REVIEW 4 major objections 5 minor 31 references
Model Reprogramming Demystified: A Neural Tangent Kernel Perspective
T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read Model reprogramming's success is governed by the source model's smallest kernel eigenvalue, the paper proves.
desk verdict Plausible program, but the eigenvalue link is propped up by unidentifiable and rank-deficient assumptions; central claim not established. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the neural tangent kernel matrix of the reprogrammed model, $\Theta_T(X_T,X_T)$, and the decomposition $\hat{\Theta}_T = \hat{\Theta}^A_T + \hat{\Theta}^B_T$ of the target NTK into the input-transformation-layer part and the output-mapping part (Eqs. 16-18). In the infinite-width limit $\hat{\Theta}_T = \Theta_T \otimes I_{c_T}$, so the two matrices share the same nonzero eigenvalue spectrum (Proposition 1). The argument carries the spectral analysis through three linked steps: Theorem 2 bounds $\hat{\Theta}^A_T$ by products of the extremal eigenvalues of $\Theta^b_S$, the feature-map Jacobian on target data, and the input-transformation NTK; Theorem 3 bounds $\Theta^B_T$ by products of the cross-Gram matrix $k(a(X_T),X_S)k(X_S,a(X_T))$, $[K_S + \sigma_S I]^{-2}$, and $Y_S Y_S^T$; Theorem 1 then converts the minimum eigenvalue of $\Theta_T(X_T,X_T)$ into an empirical-risk bound via $1 - \lambda_{N_T}/(\sigma + \lambda_{N_T})$. Assumptions 2 and 3 are the sufficient conditions that make $\lambda_{\min}[\Theta_T(X_T,X_T)]$ grow with $\lambda_{\min}[K_S]$, turning the spectral bounds into proportionality statements (Corollaries 1 and 2).
What would settle it
Fix the input transformation $a$ and output mapping $b$, and vary $\lambda_{\min}[K_S]$ by scaling the source kernel's feature map while keeping the source labels fixed. If, in a regime with $N_T > N_S$ where the cross-Gram matrix $k(a(X_T),X_S)k(X_S,a(X_T))$ is rank-deficient, the target empirical risk stays flat or rises despite a large $\lambda_{\min}[K_S]$, the claimed source-to-target eigenvalue link is false.
Extended reading notes
Core claim
The central claim is that, in the infinite-width NTK limit where the source model is a kernel regressor $f_S(\cdot) = k(\cdot, X_S)[K_S + \sigma_S I]^{-1}Y_S$, the success of model reprogramming is controlled by the minimum eigenvalue of the source kernel matrix $K_S$. Theorem 2 bounds the eigenvalues of the input-transformation-layer NTK $\hat{\Theta}^A_T(X_T,X_T)$ in terms of the matrix $\Theta^b_S = b Y_S^T [K_S + \sigma_S I]^{-1} K_S [K_S + \sigma_S I]^{-1} Y_S b^T$ and the Jacobian of the feature map; Theorem 3 bounds the output-mapping NTK $\Theta^B_T(X_T,X_T)$ in terms of the cross-Gram matrix $k(a(X_T),X_S) k(X_S,a(X_T))$ and $K_S$. Under Assumption 2, Corollary 1 gives $\lambda_i(\hat{\Theta}^A_T(X_T,X_T)) \ge \lambda_{\min}(b Y_S^T Y_S b^T) c_A [\lambda_{\min}[K_S]/(\lambda_{\min}[K_S]+\sigma_S)] \lambda_{\min}[\hat{\Theta}^A(X_T,X_T)]$. Under Assumption 3, Corollary 2 gives $\lambda_i(\Theta^B_T(X_T,X_T)) \ge c_B [\lambda_{\min}[K_S]/(\lambda_{\min}[K_S]+\sigma_S)]^2 \lambda_{\min}[Y_S Y_S^T]$. Because Theorem 1 bounds the empirical risk by $(1/N_T)(1 - \lambda_{N_T}/(\sigma + \lambda_{N_T}))\|Y_T\|^2$, a sufficiently large $\lambda_{\min}[K_S]$ drives both the source and the reprogrammed target empirical risk to zero. The paper concludes that the eigenvalue spectrum of the source NTK is the bridge between source model quality and target model performance.
