et al., 2014; Fredrikson et al., 2015; Zhang et al., 2020]. In a learnware system, publishing a specification alongside the model introduces an additional evidence channel. The learnware-specific risk we study is whether this extra channel can strengthen such attacks beyond what the model alone already enables.

Figure 1 summarizes the PAVE identification workflow and the two specification-induced risk studied in this paper.

A generic inference game. Let D denote the developer's training dataset, drawn from an underlying distribution P. A learnware consists of a released model h together with a released specification R. We model an attack by a tuple (A, τ, ν), where A is a possibly randomized adversary, τ is a target function encoding the inference objective, and ν denotes the side information provided to the adversary. The interaction proceeds as follows:

1. The challenger samples a record s fromP, or equivalently from D when modeling membership.
2. The challenger reveals the side information ν(s) to the adversary.
3. The adversary is given a released interface, specified below, and outputs a guess.

The adversary's success is defined as

where the probability is over the randomness of the sampled record, the released interface, and the adversary. Different privacy concerns correspond to different adversarial views V.

(i) Disclosure risk of releasing the specification. We first quantify what the specification R reveals by itself. In this game, the adversary observes the released specification, denoted by Vspec = R. Since side information may already reveal part of the target, we define disclosure risk as the incremental advantage brought by releasing R:

where A denotes the class of admissible adversaries, and ∅ denotes the baseline view in which the adversary receives only the side information. A small Riskdis(R) indicates that observing the released specification does not substantially improve the adversary's ability to infer τ(s) beyond what is already possible from side information.

• (ii) Amplification risk for attacks against the released model. Releasing a specification may also help an attacker exploit the model more effectively. To capture this, we compare adversaries that observe the model alone with adversaries that observe both the model and the specification. Let Vmodel = h denote access to the released model alone, and let Vjoint = (h,R) denote access to both. We define the amplification risk induced by R for the model h as

This quantity isolates the incremental privacy risk introduced by publishing the specification on top of the released model.

Binary instantiation. The gain-based definitions above describe the operational meaning of the two risks for general inference objectives. To obtain attack-agnostic theoretical guarantees, we use their standard binary neighbouring-dataset instantiation. In this instantiation, the adversary distinguishes whether a view is generated from a dataset D or from a neighbouring dataset D′ .

For a released view V , define

and the optimal distinguishing advantage

Equivalently, in the balanced binary game between D and D′ , the optimal success probability is

Thus, controlling Adv⋆ also controls the corresponding binary inference gain. Let [x]+ ≜ max{x, 0}. The advantagestyle disclosure risk Riskadv dis (R | H0) is

where H0 denotes the baseline side information before observing the specification. Similarly, the advantage-style amplification risk Riskadv amp (H;R) is

where H denotes the model-only view.

3 DP Guarantees for PAVE Specifications

In this section, we characterize when PAVE specifications admit differential privacy. We first show that, under natural compact-release conditions of learnware docks, the compact PAVE factor satisfies an intrinsic (ε, δ)-DP guarantee without injecting additional additive noise. We then discuss the structural conditions behind this guarantee and introduce DPS-PAVE, a certified variant for deployments outside the intrinsic compact-release regime.

We first recall some basic notions of differential privacy (DP). DP limits how much the output distribution can change when a member of the original dataset is modified.

Definition 3.1 (Neighbouring datasets). Let D = {zi}Ni=1 and D′ = {z′i }Ni=1 be two datasets of the same size. We write D ∼ D′ if they differ in exactly one record, i.e., there exists an index j such that zj ̸= z′j and zi = z′i for all i ̸= j.

Definition 3.2 (Differential privacy). A randomized mechanismM is (ε, δ)-differentially private if for any measurable event E and any neighbouring datasets D ∼ D′ ,

where the probability is taken over the randomness of M.

Definition 3.3 (ℓ2-sensitivity). Let q be a matrix-valued query. Its ℓ2-sensitivity is

where ∥ · ∥2 denotes the spectral norm.

