When Priors Backfire: On the Vulnerability of Unlearnable Examples to Pretraining
Authors: Zhihao Li
Gezheng Xu
Jiale Cai
Ruiyi Fang
Di Wu
Qicheng Lao
Charles Ling
Boyu Wang
Venue: ICLR 2026 Poster (2026)
Keywords: unlearnable examples
data privacy
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Unlearnable Examples (UEs) serve as a data protection strategy that generates imperceptible perturbations to mislead models into learning spurious correlations instead of underlying semantics. In this paper, we uncover a fundamental vulnerability of UEs that emerges when learning starts from a pretrained model. Crucially, our empirical analysis shows that even when data are protected by carefully crafted perturbations, pretraining priors still furnish rich semantic representations that allow the model to circumvent the shortcuts introduced by UEs and capture genuine features, thereby nullifying unlearnability. To address this, we propose $\textbf{BAIT}$ ($\textbf{B}$inding $\textbf{A}$rtificial perturbations to $\textbf{I}$ncorrect $\textbf{T}$argets), a novel bi‑level optimization formulation. Specifically, the inner level aims at associating the perturbed samples with real labels to simulate standard data-label alignment, while the outer level actively disrupts this alignment by enforcing a mislabel-perturbation binding that maps samples to designated incorrect targets. This mechanism effectively overrides the semantic guidance of priors, forcing the model to rely on the injected perturbations and consequently preventing the acquisition of true semantics. Extensive experiments on standard benchmarks and multiple pretrained backbones demonstrate that BAIT effectively mitigates the influence of pretraining priors and maintains data unlearnability. Code is available at https://github.com/zhli-cs/BAIT.

Published as a conference paper at ICLR 2026
WHEN PRIORS BACKFIRE: ON THE VULNERABILITY OF UNLEARNABLE EXAMPLES TO PRETRAINING
Zhihao Li'
Gezheng Xu
Jiale Cail
Ruiyi Fang'
Di Wu? Qicheng Lao
Charles Ling
Boyu Wang
Western University
Concordia University
3 Beijing University of Posts and Telecommunications 4 Vector Institute
{zli344 4, 6, gxu86, j jcai336, rfang32, charles. dingheuwoo.o di www.wu@ccnnooooo www.wocooodda.a..ooooo. ca gicheng. la laoßbupt.. edu. on bwangêcsd, uwo ca
ABSTRACT
Unlearnable Examples (UEs) serve as a data protection strategy that generates imperceptible perturbations to mislead models into learning spurious correla- tions instead of underlying semantics. In this paper, we uncover a fundamen- tal vulnerability of UEs that emerges when learning starts from pretrained model. Crucially, our empirical analysis shows that even when data are protected by carefully crafted perturbations, pretraining priors still furnish rich semantic representations that allow the model to circumvent the shortcuts introduced by address
UEs and capture genuine features, thereby nullifying unlearnability. this, propose BAIT (Binding Artificial perturbations to Incorrect Targets), novel bi-level optimization formulation. Specifically, the inner level aims at as- sociating the perturbed samples with real labels simulate standard data-label alignment, while the outer level actively disrupts this alignment by enforcing a binding that maps samples to designated incorrect targets. This mechanism effectively overrides the semantic guidance of priors, forcing the model rely the injected perturbations and consequently preventing the ac- quisition of true semantics. Extensive experiments on standard benchmarks and multiple pretrained backbones demonstrate that BAIT effectively mitigates the in- fluence of pretraining priors and maintains data unlearnability. Code is available at htt.ts: thub. com/ i CS/BAIT
INTRODUCTION
The rapid growth of social media has produced massive online data, enabling large-scale datasets (Deng et al. 2009 Lin et al. 2014) and propelling data-driven deep learning (Ye et al., 2024 Xu et al. 2025b Ji et al. 2025). However, it also raises concerns over unauthorized usage. To safeguard privacy, Unlearnable Examples (UEs) have emerged as promising data protection strategy (Huang ct al. 2021 Yu al. 2025). By injecting perturbations into training data, UEs induce models to cap- ture spurious shortcuts rather than underlying semantics, thereby degrading clean test performance.
Liu et al. 2024a) primarily target randomly initialized models. However, as training from seratch is annotation iunnotationinntesivve practitioners commonly adopt pretrained backbones (lofinova et al. pretrained models remains unexplored, leaving a critical gap in assessing their real-world applica- bility. Meanwhile, UEs essentially operate by injecting spurious shorteuts (Huang al. 202 Ren et al. 2023). and recent studies indicate that pretraining can improve robustness to spurious correla- tions Tu et al. 2020) Izmailov al. [202]] Mehta al., (022)). This motivates us to raise a natural question: Can unlearnable examples remain effective when applied to pretrained models?
Existing studies YYu al.
2022
2022 Fang al. 2023 Lu et al., 2024). Yet the behavior of UEs
In this paper, we uncover an overlooked yet fundamental vulnerability of UEs when applied to a pre- trained model. As shown in Figure [a] pretrained models exhibit substantially higher test accuracy compared with their train-from-scratch counterparts, indicating that they circumvent the unlearnabil- ity and acquire authentic semanties. We hypothesize that pretraining priors are the primary factor
Corresponding author

