Unlearnable data methods (ULD) protect public data from unauthorized model training by adding imperceptible perturbations that create a learning shortcut. A deep neural network can exploit the shortcut learning path to minimize training loss without learning generalizable features. Intuitively, finding adversarial versions of perturbed images that can substantially increase the model's loss can force the model to learn generalizable features. Existing data augmentation based attacks rely on heuristic search strategies/random sampling over a curated augmentation set to identify adversarial augmentation operations, an approach that often does not scale when the number of candidate operations is large. To address the challenge of a large search space, we propose {\techname}, a gradient based adversarial augmentation framework that learns an augmentation policy via stochastic gradient ascent. {\techname} leverages a differentiable data augmentation pipeline to efficiently search a set of up to 18 augmentation techniques, from which a grid search selects a protection-specific subset. The augmentation subset is trained to maximize a surrogate model's classification loss. We introduce a perceptual-plus-pixel regularization to learn operation parameters that preserve image semantics. Under a controlled ablation, {\techname} consistently outperforms an equivalent random sampling baseline (80.0% vs. 77.29% clean test accuracy on EMIN-protected CIFAR-10 for ResNet-18 and 83.28% vs. 66.45% on NTGA-protected CIFAR-10 for MobileNet-V2), demonstrating that gradient guidance drives the clean test accuracy recoverability rather than the expanded search space. {\techname} offers an effective and scalable adversarial augmentation framework for stress-testing ULD methods, a critical tool for developing robust ULD methods.
Figures & tables
Attacks
Search space
Nonlinear transformations. [ 8 ]
Threshold binary, threshold binary inverse, color channel manipulation, erode, and Gaussian blur
ISS [ 9 ]
Grayscale, JPEG and Bit Depth Rate (BDR)
UEraser [ 10 ]
PlasmaTransform, TrivialAugment, and ChannelShuffle
Ours (GAA)
We expand the DA search space beyond previous studies [ 8 , 9 , 10 ] by utilizing the DA set of 16 standard image transformation techniques listed in AutoAugment [ 12 ] . We further add Gaussian blur and Grayscale to ensure generating diverse augmented images. In summary, the augmentation search space has up to 18 operations. A protection-specific operative subset is selected via grid search (Sec. III-A2 ) † .
TABLE I: The search space of existing data augmentation based attacks.
Fig. 1: Overview of the gradient based adversarial augmentation framework (GAA). Unlike existing augmentation-based attacks [ 8 , 10 , 9 ] , our search space is substantially expanded, comprising up to 18 augmentation operations spanning geometric transformations, color adjustment, Gaussian blur, and grayscale conversion; we select the operative subset per protection via grid search (Sec. III-A4 ). Each circle denotes the aggregated image, the weighted average of the candidate space’s augmented images at each stage. Bold arrows represent the most dominant operations, explaining why the output image x′ is sheared, solarized, and blurred.
Attacks
Clean
EMIN
AR
NTGA
SEP
TAP
DC
GAA
95.57
80.0
22.10
54.95
78.06
80.0
70.34
RS
94.78
77.29
48.01
80.28
70.76
77.29
90.44
UEraser
91.93
83.88
89.36
90.21
89.74
88.39
89.66
TABLE II: Clean test accuracies(%) of GAA and a random-sampling adversarial augmentation (RS) on CIFAR-10.
Model
GAA
RS
UEraser
ResNet-18
85.88
80.28
90.21
ResNet-50
86.68
78.27
90.75
MobileNet-V2
83.28
66.45
88.83
TABLE III: Clean and NTGA-protected test accuracies (%) under an NTGA matched policy search, i.e., where the surrogate and policy are trained specifically on NTGA dataset rather than transferred from the EMIN trained surrogate.
Attacks
ResNet-50
MobileNet-V2
GAA
Clean
96.15
91.59
EMIN
83.09
76.91
TAP
83.17
87.99
NTGA
57.64
48.02
SEP
78.42
72.16
AR
20.91
17.59
TABLE IV: Clean test accuracies (%) of different architectures (ResNet-50 and MobileNet-V2) on CIFAR-10.