From PAVE to a compact Gaussian-sketch mechanism. For clarity, we first consider a single layer and omit the layer index. Let A ∈ Rr×m be sampled with i.i.d. entries Aij ∼ N(0, 1/r), independently of the dataset. In the compact privacy regime, the distribution of A is public, while its realized value and random seed are maintained as internal randomness and are not part of the public specification.

For one-step, linearized, or trajectory-decoupled PAVE, the learned compact factor can be written as

where F(D) ∈ Rd×m is the matrix query induced by the fine-tuning trajectory. For example, unrolling gradient steps of the form Bt+1 = Bt - ηGt(D)A⊤ gives BT (D) = -η ∑T -1 t=0 Gt(D)A⊤, so that F(D) = -η ∑T-1 t=0 Gt(D) when the cumulative query is independent of the realized A.

The mechanism in Eq. (17) is a Gaussian sketch. To avoid support separation for matrix-valued releases, we analyze the standard fixed-subspace regime. Assume that there exists a fixed and public matrix U ∈ Rd×k , U⊤U = Ik, such that the released query lies in this specification subspace:

Equivalently, the released compact factor can be written as

Since U is fixed and public, it suffices to analyze the coordinate release C(D). We define the covariance matrix

We impose the following covariance-stability condition on admissible neighbouring datasets:

(1-γ)ΣD′ ⪯ΣD ⪯ (1+γ)ΣD′ with 0 < γ < 1, (21) where ΣD and ΣD′ are positive definite. This condition states that changing one record cannot substantially rotate or rescale the covariance inside the specification subspace.

For a concise privacy accounting, we use R´enyi differential privacy (RDP).

Definition 3.4 (R´enyi differential privacy). For α > 1, a mechanismM is said to satisfy (α, ρ)-RDP if

for all neighbouring datasets D ∼ D′ , where Dα(·∥·) is the order-α R´enyi divergence.

An (α, ρ)-RDP mechanism is also (ρ + log(1/δ) α-1 , δ) -DP for any δ ∈ (0, 1). In particular, a (2, ρ2)-RDP guarantee gives (ρ2 + log(1/δ), δ)-DP.

Theorem 3.5 (Intrinsic DP for compact PAVE specifications). Consider the compact PAVE mechanism

where Aij ∼ N(0, 1/r) is sampled independently of D, and the realized A is not released. Assume the common-support condition in Eq. (18) and the covariance-stability condition in Eq. (21). ThenMB satisfies (2, ρ2)-RDP with

Consequently, for any δ ∈ (0, 1), MB is (ε, δ)-DP with

Remark 3.6. Theorem 3.5 characterizes an intrinsic DP regime of compact PAVE specifications. It relies on three structural conditions and one modeling scope condition.

Compact secret release. The public PAVE specification is the compact factor B = F(D)A⊤, while the realized Gaussian matrix A, its seed, and the expanded update BA are not part of the public release. The distribution of A can be public; what is not released is the particular realization used to generate the specification. This distinction is essential because A serves as the internal randomness of the compact Gaussian-sketch mechanism. If (A,B) is released, the algebraic relation B = F(D)A⊤ becomes directly testable, and the Gaussian-sketch privacy argument no longer applies. The modeling scope condition is related but different: the matrix query F(D) should be independent of the realized A. This holds for one-step or trajectory-decoupled PAVE, where the cumulative query is fixed once D is fixed. For fully adaptive PAVE training, the certified variant below should be used.

Common specification subspace. The second structural condition is the fixed public subspace in Eq. (18). Its role is to place all released PAVE specifications in the same public coordinate system: F(D) = UH(D) and B(D) = U(H(D)A⊤). This condition is natural in a learnware dock, because model-side and user-side specifications must be comparable for identification. It is automatically satisfied when the selected PAVE query has stable full row support, in which case one may take U = I. More generally, the system can enforce it by selecting fixed layers, using a fixed public projection subspace, choosing a subspace from public calibration data, or directly releasing the coordinate specification C(D) = U⊤B(D) = H(D)A⊤. Without such a common support, neighbouring datasets may move the released matrix into different column supports, causing support separation.

