[Paper Review] One-Pixel Shortcut: on the Learning Preference of Deep Neural Networks

Shutong Wu, Sizhe Chen+2 more|arXiv (Cornell University)|May 24, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes One-Pixel Shortcut (OPS), a model-free data protection method that degrades deep neural network performance by perturbing a single pixel per image to create strong, imperceptible shortcuts. Unlike prior unlearnable examples (ULEs) based on global noise, OPS resists adversarial training and strong augmentations, achieving only 10.61% test accuracy on ResNet-18 even under adversarial training, outperforming existing methods.

ABSTRACT

Unlearnable examples (ULEs) aim to protect data from unauthorized usage for training DNNs. Existing work adds $\ell_\infty$-bounded perturbations to the original sample so that the trained model generalizes poorly. Such perturbations, however, are easy to eliminate by adversarial training and data augmentations. In this paper, we resolve this problem from a novel perspective by perturbing only one pixel in each image. Interestingly, such a small modification could effectively degrade model accuracy to almost an untrained counterpart. Moreover, our produced \emph{One-Pixel Shortcut (OPS)} could not be erased by adversarial training and strong augmentations. To generate OPS, we perturb in-class images at the same position to the same target value that could mostly and stably deviate from all the original images. Since such generation is only based on images, OPS needs significantly less computation cost than the previous methods using DNN generators. Based on OPS, we introduce an unlearnable dataset called CIFAR-10-S, which is indistinguishable from CIFAR-10 by humans but induces the trained model to extremely low accuracy. Even under adversarial training, a ResNet-18 trained on CIFAR-10-S has only 10.61% accuracy, compared to 83.02% by the existing error-minimizing method.

Motivation & Objective

• To address the vulnerability of existing unlearnable examples (ULEs) to adversarial training and data augmentation by rethinking their underlying learning mechanism.
• To investigate whether deep neural networks can learn from extremely localized, non-semantic features as strong shortcuts during training.
• To develop a lightweight, model-free method that generates unlearnable examples with minimal computational cost and high imperceptibility.
• To create a new benchmark dataset, CIFAR-10-S, combining EM-based and OPS-generated perturbations for evaluating model robustness to composite shortcuts.
• To explore the interplay between local and global data augmentations and their impact on shortcut learning and model generalization.

Proposed method

• OPS identifies a single pixel location across all in-class images where the perturbation to a fixed target value maximizes deviation from original pixel values while minimizing variance.
• The method selects the pixel position and target value based on statistical robustness—maximizing inter-class deviation and minimizing intra-class variance across training images.
• Perturbations are applied uniformly to all in-class images at the same spatial location and value, creating a consistent, localized shortcut that is imperceptible to humans.
• The approach is model-free and does not require a deep neural network generator, significantly reducing computational cost compared to GAN- or optimization-based ULE methods.
• OPS is combined with existing EM-based ULEs to form an ensemble method, creating stronger, more resilient unlearnable examples resistant to both global and local augmentations.
• The method is extended to multi-pixel scenarios, where increasing the number of perturbed pixels further degrades model accuracy, though at the cost of reduced imperceptibility.

Experimental results

Research questions

• RQ1 Can a single pixel serve as a powerful, stable shortcut that degrades DNN generalization performance even under adversarial training?
• RQ2 How does the effectiveness of OPS compare to EM-based ULEs under various data augmentation strategies, including adversarial training and Cutout?
• RQ3 To what extent can OPS and EM-based ULEs be combined to create unlearnable examples that resist both global and local data augmentations?
• RQ4 How does the number of perturbed pixels affect model accuracy degradation and imperceptibility in the context of shortcut learning?
• RQ5 Can a new benchmark dataset, CIFAR-10-S, be constructed using combined EM and OPS perturbations to evaluate model robustness to composite non-semantic shortcuts?

Key findings

• OPS reduces test accuracy of a ResNet-18 model trained on CIFAR-10-S to 10.61% even under adversarial training, compared to 83.02% for the existing EM-based method.
• OPS is significantly more robust to adversarial training than EM-based ULEs, which are effectively neutralized by such training, while OPS remains effective.
• OPS is highly sensitive to local data augmentations like Cutout (61.68% accuracy) but less so to global ones like RandAugment (71.18% accuracy), indicating complementary behavior with different augmentation types.
• The combination of EM and OPS generates stronger unlearnable examples: under RandAugment, a 3-pixel shortcut reduces accuracy to 34.66%, compared to 71.18% for OPS alone.
• Multi-pixel variants of OPS degrade model accuracy further—3-pixel OPS achieves 9.74% test accuracy on ResNet-18, demonstrating scalability and increasing robustness.
• The proposed CIFAR-10-S dataset, combining EM and OPS perturbations, serves as a new benchmark for evaluating model resilience to non-semantic, shortcut-based representations.