PaperlayerView exact revision on arXiv

Source-linked AI summary

Unlearnable Examples: Making Personal Data Unexploitable

Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, Yisen Wang

arXiv:2101.04898v2cs.LGcs.CRcs.CVstat.ML

TL;DR

The paper asks whether personal data can be made unlearnable to deep learning models, addressing concerns about unauthorized exploitation. It proposes imperceptible error-minimizing noise and finds that it creates unlearnable examples across sample-wise and class-wise forms, datasets, and experimental settings.

  • Problem

    The paper asks whether training data can be transformed into an unlearnable dataset whose trained models perform poorly on clean test data, motivated by unauthorized use of personal data.

  • Method

    The method generates imperceptible, bounded error-minimizing noise through bi-level optimization, producing sample-wise or class-wise unlearnable examples.

  • Results

    Error-minimizing noise reliably creates unlearnable examples across four datasets and both forms, with class-wise noise reducing performance close to random guessing.

  • Takeaways & Limitations

    The results establish a technique for preventing unauthorized data exploration while preserving normal data utility and supporting varied deployment settings.

  • Takeaways & Limitations

    The noise must be generated from the defender’s accessible data portion without later modification, and partially unlearnable data may not stop feature-extractor learning.

Abstract

from arXiv · show

The volume of "free" data on the internet has been key to the current success of deep learning. However, it also raises privacy concerns about the unauthorized exploitation of personal data for training commercial models. It is thus crucial to develop methods to prevent unauthorized data exploitation. This paper raises the question: \emph{can data be made unlearnable for deep learning models?} We present a type of \emph{error-minimizing} noise that can indeed make training examples unlearnable. Error-minimizing noise is intentionally generated to reduce the error of one or more of the training example(s) close to zero, which can trick the model into believing there is "nothing" to learn from these example(s). The noise is restricted to be imperceptible to human eyes, and thus does not affect normal data utility. We empirically verify the effectiveness of error-minimizing noise in both sample-wise and class-wise forms. We also demonstrate its flexibility under extensive experimental settings and practicability in a case study of face recognition. Our work establishes an important first step towards making personal data unexploitable to deep learning models.

1 INTRODUCTION

The paper addresses unauthorized exploitation of personal data by making training examples unlearnable to deep neural networks without reducing their normal utility. It proposes imperceptible error-minimizing noise in sample-wise and class-wise forms.

  • Personal data collected from the Internet has been used for training commercial models without consent, raising privacy concerns.
  • Unlearnable examples aim to make DNNs perform like random guessing on clean test examples while preserving normal data quality.
  • Error-minimizing noise reduces training loss and tricks models into learning that the protected examples contain nothing useful.
  • Class-wise error-minimizing noise is superior to random noise and resists early stopping, while sample-wise error-minimizing noise is effective against training.
  • The proposed noise is imperceptible, generated in sample-wise or class-wise forms, and evaluated through experiments and a face-recognition case study.

2 RELATED WORK

Prior privacy-preserving methods protect models from leaking training data, whereas this paper considers making personal data unusable to models. It also distinguishes the approach from poisoning and test-time adversarial attacks.

  • Data Privacy: Privacy-preserving machine learning commonly assumes models can freely explore training data and focuses on preventing sensitive-information leakage from models.
  • Data Privacy: This paper considers the harder objective of making personal data completely unusable to deep learning models.
  • Data Poisoning: Data poisoning modifies training examples to degrade clean-example performance, but prior approaches are limited against DNNs and difficult to operate in practice.
  • Adversarial Attack: Adversarial examples use error-maximizing noise to fool DNNs at test time, while this paper explores the opposite direction.

3 UNLEARNABLE EXAMPLES AND ERROR-MINIMIZING NOISE

The paper formulates unlearnability as transforming clean training data into a dataset whose trained DNN performs poorly on clean tests. It uses imperceptible bounded noise, sample-wise or class-wise, generated through bi-level optimization.

  • 3.1 PROBLEM STATEMENT: The defender can transform only their own data, cannot access the full training set or training process, and cannot modify examples after creation.
  • 3.1 PROBLEM STATEMENT: The objective is to transform clean training data into an unlearnable dataset that causes DNNs trained on it to perform poorly on clean test data.
  • 3.1 PROBLEM STATEMENT: Each unlearnable example adds Lp-bounded invisible noise whose small magnitude is intended to preserve normal utility.
  • 3.1 PROBLEM STATEMENT: The method seeks to make models learn correlations between noise and labels instead of the original input-to-label mapping.
  • 3.1 PROBLEM STATEMENT: Sample-wise noise is generated separately for each example, whereas class-wise noise is shared across examples in a class and is more efficient to generate.
  • 3.2 GENERATING ERROR-MINIMIZING NOISE: A min-min bi-level optimization jointly minimizes classification loss over noise and model parameters, with constrained noise optimized periodically during limited model updates.