Covariance stability. The third structural condition is covariance stability in Eq. (21). It requires the Gaussian-sketch covariance ΣD = H(D)H(D)⊤ to change smoothly under a single-record modification. The positive definiteness of ΣD is the non-degeneracy part of this condition: the retained public specification subspace should not collapse to a lowerdimensional direction. A convenient sufficient condition is µ2 Ik ⪯ H(D)H(D)⊤ ⪯ L2 Ik and ∥H(D)-H(D′ )∥2 ≤ ∆ for all neighbouring D ∼ D′ . Then ∥ΣD - ΣD′ ∥2 ≤ 2L∆, and Eq. (21) holds with

provided γ < 1. For an average-type query H(D) = n-1 ∑ni=1 Ψ(zi) with ∥Ψ(z)∥2 ≤ G, one has ∆ ≤ 2G/n, and hence γ ≤ 4LG/(nµ2 ). Thus large fine-tuning datasets, stable optimization, and clipping of unusually large updates all make the intrinsic compact guarantee more favorable.

Proposition 3.7 (A public-A compact release is not generally DP). Consider the mechanism

where A ∈ Rr×m has i.i.d. Gaussian entries and the realized A is released. If there exist neighbouring datasets D ∼ D′ such that F(D) -F(D′ ) ̸= 0, then, for such a neighbouring pair, Mpub is not (ε, δ)-DP for any finite ε and any δ < 1.

Remark 3.8. The quantities in Theorem 3.5 have direct learnware interpretations. The rank r is the low-rank width

Algorithm 1 DP-Stabilized PAVE (DP-S-PAVE)

• 1: Input: dataset D; pretrained parameters θ0; selected layers set I withWℓ ∈ Rmℓ×nℓ ; ranks {rℓ}ℓ∈I; per-example fine-tuning loss L; steps T ; step size η; clipping threshold C; sampling rate
• q; noise multiplier σ. 2: Output: private compact specification R = {Bℓ,T }ℓ∈I. 3: for ℓ ∈ I do 4: Initialize Aℓ ∈ Rrℓ×nℓ independently of D and freeze it; and set Bℓ,0 ← 0mℓ×rℓ . 5: end for 6: for t = 0, . . . , T -1 do 7: Sample a mini-batch St ⊆D with rate q or |St| = ⌊q|D|⌋. 8: for ℓ ∈ I do 9: for zi ∈ St do 10: Z(i) ℓ,t ←∇Wℓ L(Wt; zi)A⊤ℓ ; 11: ˜Z(i) ℓ,t ← Clip(Z(i) ℓ,t , C) = Z · min{1, C/∥Z∥F}. 12: end for 13: DrawNℓ,t ∈ Rmℓ×rℓ with entries fromN(0, σ2C2 ). 14: ¯Zℓ,t ← b-1(∑zi∈St ˜Z(i) ℓ,t +Nℓ,t). 15: Bℓ,t+1 ←Bℓ,t -η¯Zℓ,t. 16: end for 17: end for 18: return R = {Bℓ,T}ℓ∈L.

of the PAVE factor, and k is the dimension of the public specification subspace. Their product rk is the effective number of Gaussian sketch coordinates released to the system. The parameter γ measures the relative change of the specification covariance under a neighbouring-dataset modification. Thus, smaller effective specification dimension and more stable task-level parameter variations lead to tighter privacy. These quantities also correspond to design choices of the system: the rank controls how much parameter-variation signal is retained, the public subspace controls the common coordinate system for matching, and the stability parameter reflects the influence of individual records on the specification.

