Research map / Adversarial robustness and security / Attacks on text and graphs
RAEncoder: A Label-Free Reversible Adversarial Examples Encoder for Dataset Intellectual Property Protection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes RAEncoder, a label-free reversible adversarial example framework that trains a noise encoder to produce universal perturbations by attacking SSL pre-trained encoders, with an interference pattern so only the correct signature noise recovers the original data.
Problem
Reversible adversarial examples for dataset IP protection rely on labeled data and supervised classifiers, and their adversarial strength and transferability drop when downstream models use SSL pre-trained encoders.
Approach
A noise encoder maps a fixed signature noise to a universal perturbation, trained with an InfoNCE-style loss against a public SSL encoder plus a high-frequency filter loss and an interference pattern that makes random-noise inputs produce near-blank perturbations, enabling 100% recovery for authorized users without label supervision or embedded information.
Key results
- Protected samples reach over 80% ASR in almost all of 6 SSL encoders x 4 downstream dataset settings, and near 100% when pre-training and downstream are both ImageNet.
- On CIFAR10, RAEncoder achieves SSIM 0.85 / PSNR 28.26 for protected data versus 0.42 / 14.73 for SRAE, with recovered data at SSIM 1.00 and infinite PSNR.
- Without the interference pattern, random-noise inputs recover near-original images; with it, the attacked dataset retains adversarial strength (attacked ASR 86.11% at default weight).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use RAEncoder rather than prior RAE methods to generate protected CIFAR10 samples | RAEncoder and existing RAE methods · CIFAR10 protected samples | SSIM: 0.77 -> 0.85 | Helped |
| Use RAEncoder rather than PGN to generate protected ImageNet samples | RAEncoder and PGN · ImageNet protected samples | PSNR: 34.23 -> 30.26 | Hurt |
| Use RAEncoder rather than SRAE to protect CIFAR10 | RAEncoder and SRAE · CIFAR10 / ResNet18 | ASR: 88.40 -> 84.79 | Hurt |
| Add the interference pattern to the noise encoder (ablation) | RAEncoder noise encoder · Protected dataset after random-noise attack | ASR | Helped |
| Add L_E_mse to the noise-encoder loss (ablation) | RAEncoder · CIFAR10 protected samples | SSIM: 0.80 -> 0.85 | Helped |
| Add L_E_H to the noise-encoder loss (ablation) | RAEncoder · CIFAR10 protected samples | SSIM: 0.82 -> 0.85 | Helped |
| Set interference-pattern loss weight ratio ϕ to 0.5 instead of the default 1 (ablation) | RAEncoder · CIFAR10 protected samples | ASR_protected: 85.83 -> 85.47 | No clear effect |
| Set interference-pattern loss weight ratio ϕ to 2 instead of the default 1 (ablation) | RAEncoder · CIFAR10 protected samples | ASR_protected: 85.83 -> 82.13 | Hurt |
| Increase the perturbation upper-bound ϵ (ablation) | RAEncoder · CIFAR10 protected samples | ASR | Mixed |
| Apply image processing operations to protected samples | RAEncoder · Processed protected samples | ASR | Helped |
| Increase Gaussian blur corruption | RAEncoder and SRAE protected samples · Corrupted protected samples | ASR | Hurt |
Surprising findings
- SRAE achieves slightly higher ASR than RAEncoder on CIFAR10 but at much lower imperceptibility (SSIM 0.42 vs 0.85).
Limitations
- Visual quality versus adversarial strength trade-off is not fully resolved, as acknowledged by the authors.
- Baselines were adapted to SSL settings by attaching classification heads to pre-trained encoders, which may not reflect their original designs.
- Security relies on the secrecy of the signature noise; the noise encoder could be compromised if stored in cloud services.
Experimental setup
Datasets: CIFAR10 ImageNet STL10 GTSRB
Benchmarks: CIFAR10 ImageNet STL10 GTSRB
Metrics: ASR SSIM PSNR LPIPS
Baselines: Xue et al. RDH-based RAE PGN GEAA SRAE
Builds on: InfoNCE Reversible Image Transformation PGN solo-learn
Closest papers by meaning
- RevINN: An End-to-End Invertible Neural Network for Reversible Adversarial Examples Generation (CVPR 2026 · similarity 0.87)
- DataFreeShield: Defending Adversarial Attacks without Training Data (ICML 2024 · similarity 0.85)
- Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise (AAAI 2024 · similarity 0.85)
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.85)
- Catch-Only-One: Non-Transferable Examples for Model-Specific Authorization (NeurIPS 2026 · similarity 0.84)
- Tracking the Copyright of Large Vision-Language Models through Parameter Learning Adversarial Images (ICLR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.