Research map / Vision-language and multimodal / CLIP and zero-shot

A3: Few-shot Prompt Learning of Unlearnable Examples with Cross-Modal Adversarial Feature Alignment

CVPR 2025 · Vision-language and multimodal › CLIP and zero-shot · approach: Feature calibration for unseen-class detection · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that prompt learning on pretrained CLIP resists unlearnable examples in few-shot settings, and proposes A3, which uses cross-modal adversarial augmented feature alignment (image and text augmentations, minimum-similarity pairs, meta-net) to learn robustly from UEs.

Problem

Unlearnable examples are designed against training from scratch with lots of data, but unauthorized trainers may use few-shot prompt learning on pretrained VLMs such as CLIP, which may circumvent the protection.

Approach

Adapts surrogate-based UE generators (EM, REM, HYPO) to use the CoCoOp prompt learner as surrogate, and defends with A3: sample diverse image and text augmentations, and optimize prompts and a meta-net so that the least similar augmented image-text pair is aligned (min-max over augmented pairs).

Key results

• Under EM perturbations (ℓ∞ 8/255), A3 achieves an average harmonic mean of 82.43% across 7 datasets versus 65.47% for CoCoOp (as stated in the abstract).
• A3 yields 15% to 33% higher harmonic mean than CoCoOp for surrogate-based UEs (EM, REM, HYPO) and 6% to 30% for surrogate-free UEs (LSP, AR, OPS).
• In the ablation, UEraser is the strongest existing augmentation strategy, but A3 still outperforms it, particularly on HYPO, LSP and AR with larger budgets.

Measured effects reported in the paper

Surprising findings

• Prompt learning (CoCoOp) trained on UEs often performs worse than zero-shot CLIP, suggesting UEs can harm the model more than help.
• UE methods that effectively thwart supervised training of small models from scratch are much less effective against CLIP-based prompt learning.

Limitations

• Adversarial training and simple augmentations are less effective, and A3 still falls short of UEraser on some settings with larger budgets.
• Evaluation is limited to CLIP-based prompt learning and a 16-shot default setting.

Experimental setup

Datasets: ImageNet Caltech-101 Oxford Flowers-102 Food-101 Oxford-Pets UCF-101 SUN397 CIFAR-10

Benchmarks: ImageNet Caltech-101 Oxford Pets Flowers-102 Food-101 SUN397 UCF-101

Metrics: accuracy harmonic mean accuracy (base-to-novel)

Baselines: CoCoOp CoOp ProDA KgCoOp UEraser adversarial training Grayscale JPEG compression

Builds on: CoCoOp CoOp UEraser Robust error maximization Error maximization

Closest papers by meaning

• How Far Are We from True Unlearnability? (ICLR 2025 · similarity 0.87)
• Purify Unlearnable Examples via Rate-Constrained Variational Autoencoders (ICML 2024 · similarity 0.86)
• Few-Shot Adversarial Prompt Learning on Vision-Language Models (NeurIPS 2024 · similarity 0.86)
• Detecting and Corrupting Convolution-based Unlearnable Examples (AAAI 2025 · similarity 0.86)
• Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise (AAAI 2024 · similarity 0.86)
• Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models (NeurIPS 2024 · similarity 0.85)