Learnability Lock: Authorized Learnability Control Through Adversarial Invertible Transformations
Authors: Weiqi Peng
Jinghui Chen
Venue: ICLR 2022 Poster (2022)

Abstract: Owing much to the revolution of information technology, recent progress of deep learning benefits incredibly from the vastly enhanced access to data available in various digital formats. Yet those publicly accessible information also raises a fundamental issue concerning Intellectual Property, that is, how to precisely control legal or illegal exploitation of a dataset for training commercial models. To tackle this issue, this paper introduces and investigates a new concept called ''learnability lock'' for securing the process of data authorization. In particular, we propose adversarial invertible transformation, that can be viewed as a mapping from image to image, to encrypt data samples so that they become ''unlearnable'' by machine learning models with negligible loss of visual features. Meanwhile, authorized clients can use a specific key to unlock the learnability of the protected dataset and train models normally. The proposed learnability lock leverages class-wise perturbation that applies a universal transformation function on data samples of the same label. This ensures that the learnability can be easily restored with a simple inverse transformation while remaining difficult to be detected or reverse-engineered. We empirically demonstrate the success and practicability of our method on visual classification tasks.  

Published as a conference paper at ICLR 2022
LEARNABILITY LOCK: AUTHORIZED LEARNABIL- ITY CONTROL THROUGH ADVERSARIAL INVERTIBLE TRANSFORMATIONS
Weiqi Peng
Jinghui Chen
Yale University
Pennsylvania State University j2c59170pas edu
weiqi. weiiii.pen@eyale.com edu
ABSTRACT
Owing much to the revolution of information technology, the recent progress of deep learning benefits incredibly from the vastly enhanced access to data avail- able in various digital formats. However, in certain scenarios, people may not want their data being used for training commercial models and thus studied how attack the learnability of deep learning models. Previous works learnability attack only consider the goal of preventing unauthorized exploitation on the spe- cific dataset but not the process of restoring the learnability for authorized cases. To tackle this issue, this paper introduces and investigates a new concept called "learnability lock" for controlling the model's learnability a specific dataset with special key. In particular, we propose adversarial invertible transforma- tion, that can be viewed as mapping from image to image, slightly modify data samples so that they become "unlearnable" by machine learning models with negligible loss of visual features. Meanwhile, one can unlock the learnability of the dataset and train models normally using the corresponding key. The proposed learnability lock leverages class-wise perturbation that applies a universal trans- formation funetion ability can be easily restored with a simple inverse transformation while remain- ing difficult to be detected or wverse-engineered. We empirically demonstrate the success and practicability of our method on visual classification tasks.
data samples of the same label. This ensures that the learn-
INTRODUCTION
Recent progress in deep learning empowers the application of artificial intelligence in various do- mains such as computer vision (He et al. 2016), speech recognition (Hinton et al.) 2012), natural language processing (Devlin et al. 2018) ) and etc. While the massive amounts of publicly available data lead to the successful AI systems in practice, one major concern is that some of them may be illegally exploited without authorization. In fact, many commercial models nowadays trained with unconsciously collected personal data from the Internet, which raises people's awareness on the unauthorized data exploitation for commercial or even illegal purposes.
For people who share their data online (e.g., upload selfie photos to social networks), there is not much they can do to prevent their data from being illegally collected for commercial use (e.g. train- ing commercial machine learning models). To address such concern, recent works propose Learn- ability Attack (Fowl et al.) 2021a Huang et al. 2021) Fowl al., 2021b), which adds invisible per- turbations to the original data make it "unlearnable" such that the model trained on the perturbed dataset has awfully low prediction accuracy. Specifically, these methods generate either sample- wise or class-wise adversarial perturbations to prevent machine learning models from learning meaning- ful information from the data. This task is similar to traditional data poisoning attack, except that there is additional requirement that the perturbation noise should be invisible and hard-to-notice by human eyes. And when the model trained on the perturbed dataset is bad enough, won't 't even be considered realistic inference model by the unauthorized user for any purposes.
However, the previous works on Icarnability attack only consider the goal of making the perturbed dataset "unlearnable" to unauthorized users, while in certain scenarios, also want the authorized

---

Published as a conference paper at ICLR 2022
users to access and retrieve the clean data from the unlearnable counterparts. For example, photog- raphers or artists may want to add unlearnable noise to their work before sharing it online to protect it from being illegally collected to train commercial models. Yet they also want authorized users (e.g., people who paid for the copyrights) to obtain access to their original work. In this regard, the existing methods (Fowl al. 2021a Huang et al. 2021 Fowl al.) 2021b) have the following ma- jor drawbacks: (1) sample-wise perturbation does not allow authorized clients to recover to original data for regular use, i.e., restore the learnability; (2) class-wise perturbation can be easily detected or reverse engineered since it applies the same perturbation for all data in one class; (3) the unlearnable performances are significantly worse for adversarial training based learning algorithms, making the perturbed data, to certain extent, "learnable" again.
To tackle these issues, we introduce the novel concept of Learnability Lock, a learnability control technique to perturb the original data with adversarial invertible transformations. To meet our goal, a DNN model trained on the perturbed dataset should have a reasonably bad performance for various training schedules such that none of the trained models can be effectively deployed for AI system. The perturbation noises should also be both invisible and diverse against visual inspections. In addition, the authorized users should be able use the correct key to retrieve the original data and restore their learnability.
In particular, creatively adopt a class-wist invertible functional perturbation where trans- formation is applied to each class as a mapping from images to images. In this sense, the key for the learnability control process is defined as the parameters of the transformation function. For an authorized user, the inverse transformation function can be easily computed with the given key, and thus retrieving the original clean dataset. We focus our method on class-wise noise rather than sample-wise noise because we want the key, i.e., parameters of the transformation function, to be lightweight and easily transferable. Note that different from traditional additive noises (Fowl al.] 2021a; Huang et al., 2021] Fowl et al. (021b), even the same transformation function would pro- duce different perturbations on varying samples. Therefore, is still difficult for an attacker to reverse-engineer the perturbation patterns as a counter-measure.
We summarize our contributions follows:
We introduce a novel concept I Learnability Lock, that can be applied to the scenario of learn- ability control, where only the authorized clients can access the key in order train their models on the retrieved clean dataset while unauthorized clients cannot learn meaningful information from the released data that appears normal visually.
We creatively apply invertible functional perturbation for crafting unlearnable examples, and propose two efficient functional perturbation algorithms. The functional perturbation is more suited to crafting class-wise noises while allowing different noise patterns across samples to avoid being detected or reverse engineered.
We empirically demonstrate that our pipeline works on common image datasets and is more robust to defensive techniques such as adversarial training than prior additive perturbation methods (Fowl et al. 2021a Huang et 2021 Fowl al. 2021b).
2 RELATED WORK
Adversarial Attack One closely related topic is adversarial attack (Goodfellow et al. 2015 Paper-
not et al. 2017). Earlier studies have shown that deep neural networks can be deceived by small
adversarially designed perturbations (Szegedy et al. 2013 Madry et al. 2017). Later on, various at-
tacks (Carlim & Wagner 2017 Chen et al. [201 Lya et al. 2018 Athalye et al. 2018 Chen al.
2020
Moon et al. 2019: Croce & Hein| 2020 Tashiro et al. [020]] Andriushchenko et al. 2020
Chen Gu 2020) were also proposed for different settings or stronger performances. [aidlaw &
Feizi (2019) proposes functional adversarial attack that applies unique color mapping function for crafting functional perturbation patterns. It is proved in Laidlaw & Feizil (2019) that even a simple linear transformation can introduce more complex features than additive noises. On the de- fensive side, adversarial training has been shown as the most efficient technique for learning robust features minimally affected by the adversarial noises (Madry et al. 20188) Zhang et al. 2019a).
Data Poisoning Different from adversarial evasion attacks which directly evade a model's predic- tions, data poisoning focuses on manipulating samples at training time. Under this setting, the
2