A certified variant beyond the intrinsic regime. The above structural conditions are natural in a compact-release regime, but they need not hold in every deployment. For example, a system may require public reproducibility of A, may need to release the expanded update BA, may not enforce a common specification subspace, or may use fully adaptive nonlinear PAVE training in which the cumulative query depends on the realized A. To cover such cases, we introduce a certified differentially private variant, called DP-Stabilized PAVE (DP-S-PAVE). The idea is to apply per-example clipping and calibrated Gaussian noise directly in the low-rank PAVE update space. We use the same per-example loss as in the original PAVE generation procedure. In contrast to Theorem 3.5, DP-S-PAVE does not rely on secret A, common support, or covariance stability.

Theorem 3.9 (Certified DP of DP-S-PAVE). Fix the matrices {Aℓ}ℓ∈L independently of the dataset. In Algorithm 1, assume that every per-example projected update is clipped to Frobenius norm at most C, and that independent Gaussian noise with standard deviation σC is added before the deterministic scaling by 1/b. Let ρsubG α (q, σ) denote the order-α RDP parameter of one Poisson-subsampled Gaussian update with replacement-neighbour sensitivity 2C and noise standard deviation σC. Then the final release R = {Bℓ,T}ℓ∈L satisfies (α, ρα)-RDP with

Thus for any δ ∈ (0, 1), DP-S-PAVE is (εdp, δ)-DP with

In particular, without subsampling, i.e., q = 1, a conservative closed-form bound is

Remark 3.10. DP-S-PAVE complements the intrinsic compact guarantee. When the compact secret-sketch conditions hold, Theorem 3.5 gives a noise-free DP route. When these conditions are not enforced, Theorem 3.9 provides a certified route by adding calibrated noise in the low-rank PAVE update space. Since the guarantee of DP-S-PAVE is conditioned on fixed Aℓ and comes from explicit Gaussian perturbation, the realized Aℓ, the compact factors Bℓ, the expanded updates BℓAℓ, normalized specifications, cosine similarities, and top-K retrieval outputs are all post-processing of a DP mechanism and therefore remain differentially private.

4 Risk Analysis

We now connect the DP guarantees in Section 3 to the two learnware privacy risks formalized in Section 2.2, and then discuss the resulting privacy-utility trade-off.

4.1 Disclosure Risk of the Specification Channel

We first consider the disclosure risk of releasing the specification itself. For brevity, we write ηε,δ ≜ (eε - 1) + δ.

Lemma 4.1 (DP channels add bounded inference advantage). Let H be a baseline view, and let RD = M(D) be an additional released channel. Suppose that R is conditionally (ε, δ)-DP given H, i.e., for every fixed value H = u, every measurable event S, and all D ∼ D′ ,

Lemma 4.1 is the link between mechanism-level privacy and learnware-level risk. After the view H = u is fixed, any attack using (u,R) is a post-processing of the released specification. The term Adv⋆ (H;D,D′ ) accounts for the distinguishing power already present in the baseline view, while the additional contribution of R is controlled by ηε,δ.

Theorem 4.2 (DP controls specification disclosure risk). Let R =MB(D) be the released compact PAVE specification. If R is conditionally (ε, δ)-DP given the baseline side information H0, then

In particular, the same bound holds when H0 is fixed public side information and R satisfies ordinary (ε, δ)-DP.

Theorem 4.2 is an incremental-risk statement. It does not bound the raw success probability of an attack, because the baseline side information may already reveal part of the target. Instead, it bounds the extra binary distinguishing advantage attributable to observing the specification. Consequently, tighter compact-release privacy parameters, smaller effective dimension rk, stronger covariance stability, or the use of DPS-PAVE directly reduce the worst-case disclosure advantage.

4.2 Specification-Side Amplification Risk

We next consider amplification risk: whether publishing a PAVE specification can strengthen attacks against the released model. Let H denote the model-only view available to the adversary, including the released model h and any side information shared across the two games. The joint view is (H, R). The model view H may already contain information about the underlying dataset; our goal is to isolate the additional contribution of the specification channel.