4 EXPERIMENTS

Experiments evaluate error-minimizing noise across datasets, noise forms, training conditions, transfer settings, and face recognition. The method generally creates unlearnable examples, but effectiveness declines when clean data remain or adversarial training is used.

  • Experimental settings: Experiments cover four image datasets, imperceptible L∞-bounded noise, ResNet-18 noise generation, and comparisons with random and error-maximizing noise.The noise constraint is ∥δ∥∞ < 8/255, and random and adversarial baselines receive the same amount of noise application.
  • Comparison with baselines: Class-wise random and error-maximizing noise can disrupt learning, but early stopping can circumvent them; error-minimizing noise is more flexible.In the sample-wise setting, networks remain robust to the random and error-maximizing baselines.
  • Overall effectiveness: Error-minimizing noise reliably creates unlearnable examples in sample-wise and class-wise forms across SVHN, CIFAR-10, CIFAR-100, and ImageNet subset.Class-wise noise is particularly effective, reducing performance close to random guessing and transferring across model types.
  • Stability analysis: When only part of the dataset is unlearnable, effectiveness drops quickly and is almost negligible even when noise affects 40% of the data.The reported limitation applies to both sample-wise and class-wise noise.
  • Stability analysis: With 80% unlearnable and 20% clean data, the clean subset alone suffices for good model performance, while the unlearnable subset remains unlearnable.Models trained on the mixed dataset perform similarly to models trained only on the clean proportion.
  • Noise filtering techniques: Adversarial training weakens the protection, with slightly increased ϵ allowing 79% clean test accuracy on CIFAR-10.The noise is described as fairly robust to four data-augmentation techniques, whose highest reported accuracy is 58.51%.
  • Transferability analysis: Noise generated on CIFAR-10 transfers to CIFAR-100, making the ship class unlearnable despite early learning of 60% clean-test accuracy.The experiment models generating protective noise on one dataset before images are incorporated into another.
  • Face-recognition case study: In face recognition, 50 noisy identities achieve 16% clean-face recognition accuracy versus 86% for 10,525 clean identities.In the fully unlearnable setting, error-minimizing noise reduces verification AUC to 0.5321 from 0.9975 in the clean setting.

5 CONCLUSION

The paper explores invisible noise that makes data unlearnable to deep learning models and demonstrates effectiveness across forms, sizes, datasets, filtering methods, and face recognition. It presents this work as an important first step, while acknowledging obstacles to large-scale application.

  • Error-minimizing noise creates unlearnable examples that prevent deep learning models from freely exploiting personal data while remaining imperceptible to human eyes.The paper states that the noise does not reduce general data utility.
  • The method supports sample-wise and class-wise noise, full-image or small-patch perturbations, and customization to selected proportions or classes.Noise can target one class, multiple classes, or a certain proportion of data.
  • Error-minimizing noise resists common data filtering methods and can transfer from public datasets to make private datasets unlearnable.
  • A face-recognition case study verifies the usefulness of unlearnable examples in a real-world scenario.
  • The authors identify many practical obstacles that remain before large-scale application of error-minimizing noise.

B MORE EXPERIMENT SETTING

The experiments regularize imperceptibility with an Lp-norm constraint and use different perturbation budgets and optimization steps for datasets and noise forms.

  • ϵ = 8/255 is used for CIFAR and SVHN, while ϵ = 16/255 is used for ImageNet.
  • Sample-wise noise uses 20 iterative steps, class-wise noise uses 1 step, and α is set to ϵ/10.The shorter class-wise optimization avoids overfitting to specific examples.
  • Class-wise experiments generate noise using 20% of the training data.

C STABILITY ANALYSIS

Figure 5 presents clean-test prediction confusion matrices for RN-18 models trained with sample-wise or class-wise error-minimizing noise on CIFAR-10.

  • The confusion matrices compare prediction behavior for sample-wise and class-wise error-minimizing noise, with unlearnable classes shown in bold.

D RESISTANCE TO DATA AUGMENTATION AND ADVERSARIAL TRAINING

The paper evaluates unlearnable examples against advanced data augmentation and adversarial training. Error-minimizing noise remains effective under these settings, although adversarial training reduces its resistance and introduces an accuracy trade-off.