---

Published as a conference paper at ICLR 2026
300
DVV
100
Test Accumcc (N
Acourscy (56)
10
H4 pin
80
10
Au Oiie
20
UE Method
(.2344) B354)
344
Presaining
14
#pach
Esoch
(a) Performance Cap
(b) Effect of Priors
(c) Parameter Updates
(d) PT Learning Curves
Figure/ 1: Empirical analysis of the vulnerability of UEs to pretraining priors. All experiments
conducted on CIFAR-10 with ResNet-18. (a) Existing UE methods suffer severe unlearnability degradation when applied to pretrained (PT) backbones instead of ceii-frommscrattee (TS) models. (b) We progressively replace layers of four-layer ImageNet pretrained ResNet-18 with randomly initialized layers until obtaining ishes as pretraining priors are removed. (c) We report the normalized model parameter updates when training on clean data and UEs (details Appendix B.I]. We observe that effective perturbations result in minimal parameter updates. In contrast, pretrained models bypass the spurious correlations induced by EMN (Huang et al. 202T) and remain fully optimized. (d) We plot the learning curve starting from a pretrained backbone. The concurrent rise in the training and test accuracy of EMN indicates that such substantial parameter updates drive the model to acquire real semantics rather than the injected shorteuts, thereby nullifying the unlearnability.
rrai-from-scrateee model. The resistance to UEs steadily dimin-
that enables models to bypass the UE-induced spurious correlations. To investigate their roles, we progressively remove priors by replacing the pretrained layers with randomly initialized ones and observe that the test accuracy consistently decreases, indicating that the unlearnability strengthens as priors are reduced, as illustrated in Figure [bb] We further posit that the presence of pretraining priors facilitates semantic-label pathway, which guides models to exploit underlying semantics rather than the perturbation-labe shorteuts, thereby enabling the resumption of effective learning- To validate this, we examine the parameter update dynamics when training on clean data versus UEs generated by EMN (Huang et al. (021). as shown in Figure Ic Our observations reveal that for pretrained models, the parameter update magnitude on UEs parallels that of clean data and con- siderably exceeds that of ceiin-from-ccree curve of a pretrained model in Figure [d and observe that EMN demonstrates prominently higher test accuracy. This implies that such substantial parameter updates propel the model to learn real representations. Consequently, driven by the semantic pathway inherent in priors, models are able to resume learning meaningful image features rather than being confined to the UE-introduced spu- rious correlations. These findings highlight that existing UE methods are vulnerable pretraining, as strong priors enable models to bypass their protection and acquire real semantics.
counterparts. To delve deeper, we analyze the learning
To address the aforementioned limitation, we propose BAIT (Binding Artificial perturbations to Incorrect Targets), novel bi-level optimization framework designed to counteract pretraining pri- ors. The core idea to disrupt the standard data-label alignment reinforced by priors and instead re- cover the UF-induced spurious perturbation-late correlation. To achieve this, we devise a mislabel- perturbation binding mechanism that explicitly associates perturbations with incorrect labels that are semantically distinct from the ground truth. Specifically, the inner level utilizes pretraining priors to simulate standard data-label correspondences, while the outer level optimizes perturbations to map perturbed images onto designated incorrect targets, overriding the underlying semantic- dependency induced by pretraining priors. This mechanism blocks models from readily exploiting pretraining priors, compelling reliance on perturbations and impeding the acquisition of meaningful semantics. As demonstrated in Figure [ our method successfully reduces the test accuracy to chance level in the presence of pretraining priors. Our main contributions are summarized as follows:
We reveal that UEs suffer from a fundamental vulnerability when applied to pretrained backbones. We also empirically demonstrate that pretraining priors enable models to cir- cumvent UE-induced shortcuts and acquire true semantics.
We propose BAIT, a bi-level optimization framework that binds perturbations to incorrect target labels, thereby disrupting the semantic-label mapping underpinned by pretraining priors and reconstructing the synthetic perturbation-late correlations.
Extensive qualitative and quantitative experiments demonstrate the effectiveness and gen- eralizability of BAIT against various pretrained backbones.
2

---

Published as a conference paper at ICLR 2026
2 RELATED WORK
Recent studies have increasingly focused on socictal implications, encompassing critical dimensions such as privacy (Li et al. 2025a Zheng et al. 2025 Pu et al., 2025b), safety (Huang et al. 2020).
and faimess (uu al. 2024). Unlearnable Examples (UEs) have emerged a promising protection approach to prevent unauthorized data usage (Sandoval-Segura et al. 2023 Wang et al. (025b). The goal is inject imperceptible perturbations into data such that models trained on these perturbed samples achieve high training accuracy but fail to generalize to the clean test set, with test accuracy dropping the chance level. To achieve this, prior studies mainly introduce "shortcuts" during training, guiding models to memorize synthetic perturbation-label associations instead of learning real semanties "Sandoval-Seguni et al., 2022 Wu et al., 2023 Wang al.) 2025a). Recently, UEs have been extended to diverse realistic settings. Some works (He et al. [2023] et al. (024)
explore unsupervised regimes, whereas UC (Zhang et al. 2023) and 14A (Chen al. (024) inves-
tigate label-agnostic scenarios and cross-dataset transterability, respectively. Additionally, VTG (Li
ct al. 2025b) offers a comprehensive assessment covering distribution shifts (Guo et al., 2024 Fang al. 2025b; Xu et al. (2025a), novel classes, and input space discrepancies. Moreover, the applica- al.] (2025a) to other tasks,
bility of UEs has extended beyond classification (Guo et al. 2023 Fang et al. such segmentation (Sun al., 2024), point clouds (Zhu et al. 2024), and diffusion models (Zaao et al. 2024). These studies have greatly promoted the development of the UE literature.
However, existing efforts predominantly focus on applying UEs to randomly initialized backbones, which neglects the practical yet crucial case of pretrained models that underpin most modern ap- plications, leaving a critical gap in the current UE literature. While some UE studies (Qin et al. 2023 Sun et al., 2024) utilize pretrained models for perturbation generation or auxiliary evaluation, they lack systematic investigation into the vulnerability of UEs against pretrained models and offer no corresponding countermeasures, To the best of our knowledge, we make the first attempt to un- cover the vulnerability of UEs against pretrained backbones and design novel bi-level optimization framework neutralize the influence of pretraining priors.
PROPOSED METHOD
In this section, we describe the UE setting targeting pretrained backbones and propose BAIT, bi-level framework designed to bind perturbations to incorrect labels. Then, we elaborate on the implementation details and optimization strategies to construct effective UEs.
3.1 PROBLEM SETUP
In contrast to existing UE studies that target cein-ffomm-cratel classifiers, we introduce a new UE setting that focuses on rendering data unlearnable for pretrained classifiers. Such models possess rich prior knowledge from their pretraining data and thus are harder to be misled by the injected unlearnable perturbations. Below, we formulate the problem in the context of image classification.
Objectives. Let (x, y) be labeled example, where x E X' is a data point, and y E y = (1..... K) its label. We denote the clean training and test sets De. D., respectively. The goal of UEs is to transform the training set DD into an unlearnable dataset D., by injecting perturbations ô to each example as x' x + 5. Generally, the perturbation ō is constrained by ||0||p S c. ensuring imperceptibility to human vision, where Illpp denotes the Lp norm and e is chosen to be sufficiently small. A pretrained classifier fo X - Ay. where 0 is the model parameter and Ay denotes the probability simplex over the label space y, is fully finetuned on D.,. The effectiveness of perturba- tions then evaluated by measuring the performance degradation of fo on the clean test set D,, which would approximate the chance level if 5 can successfully counter the pretraining priors of fo and establish artificial perturbation-late correlations for the training process.
3.2 BINDING ARTIFICIAL PERTURBATIONS TO INCORRECT TARGETS
Existing works primarily focus designing UEs to protect data from train- ciin--foo-scratte classi- fiers. However, as shown in Figure [ their unlearnability diminishes substantially when applied to pretrained backbones, where priors bypass spurious correlations and allow the model to learn real
3

