Transferable Unlearnable Examples
Authors: Jie Ren
Han Xu
Yuxuan Wan
Xingjun Ma
Lichao Sun
Jiliang Tang
Venue: ICLR 2023 poster (2023)
Keywords: Unlearnable Examples
Data Protection

Abstract: With more people publishing their personal data online, unauthorized data usage has become a serious concern. The unlearnable examples strategies have been introduced to prevent third parties from training on the data without permission. They add perturbations to the users’ data before publishing, so as to make the models trained on the perturbed published dataset invalidated. These perturbations have been generated for a specific training setting and a target dataset. However, their unlearnable effects significantly decrease when used in other training settings or datasets. To tackle this issue, we propose a novel unlearnable strategy based on Class-wise Separability Discriminant (CSD), which boosts the transferability of the unlearnable perturbations by enhancing the linear separability. Extensive experiments demonstrate the transferability of the unlearnable examples crafted by our proposed method across training settings and datasets.

Published as a conference paper at ICLR 2023
TRANSFERABLE UNLEARNABLE EXAMPLES
Jie Ren"
Han Xu"
Yuxuan Wan
Michigan State University renjies jinjie3ee @msu. edu
Michigan State University xuhan @msu. edu
Michigan State University panyuxua@msu.c edu
Xingjun Ma
Lichao Sun
Jiliang Tang
Fudan University singjunmat fudan. edu. en
Lehigh University 1is221@lehigh.cem
Michigan State University tang ji pililee 1@msu. edu
ABSTRACT
With more people publishing their personal data online, unauthorized data usage has become a serious concern. The unlearnable examples strategies have been introduced to prevent third parties from training on the data without permission. They add perturbations to the users' data before publishing, so to make the models trained on the perturbed published dataset invalidated. These perturbations have been generated for a specific training setting and a target dataset. However, their unlearnable effects significantly decrease when used in other training settings datasets. To tackle this issue, we propose a novel unlearnable strategy based on Class-wise Separability Discriminant (CSD), which boosts the transferability of the unlearnable perturbations by enhancing the linear separability. Extensive experiments demonstrate the transferability of the unlearnable examples crafted by our proposed method across training settings and datasets. The implementation of our method is available at hhthps//gihubb.oo//ejjee///////
INTRODUCTION
With more people posting their personal data online (intentionally or unintentionally), it has raised the concern that the data might be utilized without the owner's consent to train commercial or malicious machine learning models. While large-scale datasets collected from the Internet like LFunH al. 2008), Freebase(Bollacker advanced the development of deep learning, they may contain a certain amount of private data, which has the potential risk of privacy leakage. Thus, growing efforts (Huang et al.) 2020 Fowl iet al. 2021) have been made to protect data from unauthorized usage by making the data samples "unlearnable" (Huang et al. 2020 Fowl al. 2021 He al. 2022) These methods generate the unlearnable examples by injecting imperceptible "shortcut" perturbation. If the data is used by unauthorized training, the models will be tricked to extract such easy-to-learn shortcut features and ignore the real semantics in the original data (Geirhos et al.) 2020). Consequently, the trained model fails to recognize the user's 's data during the test phase and the user's data gets protected.
al.) 2008), and Pevceleb-lm@Gur et al. 2016) have greatly
As shown in Figure I the practical usage procedure of unlearnable examples (UEs) consists of two stages, i.c., the generation stage and the evaluation stage. Before releasing data, in the generation stage, one make the data unlearnable by adding perturbations into original data. According to whether the label information is used to generate the perturbations, we divide the UEs into Supervised UEs which is generated with the guidance of the label information, and Unsupervised UEs which is generated without the guidance of label information. In the evaluation stage, the unlearnable version of data is released the public, and the unauthorized third parties might use different algorithms, like supervised training and unsupervised training, to learn from the data. The UEs aim to provide protection this stage against unauthorized training and invalidate the models trained on them.
However, existing UEs are in lack of saining-wise transferability and have weaknesses in data- wise transferability in the evaluation stage. First, low training- wise transferability implies that the perturbed samples generated towards one target training setting cannot be transferred to other
Equull contribution.

---

Published as a conference paper at ICLR 2023
Generation stage:
Evaluation stage: Test protection against unauthorized training
Generate UEs with/without labels
Supervised UEs
supervised
clean
(Gonerated using labels)
classifier
Release to the public
OR
Unsupervised UEs
unsupervised festure extrector de
liner probing R.
(Generated using no labels)
Figure I: Two stages of Unlearnable Examples.
training settings. As shown in Section 3.2. although Error-Miimmizing Noise (EMN) (Huang et al.
2020) can protect data from supervised training, we can use unsupervised learning methods, such as Contrastive Learning (Chen et al. 2020at Chen & He 2021] Chen al.. 2020b), extract useful representations from the EMN-protected dataset and obtain high accuracy. In this way. the perturbed dataset is still exposed no protection. Second, insufficient data-wise transferability indicates that the unlearnable effect of perturbations generated for one target dataset will significantly decrease when transferred to other datasets. We have to generate perturbations for each dataset, reducing its flexibility in real-world scenarios. For example, data in various applications such as social media is dynamic or even streaming, which makes it extremely challenging to generate the entire perturbation set when new data is continuously emerging.
In this work, we aim to enhance the training-wise and data-wise transferability of unlearnable examples. In detail, our method is motivated by Synthetic Noise (SN) Yu al., 2021). which devises a manually designed linear separable perturbation to generate UEs. Such perturbations do not target specific dataset, thus it has the potential to enhance data-wise transferability. However, SN is manually designed and it is not quantifiable or optimizable. As such, it is impossible to incorporate SN into other optimization processes. Meanwhile, SN lacks training-wi -wis transferability. Therefore, in this work, we propose Class-wise Separability Discriminant (CSD) to generate optimizable linear- separable perturbations. Our framework Transferable Unlearnable Examples with enhanced linear separability can generate UEs with superior training- maiingg-wise wise and data-wise transferability.
2 RELATED WORK
Unlearnable Examples. Unlearnable examples are close to availability attack which aims at making
the data out of service for training the models by the unauthorized third parties (Muñoz-González
cct al. 2017 Several supervised UEs are proposed (Huang et al. 2020; Fowl et al. 2021 Shan et al. perturbations into the clean samples (Huang et al.) 2020). Being induced to trust that the perturbation minimize the loss better than the original image features, the model will pay more attention the perturbations. Unlearnable Contrastive Learning (UCL) is proposed (He et al. 2022) to generate UEs protect data from unsupervised learning. Our studies show that both Supervised and Unsupervised UEs lack training wise transferability as shown in Section B.2.1 and summarizes the settings of existing methods, where means ineffective protection.
2020 The vanilla unlearnable examples are crafted by generating and adding unlcarnable
Jand Appendix A respectively. Table I
Table I: Unlcarnalee Examples Settings of Existing Approaches
Generation Evaluation
Supervised Training
Unsupervised Training
Supervised Unleamability
(Huang et al. 2020 Fowl et ul. 2021
X
Unsupervised Unlearnability
X
He et al. 2022
Unsupervised Learning, Recently, unsupervised learning has shown its great potential to learn the representation from unlabeled data. Contrastive learning, one of the popular unsupervised methods. uses the task of instance discrimination to learn the representations. In SimCLR (He et al.) 2022) which is the most common contrastive learning method, the positive and negative samples for each instance are created and the task is to discriminate the positive samples and negative samples. Some methods like SimSiam (Chen & He 202T) and BYOL (Grill et al.. 2020) can remove the negative samples and only focus on pushing the representations between positive samples to be similar.
PRELIMINARY
In this section, preliminary studies are conducted to explore two types of transferability. We first introduce key notations and definitions, and then show the insufficiency of transferability. Since the majority of UEs are guided by label information, in this work, we focus Supervised UEs
2

