How Far Are We from True Unlearnability?
Authors: Kai Ye
Liangcai Su
Chenxiong Qian
Venue: ICLR 2025 Poster (2025)
Keywords: shortcut learning
unlearnable dataset
loss landscape
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: The first to reveal and quantify the nature of unlearnability from the perspective of parameter learning.

Abstract: High-quality data plays an indispensable role in the era of large models, but the use of unauthorized data for model training greatly damages the interests of data owners. To overcome this threat, several unlearnable methods have been proposed, which generate unlearnable examples (UEs) by compromising the training availability of data. Clearly, due to unknown training purposes and the powerful representation learning capabilities of existing models, these data are expected to be unlearnable for models across multiple tasks, i.e., they will not help improve the model's performance. However, unexpectedly, we find that on the multi-task dataset Taskonomy, UEs still perform well in tasks such as semantic segmentation, failing to exhibit $\textit{cross-task unlearnability}$. This phenomenon leads us to question: $\textit{How far are we from attaining truly unlearnable examples?}$ We attempt to answer this question from the perspective of model optimization. To this end, we observe the difference in the convergence process between clean and poisoned models using a simple model architecture. Subsequently, from the loss landscape we find that only a part of the critical parameter optimization paths show significant differences, implying a close relationship between the loss landscape and unlearnability. Consequently, we employ the loss landscape to explain the underlying reasons for UEs and propose Sharpness-Aware Learnability (SAL) to quantify the unlearnability of parameters based on this explanation. Furthermore, we propose an Unlearnable Distance (UD) to measure the unlearnability of data based on the SAL distribution of parameters in clean and poisoned models. Finally, we conduct benchmark tests on mainstream unlearnable methods using the proposed UD, aiming to promote community awareness of the capability boundaries of existing unlearnable methods.

Published as a conference paper at ICLR 2025
How FAR ARE WE FROM TRUE UNLEARNABILITY?
Kai Ye', Liangcai Su', Chenxiong Qian The University of Hong Kong
ABSTRACT
High-quality data plays an indispensable role the era of large models, but the use of unauthorized data for model training greatly damages the interests of data owners. To overcome this threat, several unlearnable methods have been pro- posed, which generate unlearnable examples (UEs) by compromising the training availability of data. Clearly, due to unknown training purposes and the powerful representation learning capabilities of existing models, these data expected be unlearnable for models across multiple tasks, i.e., they will not help improve the model's performance. However, unexpectedly, dataset Taskonomy, UEs still perform well in tasks such as semantic segmentation, failing exhibit cross-task unlearnability. This phenomenon leads to question: How far are we from attaining truly unlearnable examples? We attempt to answer this question from the perspective of model optimization. To this end, we observe the difference in the convergence process between clean and poisoned models us- ing a simple model architecture. Subsequently, from the loss landscape we find that only part of the critical parameter optimization paths show significant dif- ferences, implying a close relationship between the loss landscape and unlearn- ability. Consequently.
find that the multi-task
employ the loss landscape to explain the underlying reasons for UEs and propose Sharpness- unlearnability of parameters based on this explanation. Furthermore, we propose an Unlearnable Distance (UD) to measure the unlearnability of data based on the con- SAL distribution of parameters in clean and poisoned models. Finally, duct benchmark tests on mainstream unlearnable methods using the proposed UD, aiming to promote community awareness of the capability boundaries of existing unlearnable methods.
Learnability (SAL) to quantify the
INTRODUCTION
High-quality data is the new oil of our era, giving rise to series of impressive works such as large language models (LLMs). In pursuit of the Scaling Law, publicly available but unauthorized data may be unwittingly used during model training, severely harming the interests of data owners. To avoid this threat, Unlearnable Examples (UEs) have been proposed, which actively disrupt data us- ability training by adding imperceptible perturbations. Existing unlearnable methods have deeply explored images, rendering unlearnable examples almost unhelpful for training image classification models and exhibiting single-task unlearnability. However, once data is public or leaked, its train- ing purpose is unknown, meaning the data may be used to train various models with different tasks, e.g., semantic segmentation and object detection. However, multi-tast unlearnability of UEs has not only been understudied but also largely overlooked.
Furthermore, we investigate the multi-task unlearnability of unlearnable examples, generated by un- learnable methods based proxy models and heuristics. For the former, constructing UEs necessi- tates model training to identify effective perturbations, such as EM (Huang et al. [022 In contrast, heuristic methods introduce specific bias information, assisting the model in linding "shortcuts" during training and disregarding the data's inherent features, such as OPS (Wu et al. 2022). Since heuristic methods primarily cater to classification tasks, we employ the representative unlearnable methods (EM, OPS and AR) to generate UEs and evaluate the performance gap between its poi- soned model and clean model under multi-task scenarios, depicted in Figure 6 Appendix A.I
Contributed Equally. Corresponding Author (oqi anees hku.k).

---

Published as a conference paper at ICLR 2025
We also compare the performance of different tasks during EM (Error- (eroon-Mnizing) training, includ- ing similar tasks and tasks with significant differences. The results show that the EM still fails to exhibit unlearnability consistent with the nature of the tasks under multi-task scenarios, shown in Figure in Appendix A.T Surprisingly, on the Taskonomy dataset (Zamir et al. 2018), the UEs generated by existing methods have minimal negative impact on model performance, suggesting that existing UEs do not cause model training to fail. In other words, current Unlearnable Examples have not genuinely achieved multi-task unlearnability. Furthermore, the experimental results also demonstrate that existing UEs fail in cross-task scenarios (see Appendix (A.2). This observation raises the question: How far are we from attaining truly unlearnable examples?
To answer this question, we need reasonable metric to evaluate the unlearnability of UEs. Existing unlearnability evaluation depends on the performance of models after training, for example, the difference in accuracy between models trained on UEs and clean samples in classification tasks. However, this metric cannot explain the cause of UEs and relies on the specific form of downstream tasks. Furthermore, we observed that the model parameters trained values than those trained on UEs. This implies that with the same model initialization, the parameter updates of the poisoned models are slower and the magnitude of updates is lower, shown in Figure 9 in Appendix [A.3] Therefore, unlike existing work, considering that UEs directly impact the parameter update process during model training, attempt to assess data unlearnability from the perspective of model optimization.
clean datasets have higher
As result, explore the connection between unlearnability and the training process. First, we observe the model convergence process on clean samples and UEs through the loss landscape. We find that only small number of key parameters exhibit significant differences between the two models, and these key parameters cannot converge on UEs. This suggests that there is a more direct connection between parameter updates and unlearnability. We then attempt to describe this connection, stating that if a sample is unlearnable, the direction of parameter updates should move along contour lines, or the magnitude of parameter updates should be so small that they are almost zero, meaning the loss can be considered as not decreasing. In practice, it is difficult for parameters to update strictly along contour lines, but the latter may be feasible under approximate conditions. Specifically, if the parameters are in globally flat area with sparse contour line density, the impact of parameter updates on the loss is relatively negligible.
Building on this understanding, we propose the Sharpness- Aware Learnability (SAL) metric to char- acterize the unlcarnability of parameters. We conduct experiments in both multi-task and single-task settings and find that SAL exhibits high consistency with traditional unlearnability metrics (i.e., the difference of model performance), demonstrating the rationality of SAL. Based on SAL, we fur- ther introduce Unlearnable Distance (UD) of samples for intuitively comparing the unlearnability of protected data. Lastly, we benchmark existing methods to reveal the current state of unlearnable examples. In summary, our contributions can be outlined as follows:
We are the first to uncover that existing unlearnable methods fail maintain unlearnability in multi-task models, thus offering new research directions to enhance the practicality of unlearnable examples.
We focus on the training phase instead of simple test accuracy, and put forward an expla- nation for the effectiveness of unlearnable examples by analyzing the loss landscape. We further introduce Sharpness-Aware Learnability (SAL. and Unlearnable Distance (UD) as metrics for measuring the unlearnability of model parameters and data, respectively.
Utilizing the proposed UD, we benchmark existing unlearnable methods and provide a more intrinsic tool for evaluating UEs. Our approach ascertains the gap between existing research efforts and the truly UEs while encouraging the development of more practical unlearnable methods from a novel perspective.
2 RELATED WORK
Unlearnable Examples. Data poisoning techniques that introduce perturbations to the entire train- ing dataset, referred to "unlearnable datasets" simply "poisons", are also known as availability attacks (Fowl et al. 202T Yu et al., 2022). generalization attacks (Yuan & Wu 202T), delusive at- tacks (Tao et al. 2021), unlearnable examples (Huang et al. 2021 In this study, unlearnale
2