---

Published as a conference paper at ICLR 2026
data-label relationships. This fundamental vulnerability severely limits the practical deployment of UEs in protecting personal data from unauthorized exploitation.
To address the aforementioned limitation, we propose BAIT, novel bi-level optimization frame- work" designed to bind artificial perturbations to incorrect targets that are semantically distinct from the ground truth, thereby deliberately diverting the learning process from genuine semantics. To achieve this, we devise a mislabel cosslabel-eerturaation binding mechanism that disrupts the inherent data- label alignment established by priors. This mechanism enforces class-wise perturbations domi- nate the model's predictions, which steer the input to a designated incorrect target class regardless of the original image content. The formulation of BAIT is detailed as follows:
min ((f(ax v0))
5 s.t. O arg
(1)
(fo( ( +8)),')
where x, y, and ô are samples, labels, and class-wise perturbations, respectively; superscripts i.j fl..... K} + j) indicate distinct classes, with K representing the total number of classes; function fo refers to a pretrained surrogate parameterized by 8; L denotes the cross cross-entropy loss.
The inner and outer objectives BAIT are intricately coupled form a dynamic interplay. Specifi- cally, (1) The inner optimization on model parameters aims to align the perturbed inputs with ground truth labels, fostering a standard semantic alignment. Concretely, a sample x: from class is per- turbed by the corresponding class-wise perturbation 5' and mapped to its true label y'- (2) The outer optimization over perturbations actively breaks the data-label alignment established in the inner level and dynamically enforces intentional
pertur-petttnntionn bindings. Unlike prior UE methods (Huang et al. 2021: Ren et al., 2023, Fu et al., 2022) that preserve the original data-label correspondence (x' + 8" y²), we impose more challenging cross-label assignment, explicitly mapping perturbed samples to designated incorrect target labels (x* + 8 - w²). This mislabel- perturbation binding mechanism deliherately overrides the prior-driven data-label alignment, forc- ing models to rely on the spurious shortcuts induced by perturbations as the dominant training signal. Consequently, BAIT neutralizes the influence of pretraining priors, yielding unlcarnable examples that inhibit pretrained models from capturing intrinsic semantics.
3.3 OPTIMIZATION STRATEGY FOR CRAFTING EFFECTIVE UNLEARNABLE EXAMPLES
Perturbation Generation. We follow prior UE methods (Liu et al. 2024a Chen al. 2024 and develop a generator G to produce perturbations. G is designed with a standard encoder-decoder structure, which takes raw images as input and generates perturbations as ô G(x)). To ensure visual imperceptibilitty we constrain the perturbation magnitude by ||01 oo < with = 8/ /55, in
accordance with previous works (Huang al. 2021 Ren al. 2023 Liu al. 2024a).
Learning to Learn Unlearnable Perturbations. Directly minimizing the full bi-level objective in Equation T is intractable. To overcome this challenge, we adopt meta-learning strategy (Finn et al. 2017: Huang et al.) 2020 Liu et al. 2202b)). approximating the outer objective by unrolling the inner optimization for N steps. Specifically, model weights and 8 denote the perturbation (initialized to zero at the start of training). We create a copy of the current surrogate weights, On,p +- On which is then updated through N inner-level optimization steps as follows:
the n-th iteration, let 6,, denote the surrogate
0 On Vo.. C + +8)),"",
where E 10, 1,..,, N 1}. and indicates the learning rate that controls the step size. This N-step unrolling enables a "look ahead" perspective during training, allowing us to explicitly assess how perturbations introduced at the current step gradually influence the outer ceslabel-perturbattin binding objective after N inner updates.
We note that while several previous studies (e.g., EMN (Huang et al. 2021). TUE Ren et al. 2023 refer to their formulations as bi-level optimization. they effectively implement min- min optimization solved in an alternating manner. BAIT distinguishes itself hy employing formal bi-level structure, which allows for more rigorous decoupling of the objectives explicitly neutralize the influence of pretraining priors.
4

---

Published as a conference paper at ICLR 2026
The unrolled surrogate model with weights ",,, v is then employed in the outer-level optimization to update perturbations, enforcing the perturbed samples onto incorrect target labels and misleading the intrinsic semantic-labes connection within pretraining priors, which is shown below:
8 + 5% VV E (m.)) C(fo(x' +,)))"))
(3)
where i,j E (I...., K) (i j) denote class indices; 8 indicates the learning rate optimize perturbations. In this procedure, each sample a from class i perturbed with 8 from a different class j and forced towards the target incorrect label y². which optimizes perturbations that counter pretraining priors and prevent the model from relying on priors to associate samples with real labels.
The updated perturbations are incorporated into the corresponding samples at the inner level, and the surrogate model 0n is then updated accordingly to 0n+1, which serves as the initialization for the next iteration:
0n+1 = nn a (a.g)) ((fe(x' + +0"),y".
(4)
The above meta-learning procedures are executed iteratively throughout the entire training process, ultimately yielding the optimized perturbations.
Curriculum-Guider Target Label Selection. To enhance the effectiveness of perturbations by di- recting perturbed samples toward diverse incorrect target labels, we dynamically select target labels rather than relying on fixed incorrect targets. Drawing inspiration from curriculum learning (Ben- gio et al. 2009: Wang et al. 2021), we design three-stage easy-to-hard strategy according to the likelihood misclassification, as shown below.
Stage 1: Hard Negative Classes. We first select the non-ground-truth class with the highest logit score. Since these classes are most easily confused with the true class, they provide a natural starting point for optimization.
Stage 2: Random Classes. We then randomly select non -ro---oou---uuth classes as the incorrect target class, increasing task difficulty and improving the generalizability of perturbations across varying target labels.
Stage 3: Most Dissimilar Classes. Finally, we select the class with the lowest logit score. This constitutes the most challenging case, as perturbations must push predictions toward semanti- cally unrelated classes.
This progressive curriculum learning strategy dynamically steers perturbations to perform mislabel- perturbation binding from easy increasingly difficult targets, thereby enhancing their ability to mislead pretraining priors away from aligning samples with true labels. As a result, models are forced to depend these perturbations for classification throughout training.
4 EXPERIMENTS
In this section, first evaluate the effectiveness of the proposed optimization framework against pretrained backbones on standard benchmarks. We further examine the transferability across differ- pretraining priors, larger datasets, and network architectures. Moreover, we verify its efficacy in the conventional frin-from-scrrtch setting and provide qualitative visualizations.
4.1 EXPERIMENTAL SETUP
Datasets and Backbones. Our experiments utilize standard benchmarks, including CIFAR- -10, CIFAR- 100 (Krizhevsky et al., 2009), and SVHN (Netzer et al.) 2011). Beyond these, we extend our evaluation Flowers (Nilsback & Zisserman 2008) and a 100-class ImageNet subset (Deng and more complex scenarios. Unless other- wise specified, evaluations are conducted on a fully trainable EangeNet-pretrainee backbone with a learning rate of 0.001, in contrast to prior studies that utilize randomly initialized models. Backbones include ResNet-13 18 (He et al. (016)). ResNet-50 (He et al. 2016). VGG-11 (Simonyan & Zisserman 2014), DenseNet- 121 (Huang al. 2017), GoogLeNet (Szgedyy al. 2015), Tiny- ViT (Wu al.
et al. 2009) to assess performance in higher-resolutee
2022). 3 Swin Transformer Tiny (Liu et al. 2021), and ViT-B/16 (Dosovitskiy et al,, (02T). The fully connected layer is modified to align with the class number of each downstream dataset. We employ
5