---

Published as a conference paper at ICLR 2023
and leave Unsupervised UEs as one future work. Note that the observations of Supervised UEs in terms of transferability could be applicable to Unsupervised UEs. For example, in Appendix A we show that Unsupervised UEs also lack training-win wise transferability.
3.1 DEFINITIONS
In this subsection, we give the definition of UEs and then define the two types of transferability. Unlearnable Examples. Suppose that the dataset contains n clean examples De = {(22;, 34) 3:) with the input data Φ; E X C IRd and the associated label y/ E y = 2 2........ ..,K., K]. We assume that the unauthorized parties will use the published data to train classifier fo X + 3/ where @ is the model parameters, and do inference on their test dataset. To protect the data from unauthorized training, instead of publishing De. we generate an unlearnable dataset as D, {(ar; + 5, yo )= where ò, E AD. C Ød and ÅD. is the perturbation set for De. The goal of unlearnability is that if we only publish D., the model fo trained on Du performs poorly on the test dataset. Benefiting from the constraint |0||, I Du appears the same as Dr in human eyes. The perturbed example æ; 5; is known as the unlearnable example. The most representative EMN (Huang et al.) 2020) generates supervised UEs by alternating optimization on the bi-level problem:
min
min
Cfo (z, + 6.).
(1)
The outer minimization can imitate the training process, while the inner minimization can induce ò; to have the property of minimizing the supervised loss. Due to this property, deep models will pay more attention to the easy-to-learn ò; and ignore 2;,
Training-wise Transferability. Supervised unlearnable examples have been designed to protect data from supervised training in the evaluation stage (Huang et al.) 2020). However, the unlearnable effect is almost lost if they are utilized for unsupervised training. The unauthorized parties can first get a useful feature extractor In from D,, by unsupervised training like Contrastive Learning (Chen) et al.) 2020a) and then fine-tunes on D, other data to get the classifier hg. The training-wise transferability means that supervised unlearnable examples can invalidate 9n when transferred into unsupervised training.
Data-wise Transferability. When a second dataset, D;- = {( (.) where i; E X C IRd and d E 5 {1, ...., K)). K}. also requires protection, it is more efficient and practical if we can transfer the perturbation that has already been generated for D. onto Dz. If the perturbation, Ap. is data-wise transferable, we can quickly create an unlearnable dataset Da to replace Dz before publishing as Da = (( + ())()) Hi) where &. E De. 5н(() E AD, and H (i) decides which perturbation in ÅD. is added on 2; in the new dataset, Dz. Without retraining the perturbation set, the unseen D;
is also protected by transferring the unlearnable perturbations from AD.
clean
EMN UCL
3.2 TRANSFERABILITY IN EXISTING METHODS
100.0%
93.8
92.9
90.0
89.8
In this subsection, we show that existing supervised unlearn- able examples have almost no training- wise wise transferability and insufficient data-wis, transferability.
80.2%
60.26
47.8
3.2.1 TRAINING- WISE TRANSFERABILITE
40.2%
In Fig. 2 the experiments demonstrate the ineffective protec- tion of two existing Supervised UEs, i.e. Error-Minimizing Noise (EMN) (Huang et al.) 2020) and Synthetic Noise (SN) YYu et al. 2021) when they are transferred into un- supervised training in the evaluaton stage. The UEs for CIFAR-I0 (Krizhevsky et al. 2009) are generated and then applied to prevent either supervised (standard training with cross-entropy loss) or unsupervised (SimCLR plus linear probing (Chen et al. 2020al) training of ResNet-18 (He et al. 2016). Fig. shoows the test accuracy (accuracy on the original clean test set) of the target models obtained under different training settings. An extremely low test accuracy indicates successful unlearnable protection. EMN decreases the accuracy of supervised training from 93.8% to 14.7%, but only decreases the accuracy of unsuper- vised training by 0.2%. This suggests that EMN has almost no unlearnable effect under unsupervised learning and thus has extremely low training-wir transferability, which is also the case for SN.
20.3%
14.7
supervised learning unsuperivsed learning Figure 2: Acc. on clean test data of super- vised and unsupervised models trained on clean and EMN-pertubed CIFAR-10
3

---

Published as a conference paper at ICLR 2023
(i) original corresponding
(b) inira-class swap
(c) inter-class swap
Figure 3: Original one-to-one correspondence and two swapping methods.
3.2.2 DATA-WISE TRANSFERABILITY
In this subsection, investigate data-wise transferability for EMN and SN. As introduced in Eq. EMN has been designed to induce ó; to minimize the loss in supervised training on zy Therefore, EMN generates UEs based target data. Next, we will show the data-wise transferability of EMN on non-target data samples and non-target datasets. For 5, the target sample is x,, while the non-target samples are all the other samples x, in De. where + i. For the whole perturbation set AD., the non-target dataset is any other dataset Dz. Since ó, focuses on the target sample x,, we will first show the reduction of unlearnable effect on non-tare non-target samples. Then we will demonstrate that the perturbation set Ap, for De cannot hold the strong unlearnable effect on non- -on-ttrget dataset, De.
On non-target samples, we change the assignment between perturbations and samples by intra-class swapping and inter-class swapping as shown in Fig. [ Specifically, for inter-class swapping, we apply the unlearnable noise generated for sample æ; a different sample v, from different class (i.e., V/ * yy) via random permutation. For intra- clats- swapping, we swap the noise between samples from the same class also via random permutation. The two sample transferability swaps are illustrated in Fig. 3 As shown in Table 2 the unlearnable effect decreases significantly under both intra-class and inter-class swapping.
On non-target datasets, EMN is also limited in data-wise transferability. We first generate the perturbations Ap. on CIFAR-10 10 and then choose another non-target dataset SVHN-small, which is non-targe dataset De to protect. CIFAR-10 has
downsampled from NNeter et al.]2011| ten classes, where every class has 5,000 training images. SVHN also has classes, but some classes have more than 5,000 training images. Thus we sample 5,000 training images in every class from SVHN and construct SmHN-small. In Table 3 we first generate EMN on SVHN-small to protect target dataset, i.e. SVHN-small. It protects the data from unauthorized training and reduces the test accuracy to only 11.64% But when we use EMN generated on CIFAR-IO to protect SVHN-small SVHN-small becomes non-target dataset. More information is learned from SVHN-small and the test accuracy is 27.59% which means the non-targe target dataset gets less protection.
Table 2: Comparison of supervised unlearnable Table 3: Comparison of supervised unlearnable examples on target and non-targe non-target samples. examples on target and non- non-target datasets.
CIFARIO
CIFARI00 FMN
Tested on SVHN-small EMN
Corresponding
Generated on
FMN
SN
SN
SN
Original
15.88
14.07
6.59
2.13
SVHN-small CIFAR-10
11.64 27.59
8.46
Intra-class swap
30.74
13.59
21.63
2.44
9.58
Inter-class swap
30.15
13.15
35.50
2.73
We conducted similar experiments for SN (Yu et al. 2021 The results for non-target samples respectively. We observe that SN is data-wise transferable. According to (Yu al. 2021), SN can create linear separability that the label-related imperceptible perturbation is linearly separable between different classes, as a shortcut for the optimization objective. In other words, the linear separability is only between d, and yi and not related to Z;. This indicates the importance of linear separability for data-wise transferability. However, SN is generated by sampling from a manually designed distribution and the sampling process is incompatible with an optimization process. Thus, it is hard to directly incorporate SN into other optimization objectives to enjoy linear separability for data-wise transferability.
and non-target datasets are illustrated in Table 2 and Table 3
3.3 DISCUSSIONS
As shown by the above preliminary studies, both EMN and SN lack training -wie transferability. and EMN has insufficient data-wise transferability. Meanwhile, found that the linearly separable SN perturbation that is independent on the data has good data-wise transferability. However, the manually designed linear separability of SN is unable be leveraged by other optimization objectives. Thus in
4