Adversarial training remains one of the most effective defenses against adversarial attacks, but its standard PGD-based training is computationally expensive because adversarial examples are generated for every training sample. Selective adversarial training reduces this cost by perturbing only a subset of samples. However, existing selective techniques typically rely on point-wise difficulty signals such as loss, entropy, margin, or gradients. We show that these point-wise criteria do not capture local instability in a sample's neighborhood. Motivated by this, we propose Augmentation-Guided Adversarial Training (AGAT), a selective adversarial training framework that uses augmentation-induced local variation to allocate samples with unstable neighborhoods for adversarial training. AGAT ranks samples using Augmentation-based Local Stability (ALS), a lightweight score that measures the normalized change in model logits between an input and its label-preserving augmented variant. Experiments across different architectures on MNIST, CIFAR-10, CIFAR-100, and Tiny-ImageNet-200 demonstrate that AGAT achieves comparable or higher robust accuracy while applying adversarial supervision to only 20-30% of the training samples in each minibatch. AGAT also requires less training time than all other adversarial training baselines in the computational cost evaluation.
Daniel Agyei Asante, Mark Tetteh, Deborah Asamoah +2
Ohio University, United States · University of Nebraska Omaha, United States · University of Toronto, Canada +1
Unlearnable examples (UEs) aim to compromise model training by injecting imperceptible perturbations to clean samples. However, existing UE schemes exhibit limited robustness against advanced defenses due to their heuristic design or narrowly scoped domain perturbations. To address this, we propose DUNE, a Dual-branch UNlearnable Ensemble perturbation optimization approach. Specifically, DUNE separately optimizes perturbations in the spatial and color domains to establish the mapping between perturbations and shift-induced labels. This design extends the perturbation domain to increase noise intensity for improving robustness and drives the models to learn perturbation-oriented features with degraded generalization, thereby achieving unlearnability. To strengthen DUNE's performance, we further propose an unlearnability-enhancing ensemble strategy that aggregates diverse pre-trained models during the dual-branch optimization. Extensive experiments on benchmark datasets CIFAR-10 and ImageNet verify that DUNE's robustness outperforms 12 SOTA UE schemes under 7 mainstream defenses, yielding a lower average test accuracy of 14.95% to 50.82%.
Xianlong Wang, Hangtao Zhang, Wenbo Pan +4
Department of Computer Science, City University of Hong Kong, Hong Kong SAR, China · University of Pennsylvania, Philadelphia, USA · Huazhong University of Science and Technology, Wuhan, China +2
The abundance of online data is at risk of unauthorized usage in training deep learning models. To counter this, various Data Availability Attacks (DAAs) have been devised to make data unlearnable for such models by subtly perturbing the training data. However, existing attacks often excel against either Supervised Learning (SL) or Self-Supervised Learning (SSL) scenarios. Among these, a model-free approach that generates a Convolution-based Unlearnable Dataset (CUDA) stands out as the most robust DAA across both SSL and SL. Nonetheless, CUDA's effectiveness against SSL is underwhelming and it faces a severe trade-off between image quality and its poisoning effect. In this paper, we conduct a theoretical analysis of CUDA, uncovering the sub-optimal gradients it introduces and elucidating the strategy it employs to induce class-wise bias for data poisoning. Building on this, we propose a novel poisoning method named Imperfect Restoration Poisoning (IRP), aiming to preserve high image quality while achieving strong poisoning effects. Through extensive comparisons of IRP with eight baselines across SL and SSL, coupled with evaluations alongside five representative defense methods, we showcase the superiority of IRP. Code: https://github.com/lyumingzhi/IRP
Yi Huang, Jeremy Styborski, Mingzhi Lyu +2
College of Computing and Data Science, Nanyang Technological University, Singapore · Rapid-Rich Object Search (ROSE) Lab, Interdisciplinary Graduate Programme, Nanyang Technological University, Singapore