  • Resistance to Data Augmentation: Table 3 reports clean-test accuracy for RN-18 models trained on unlearnable CIFAR-10 with Cutout, Mixup, Cutmix, and Fast Autoaugment.RN-18 trained on clean CIFAR-10 achieves 94.95% accuracy.
  • Adversarial Training: Adversarial training is more effective than data augmentation against both sample-wise and class-wise noise, but it trades robustness for accuracy.
  • Adversarial Training: 85% accuracy is achieved on unlearnable CIFAR-10 with adversarial training, compared with 94.95% under standard training on clean CIFAR-10.
  • Adversarial Training: Error-minimizing noise is less resistant to adversarial training, yet still significantly compromises model performance.The paper suggests future work could craft noise using robust features.
  • Adversarial Training: Figure 6 compares clean-test accuracy across different error-minimizing noise sizes, using clean-CIFAR-10 RN-18 performance as the dashed-line reference.

F FLEXIBILITY ANALYSIS OF ERROR-MINIMIZING NOISE

The paper tests whether class-wise error-minimizing noise remains effective when applied to smaller image patches or mixed across two generated noise sets.

  • Experimental Setting: The experiments use RN-18 on CIFAR-10 and fix the maximum perturbation for all error-minimizing noise at ϵ = 8/255.The flexibility analysis covers both smaller patches and mixed class-wise noise.
  • Experimental Setting: Table 5 reports clean test accuracy for RN-18 models trained with random-location patch noise or a mixture of two noise types.The table concerns the two flexibility settings tested in this section.
  • Effectiveness on Smaller Patches: 32×32, 24×24, 16×16, and 8×8 patches are evaluated to test whether class-wise noise remains effective on smaller regions.A random patch is selected and perturbed during each noise-generation step before the generated class-wise patch noise is attached to training examples.
  • Effectiveness of Mixed Noises: Two class-wise noise sets, Δc1 and Δc2, are randomly mixed across CIFAR-10 training examples to simulate heterogeneous user noise or upgraded noise.The mixed-noise experiment applies the perturbations to the full image.

G RESULTS ON FACE VERIFICATION

Figure 7 evaluates face verification using Inception-ResNet classifiers trained on partially or fully unlearnable WebFace and tested as feature extractors.

  • Face Verification: Figure 7 compares ROC curves for two Inception-ResNet models trained on partially unlearnable WebFace versus fully unlearnable WebFace.The partially unlearnable model is evaluated on the clean WebFace test set, while the fully unlearnable model is evaluated on LFW.
  • Face Verification: Both Inception-ResNet models are trained as classifiers and tested as feature extractors for face verification.The plots distinguish clean identities from unlearnable identities.

H CLASS-WISE NOISE VS. BACKDOOR ATTACK

Class-wise error-minimizing noise differs from backdoor-trigger noise: it is not an effective trigger, unlike class-wise error-maximizing noise.

  • Attack Success: More than 75% attack success is achieved by class-wise error-maximizing noise when it poisons only 20% of CIFAR-10 training data.Attack success rate is measured as the percentage of non-target test images predicted as the target class when attached with the target-class noise.
  • Attack Success: Random and error-minimizing class-wise noise require at least 80% poisoned training data to reach a similar attack success rate.Neither is considered an effective backdoor trigger under lower poisoning rates.
  • Interpretation: The results indicate that error-minimizing noise serves a different purpose from backdoor attacks.The paper attributes adversarial noise’s stronger trigger behavior to hard examples that receive more model attention and are more strongly remembered.

I DIFFERENT GENERALIZATION METHODS FOR ERROR-MINIMIZATION NOISE

The paper compares optimization methods for generating error-minimizing noise, contrasting PGD with an L-BFGS reformulation and evaluating noise effectiveness on CIFAR-10.

  • Optimization Methods: PGD solves the inner minimization problem used to generate the proposed error-minimizing noise.The optimization is a constrained problem, so alternative attack methods can also be used after reformulating the objective when necessary.
  • Optimization Objective: Unlike adversarial attacks that seek an incorrect label, unlearnable-example optimization seeks small noise that makes the model predict the correct label with highest confidence.This corresponds to minimizing the model’s error on the training example.
  • Optimization Methods: L-BFGS can also generate error-minimizing noise after reformulating the inner minimization objective.The reported L-BFGS setup uses c = 1.0, cross-entropy loss, Adam, T = 200 inner steps, and M = 100 outer steps on CIFAR-10.
  • Evaluation: Figure 9 compares random, error-maximizing, PGD-generated error-minimizing, and L-BFGS-generated error-minimizing noise using clean test accuracy.Lower clean test accuracy indicates greater effectiveness in making training examples unlearnable.
Loading 2101.04898v2…