---

Published as a conference paper at ICLR 2025
datasets considered defensive measures, their primary purpose is prevent the exploitation of data. Conversely, attempting to learn from unlearnable datasets is regarded as an attack.
Unlearnable datasets are generated by applying perturbations to clean samples while ensuring that the labels are unchanged. All methods for crafting UEs aim to address the following bi-level maxi- mization problem:
max E, () D.. [C(f(2), ( v: 0(6)),
SEA
0(6) = arg min (F..)))> [C (z; 62) ys: 0)]
Equation2 2 describes the process of training a model on unlearnable data, where denotes the model parameters. Eqquaiinn 1] states that the unlearnable data should be chosen that the trained network has high test loss, and thus fails to generalize to the test set.
Existing Explanations. There are multiple explanations for why unlearnable datasets hinder the generalization of networks on test sets: error-minimizing perturbations lead to overfitting (Huang 202I). arror-maximizing noise promotes the learning of non-robust features (Fowl et al., 2021 convolutional layers are receptive to autoregressive patterns (Sandoval-Segura et al. 2022b). hese various explanations stem from different optimization objectives and theories. However, the predominant explanation is provided by Yu et al. 2022), who discover nearly perfect linear sepa- rability of perturbations across all considered unlearnable datasets. They propose that unlearnable datasets introduce learning shortcuts as a result of the linear separability of perturbations. How- ever, existing explanations treat the model trained on UEs as a whole and focus only one-sidedly on its accuracy explaining why UEs fail in multi-task scenarios. In addition, some studies have revealed that UEs tend to exhibit a high peak accuracy and lower final accuracy on test dataset of classification tasks Sandoval-Seeura et af., [022a]] Zhu et al. (024).. However, since learning is a dynamic process that is only completed during the training phase, it is challenging and even wrong to discern the underlying reasons for the fluctuation in accuracy numbers. To truly understand the inherence and impact of unlearnability, one must focus on the training process itself.
a clean test set, in addition to the fact that existing explanations have difficulty
Loss Landscape Sharpness. The notion of the loss landscape sharpness and its connection to generalization has been extensively studied, both empirically (Keskar al. [0166] Jiang et al., 2019 Neyshabur et al. 2017: Li et al. 2018) and theoretically (Dziugaite & Roy 2017). These studies have motivated the development of methods (Chaudhari et al.) 2019) that aim to improve model generalization by manipulating or penalizing sharpness. Among these methods. Sharpness- Aware Minimization (SAM) (Foret et al. 2020 Andriushchenko & Flammarion) 2022 Wen et al.
2022) has shown to be highly effective and scalable for DNNs across various tasks (Li et al. 2024). The loss landscape helps illustrate how training data is learned. Similarly, it can be employed to demonstrate how UEs are unlearned. In this paper, start from loss landscape analysis and then borrow the use of sharpness to explain unlearnability.
3 THARPNESS-AWARY UNLEARNABILITY EXPLANATION
3.1 EXPLORATION OF THE MODEL OPTIMIZATION PROCESS
Experimental Setting. For the toy classification task, we employ a single-layer linear layer as the classification model with input and output dimensions of (12,) and (10,), respectively, We manually construct dataset containing 5,000 samples and 10 classes using the make classification method in the scikit-learn library. We utilize CrossEntropy as the discriminator and SGD (with a learning rate of 0) as the optimizer. We train for 10 epochs and collect trajectories for plotting the loss landscape every 5 steps. For MNIST, we train a classifier using LeNet-5, with the same discriminator and optimizer (with a learning rate of 0.001 and momentum of 0.9). For both datasets, we employ OPS to generate class-wise perturbations to construct UEs.
Visulization of Loss Landscape. The parameters in DNNs are very high dimensional and there are a lot of nonlinearities involved, making it hard to imagine what is going on during the optimization. While much work has studied the loss landscape of deep networks in vanilla training, there has been little discussion of poisoning training, especially for training on UEs. Here we study the difference between the loss landscapes of the vanilla and poisoning training and the convergence trajectories
3

