Research map / Adversarial robustness and security / Attacks on text and graphs
Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Stable Error-Minimizing noise (SEM), which trains unlearnable-example defensive noise against random perturbations instead of PGD adversarial perturbations, yielding stronger and faster robust unlearnable examples.
Problem
Unlearnable examples lose protection under adversarial training, and the best existing robust method (REM) is computationally expensive (about a day on CIFAR-10) and its defensive noise is unstable.
Approach
Analysis shows the robustness of the surrogate model, not of the defensive noise, drives protection, and adversarially enhancing the noise hurts it. SEM therefore replaces the adversarial perturbation in defensive-noise optimization with uniform random noise matched to the adversarial radius, cutting cost roughly 4x while improving protection.
Key results
- On CIFAR-10 with adversarial training radius 4/255, SEM reduces test accuracy to 31.92% versus 48.16% for REM, while generation time drops from 22.6h to 5.78h (3.91x speedup).
- SEM achieves the lowest test accuracy in most adversarial-training settings across CIFAR-10, CIFAR-100 and ImageNet Subset, e.g. 37.82% vs 41.66% for REM on ImageNet Subset at 4/255.
- Robustness of the surrogate model correlates positively with protection performance (Pearson 0.9551), while defensive-noise robustness correlates negatively (Pearson -0.5851).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use stable error-minimizing noise instead of REM | unlearnable examples · CIFAR-10, adversarial training ρa=4/255 | test accuracy (%): 48.16 -> 31.92 | Helped |
| Use stable error-minimizing noise instead of REM | unlearnable examples · CIFAR-100, adversarial training ρa=4/255 | test accuracy (%): 27.10 -> 20.25 | Helped |
| Use stable error-minimizing noise instead of REM | unlearnable examples · ImageNet Subset, adversarial training ρa=4/255 | test accuracy (%): 41.66 -> 37.82 | Helped |
| Use SEM noise generation instead of REM | defensive-noise generation · CIFAR-10/100 | generation time: 22.6h -> 5.78h; 3.91 | Helped |
| Use SEM noise generation instead of REM | defensive-noise generation · ImageNet Subset | generation time: 5.2h -> 1.33h; 3.90 | Helped |
| Add random perturbation to the defensive-noise update (ablation) | SEM · CIFAR-10, adversarial training ρa=4/255 | test accuracy (%): 37.91 -> 30.03 | Helped |
| Use random rather than adversarial perturbation in the defensive-noise update (ablation) | SEM · CIFAR-10, adversarial training ρa=4/255 | test accuracy (%): 46.72 -> 30.03 | Helped |
| Add adversarial perturbation to the noise-generator update (ablation) | SEM · CIFAR-10, adversarial training ρa=4/255 | test accuracy (%): 89.22 -> 30.03 | Helped |
| Add perturbations to the noise-generator and defensive-noise updates (ablation) | SEM · CIFAR-10, adversarial training ρa=4/255 | test accuracy (%): 89.15 -> 30.03 | Helped |
| Set the random-perturbation radius equal to the adversarial-training radius (ablation) | SEM · CIFAR-10, adversarial training ρa=4/255 | test accuracy (%): 67.52 -> 31.92 | Helped |
| Increase noise-generator training steps (ablation) | SEM · CIFAR-10 and CIFAR-100 | test accuracy (%) | Helped |
| Increase the sampling size J for gradient approximation (ablation) | SEM · CIFAR-10 and CIFAR-100 | test accuracy (%): nearly 8% | Helped |
Surprising findings
- Removing adversarial perturbation from defensive-noise optimization (using purely adversarial noise for the noise) degrades protection; adversarially enhancing the defensive noise hurts protection performance.
- Using only the surrogate model's adversarial training (REM-theta, no adversarial noise update) achieves 37.90% accuracy, close to full REM's 46.72%, suggesting the surrogate model's robustness is the main driver.
Limitations
- Protection is weak when only a small fraction of the data is poisoned (partial poisoning with clean data mixed in), where existing noise types fail to degrade performance significantly.
- Effectiveness depends on knowing the adversarial training radius, since the random perturbation radius works best when matched to it.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet Subset Facescrub
Benchmarks: CIFAR-10 CIFAR-100 ImageNet Subset Facescrub
Metrics: test accuracy under adversarial training noise generation time Pearson/Spearman/Kendall correlation
Baselines: EM TAP NTGA SC REM
Builds on: error-minimizing noise robust error-minimizing noise expectation over transformation projected gradient descent adversarial training
Closest papers by meaning
- Robust Unlearnable Examples: Protecting Data Privacy Against Adversarial Learning (ICLR 2022 · similarity 0.94)
- Detection and Defense of Unlearnable Examples (AAAI 2024 · similarity 0.89)
- Re-thinking Data Availability Attacks Against Deep Neural Networks (CVPR 2024 · similarity 0.89)
- Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models (NeurIPS 2024 · similarity 0.88)
- Purify Unlearnable Examples via Rate-Constrained Variational Autoencoders (ICML 2024 · similarity 0.88)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.