Load-bearing premise
The whole chain depends on Assumption 3, which requires the cross-Gram matrix $k(a(X_T),X_S)k(X_S,a(X_T))$ to have a minimum eigenvalue at least a constant times $(\lambda_{\max}[K_S])^2$; this condition fails when the source dataset is smaller than the target dataset or when the kernel feature map is high-dimensional.
Editorial extensions
If this is right
- Deepening or widening a source model so that $\lambda_{\min}[K_S]$ rises should directly improve reprogrammed target accuracy, and the bounds of Corollaries 1 and 2 quantify that improvement.
- Input transformation layers should be designed to keep the minimum eigenvalue of $k(a(X_T),X_S)k(X_S,a(X_T))$ large relative to $(\lambda_{\max}[K_S])^2$, mapping target inputs into the span of well-conditioned source features.
- The generalization-gap bound (Theorem 4) implies that reducing the Frobenius norm of $\Theta_T(X_T,X_T)$, for instance through the output mapping, tightens the gap between empirical and true target risk.
- Both source and target empirical risk converge to zero together when $\lambda_{\min}[K_S]$ is sufficiently large, formally justifying the rule of thumb that a better source model yields better reprogramming.
- The relationship is testable end-to-end: measuring $\lambda_{\min}[K_S]$ for source models of increasing depth should predict the monotone decrease in target loss seen in the paper's tables.
Reading between the lines
- If the spectral-link claim extends beyond the kernel limit, the practical bottleneck in model reprogramming is the conditioning of the cross-task Gram matrix rather than source-model accuracy per se; input transformations that whiten or align source features should then outperform generic prompts even for weak source models.
- Assumption 3 requires $N_S \ge N_T$ for the cross-Gram matrix to be full row rank, so the theory predicts a sharp degradation in reprogramming when the source dataset is smaller than the target dataset; this regime is not tested in the paper and would be a direct falsification check.
- One could make Assumption 3 constructive by choosing the input transformation to project target features onto the top-$\kappa$ principal subspace of the source feature map, controlling $\lambda_{\min}[k(a(X_T),X_S)k(X_S,a(X_T))]$ and turning Corollary 2 into a design rule.
- Whether the proportionality survives finite-width feature learning (where the NTK changes during training) is open; probing the claim on modern transformer backbones would test the theory beyond the infinite-width kernel regime.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a Neural Tangent Kernel (NTK) analysis of Model Reprogramming (MR), in which a frozen source model is adapted to a target task through a trainable input transformation and output mapping. The main claim is that the success of MR is governed by the eigenvalue spectrum of the target NTK matrix, and that the minimum eigenvalue of the source model's NTK matrix, λmin[KS], controls both the source and the reprogrammed-target empirical risks. The theoretical development consists of Theorem 1 (an eigenvalue bound on the target empirical risk), Theorem 2 and Corollary 1 (input-transformation branch), Theorem 3 and Corollary 2 (output-mapping branch), with Assumptions 2 and 3 serving as sufficient conditions linking source and target spectra. Experiments with CNN, VGG, ResNet, and CLIP backbones are presented as validation.
Significance. If the central claim were established, the paper would provide a simple and practically useful design criterion for model reprogramming: choose source models with large λmin[KS]. The paper is clearly written and the elementary results (Theorem 1 and Proposition 1) are correct as stated; the authors also deserve credit for explicitly acknowledging that Assumption 2 is not practically identifiable. However, the main bridge from λmin[KS] to λmin[ΘT(XT,XT)] rests on a false eigenvalue identity in the proof of Theorem 2 and on Assumption 3, a strong rank condition that is not verified in the experiments. The empirical support is too thin to compensate for these gaps. The central quantitative claim is therefore not established.
major comments (4)
- [Section 4.1, Theorem 2 and Appendix A.5, Eqs. (73)-(74)] The proof of Theorem 2 claims that λmax[SS^T] = sup_i λmax[\hat Θ_S^A(x_i,x_i)] and λmin[SS^T] = inf_i λmin[\hat Θ_S^A(x_i,x_i)] for the stacked Jacobian matrix S. This is not an identity for a general block matrix because off-diagonal blocks change the spectrum. For example, with two target points whose Jacobian vectors coincide, SS^T = [[v^T v, v^T v], [v^T v, v^T v]] has λmin = 0, while each diagonal block has positive λmin. Consequently the lower bound in Eq. (22) is unproved, and Corollary 1, which is the input-transformation half of the source-to-target mechanism, is not established.