---

Published as a conference paper at ICLR 2025
of the models. Note that the two parameters that need to be chosen for 2D loss landscape plotting to estimate the effect of overall model parameter changes on loss is difficult because DNNs often have millions of parameters. Therefore, the fewer model parameters, the more accurate the estimation, and the 2D loss landscape and convergence trajectories can better reflect the actual training process. Furthermore, when there are only two parameters, the loss landscape sent the training process. However, this extreme case is not suitable for poison training. Therefore, choose a single linear layer classifier with parameter dimensions of (12,10) balance the re- quirements of the model's 's ability to learn effectively under regular training settings and the potential interference between an excessive number of parameters.
fully and accurately repre-
Largellocal minimum
target
Parrammeee 3.2%
(a) Vanilla Top parameters
(b) OPS Top 2 parameters
targetlocal nihimum
target local mihimum
parsmater 3, 3.0%
82
.22
parameser
parameterr
(c) Vanilla 3rd & 4th parameters
(d) OPS 3rd & 4th parameters
Figure I: Optimization in loss landscape of training process on Toy Classification task. We use PCA for dimensionality reduction and the x, y-axis are selected Top 2 parameters. The training campaign of the model on UEs tends to take detours rather than shortcuts to the target minimum. However, only very few parameters converge in line with the model performance. For ease of comparison, employ the same colour bars in all figures. The fewer contour lines in the bottom two figures are due to the loss fluctuations being significantly lower than those in the top two figures. Refer to Appendix A.5 for loss landscape on MNIST dataset and more details of PCA.
To better demonstrate the degree of influence of different parameters model convergence during model optimization, we use principal component analysis (PCA) on the optimization path and get the top 2 components (parameters) most variance, as well as to choose the 3rd and 4th components, respectively. In Figure I we simple linear classification task with very small number of parameters to show how UEs work. For a real-world scemario, we adopt MNIST as datasets for image classification task and the corresponding visualization is shown in Figure in Appendix A.5] There are conclusions that can be drawn from these loss landscape visualizations. Firstly, the model trained on UEs initially approaches the global optimum and then gradually deviates, indicating that the model is not yet fully affected by UEs during the early stages of poison training. This is consistent with our experimental results in Section 3.3 The second that various parameters have varying levels of importance in model training. This leads us to speculate that only a few key parameters in DNNs undergo normal "learning" " and updating during the training campaign. In simpler terms, a small subset of parameters significantly influences the model's ability to learn when trained on UEs, whereas most secondary parameters do not undergo normal "learning". Hence, we suppose that the abnormal updates of key parameters reflect this unlearnability of models, and unlearnable perturbations to the samples make difficult to update the parameters properly. The evaluation of UEs should take into account the updates of model parameters, rather than solely relying on simple test accuracy.
visualize the loss over the 2 orthogonal directions with the
4

---

Published as a conference paper at ICLR 2025
3.2 UNVEILING THE RELATIONSHIP BETWEEN LOSS LANDSCAPE AND UNLEARNABILITY
The loss landscape provides an intuitive visualization of the model's optimization trajectory. illus- trating how training data learned. Similarly, it can be employed to demonstrate how UEs are unlearned. Hence, we propose to explore the relationship between Loss Landscape and unlearn- ability. If sample unlearnable, needs to satisfy one of the following two conditions: (1) the parameter update direction moves along the contour lines; (2) the parameter update magnitude is small enough so that the training loss barely changes. Implementing the first condition is quite chal- lenging, parameters usually updated in direction perpendicular to the gradient. Therefore, we need to strive to satisfy the second condition as much as possible.
As shown in Figure 2 a). display two regions with dense and sparse contour lines, respectively. When the parameters are the flat area of the loss landscape, the change in loss after the parameter update is minimal, presenting performance similar to the second condition. In contrast, in the steep area, even small parameter updates can cause the loss to decrease rapidly. Thus, we believe that the steepness of the loss landscape can reflect the unlearnability of UEs. In Figure 2(b), within certain range of parameter updates, the fluctuations in loss in the flat area are relatively small, which inspired us to propose Sharpness- -ware Learnability. Our focus is on the relationship between the fluctuation of loss within certain region and the perturbation of parameters. When training on UEs, the optimization direction should be as tangential to the gradient direction as possible, rather than in the opposite direction with adversarial examples, to ensure that no useful information is learned.
Lendscane
A
Tagas
L
BAL
Flatien
Von
Laidsapee
Lanaaoee
(a)
(b)
Figure 2: (a) Training loss landscape of ResNet-46. It is more difficult for the model to converge to the target optimal point flatten regions (lower SAL) for the same step size compared to sharp regions. (b) When the neighborhood is flatter, the smaller the SAL of the model parameters is, meaning that it difficult for the model to escape from the local minima because this requires more steps compared to when it is in sharp neighborhood.
3.3 SAL FOR SINGLE-TASK SCENARIOS
Definition 1 (Sharpness-Aware Learnability, SAL). Inspired by (Zhu et al. (023), in this work, we define the Sharpness-Awar ware Learnability of layer parameters of model trained on particular dataset as SAL. Given weight perturbation scaling factor 0 and neural network O, the SAL of layer parameters 0 at training epoch is defined as:
SAL (0), max [[(0, + + U; (00;
(3)
where 0 is l-layer DNN and 0: is the 1-th layer parameters. v is the perturbation of O,, and the parameters of the remaining layers are temporarity frozen. The target training loss (c.g. cross- entropy) is denoted by C. 1|p < is denoted as the Ep norm. Dir denotes the training dataset.
Considering that all current unlearnable methods target single task (e.g. image classification), first focus on monitoring SAL on a single task, as well as explaining why SAL a better explanation of why and how existing unlearnable methods work.
5

---

Published as a conference paper at ICLR 2025
Conv
Conv
Layer
Head
Fpach
Com
Conv
Layer
Head
Head
Epoch
Figure 3: Most parameters in the model trained on UEs exhibit low SAL (except for TAP, which is considered as adversarial examples), while a small number of parameters on clean training maintain a relatively high SAL (darker green and larger SAL). This suggests that UEs exert unlearnability by reducing the SAL of the parameters. Results on other UEs are in Figure 1iin Appendix A.6
Experimental Setting. Unless stated separately, all experiments in our graphical results are on CIFAR-10 10 (Krizhevsky et al. 2009) trained with ResNet18 (He et al. 2016). We generate sample- wise perturbations for all the UEs mentioned except for OPS and we follow their default generating setting. We limit the perturbation budget to fx 8/255. After generating the poisoned dataset, the model is randomly initialized and re-trained from scratch, via SGD for 100 epochs with an initial learning rate of 0.1 and decay by 0.1 by default. For SAL searching, we set ll < 0.05, the iterative step for optimizing v 10.
||2 and
Figure 3
shows the visualization of SAL of different layer parameters training proceeds, visual- ization on more UEs is shown in Figure 11 We observe that models trained on unlearnable datasets have a lower SAL compared to those trained on vanilla datasets, and the SAL of these parameters further decreases with training proceeding. Although this generally corresponds to the pattern of their demonstrated test accuracy. where methods that exhibit lower test dataset accuracy have fewer unlcarnable parameters, there are also exceptions: TAP (Fowl et al.) (202T) use adversarial examples for availability attack and get significant test accuracy degradation. This helps us to distinguish which methods truly demonstrate unlearnability and which are simply conventional poisoning at- tacks. In summary, SAL can better explain the origins and working principles of unlearnability.
3.4 SAL FOR MULTI-TASK SCENARIOS
Background and Experimental Setting, We observe that while existing unlearnable and availabil- ity attack methods are effective across datasets, model architectures, and training methods, there is a lack of discussion regarding multi-task scenarios. Intuitively, we believe this is primarily because most of the current unlearnable data heavily relies on simple features that are easy to learn. Clearly, class-based features only applicable to classification tasks and cross-entropy loss. Even those unlearnable datasets that do not require class features are considered to necessitate the introduction of shortcuts, but the results in Figure 6) suuggest that there are conflicts between shortcuts for different tasks. In the multi-task learning experiments we train a multi-task model based on ResNet as the backbone on Taskonomy (Zamir et al. 2018) dataset (we use the tiny split to facilitate the search for EM perturbations). which includes four tasks (Scene Cls., Keyp.2d, Depth Euc. and Segm.2D ). We refer the experimental setup of ModSquad (Chen et al. 2023) and train for 100 epochs.
The unlearnability of EM perturbations during multi-tast training is not significant. We believe that this is largely due to the inherent difficulty of multi-task learning, that is, conflicts between different tasks naturally exist, and unlearnable perturbations are also limited to this. From the perspective of loss, for samples the same batch, whether is adding perturbations that maximize loss (adversarial samples) perturbations that minimize loss (EM), this is more difficult in the multi-task scenario. In addition, existing unlearnable methods often overlook the discussion of unlearnable perturbation on complex tasks such semantic segmentation and depth estimation.
To sum up. the proposed SAL provides a more in-depth analysis of why existing methods fail in multi-task scenarios. That is, the impact of different task losses on the changes of the same param- eter is heterogeneous, making it difficult for the parameter to exhibit leamability or unlcarnability simultaneously across different tasks. We provide heat maps of cosine similarity between vectors