---

Published as a conference paper at ICLR 2022
attacker injects bad data samples into the training pipeline that whatever pattern the model leams becomes useless. Previous works have shown that DNNs MuñozzGGnzzlez et al, 2017) as well traditional machine learning algorithms, such SVM (Biggio et al. 2012),
vulnerable to poisoning attacks (Shafahi et al. 2018 Koh et al. 2018). Recent progress involves using gradient matching and meta-learning inspired methods solve the noise crafting problem (Geiping al.) 2020 Huang et al., (020). One special type of data poisoning is backdoor attacks, which aim to inject falsely labeled training samples with stealthy trigger pattern (Gu et al. 2017, Qiao al. 2019). During the inference process, inputs with the same trigger pattern shall cause the model to predict incorrect labels. While poisoning methods can potentially be used prevent malicious data exploitation, the practicability is limited as the poisoned samples appear distinguishable to clean samples (Yang et al. 2017).
Learnability Attack Learnability attack methods emerge recently in the ML community with similar purpose as data poisoning attacks (to reduce model's prediction accuracy) but with an extra requirement to preserve the visual features of the original data. Huang et al. (2021) firstly present form of error-minimizing noise, effective both sample-wise and class-wise, that forces deep learn- ing model to learn useless features and thus behave badly clean samples. Specifically, the noise crafting process involves solving a bi-level objective through projected gradient descent (Madry al., (0118) Fowl al.] (2021b) resolves similar problem using gradient matching technique. In another work, they note that adversarial attacks can also be used for data poisoning (Fowl et al.) 2021ap. In comparison, our method concerns novel target as "Iearnability control", where autho- rized user is granted access to retrieve the clean data and train their model on it.
3 METHOD
3.1 PROBLEM DEFINITION
We focus the scenario where the data for releasing is intentionally poisoned by the data holder to lock its learnability. In particular, a model trained on the learnability locked dataset by unauthorized users should have awfully low performances rized clients with the correct keys can unlock the learnability of the dataset and train useful models. In designing secure learnability control approach for our needs, we assume the data holder has full access to the clean data, but cannot interfere with the training procedure after the dataset is released. We also assume that the dataset to be released is fully labeled, Let's denote the original clean dataset with n samples as De {xx, yt)] Our goal is to develop method that succeeds the following tasks:
the standard test cases. On the other hand, autho-
A. Given D., craft the learnability- lockked dataset D, = {(x1, ni) with a special key sb.
B. Given Dp and the corresponding key sb, recover the clean dataset as Dø which restores the learnability of D
Owner
Released
Training on DNN
(a) Illegal
Privata Dataset
Controlled Dp
Degraded Accuracy
(b)
g (
9 (
Authorized
Privare Dataset
Controlled
Unlocked
Normal
Datacnt
Dataset
De
D
D
Figure 1: Authorized learnability control pipeline, with Ie being a perturbation function where zb serves the key for the learnability lock. (a) demonstrates the case of an illegal exploitation attempt where the unauthorized client trains a model on the beamabilliy-loocke dataset; In (b) an authorized user can unlock the protected dataset with the inverse transformations and train normal model.
Now we design a novel method that introduces functional perturbations to generate learnability locked data samples. For simplicity, let's consider the common supervised image classification
3

---

Published as a conference paper at ICLR 2022
task with the goal of training K-class classifier fo X y with a labeled dataset. With little abuse of notations, we define set of K perturbation functions {g(4) ,.... (..,.(k)) (()) for each class E {1.... }.. Each perturbation function g(w) : X + X' maps the original data x to new one x', through an invertible transformation while the changes remain unnoticeable, i.c., x(()) g0dd (x) and ||x - -x I 6. Let's use 2/ to denote the parameters of the transformation function, which also served as the key for unlocking the learnability of the dataset. To solve for the most effective transformation function for locking the learnability, we formulate the problem min-min bi-level optimization problem for each class y::
argmin (x..))- min & (x)())((())) 0 where 0, the model for noise generation, is trained from scratch and ab, the parameters of the per- turbation function, is also initialized as identical mapping.
s.t. [199)"(()
x Se
(3.1)
Intuitively, the inner minimization will generate a perturbation such that the perturbed data well fit the current model. Thus in the outer minimization task, the model is tricked into believing that the current parameters are perfect and there is little left to be learned. Therefore, such perturbations can make the model fail in learning useful features from data. Finally, training such perturbed dataset will lead to a model that heavily relies on the perturbation noise. And when testing the model on clean samples, it cannot judge based the noise pattern and thus makes wrong predictions. (3.1) can be solved via an alternating strategy: first solving the inner minimization problem to obtain the best op that minimizes the training loss, then solving the outer minimization for better 0. Ideally, if
3.1 I can be well optimized, the perturbations generated by J (.) should fulfill task A of crafting unlearnable samples.
Compared with Huang et al. (202I), the main difference is that we define the inner optimization as solving the transformation function parameters vb instead of a set of fixed perturbation vectors. This 0
brings us unique challenges in designing the form of the perturbation functions (3) (.). Specifically, to fulfill task B, the perturbation function g is required be invertible (i.e. g exists), which means it maps every input to unique output and vice versa. Moreover, the magnitude of perturbation should be bounded so that will not affect normal use, i.e., 11 (v) (x) x|| S This constraint may seem easy for generating adversarial examples but not quite obvious for building invertible transformations. Finally, it requires a careful balance between the transformation's 's parameter size and its expressive power: it should be complicated enough to provide various perturbations for solving 3 and also be relatively lightweight for efficiently transferring to the authorized clients.
In the following section, we present two plausible perturbation functions that could satisfy the afore- mentioned properties. One is based on linear transformation and the other one is convolution-based nonlinear transformation.
3.1.1 LINEAR FUNCTIONAL PERTURBATION
We start by considering a linear transformation function where 9& (-) consists of simple element- wise linear mappings over input data x; E Rd drawn from De. We define the linear weights W- (w(1), ..... w(K)), ), with each w(v) Rdd and biases B {b(1) ..... b(k),, with each ((9) Rdd
We denote the overall parameters +b = ( B}. For each (x,, v1) E D., we leverage an invertible transformation as:
x 9 (vc) (x,) = w (1s) O x; + +0x+b(()) ((m)),
(3.2)
where @ denotes element-win wise multiplication. Note that the above transformation is class-wise, where weights w and b are universal for each class label. Furthermore, for each index j E [d] we
restrict [w(w)], E [1 e/2, + e/2], and [b(v)], E [[e/2,,/2] This ensures that the perturbation on each sample shall be bounded by:
Xx| x max [[ (v) [xxss, + [b: [x.bl S max [[x]i]] + Se. JE(d]
sEed
where the last inequality is due to 0 [x:], S 1 in the image classification task. Therefore, the linear function implicitly enforces the perturbation to satisfy the e limit in Lxs distance. The whole crafting process is summarized in Algorithm
4

---

Published as a conference paper at ICLR 2022
Algorithm Learnabilityy Locking (Linear)
1: Inputs: Clean dataset De { y4) (4)]=n. crafting model f with parameters 8, all wo =
and bo O, perturbation bound outer optimization step 7, inner optimization step J, error rate X, loss function I.
2: while error rate < À do
3: D2 +- empty dataset
4:
for (x;, 3/) in De do
5:
x; = w(")) @x x, + b(x))
6: Add (x), v.) Dp
7:
end for
8: repeat steps:
b outer optimization over
9: (x4= uk) &- Sample new batch from Dp
Optimize over [(w( (9k) @ Φx + b, (w))), yk) by SGD
10:
11: repeat J steps:
inner optimization over tb>
12:
for (x,, ys) in Dp do
13:
Optimize W and B by B.3 and 3.4
14:
W Cl, 1 - e/2, + e/2), and B <- Clip(B, -6/2, +c/2)
15:
end for 16: eπrоr rate t Evaluate fe over Dr
end while
18:
Output Poisoned dataset Dp key ab (W,
Algorithm 2 Learnability Unlocking (Linear)
Inputs: Poisoned dataset D, {(x}, y))) CNN parameters W and B, perturbation bound
2: Dž + empty list
3: for each x/. in Dp do
4: (x b (xx)) Ø 1x
5: Append (x, 31) to Dz
6: end for
7: Output Recovered dataset Dă
Optimization We solve 3.1 by adopting projected gradient descent (Madry et al. 2018 to itera- tively update the two parameter W and B. Specifically, first optimize over 0 for / batches on the perturbed data via stochastic gradient descent. Then vù, namely W and B, is updated through optimizing the inner minimization for J steps. In particular, W and B are iteratively updated by:
++1 w (36) mn V W(J
(an)
(86) @ x b, (wv)), ), v:),
(3.3)
(3)) b (31) VoC(fo(w (nd) o + (b)) y1).
(3.4)
at step + with learning rates 7j and 72- In practice, the iterations J will traverse pass (epoch) through the whole dataset. This typically allows W and B to better capture the strong (false) correlation between the perturbations and the model. After each update, each entry of W clipped into to the range [1 c/2, + c/2], and each entry of B is constrained to e/2]. Moreover, D, is updated at each iteration according to (.22). The iteration stops when fo obtains low training error, controlled by X, on the perturbed dataset.
To unlock the dataset, simply do an inverse of the linear transformation given the corresponding W and B from Algorithm Contrary to the locking process, we first apply an inverse shifting and then apply an inverse scaling operation. Detailed process is presented in Algorithm We note that the whole lcarnability control process based on linear transformation is nearly lossless in terms of information!
In practical image classification tasks, the perturbed images are further clipped into 10, 1] range and thus may slight lose a bit information during the unlocking process. Yet the difference is neglectable. See more details in Appendix B.4
5

