Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The paper presents a method to generate unlearnable examples (ULE), using which if one trains a neural network, that network will not perform well (sometimes random performance) on an unclean test. The authors show that even changing just a small pixel value, given that that change is done consistently at the same location in all the images of the same class, can lead to surprisingly effective unlearnable examples. The application of such unlearnable examples is shown in many image classification settings (e.g., CIFAR-10) and superior performance over the existing paradigm of creating ULEs is shown.

strength_and_weaknesses: The method is well motivated, very simple, and most importantly, surprisingly effective at creating unlearnable examples.

The results are not simply empirical, but the authors also analyze what goes on with the created ULEs. For example, the authors visualize what happens to the feature computed through ULEs and show that with just one pixel change, all the intermediate features change their properties. This result will be surprising to the community. That being said, it also needs to be studied a bit more. In other words, in what way have the community understood the convolutional layers incorrectly which led to us assuming something like this (Fig. 1) happens. 

The phenomenon discovered by the authors seems to generalize well enough; in that it not only affects the traditional convolutional architectures (e.g. ResNet) but also to transformer based architectures (ViT). This corroborates the fact that this result is indeed not an exploitation of a specific weakness, but is a bug (or feature) of neural networks in general.

Comments/Questions

“Images belonging to the same category are perturbed at the same position”. If I understand correctly, if you have two images of dogs, both will be perturbed at the same location with the same perturbation. How are these two properties related? In other words, what happens if you enforce one of the constraints (need for the perturbation to be in the same location) but not the other, and vice versa. This property should be studied better.

Mathematical notations are confusing sometimes. For example, in Eq. 1, it is not clear what c (in D_c, k) and i, j (in sigma_k(i, j)) mean. 

Is there any trend in the discovered location for perturbation? In other words, is it the case that for certain classes, the perturbed locations turn out to be in center whereas for some other they are on the edge?

clarity,_quality,_novelty_and_reproducibility: Apart from a few issues surrounding some mathematical notations (please see the comments section), the paper is well written with motivations explained clearly. 

To the best of my knowledge, the idea about the ability of perturbing one pixel to drastically change the behavior of a network is novel, and has been shown to be generalizable enough.
summary_of_the_review: The findings of the paper are surprising. The community of machine learning for privacy will definitely find the work useful. The method introduced is simple and effective for an important task. The authors have shown the generalization ability of the method through multiple lens (different tasks, different network architectures). I hence recommend acceptance.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The paper proposes a one-pixel shortcut (OPS) method to generate unlearnable examples that would render a trained model perform not better than a random network on test examples. This performs better than the existing unlearning example generation method by error minimization (EM) at different settings. EM and OPS are combined to create a dataset named CIFAR-10-S, which injects shortcuts in the dataset to evaluate different models' resistance to them.
strength_and_weaknesses: Strengths:
- The paper provides a new perspective on learning a per-class noise that minimizes test accuracy while achieving good training accuracy. Shortcuts like these are easy to pick up by a network, especially if they are consistent across images in the same class.
- Evaluation is very thorough, with different architectures showing that the method is not dependent or sensitive to architecture choices, augmentations, or training strategies. 

Weaknesses:
- The method is rather complex in the sense that since neural networks are good at picking up shortcuts, it should be possible to perturb *any* pixel with *any* color consistently across all images in the same class - as long as the values of $\sigma_k, \xi_k$ are different for different k. This should be an initial baseline to compare against OPS which is obtained by minimizing Eqn (2). 
- One major downside of using OPS is that regardless of the claims about the perceptibility of the augmented images, it is extremely easy for a human (the reviewer in this case) to see exactly which pixel is perturbed. Unlike the EM method which has the capability to learn a per-image noise, the OPS method performs a class-wise perturbation. This is problematic for few reasons. First, the easy perceptibility of the augmented pixel can lead to manual solutions to fix this problem (one way to combat OPS - if done across the dataset, is to just find the pixel such that the standard deviation of the pixel is 0 across the images of that class - and replace it with a mean of neighboring pixels, etc.) - and finding an analogous way to "undo the noise" in EM is not easy. Secondly, if part of the information is perturbed, visual inspection is enough to discard the perturbed data and then learn a network, but in EM, this is not possible.