---

Published as a conference paper at ICLR 2025
composed of SAL parameters at different layers during training for different tasks in Figure 4 It can be observed that there is no significant difference in the parameter SAL similarity between tasks in the vanilla training and EM training. Based our theory that unlearnability is reflected through the parameters, this confirms that existing unlearnable methods struggle to demonstrate extensive unlearnability in multi-task scenarios (Yu et al. 2020).
Scara
CL8S
0-5
0,00
0225
0L311
Deth bi
20 deges
94
20 Tenite
9:24 6.87
8.00
0.6
0,34
0228
6.90
1112
Depin
Murr (h.)
20 20/egg:2e
(a)
Figure 4: (a) Heat maps of the cosine similarity between vectors composed of SAL parameters for different tasks. A higher value implies that the unlearnability of the parameters between two tasks is more consistent during training. while a lower value suggests that the two tasks are more difficult to exhibit unlearnability simultancously. Furthermore, we believe that the inherent conflicts present in multi-task learning are the fundamental cause of the inconsistency in unlearnability. (b) The propor- tions of learnable parameters for different tasks have significantly different trends in EM training, and the inconsistency of unlearnability between tasks reveal the great challenge of constructing UEs under multi-task scenarios. We label the unlearnable distance computed by Equation S|at the end of the smoothed line (it is time-consuming to perform SAL analysis for multi-lask models).
DATA UNLEARNABILITY METRIC: UNLEARNABLE DISTANCE
In this section, we delve further into evaluating the unlearnability of data based on the SAL. Drawing from the findings in Section 3.1 and Section 3.3 the SAL reflects the learning capacity of model parameters, meaning that when the SAL relatively large, the parameter has a significant impact on the model's performance. Furthermore, we discovered that an unlearnable dataset leads to training failure by reducing the SAL of model parameters. other words, the proportion of parameters with high SAL can directly indicate the unlearnability of dataset.
Based on this insight, we propose categorizing parameters into learnable and unlearnable groups using a threshold according to the SAL. Moreover, we introduce new metric called unlearnable distance (UD) to evaluate the unlearnabiiity of various unlearnable methods in specific training set- tings. This approach allows us to assess the unlearnability of different unlearnable methods without relying solely on a single test accuracy metric. We made our code publicly available on GitHubi.
Definition 2 (Learnable Threshold, LT). The goal of LT is to distinguish between learnable and unlearnable parameters, which relies the SAL of the model parameters during the training pro- cess of the clean model 6% Considering the diverse density distributions of the SAL, we employ the K-Means method (Arthur al. 2007) to segregate the parameters into two categories and choose the mean value of the cluster centers as the threshold. For the sake of convenience, we utilize B to represent LT, and its value determined as follows:
B(T) Σt
- E. (SALLO ())
(4)
2x
where T denotes the number of epochs; K; represents the mean value of the i-th cluster center; SAL(0%, e,t) refers to the sharpness-aware learnability of the clean model 0 at the t-th epoch.
Next, we evaluate the unlearnability of UEs by comparing the changes in the number of learnable parameters during the training process of the same model architecture clean samples and UBs. Figure 5) shows the process used by our threshold to categorize learnable and unlearnable parameters.
lity.git

---

Published as a conference paper at ICLR 2025
Furthermore, we quantify the proportion of learnable parameters for UEs during training. depicted in/Figure 13 Appendix(A.77 As expected, we find that the number of learnable parameters for clean training is significantly higher than for other UEs, which experience rapid decrease in the number of learnable parameters from the beginning of training. TAP is an exception, as it is inherently adversarial examples. It can also be observed that while TAP has similar number of learnable parameters to clean training, it is merely continuously learning erroneous features from the data.
T.veswed22.11 2.57
322
Figure 5: Finding SAL threshold B(T)) to distinguish learnable and unlearnable parameters in model trained on the vanilla dataset. The learnable parameters of poisoned models only small fraction in the early stages of training and decrease rapidly (except for TAP, which is considered as adver- sarial examples), which further corroborates our hypothesis regarding the inherent unlearnability of UEs, suggesting that the learning of part of the model parameters is compromised.
Definition (Unlearnable Distance, UD). Assuming that the clean model and the poisoned model have the same nelwork architecture, they also possess an equal number of parameters. We measure the unlearnability of the poisoned model by the rutio of the average learnable purameter quantities in the poisoned model and the clean model. the ratio is small, it implies that the UEs contribute less to model convergence, thereby being closer to the genuine UEs. Conversely, if the ratio is large, it means that the model converges more normally, without achieving the genuine UEs. Thus, this distance can be calculated as follows.
1 E. X(SA((O),,,)) (,,,((0,,.t),,((T)) UD(OP) T
(5)
E. A(SAL(OS (.,)())))
where T and represent the number of epochs for training of the clean model and the poisoned model, respectively. M(SA((0, e,t), model O at the t-th epoch, i.e., the corresponding SAL is greater than the threshold (TT").
(.t)),,((TT) B(T*)) denotes the number of learnable parameters in the
Algorithm. Here, provide complete summary of the process to evaluate the unlearnability of UE dataset D", as shown in Algorithm
BENCHMARKING DATA UNLEARNABILITY
5.1 EXPERIMENTAL SETTING
The basic experimental setup in this section is almost identical to Section 3.3 the universality of the proposed metries, we have included the larger-scale dataset CIFAR-100 and ImageNet (Russakovsky et al. 2015) subset (the first 100 classes, and center-crop all the images to 224 x224) in addition to CIFAR-IO 10. Moreover, we have explored various base model architectures such ResNet-50, SENet-18 (Cheng et al., 2016), and VIT, apart from ResNet-18.
To demonstrate
In terms of unlearnable methods, we have selected EM (Huang et al. 2021), REM (Fu et al. 2022
DC (Feng al. 2019). TAP (Fowl et al. 2021), LSP (Yu al.] 2022), and OPS (Wu et al. 2022) as exploration models, all of which are representative. We refer to the experimental setup in Qin al. 2023a) get UEs and implement training and defense setups.
8