We assume that the compact specification channel R is conditionally (ε, δ)-DP given H. This is satisfied, for example, when H is treated as fixed public side information and the compact PAVE release satisfies Theorem 3.5 uniformly under this conditioning. If the model h is trained by a nonprivate procedure, it may still leak information, but the result below controls the incremental leakage caused by adding R.

Theorem 4.3 (No material specification-side amplification). Let R = MB(D) be the released compact PAVE specification, and let H be the model-only view. If R is conditionally (ε, δ)-DP given H, then

Although Theorem 4.3 has the same numerical margin as the disclosure bound, it controls a different learnware-specific risk. The disclosure bound compares the baseline side information H0 with the joint view (H0,R), and therefore measures what the specification reveals by itself. In contrast, the amplification bound takes the model-only view H as the baseline. This view may already be data-dependent and nonprivate, and the theorem does not attempt to remove such model-side leakage. Instead, it asks whether the additional specification channel R can further increase the adversary's distinguishing power beyond what is already possible from H. Technically, both results rely on Lemma 4.1, but they instantiate it with different baselines: H0 for disclosure and H for amplification. The identical margin (eε - 1) + δ reflects that, in both cases, the only newly added channel is the DPprotected specification. Thus Theorem 4.3 should be read as a specification-side amplification guarantee: publishing PAVE may be combined with model access, but the extra inference advantage attributable to the specification is bounded by the DP-controlled margin in Eq. (33).

This is a specification-side guarantee. It separates the information already present in the released model view from the additional risk introduced by the specification. If a deployment releases objects outside the compact secret-release regime, such as the realized A, the expanded update BA, or an adapted predictor constructed from a public A, then Theorem 3.5 may no longer apply. In such cases, the same disclosure and amplification conclusions can be obtained by using the certified DP-S-PAVE guarantee in Theorem 3.9. Once the specification channel is DP, downstream dock operations such as normalization, cosine similarity, ranking, and top-K retrieval remain protected by post-processing.

4.3 Privacy-Utility Trade-off of PAVE

The preceding results show that both disclosure risk and specification-side amplification risk are controlled by the DP parameters of the released specification channel. Theorem 3.5 makes these parameters explicit for compact PAVE. In the intrinsic regime, the order-2 RDP parameter satisfies

Thus the effective released dimension rk and the covariancestability parameter γ are the main privacy-relevant quantities. The same quantities also affect learnware identification. The rank r controls the width of the low-rank PAVE factor, while k controls the dimension of the public specification subspace. Larger r or k can preserve richer parameter-variation signals and improve matching, but they also release more Gaussian sketch coordinates and increase the privacy cost. Conversely, overly small r or k may improve privacy but remove directions needed to distinguish helpful learnwares.

The stability parameter γ captures another side of the trade-off. It measures how much the covariance ΣD = H(D)H(D)⊤ of the projected PAVE query changes when one record is modified. When H(D) is stable and nondegenerate, γ is small and the privacy bound becomes tighter. The sufficient condition in Section 3 gives a concrete interpretation: if µ2 Ik ⪯ H(D)H(D)⊤ ⪯ L2 Ik and ∥H(D) - H(D′ )∥2 ≤ ∆, then γ = 2L∆/µ2 ; for average-type queries with bounded per-example contribution, ∆ = O(1/n). Larger fine-tuning datasets, stable optimization, and clipping of unusually large updates therefore reduce the effect of any individual record on the specification.

This stability is also useful for identification. Learnware matching should depend on task-level variation rather than example-specific spikes. Suppressing unstable record-level influence helps the PAVE specification reflect reusable capability information instead of idiosyncratic noise, which can improve the robustness of cosine-based comparisons across learnwares. In this sense, privacy and utility are not always opposed: the same stabilization that reduces γ can also make the specification more faithful to the task-level signal.