- [Section 4.2, Eq. (29), Assumption 3 and Corollary 2] Assumption 3 requires λmin[k(a(X_T),X_S)k(X_S,a(X_T))] ≥ c_B (λmax[KS])^2. Since M = k(a(X_T),X_S) is an N_T × N_S matrix, the product M M^T has positive minimum eigenvalue only if N_S ≥ N_T and the kernel feature map has dimension at least N_T. The paper does not state these conditions, does not report N_S and N_T in the experiments, and Fig. 4 shows only a five-point trend without rank information. In the common regime N_S < N_T the assumption is impossible and Corollary 2 gives no bound. Thus the output-mapping branch of the claimed source-to-target eigenvalue link is unsupported exactly where it must hold.
- [Section 3.1, Eq. (12), discussion after Theorem 1] Theorem 1 is correct as a bound, but the text over-reads it. The sentence claiming that as λ_NT increases the empirical risk decreases to zero is not implied by an upper bound that decreases; the actual L_ER also depends on Y_T and on the full spectrum. A decreasing upper bound does not imply a monotonic decrease of the risk itself. The paper's headline statement that the success of MR is governed by the eigenvalue spectrum is therefore stronger than what Theorem 1 proves.
- [Section 4.3, Assumption 2 discussion] The authors state that Assumption 2 is 'not practically identifiable.' Because Corollary 1 is the only theoretical result for the fixed-output-mapping case, the explanation of source-model dependence in that branch rests on an assumption that cannot be checked from data. The experiments do not attempt to verify Assumption 2; the CNN discrepancy is attributed to its failure, but no independent evidence for or against the assumption is provided. This compounds the proof gap in Theorem 2.
minor comments (5)
- [Section 5.2] The references 'Table ?? and Table ??' are placeholders that were never filled; Tables 1 and 2 are not referred to in the text.
- [Appendix C.2] Several sentences are truncated, including 'source accuracy improves from 58.20' and 'VP achieves 44.68,' making the CLIP results incomplete and impossible to assess.
- [Fig. 4] The caption describes a comparison of sqrt(λmin[k(a(X_T),X_S)k(X_S,a(X_T))]) with λmax[KS], but the axis labels and panel text show the unsquared product; please make the plotted quantity unambiguous.
- [Eqs. (30) and (113)] The denominator 'λmin[KS] + σ_S I' mixes a scalar and an identity matrix in a dimensionally inconsistent way; it should be written as (λmin[KS] + σ_S)^2 or with explicit matrix notation.
- [Theorem 2 and Appendix A.5] The dimensions of the feature map Φ and the stacking convention in Eqs. (57)-(58) are not stated, which makes the proof difficult to follow and contributes to the eigenvalue identity error.
Circularity Check
No circular reduction found: the source-to-target eigenvalue link is an explicit conditional theorem, and the manuscript's admitted assumption limitations are correctness risks, not circular identities.
full rationale
The derivation chain is not circular. Theorem 1 is a direct spectral bound on the kernel-ridge empirical risk, not a definition of success in terms of source eigenvalues. The source-to-target eigenvalue link is stated conditionally: Corollary 1 requires Assumption 2, and Corollary 2 requires Assumption 3. Corollary 2 follows from Theorem 3 and Assumption 3 by explicit matrix inequalities; the conclusion (a lower bound on the target NTK eigenvalue growing with the source minimum eigenvalue) is not identical to the assumption (a lower bound on the cross-Gram minimum eigenvalue in terms of the source maximum eigenvalue), and the matrices are distinct. The experiments validating Assumption 3 measure the cross-Gram and source kernel spectrum and do not fit the target loss and then rename that fit as a prediction. The only self-citation appears in Appendix A.9, where Theorem 4 is stated to combine Theorem 3 of Chung et al. (2024) with Eq. 4 of Chen et al. (2024); because the paper itself argues the generalization gap is insensitive (Eq. 14), this imported bound is not load-bearing for the central eigenvalue claim. The manuscript's own limitations are real but non-circular: Section 4.3 admits that Assumption 2 is not practically identifiable, and Assumption 3 (Eq. 29) is a rank condition on an NT-by-NS Gram matrix that becomes vacuous when the source sample count is smaller than the target sample count. These are validity and scope risks, not cases where a predicted quantity equals its input by construction.