---

Published as a conference paper at ICLR 2023
the next section, we propose Class- Separabilityy Discriminant and a new framework generate unlearnable examples with training-wii -wise and data-wise transferability.
TRANSFERABLE UNLEARNABILITY FROM CLASSWISE SEPARABILITY DISCRIMINANT
In order to improve the two types of transferability of unlearnable examples, we propose the optimiz- able Class wise Separability Discriminant (CSD) to quantify linear separability. Furthermore, propose Transferable Unlearnable Examples (TUE) that have superior training wise and data-wise transferability. In the evalaution stage, not only generalizes the protection scenario from supervised to unsupervised training but also maintains the unlearnability when transferred to non-target datasets.
4.1 CLASSWISE SEPARABILITY DISCRIMINANT
Linear separability lies in two factors, i.e., intra-class distance and inter-class distance. Intuitively, better linear separabilityy means smaller intra-class distance and larger inter-class distance. In the context of UEs, smaller intra-class distance means that perturbations from the same class concentrate on a small area in the input space, while larger inter-class distance means that perturbations of different classes are far away from each other. When the overlapping area between different classes reduced by smaller intra-class distance and larger inter-class distance, the perturbations can become features that are easily separated by even a linear classifier. For measuring the intra-class and inter-class distances, we first define the centroid of the perturbations for one class: = [6,:9==]] R|] Σ (d): 8,, where {ō, y/ = k} are the perturbations for class k. Then we have the intra-class distance as:
1
Σ d().,c.), =.;;)=}}
0 16; : y1 k}
where d(.;) )) is the Euclidean distance. d measures the average distance between the perturbation 8, whose label is k to the centroid cs. The inter-class distance is defined by the Euclidean distance between two centroids:
d, d (ci,c))
To enhance the linear separability with an optimizable objective function, we propose Class-wise Separability Discriminant (CSD):
M-1
LesD((5, (EL =
1 M
1
Σ
a + o,
(4)
M
d
where M is the number of classes, and y; represents the ground truth label for sample æ; D... is worth mentioning that LesD (6, yi } is not related to æ;, which means that 6; is generated independently on H; o and σ,, measure the intra-class distance of class and class j. respectively; ds,; measures the inter-class distance between class i and class j. The ratio between intra-class
o,ta, defines the overlapping between two classes. Better distance and inter-class distance, d,, clustering distribution has smaller intra-class distance and larger inter-class distance, leading lower ratio and smaller overlapping area between two classes. Therefore, smaller CSD value indicates more compact classes and separable clusters, i.e., better linear separability.
4.2 TRANSFERABLE UNLEARNABLE EXAMPLES
As discussed in Section 3.2.2 linear separability plays an essential role in supervised unlearnability and data-wise transferability. In order to enhance the data-wise and training-wiss transferability of UEs simultancously, we incorporate linear separability into unsupervised unlearnable examples, resultign in the Transferable Unlearnable Examples (TUE) framework. In particular, TUE uses contrastive learning as the unsupervised backbone and embeds linear separability via CSD into unsupervised unlearnability. Since TUE uses label information CSD, is one kind supervised unlearnable example methods. Most contrastive learning algorithms, such SimCLR (Chen et al.) 2020a), MoCo (Chen et al.) (020b) and SimSiam (Chen He 202T). enforce the similarity between two augmentations of the same samples to learn a representation. TUE generates the perturbation that not only promotes this similarity but also has linear separability, via the following bi-level optimization problem:
5

---

Published as a conference paper at ICLR 2023
Σ La (1(0,T + (r))) fa
(O, (2 + 8:))) + (CsD(((6 Di)= (5)
min min 6: Sc)
where LaL is the loss of contrastive learning, and A is the weight to balance between two loss terms. Ti and T3 are augmentations on input data. The first term Eq. that the generated perturbation has the property of promoting the similarity between two augmented views of the same sample to reduce LCL. this way, the perturbation provides easy-to-learn shorteut information for unsupervised learning such that the model will learn to extract the perturbation instead of the intrinsic semantic information in the data. In other words, the first term is to ensure the unlearnability against unsupervised training. The second term can enhance the linear separability of the perturbations. Furthermore, we propose to solve this bi-level optimization problem in Eq. Flattemately:
S1 ((0) arg min
Σ La (S(O.Ti(w) + 8), (0, (0 6!(-)))
B.EDo
(6)
$2 800) arg LeL (I(000, + 6.)). T2(a, + 6.)) + ALcsu (.
(
In the first step (SI), we update the model parameter 0 minimize the unsupervised loss LCL, while in the second step (S2) we optimize the perturbation { to jointly reduce the unsupervised loss and force the linear separability among different classes. By the bi-level optimization on unsupervised loss and CSD, we can generate UEs with both data-wise and training-wiss transferability.
Interpolation for data-wise transferability. Once the generation stage is completed the training dataset, De, we can directly transfer the obtained perturbation to a new dataset, Dü Nevertheless, it possible that the number of classes in D. or the number of samples in one class in D, is less than De. The generated perturbation may not cover every sample in De. To solve this problem, we use interpolation create more perturbations. Interpolation can make use of current perturbation in Ap, to enlarge its size and transfer to a larger dataset. If more classes are required, we can interpolate between two current classes D. to create new classes:
o ad; + (1 a)oj, where ys # y/-
If more samples (in one class) are required, we interpolate within the class create samples:
8 = ad; + (1 a)oj where yi y/-
(8)
By varying a, more than one sample can be created from the interpolation between 8, and 5y- Empirical results in Section 5.3 show that this interpolation strategy works very well.
5 EXPERIMENT
In this section, validate the types of transferability of TUE. (.ItiionS.][introoddoe the experimental setups. Section (5.2] and Section 5.3 present the results on the improved training-wis wise and data- transferability, respectively. Section 5.4 illustrates the enhanced linear separability in input space by visualization. And Section [5.3]shows that TUE has both class-wise and sample-wise characteristics. Additional experiments can be found in Appendix and Appendix D which include visualization of interpolation, comparison with other methods, unlcarnability on partly perturbed dataset and so on.
5.1 EXPERIMENTAL SETUPS
Datasets. The datasets include CIFAR-10 10 and CIFAR- 100 (Krizhevsky al. 2009). which contain
50,000 training images and 10,000 test images, and SVHN (Netzer et al.] (011). which contains 73,257 training images of ten classes and 26,032 test images. We randomly sample from SVHN to construct SVHN-small where the number of training images in every class is no more than 5000.
Baselines. We use three representative unlearnable examples
baselines, which Error- Minimizing Noise (EMN) (Huang et al.] (020). Unlearnable Contrastive Learning (UCL) (He) al. 2022 and Synthetic Noise (SN) (He et al. 2022). More details can be found in Appendix B.
Generation and Evaluation settings. All the perturbations, except SN that is sampled from a distribution, are generated by PGD (Madry et al. 2018) on 18 and constrained by || < with e = 8/ 8/255. In the evaluation stage, we use cross-entropy loss in supervised training and linear probing after contrastive pre- pre-training unsupervised training. The supervised model is trained for 200 epochs. The unsupervised model is pre- pre-trained for 1000 epochs and fine-tuned for 100 epochs. More hyperparamaters for generation and evaluation can be found in Appendix B.2