There are no comments about the "generalization capability" of this noise location and color. How robust is this in settings where more data is gradually added to the dataset (like continual learning, etc.)? The OPS shortcut is learned on the entire dataset, which is not what is done from a practical standpoint (an end user would want to add their own noise before uploading a picture to the internet). This issue need not be solved in the paper, but should be addressed.

Moreover, it would be interesting to see how a method like Noise2Void [1] can be modified to use as an adversarial method to combat OPS - which performs selective masking on the image.

[1] https://arxiv.org/pdf/1811.10980.pdf

clarity,_quality,_novelty_and_reproducibility: Paper is generally very clear, and I had no issues understanding the paper. One thing I didn't find very useful is Fig4. and its relevance in the overall theme of the paper. Method is proposed on publicly available datasets, and pseudocode/algorithm (Alg.1) is very clear too. 
summary_of_the_review: The one-Pixel shortcut method provides a new way of generating unlearnable examples. The paper is well-motivated and well-explained. The experiments are satisfactory. Although I would still argue that from a practical standpoint, EM unlearnable examples generation is more usable, since its not easily detectable upon an initial inspection. From a practitioner's standpoint, seeing that training losses are reaching 0, while the model gets poor test error, they would inspect the dataset first. OPS-based augmentations are easier to detect and remedy, once detected. 

However, I like the idea and think that this paper can lead the way for mitigating some of the shortcomings of the method.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper aims at preventing data from being used (without authorization) for training DNNs. They propose the One-Pixel Shortcut (OPS) method where all the images of a same class get the same pixel location replaced with a same color pixel. This method fools the network during training as the network will use this replaced color pixel shared within the class as a shortcut during training to learn the class instead of using actual discriminative features. The authors evaluate this method on CIFAR-10 on several architectures from ResNet to Vision Transformers.
strength_and_weaknesses: Strengths:
1) The authors evaluate their method on several architectures.
2) The authors evaluate various training strategies as defenses against their proposed attack. They investigate data augmentations and adversarial training.

Weaknesses:
1) Subsection 3.1 is unclear and could be re-worked. Table 1 is not clear and could be better explained: the metric could be stated more clearly.
2)  In Table 5, CutOut and RandAugment seem individually quite effective against the one pixel shortcut method. This table is missing the combination of CutOut and RandAugment. It seems that such a combination could strongly affect the proposed one pixel shortcut method (as the individual components are already effective). Furthermore, modern architectures such as ViT use considerable amount of data augmentations so it makes sense to study combination of augmentations.
3) As easy missing training strategy in this study as mean of defense against the proposed one pixel shortcut, I would like to point to median filters and gaussian blurring.
4) Using l-inf perturbations for adversarial training seems unfair as by construction such perturbations will not be able to compensate the pixel replacement of the proposed OPS method. Using l2 perturbations with medium-strong perturbation radiuses seems much more appropriate and interesting in this setting. Especially as adversarial training with l-inf perturbations already lowers the clean test accuracy due to the robustness/accuracy tradeoff observed with adversarial training. 
clarity,_quality,_novelty_and_reproducibility: The paper is novel, clear and easy to read except for section 3.1. The paper gives implementation details and code so the paper can be reproduced.
summary_of_the_review: The paper is interesting, easy to read and proposes an easy strategy to prevent the unauthorized use of images for training. My concern is that modern architectures such as ViT use considerable amount of data augmentations whereas here data augmentations are studied separately and even individually they seem to reduce the impact of the proposed method. Furthermore, the authors only study l-inf adversarial perturbations which by construction will fail against the proposed method. Studying l2 perturbations should be more relevant.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper presents a novel method to generate so called unlearnable examples (ULE), examples a  network is expected to perform poorly on, even when only lightly but consistently changing the image values.  
The proposed method is well motivated, very simple. It is also very effective.

While yielding overall a convincing performance in the reported experiments, a remaining concern is that modern architectures such as ViT use considerable amount of data augmentations. In this paper,  data augmentations are studied separately.

Overall, the paper received strong reviews, ranging fro 6 to 8.

justification_for_why_not_higher_score: The proposed approach is interesting, yet rather simple. The presented evaluation could also be stronger with respect to data augmentations.
justification_for_why_not_lower_score: The proposed approach to generate unlearnable examples is interesting and simple and allows some interesting insights. The paper should be accepted for presentation at ICLR.
Decision: Accept: notable-top-25%