---

Published as a conference paper at ICLR 2022
3.1.2 CONVOLUTIONAL FUNCTIONAL PERTURBATION
Next, we present another way of applying convolutional function to craft adversarial perturbations. To begin with, we quickly review the idea of invertible ResNet (i-ResNet) (Behrmann et al. 2019).
i-ResNet Residual networks consist of residual transformations such as y = x (x). Behrmann et al. (2119) note that this transformation is invertible as long as the Lipschitz-constann of hup satisfies L S 1. Behrmann al. (2019) proposed the invertible residual network that uses spectral normalization to limit the Lipschitz-contaan of hup (-) and obtain invertible ResNet. In particular, the inverse operation can done by performing an fix-point iteration starting from Xo = y, and then iteratively compute Xx+1 more detailed illustrations.
has (Xe). We refer the reader to the original paper for
The invertible residual block is perfect match for our purposes: we need an invertible and parameter-effiient transformation for data encryption/decrypioon while the invertible residual block only requires few convolutional layers (shared convolution filters). Specifically, let's denote the class-y's s invertible residual transformation functior as g(w) For each x; with label y: E {1,..., K), we design the following the transformation function:
x = of (66) (x,) x, + tanh(h (1)) (x,)),
(3.5)
where each (g) is composed of multiple spectrally normalized convolution layers with same-sized
output, and ReLU activations, in order to make the transformation invertible. The output of n (-) can be viewed as the perturbation noise added to the original image. To limit the Loo norm of the perturbation to satisfy the constraint, add an extra tanh function outside (1 (-) and then multiplied by Note that this does not change the invertible nature of the whole transformation, as the tanh function is also 1-Lipschitz.
The crafting process is similar to the linear transformation case, summarized in Algorithm S in appendix. Specifically, we adopt stochastic gradient descent for updating 0 and sa alternatively. To unlock perturbed data sample in this setting, start from x, x and perform fixed point iterations by updating x; = X; - c. -tanhhhh (ha (h (2)) (x;)), as shown in Algorithm in the appendix. Note that although this iterative unlocking process cannot exactly recover the original dataset, as shown in Appendix [B4, the actual reconstruction loss is minimal.
4 EXPERIMENTS
In this section, we empirically verify the effectiveness of our methods for learnability control. Fol- lowing Huang et al. (202I). we then examine the strength and robustness of the generated pertur- bations in multiple settings and against potential counter-measures. Tasks are evaluated on three publicly available datasets: CIFAR-10, CIFAR-100 (Krizhevsky et al., 2009), and IMAGENET (Deng et al., 2009).. Specifically, for IMAGENET experiments, we picked a subset of 10 classes, each with 700 training and 300 testing samples, denoted by IMAGENET-10. Detailed experimental setups can be found at Appendix B.T
4.1 LEARNABILITY CONTROL
Our main experiments aim to answer the following two key questions related to the learnability control task: (1) the proposed transformations effective for controlling (locking and unlocking) the learnability of the dataset? (2) is this learnability control strategy universal (agnostic to network structures or datasets)? We test the strength of our methods on standard image classification tasks for CIFAR- 10, CIFAR-100, and IMAGENET-IE 10 datasets on four state-of-art CNN models: ResNet- 8, ResNet-50 (He et al. 2016), VGG-11 (Simonyan & Zisserman, 2014). and DenseNet- (Huang ct al. 2017). We train each model on CIFAR-10 for 60 epochs, CIFAR- 100 for 100 epochs, and IMAGENET-10 for 60 epochs.
As shown in Table I] both of the proposed adversarial transformations (linear or convolutional) can reliably lock and restore the dataset learnability. Specifically, compared clean models trained on
Thee transformation designed keep the input dimension unchanged.

---

Published as a conference paper at ICLR 2022
De. models trained on perturbed dataset D, have significantly worse validation accuracy. This effect is equally powerful across network structures with different model depths. On the other hand, the leamability is ideally recovered through the authorization process the model trained recovered dataset Da achieves comparable performance as the corresponding clean models. This is also true on IMAGENET-10 10 dataset, suggesting that the information loss through the learnability control process is negligible for training commercial models. We can also observe that the linear transformation function seems more powerful than the convolutional one in terms of the validation accuracy on the learnailiiyy locked dataset Dz. However, the convolutional lock is advantageous in that the structure of hag can be flexibly adjusted to control the number of parameters in the key while the linear one has the key size strictly proportional the data dimension. Also note that while we use ResNet- 18 model for fe in the learnability locking process, other model architectures could also be effective for our task, which further discussed Appendix C.4
Table I: Test accuracy for models trained on clean dataset (D,). perturbed dataset( Dp), and recov- ered clean dataset (Dz). The first row summarizes result for linear perturbation function; the second row lists the result for convolutional perturbation function.
CIFAR-10
CIFAR-100
IMAGENET-10
Transform
Network
De
Dp
D2
De
Dz
De
Dp
Dz
p
ResNet-18
91.60
12.38
90.66
68.46
8.58
67.16
81.57
9.97
81.90
ResNet-50
94.28
15.62
95.59
70.12
6.98
69.09
84.20
10.30
83.53
Linear
VGG-11
90.76
15.07
91.37
67.25
6.62
67.49
81.07
11.80
81.33
DenseNet- 121
94.36
14.75
93.33
70.81
7.48
71.32
83.17
8.53
83.37
ResNet-18
91.02
16.60
91.95
69.27
8.92
68.93
82.83
12,20
81.70
ResNet-50
95.68
19.39
94.79
69.58
8.70
67.29
84.93
10.37
84.63
Conv
VGG-11
91.07
19.61
90.88
67.32
7.45
67.98
81.30
13.20
81.90
DenseNet-121
93.22
20.23
93.48
71.14
5.62
71.54
84.37
12.47
84.43
In practice, the data controller may not has access to the entire dataset, rather, the access may be restricted to single several classes of the whole dataset. We test our learnability control process with only one single class being manipulated. Specifically, we choose to perturb the class "bird" in the CIFAR-10 dataset and observe the corresponding learnability perfor- mance. In Figure we show the heatmap of the prediction confusion matrices on our single-class controlled CIFARIO dataset via both linear and convolutional transformations. can be observed that our proposed method reliably fools the network into misclassifying "bird" as other class labels. This demonstrates the effectiveness of our proposed method even with single class data being per- turbed. On the other hand, the model trained on the unlocked "bird" data can achieve 93% and 91% test accuracies respectively for linear and convolutional perturbation functions. This confirms that our learnability lock can be flexibly adapted to different protection tasks. Due to the space limit, we refer the readers to Section B.2 in the appendix for experiments with learnability control on multiple classes.
Control over Single Class:
Effect of Perturbation Limit e: We also test the effectiveness of our learnability control with different limitations. We conduct two sets of experiments on the CIFARIO dataset using linear transformation with c = 8 and = 16 respectively. As shown in Figure 3 the learning curves demonstrate that larger perturbation provides apparently better protection to the data learnability. While it is true that larger e gives better learnability control on the dataset, we point out that the too large noise will make the perturbation visible to human eyes.
4.2 ROBUSTNESS ANALYSIS
In this section, we evaluate the robustness of the functional perturbations against proactive mitigation strategies. It is worth noting that there is no existing strategy specifically targeted to compromise the learnability control process. So we consider two types of general defenses that may affect the effectiveness of our learnability lock: 1) data augmentations or filtering strategies that preprocess the
In many cases, the CNN structure with shared convolutional filters requires much fewer parameters. The detailed structure used for our convolutional transformation can be found in the Appendix.