---

Published as a conference paper at ICLR 2023
Backbones. We generated TUE three unsupervised backbones, SimCLR (Chen et al. 2020a), MoCo (Chen et al. 2020b) and SimSiam (Chen & Hc 2021). The backbones are also used in UCL. EMN is generated on the backbone architecture of ResNet-18 18 in supervised setting. SN has backbone in the generation stage and is directly sampled from the manually designed distribution.
Table 4: Test accuracy (%) of ResNet- 18 trained on clean data vs. UEs by EMN, SN, UCL and TUE. TUE and UCL are generated on different unsupervised backbones. Under each backbone, the UEs are applied to the same unsupervised learning plus linear probing in the evaluation stage. The generation processes of EMN and SN are always the same regardless of evaluation and backhone of unsupervised leamning EMN and SN also tested under three backbones the evaluation stage for comparison.
Dataset
Backbone
Evaluation
Clean
EMN
SN
UCL
TUE
Supervised
93.79
14.74
19.23
92.86
10.67
SimCLR
Unsupervised
90.04
89.79
88.93
47.78
52.38
CIFAR-10
Supervised 93.79
14.74
19.23
92.62
10.06
MoCo
Unsupervised
89.90
89.18
89.32
44.24
63.38
Supervised 93.79
14.74
19.23
93.50
10.03
SimSiam
Unsupervised
90.59
91.43
91.54
30.43
35.57
Supervised 74.49
5.23
2.13
72.17
0.76
SimCLR
Unsupervised
63.68
62.00
62.31
16.68
19,51
CIFAR-100
Supervised 74.49
5,23
2.13
71.59
1.09
MoCo
Unsupervised
63.03
60.62
61.81
18.74
23.60
Supervised 74.49
5.23
2.13
71.84
1.21
SimSiam
Unsupervised
64.69
65.96
66.83
4.64
6.17
5.2 TRAINING-WISE TRANSFERABI UNLEARNABILITY
As mentioned above, existing UEs focus on one training setting, either supervised or unsupervised training. In this work, we use the proposed TUE to make the dataset unlearnable both supervised and unsupervised training settings and thus protect the data from unauthorized training in a comprehensive way. Table we reported the comparison on CIEAR- and CIFAR- -10 with supervised training by cross-entropy loss and three unsupervised training methods. The unlearnable examples are evaluated by two training settings, supervised and unsupervised training. When testing with unsupervised training, we use the corresponding unsupervised algorithm that is used to generate TUE.
Thole the model accuracy on clean test data after being trained on unlearnable data. First, we observe that existing unlcarnability methods can work under one training setting, but have almost no protection under the other training setting. Specifically, EMN and SN reduces the test accuracy of supervised training to less than 20% on CIFAR- and less than 6% on CIFAR- 1100 but cannot transfer well in all of the three unsupervised trainings. UCL reduces the accuracy of unsupervised training to less than 50% on CIFAR-10 10 and less than 20% on CIFAR- 100 but has almost no effect against supervised training. Second, TUE can hold the unlcarnability in both supervised and unsupervised training settings. It reduces the supervised accuracy to around 10% on CIFAR- 10 and 1% CIFAR- 100 and reduces the unsupervised accuracy to a comparable level to UCL. In particular, it can even perform better than EMN in supervised training. The test accuracy of unauthorized classifiers trained on TUE is around 4% lower than EMN on both CIFAR-10 and CIFAR- 100. It indicates that the enhanced linear separability can mislead supervised models focusing more TUE perturbation than EMN perturbation. In summary, from Table 4 we can see that TUE has good training-wiss transferability, which can maintain the unlearnable effect when being transferred from supervised training to unsupervised training and it is the only one that maintains the unlearnabl effects under two training settings.
5.3 DATA-WIEE WISE TRANSFERABLE UNLEARNABILITY
In this subsection, show that TUE also has better data-wise transferability, i.e., the perturbations generated with TUE on one dataset can also protect any other datasets from unauthorized supervised training. Following the experimental settings in the preliminary studies of Section 3.2.2] test the data-wise transferability first on non-target data samples, and then on non-target datasets. The results reported in Table and Table respectively.
7