---

Published as a conference paper at ICLR 2026
Table 1: Test accuracy (%)
evaluation against ImageNet-pretrainee backbones.
Dataset
Backbone
Clean
EMN
TUE
REM
L.SP
GUE
14A
Ours
ResNet-18 18
84.10
61.82
82.72
74.46
54.20
23.17
65.70
14.40
ResNet-50
86.48
57.54
85.68
85.06
65.00
71.42
72.81
14.82
CIFAR-10
VGG-11
88.39
80.90
87.67
63.32
55.63
45.77
50.80
22.14
DenseNet-122 121
87.17
63.31
86.30
61.05
62.66
72.31
74.89
20.32
ResNet-18
55.73
55.53
55.20
55.22
36.98
54.09
33.67
20.77
ResNet-50
60.73
45.78
59.54
58.69
42.84
53.14
36.58
28.02
CIFAR-100
VGG-11
63.62
38.10
62.52
35.25
39.26
57.02
30.58
26.64
DenseNet-122 121
61.92
49.94
61.14
48.37
36.27
56.78
44.34
25.81
ResNet-18 18
90.96
37.55
41.15
76.45
38.91
39.68
81.47
14.37
ResNet-50
92.09
30.29
35.52
87.38
45.48
91.74
85.59
18.86
SVHN
VGG-11
93.34
56.24
77.54
51.50
49.89
32.14
82.89
17.75
DenseNet-121
92.97
58.22
40.53
71.87
53.56
73.34
86.83
11.61
classification accuracy the clean test set the evaluation metric, where lower accuracy signifies stronger unlcarnability.
Baselines.
We select six representative UE baselines, which are Error-Minimizing Noise (EMN) (Huang et al. 2021), Transferable Unlearnable Examples (TUE) (Ren el al., 2023). Robust
Biror-Minmmizing Noise (REM) (Fu et 2022), Linear Separable Perturbation (LSP) (Yu al.
2022
Game Unlearnable Example (GUE) (Liu et al. 2024a), and Universal Perturbation Generator
(14A)
CCenn et al. 2024).
Implementation Details. Our model is implemented with Py PyTorch and trained on single NVIDIA L40S GPU. Unless specified otherwise, we utilize an ImageNet-pretraine set its learning rate to 0.1. We adopt Adam (Kingma (014) with learning rate 3 of 0.001 to optimize perturbation generator. Perturbations are constructed class-wise by averaging individ- ual sample perturbations. The unrolling step is set to 1. For the three-stage curriculum learning strategy, we train each stage for 30 epochs on CIFAR- 10 and CIFAR-100, and 20 epochs on SVHN. Perturbations bounded by 8/255 for imperceptibilityy All results reported averages over five runs with different random seeds.
ResNet- 18 surrogate and
4.2 UNLEARNABILITY UNDER PRETRAINING PRIORS
Unlearnability against IrretnnetPreerrineed Backbones. To demonstrate the efficacy of BAIT in countering prior knowledge and gen- erating effective perturbations, we conduct comprehensive evaluations against ImageNet- pretrained backbones. Perturbations timized and evaluated on the same backbone ensure consistency. As shown in Table our method outperforms current UE methods all backbones and datasets. Specifically, it drives performance close to random guess- ing on CIFAR- 10 and SVHN, and achieves sub-
Table 2: Test accuracy (%) comparison against re-implemented baselines with pretrained surro- gates ImageNett ResNet-18.
Method CIFAR-10
CIFAR-100
SVHN
op-
EMN
59.84
45.20
32.33
TUE*
82.65
55.28
47.71
REM
56.08
34.30
55.26
Ours
14.40
20.77
14.37
stantial accuracy reductions on CIFAR-100 Notably, even though 14A (Chen et al. 2024) incorpo- rates a pretrained CL.P backbone aid perturbation generation, our method still surpasses on all benchmarks. These results highlight the superior capacity of BAIT to bind perturbations with des- ignated incorrect labels, compelling models to rely on perturbations rather than priors and thereby preventing models from learning genuine semantics.
Further Comparison to Re-implemented Baselines with ImageNet--Peetrained Priors. Several UE methods do not exploit pretraining priors when generating perturbations. Therefore, criti- cal question whether their deficiencies stem from this omission, and whether leveraging such priors would yield marked improvements. To rigorously examine this, re-implement represen-