---

Published as a conference paper at ICLR 2025
Algorithm Unlearnable Distance
Input: Poisoned training datasct Di,, Clean training dataset Di,. Poisoned model 6", Clean model 6" Training epochs 7 clean data, Weight perturbation scaling factor Training epochs 7 UEs.
Output: (0P)
1: 0" f- 0o. 0 0o
b Initialization
2: for in
T do
3: ( 1) (t)
4: for the 1-th layer parameters in 0" do Freeze(05)) * (0 c, + maxao,ECa Ri0 + A0:) R((f)
6:
D. Follow
Equation
7: end for
8: end for
((T))
Dr Σ K. c,
Calculate Learnable Threshold
10: for in
I....T" T do
11: (L 1) (1)
12: for the 1-th layer parameters 0r 0 do
13:
Freeze (5) vi #
14:
SAL"(O, "0 e,t maX R(o,, + A0:) ) R((,))
Follow
Equation
15: end for
16:
end for
UD(0") + To Er MSAL(O (1
Follow Equation
El MSSALLO
5.2
BENCHMARK RESULTS
We consider three factors that influence the unlearnability of UEs, including unlearnable methods, attack methods UEs, and model architectures. Additionally, provide the average number of learnable parameters per layer as a reference metric, abbreviated as "#LP."
Table I: UD of ResNet-13 trained on UEs constructed on CIFAR-10, CIFAR- 100 and ImageNet subset. Bolded numbers indicate the smallest unlearnable distance, i.e., the best unlearnability.
CIFAR-10
CIFAR-I00
IMAGENET: 100
UNLEARNABLE METHOD
TEST AcC
H.P
UD)
TEST Acc
UD
TEST
HPP
UD>
VANILLA
54.11
75.23
2.25
69.13
1.86
EM
26.52
0.62
0.187
12.34
0.25
0.111
1.30
0.02
0.011
1,280
DC
18.51
1.00
0.301
54.66
2.24
0.996
5.00
3,40
1.818
TAP
29.85
5.44
1.639
33.75
2.73
1.213
1.20
4.22
2.269
LSP
1,796
OPS
11.98
0.52
0.157
10.09
0.02
0.009
3.30
2.66
1.430
We find that the ma- jority of unlearnable methods yield UE samples with relatively low UD, which consistent with test accuracy. However, the UD of TAP is significantly greater than 1, implying that the model has ample learnable parameters. This is consistent with the aforementioned visualization of the SAL and learnable parameters for TAP, implying that TAP, tive availability attack method, are not true UEs. This because adversarial examples guide the model away from the correct optimization direction during training. Hence, parameters continue to update but the model does not converge. This is inconsistent with the rapid reduction and cessation of learning in the number of learnable parameters observed in models trained on UEs. Addition- ally, we observe that OPS has a significantly lower UD, even though its test accuracy is not the lowest. We speculate that this is because the perturbations in OPS contain strong simple features (more pronounced celss-r fcatures), providing a shortcut for model training, leading to a faster reduction in learnable parameters. Except for EM, all methods have relatively large UD (> 1). Although the ranking among different methods does not vary significantly from the previous trend (TAP still has the lowest test accuracy and the largest UD). This implics that the unlearnability of the same method behaves differently in different datasets, which further corroborates opinion that unleamability cannot be directly linked to test accuracy. Instead, the training environ- ment and the selected model should be taken into account. This might be because the ImageNet- dataset has more abundant features, making it more difficult for the model to learn useful features from perturbed samples. Nevertheless, do not believe that shortcul learning fully explain
The impact of different unlearnable methods on UD is shown in Table 1
adversarial example, although effec-
proposed

---

Published as a conference paper at ICLR 2025
unlearnability, as the shortcut is just one of the factors contributing to the unlearnability of UEs, and it happens to be the most effective method for classification tasks.
UD of ResNet-18 trained on defended UEs. changes in UD relative to predefense.
Table 2:
Note that =values in red or blue indicate
JPEG
Adversarial Training
UEraser-max
MixUp
CutOut
FARNABLE METHOD
RLP
UD
RLP
UD
RLP
UD
RLP
UD
ALP
UD
VANILLA
0.747
2.151
4.32
1,301
3.64
1,097
3.72
1.120
EM
1.24
0.373
0.40
0.120 0.057
0.42
0.127 0.00
1.28
0.386
1.36
0.470,a228
TAP
1.66
0.500
1.889
2.92
0.880
0.789
0.81
0.243
1.306
1.92
0.579
1.00
2,01
0.605 1.034
OPS
2.16
0.651
40 491
0.56
0.16940.012
40.002
1.18
0.355
40 108
1.60
0.482+0.385
1.54
0.46440.00
Benchmark on defended UEs. We calculate UD against 3 state-of-the-arr defenses (JPEG com- pression (Liu et al.) 2003), UEraser (Qin et al. 2023b) and adversarial training) and 2 commonly used data augmentation strategies (MixUP (Zhang 2017) and CutOut (DeVries) 2017)). The result is shown in Table 2, With the exception of TAP, most defense methods iecrease UD, thereby disrupting the unlearnability of UEs. Among these defense techniques, JPEG compression performs the best. As for TAP, since consider them adversarial examples and not belonging UEs, these additional defense perturbations disrupt the adversarial characteristics within the data. Overall, the effectiveness of the defense further demonstrates the validity of our proposed UD metric.
Table UD of models with different architectures.
VANILLA
EM
TAP
OPS
MODEL
NLP
UD
#LP
UD
ALP
UD
RESNET-18 88
3.32
0.62
0.187
5.44
1.639
0.52
0.157
RESNET-50
0.69
0.25
0.364
4.17
1.256
1.13
0.340
SENET-18
3.21
0.97
0.302
5.36
1.614
0.82
0.248
VIT
1.15
1.81
1.573
1.94
0.584
0.818
Benchmark on different model architectures. The impact of different model architectures on UD is shown in Table 3] We select ResNet series, SENet, and ViT as backbone networks. On the one hand, we find that different model architectures exhibit considerable differences in UD, ranging from minimum of 0.157 to maximum of 1.639. This suggests that data unlearnability model-dependent, rather than solely dependent on the data itself. Furthermore, we find that ViT has notably higher UD than other methods. Compared to ResNet and SENet, ViT is generally regarded as a stronger model architecture. Thus, we can conclude that the larger the number of model parameters and the stronger the model, the more difficult it is to maintain unlearnability when training on UEs. For TAP, similar to the discussion above, it exhibits an opposite trend compared to other UEs, meaning that as the model becomes more complex, the UD value actually decreases.
CONCLUSION
In this work, reveal that existing unlearnable examples do not exhibit the anticipated multi-task unlearnabiliiy, implying that they can still contribute to enhancing the performance of multi-task models. This finding prompts us to reevaluate the true unlearnability of data. Tackling this issue from the perspective of model optimization. we propose an explanation method based on the loss landscape shed light on the functioning of unlearnable examples. Consequently, we introduce a metric called Sharpness-Awar Learnability (SAL. to quantify the unlearnability of parameters. Furthermore, we employ SAL to distinguish between learnable and unlearnable model parameters and propose the Unlearnable Distance (UD) means to quantify data unlcarnability. By creating benchmark using various unlearnable methods based on the UD metric, we aim to foster community awareness regarding the effectiveness of existing unlearnable methods.
ACKNOWLEDGMENTS
This work is partially supported by the NSFC for Young Scientists of China No.662224000 and the RGC for Early Career Scheme (70.27210024). Any opinions, findings, or conclusions expressed in this material are those of the authors and do not necessarily reflect the views of NSFC and RGC.
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Maksym Andriushchenko and Nicolas Flammarion. Towards understanding sharpness-aware mini- mization. In International Conference on Machine Learning, pp. 639-668. PMLR, 2022.
David Arthur, Sergei Vassilvitskii, al. k-means++: The advantages of careful seeding. In Soda, volume 7, pp. 1027-1035, 2007.
Pratik Chaudhari, Anna Choromanska, Stefano Soatto, Yann LeCun, Carlo Baldassi, Christian Borgs, Jennifer Chayes, Levent Sagun, and Riccardo Zecchina. Entropy-sgd: Biasing gradient descent into wide valleys. Journal of Statistical Mechanics: Theory and Experiment, 2019(12):
124018, 2019.
Zitian Chen, Yikang Shen, Mingyu Ding, Zhenfang Chen, Hengshuang Zhao, Erik G Learned- Miller, and Chuang Gan. Mod-squad: Designing mixtures of experts modular multi-task learn- ers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 11828-11837, 2023.
Dongeai Cheng, Gaofeng Meng, Guangliang Cheng, and Chunhong Pan. Senet: Structured edge network for sea-land segmentation. IEEE Geoscience and Remote Sensing Letters, 14(2):247- 251, 2016.
Terrance DeVries. Improved regularization of convolutional neural networks with cutout. arXiv preprint urXiv:/706 740504452, 2017.
Gintare Karolina Dziugaite and Daniel Roy. Computing nonvacuous generalization bounds for deep (stochastic) neural networks with many more parameters than training data. arXiv preprint arXiv: 7703. / 1008, 2017.
Feng, Qi-Zhi Cai, and Zhi-Hua Zhou. Learning to confuse: Generating training time adversarial data with auto-encoder. Advances in Neural Information Processing Systems, 32, 2019.
Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware minimiza- tion for efficiently improving generalization. arXiv preprint arXiv:2010.01412, 2020.
Liam Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojeiech Czaja, and Tom Goldstein. Adversarial examples make strong poisons. Advances in Neural Information Processing Systems, 34:30339-30351, 2021.
Shaopeng Fu, Fengxiang He, Yang Liu, Li Shen, and Dacheng Tao. Robust unlearnable examples: Protecting data against adversarial learning. arXiv preprint arXiv:2203. 240.32203.1433,, 2022.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearnable examples: Making personal data unexploitable. arXiv preprint arXiv:2101.0488 2021.
Yiding Jiang, Behnam Neyshabur, Hossein Mobahi, Dilip Krishnan, and Samy Bengio. Fantastic generalization measures and where to find them. arXiv preprint 191iv:191..02178. 2019.
Nitish Shirish Keskar, Dheevatsa Mudigere, Jorge Nocedal, Mikhail Smelyanskiy, and Ping Tak Pe- ter Tang. On batch training for deep learning: Generalization gap and sharp minima. arXiv preprint arXiv: 169.0:160. 2016.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Hao Li, Zheng Xu, Gavin Taylor, Christoph Studer, and Tom Goldstein. Visualizing the loss land- scape of neural nets. Advances neural information processing systems, 31, 2018.
Tao Li, Pan Zhou, Zhengbao He, Xinwen Cheng, and Xiaolin Huang. Friendly sharpness-awar aware minimization. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 5631-5640, 2024.
11

---

Published as a conference paper at ICLR 2025
Zhuoran Liu, Zhengyu Zhao, and Martha Larson. Image shortcut squeezing: Countering perturba- tive availability poisons with compression. In International conference on machine learning. pp- PMLR. 2023.
Behnam Neyshabur, Srinadh Bhojanapalli, David McAllester, and Nati Srebro. Exploring general- ization in deep learning. Advances in neural information processing systems, 30, 2017.
Tianrui Qin, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhone Xu. Apbench: A unified benchmark for availability poisoning attacks and defenses. arXiv preprint WrXiv:2308.03258
2023a.
Tianrui Qin, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu. Learning the un-
learnable: Adversarial augmentations suppress unlearnable example attacks. arXiv preprint arXiv:2303.15127, 2023b.
Olga Russakovsky, Jia Deng. Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma. Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115:211 2015.
Pedro Sandoval-Segura, Vasu Singla, Liam Fowl, Jonas Geiping, Micah Goldblum, David Jacobs, and Tom Goldstein. Poisons that are learned faster are more effective. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 198-205, 2022a.
Pedro Sandoval-Segura Vasu Singla, Jonas Geiping, Micah Goldblum, Tom Goldstein, and David Jacobs. Autoregressive perturbations for data poisoning. Advances in Neural Information Pro- cessing Systems, 35:27374-27386, 2022b.
Lue Tao, Lei Feng. Jinfeng Yi, Sheng-Jun Huang, and Songcan Chen. Better safe than sorry: Pre- venting delusive adversaries with adversarial training. Advances in Neural Information Process- ing Systems, 34:16209-16225, 2021.
Kaiyue Wen, Tengyu Ma, and Zhiyuan Li. How does sharpness-aware minimization minimize sharpness? arXiv preprint arXiv:2211.05722 2022.
Shutong Wu, Sizhe Chen, Cihang Xie, and Xiaolin Huang. One-pixel shortcut: on the learning preference of deep neural networks. arXiv preprint arXiv:2205.. 12141, 2022.
Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie- Yan Liu. Availability attacks create shortcuts. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 2367-2376, 2022.
Tianhe Yu. Saurabh Kumar, Abhishek Gupta, Sergey Levine, Karol Hausman, and Chelsea Finn. Gradient surgery for multi-task learning. Advances in Neural Information Processing Systems, 33:5824-58366 2020.
Chia-Hung Yuan and Shan-Hung Wu. Neural tangent generalization attacks. In International Con- ference on Machine Learning, pp. 12230-12240. PMLR, 2021.
Amir R Zamir, Alexander Sax, William Shen, Leonidas Guibas, Jitendra Malik, and Silvio Savarese. Taskonomy: Disentangling task transfer learning. In Proceedings of the IEEE con- ference on computer vision and pattern recognition, pp. 3712-3722, 2018
Hongyi Zhang. mixup: Beyond empirical risk minimization. arXiv preprint 17100.171..09112, 2017.
Kaijie Zhu, Xixu Hu, Jindong Wang, Xing Xie, and Ge Yang. Improving generalization of ad- versarial training via robust critical fine-tuning In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4424 4434, 2023.
Yifan Zhu, Lijia Yu, and Xiao-Shan Gao. Detection and defense of unlearnable examples. In Proceedings of the AAAI Conference Artificial Intelligence, volume 38, pp. 17211-17219. 2024.
12

---

Published as a conference paper at ICLR 2025
A
APPENDIX
A.1 1
VISUALIZATION OF UES UNDER MULTI-TASK SCENARIOS
Please refer to Figure for more details.
30-
Random
of Metrictt))
20
DPS
EM
10
oojeettjet object
mutidden s0go aookpion
kaypuinnd
keppontate
natmal
priniia surveure reshading
vegmmnt uncupdd unouptdd
edge
Figure 6: Current UEs fail in multi-task model training with ResNet backbone and Taskonomy dataset (the task metrics do not show a significant decrease compared to the vanilla training, and the fluctuation range is even close random noise). The perturbations of the 4 selected UEs are considered to have obvious linear separability in classification; yet in multi-task practice, they do not succeed in the classification tasks. The results demonstrate that existing UEs struggle to perform effectively in multi-task scenarios.
Task Similarity Tree
Objectt Class -0.00052
X X:2D Keypoints lD Segm
XX Fuc Reshannnn
100222--000000000 --0000000
Metric Diff'
-0.004240
0-0.00041
(Error-Min)
-0.000094 0.00167
0.00083
0.36796
Figure 7: The visualization of the performance of EMM (Error-Minizing noise under multi-task learn- ing. The task similarity tree the figure derived from Zamir et al. (2018), where X represents other tasks. The task metric values and connections in the figure represent the impact of perturba- tions of UEs found through EM training (with the loss function being the sum of the tasks at both ends of the connection) from the figure that perturbations found using the EM are difficult to succeed, whether for tasks with high similarity (Object Class, and Scene Class.) Reshading). The experimental results imply that the failure of UEs on multi-task learning is not only due conflicts between different tasks but may also be because the perturbations are more fragile than the samples, with fewer distinct features.
vanilla training acToss tasks of different similarity. It can be observed
for tasks with low similarity (Scene Class. and
A.2 VISUALIZATION OF UES UNDER CROSS-TASK SCENARIOS
Please refer Figure 8 for more details.
A.3 VISUALIZATION OF THE CUMULATIVE DISTRIBUTION OF MODEL PARAMETERS
Please refer Figure 9 for more details.
13

---

Published as a conference paper at ICLR 2025
Méniarn Minizanng Sep
Kesponnt
Figure 8: Difference in model performance between poisoned models (trained on UEs) and clean models (trained on the vanilla dataset) under cross-task scenarios with ResNet backbone and Taskon- omy dataset. EM (*) denotes the Peror-Minimizing (Huang et al. (202T)) perturbation using the loss function of specific task, whereas All signifies the use of the sum of loss functions from all tasks. The & following the metric indicates that a lower value corresponds to better model performance. The results demonstrate that existing UEs struggle to perform effectively in cross-task scenarios.
1.0
0.8
Cumulstive Probability
0.6
0.4
Vanilla944.11%)
EM(26.52%)
REM(30.26%)
0.2
DC(18.51%)
TAP(29.85%)
0.223)
DPS:11.99)
0.000
0.002
0.006
0.008
0.010
0.012
0.016
0.018
0.020
Parameter Value
Figure 9: Visualization of the CDF of model parameters between clean training and poison training. can be clearly seen that the distribution the parameter values of the model trained on UEs smaller than vanilla training.
A.4 DETAILS OF PCA IN VISUALIZING OPTIMIZATION TRAJECTORY
Visualization of loss landscape help feel the way of the learning campaign of models (Li al. (2018)) In the high dimensional parameter space, the most straightforward way to find two direc- tions eut through the high dimensional space and visualize loss values over that plane. The path's
14

---

Published as a conference paper at ICLR 2025
projection onto the plane spanned by random vectors in high dimensional space will look like ran- dom walk because they have a high probability of being orthogonal, and can hardly capture any vari- ation for the optimization path. Therefore, there two approaches to better visualize the trajectory of model optimization. The first approach involves employing PCA along the optimization path to identify the most relevant orthogonal directions. The second approach aims reduce the num- ber of model parameters as much as possible to compress the dimensionality space. We utilize the PCA method from the sklearn library, setting womponenntsssss min (optim wath_matriz Our findings reveal that whether it is the LeNet-5 trained on the MNIST dataset simple classifier with parameter dimensions of (12,10) trained on a Toy Classification task, the first two parameters account for over 90% in the PCA analysis. This implies that the relevance of subsequent parameters significantly lower, making it challenging to effectively visualize the optimization trajectory.
A.5 VISUALIZATION OF LOSS LANDSCAPE
This the visualization of the loss landscape of the training process the naive classification dataset and MNIST dataset.
target mininum
tanget local
premeter 9.84
Dorameter 13.1%
O
-2
-18
parameter O,
parameter C, 64.1%
(a) Vanilla (MNIST)- Top parameters
(b) OPS (MNIST) Top parameters
targe: local minimum
tanget local minimum
30
persmeter 3.0.2%
paramesor 3.0.3%
30
-223
-331
paramater 1.2%
paramater 2, 1.6%
(c) Vanilla (Naive Class.) 3rd&c4th parameters
(d) OPS (Naive Class.) 3rd&c4th parameters
Figure 10: Optimization in loss landscape of training process on naive classification dataset and MNIST dataset. We use PCA for dimensionality reduction and the x-axis and y-axis are selected 3rd& parameter values.
A.6 VISUALIZATION OF SAL
This is additional visualization of the results for Figure
15

---

Published as a conference paper at ICLR 2025
Vanilla
Conv
Layer
Head
Epoch REM
Conv
Layer
Head
Epoch
LSP
Conv
Layer
Head
Epoch
DC
Conv
Layer
Head
Epoch
Figure 11: Heat map of SAL variation of model parameters with training epochs.
Figure 12: Finding SAL threshold 3 to distinguish learnable and unlearnable parameters the vanilla dataset by K-means. The poisoned models have only a small number of learnable parameters in the early training stage, which quickly diminish the training proceeds.
16

---

Published as a conference paper at ICLR 2025
A.7 VISUALIZATION LEARNABLE PARAMETERS
This visualization of the proportion of learnable parameters under different UEs with SAL threshold [ obtained from Equation 4
0.25
Vanilla
0.15
0.10
0.00
EM
0.3
0.2
0.0
OPS
0.6-
Proportion Learnable Parameters
0.2
0.150
0.325
DC
0.100
0.00
0.025
0.000
REM
0.19
0.0
0.8
TAP
0.4
0.2-
0.20
LSP
100
Epoch
Figure 13: Proportion of learnable parameters under different UEs with SAL threshold 8 obtained from ftom|Equation 4
17


Reviews:
[{"review_id": "PwVhl30Usd", "reviewer": "Reviewer_6Uf4", "summary": "The authors investigate the limitations of current unlearnable examples (UEs), which aim to protect data ownership by making data unusable for model training. They discover that UEs generated for one task (e.g., image classification) can still contribute to performance improvement in other tasks (e.g., semantic segmentation) within multi-task learning settings. To address this, they introduce the concept of Sharpness-Aware Learnability (SAL) as a new metric to measure the unlearnability of model parameters. They further propose Unlearnable Distance (UD), a metric built on SAL, to quantify the unlearnability of data. Using UD, they benchmark existing unlearnable methods, revealing the gap between current research and the goal of creating truly unlearnable examples.", "questions": "Please refer to the weakness.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "1. Novel perspective on unlearnability: The authors explore the concept of cross-task unlearnability. They highlight the limitations of existing unlearnable methods that primarily focus on single-task scenarios, revealing their ineffectiveness in multi-task settings. \n\n2. Focus on the training process: Instead of relying solely on test accuracy, the authors analyze the model optimization process during training to understand how UEs impact learning. This may provide a more in-depth understanding of the unlearnability mechanism compared to previous studies that focused on post-training model performance.\n\n3. Introduction of new metrics: The authors propose two novel metrics:\n\n    a. Sharpness-Aware Learnability (SAL): This metric quantifies the unlearnability of parameters by considering the impact of parameter updates on the loss landscape during training. \n\n    b. Unlearnable Distance (UD): This metric, built on SAL, measures the overall unlearnability of data by analyzing the proportion of learnable parameters in models trained on UEs compared to models trained on clean data.", "weaknesses": "1. Limited explanation of multi-task unlearnability failure: While the authors identify the failure of existing UEs in multi-task scenarios, they provide a limited explanation for this phenomenon. They point towards the inherent difficulties of multi-task learning, specifically conflicts between different tasks, as a potential reason. However, a more detailed analysis of how these conflicts affect unlearnability is lacking. For instance, do UEs designed for one task interfere with the learning of other tasks? Or do the shared representations learned in multi-task models somehow overcome the unlearnability effect of UEs? The authors do not fully address these questions.\n\n2. Limited scope of multi-task experiments: The multi-task experiments are primarily conducted on the Taskonomy dataset using only 4 tasks, which might not be representative of all multi-task learning scenarios. Exploring the effectiveness of UEs on other multi-task datasets with more diverse tasks and complexities would strengthen the claim of cross-task unlearnability failure.\n\n3. Lack of discussion on practical implications: The authors briefly mention the need for better data protection strategies, but they do not discuss the practical implications of their findings in detail. How can the insights from this research be translated into real-world solutions for protecting data ownership? What are the potential challenges in implementing these solutions? \n\n4. Poor visualization of figures: Some figures are not well-visualized, especially the color, linewidth and font size are not well-chosen. For example, figures 1, 2, and 4 are hard to read in the printed version.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nZb6NcxwvB", "reviewer": "Reviewer_H1LC", "summary": "This paper addresses the challenges of unlearnable examples (UEs) in the context of model training, particularly highlighting their unexpected performance in multi-task Taskonomy. The authors reveal that existing unlearnable methods fail to achieve true unlearnability, prompting an exploration of the convergence differences between clean and poisoned models through loss landscape analysis. The authors introduce two key concepts: Sharpness-Aware Learnability (SAL) for quantifying parameter unlearnability, and Unlearnable Distance (UD) for measuring data unlearnability. The paper benchmarks existing methods using UD, aiming to illuminate the limitations of current approaches and guide future research towards more effective unlearnable examples.", "questions": "- Revisiting Figure 1, it highlights that the Error Minimization (EM) method struggles to perform effectively in multi-task scenarios. I'm curious if any recent methods have also faced similar limitations.\n- I'm curious about the  generalizability of the evaluation metrics.  The experiments predominantly emphasize classification tasks; including evaluations on other downstream tasks, such as semantic segmentation, object detection, and even applications in large language models, would enhance the study's relevance and generalizability. This narrow focus may limit the applicability of the findings to other domains or unlearnable methods not considered in this research.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper is  well written and easy to follow.\n- The motivation and background is explained clearly. Arguments and claims are supported by  experimental results.\n- The paper provides a new perspective  to  evaluate the data unlearnability through the introduction of SAL and UD. These metrics provide valuable insights into the effectiveness of unlearnable methods and address a gap in existing evaluation methods that rely solely on post-training performance metrics", "weaknesses": "Limited Scope of Experiments: While the paper investigates unlearnability in multi-task settings, the experiments primarily focus on specific datasets, such as CIFAR-10 and CIFAR-100. It would be valuable to see results on larger and more complex datasets, like ImageNet.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "3JNaqmKPBQ", "reviewer": "Reviewer_yDjs", "summary": "This paper addresses the concept of “unlearnable examples” (UEs), which are data samples designed to prevent unauthorized model training by impairing their usability. While current methods produce UEs effective in single-task settings, the paper reveals their limitations in multi-task scenarios. The authors explore unlearnability through the lens of model optimization and introduce Sharpness-Aware Learnability (SAL) as a metric to measure parameter unlearnability. Additionally, they propose “Unlearnable Distance” (UD) to benchmark existing UE methods across tasks.", "questions": "Given the identified limitations of existing unlearnable examples (UEs) in multi-task scenarios, could SAL and UD metrics be used to improve UE robustness across diverse tasks?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper identifies a crucial gap in current unlearnable example (UE) methods by showing their limited effectiveness in multi-task scenarios.\n2. The authors present SAL as a metric that evaluates the unlearnability of parameters, providing a fresh approach that goes beyond traditional test accuracy to measure how model parameters respond to UEs during training.", "weaknesses": "While the paper highlights the limitations of existing unlearnable example (UE) methods in multi-task scenarios, it does not provide solutions or adaptations to improve UE robustness across tasks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)