SlowGuess/NeurIPS_2023_OCR huggingface dataset:
To evaluate recovered data from Orthogonal Projection, we consider an additional architecture: ViT. In Table 7, we train ViT with patch size of 4 on CIFAR-10 unlearnable datasets using different attacks. Our Orthogonal Projection method is competitive with adversarial training for all class-wise perturbed unlearnable datasets and most sample-wise perturbed datasets. Orthogonal Projection is the best performing method for  $OPS + EM$  and  $OPS$  (ICLR 2023). Note that  $OPS + EM$  and  $OPS$  are most difficult for adversarial training.
Table 6: NTGA contains the least linearly separable images, while  $\mathbf{AR}(\ell_2)$  images are most comparable to the clean distribution. Other unlearnable datasets become more linearly separable. We train a linear logistic regression model on poison images and report train accuracy. High train accuracy indicates linear separability of poison images. Mean and one standard deviation computed from 10 independent runs.
TRAINING DATA	TRAIN ACCURACY
CLEAN	53.94 ± 0.02
UNLEARNABLE EXAMPLES [10]	100.00 ± 0.00
ADVERSARIAL POISONING [7]	62.40 ± 0.01
AR (l2) [27]	53.97 ± 0.02
NTGA [37]	31.48 ± 0.02
ROBUST UNLEARNABLE [28]	77.21 ± 0.01
LSP [36]	100.00 ± 0.00
OPS+EM [35]	100.00 ± 0.00
○OPS [35]	100.00 ± 0.00
○UNLEARNABLE EXAMPLES [10]	100.00 ± 0.00
○REGIONS-4 [26]	100.00 ± 0.00
○RANDOM NOISE	100.00 ± 0.00
Table 7: Orthogonal Projection can make class-wise unlearnable data learnable for ViT. Especially for unlearnable datasets with class-wise, linearly separable perturbations, our Orthogonal Projection attack is competitive with  $\ell_{\infty}$  Adversarial Training at a fraction of the computational cost.
CIFAR-10 TRAINING DATA	ATTACK
NONE	ADV TRAINING	ORTHO PROJ (OURS)
CLEAN	84.99	76.38	74.14
UNLEARNABLE EXAMPLES [10]	25.39	75.44	60.15
ADVERSARIAL POISONING [7]	31.33	75.15	41.49
AR (l2) [27]	17.13	75.12	35.11
NTGA [37]	32.67	71.95	66.19
ROBUST UNLEARNABLE [28]	28.24	78.03	37.34
LSP [36]	29.40	75.45	74.77
OPS+EM [35]	20.73	11.79	51.94
○OPS [35]	21.58	10.17	72.80
○UNLEARNABLE EXAMPLES [10]	12.19	76.35	76.01
○REGIONS-4 [26]	15.00	75.96	67.20
○RANDOM NOISE	29.66	76.23	73.05
A.4.2 CIFAR-100 Dataset for Section 4.4
We consider an additional dataset, CIFAR-100, to evaluate Orthogonal Projection. We train a RN-18 on four unlearnable dataset methods. During the first step of Orthogonal Projection, we train the logistic regression model for 60 epochs using SGD with an initial learning rate of 0.1, which decays by a factor of 10 on epochs 30 and 45.
Table 8: Orthogonal Projection is competitive on CIFAR-100 class-wise unlearnable data.
CIFAR-100 TRAINING DATA	ATTACK
ADV TRAINING	ORTHO PROJ (OURS)
CLEAN	74.14	59.23	26.78
UNLEARNABLE EXAMPLES [10]	8.11	58.29	28.44
ADVERSARIAL POISONING [7]	5.93	57.60	25.24
○ UNLEARNABLE EXAMPLES [10]	1.72	60.31	41.83
○ RANDOM NOISE	1.30	58.83	51.23
In Table 8, we find that Orthogonal Projection performs better on class-wise unlearnable data than sample-wise perturbed data, as expected. At approximately the cost of standard training (Attack: None), Orthogonal Projection achieves gains of more than  $20\%$  test accuracy for sample-wise perturbed data and more than  $40\%$  test accuracy for class-wise perturbed data.
A.4.3 Additional Intuition for Orthogonal Projection
Assume CIFAR-10 images of shape  $(3, 32, 32)$ . Each column  $i$  of  $W$  (optimized in Alg 1, Lines 1-4) is a 3072-dimensional vector that represents the most predictive image feature for class  $i$ . This step serves as recovery of the perturbation. After the QR decomposition of  $W$ ,  $Q$  consists of orthonormal columns that form a basis for the column space of  $W$ . When we say Orthogonal Projection "ensures that the dot product of a row of  $X$  with every column of  $Q$  is zero," (i.e.,  $X_r \cdot Q = 0$ ) this means that every recovered image vector does not contain any linearly separable component (i.e., does not contain any column of  $Q$  as a component). Alg. 1, Line 6 ensures image vectors and columns of  $Q$  are orthogonal and so the dot product is 0. The "recovered" data thus has 10 dimensions (approximations of the 10 perturbations) removed.
A.4.4 Subtracting a Class-wise Image
Given that the goal of Orthogonal Projection is to extract perturbations from poison images, it is reasonable to consider visualizing the average image of a class for class-wise poisons like  $LSP$  and  $OPS$ . In Figure 5, we see that class-wise average images somewhat reveal class-wise perturbations, but the results are not clear enough to be useful. In contrast, class-wise patterns and clearly present in learned weights from logistic regression.
Figure 5: Average class images display class-wise perturbations, but not as clearly as learned weights from logistic regression. We compare the average image of a class (Left) and learned weights of a logistic regression classifier (Right) trained on image pixels (the first step of Orthogonal Projection method) to for  $LSP$  and  $OPS$  Poisons. While average image of a class does reveal the class-wise perturbation (block pattern for  $LSP$  and one highlighted pixel for  $OPS$ ), the result is blurry and contains other semantic image features. Learned weights from Orthogonal Projection properly isolate the perturbation.
For training models on class-wise perturbed data, one might consider subtracting the class-wise average image from each class. However, simply subtracting this average class image from each image does not remove the poisoning effect. Additionally, because we do not know the true class at inference time, we cannot subtract the class image, resulting in a distribution mismatch between train and test sets. This trivial method of subtracting average class images is compared to Orthogonal Projection in Table 9.
A.4.5 Visualizing Additional Logistic Regression Weights
We visualize additional linear model weights (from the first step of Orthogonal Projection) for sample-wise perturbed unlearnable datasets in Figure 6, and for class-wise perturbed unlearnable datasets in Figure 7. We find that for Adversarial Poisoning,  $AR$ , and Robust Unlearnable the linear model learns features comparable to when trained on clean data. We posit that because the diversity of perturbations in these datasets is higher, the linear model struggles to find predictive features to project away. In contrast, for class-wise perturbed data, Figure 7, demonstrates that the linear model can recover features that resemble the original class-wise perturbation.
Table 9: Subtracting the average class image from training images is not effective. For  $LSP$  and  $OPS$ , datasets with class-wise perturbations, our Orthogonal Projection attack improves CIFAR-10 test accuracy over simply subtracting the average class image at training time.
TRAINING DATA	ATTACK
CLASS-AVG SUBTRACT	ORTHO PROJ (OURS)
LSP [36]	13.05	87.99
○OPS [35]	12.62	87.94
Figure 6: Learned Weights from first step of Orthogonal Projection on sample-wise perturbed CIFAR-10 unlearnable datasets. We visualize learned weights (W in Algorithm 1) after training a linear model on unlearnable datasets. Learned weights from Adversarial Poisoning, AR, and Robust Unlearnable resemble the learned weights from clean data (See Figure 3). In our Orthogonal Projection attack, we project each perturbed image to be orthogonal to each of these learned weights (Algorithm 1, Line 6).
A.5 Samples from Unlearnable Datasets
We visualize samples from sample-wise perturbed CIFAR-10 unlearnable datasets in Figure 8, and from class-wise perturbed unlearnable datasets (prefix by  $\circ$  throughout results) in Figure 9. NTGA is omitted due to data ordering of the publicly available poison. We also visualize SVHN samples in Figure 10 and CIFAR-100 in Figure 11.
A.6 Broader Impact Statement
Our findings test prevailing hypothesis about unlearnable datasets and our results have practical implications for their use. Two of our three main conclusions relate to privacy vulnerabilities when employing unlearnable datasets for data protection. In one experiment, we demonstrate useful features can be learned from unlearnable data. In another, we demonstrate how one can effectively remove a class-wise perturbation. Our findings highlight the need for extra caution when it comes to using unlearnable datasets. By making this information available to the public, the capabilities and vulnerabilities of unlearnable datasets can be better understood.
Figure 7: Learned Weights from first step of Orthogonal Projection on class-wise perturbed CIFAR-10 unlearnable datasets. We visualize learned weights (W in Algorithm 1) after training a linear model on unlearnable datasets. Learned weights appear to recover the added class-wise perturbation for all datasets. In our Orthogonal Projection attack, we project each perturbed image to be orthogonal to each of these learned weights (Algorithm 1, Line 6).
Figure 8: Samples from CIFAR-10 unlearnable datasets. We visualize the first 10 images from each sample-wise perturbed unlearnable dataset.
Figure 9: Samples from CIFAR-10 unlearnable datasets. We visualize the first 10 images from each class-wise perturbed unlearnable dataset.
Figure 10: Samples from SVHN unlearnable datasets.
Figure 11: Samples from CIFAR-100 unlearnable datasets.