---

Published as a conference paper at ICLR 2022
Accurney
0.8
Test Accurncy
0.8
Clan
0.4
6m
gen
of of
20
Predical Looes
Epochs
Epochs
(a) Linear
(b) Conv
(a) Linear
(b) Conv
Figure 2: Heatmap of the classification confusion matrix for learnability control on the single class "bird" of CIFAR-10 for (a) linear transformation, and (b) convolutional transformation.
Figure Test accuracy against training epochs for model training the perturbed dataset Dp
using different for (a) linear transformation, and (b) convolutional transformation.
input data which may mitigate the effect of our perturbations; 2) adversarial training based defensive techniques that target to learn the robust features in the input which still exist the perturbed data.
4.2.1 DATA AUGMENTATION AND FILTERING TECHNIQUES
It is possible that data augmentation can be used to mitigate the effect of small adversarial pertur- bations. In addition standard augmentation methods such as rotation, shifting, and flipping, we test our method against several more advanced ones, including Mixup (Zhang et al. 2018). Cutmix Yun et al.) 2019), and Cutout (Cubuk et al., 2018). We also evaluate our method on some basic filtering techniques such as random Loo noises and Gaussian smoothing restricting the perturbation strength
Experimental results Table indicate that none these techniques defeat our learnability control method as the model trained on the augmented samples still behaves poorly. Standard augmentations such as rotation, shifting and flipping can only recover an extra 1% of the validation accuracy. Mixup (Zhang al., 2018) achieved the best learnability recovery result of 43.88% for linear lock and 36.97% for convolutional lock, yet still far from satisfactory for practical use cases. Note that although convolutional based perturbations achieve worse learnabil- ity locking performance compared with linear perturbations, they are actually more robust to such data augmentation or filtering techniques. It is also worth noting that in our experiment, we assume that the data provider doesn't know the potential augmentations used for generating the learnability locked dataset. We believe our method can be further improved by crafting the learnability lock on an augmented dataset so that the lock can generalize better to various augmentations.
Table Summary of applying data augmentation and filtering techniques the learnability locked dataset.
Table Summary on the effectiveness of applying adversarial training on several learnability attack methods and our pro- posed learnability lock.
Defenses
Ace (Linear)
Acc (Conv)
None
14.79
17.61
Method
Val Acc
Random Noise
19.83
17.32
Gaussian Blurring
15.59
21.28
Unlearnable Examples
85.89
rotate & flip & crop
15.25
18.81
Gradient Alignment
83.56
Cutmix Cutout
20.72
18.60
Adversarial Poisoning
86.09
26.28
23.04
Learnability Lock (linear)
65.53
Mixup
43.88
36.97
Learnability Lock (conv)
71.78
4.2.2 ADVERSARIAL TRAINING
Adversarial training Madry et al. 2018) can also be viewed as strong data augmentation technique against data perturbations. It is originally designed to help the model learn robust features to defend against the adversarial examples, which are generated by solving min-max problem. Note that this min-max optimization is the exact counterpart of the min-min formulation in Huang et al. (222T). Huang et al. (2021) reported that adversarially trained models still effectively learn the useful information from the dataset perturbed by the error-mine mroommmnnmizzig noise (gaining around 85% valida- tion accuracy). We test methods by adversarially training ResNet-50 model the perturbed
8

---

Published as a conference paper at ICLR 2022
CIFAR-10 10 dataset created from functional perturbations. We compare the result with three existing
learnability attack methods including unlearnable examples (Huang et al. 202T). gradient alignment (Fowl et al., 2021b), and adversarial poisoning (Fowl et al. (021a). The attack used for adversarial training is the traditional PGD approach with 10 iteration steps, and the maximum Toee perturbation is limited 8/255.
Experimental results in Table indicate that the learnability lock outperforms existing methods based on additive noises in terms of adversarially trained models. We suspect this is because simple transformations, such as scaling and shifting, are able to generate much more complicated perturba- tion patterns than pure additive noises (Laidlaw Feizi 2019). A similar finding noted by ZZhang et al. (2019b) that simple transformations can move imgges out of the manifold of the data samples and thus expose the adversarially trained models under threats of "blind spots". While adversarial training proves to be much more effective than other data augmentations techniques, it also fails to recover the validation accuracy back to a natural level and is, on the other hand, extremely computa- tionally expensive. In Appendix B.3 we further discuss a hypothetical case where attacker realizes the transformation function used for learnability control and thus perform an adaptive adversarial training, which is shown to be even less effective than standard adversarial training.
4.3 PRACTICAL GUIDELINES
In this section we study some unique properties of our learnability control framework. Since our proposed learnability control framework al- lows us to restore its learnability with the rect secret key, one may wonder whether this learnability key is unique and reliable for prac- tical use. In other words, if we generate two sets of keys for two clients based on one com-
Table 4: Summary of uniqueness experiment sults with a ResNet- 18 trained on CIFAR-10
Keys +
Linear (A)
Conv (A)
Linear (B) 14.79
11.35
Conv (B)
19.83
17.81
mon data source, would the two keys mutually unlock the other "Iearnability locked" dataset? This crucial since if it is the case, then as long as one set of key (transformation function) is exposed to an attacker, we lost the learnability locks for all the perturbed datasets based on the same source data, In our experiment, we train two learnability locks for each transformation separately on the CIFAR-10 dataset and generate learnability locked datasets DJ and D2 with corresponding keys T/1 and 1/2. Then we use 1 to unlock D and train a model on the retrieved dataset. As shown in Table each row represents the transformation method we used as the key and each column stands for a learnability locked dataset we intend to unlock. The result suggests that learnability lock is strongly tied with key that cannot be used to mutually unlock other locks, which introduces the desired property that prevents any unwanted data usage caused by partial leakage of secret keys.
We also conduct various ablation studies on the practicality of learnability lock including the effect of different perturbation percentages in D,,. different model architectures of fe. the possibility of using global transformation functions or mixture of transformation functions, for which we refer the reader to Appendix C
5 CONCLUSION
We introduce a novel concept Learnability Lock that leverages adversarial transformations to achieve Icarnability control on specific dataset. One significant advantage of our method is that not only we can attack the lcarnability of specific dataset with little visual compromises through an adversarial transformation, but also can easily restore its learnability with a special key, which is light-weighted and easy-to-trame -oranss-r,,,,eer through the inverse transformations, While demonstrate the effectiveness of our method on visual classification tasks, it is possible to adapt our method to other data formats, which we leave future work directions.
REFERENCES
Maksym Andriushchenko. Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square at- tack: query-efficient black-box adversarial attack via random search. In European Conference

---

Published as a conference paper at ICLR 2022
Computer Viston, pp. 484-501. Springer, 2020.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Cireumventing defenses to adversarial examples. In ICML, 2018.
Jens Behrmann, Will Grathwohl, Ricky TQ Chen, David Duvenaud, and Jörn-Henrik Jacobsen. Invertible residual networks. In International Conference Machine Learning, pp. 573-582. PMLR, 2019.
Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector ma- chines. arXiv preprint arXiv:1206.6389, 2012.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In SP, pp. 39-57. IEEE, 2017.
Jinghui Chen and Quanquan Gu. Rays: ray searching method for hard-label adversarial attack. In SIGKDD, 2020.
Jinghui Chen, Dongruo Zhou, Jinfeng Yi, and Quanquan Gu. frank-wolfe framework for efficient and effective adversarial attacks. In AAAI, 2020.
Pin- Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsich. Zoo: Zeroth order opti- mization based black-box attacks to deep neural networks without training substitute models. In AlSec, pp. 15-26. ACM, 2017.
Croce and M. Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In ICMI, 2020.
Ekin D Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoc Le. Autoaugment: Learning augmentation policies from data. arXiv preprint arXiv:1805.090 895000 2018.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pp. 248-244220 255. leee, 2009.
Jacob Devlin, Ming- bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 2018.
Weig-Weiffe Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep
Liam Fowl, Micah Goldblum, Ping ych Chiang, Jonas Geiping, Wojtek Czaja, and Tom Goldstein. Adversarial examples make strong poisons, 2021a.
Liam Fowl, Ping yeh Chiang, Micah Goldblum, Jonas Geiping, Arpit Bansal, Wojtek Czaja, and Tom Goldstein. Preventing unauthorized use of proprietary data: Poisoning for secure dataset release, 2021b.
Jonas Geiping, Liam Fowl, W Ronny Huang. Wojeiech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. Witches' brew: Industrial scale data poisoning via gradient matching. arXiv preprint arXiv:2009.02277 2020.
Ian Goodfellow. Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples, 2015.
Tianyu Gu, Brendan Dolan-Gavie and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint 1XX8::7708.061 2017.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and patlern recognition, pp. 770-778, 2016.
Geoffrey Hinton, Li Deng. Dong Yu, George Dahl, Abdel-rahman Mohamed, Navdeep Jaitly, An- drew Senior, Vincent Vanhoucke, Patrick Nguyen, Brian Kingsbury, et al. Deep neural networks for acoustic modeling in speech recognition. IEEE Signal processing magazine, 29, 2012.
10