Assumptions & free parameters
free parameters (4)
- c_A
- c_B
- σ
- σS
assumptions (6)
- domain assumption The source model fS is an RKHS kernel model fS(.)^T = k(.,XS)[KS+σS I]^{-1} YS with NTK kernel k
- domain assumption Infinite-width NTK convergence: Θ̂T(x,x') → ΘT(x,x')I_c and kernel ridge equivalence
- ad hoc to paper Assumption 2: λmin[Θ̂A_S(xt,xt)] ≥ c_A(λmax[KS]+σS) for all target points
- ad hoc to paper Assumption 3: λmin[k(a(XT),XS)k(XS,a(XT))] ≥ c_B(λmax[KS])^2
- standard math Representer theorem and RKHS properties
- standard math Theorem 3 of Chung et al. (2024) and Eq. 4 of Chen et al. (2024) for Rademacher complexity bound
Cite this review
Pith. "Pith review of Model Reprogramming Demystified: A Neural Tangent Kernel Perspective." pith.science (2026). https://pith.science/paper/JYRHSP5E
@misc{pith2026250600620,
author = {Pith},
title = {Pith review of: Model Reprogramming Demystified: A Neural Tangent Kernel Perspective},
year = {2026},
howpublished = {\url{https://pith.science/paper/JYRHSP5E}},
note = {Machine review of arXiv:2506.00620}
}
read the original abstract
Model Reprogramming (MR) is a resource-efficient framework that adapts large pre-trained models to new tasks with minimal additional parameters and data, offering a promising solution to the challenges of training large models for diverse tasks. Despite its empirical success across various domains such as computer vision and time-series forecasting, the theoretical foundations of MR remain underexplored. In this paper, we present a comprehensive theoretical analysis of MR through the lens of the Neural Tangent Kernel (NTK) framework. We demonstrate that the success of MR is governed by the eigenvalue spectrum of the NTK matrix on the target dataset and establish the critical role of the source model's effectiveness in determining reprogramming outcomes. Our contributions include a novel theoretical framework for MR, insights into the relationship between source and target models, and extensive experiments validating our findings.
Figures
Figures from the paper (5 more)
Reference graph
Works this paper leans on
-
[1]
write newline
" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...
- [2]
- [3]
- [4]
-
[5]
A. Berlinet and C. Thomas-Agnan. Reproducing kernel Hilbert spaces in probability and statistics. Springer Science & Business Media, 2011
work page 2011
- [6]
-
[7]
A. Chen, Y. Yao, P.-Y. Chen, Y. Zhang, and S. Liu. Understanding and improving visual prompting: A label-mapping perspective. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 19133--19143, 2023
work page 2023
-
[8]
P.-Y. Chen. Model reprogramming: Resource-efficient cross-domain machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), volume 38, pages 22584--22591, 2024
work page 2024
Show all 31 references
-
[9]
Y. Chen, W. Huang, H. Wang, C. Loh, A. Srivastava, L. Nguyen, and L. Weng. Analyzing generalization of neural networks through loss path kernels. Advances in Neural Information Processing Systems (NeurIPS), 36, 2024
2024
-
[10]
Chung, S.-Y
M.-Y. Chung, S.-Y. Chou, C.-M. Yu, P.-Y. Chen, S.-Y. Kuo, and T.-Y. Ho. Rethinking backdoor attacks on dataset distillation: A kernel method perspective. In The Twelfth International Conference on Learning Representations (ICLR), 2024
2024
-
[11]
S. Du, J. Lee, H. Li, L. Wang, and X. Zhai. Gradient descent finds global minima of deep neural networks. In International conference on machine learning (ICML), pages 1675--1685, 2019
2019
-
[12]
G. F. Elsayed, I. Goodfellow, and J. Sohl-Dickstein. Adversarial reprogramming of neural networks. arXiv preprint arXiv:1806.11146, 2018
2018 arXiv
-
[13]
Englert and R
M. Englert and R. Lazic. Adversarial reprogramming revisited. Advances in Neural Information Processing Systems, 35: 0 28588--28600, 2022
2022
-
[14]
Ghojogh, A
