Research map / Adversarial robustness and security / Attacks on text and graphs
Re-thinking Data Availability Attacks Against Deep Neural Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a two-stage min-max-min optimization with a differentiable average randomness constraint to train a robust surrogate that generates unlearnable noise resisting adversarial training.
Problem
Availability attacks (unlearnable examples) are easily disrupted by adversarial training, and existing robust methods (REM, EntF) retain limited protection.
Approach
Train a robust surrogate model from scratch via adversarial training inside a min-max-min pipeline (inner min generates unlearnable noise, outer min-max simulates poisoned adversarial training), and add a Differentiable Average Randomness constraint (MSE to uniform prediction on clean data) so the surrogate learns little from clean examples.
Key results
- Under 4/255 adversarial training on CIFAR-10 with ResNet-18, the proposed noise yields 23.12% test accuracy versus 48.16% for REM and 88-89% for EM/TAP/NTGA.
- Transfer to other architectures: on CIFAR-10 the average accuracy of the method across surrogates is reduced by roughly 7% to 25% relative to SOTA methods.
- Up to ~30% accuracy drop for adversarially trained poisoned models compared to SOTA according to abstract.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the two-stage min-max-min method with Average Randomness Constraint instead of REM | ResNet-18 noise generation · CIFAR-10, adversarial training ρa=4/255 | test accuracy (%): 48.16 -> 23.12 | Helped |
| Use the two-stage min-max-min method with Average Randomness Constraint instead of REM | ResNet-18 noise generation · CIFAR-100, adversarial training ρa=4/255 | test accuracy (%): 27.35 -> 23.00 | Helped |
| Use the two-stage min-max-min method with Average Randomness Constraint instead of REM | ResNet-18 noise generation · ImageNet subset, adversarial training ρa=4/255 | test accuracy (%): 41.66 -> 31.64 | Helped |
| Use the two-stage min-max-min method with Average Randomness Constraint instead of REM | ResNet-18 noise generation · CIFAR-10, adversarially trained VGG-16 | test accuracy (%): 65.23 -> 37.78 | Helped |
| Use the two-stage min-max-min method with Average Randomness Constraint instead of REM | ResNet-18 noise generation · CIFAR-100, adversarially trained ResNet-50 | test accuracy (%): 26.03 -> 21.47 | Helped |
| Increase adversarial training perturbation radius from 0 to 4/255 | Ours on CIFAR-10 · CIFAR-10, ResNet-18 | test accuracy (%): 12.71 -> 23.12 | Hurt |
| Increase adversarial training perturbation radius from 0 to 4/255 | Ours on CIFAR-100 · CIFAR-100, ResNet-18 | test accuracy (%): 3.27 -> 23.00 | Hurt |
| Increase adversarial training perturbation radius from 0 to 4/255 | Ours on ImageNet subset · ImageNet subset, ResNet-18 | test accuracy (%): 4.08 -> 31.64 | Hurt |
Surprising findings
- Table 3 shows the proposed method's protection on CIFAR-10 at 4/255 under standard training (ρa=0) is comparable to other methods, while EM-style noise is largely neutralized by even 1/255 adversarial training.
Limitations
- Requires adversarial training during noise generation, which is computationally expensive on large-scale datasets like ImageNet.
- Less effective when only a fraction of the data is protected.
- Robust noise under adversarial training with larger radii degrades (e.g., ResNet-18 ImageNet and CIFAR-100 protection weaker at low protection percentages).
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet subset (first 100 classes)
Benchmarks: CIFAR-10 CIFAR-100 ImageNet subset
Metrics: test accuracy on clean test set of models trained on unlearn
Baselines: EM TAP NTGA REM EntF
Builds on: Error-Minimizing noise Robust Error-Minimizing Entangled Features PGD adversarial training
Closest papers by meaning
- Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise (AAAI 2024 · similarity 0.89)
- Rethinking Adversarial Robustness in the Context of the Right to be Forgotten (ICML 2024 · similarity 0.87)
- Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond (ICML 2025 · similarity 0.87)
- SuperDeepFool: a new fast and accurate minimal adversarial attack (NeurIPS 2024 · similarity 0.86)
- Flexible, Efficient, and Stable Adversarial Attacks on Machine Unlearning (ICML 2025 · similarity 0.86)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.