The public specification subspace also has a dual role. From the privacy perspective, a fixed subspace U prevents support separation across neighbouring datasets and enables the compact Gaussian-sketch analysis. From the learnware perspective, U provides a common coordinate system in which model-side and user-side specifications can be compared. In practice, U may be chosen by fixed layer selection or a public projection, while the effective dimension k can be tuned according to the desired privacy-utility balance. When the compact secret-release conditions are not suitable, the privacy of DP-S-PAVE privacy is controlled by the clipping threshold, noise multiplier, sampling rate, and number of optimization steps through standard DP accounting.

5 RelatedWork

Most existing learnware systems [Tan et al., 2024c] build with RKME as a specification choice [Zhou and Tan, 2024; Wu et al., 2023]. This has led to a rich line of work on learnware identification, heterogeneous feature or label spaces, and evolvable learnware systems [Tan et al., 2024b; Liu et al., 2024; Tan et al., 2024a]. On the privacy side, recent work provides rigorous guarantees for RKME-style specifications through geometric analysis of reduced sets [Lei et al., 2024]. Our work studies the similar general objective but for a fundamentally different specification form. PAVE summarizes model capability through parameter variations induced by fine-tuning [Liu et al., 2026], rather than through representatives in data space. This difference changes both the privacy surface and the mathematical tools needed for analysis.

Our analysis is also related to DP mechanisms for learning and sketching. Standard learning-based DP guarantees are usually obtained by explicit noise injection, such as DP-SGD, RDP, and subsampled-RDP accounting [Abadi et al., 2016; Mironov, 2017; Wang et al., 2019]. Another line shows that random projections or Gaussian sketches can themselves provide privacy guarantees [Blocki et al., 2012; Lev et al., 2025]. Recent work on LoRA privacy studies Wishart projection mechanisms and shows that matrix-valued LoRA-style updates are not generally noise-free DP [Hu et al., 2026]. Our compact PAVE result is different: under dock-side compactrelease conditions, the released factor is analyzed as a Gaussian sketch of stable parameter variations, and DP-S-PAVE recovers certified protection by explicit perturbation.

Finally, our risk formulation is motivated by privacy attacks on learning systems. Gradient and update inversion motivate the disclosure risk of releasing PAVE [Zhu et al., 2019; Geiping et al., 2020], while membership, attribute, and model inversion attacks motivate the amplification question when a specification is released together with a model [Fredrikson et al., 2014; Fredrikson et al., 2015; Shokri et al., 2017; Yeom et al., 2018; Salem et al., 2019]. Our DP-to-advantage analysis connects the risks to the privacy of the specification.

6 Concluding Remarks

This paper provides the first formal theoretical analysis for privacy characterization of PAVE specifications in the learnware paradigm. We show that, under natural compact-release conditions of learnware docks, compact PAVE specifications admit an explicit (ε, δ)-differential privacy guarantee through a Gaussian-sketch view of stable parameter variations, without introducing explicit additive noise. For deployments outside this intrinsic regime, we further provide DP-S-PAVE as a certified differentially private variant. We connect these DP guarantees to rigorous bounds on both disclosure risk and specification-side amplification risk, showing that the additional inference advantage attributable to the specification is controlled by the corresponding DP parameters. Finally, we discuss how privacy and identification utility vary with the PAVE generation settings. Our analysis offers useful building blocks for privacy-aware learnware specification design and contributes to a DP-based understanding of dataset leakage through parameter-variation representations.

Ethical Statement

This work studies privacy risks and privacy-preserving guarantees for PAVE specifications in learnware systems. It does not collect new human-subject data or conduct experiments on private user data. The proposed analysis is intended to support privacy-aware deployment by clarifying when compact PAVE releases admit formal differential privacy guarantees and by providing DP-S-PAVE for settings where the structural conditions are not enforced. We also emphasize that practical deployments should verify the required assumptions or use the certified DP variant before releasing specifications.

Acknowledgments

This work was financially supported by FIDBP of MoE (JYB2025XDXM118) and 111 Center (B26023). Tan was supported by the Postdoctoral Fellowship Program of CPSF (GZB20250396) and Jiangsu Funding Program for Excellent Postdoctoral Talent (2025ZB482).