Research map / Adversarial robustness and security / Black-box and transfer attacks
BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that a small set of leaked (unprotected, protected) pairs from black-box protection APIs lets an adversary train a diffusion bridge model (BridgePure) that largely removes availability protections for classification and style mimicry.
Problem
Black-box data protection tools (unlearnable examples, style mimicry cloaks) can be undone if an adversary obtains a small set of unprotected in-distribution images and queries the protection API to form (unprotected, protected) pairs, a risk the authors call protection leakage.
Approach
Train a denoising diffusion bridge model from scratch on a few hundred to few thousand leaked pairs so it learns the inverse of the protection mapping, conditioned on the protected endpoint, and use it to purify protected data with conditional sampling.
Key results
- On CIFAR-10 against nine attacks, BridgePure-4K restores accuracy to roughly 92.9-93.9% versus 94.01% for the unprotected data, while the protected data falls to 9.5-23.8%.
- On CIFAR-100, BridgePure-4K reaches 70.96-74.56% across attacks versus a 74.27% unprotected baseline, outperforming AVATAR and LE-JCDP.
- On ImageNet-Subset with EM protection, BridgePure-0.5K reaches 65.89% versus 54.87% for DiffPure and a 66.18% unprotected baseline.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train BridgePure using limited paired leakage data and purify protected images | CIFAR-10 availability attacks · CIFAR-10 (nine attacks) | accuracy: 91.9 vs 49.3 | Helped |
| Train BridgePure using limited paired leakage data and purify protected images | CIFAR-100 availability attacks · CIFAR-100 (nine attacks) | accuracy: 70.3 vs 24.0 | Helped |
| Increase leakage pairs from 0.5K to 4K (ablation) | BridgePure · CIFAR-10 and CIFAR-100 | accuracy | Mixed |
| Add Gaussian-noise preprocessing with parameter β (ablation) | BridgePure · CIFAR-10 and CIFAR-100 availability attacks | accuracy | Mixed |
| Increase sampling randomness s (ablation) | BridgePure · CIFAR-10 and CIFAR-100 availability attacks | accuracy | Mixed |
| Use 100 leakage pairs instead of fewer pairs (ablation) | BridgePure · LSP-protected CIFAR-10 | accuracy: 93% | Helped |
| Increase leakage from 100 to 200 pairs (ablation) | BridgePure · LSP-protected CIFAR-100 | accuracy: 50% to 69% | Helped |
| Use BridgePure purification rather than adding unprotected data by dilution | CIFAR-10 and CIFAR-100 classifiers · CIFAR-10 and CIFAR-100 | accuracy: 91.9 vs 49.3; 70.3 vs 24.0 | Helped |
| Train BridgePure using 40K rather than 100,000 steps (ablation) | BridgePure-4K · WebFace-Subset (EM/LSP/TAP) | accuracy: 87.88/87.87/87.61% | No clear effect |
Surprising findings
- Only 500 leaked pairs already surpass DiffPure and most prior purification baselines on several settings.
- Diluting protected data with 4000 unprotected images is far less damaging to protection than 500 leaked pairs.
Limitations
- Transfers poorly across protection mechanisms and across data distributions (e.g., CIFAR-10 to CIFAR-100 accuracy below 60% for all protections).
- Requires that the adversary can query the protection API on in-distribution unprotected data, and results report best-of several hyperparameter settings.
- Training uses paired data and per-protection models, so performance on minor leakage (e.g., 100 pairs on CIFAR-100) is low.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet-Subset WebFace-Subset CASIA-WebFace Cars Pets CelebA artwork of @nulevoy Monet paintings
Benchmarks: CIFAR-10 CIFAR-100 ImageNet-Subset WebFace-Subset Cars Pets SimCLR contrastive evaluation
Metrics: test accuracy PSNR SSIM
Baselines: PGD-AT D-VAE AVATAR LE-JCDP DiffPure GrIDPure PDM NoisyUpscaling
Builds on: denoising diffusion bridge models (DDBM) DiffPure AVATAR LE-JCDP D-VAE
Closest papers by meaning
- Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneously (NeurIPS 2024 · similarity 0.85)
- Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models (NeurIPS 2024 · similarity 0.84)
- Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable (NeurIPS 2024 · similarity 0.84)
- Phantom Transfer: Data Poisoning can Survive Data-Level Defences (NeurIPS 2026 · similarity 0.84)
- Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · similarity 0.83)
- Unlearned but Not Forgotten: Data Extraction after Exact Unlearning in LLM (NeurIPS 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.