---

Published as a conference paper at ICLR 2026
Table 3: Transferability across pretrained backbones with different priors. An ImageNet-pretraing ResNet- 18 is used as the surrogate model for perturbation optimization, and the resulting unlearnable examples are evaluated against prior knowledge from CIFAR-10, CIFAR- -00, and SVHN.
Dataset
Pretraining Prior
EMN
TUE
REM
LSP
GUE
Ours
CIFAR-100
48.58
82.26
60.88
60.64
27.05
20.58
CIFAR-10
SVHN
28.33
49.00
37.91
38.53
15.55
9.75
CIFAR-10
33.67
61.05
24.77
35.08
66.93
22.89
CIFAR-100
SVHN
62.57
62.18
16.77
26.14
59.10
11.21
CIFAR-10
19.13
12.80
70.43
26.73
29.35
11.27
SVHN
CIFAR-100
28.75
19.47
64.42
47.71
24.14
17.49
Table 4: Test accuracy (%) & evaluation against pretrained backbones on more complex datasets. Note that ImageNet" and ImageNet denote two randomly selected 100-class subsets of ImageNet with no overlapping classes.
Dataset
Pretraining Prior
EMN
TUE
REM
LSP
GUE
Ours
Flowers
ImageNet ImageNet*
44.36
46.63
43.91
47.76
45.18
24.91 37.72
ImageNet"
51.98
59.00
59.12
59.44
24.22
tative surrogate-basee based UE methods, replacing their randomly initialized surrogates with ImageNet- pretrained models to enable a fairer comparison. The revised variants are denoted as EMN", TUE", and REM', respectively. As shown in Table [ even with access to ImageNet priors during per- turbation optimization, our method consistently outperforms these baselines, exhibiting stronger capabilities to erode and disrupt pretrained knowledge. This advantage enables our unlearnable ex- amples to reliably counter pretrained backbones in practical applications and to provide sustained protection against unauthorized data usage.
Transferability across Diverse Pretraining Priors. As introduced in Equation I we employ an ImageNet-pretraine surrogate during perturbation optimization and then evaluate the resulting un- learnable data on maageNet-rretranng pretraining priors, we further examine the generalizability of BAIT across backhones pretrained on CIFAR-10, CIFAR-100 and SVHN, As shown in Table 3 BAIT clearly outperforms baselines and reduces the test accuracy substantially, demonstrating the efficacy of our UEs even when they are applied to backbones with different priors.
backbones. To consider practical scenarios involving diverse
Transferability to Larger Datasets.
We perform additional experiments to study the transferability of our perturbations to more complex datasets. We utilize CIFAR- 10 for perturbation optimization and subsequently evaluate the performance on Flowers 102 and an ImageNet subset. subset. For Flowers 102, ResNet-18. For ImageNet, to miti-
conduct evaluations against standard ImageNet-pretrainee gate potential data leakage between the pretraining and finetuning phases, we partition ImageNet- K into disjoint subsets. Specifically, we first randomly select 100 classes construct the pretraining dataset, denoted as ImageNet', which is utilized to pretrain ResNet-18 backbone. Subsequently, sample distinct set of 100 classes (with no overlap with ImageNet ) to serve the down- stream data, denoted as ImageNet".. From Table we observe that our method clearly outperforms baselines, highlighting its superior transferability and effectiveness on more challenging scenarios.
Aresttrrchee Unlearnability. We further examine the transferability of unlcarnability across network architectures. As shown in Figure 2 perturbations are optimized with surrogate ResNet- 18 and evaluated on both conventional CNN-based pretrained backbones (ResNet-50, VGG-11, DenseNet-121. and GoogLeNet) and advanced ViT-based pretrained backbones (Tiny-ViT, Swin Transformer Tiny, and VřT-B/16). The results on CIFAR-10 and CIFAR-100 consistently validate that BAIT effectively induces cross-architecture unlearnability, outperforming baselines by distinct margin. We also observe that advanced ViT-basee backbones possess stronger resilience to unleam- able data. For example, TUE retains over 90% test accuracy on CIFAR- 10, and GUE exceeds 80% on CIFAR-100. These findings indicate that richer priors manifest superior resistance to the ap-
Cross-
7

---

Published as a conference paper at ICLR 2026
CIFAR-10
CIFAR-100
Swin Tiny
ResNet-50
Swin Tiny
ResNet-50
Viny
VGG-11 Viny
VGG-11
GoogLeNet
DenseNet-122
GoogLeNet
DenseNet-121
EMN
TUE
LSP
GUE
Ours
Figure Evaluation of unlearnability transferability (test accuracy (%) 4) across architectures, where UEs are generated using ResNet-18 surrogate and evaluated against diverse pretrained back- bones (including CNNs and ViTs).
Table 5: Ablation study target label selection on ResNet-18. Stages 1, 2, and 3 denote selecting target labels from Hard Negative, Random, and Most Dissimilar Classes, respectively.
Stagel
Stage2
Stage3
CIFAR-10
CIFAR-100
SVHN
23.68
35.75
21.75
20.60
23.94
16.58
14.40
20.77
14.37
Table 6: Test accuracy (%) 4. evaluation against randomly initialized backbones on CIFAR-10.
Method
ResNet-
ResNet-50
VGG-11
DenseNet-121
EMN
16.42
13.45
16.93
14.71
TUE
10.67
12.23
12.79
17.60
REM
15.18
25.57
47.68
41.54
LSP
13.54
15.94
17.15
17.47
GUE
13.25
12.97
23.89
13.71
14A
41.34
24.85
39.87
48.97
Ours
10.18
10.01
10.13
10.05
plied perturbations. Nevertheless, our method clearly surpasses baselines and successfully enforces unlcarnability, thereby further demonstrating the efficacy of the proposed BAIT framework.
4.3 ABLATIONS AND FURTHER ANALYSES
Impact of ceerriculu-guuider Target Label Selection. The selection of target labels is crucial to establishing effective ceslaael-perturbation bindings. To investigate the role of curriculum learning, we conduct rigorous ablation studies. As shown in Table 5 unlearnability against pretrained priors improves progressively with the inclusion of each stage. Specifically, we observe that selecting hard negative classes as the incorrect target labels (Stage 1) introduces the basic unlearnable effect, while incorporating random classes (Stage 2) and the most dissimilar classes (Stage 3) further strengthen it. These results highlight the contribution of each curriculun-guider stage and demonstrate that the synergistic integration of all three stages leads to the strongest performance.
Unlearnability in the Conventional Train-from-Scrattee Setting. BAIT also provides feasi- ble solution when evaluating UEs with randomly initialized backbones. As shown in Table [) we observe that while baseline methods demonstrate competitive unlearnaility, method exhibits perior efficacy and yields the lowest test accuracy. These results underscore the broad applicability of BAIT across both pretrained and randomly initialized backbones.
Resistance to Defenses. To evaluate the resilience against potential countermeasures, we apply di- verse defense strategies, encompassing standard augmentations (Cutout Vries & Taylor 2017).
8