---

Published as a conference paper at ICLR 2023
Table 5: Test accuracy (%) with different correpondings Table 6: Test accuracy (%) of transferring perturba- between train data and perturbations.
tion generated on CIFAR- 10 to different datasets.
Dutasel
Methods
Original
Intra
Inter
SVHN-small
CIFAR-100
SVHN
CIFAR-10
EMN SN TUE (SiMCLR)
15.88
30.74
33.91
EMN SN TUE (SimCLR)
27.59
21.80
24.72
14.07
13.59
13.15
9.58
9.35
7.77
10.67
10.16
10.90
9.77
10.53
11.72
TUE (MoCo)
10.06
12.04
8.57
TUE TUF (MoCo)
11.29
8.32
13.95
TUE (SimSiam)
10.03
10.25
10.47
TUE (SimSiam)
10.28
5.10
12.93
CIFAR-100
EMN SN TUE (SimCLR)
6.59
21.63
35.50
2.13
2.44
2.73
0.76
1.11
1.13
TUB (MoCo)
1.09
1,25
3.63
TUE (SimSium)
1.21
1.28
1.08
First, for non-target data samples, we compare the performance under 1) the original correspondence. 2) intra-class swapping, and 3) inter-class swapping between samples and perturbations in the same dataset. In T it is evident that our TUE can maintain high unlearnability (low test accuracy) under different correspondences on CIFAR-10 and CIFAR-100 100. Particularly, on CIFAR- 100, the test accuracy of EMN under intra-class and inter-class swappings are roughly 15% and 29% higher than that in the original correspondence, but for TUE, the difference in the test accuracy under different correspondences less than 3%. Although we can also notice this data-wise transferability in SN, is not optimizable method and is unable to be used for improving the training-wis wise transferability.
Second, verify data- wise transferability test the performance of transferring onto three datasets, SVHN-small, CIFAR- 100 and SVHN. TUE on CIFAR-10 10 can be directly transferred SVHN-small without interpolation, while CIFAR-100 requires interpolation for more classes and SVHN requires interpolation for more samples. The baseline methods are also interpolated in the same way for comparison. In Table 6 we can observe that on all the datasets, TUE can maintain the unlcarnable effect onto all the other datasets. The enhanced linear separability of TUE ensures that the test accuracy is low. For example, EMN has poorer protection after transferred onto SVHN-small with the accuracy of 27.59%, but TUE can maintain the unlearnability on non-target datasets for all the backbones at around 10% accuracy.
non-target datasets, we generate TUE CIFAR-10 10 and
From Table and Table we can draw the conclusion that the proposed TUE has better data-wise transferability than aptimization-basel unlearnable methods like EMN, and our strategy to transfer TUE to protect other datasets can be very efficient.
5.4 LINEAR SEPARABILITY OF TRANSFERABLE UNLEARNABLE EXAMPLES
In this subsection, we visualize the clusters formed by different types of UEs to gain deeper under- standings of how linear separability influences unlcarnability. Particularly, we use t-SNE (Van der Maaten & Hinton, 2008 to show the perturbation in the input space. Although t-SNE cannot accu- rately describe the high-dimension space, it is useful to observe the separability of the perturbations in the input space. We compare the perturbations in the input space in the following three groups
Comparison of Linear separability in super- vised unlearnable examples. In Fig. we show the perturbations of EMN, SN and TUE to understand why linear separability is more effective than EMN when used in supervised classification. In Fig. 4 the perturbations of different classes in TUE and SN are clearly separated and have no overlapping. In contrast, EMN has some data points mixed with other classes which are confusing when used in clas- sification. Meanwhile the clusters EMN do not contract as well as TUE and SN. Since better linear separability can provide useful information about classification, the supervised model will focus on TUE and SN more than EMN and ignore the semantic features in clean images.
(c) TUB Figure 4: t-SNE visualization of linear separability of supervised unlcarnable examples.
(a) EMN
(b)
Linear separability in Interpolation. In Fig. 5 we show that the interpolation on TUE from CIFAR- 10 to SVHN and CIFAR- 100 can also hold linear separability which makes it dita-wise transferable. We can observe that in the interpolation for SVHN although the size of each class different,
8

---

Published as a conference paper at ICLR 2023
they can still hold clear linear separabilityy and unlearnbility. In SVHN, the interpolation within classes creates more samples for one class. Since the numbers of examples in different classes in SVHN are different, it can be observed that some clusters much larger than others. For CIFAR-100 more classes are created and they still keep good linear separability. So the supervised model trained on interpolation-based unlearnable SVHN and CIFAR- R-100 will learn nothing but the perturbations and perform poorly on clean test data which has no perturbations.
Interpolation: SVHN Interpolation: CIFAR-100 Figure 5: I-SNE visualization of linear separability of interpolations.
Comparison of Linear separability between supervised and unsupervised unlearnability. In Fig. 6 we show the perturba- tions of UCL and TUE in input space to understand why UCL cannot help with unlearnable effects in supervised training. TUE is linear separable, which can be used to protect the data from both supervised and unsupervised training. But for UCL, all the perturbations are mixed, they cannot provide the class informa- tion for supervised training. So for supervised model, UCL not a helpful feature and will not vanquish the semantic feature.
(a) UCL Figure 6: I-SNE visualization of linear separability of supervised and unsu- pervised unlearnability.
(b) TUE
5.5
CASE STUDY
In this subsection, by showing the patterns of the perturbations generated by different methods, we can deepen our understanding on linear separability in TUE and observe the classwise and samplewise characteristics, which reflect the basic idea behind trainingwwise transfcrability.
Original sample
EMN
UCL
TUE (ours)
Class 1: horse
Class 2: airplane
Figure 7: Visualization of unlearnable examples of EMN, UCL and TUB(ours). We rescale the perturbation from [-8/255, 8/255] to [0.1] for better visualization.
We illustrate the samples and unlearnable perturbations from classes of CIFAR-10, i.e., horse and airplane, in Figure 7 First, we find that EMN and TUE both have class-wise noise patterns. Every noisy sample has consistent patterns one class, while every class has different feature pattern from other classes. This is new perspective to show that TUE has linear separability and perturbations from the same class are clustered in input space. Second, in UCL, the perturbations can be more diverse and related to each sample, which indicates that unsupervised unlearnability requires more complex feature patterns. We cannot see the class-wise patterns like EMN. Because UCL uses no label information and has no concept of classes. Third, we notice that TUE has both class-wise and sample-wise characteristics as expected. The class-wise feature can be the easy-to-learn feature for the supervised model, while the samplewise feature can be effective in reducing unsupervised loss, which makes the unlearnability transferable from supervised training to unsupervised training. In summary, from the case study, features provide supervised and unsupervised protection at the same time. The linear separability makes the supervised unlearnability data-wise transferable.
observe that the co-existing class- class-wise and sample-wise
6 CONCLUSION
We reveal the limitation of training-win wise and data-wise transferability in existing UEs and propose CSD to enhance transferability. The proposed Transferable Unlearnalee Examples has training-win wise transferability and can protect data from unauthorized usage in a comprehensive way. Meanwhile, TUE has data-wise transferability and can generate unlearnbility once for all, which makes UEs more practical and efficient. TUE greatly pushes the boundary of existing unlearnable methods that can only work on the target data and target training setting. We improve the data-wise and training wise transfcrability of unlearnable examples and provide more flexible, practical, and comprehensive protections from unauthorized data usage.

---

Published as a conference paper at ICLR 2023
ACKNOWLEDGMENTS
Jie Ren, Han Xu, Yuxuan Wan and Jiliang Tang are supported by the National Science Foundation (NSF) under grant numbers CNS1815636, ISS145081, IIS1928278, IIS1955285, IIS2212032, IIS2212144, IO$2107215, and IOS2035472, the Army Research Office (ARO) under grant number 191 the Home Depot, Cisco Systems Inc, Amazon Faculty Award, JohnsonJohnson and SNAP. Xingjun Ma is in part supported by the National Key R&D Program of China (Grant No. 2021ZD01 12804), the National Natural Science Foundation of China (Grant No. 62276067), and the Science and Technology Commission of Shanghai Municipality (Grant No. 2251 22511006 106102).
REFERENCES
Kurt Bollacker, Colin Evans, Praveen Paritosh, Tim Sturge, and Jamie Taylor. Freebase: collabora- tively created graph database for structuring human knowledge. In Proceedings of the 2008 ACM SIGMOD international conference on Management of data, pp. 1247-1250, 2008.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning, pp- 1597-1607. PMLR, 2020a.
Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In Proceedings of the IEEF/CVE Conference on Computer Vision and Pattern Recognition, pp. 15750-15758, 2021.
Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He. Improved baselines with momentum contrastive learning. arXiv preprint arXiv:2003.04297, 2020b.
Liam H Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojeiech Czaja, and Tom Goldstein. Adversarial examples make strong poisons. In Advances in Neural Information Processing Systems, 2021.
Robert Geirhos, förn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A Wichmann. Shortcut learning in deep neural networks. Nature Machine Intelligence, 2(1 1):665-673, 2020.
Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, et al. Bootstrap your own latent-a new approach to superviedd learning. Advances Neural Information Processing Systems, 33:21271-2122 2020.
Yandong Guo, Lei Zhang, Yuxiao Hu, Xiaodong He, and Jianfeng Gao. Ms-celeb-Imi Im: A dataset and benchmark for large-scale face recognition. In European conference on computer vision, pp. 87-102. Springer, 2016.
Hao He, Kaiwen Zha, and Dina Katabi. Indiscriminate poisoning attacks unsupervised contrastive learning. arXiv preprint arXiv:2202. /202, 2022.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Gary B Huang, Marwan Mattar, Tamara Berg, and Eric Leamed-Miller. Labeled faces in the wild: A database forstudying face recognition in unconstrained environments. In Workshop on faces in Refe- Images: detection, alignment, and recognition, 2008
Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearn- able examples: Making personal data unexploitable. In International Conference on Learning Representations, 2020.
Alex Krizhevsky, Geoffrey Hinton, al. Learning multiple layers of features from tiny images. 2009.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
10

