Research map / Adversarial robustness and security / Attacks on text and graphs
Detection and Defense of Unlearnable Examples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that unlearnable examples are easily detectable via linear/two-layer network and bias-shifting tests, and proposes stronger augmentations plus simple-network adversarial noise as a cheap defense, with certified budget criteria for adversarial training.
Problem
Unlearnable examples protect personal data by poisoning training sets so models look good on poisoned validation data but fail on clean test data; the paper asks whether such poisoned datasets can be detected and defended cheaply, and what poison/defense budgets make adversarial training effective.
Approach
Proves certain class-wise and region-wise random poisons make the poisoned dataset (not just the noise) linearly separable, uses linear/two-layer-NN training accuracy and a large-bias-shift test to detect poisons, and defends by combining stronger contrastive-style augmentations with adversarial noise from an adversarially trained two-layer NN to destroy detectability.
Key results
- Simple networks (linear or two-layer NN) with bias-shifting noise tests detect the tested unlearnable poisons on CIFAR-10, CIFAR-100 and TinyImageNet; the bias test with -0.5 shift flags all tested poisons at bound 0.7 (two-layer NN detects all of them).
- The proposed SDA+AN defense reaches 93.51% test accuracy on Region-16 and 88.01% on Err-min(S) poisoned CIFAR-10, versus 19.86% and 10.09% with no defense.
- Adversarial training with defense budget 6/255 restores CIFAR-10 test accuracy to about 77% against 8/255 poisons, while budgets at or below 2/255 stay below 30%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add stronger data augmentations with adversarial noises generated by a simple two-layer network (ablation) | SDA defense on poisoned CIFAR-10 · Region-16 and Err-min(S) | test accuracy: 77.20 -> 93.51; 75.62 -> 88.01 | Helped |
| Add adversarial noises to stronger data augmentations (ablation) | SDA defense on poisoned CIFAR-10 · Err-max, RobustEM, AR, EntF | test accuracy: 56.96 -> 61.19; 79.21 -> 79.28; 75.81 -> 80.20; 90.84 -> 88.17 | Mixed |
| Add adversarial noises to stronger data augmentations (ablation) | SDA defense on poisoned CIFAR-10 · NTGA and TUE | test accuracy: 78.48 -> 89.00; 73.80 -> 92.76 | Helped |
| Increase adversarial-training defense budget from 2/255 to 6/255 | Adversarial training on poisoned CIFAR-10 with poison budget 8/255 · Region-16, Err-min(S), and RobustEM | test accuracy: 29.57 -> 77.03; 10.13 -> 76.53; 28.50 -> 76.69 | Helped |
| Increase adversarial-training defense budget beyond 6/255 | Adversarial training on poisoned CIFAR-10 with poison budget 8/255 · Region-16, Err-min(S), and RobustEM | test accuracy: 77.03 -> 72.65; 76.53 -> 72.13; 76.69 -> 72.19 | Hurt |
| Increase poison budget from 0 to 8/255 | Region-16 poisoning on CIFAR-10 · CIFAR-10 | linear separability rate: 46.53 -> 99.87 | Helped |
| Increase poison budget from 0 to 8/255 | Err-min(S) poisoning on CIFAR-10 · CIFAR-10 | linear separability rate: 46.53 -> 99.99 | Helped |
| Increase poison budget from 0 to 8/255 | RobustEM poisoning on CIFAR-10 · CIFAR-10 | linear separability rate: 46.53 -> 78.49 | Helped |
| Use stronger contrastive-learning data augmentation for two-layer-network detection | Simple Networks Detection · CIFAR-10 and CIFAR-100 poisoned datasets | detection training accuracy | No clear effect |
| Use a bias-shifting noise of ±0.5 | Bias-shifting Noise Test · Poisoned validation sets | validation accuracy: 100.0 -> 99.84; 100.0 -> 99.64; 99.99 -> 100.0; 99.98 -> 95.26; 99.98 -> 99.82 | No clear effect |
| Train with a smaller initial learning rate and early stopping | Victim models trained on unlearnable CIFAR-10 examples · CIFAR-10 | test accuracy: 10.32 -> 69.47; 11.02 -> 79.30; 9.95 -> 81.84 | Helped |
Surprising findings
- Unlearnable examples can be detected by a simple linear model or two-layer NN, even though clean CIFAR-10 is only 46.53% linearly separable.
- Stronger data augmentation alone achieves defense comparable to adversarial training, suggesting breaking detectability is key to defense.
Limitations
- Theoretical bounds are not tight; the authors state tighter poison budget bounds are possible.
- Defense performance against Err-max poisons is weaker (SDA+AN 61.19% vs 84.75% for AT-based methods).
- Detection is designed for whole datasets rather than individual instances, and results depend on a chosen detection bound B.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 TinyImageNet
Benchmarks: CIFAR-10 CIFAR-100 TinyImageNet
Metrics: test accuracy detection accuracy linear separability rate false positive/false negative rate
Baselines: Adversarial training (AT-based methods) UEraser ISS Adversarial noises
Builds on: unlearnable examples adversarial training PGD attack contrastive learning augmentations
Closest papers by meaning
- Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise (AAAI 2024 · similarity 0.89)
- Rethinking Adversarial Robustness in the Context of the Right to be Forgotten (ICML 2024 · similarity 0.87)
- Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy (ICLR 2025 · similarity 0.86)
- Adversarial Machine Unlearning (ICLR 2025 · similarity 0.86)
- Flexible, Efficient, and Stable Adversarial Attacks on Machine Unlearning (ICML 2025 · similarity 0.86)
- Game-Theoretic Unlearnable Example Generator (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.