Research map / Adversarial robustness and security / Certified and empirical robustness
Detecting and Corrupting Convolution-based Unlearnable Examples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes EPD, an edge-pixel SVM detector for convolution-based unlearnable examples, and COIN, a random bilinear-interpolation transformation that corrupts them, plus two new convolution-based UEs (VUDA, HUDA).
Problem
Existing defenses fail against convolution-based unlearnable examples (UEs), which apply class-wise multiplicative convolutional noise without norm constraints; there is no detection or defense tailored to them.
Approach
Detect convolution-based UEs via summed RGB values along image edges (lower edge values, biased toward black), then disrupt class-wise multiplicative noise by left-multiplying with a random matrix implemented as random bilinear interpolation, increasing intra-class matrix inconsistency and inter-class matrix consistency.
Key results
- COIN reaches 72.41% average test accuracy on CIFAR-10 against CUDA versus 47.04% for the best prior defense (AT), per the CUDA table.
- EPD achieves 89.21% average ACC and 0.891 AUC on CIFAR-10 detection settings and 99.91% ACC on ImageNet20.
- The paper claims COIN outperforms 11 SOTA defenses by 19.17%-44.63% on CIFAR-10 and CIFAR-100 against CUDA.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply COIN instead of AT | CUDA defense on CIFAR-10 · CIFAR-10, CUDA | test accuracy (%): 47.04 -> 72.41 | Helped |
| Apply COIN instead of AT | CUDA defense on CIFAR-100 · CIFAR-100, CUDA | test accuracy (%): 33.85 -> 47.41 | Helped |
| Apply COIN instead of AT | CUDA defense on ImageNet100 · ImageNet100, CUDA | test accuracy (%): 36.60 -> 37.48 | Helped |
| Apply COIN instead of AT | CUDA defense on ImageNet20 · ImageNet20, CUDA | test accuracy (%): 52.5 -> 60.9 | Helped |
| Apply COIN instead of ISS-J | VUDA defense on CIFAR-10 · CIFAR-10, VUDA | test accuracy (%): 45.15 -> 72.44 | Helped |
| Apply COIN instead of OP | HUDA defense on CIFAR-10 · CIFAR-10, HUDA | test accuracy (%): 49.21 -> 73.05 | Helped |
| Increase COIN's random offset range α (ablation) | COIN against CUDA · CUDA | test accuracy: null | Mixed |
| Set the EPD SVM penalty parameter Cp to 0.1 (ablation) | EPD · CIFAR-10 detection settings S1-S4 | average detection performance: null | Helped |
Surprising findings
- Existing defenses such as AT and AA show large accuracy variation across model architectures and datasets, with AA dropping to 1.00% on VGG16 for CIFAR-100 against CUDA.
Limitations
- COIN is not effective against all types of unlearnable examples, as the authors acknowledge.
- EPD relies on edge-pixel statistics that may not generalize to UEs without dark edges.
- Results on the new VUDA and HUDA attacks are only reported on CIFAR-10.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet20 ImageNet100 CUDA VUDA HUDA OPS AR URP UHP LSP
Benchmarks: CIFAR-10 CIFAR-100 ImageNet20 ImageNet100
Metrics: test accuracy ACC AUC
Baselines: Cutout Mixup Cutmix DP-SGD AT AA AVATAR OP ISS-G ISS-J ECLIPSE
Builds on: CUDA Gaussian mixture model analysis of unlearnable examples adversarial training JPEG compression defense
Closest papers by meaning
- A3: Few-shot Prompt Learning of Unlearnable Examples with Cross-Modal Adversarial Feature Alignment (CVPR 2025 · similarity 0.86)
- Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noise (AAAI 2024 · similarity 0.86)
- Purify Unlearnable Examples via Rate-Constrained Variational Autoencoders (ICML 2024 · similarity 0.86)
- UnSeg: One Universal Unlearnable Example Generator is Enough against All Image Segmentation (NeurIPS 2024 · similarity 0.85)
- How Far Are We from True Unlearnability? (ICLR 2025 · similarity 0.85)
- Detection and Defense of Unlearnable Examples (AAAI 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.