---

Published as a conference paper at ICLR 2023
Luis Gantzzzz,,zzlez, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C Lupu, and Fabio Roli. Towards poisoning deep learning algorithms with back-gree graddeet optimization. In Proceedings of the 10th ACM workshop artificial intelligence and security, pp. 27-38, 2017.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. Fawkes: Protecting privacy against unauthorized deep learning models. In 29th USENIX Security Symposium (USENIX Security 20). pp. 1589-1604, 2020.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9(11), 2008
Da Yu, Huishuai Zhang, Wei Chen, Jian Yi,, and Tie- Yan Liu. Indiscriminate poisoning attacks are shortcuts. arXiv preprint arXiv:2111.00896 2021.
A EXISTING UNLEARNABLE METHODS CANNOT PROTECT UNLABELED DATASET IN A TRAINING- WISE TRASNFERABLE WAY
Previous unlearnable methods can only protect data from one unauthorized training setting. According to whether the dataset is annotated, unlearnable examples can be classified in two settings, supervised and unsupervised unlearnable examples, as mentioned in Section 2 The supervised unlearnable methods, like EMN, can create unlearability based on the label information and protect the data from supervised training, but these methods cannot prevent the unauthorized parties from training the data with an unsupervised algorithm. Similarly, the unsupervised unlearnable examples produced by Unleanrable Contrastive Learning (UCL) He et al. (2022) can destroy the unsupervised training but they are still learnable in the supervised training. supervised training from 93.8% to 14.7%, but only decreases the accuracy of unsupervised training by 0.2%. Similarly, SN decreases supervised training to 14.15 ,, but only decreases unsupervised training by 1.1%. Supervised unlearnable examples have almost no training-wis wise transferability to unsupervised training. UCL, which produces unsupervised unlearnable examples, can protect data from unsupervised training, but cannot be transferred well to supervised training. Under unsupervised training, UCL can decrease the test accuracy from 90.0% to 47.8%, but under supervised training, can only decrease the accuracy by 0.9%.
Fig. EMN decreases the accuracy of
clean
EMN
SN
UCL
100.0%
93.98 13.88%
92.9%
90.0% 89.5%
60.0%
47.8%
40.0%
20.0%
15.9%
0.0%
supervised
unsupervised
Figure 8: Accuracy on test data of classifiers produced by supervised training and unsupervised training the unlearnable examples from CIFAR-10
11

---

Published as a conference paper at ICLR 2023
B DETAILS OF EXPERIMENTAL SETTINGS
B.I DETAILS OF BASELINE METHODS
EMN (Huang al, 2020 generates the easy-to-learn feature by inducing the perturbations to reduce the supervised cross e loss via alternating optimization on the bi-level min-min problem:
min 0
mii 1:1|
(Jo (a:, + v.).
6:6
Se
The outer minimization can imitate the training process, while the inner minimization can induce ó; to have the property of minimizing the supervised loss. Due to this property, deep models will pay more attention to the easy-to-leant ò; and ignore 2;.
UCL (He et al. 2022) also generates perturbatioins which is casy-to-learn for unsupervised con- trastive learning by inducing the perturbations to reduce the contrastive loss via alternating optimiza- tion on the li-level min-min problem:
Σ LeL ((),T())) 6,), (a) o.)))
min 8
min
(10)
66:116:
does not require label information and works well on different contrastive learning backbones.
SN Yuu al. 2021) is sampled from manually designed distribution. is not targeting any backbone or dataset and only focuses on linear separability. SN first sets M centers in the perturbation space, where M is the number of protected classes. The generation process can be seen as sampling the perturbations for one class from a Gaussian distribution whose mean is one of the M centers.
B.2 SETTINGS OF GENERATION PROCESS
All the baselines and our proposed TUE are generated in the way of PGD Madry et al. (2018), except for SN, which is sampled from manually designed distribution following the algorithm in Yu et al. (202T). For EMN, UCL, and TUE, the generation process is an alternate optimization between model parameters and perturbations. For example, TUE is optimized in the way of Eq. 6 In EMN, after every epoch of optimization on model parameters, the whole set perturbations are optimized for one epoch by PGD-20. In TUE, different backbones are the model parameters are trained for 40 epochs, and after every 1/5 epoch of optimization on model parameters, the whole set perturbations are optimized for one epoch by PGD-20. For TUE (MoCo), the model parameters are trained for 200 epochs, and after every epoch of optimization on model parameters, the whole set perturbations are optimized for one epoch by PGD-5. For TUE (SimSiam), the model parameters are trained for 50 epochs, and after every 1/4 epoch of optimization on model parameters, the whole set perturbations are optimized for one epoch by PGD-20. UCL with SimCLR and SimSiam have the same settings TUE. UCL with MoCo uses PGD-10 10 and the other settings in the schedule is the same as TUE (MoCo). Finally, all the perturbations are constrained by Loo norm, i.e. || I where 8/255.
different schedule. For TUE (SimCLR),
B.3 SETTINGS OF EVALUATION STAGE
To evaluate the unlearnable effect, use CrossEntropy the objective function in the unauthorized supervised training. We use linear probing after contrastive pre-training to evaluate the unlearnable effect in unsupervised training. The supervised model is trained for 200 epochs. The unsupervised model pre-trained for 1000 epochs by unsupervised contrastive learning and then fine-tuned for 100 epochs by linear probing. The details for the hyperparameters are listed in Table
C VISUALIZATION OF INTERPOLATION
We use t-SNE to show the interpolations in the perturbation space (Fig. 9 and then visualize the perturbation patterns (Fig. [O]. Fig. 9 it shows that intra-class interpolation tends to create new perturbations around the original perturbation clusters, while inter-class interpolation tends
12