B. Ghojogh, A. Ghodsi, F. Karray, and M. Crowley. Reproducing kernel hilbert space, mercer's theorem, eigenfunctions, nystr\" o m method, and use of kernels in machine learning: Tutorial and survey. arXiv preprint arXiv:2106.08443, 2021
2021 arXiv
-
[15]
Hambardzumyan, H
K. Hambardzumyan, H. Khachatrian, and J. May. Warp: Word-level adversarial reprogramming. arXiv preprint arXiv:2101.00121, 2021
2021 arXiv
-
[16]
B. He, B. Lakshminarayanan, and Y. W. Teh. Bayesian deep ensembles via the neural tangent kernel. Advances in neural information processing systems (NeurIPS), 33: 0 1010--1022, 2020
2020
-
[17]
Huang and H.-T
J. Huang and H.-T. Yau. Dynamics of deep neural networks and neural tangent hierarchy. In International conference on machine learning (ICML), pages 4542--4551, 2020
2020
-
[18]
Jacot, F
A. Jacot, F. Gabriel, and C. Hongler. Neural tangent kernel: Convergence and generalization in neural networks. Advances in neural information processing systems (NeurIPS), 31, 2018
2018
-
[19]
M. Jin, S. Wang, L. Ma, Z. Chu, J. Y. Zhang, X. Shi, P.-Y. Chen, Y. Liang, Y.-F. Li, S. Pan, et al. Time-llm: Time series forecasting by reprogramming large language models. arXiv preprint arXiv:2310.01728, 2023
2023 arXiv
-
[20]
Kimeldorf and G
G. Kimeldorf and G. Wahba. Some results on tchebycheffian spline functions. Journal of mathematical analysis and applications, 33 0 (1): 0 82--95, 1971
1971
-
[21]
J. Lee, L. Xiao, S. Schoenholz, Y. Bahri, R. Novak, J. Sohl-Dickstein, and J. Pennington. Wide neural networks of any depth evolve as linear models under gradient descent. Advances in neural information processing systems (NeurIPS), 32, 2019
2019
-
[22]
Li, Y.-L
Y. Li, Y.-L. Tsai, C.-M. Yu, P.-Y. Chen, and X. Ren. Exploring the benefits of visual prompting in differential privacy. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 5158--5167, 2023
2023
-
[23]
Melnyk, V
I. Melnyk, V. Chenthamarakshan, P.-Y. Chen, P. Das, A. Dhurandhar, I. Padhi, and D. Das. Reprogramming pretrained language models for antibody sequence infilling. In International Conference on Machine Learning, pages 24398--24419. PMLR, 2023
2023
-
[24]
Mohri, A
M. Mohri, A. Rostamizadeh, and A. Talwalkar. Foundations of Machine Learning. The MIT Press, 2012. ISBN 026201825X
2012
-
[25]
Nguyen, Z
T. Nguyen, Z. Chen, and J. Lee. Dataset meta-learning from kernel ridge-regression. In International Conference on Learning Representations (ICLR), 2020
2020
-
[26]
Ronen, D
B. Ronen, D. Jacobs, Y. Kasten, and S. Kritchman. The convergence rate of neural networks for learned functions of different frequencies. Advances in Neural Information Processing Systems (NeurIPS), 32, 2019
2019
-
[27]
Tsai, P.-Y
Y.-Y. Tsai, P.-Y. Chen, and T.-Y. Ho. Transfer learning without knowing: Reprogramming black-box machine learning models with scarce data and limited resources. In International Conference on Machine Learning, pages 9614--9624. PMLR, 2020
2020
-
[28]
H.-A. Tsao, L. Hsiung, P.-Y. Chen, S. Liu, and T.-Y. Ho. Autovp: An automated visual prompting framework and benchmark. arXiv preprint arXiv:2310.08381, 2023
2023 arXiv
-
[29]
Vinod, P.-Y
R. Vinod, P.-Y. Chen, and P. Das. Reprogramming pretrained language models for protein sequence representation learning. arXiv preprint arXiv:2301.02120, 2023
2023 arXiv
-
[30]
C.-H. H. Yang, Y.-Y. Tsai, and P.-Y. Chen. Voice2series: Reprogramming acoustic models for time series classification. In International conference on machine learning (ICML), pages 11808--11819, 2021
2021
-
[31]
C.-H. H. Yang, B. Li, Y. Zhang, N. Chen, R. Prabhavalkar, T. N. Sainath, and T. Strohman. From english to more languages: Parameter-efficient model reprogramming for cross-lingual speech recognition. In IEEE International Conference on Acoustics, Speech and Signal Processing (...
2023
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.