Research map / Adversarial robustness and security / Attacks on text and graphs
Ungeneralizable Examples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes UnGeneralizable Examples (UGEs), a generator-produced, bounded-noise data protection that keeps data learnable for a protector-chosen authorized network while making it unlearnable for hacker networks.
Problem
Existing unlearnable examples protect data from all training uniformly, which also prevents legitimate authorized use of the data; the paper seeks data that is learnable by authorized networks but not by unauthorized hacker networks.
Approach
Train a generator to produce bounded perturbations combining a gradient matching loss (keep authorized-network training trajectory on original data), a CLIP feature-space distance loss with triplet term (make data unlearnable for hacker networks), and an undistillation loss (block distillation from the authorized network), replacing bilevel error-minimizing noise optimization.
Key results
- UGEs reduce hacker network test accuracy by more than 40% while the authorized network loses less than 5% accuracy (e.g., CIFAR-10 ResNet-18 authorized 93.89 vs 95.05 clean; hacker CNN 26.46 vs 95.05).
- On CIFAR-10 under distillation attack, the undistill loss reduces hacker accuracy from about 75-87% (UGEs w/o UD) to about 32-47% (full UGEs).
- Compared with existing ULE methods on CIFAR-10/CIFAR-100, the Lfd-only variant achieves competitive unlearnability (22.59% and 9.35%), though not best across all baselines.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Generate UGEs with gradient matching, feature distance, and undistill losses | ResNet-18 authorized network and hacker networks · CIFAR-10 | test accuracy: 95.05 -> 93.89; 95.41 -> 26.12 | Mixed |
| Generate UGEs with gradient matching, feature distance, and undistill losses | ResNet-18 authorized network and hacker networks · CIFAR-100 | test accuracy: 78.24 -> 74.68; 72.67 -> 32.11 | Mixed |
| Generate UGEs with gradient matching, feature distance, and undistill losses | ResNet-18 authorized network and hacker networks · TinyImageNet | test accuracy: 63.08 -> 59.54; 60.02 -> 15.79 | Mixed |
| Add undistill loss (ablation) | UGEs on CIFAR-10 · CIFAR-10 | test accuracy under distillation attack: 87.10 -> 35.23 | Helped |
| Add undistill loss (ablation) | UGEs on CIFAR-100 · CIFAR-100 | test accuracy under distillation attack: 40.45 -> 15.50 | Helped |
| Add undistill loss (ablation) | UGEs on TinyImageNet · TinyImageNet | test accuracy under distillation attack: 42.93 -> 24.42 | Helped |
| Remove undistill loss (ablation) | UGEs on CIFAR-10 · CIFAR-10 | authorized test accuracy: 93.89 -> 94.34 | No clear effect |
| Remove undistill loss (ablation) | UGEs on CIFAR-100 · CIFAR-100 | authorized test accuracy: 74.68 -> 75.26 | No clear effect |
| Use feature distance loss only (ablation) | UGEs on CIFAR-10 · CIFAR-10 | test accuracy: 93.89 -> 22.59 | Hurt |
| Use undistill loss only (ablation) | UGEs on CIFAR-10 · CIFAR-10 | test accuracy: 93.89 -> 94.52 | No clear effect |
| Use feature distance loss only (ablation) | unlearnable examples on CIFAR-10 · CIFAR-10 | test accuracy: ULEs: EM 13.20, TAP 22.51, NTGA 16.27, REM 27.09, CUDA 18.48, Ours (Lfd) 22.59 | Mixed |
| Use feature distance loss only (ablation) | unlearnable examples on CIFAR-100 · CIFAR-100 | test accuracy: ULEs: EM 1.60, TAP 13.75, NTGA 3.22, REM 10.14, CUDA 12.69, Ours (Lfd) 9.35 | Mixed |
Surprising findings
- Adding the undistill loss to UGEs lowers hacker accuracy under distillation attacks but in some configurations increases authorized accuracy trade-offs are mild; the paper notes that with more authorized networks the UGE performance declines slightly.
Limitations
- Performance degrades as the number of authorized networks grows (Table 2).
- Framework is designed only for image classification tasks.
- Hacker-network accuracy gains are not uniform; some configurations keep moderate accuracy under distillation attacks.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 TinyImageNet
Benchmarks: CIFAR-10 CIFAR-100 TinyImageNet
Metrics: test accuracy on authorized network test accuracy on hacker networks
Baselines: EM TAP NTGA REM CUDA Original (clean training)
Builds on: unlearnable examples (error-minimizing noise) knowledge undistillation CLIP gradient matching
Closest papers by meaning
- How Far Are We from True Unlearnability? (ICLR 2025 · similarity 0.87)
- A3: Few-shot Prompt Learning of Unlearnable Examples with Cross-Modal Adversarial Feature Alignment (CVPR 2025 · similarity 0.85)
- Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise (AAAI 2024 · similarity 0.85)
- One for All: A Universal Generator for Concept Unlearnability via Multi-Modal Alignment (ICML 2024 · similarity 0.85)
- Detection and Defense of Unlearnable Examples (AAAI 2024 · similarity 0.85)
- Certified Unlearning for Neural Networks (ICML 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.