---

Published as a conference paper at ICLR 2026
Table Test accuracy (%) & evaluation against an SeaageNet--retrrannee ResNet-18 under additional defenses, where CIFAR-10 10 is utilized as the downstream dataset.
Method
w/o
Cutout
CutMix
Mixup
Clean
84.10
83.25
83.06
84.14
EMN
61.82
51.60
54.71
68.70
TUE
82.72
81.54
81.35
82.69
REM
74.46
65.39
73.71
78.08
LSP
54.20
44.68
51.53
59.44
GUE
23.17
29.31
28.30
34.48
Ours
14.40
13.69
14.58
21.08
Table 8: Test accuracy (%) comparison against ImageNet-pretrained ResNet-18 with JPEG
compression defense on CIFAR-10 10.
JPEG Compression
90
80
70
60
50
40
30
20
10
Clean
82.64
82.13
81.08
80.58
80.03
79.19
77.77
75.64
73.95
EMN
68.22
69.09
69.23
69.13
69.91
71.32
73.47
74.18
74.46
TUE
81.21
80.41
79.91
79.62
79.70
79.26
78.91
77.81
75.11
REM
77.15
77.29
78.08
78.17
78.34
78.55
78.33
78.14
75.33
LSP
55.47
57.24
59.56
61.43
63.48
63.84
64.86
68.53
71.00
GUE
60.94
65.59
66.73
66.86
68.39
69.18
70.11
72.33
72.88
Ours
15.91
16.47
16.70
16.96
17.12
18.93
20.41
27.48
68.08
CutMix (Yun et al. 2019), Mixup (Zhang et al. 2018) and an advanced defense technique (JPEG
compression (Liu et al.||2000 2003)) As presented in Table our method maintains reliable unlearnabil- ity across all transformations. Moreover, the results in Table substantiate that BAIT clearly outper- forms basclines, suppressing test accuracy to near-chance levels across broad spectrum of JPEG compression qualities. While the unlearnability is impacted under extreme compression (Qual- ity=10), given the pronounced visual artifacts introduced at this level, argue that BAIT maintains exceptional resistance to JPEG defenses. Overall, these experiments demonstrate the superiority of BAIT in countering pretraining priors when compounded by additional defenses.
Visualization of Perturbed Samples. The imperceptibility of the unlearnable perturba- tions to human vision serves as key evalu- ation criterion for UEs, and we have explic- itly constrained the magnitude of perturbations as 8/255, in accordance with previous stud- ies (Huang et al.) 2021; Liu et al.) 2024a). To provide a qualitative assessment, we visualize perturbed images CIFAR- 10 and con- trast them with existing UE methods. As illus- trated in Figure 3 we observe that the perturba- tions optimized by BAIT are generally invisi- ble humans. We further present more visual- izations of the perturbed images on CIFAR-100 and SVHN for more comprehensive analysis, as shown in Appendix
Clean
EMN
TUE
LSP
GUE
T-SNE Visualization. We present t-SNE visu- alization (Maaten & Hinton 2008) to further demonstrate the effectiveness of the unlearn- able perturbations and their impact on mod- els. As shown in Figure while baseline methods are capable of inducing unlearnabil- ity in www--foom-ttttte backbones, manifested feature entanglement during testing, they fail to maintain this effect against pretrained mod- els. contrast, BAIT exhibits notable unlearnability across both randomly initialized and pre- trained backbones, safeguarding authentic semantics and underscoring its superior effectiveness.
Ours
Figure 3: Perturbed examples on CIFAR-10.

---

Published as a conference paper at ICLR 2026
Clean
EMN
REM
LSP
Ours
Train-from from--Su Scratch
Pretrained
Figure 4: t-SNE visualization of the last layer features. Classifiers are trained on the perturbed training set and tested on the clean test set. The top row displays models trained in scratch manner, whereas the bottom row shows models utilizing pretraining priors.
4.4 QUALITATIVE ANALYSIS ON THE OPTIMIZATION PROCESS OF BAIT
To provide further qualitative analyses on the optimization of perturbations, we use two vari- ants of CIFAR-10 10 training samples to test the
Accuracy of Training Samples(%)
100
surrogate model, namely the perturbed train- ing samples and the original clean training sam- ples. During the optimization of BAIT, we plot the accuracy curve of the surrogate model fo on both types of samples, as illustrated in Fig- ure At the early stage, the surrogate model benefits from its inherent pretraining priors and acquires meaningful semanties, reflected by the simultancous improvement of performance on both perturbed and clean training images. However, as the optimization of perturbations, a divergence emerges: the accuracy on per- turbed images keeps rising, while the accuracy on clean images progressively declines toward the chance level. This indicates that perturba- tions gradually mislead the real data-label asso- ciation guided by pretraining priors and force the surrogate to rely on the spurious correla- tions between perturbations and labels, which prevents models from learning genuine semantics.
Perturbed
Clean
60-
40
20
Stage 1
Stage 2
Stage
0
30
90
Perturbation Optimization Epoch
Figure 5: Training accuracy curve on CIFAR-10. illustrating that BAIT successfully misleads the ImageNet- surrogate model during per- turbation optimization.
5 CONCLUSION
In this paper, we uncover an overlooked yet fundamental vulnerability of unlearnable examples that emerges when models are initialized with a pretrained backbone. We empirically show that the semantic-label pathway within priors enables models to bypass the shortcuts injected by UEs and acquire genuine semantics. To address this, we propose BAIT, bi-level optimization framework designed to mislead pretraining priors. Specifically, the inner level imitates the standard prior-driven data-label alignment, while the outer level actively overrides it and establishes perturblpo bindings to enforce perturbed samples to align with designated incorrect targets. This mechanism counteracts pretraining priors and compels the model to rely the spurious perturbation-label cor- relations. We integrate meta-learning and curriculum learning to facilitate optimization. Extensive experiments demonstrate that BAIT consistently outperforms state-of-thed the methods.
Limitations. While this paper reveals the vulnerability of UEs to pretraining priors in classification and proposes BAIT countermeasure, the extensibility of this approach other downstream tasks, such as segmentation, remains relatively unexplored. Given the critical role of cross-task transferability, we consider this pivotal direction for future investigation.
10

---

Published as a conference paper at ICLR 2026
ETHICAL STATEMENT
This work is conducted in accordance with the ICLR Code of Ethics, Our study focuses on the design of unlearnable examples as data protection mechanism, aiming safeguard individuals' data from unauthorized exploitation in machine learning systems. All experiments are carried out on publicly available datasets under their respective licenses, with no involvement of human sub- jects or sensitive personal data. While techniques such as BAIT could, in principle, be misused adversarial purposes, we emphasize that our intent is to strengthen pivacc-preserving learning and to advance defenses against unauthorized model training. We report our methods and findings transparently to foster reproducibility and responsible use.
REPRODUCIBILITY STATEMENT
We have taken several measures to ensure the reproducibility of our work. All datasets used in our experiments are publicly available and described in detail in the main text. The implementation of the proposed BAIT framework, including model architectures, training schedules, hyperparameter settings, and evaluation procedures, is fully documented, and the source code has been released to facilitate the research community.
ACKNOWLEDGEMENT
This work is supported by the Natural Sciences and Engineering Research Council of Canada (NSERC), Discovery Grants program.
REFERENCES
Yoshua Bengio, Jérôme Louradour, Ronan Collobert, and Jason Weston. Curriculum learning. In International Conference Machine Learning, pp. 41-48, 2009.
Chaochao Chen, Jiaming Zhang, Yuyuan Li, and Zhongxuan Han. One for all: A universal generator for concept unlearnability via multi-modal alignment. In International Conference Machine Learning, pp. 7700 7711, 2024.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 248-255. Ieee, 2009.
Terrance DeViies and Graham W Taylor. Improved regularization of convolutional neural networks 2017.
with cutout. arXiv preprint
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image is worth 16x 16 words: Transformers for image recognition at scale. International Conference on Learning Representations, 2021.
Mark Everingham, Lue Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes (voe) challenge. International Journal of Computer Vision, 88 (2):303-338, 2010.
Alex Fang, Simon Kornblith, and I Ludwig Schmidt. Does progress on imagenet transfer to real-world datasets? Advances in Neural Information Processing Systems, 36:25050 2023.
Ruiyi Fang, Liangjian Wen, Zhao Kang, and Jianzhuang Liu. Strueture-preservingg graph represen- tation learning. In 2022 IEEE International Conference on Data Mining (ICDM), pp. 927-932. IEEE, 2022.
Ruiyi Fang, Bingheng Li, Jingyu Zhao, Ruizhi Pu. QIUHAO Zeng. Gezheng Xu, Charles Ling, and Boyu Wang. Homophily enhanced graph domain adaptation. In Forty-second International Conference Machine Learning, 2025a
11

