Research map / Adversarial robustness and security / Attacks on text and graphs
Game-Theoretic Unlearnable Example Generator
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Formulates unlearnable example attacks as a nonzero-sum Stackelberg game, proves equilibrium existence, and proposes GUE, an autoencoder-style poison generator trained with BOME and dynamic barrier gradient descent that generalizes to unseen data.
Problem
Unlearnable example attacks are formulated as bi-level optimization that is intractable for deep networks; existing per-sample methods must regenerate poisons for every new data batch and are vulnerable to dilution and adversarial training.
Approach
Model the attacker (leader) and victim (follower) as a nonzero-sum Stackelberg game, prove equilibrium existence in standard and adversarial settings, use a bounded surrogate loss, and solve it with a first-order bi-level method (BOME plus dynamic barrier gradient descent) to train an encoder-decoder poison generator that generalizes to unseen data.
Key results
- GUE reduces ResNet-18 clean test accuracy on CIFAR-10 to 13.25% and CIFAR-100 to 8.35%, second only to EM on CIFAR-10 (10.16%) and CIFAR-100 (1.90%).
- With the generator trained on only 60% of CIFAR-10 training data, GUE still degrades test accuracy to about 20%.
- Under adversarial training with epsilon_d=2/255, GUE-AT(8-2) yields 22.27% vs REM's 29.75%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GUE instead of DeepConfuse, ShortcutGen, or TAP | ResNet-18 trained on poisoned data · CIFAR-10 | test accuracy: 22.74 -> 13.25; 24.42 -> 13.25; 20.28 -> 13.25 | Helped |
| Use GUE instead of EM | ResNet-18 trained on poisoned data · CIFAR-10 | test accuracy: 10.16 -> 13.25 | Hurt |
| Use GUE instead of DeepConfuse or TAP | ResNet-18 trained on poisoned data · CIFAR-100 | test accuracy: 25.73 -> 8.35; 15.40 -> 8.35 | Helped |
| Use GUE instead of EM | ResNet-18 trained on poisoned data · CIFAR-100 | test accuracy: 1.90 -> 8.35 | Hurt |
| Train the GUE generator using only 60% of the training data and apply it across the full dataset | GUE generator · CIFAR-10 | test accuracy: about 20% | Helped |
| Apply adversarial training at εd = 2/255 to GUE-poisoned data | GUE · CIFAR-10 | clean test accuracy: 13.25 -> 22.55 | Hurt |
| Increase adversarial-training radius to εd = 4/255 on GUE-poisoned data | GUE · CIFAR-10 | clean test accuracy: 13.25 -> 76.96 | Hurt |
| Use GUE-AT(8-2) instead of REM(8-2) | ResNet-18 adversarial training · CIFAR-10, εd = 2/255 | test accuracy: 29.75 -> 22.27 | Helped |
| Use GUE-AT(8-4) instead of REM(8-4) | ResNet-18 adversarial training · CIFAR-10, εd = 4/255 | test accuracy: 44.91 -> 52.79 | Hurt |
| Replace the surrogate attacker loss with cross-entropy loss (ablation) | GUE equilibrium computation · Training | poisoned loss convergence | Hurt |
| Replace the surrogate attacker loss with cross-entropy and gradient clipping (ablation) | GUE equilibrium computation · Training | poisoned loss convergence | Hurt |
| Use the bounded surrogate attacker loss instead of cross-entropy loss, with or without gradient clipping (ablation) | GUE equilibrium computation · Training | poisoned loss convergence | Helped |
Surprising findings
- Cross-entropy-based payoff gives exploding attacker gradients (about two orders of magnitude larger) and non-converging victim loss, motivating the bounded surrogate loss.
- GUE is not better than EM on standard training in the reported table, and under adversarial training with epsilon_d=4/255 it reaches 60.11% accuracy, so it fails against larger adversarial radii.
Limitations
- Algorithm does not converge well at larger adversarial radii, so it is ineffective against aggressive adversarial training budgets (4/255 yields 60.11%).
- Standard-training results are not uniformly best; EM outperforms GUE on CIFAR-10 and CIFAR-100.
- Convergence guarantees are for the game equilibrium existence only; the first-order algorithm lacks convergence proof in practice.
Experimental setup
Datasets: CIFAR-10 CIFAR-100
Benchmarks: CIFAR-10 CIFAR-100
Metrics: clean test accuracy
Baselines: EM TAP DeepConfuse ShortcutGen REM INF
Builds on: BOME dynamic barrier gradient descent TRADES DeepConfuse Error-minimizing noise
Closest papers by meaning
- Adversarial Machine Unlearning (ICLR 2025 · similarity 0.86)
- Detection and Defense of Unlearnable Examples (AAAI 2024 · similarity 0.85)
- Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise (AAAI 2024 · similarity 0.85)
- Machine Unlearning Fails to Remove Data Poisoning Attacks (ICLR 2025 · similarity 0.85)
- Flexible, Efficient, and Stable Adversarial Attacks on Machine Unlearning (ICML 2025 · similarity 0.84)
- Re-thinking Data Availability Attacks Against Deep Neural Networks (CVPR 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.