---

Published as a conference paper at ICLR 2022
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Weinberger. Densely connected convolutional networks. Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4700-4708, 2017.
Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearnable examples: Making personal data unexploitable. arXiv preprini arXiv:2101 (01.:29000. 2021.
W Ronny Huang, Jonas Geiping. Liam Fowl, Gavin Taylor, and Tom Goldstein. Metapoison: Prac- tical ceneral-purpose clean-label data poisoning. arXiv preprint arXiv:2004. 00225, 2020.
Andrew Ilyas, Logan Engstrom, Anish Athalye, Jessy Lin, Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Black-box adversarial attacks with limited queries and information. In ICML, 2018
Pang Wei Koh, Jacob Steinhardt, and Percy Liang. Stronger data poisoning attacks break data sanitization defenses. arXiv preprini wrXiv//11.00074 2018.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Cassidy Laidlaw and Soheil Feizi. Functional adversarial attacks. arXiv preprint arXiv: 2019.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient- based learning applied to document recognition. Proceedings of the IEEE, 86(11):227--2324 1998.
lyy Loshchilov and Frank Hutter. Sgdr: Stochastic gradient descent with warm restarts. arXiv preprint /608v 2016.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.066 06083, 2017.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. ICML, 2018.
Seungyong Moon, Gaon An, and Hyun Oh Song. Parsimonious black-box adversarial attacks via efficient combinatorial optimization. In ICML., pp. 4636-4645, 2019.
Luis Muñoz-González, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C Lupu, and Fabio Roli. Towards poisoning of deep learning algorithms with back- mack-gradient optimization. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pp. 27-38, 2017.
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, 7. Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security, pp. 506-519, 2017.
Ximing Qiao, Yukun Yang, and Hai Li. Defending neural backdoors via generative distribution modeling. arXiv preprint arXiv: /tt.v::9900044444 2019.
Ali Shafahi, Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks neural networks. arXiv preprint
2018
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv: 1409. 1556, 2014.
Christian Szegedy, Wojeiech Zaremba. Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 2013.
Yusuke Tashiro, Yang Song, and Stefano Ermon. Diversity can transferred: Output diversification for white-and black-box attacks. Advances in Neural Information Processing Systems, 33, 2020.

---

Published as a conference paper at ICLR 2022
Boxi Wu, Jinghui Chen, Deng Cai, Xiaofei He, and Quanquan Gu. Do wider neural networks really help adversarial robustness? arXiv preprint arXiv:2010.01279, 2020.
Chaofei Yang, Qing Wu, Hai Li, and Yiran Chen. Generative poisoning attack method against neural networks. arXiv preprini arXiv: 1703.0100000 2017.
Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Interna- tional Conference on Computer Vision (ICCV), 2019.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, pp. 7472-7482. PMLR, 2019a.
Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez- Paz. mixup: Beyond empiri- risk minimization. In International Conference on Learning Representations, 2018.
Huan Zhang, Hongge Chen, Zhao Song, Duane Boning, Inderjit Dhillon, and Cho-Jui Hsieh. The limitations of adversarial training and the blind-spot attack. arXiv preprint arXiv: 1e0111911..999 2019b.
12

---

Published as a conference paper at ICLR 2022
A ALGORITHMS FOR CONVOLUTIONAL LEARNABILITY LOCKING AND UNLOCKING
In this section, we attach the complete algorithms for the convolutional learnability locking and unlocking process. Specifically, the convolutional learnability locking process is summarized in Algorithm 3 The general procedure similar Algorithm T we update the perturbed dataset Dp with the current convolutional function and then alternatively update 0 and vp using the perturbed data via stochastic gradient descent.
The unlocking steps are summarized in Algorithm 4 Specifically, the inverse mapping of the resid- ual network can be approximated by fixed-point iteration. Note that while this fixed-point iteration may not perfectly reconstruct the original data, we show that this information loss is essentially negligible (in terms of both reconstruction error and learnability) in Section B.4
Algorithm Learnability Locking (convolutional)
1: Inputs: Clean dataset D. {(x, m1) 1=1- crafting model f with parameters 0, transformation h with randomly initialized parameters tho. perturbation bound e, outer optimization step I, inner optimization step J, error rate X, loss function L
2: while error rate < X
3: Dp + empty dataset
4: for (x,, 1/3 in D.
(v.) x!- = x; + (a
5:
6: Add (x/.
Dp
7:
end for
8: repeat / steps:
outer optimization over
9: (x&.yk) < Sample a new batch from Dp
Optimize over [(fo(x) + e tanh(h (yv) (x())). by SGD
11: repeat J steps:
inner optimization over rb
12: for (x/, MA) in Dp do
Optimize over C(fo(x + tann(h y:) by SGD end for 15: error rate <- Evaluate fo over Dp
16: end while
17:
Output Poisoned dataset D, key rb
Algorithm 4 Learnability Unlocking (convolutional)
1: Inputs: Poisoned dataset D, {(X', 3e) Ji transform function (i-ResNet) hop, number of fixed-point iterations m,, perturbation bound e
2: Da + empty list
3: for each x,, y/ in D, do
4: for i = 1, ..., do
X; x e tanh(h (wr) (xx))
5:
6: end for
7: Append (x,, 31) to Da
8:
end for
9: Output Recovered dataset Da
B ADDITIONAL EXPERIMENT DETAILS
B. EXPERIMENTAL SETUP
For all experiments, we use ResNet-18 (He et al. 2016) as the base model for generating the learn- ability lock unless specified. Performance of the learnability locking process is evaluated by the
13

---

Published as a conference paper at ICLR 2022
Table Structure of transformation model for convolutional learnahility lock on CIFAR
Layer Type
# channels
Filter Size
Stride
Padding
Activation
Conv
8
3 3
ReLU
Conv
16
3 x
ReLU
Conv
16
1 1
ReLU
Conv
3 x 3
ReLU
Conv 3
3 3 3
ReL.U
testing accuracy of the model train from scratch on the controlled dataset D,- Similarly, effec- tiveness of the unlocking process is examined by the testing accuracy of the model trained on the learnability restored dataset Da. To ensure the stealthiness of the perturbation, we restrict 8/255 for CIFAR-10 and CIFAR-I00 100, and 16/255 for IMAGENET. To evaluate the effectiveness of the learnability control, the evaluation models are trained using Stochastic Gradient Descent (SGD) (LeCun et al.] 1998) with initial learning rate of 0.01, momentum of 0.9, and a cosine annealing scheduler (Loshchilov & Hutter 2016). For model training during the learnability locking process (updating Ja), we set initial learning rate of SGD as 0.1 with momentum as 0.9 and cosine anneal- ing scheduler without restart. Cross-entropy is always used the loss function if not mentioned otherwise. The batch size is set as 256 for CIFAR-10 10 and CIFAR- 100, 128 for the IMAGENET due memory limitation.
Setup for Linear Learnability Lock For learnability locking using linear transformations, we use with learning rate over z6 of 0.1 according to (3.3) and (3.4): for CIFAR- 100, we let I = 25 and J = 3 with learning rate 0.1; for IMAGENET-IO 10 dataset, we set 30 and J with learning rate 0.1. In addition, the functional parameters v/ (W.B) are initialized with all ones to W and all zeros B. For the exit condition, set to 0.1.
the following hyper-parametert
Algorithm T for CIFAR-I0, 10, we set 20 and
Setup for Convolutional Learnability Lock The convolutional model h&p we used for generating perturbations is demonstrated in Table 5 For experiment on IMAGENET, we use the same struc- ture but modify the number of channels in order to 64, 128, 128, 64, 3. The hyper-parameters set as follows in Algorithm 3 for CIFAR- 10, we use = 25 and J = 3 with a learning rate of 0.1 with SGD over v/; for CIFAR 100, we set / = 30 and J 5 with initial learning rate 0.05, which shrinks by half for every 5 iterations of Algorithm 3 On IMAGENET, we instead use I = 40 and the number of exed-point iterations m 5. For exit condition, we set = 0.2 and also applied early stopping to avoid overfitting.
J with learning rate 0.01. For the unlocking process,
B.2 LEARNABILITY CONTROL ON MULTIPLE CLASSES
We follow the experimental setup in Section 4.1 and consider the case where multiple, but not all, classes need to be protected. For linear transformation, we select classes ("automobile", "cat", "dog", "horse") from the CIFAR-10 10 dataset conduct lcarnability control. For convolutional trans- formation, we do the same on another classes ("bird", "deer", "frog", "ship") for demonstration. Note that the controlled classes selected by random and method also generalizes to other settings. Figure 5 shows the prediction results of ResNet-50 trained on the partially controlled dataset. We can observe that model falsely predict almost all the samples that belong to classes under learnability control, while remaining unaffected on other classes. The learnability can also be reliably restored by unlocking the controlled classes. Models trained on the restored datasets achieve testing accuracies of 94% and 93%, respectively.
B.3 MORE DETAILS ON ADVERSARIAL. TRAINING
Generally speaking, adversarial training fails to serve as an ideal counter-measure to our proposed learnability control. Aside from the extra computational cost to craft adversarial examples in each training step, it has been shown that adversarially trained models suffer from a compromised nat- ural accuracy (Zhang et al. 2019a Wu et al. 2020). Our experiments indicate that with the same training pipeline, the adversarially trained model on CIFAR-10 dataset can achieve at best 87% validation accuracy, while the normally trained model can easily attain a 93%. The degradation is more apparent industry-level dataset with high resolution (Fowl et al. 2021a). In addition,
14

---

Published as a conference paper at ICLR 2022
plane car
14
plana car
M22
600
bird
1M
bird
21
212
Correct Labels
cat
12t
12
992
Correct Labels
cal
2C
dear
f
T9
15
27
desB
deg
12
327
4002
dog
2C
305
1C
400
frog
Q2
X
15
F72
fro3
22
921
horse
13
9
<
CST
horsa
EX1
ship
852
ship
107
truck
8M4
truck
plane
bird
cat
dear
dog
trog horse
ship
truck
plane
car
bird
cal
dear
dog
trag
horee
ship
truck
Predicted Labels
Predicted Labels
(a) Linear
(b) Convolutional
Figure 4: Annotated version of Fig. 2 classification confusion matrix for learnability control on the single class "bird" of CIFAR-IO for (a) linear transformation, and (b) convolutional transformation.
plane CBF
14
T6
plane
130
12
800
cBr
bird
2L2
314
TNY
Correct Labels
414
Correct Labels
call
deer
Seen
2N1
dog
AZ
400
trog
SSC
horse
-25
72
horse
200
ship
Ship
211
truck
truck
plane
bird
deef
borse
Ship
truck
plane
1600
80
(003)
horrs
truck
Predicted Labels
Predicted Labels
(a) Linear
(b) Convolutional
Figure 5: Prediction results of a ResNet-50 model trained on partially carmability-controlle CIF The classes under control are circled red. It is easy to see that the model has fairly bad performance controlle classes, while nearly unaffected on other classes.
the adversarial training could be less effective without knowing the exact method an adversary used for the attack. This is also true in our learnability control setting as the adversary is unaware of the transformations used within the learnability lock.
To further explore the stability of our learnability control strategy, emvision hypothetical sce- nario that the adversary actually know what type of transformation is used for our learnability lock. Therefore, the adversary may choose to adversarially train the model using the exact same type of transformations for solving the min-max problem. Specifically, if the learnability lock is crafted based linear transformation, then the adversary can also first solve the maximizer for W and B that mostly degrades the model performance at each training step and then solve the minimizer on the outer model training problem. We test out this concern for both the linear and convolutional lcarnability control processes. Specifically, we adversarially train a ResNet-50 on the CIFAR-10 dataset based on class-wise noises with linear and convolutional transformations respectively. In addition, we also use the sample-wise linear transformation (which is much computationally inten- sive) to craft the noise for adversarial training. We are not able to leverage the sample-wise convolu- tional transformation for the full adversarial training process due to the high computational burden. Instead, we craft the sample-wise noises based on convolutional transformation on a well-trained model on Dp. and include the perturbed samples data augmentation to Dp- We then continue training the model for 20 iterations. The result is summarized in Figure 66 suggesting that none of the adversarial training techniques can reliably defeat our method. From Figure 6 we also observe
15

---

Published as a conference paper at ICLR 2022
that when the adversary is unaware of the type of transformation used, the best strategy is probably to apply the standard adversarial training, even though its learnability recovery ability also limited (as previously shown in Section 4.2.2
92:1
Testing Accuracy
71.78
65.53
50
16.09
17:13
Clean
AT lineartc)
AT [inear(s]
AT linear(st)
AT conv(s)
AT convjs)
AT convist)
Figure 6: Performance on the learnability locked dataset trained by adapted adversarial training with respect to the transformation functions. Specifically, "c" stands for adversarial training with class- wise perturbations, "s" means sample-wise, and "st" means the standard adversarial training using PGD.
B.4 RECONSTRUCTION Loss
Normally the encryption and decryption process accompanicd by a certain degree of information loss. This is also true for the linear and convolutional learnability lock. On the one hand, the samples transformed by the lock may be further clipped into range [0, 1] in image classification tasks. This introduces slight information loss when reconstruct the samples with inverse transformation. Additionally, for the convolutional lock, the inverse transformation is approximated by fixed-point iterations, bringing certain degree of information loss. While we already show in Table that this loss is negligible for restoring the learnability, here we explore the ability to reconstruct the original dataset with the two proposed transformations. The experiment is conducted on CIFAR-I with two pre-trained learnability locks. The information loss is measured by the average L-2 loss between retrieved images from Da and original images from De. calculated on 500 randomly selected images. Results are included in Table 6 It shows that the information loss is trivial compared with the distance from perturbed images, and thus the learnability control process is rarely affected.
Table 6: Reconstruction losses for learnability locks with both linear and convolutional transforma- tions measured in L2 distance.
Average L2 loss compared to D
Dp
D
Linear Conv
0.81 + 0.07
2.58e 7 -
1.67 + 0.06
4.91e 4 + 1
C
ABLATION STUDY
In this section, we present some important ablation studies to our proposed learnability lock frame- work.
C.1 PERTURBATION PERCENTAGES
In case when the entire training data collection is not available for the data controller to leverage learnability control, we examine the potency our method when we perturb merely a portion the training data. This is different from the aforementioned single-class experiments, which constrain the perturbation to only one single class. In this section, we study the effect only part of the randomly selected samples from full dataset has been controlled for learnability. Figure shows that the effectiveness of both transformation functions is compromised when the training samples not all under learnability control. The result suggests that the data provider should possess
16

---

Published as a conference paper at ICLR 2022
80
Test Accuracy
60
40
Linear Lock(ours)
Convolutional Lock(ours)
20
Unleamable Examples
20%
40%
60%
80%
100%
Perturbation Percentage
Figure 7:
Test accuracy against perturbation percentage for models trained on learnability controlled dataset with different percentage of perturbed samples.
least 60% of the training data in order to activate the learnability control effect. This vulnerability also noted in previous work (Huang et al.) 2021). Compared with Huang et al. (2021 we observed that both linear and convolutional transformations achieve much better learnability locking performances especially when the perturbation percentage lies in the middle range (40% ~ 80%).
C.2 GLOBAL TRANSFORMATION FUNCTION
Our method focuses on class-wiss transformation functions. Of particular interest is whether one global transformation function can be applied over the whole dataset and still lock the learnability. One advantage of applying universal transformation is a smaller amount of parameters (size the keys) needed. This makes transferring the keys between the data owner and clients more convenient. We test with both proposed perturbation functions on the CIFAR-10 dataset. Specifically, for the convolutional transformation,
a deep network with 20 convolution layers (to ensure enough expressiveness for perturbing the entire dataset). As shown in Figure g while the potency of our method is decreased, the learnability lock is still effective in degrading the model performance by 20-30 percent. We believe that the performance can be further improved by either designing more effective perturbation functions or advanced optimization steps. We leave it for future study.
100
93.97
Tist Accuracy
72.79
61.38
40
clean
locked((inear)
locked(ccorv)
Figure 8: Experimental result for global transformation functions CIFAR-10 10 dataset.
C.3 MIXTURE OF PERTURBATION FUNCTIONS
Another way to improve the complexity of learnability control process against potential counter- measures is to apply a mixture of perturbation functions. this sense, we can apply different transformation functions to each class in a random order so that the order itself could serve as another secret key. We show that this is possible by applying the linear transformation (Algorithm 1 on classes with odd labels and convolutional transformation (Algorithm 3) classes with even labels from CIFAR-10. The result is listed in Table generated on a ResNet-50 model. It is
We directly the data provided in the original paper Huang et al. 2021
the baseline.
17

---

Published as a conference paper at ICLR 2022
Table Performance comparison when using a mixture of perturbation functions.
Perturbation
Val Acc
None
93.89
Linear
13.93
Conv 17.06
Mixture 21.29
observed that using a combination of different locks has little impact on the potency of learnability control. Yet without knowing the exact transformation functions and the orders applied, it is harder attackers to mitigate or reverse-engineer the perturbation patterns order to compromise the protection.
C.4 EFFECT ON CRAFTING MODEL ARCHITECTURES
While ResNet-18 is used as the default model architecture for crafting the learnability locked dataset in our experiments, we verify that other model architectures could serve the same purpose equiv- alently. Specifically, we use VGG-11 11 and DenseNet- 121 as crafting models and evaluate the per- formance of the trained adversarial transformations on CIFAR-10 with ResNet-50. The results are listed in Table For both linear and convolutional transformations, the learnability control process still effective under different model architectures, suggesting that the learnability lock has the de- sired property that it is agnostic to network structures. In addition, we observe that a more powerful crafting model always generates a stronger learnability lock. For example, the validation accuracy of model trained on CIFAR- 10 controlled by lock crafted with DenseNet- -21 is always lower than that crafted with VGG-11.
Table 8: Learnability locking performances with different model architectures of fe-
g
fe
Test Ace (locked)
Test Ace (unlocked)
VGG-11
17.53
91.35
Linear
Densenet-121
12.01
90.34
VGG-11
19.21
91.67
Conv
Densenet-121 121
14.56
92.75
C.5 COMPARISON TO ADDITIVE PERTURBATION
Additive noise is widely adopted in the literature of adversarial machine learning. It usually has the form x' = 8 where 8 stands for the noise pattern being mapped onto clean sample. Several recent works leverage additive perturbation to prevent models from learning useful features on poisoned dataset (Fowl al. 2021a Huang noises can be summarized into two categories: sample-win and dassswwise. However, we argue that both kinds of them are not suitable for a task of learnability control due to several major drawbacks.
2021 Fowl al. 2021b). Existing additive
Sample-wise perturbation falls short of recovering the learnability for the whole dataset because of the extremely high cost to pass all the noise patterns to an authorized user. Obviously, the potential cost of transferring the "secret key" grows with the number of samples contained in the dataset, practical commercial setting. On the other hand, additive perturbations
which tends to be large injected class-wise has much lower transferring cost. In specific, the secret key would involve unique noise pattern for each class so that the cost is merely O(d x k). where stands for the sample dimension and k represents the number of classes. However, the downside of class wise additive perturbation is that applies the same perturbation for all data in one class, and thus can be easily detected reverse-enge -eggineengg.......
transformation based perturbation resolves both concerns raised above. First, the inversion cost is much lower than that of sample-wise additive noises. The proposed linear learnability lock involves
18

---

Published as a conference paper at ICLR 2022
O x k) parameters to do the inverse transformation. This is merely 61440 parameter values in the case of CIFAR-I0 10. The cost Sof convolutional learnability lock also low, with around 30000 parameters CIFAR-10 10 (based on h provided in Table On the other hand, the transformation based perturbation, though performed class-wise, can generate different noise patterns for each sam- ple. This improves the stealthiness and stability of the learnaillity control process. Furthermore, is shown that the Transformation-basee as counter-measure TobpeeComparrs the maximum achievable accuracy of our method with Huang et al. (202T) that is based on additive noise. It shows that while the validation accuracy on the un- learnalle data produced by our method is comparable to that of al. (202I). our method can ensure much lower maximum achievable accuracy taking into account adversarial training. Table 10 summarizes the comparisons between our method and additive noises in terms several signifi- cant properties for learnability control. Specifically, the "stealthiness" is reflected through diversity of functional perturbations rather than the value of e. The diversity functionally perturbations make it harder to reverse-cngineer the noise patterns from the unlearnable dataset and thus break our protection. For example, suppose a key-lock pair (one noisy image and the original clean sample) disclosed, then for the additive noise, it is easy for the attacker to detect reverse-engineer the noise pattern and remove all of them. This is not true for our method as the functional parameters (e.g. invertible resnet) essentially impossible recover with one key-lock pair.
perturbation is more robust to standard adversarial training
Table 9; Comparison of maximum achievable accuracy with unlearnable examples (Huang al., 2021). Here we focus on the maximum achievable validation accuracy of a ResNet-50 trained on the CIFAR-10 dataset using any training schemes.
Normal Training
Adv Training
Max Achievable Accuracy
Unlearnable Ours (linear)
13.45
85.89
85.89
15.62
65.53
65.53
Ours (conv) 19.39
71.78
71.78
Table 10: Comparison of different strategies under the setting of learnability control. The "stealth- iness" evaluates based if the noise is easily detectable be reverse-engineered. (V denotes "yes", X denotes "no"")
Perturbation
Inverse
Transfer Cost
Adv. Train
Stealthiness
Additive (sample-wise)
high
X
Additive (class-wise)
low
X
X
Linear (ours)
low
V
Convolutional (ours)
low
'lll the experiments apply the for all baselines.
19


