[Paper Review] Unlearnable Examples: Making Personal Data Unexploitable

Hanxun Huang, Xingjun Ma+3 more|arXiv (Cornell University)|Jan 13, 2021

Privacy-Preserving Technologies in DataComputer Science58 references46 citations

TL;DR

The paper introduces error-minimizing noise to create unlearnable training examples, making personal data unusable for deep learning while preserving data utility for normal use.

ABSTRACT

The volume of "free" data on the internet has been key to the current success of deep learning. However, it also raises privacy concerns about the unauthorized exploitation of personal data for training commercial models. It is thus crucial to develop methods to prevent unauthorized data exploitation. This paper raises the question: \emph{can data be made unlearnable for deep learning models?} We present a type of \emph{error-minimizing} noise that can indeed make training examples unlearnable. Error-minimizing noise is intentionally generated to reduce the error of one or more of the training example(s) close to zero, which can trick the model into believing there is "nothing" to learn from these example(s). The noise is restricted to be imperceptible to human eyes, and thus does not affect normal data utility. We empirically verify the effectiveness of error-minimizing noise in both sample-wise and class-wise forms. We also demonstrate its flexibility under extensive experimental settings and practicability in a case study of face recognition. Our work establishes an important first step towards making personal data unexploitable to deep learning models.

Motivation & Objective

• Motivate the need to protect personal data from unauthorized deep learning training.
• Propose a new form of noise that minimizes training error to make examples unlearnable.
• Develop a bi-level optimization framework to generate sample-wise and class-wise unlearnable noise.
• Demonstrate the method's effectiveness across multiple datasets and a face recognition case study.

Proposed method

• Formulate unlearnable data as a bi-level optimization where inner minimization finds an imperceptible noise under Lp bounds that minimizes training loss, and the outer minimization updates the classifier to minimize loss on the perturbed data.
• Use two noise forms: sample-wise (per-example) and class-wise (per-label) perturbations.
• Solve the inner problem using projected gradient descent (PGD) with a bounded perturbation epsilon.
• Apply the noise generation process at intervals during training to ensure the model learns from noise rather than content.
• Evaluate robustness under varying datasets and architectures, including a face recognition case study.

Experimental results

Research questions

• RQ1 Can imperceptible noise make training examples unlearnable for deep neural networks?
• RQ2 How do sample-wise and class-wise error-minimizing noises compare in effectiveness and robustness?
• RQ3 Does the approach transfer across datasets and model architectures?
• RQ4 Can the method protect personal data in real-world scenarios such as face recognition?

Key findings

• Error-minimizing noise can reduce clean test accuracy to below 23% on CIFAR-10 in both sample-wise and class-wise forms.
• Class-wise noise typically more effective than sample-wise noise, sometimes driving accuracy near random guessing.
• The method remains effective across SVHN, CIFAR-10/100, and an ImageNet subset, and transfers to some external datasets.
• Partial unlearnability (only part of data unlearnable) still impairs learning, though full unlearnability yields stronger protection.
• A face recognition/verification case study demonstrates significant protection for targeted identities.