---

Published as a conference paper at ICLR 2023
Table 7: Hyperparameters of evaluation stage
Hyperparumeter
Supervised
SimCLR
Unsupervised pretraining
MoCo
SimSiam
SimCLR
Lineur probing MoCo
SimSiam
Epoch Optimizer
200
1000
1000
1000
100
100
100
SGD
SGD
Adam
SGD
Adam
SGD
SGD
Learingg Rate
0.1
0.06
0.3
0.06
0.001
30
30
LR Scheduler
CosineAmnealingLRR (CA)
CA
CA
Encoder Momentum
0.99
Similarity herween
Loss Function
CrossEntropy (CE)
InfoNCE
InfoNCE
CE
CE
positive sumples
to create more separated clusters, extending the unlcarnable effect to more classes. Fig. 10 shows interpolation within classes can keep the class-wise pattern that is the same the source perturbations, while interpolation between classes can create a new class pattern. Both the linear separable clusters and the class-wits patterns separability. By visualization we show the reason why interpolation can be an effective way for increasing the number of perturbations.
show that interpolation
keep good linear
(a) TUE perturbation for 3 classes CIFAR-10
(b) Interpolation within classes
(c) Interpolation between classes
Figure 9: t-SNE visualization of interpolation in perturbation space
Source perturbations
Interpolation
(1 -a)
62
Interpolation within classes
Interpolation between classes
Figure 10: Visualization of patterns of interpolation
D ADDITIONAL EXPERIMENTS
D.1 COMPARISON WITH SIMPLY COMBINING EMN AND UCL
In this subsection, we want to compare TUE with simply combining the loss EMN and UCL (EMN-UCL). EMN-UCL. is simple and direct method, but it will lose part of the linear separability
13

---

Published as a conference paper at ICLR 2023
of the perturbations, and thus reduce the data-wiis transferability and protection against supervised training as shown in the experiments in Table [ As we analyzed in Section 3.2.2 and Section [5.3] EMN is designed to reduce the supervised loss on target data, while TUE creates the shortcut by linear separability of perturbations, which is not tied to the specific data. As such, EMN-UCL. should have limited data-wise transferability compared with TUE.
Table & Comparison between EMN-UCL and TUE.
Backbone
Method
Training-wise transferability Supervised
Unsupervised
Intra-class
Inter-elass
Data-wise transferability
CIFAR-10 10 SVHN CIFAR-I0 - CIFAR-100
SinCLR
EMN-UCL
19.89
47.83
16.15
14.82
79.25
TUE
10.67
52.38
10.16
10.90
11.72
10.53
EMN-UCL
13.34
50.62
13.61
11.90
28,52
27.43
MoCo
TUE
10.06
63.38
12.04
8.57
13.95
8.32
SimSiam
EMN-UCL
15.36
32.74
16.15
14.82
11.14
21.47
TUE
10.03
35.57
10.25
10.47
12.93
5.10
In Table the experimental results are given show the following weaknesses of EMN-UCL:
First, EMN-UCL has limited lase transferability. especially when being transferred onto non-target datasets. Because of the poor linear separability from EMN, the accuracies of EMN-UCL. on non-target datasets are much higher on almost every dataset and backbone. EMN-UCI. with SimCLR backbone even has an accuracy 79.25% when transferred from CIFAR-10 to SVHN and 45.61 61% % when transferred from CIFAR- to CIFAR-100. However, TUE can reduce the accuracy on SVHN to around 12% and CIFAR-100 to less than % on every backbone.
Second, EMN-UCL has less protection against supervised training than TUE. On CIFAR-10, TUE can reduce the test accuracy of unauthorized supervised training around 10%, while EMN-UCL has a higher accuracy which is from 13% to 19 % on different backbones. This means EMN-UCL. provides less protection against supervised training than TUE.
In conclusion, TUE can provide better supervised unlearnability and better data-wise transferability than combining EMN and UCL.
D.2 THE CHANGES CSD AFTER INTERPOLATION
To better understand how interpolation affects the linear separability, we show the change of linear separability after the interpolation in Table The interpolation from CIFAR10 SVHN has almost no change to CSD. Although the interpolation from CIFAR10 to CIFAR 100 increases CSD little, is still low enough for good linear separability. The change for SN and TUE CIFAR 100 can be almost ignored. The reason why CSD increases in CIFARIOK is that a larger number of classes would make the perturbation space more crowded.
Table 9: The changes of CSD values after interpolation.
CIFAR-10 CIFAR-IO to SVHN
CIFAR-I0 CIFAR-100
EMN
1.74
1.60
2.06
SN
0.55
0.61
0.66
TUE (SimCLR)
0.71
0.72
0.85
TUE (MoCo)
0.52
0.58
0,62
TUE (SimSiam)
0.67
0.69
0.79
D.3 ABLATION STUDY
In this subsection, we conduct ablation experiments on the two terms of the proposed loss. The results reported in Tables 10 and 11 which show that removing either term will greatly hurt the performance of TUE.
Particularly, in Table 10, show that, if only CSD loss, the protection against unsupervised training will fail. In Table we show that only the centrrastie-Learninn term is used (reduces to the UCL baseline), it will lose its protection against supervised training.
14

---

Published as a conference paper at ICLR 2023
Table 10: The changes of CSD values after interpolation.
Unsupervised MoCo
Supervised
SimCLR
SimSiam
Clean
93.79
90.04
89,90
90.59
CIFAR-10
CSD
9.99
80.33
79.24
81.20
Clean
74.49
63.68
63.03
64.69
CIFAR-100
CSD
1.03
55.69
51.81
58.99
Table 11: The changes CSD values after interpolation.
CIFAR-10
cifar- 100
Backbone
Method
Supervised
Unsupervised
Supervised
Unsupervised
Clean
93.79
90.04
74.49
63.68
SimCLR
UCL
92.86
47.78
72.17
16.68
Clean
93.79
89.90
74.49
63.03
MoCo
UCL
92.62
44.24
71.59
18.74
Clean
93.79
90.59
74.49
64.69
SimCLR
UCL
93.50
30.43
71.84
4.64
D.4 COMPARISON WITH SUPERVISED CONTRASTIVE LEARNING
The loss of Supervised Contrastive Learning (SCL) has a similar intuition to our CSD. SCL pulls samples within the same class to be closer, while pushing those from different classes far away. However, is not a suitable loss for unlearnable examples.
First, SCL cannot quantify linear separability, which is the key property for achieving training- wise and data-wise transferabilitt. Particularly, CSD uses the radio between the intra-class and inter-class distances measure the overlap between two classes. But SCL takes all the samples that belong to other classes as negative which can not reflect the distance between two classes.
test the unlearnable effect of SCL and TUE with MoCo. It shows that SCL works against supervised exploitation, but it less effective in preventing unsupervised exploitation.
Second, SCL performs
than CSD. In Table 12
Table 12: Comparison between SCL and TUE.
Supervised
Unsupervised
SCL(MoCo)
10.12
66.46
CIFAR-10
TUE(MoCo)
10.06
63.38
SCL(MoCo)
1.29
28.11
CIFAR-100
TUE(MoCo) 1.09
23.60
In conclusion, although SCL is similar to CSD in the idea of pushing clusters, CSD is more suitable to TUE because it can quantify the linear separability and performs better in the protection against unsupervised training.
D.5 PERTURBING A PART OF CLASSES IN THE DATASET
In some cases, we have access to the whole dataset. Taking social media platforms as an example, for the company, they protect all the data released on the social media and they do have access to all the data. For users, they can protect their own data by perturbing before uploading.
In this paper, we focus the cases where the protection can be added onto all the data. However, we also evaluate when people can only perturb part the classes of the data (like the users can that
only perturb their data) by the experiments shown in Table [3] From Table[13] although the unsupervised training can still learn semantic features from the partly perturbed data, partly perturbing the dataset protect data from supervised training very effectively, the accuracy
15