Reviews:
[{"review_id": "hv8uDNuWSw", "reviewer": "Reviewer_ZNq5", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n+ Interesting setting and a challenging threat model\n+ Thorough evaluation \n\nWeaknesses:\n+ Narrative being very far from reality \n+ Unclear contributions over and above Huang et al. \n\n\nFirst, I want to mention that the paper is very well written, thoroughly evaluated and presents a convincing technical story for an ML audience. Yet, for people more familiar with Computer Security, and “do not roll your own crypto” principle, it presents a rather weak argument as to why any protection is provided with such an encryption scheme at all. In fact, the results from adversarial training tell that the system design is broken and the paper contradicts its own story. \n\nSecond, Carlini et al. in ‘Is Private Learning Possible with Instance Encoding?’ talk about lack of rigorous notions for privacy and use of ad-hoc arguments in instance encoding schemes such as InstaHide. It seems that this paper follows the same premise and provides no justifications for its, rather strong, claims. I am very confused about the setting of the paper. \n\n```\nExisting methods include training ML models on encrypted data, where the sensitive information could be hidden through cryptographic approaches in order to prevent malicious manipulation (Hesamifard et al., 2017; Ding et al., 2021). However, those kinds of data processing methods normally do not preserve visual properties from the raw data and thus affect normal use. For example, it does not make sense for one to send a fully encrypted and unrecognizable “selfie” photo to friends just to make sure the photo will not be exploited without authorization.\n```\n\nIndeed, if the goal is confidentiality and control of ones secrets, it does make sense to send data encrypted, a de-facto standard in private end-to-end communication. There is a branch of cryptography focusing on controlled disclosure of information if needed e.g. Partially Revealing Cryptography or even Deniable Cryptography. What is more, it does make sense to send ones ‘selfie’ encrypted over vetted channels and theoretically sound protocols — that way privacy is not going to be violated. In fact, the paper does discuss that data transfer is a potential security risk, yet argues to use a mechanism that leaks data by default:\n\n```\nFrom the data providers’ perspective, this means that any mistake conducted in the data transfer procedure could lead to potential privacy/security risks. This raises great challenges in securely distributing sensitive data from the data providers to the clients.\n```\n\nIt took cryptographic community decades to establish best practices, develop theoretically and practically rigorous attacks and defences. Currently, there are international standards, competitions, and good understanding of privacy guarantees of different encryption mechanisms. ‘’Rolling your own crypto’’ leads to mistakes. Thus, I am unable to understand how the approach proposed in this paper improves upon the state-of-the-art in secure data transfer in Machine Learning.  \n\nIn light of the above, I was unable to understand the threat model in which the paper proposes to provide a sensible mechanism to protect ones privacy, limiting its contributions over and above Huang et al. I also did not understand how the proposed approach innovates over a scheme constructed using standard cryptography toolbox like AES to make learning impossible.  If the authors are able to clarify these concerns, I would be happy to revise my review.\n\n\n\n\n\n", "summary_of_the_paper": "Paper presents an idea of “Learnability lock”, a system that aims to control learnability of individual datapoints or data classes. The system builds on top of recent work on data learnability, where, in essence, noise is applied to individual datapoints in a way to disrupt learning generalisable features. From the description, it appears that it works as a poisoning or a backdoor attack, where the objective is to correlate non-generalisable features. \n\nNow, learnability lock describes a mechanism that enables unlearnable features, whilst at the same time allowing the user to revert unlearnable noise if authorisation is acquired. Authors evaluate Learnability lock with a number of datasets and network architectures to find that it outperforms its competitors in presence of defences.\n\n\n", "summary_of_the_review": "Paper presents an interesting construction for controlled learnability, but the setting of the paper seems to be a bit misleading. Paper argues that learnability lock provides privacy through their encryption scheme, yet in the same paper authors break their own scheme. Paper also provides no cryptographic underpinning as to why any privacy is provided at all.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "PXbHqZGEb3G", "reviewer": "Reviewer_BPLq", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Strengths**\n\n1\\. Well-motivated problem and reasonable results\n- Given the prevalence of data being shared and made accessible everyday, it becomes crucial certain authorized uses e.g., preventing malicious entities on training a facial classifier on provided data. This paper takes an interesting step towards addressing this issue. The authors also show certain benefits of the approach e.g., controlling access to who can train models on the given data.\n\n2\\. Writing\n- I highly appreciate the clarity in writing. The paper was clear for the most part and easy to follow. \n\n**Major Concerns**\n\n1\\. Significance of contributions over prior work\n- My first concern is the significance of the contributions over prior work and most notably with [1]. Similar to proposed approach, [1] also propose a bi-level minimization approach to introduce class-specific additive perturbations to prevent training on the perturbed dataset. My sub-concerns: \n- (a) it seems that the improvement of the proposed approach is primarily addressing a specific failure mode -- being more robust to adversarial training on the perturbed dataset. Apart from that, [1] seems to outperform the proposed approach in few other scenarios e.g., when comparing test accuracy (Table 1) [1] appears to outperform (esp. on CIFAR-100 and ImageNet).\n- (b) As for the technical contributions itself, the proposed approach also shares a bi-level minimization problem similar to [1]. But instead of learning fixed additive per-class perturbations, a network $g_\\psi$ is trained to perturb the inputs. Could the authors comment on technical benefits over previous approach? I see that in Table 9 remarks the benefits as \"adv. train\" (which is supported) and \"stealthiness\" (which is unclear; aren't both methods evaluated at a comparable $\\epsilon$?)\n\n[1] \"Unlearnable Examples: Making Personal Data Unexploitable\" Huang et al., ICLR '21\n\n2\\. Optimization formulation\n- I was also a bit unclear (or rather could not intuit) on how the optimization objective (3.1) makes the examples unlearnable.\n- Specifically, wouldn't the optimal $g_\\psi$ be an identity function which would lead to original 'clean' accuracy? In other words, if one were to take a pretrained $\\theta$, I reckon $\\psi$ would correspond to identity function?\n- I'm also wondering how the approach learns good parameters $\\psi$ in spite of an explicit term to maximize the loss of training on the perturbed dataset?\n- I would appreciate if the authors slightly elaborated (to complement an already nice discussion below eq 3.1) on the optimization problem.\n\n**Minor Concerns**\n\n1\\. Table 1\n- I think the results in Table 1 is comparable to previous approaches (e.g., Table 1 of [1])? I would appreciate the authors also added corresponding rows (or alternatively a more descriptive table in appendix) so that direct comparison with prior work when possible. As a reader, I had to flip back and forth to compare the numbers.\n\n2\\. Unauthorized use of perturbed dataset for other tasks\n- Are the authors aware whether training on $D_p$ fails only the envisioned task (e.g., 10-way multiclass classification over predefined CIFAR classes)? It seems problematic if the same images could be used for other tasks (e.g., face recognition) unforeseen by the creator.\n\n**Nitpicks**\n* \"Control over Single Class\": What is the accuracy of the model on locked bird class? What is the number in the heatmap of Fig. 2?", "summary_of_the_paper": "- The paper tackles the problem of 'unlearnable examples': to perturb the images of a labeled dataset $D_c$ to obtain $D_p$ with the desiderata (a) training models on $D_p$ leads to models with significantly lower performance (b) image perturbations are constrained to some $\\epsilon$-ball and (c) with the correct 'secret key' (learnable parameters in this case), one should approximate recover $D_c$.\n- The approach `learnability lock' to make the examples unlearnable involve a bi-level minimization objective over the original network parameters $\\theta$ and parameters $\\psi$ of a 'secret key' network $g_\\psi$ (which could be a linear layer or an invertible ResNet).\n- Experiments demonstrate among other things: (i) training networks on $D_p$ leads to poor performances and on unlocked $D_c$ to high performances (ii) the proposed approach is more robust to augmentation strategies (specifically adversarial training) compared to previous approaches.", "summary_of_the_review": "- Overall, the paper tackles a reasonably well-motivated idea of introducing perturbations to prevent unauthorized training over a labeled dataset. The authors show that the approach achieves this objective and is additionally more robust when compared to previous works.\n- My biggest concern is the significance of improvements over prior work, which appears limited to a highly specific failure mode. I would be glad to increasing my score if the authors could address this.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "C-UE2JaaHtB", "reviewer": "Reviewer_nYcf", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strong points:\n1. An advanced exploration of an important research direction. The idea of “learnability lock” appears fairly interesting, although it is motivated by the “unlearnable examples” idea. The “learnability lock” concept is one step closer to what these works try to achieve: giving data owners some real control of their own data without damaging (much) the original content.\n\n2. The proposed invertible noise generation method looks simple and effective, should be easily applied in real-world scenarios.\n\n3. The proposed method holds two advantages (invertible/controllability and robustness to adv train) over the prior work and these two advantages seem to be quite important for real-world usage.  \n\n4. The paper is well written, pleasant to read. The experiments are comprehensive. \n\nWeak points:\n1. It is not very clear why invertible transformation improves robustness to adversarial training. Although it explains somewhere, conceptually, multiplicative noise is more effective than additive noise, I think some experiments can be conducted to dig a bit deeper on this point. Looking forward to some explanations from the authors.\n\n2. The robustness to adaptive adversarial training part in the appendix is also important. I suggest the authors provide a paragraph of analysis in the main text as well. Also, some experiments in the appendix are not mentioned in the main text.\n\n3. The experiment structure looks quite similar to Huang et al. 2021, I suggest the author acknowledge their work/setting in the experimental setting. \n\n4. The 100% unlearnable rate seems to be a remaining limitation of your and Huang’s work. Any thoughts on this?\n", "summary_of_the_paper": "This paper introduces the idea of “learnability lock” for data authorization. This paper along with three prior works mentioned in the paper are all creative works recently proposed for data protection, an important research topic that has been investigated much before.  Compared to the “unlearnable examples” work of Huang et al. 2021, this work proposes to use inevitable linear/convolution transformations to formulate the noise. This was demonstrated to have two benefits that seem to address two important limitations of previous works: 1) making the unlearnable noise more controllable so “learnability” can be flexibly locked and unlocked; 2) the noise seem can survive (to some extent) adversarial training now.", "summary_of_the_review": "Important research on data protection/authorization, simple yet very effective method, some level of technical improvements over prior work but addresses two key limitations, rich experiment, good writing. A quite solid paper overall. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "3m86ELjHm95", "reviewer": "Reviewer_ZETA", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The idea of using invertible adversarial transformation for securing the data is interesting and novel. The paper is very well written and structured. Numerous experiments are conducted to show effectiveness of the method for breaking the ML models when \"secured\" data is used and for training accurate ML models when the inverse transformation is applied. The authors also show that their method is more robust to adversarial learning than state-of-the-art additive perturbation methods. The method is shown to be robust to strong data augmentation and filtering techniques which are often used as defense methods. Finally, the authors conduct experiment to show that when two different adversarial transformations are computed, their keys can not be used to unlock each other's transformation. \n\nI have two questions for the authors: \n1. What data was used to train the attacker model (f_theta)? Also, I can see that the ResNet-18 model was used for computing the attack, did you try to use other backbones? Does the attack still transfer to other model in this case? It would be great to elaborate on that somewhere in Experiments section. \n2. In section 4.3 it is said \"we train two learnability locks for each transformation separately\". When learning two transformations from the same data, how can one control that the transformations will be different and that the model will not converge to the same solution twice? \n", "summary_of_the_paper": "The paper proposes a new concept called \"learnability lock\" for securing distribution of sensitive data. The idea is to apply an invertible adversarial transformation when releasing the data, which makes the data \"unlearnable\" for machine learning models, but also preserves the visual properties of the data. Therefore, unauthorized practitioners can not use the data for training ML models, however authorized users can use specific key to invert adversarial perturbation and make the data \"learnable\" again. \n\nThe authors propose two invertible transformations to craft adversarial perturbations: linear pixel-wise transformation and convolutional functional transformation based on invertible ResNet. Numerous experiments demonstrate the effectiveness of the proposed transformations in both securing the data (making the data unlearnable when transformation is applied) and unlocking the transformation (making the data learnable when the transformation is inverted). ", "summary_of_the_review": "Overall, I believe that the idea of the paper is interesting and novel, the results are appealing. The writing is very clear and structured, the method is compared to other attacks and defenses and is shown to outperform previous methods. I vote for accepting the paper. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper considers a relevant and interesting problem of protecting the intellectual property of data. The goal of the proposed method is to prevent unauthorized usage of the data, and the protection is attained when a model trained on the perturbed dataset will predict poorly and thus cannot be considered as a realistic inference model by the unauthorized attacker. 

Technically, the paper tackles the problem of "unlearnable examples": to perturb the images of a labeled dataset to obtain perturbed dataset such that models trained on perturbed dataset have significantly lower performance, the perturbations are small, and one can approximately recover the original labeled dataset with the correct "secret key" (learnable parameters).

The authors propose two invertible transformations to craft adversarial perturbations: linear pixel-wise transformation and convolutional functional transformation based on invertible ResNet. Numerous experiments demonstrate the effectiveness of the proposed transformations in both securing the data (making the data unlearnable when transformation is applied) and unlocking the transformation (making the data learnable when the transformation is inverted).

The paper is well motivated and exhibits competitive results. Although there are some concerns about the similarity of the work compared with [1], we believe the additional constraint of this work, that one can approximately recover the original labeled dataset with the correct "secret key",  justifies a significant contribution. 

[1] "Unlearnable Examples: Making Personal Data Unexploitable" Huang et al., ICLR '21
Decision: Accept (Poster)