---

Published as a conference paper at ICLR 2026
Ruiyi Fang, Bingheng Li, zhao kang, Qiuhao Zeng, Nima Hosseini Dashtbayaz, Ruizhi Pu, Charles Ling, and Boyu Wang. On the benefits of attribute-drinn dribven graph domain adaptation. In The Thirteenth International Conference Learning Representations, 2025b.
Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta- veta-learning for fast adaptation of deep networks. In International Conference Machine Learning, pp. 1126-1135. PMLR, 2017.
Shaopeng Fu, Fengxiang He, Yang Liu, Li Shen, and Dacheng Tao. Robust unlearnable examples: Protecting data against adversarial learning. In International Conference on Learning Represen- fations, 2022.
Hui Guo, Boyu Wang, and Grace Yi. Label correction of crowdsourced noisy annotations with an instance-dependent noise transition model. Advances in Neural Information Processing Systems, 36:347-386, 2023.
Hui Guo, Grace Y Yi, and Boyu Wang- Learning from noisy labels via conditional distribution- ally robust optimization. Advances in Neural Information Processing Systems, 37:82627-82672, 2024.
Hao He, Kaiwen Zha, and Dina Katabi. Indiscriminate poisoning attacks on unsupervised con-
trastive learning. International Conference on Learning Representations, 2023.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770-778, 2016.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4700-4708, 2017.
Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearn- able examples: Making personal data unexploitable. In International Conference on Learning Representations, 2021.
W Ronny Huang. Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. Metapoison: Prac- tical general-purpose clean-label data poisoning. Advances in Neural Information Processing Systems, 33:1 2080-11209, 2020.
Eugenia Iofinova, Alexandra Peste, Mark Kurtz, and Dan Alistath. How well do sparse imagenet models transfer? Proceedings of the IEEE Conference on Computer Vision and Pattern Recog- nition, pp. 12266-12277 2022.
Pavel Izmailov, Polina Kirichenko, Nate Gruver, and Andrew Wilson. On feature learning in the presence of spurious correlations. Advances in Neural Information Processing Systems, 35: 38516-38532, 2022.
Zhong Ji. Zhihao Li, Yan Zhang, Haoran Wang, Yanwei Pang, and Xuelong Li. Hierarchical match- ing and reasoning for multi-query image retrieval. Neural Networks, 173:106200 2024.
Zhong Ji, Zhihao Li, Yan Zhang, Yanwei Pang, and Xuelong Li. Visual semantic contextualization network for multi-query image retrieval. IEEE Transactions on Multimedia, 27:7067-7080, 2025.
Ronald Kemker, Marc McClure, Angelina Abitino, Tyler Hayes, and Christopher Kanan. Measuring catastrophic forgetting in neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 32, 2018.
Diederik Kingma. Adam: A method for stochastic optimization. arXiv preprint arXiv.1412.6980, 2014.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
12

---

Published as a conference paper at ICLR 2026
Sang- Woo Lee, Jin-Hwa Kim, Jaehyun Jun, Jung- Woo Ha, and Byoung-Tai Tak Zhang. Overcoming catastrophic forgetting by incremental moment matching. Advances in Neural Information Pro- cessing Systems, 30, 2017.
Jiahao Li, Yiqiang Chen, Yunbing Xing, Yang Gu, and Xiangyuan Lan. K-space bispectrum steganography for robust unleamable data. In Proceedings of the 33rd ACM International Con- ference on Multimedia, pp. 11492-11500 15001 2025a.
Zhihao Li, Jiale Cai, Gezheng Xu, Hao Zheng, Qiuyue Li, Fan Zhou, Shichun Yang, Charles Ling, and Boyu Wang. Versatile transferable unlearnable example generator. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025b.
Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European conference on computer vision, pp. 740-755. Springer, 2014.
Shuang Liu, Yihan Wang, and Xiao-Shan Gao. Game-theoretic unlearnale example generator. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 21349-21355 2024a.
Yixin Liu, Chenrui Fan, Yutong Dai, Xun Chen, Pan Zhou, and Lichao Sun. Metacloak: Preventing unauthorized subject-driven text-to-image diffusion-basse synthesis via meta-learning. In Pro- ceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 24219-24228, 2024b.
Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 10012-10022, 2021.
Zhuoran Liu, Zhengyu Zhao, and Martha Larson. Image shortcut squeezing: Countering perturba- tive availability poisons with compression. In International Conference Machine Learning, pp. 22473-22222222 222877 PMLR, 2023.
Yiwei Lu, Matthew YR Yang, Gautam Kamath, and Yaoliang Yu. Indiscriminate data poisoning attacks on pre-trained feature extractors. 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pp. 327-343. IEEE, 2024.
Laurens van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9NNv)):579-26655, 2008
Raghav Mchta, Vitor Albiero, Li Chen, Ivan Evtimov, Tamar Glaser, Zhiheng Li, and Tal Hass- ner. You only need a good embeddings extractor to fix spurious correlations. arXiv preprint arXiv:2212.06254. 2022.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng. et al. Reading digits natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning, volume 2011, pp. 7. Granada, 2011.
Maria-Eiae Elena- Nilsback and Andrew Zisserman. Automated flower classification over a large number of classes. In 2008 Sixth Indian conference on computer vision, graphics & image processing, pp. 722-729. IEEE, 2008
Ruizhi Pu, Gezheng Xu, Ruiyi Fang, Bing-Kun Kun Bao, Charles Ling, and Boyu Wang. Leveraging group classification with descending soft labeling for deep imbalanced regression. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 19978-19999 1998-11985, 2025a.
Ruizhi Pu, Lixing Yu. Shaojie Zhan, Gezheng Xu, Fan Zhou, Charles X Ling, and Boyu Wang. Fedelr; When federated learning meets learning with noisy labels. Neural Networks, 187:107275, 2025b.
Tianrui Qin, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu. Learning the un- learnable: Adversarial augmentations suppress unlearnable example attacks. arXiv preprint arXiv:2303.15122 2023.
13