---

Published as a conference paper at ICLR 2023
on perturbed classes is almost for most cases. When only have access to part of the data, the unlearnable examples can still protect that part of classes.
Table 13: Test accuracy (%) on partly perturb datasets. The accuracy is calculated on the perturbed classes.
CIFAR-10
cifar
perturbed classes
Unutborized training
Supervised
Unsuprsised
Superviscl
Unsupervieel
Supervised
Unsuervised
Supervised
Unsupevvsed
TUB(SinCLR)
0.20
93.40
0.15
92:58
4,00
88.00
0.90
69.00
TUE(MeCo)
0.00
94.40
0.05
95.55
4,00
83.30
0.40
73.30
TUE(SimSiam)
7.00
0.20
$5.60
D.6 UNLEARNABLE EFFECT NEW CLASSES FROM INTERPOLATION
In this subsection, show that the new classes of perturbations created by interpolation have good unlearnable effect and data-wise transferability. As shown in Sections 4 [.3] we used interpolation to create more classes of perturbations to transfer TUE from CIFARIO to CIFAR100, i.e., 90 new classes of perturbations are created to protect CIFARI 100, while the remaining 10 classes are directly transferred from CIFARIO. To better understand how the unlearnable effect interpolated new classes is, we show it from two perspectives, i.e., the unlearnable effect against unauthorized training and linear separability (quantified by CSD). First, in Table [4] we show that the unlcarnable effect on the new created classes is as good as those directly transferred from CIFAR- 10 to CIFAR- 100, Second, Table we show that the linear separability of interpolated perturbations for new classes is almost the same as the linear separability for overall classes. In conclusion, the interpolated new classes have good linear separability and the unlearnable effect can transfer well on non-target dataset.
Table 14: Test accuracy (%) new classes from interpolation.
From CIFAR-10 to CIFAR-100
New classes
Overall classes
TUE(SimCLR)
6.41
10.53
TUE(MoCo)
7.35
8.32
TUE(SimSiam)
11.94
5.
Table 15: CSD on new classes from interpolation.
From CIFAR- 10 to CIFAR-100
New classes
Overall classes
TUE SimCLR)
0,8527
0.8507
TUH(McCo)
0.6281
0.6265
TUF(SimSiam)
0.7979
0.7970
16


Reviews:
[{"review_id": "r-cNiOGEsd", "reviewer": "Reviewer_fZkw", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a strategy to address a shortcoming of prior 'unlearnable' strategies which aim to prevent training on unauthorized, namely the lack of transferability across training settings and datasets. Typical strategies add perturbations generated for a specific training setting and target dataset, and so typically do not transfer. This paper proposes a strategy called Transferable Unlearnable Examples (TUE) based on Classwise Separability Discriminant (CSD) to enhance linear separability of perturbation classes to improve the transferability of unlearnable examples. This method is an extension of prior contrastive learning algorithms to also balance linear separability, with interpolation for coverage of missing classes. Experiments show its improvements over other recent methods in most cases, particularly transferability. ", "summary_of_the_review": "This paper presents an effective strategy to promoting transferable unlearnability in image classification settings. While the performance improvements from the method are encouraging, particularly for transfer, the writing of the paper itself could be improved. ", "strength_and_weaknesses": "Strengths:\n- Experiments on three datasets support that the proposed method generally improves both unlearnability and improves unlearnability transfer compared to recent methods (by a large margin in some cases, but certainly more consistently across different settings). \n\nWeaknesses: \n- The motivation is somewhat unclear at points. Paper clarity and organization could be improved. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "jNyvmb03f88", "reviewer": "Reviewer_5F6K", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper presents an unlearnable strategy to prevent third parties from training on the data without authorization. The unlearnable strategy is based on class-wise separability discriminant that seeks to transfer better to other training settings and datasets, in contrast to existing methods that only work on a target training setting and a target dataset. Experiments on digit datasets suggest the feasibility of generating unlearnable examples across training settings and datasets.", "summary_of_the_review": "The paper presents an application of representation learning to dataset protection and security. It identifies the limitation of supervised unlearnable examples in transferring to a new situation, and presents a remedy to make unlearnable examples transferable. More experiments on use cases and challenging datasets will improve the quality of the paper. ", "strength_and_weaknesses": "- The paper systematically establishes the limitations of existing supervised unlearnable methods, and then proposes a simple strategy to make the unlearnable examples transfer to unsupervised and other datasets. \n\n- The proposed strategy is simple, and adds a class-wise separability discriminant loss to the contrastive loss for learning a transferable representation.\n\n- Interpolation data-wise transferability strategy is not convincing. Just linearly interpolating class samples or creating new class categories is not going to be representative of the real-world situations. Further experimentation is required to establish the claims to this end.\n\n- Comparison with supervised contrastive learning that makes use of samples within the class categories as positives, and other class categories as negatives would be useful, as supervised contrastive learning yields representations that are similar to the ones desired from class separability discriminant. \n\n- It is also not clear to me the rationale of the paper. If the goal is to avoid unauthorized use of the data, the data could be encrypted, or the security authentication protocol can be defined accordingly. Adding a noise to make it linearly separable seems difficult for challenging datasets.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "ZX95pnR59hm", "reviewer": "Reviewer_sZJu", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes Classwise Separability Discriminant (CSD), an unlearnable strategy to transfer the unlearnable effects (perturbations to avoid unauthorized data usage) to other training settings and datasets by enhancing the linear separability. Experiments showcase transferability of the proposed unlearnable examples across training settings and datasets", "summary_of_the_review": "The paper addresses an important problem of improving data-wise and training-wise transferability of unlearnable examples. The proposed approach is novel and detailed results show it outperforms its counterparts.\n\n", "strength_and_weaknesses": "Strengths\n-the paper proposes training-wise and data-wise transferability for unlearnable effects using contrastive learning\n- the proposed methods uses linear separability in addition to similarity between augmentations \n-experiments are extensive and detailed and show the improvement in data-wise and training-wise transferability \n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "Pe_-oejaW3", "reviewer": "Reviewer_esp8", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposed an unlearnable strategy, TUE. It aims to simultaneously enjoy training-wise transferability and data-wise transferability by enhancing linear separability. Experimental results show that the proposed method shows advantages in both transferability settings.\n", "summary_of_the_review": "Overall, this work presents a simple, yet seemingly effective unlearnable strategy, and the paper is well written and easy to understand. But there are some deficiencies in the experiment, so I would give score 6 for now.\n", "strength_and_weaknesses": "Strength:\n1. This paper proposed a simple but effective unlearnable strategy that can preserve both training-wise transferability and data-wise transferability.\n2. The paper is easy to understand, the formula is concise, and the algorithm description is clear. \n3. The performance gain seems to be significant.\n4. The visualization of unlearnable examples helps understand the effectiveness of linear separability.\n\nWeaknesses:\n1. In section 3, the authors mentioned that this paper focuses on supervised unlearnable examples, which seems to contradict the training-wise transferability of the proposed method.\n2. The first term of equation 5 combines unsupervised loss explicitly, while the second term L_S combines supervised loss implicitly. What if we consider both unsupervised and supervised loss explicitly?\n3. It is not clear how much interpolation affects data-wise transferability.\n4. What are the backbones of EMN and SN in Table 5 and Table 6?\n5. No ablation experiments on the two proposed losses.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster