[Paper Review] Robust Unlearnable Examples: Protecting Data Against Adversarial Learning

Shaopeng Fu, Fengxiang He+3 more|arXiv (Cornell University)|Mar 28, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes robust error-minimizing noise, a novel defense mechanism that generates imperceptible, unlearnable examples resistant to adversarial training. By minimizing adversarial training loss through a min-min-max optimization with expectation over transform (EOT), the method effectively suppresses model learning of protected data, outperforming prior error-minimizing noise under adversarial training across multiple datasets and architectures.

ABSTRACT

The tremendous amount of accessible data in cyberspace face the risk of being unauthorized used for training deep learning models. To address this concern, methods are proposed to make data unlearnable for deep learning models by adding a type of error-minimizing noise. However, such conferred unlearnability is found fragile to adversarial training. In this paper, we design new methods to generate robust unlearnable examples that are protected from adversarial training. We first find that the vanilla error-minimizing noise, which suppresses the informative knowledge of data via minimizing the corresponding training loss, could not effectively minimize the adversarial training loss. This explains the vulnerability of error-minimizing noise in adversarial training. Based on the observation, robust error-minimizing noise is then introduced to reduce the adversarial training loss. Experiments show that the unlearnability brought by robust error-minimizing noise can effectively protect data from adversarial training in various scenarios. The code is available at \url{https://github.com/fshp971/robust-unlearnable-examples}.

Motivation & Objective

• To address the vulnerability of existing unlearnable examples to adversarial training, which undermines data protection.
• To investigate why error-minimizing noise fails under adversarial training, particularly due to ineffective suppression of adversarial training loss.
• To design a new noise generation method that maintains unlearnability under adversarial training by minimizing adversarial loss.
• To empirically validate the robustness of the proposed method across diverse models and datasets.
• To establish a stable and effective framework for generating unlearnable examples resilient to adversarial fine-tuning.

Proposed method

• Proposes a min-min-max optimization framework to train a robust error-minimizing noise generator, where the inner minimization targets adversarial training loss.
• Introduces robust error-minimizing noise as a defense mechanism that suppresses learnable knowledge by minimizing adversarial loss, not standard training loss.
• Employs the expectation over transform (EOT) technique to stabilize noise generation and improve generalization under adversarial perturbations.
• Uses a generator network to produce imperceptible noise that, when added to clean data, renders the examples unlearnable under adversarial training.
• Trains the noise generator using a two-stage process: first, optimize for adversarial loss minimization; second, apply EOT to enhance robustness.
• Applies the method to CIFAR-10 and CIFAR-100, evaluating performance across multiple architectures (ResNet, VGG, DenseNet, Wide ResNet) under varying adversarial perturbation radii.

Experimental results

Research questions

• RQ1 Why does error-minimizing noise fail to protect data under adversarial training?
• RQ2 Can unlearnable examples remain effective when models are trained adversarially?
• RQ3 Is it possible to design a noise type that minimizes adversarial training loss while preserving data imperceptibility?
• RQ4 How does the EOT technique affect the stability and robustness of the generated unlearnable examples?
• RQ5 Does the robust error-minimizing noise generalize across different model architectures and datasets?

Key findings

• Robust error-minimizing noise (REM) maintains strong unlearnability under adversarial training, achieving test accuracy of 91.76% on CIFAR-10 with ρa = 4/255, compared to 27.09% for standard error-minimizing noise.
• On CIFAR-100, REM achieves 63.79% test accuracy at ρa = 4/255, significantly outperforming the 27.10% accuracy of error-minimizing noise.
• The EOT technique is essential: without it, the noise provides no protection, with test accuracy dropping to 18.55% on CIFAR-10 under adversarial training.
• REM demonstrates robustness across diverse architectures, including ResNet-18, VGG-16, ResNet-50, DenseNet-121, and Wide ResNet-34-10, on both CIFAR-10 and CIFAR-100.
• The method remains effective even when the defensive perturbation radius ρu is increased to 16/255, indicating strong generalization capability.
• DenseNet-121 shows reduced protection performance, possibly due to inherent limitations in adversarial generalization, though REM still outperforms baseline methods.