Research map / Adversarial robustness and security / Attacks on text and graphs
Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneously
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AUE and AAP, supervised error-minimization and error-maximization availability attacks whose data augmentations are made contrastive-like, so the poisons defeat both supervised and contrastive learning at lower computation cost.
Problem
Availability attacks that poison supervised learning often fail against contrastive learning, while existing contrastive-poisoning attacks are costly to generate; a data collector can switch between SL and CL to bypass protection.
Approach
Use contrastive-like strong data augmentations (resized crop, color jitter, grayscale) inside supervised error-minimization (AUE) and error-maximization (AAP) poison generation, so supervised losses implicitly optimize the contrastive loss while keeping cheap SL-based generation.
Key results
- On CIFAR-10, AUE reduces worst-case accuracy to 58.6% and UT-AAP reaches 35.5% worst-case, vs. CP-SimCLR's 94.5% worst case due to failure on SL.
- On ImageNet-100, AUE reduces worst-case unlearnability to 7.5% (BYOL).
- Poison generation is at least 3x, 6x and 17x faster than TUE, CP and TP on CIFAR-10/100 (AUE 2.7 h, AAP 2.2 h vs CP-SimCLR 48 h).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use contrastive-like strong augmentations instead of mild augmentations during supervised error minimization | AUE · CIFAR-10, SimCLR | accuracy drop (%): -2.3 -> -38.9 | Helped |
| Use contrastive-like strong augmentations instead of mild augmentations during targeted adversarial poisoning | T-AAP vs T-AP · CIFAR-10, SimCLR | accuracy drop (%): -42.9 -> -52.2 | Helped |
| Use contrastive-like strong augmentations instead of mild augmentations during targeted adversarial poisoning | T-AAP vs T-AP · CIFAR-100, SimCLR | accuracy drop (%): -38.3 -> -43.8 | Helped |
| Increase the augmentation strength in AUE generation (ablation) | AUE · CIFAR-10, SimCLR | accuracy (%): 83.5 -> 64.1 -> 56.7 -> 52.4 | Helped |
| Use all three augmentation strengths together rather than grayscale alone (ablation) | AUE · CIFAR-10, SimCLR | accuracy (%): 58.7 -> 52.4 | Helped |
| Use grayscale augmentation strength alone rather than ResizedCrop strength alone (ablation) | AUE · CIFAR-10, SimCLR | accuracy (%): 88.7 -> 58.7 | Helped |
| Use all three augmentation strengths together rather than ResizedCrop strength alone (ablation) | T-AAP · CIFAR-10, SimCLR | accuracy (%): 44.9 -> 39.1 | Helped |
| Use contrastive-like strong augmentations during supervised poison generation | AUE vs UE · CIFAR-10, SimCLR | accuracy (%): 89.0 -> 52.4 | Helped |
| Use AUE instead of T-AP for poisoning high-resolution images | AUE · Tiny-ImageNet, BYOL | accuracy (%): 27.2 -> 9.6 | Helped |
| Use AUE instead of T-AP for poisoning high-resolution images | AUE · Mini-ImageNet, SL | accuracy (%): 11.5 -> 8.7 | Helped |
| Use AUE instead of T-AAP for poisoning high-resolution images | AUE · ImageNet-100, BYOL | accuracy (%): 24.8 -> 7.5 | Helped |
| Use AUE rather than CP-SimCLR for poison generation | AUE · CIFAR-10/100 | poison generation time: 48 hrs -> 2.7 hrs | Helped |
Surprising findings
- Simply increasing augmentation strength in supervised error minimization makes UE effective against SimCLR (accuracy drop from 83.5 to 52.4 on CIFAR-10 with AUE).
- Clean linear probing mitigates SL-based attacks (AP, SEP, AAP, AUE) while contrastive attacks remain effective.
Limitations
- Attacks are sensitive to poisoning ratio; effectiveness drops at 80-95% poisoned data.
- Strength hyperparameters are selected per dataset and per attack; too strong augmentation can harm unlearnability on CIFAR-10.
- Some defenses (e.g., AVATAR, UEraser-Max) recover accuracy above 80%.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 Tiny-ImageNet Mini-ImageNet ImageNet-100
Benchmarks: CIFAR-10 CIFAR-100 Tiny-ImageNet Mini-ImageNet ImageNet-100
Metrics: test accuracy under worst-case unlearnability SL accuracy SimCLR/MoCo/BYOL/SimSiam linear probing accuracy alignment gap uniformity gap generation time
Baselines: UE AP SEP-FA-VR CP TUE TP DC AR NTGA REM
Builds on: unlearnable examples adversarial poisoning contrastive error minimization transferable poisoning SimCLR
Closest papers by meaning
- BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection (NeurIPS 2025 · similarity 0.85)
- Re-thinking Data Availability Attacks Against Deep Neural Networks (CVPR 2024 · similarity 0.85)
- Data Poisoning based Backdoor Attacks to Contrastive Learning (CVPR 2024 · similarity 0.85)
- Ungeneralizable Examples (CVPR 2024 · similarity 0.83)
- Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable (NeurIPS 2024 · similarity 0.83)
- Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks (AAAI 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.