---

Published as a conference paper at ICLR 2026
Jie Ren, Han Xu, Yuxuan Wan, Xingjun Ma, Lichao Sun, and Jiliang Tang. Transferable unlearnable examples. In The Eleventh International Conference on Learning Representations, 2023.
Vinu Sankar Sadasivan, Mahdi Soltanolkotabi, and Soheil Feizi. Cuda: Convolution- based unlearn- able datasets. Proceedings of the IEEE Conference on Computer Vision and Pattern Recogni- lion, pp. 3862-3871, 2023.
Pedro Sandoval-Segura, Vasu Singla, Jonas Geiping, Micah Goldblum, Tom Goldstein, and David Jacobs. Autoregressive perturbations for data poisoning. Advances in Neural Information Pro- cessing Systems, 35:27374-27388 2022.
Pedro Sandoval-Segura, Vasu Singla, Jonas Geiping, Micah Goldblum, and Tom Goldstein. What can we learn from unlearnable datasets? Advances in Neural Information Processing Systems, 077753722-5391.. 2023.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint 14: 1556, 2014.
Ye Sun, Hao Zhang, Tiehua Zhang, Xingjun Ma, and Yu-Gang Jiang. Unseg: One universal unlearn- able example generator is enough against all image segmentation. Advances in Neural Information Processing Systems, 37:79168 17779188-7999,, 2024.
Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Du- mitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 1-9, 2015.
Lifu Tu, Garima Lalwani. Spandana Gella, and He He. An empirical study on robustness spurious correlations using pre-trained language models. Transactions of the Association for Computa- tional Linguistics, 8:621 8:621-633, 2020.
Derui Wang, Minhui Xue, Bo Li, Seyit Camtepe, and Liming Zhu. Provably unlearnable data examples. In The Network and Distributed System Security (NDSS) Symposium, 2025a.
Xin Wang, Yudong Chen, and Wenwu Zhu, A survey on curriculum learning. IEEE Transactions on Paitern Analysis and Machine Intelligence, 44(9):4555-45777 2021.
Yihan Wang, Yifan Zhu, and Xiao-Shan Gao. Efficient availability attacks against supervised and contrastive learning simultaneously. Advances in Neural Information Processing Systems, 37: 72872-72900, 2024.
Yihan Wang, Yiwei Lu, Xiao-Shan Gao, Gautam Kamath, and Yaoliang Yu. Bridgepure: Limited protection leakage can break black-box data protection. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025b.
Kan Wu, Jinnian Zhang, Houwen Peng, Mengehen Liu, Bin Xiao, Jianlong Fu, and Lu Yuan. Tinyvit: Fast pretraining distillation for small vision transformers. In European Conference on Computer Vision, pp. 68-85. Springer, 2022.
Shutong Wu, Sizhe Chen, Cihang Xie, and Xiaolin Huang. One-pixel shortcut: On the learning preference of deep neural networks. The Eleventh International Conference on Learning Rep- resentations, 2023.
Gezheng Xu, Qi CHEN, Charles Ling, Boyu Wang, and Changjian Shui. Intersectional unfairness discovery. In Forty-first International Conference on Machine Leurning, 2024.
Gezheng Xu, Hui Guo, Li Yi, Charles Ling, Boyu Wang, and Grace Yi. Revisiting source-free domain adaptation: a new perspective via uncertainty control. In The Thirteenth International Conference on Learning Representations, 2025a.
Gezheng Xu, Li Yi, Pengcheng Xu, Jiaqi Li, Ruizhi Pu, Changjian Shui, A lan McLeod, Boyu Wang, and Charles Ling. Unraveling the mysteries of label noise in source-free domain adaptation: Theory and practice. IEEE Transactions on Pattern Analysis and Machine Intelligence, 47(5): 4007-4023, 2025b.
14

---

Published as a conference paper at ICLR 2026
Kai Ye, Liangcai Su, and Chenxiong Qian. How far are from true unlearnability? In The Thirteenth International Conference on Learning Representations, 2025.
YuTeng Ye, Jiale Cai, Hang Zhou, Guanwen Li, Youjia Zhang, Zikai Song. Chenxing Gao, Junqing Yu, and Wei Yang. Progressive text-to-image diffusion with soft latent direction. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 6693-6701, 2024.
Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie- Yan Liu. Availability attacks create shortcuts. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 2367-2376, 2022.
Yi Yu, Song Xia, SIYUAN YANG, Chenqi Kong. Wenhan Yang, Shijian Lu, Yap-Peng Tan, and Alex Kot. MTL.UE: Learning to learn nothing for multi-task learning. In Forty-second Interna- tional Conference on Machine Learning, 2025.
Sangdoo Yun, Dongyoon Han, Scong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Proceed- ings of the IEEE International Conference on Computer Vision, pp. 6023-6032, 2019.
QIUHAO Zeng, Changjian Shui, Long-Kai Huang, Peng Liu, Xi Chen, Charles Ling, and Boyu Wang. Latent trajectory learning for limited timestamps under distribution shift over time. In The Twelfth International Conference on Learning Representations, 2024.
Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empiri- cal risk minimization. In International Conference Learning Representations, 2018.
Jiaming Zhang, Xingjun Ma, Qi Yi, Jitao Sang, Yu-Gang Jiang, Yaowei Wang, and Changsheng Xu. Unlearnable clusters: Towards label-agnostic unlearnable examples. In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition, pp. 3984-3993, 2023.
Zhengyue Zhao, Jinhao Duan, Xing Hu, Kaidi Xu, Chenan Wang, Rui Zhang, Zidong Du Qi Guo, and Yunji Chen. Unlearnable examples for diffusion models: Protect data from unauthorized exploitation. In ICLR 2024 Workshop on Reliable and Responsible Foundation Models, 2024.
Hao Zheng, Zhigang Hu, Liu Yang. Meiguang Zheng, Aikun Xu, and Boyu Wang. Fedcalm: Conflict-aware layer-wise mitigation for selective aggregation in deeper personalized federated learning. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 15444- 15453, 2025.
Hang Zhou, Jiale Cai, Yuteng Ye, Yonghui Feng, Chenxing Gao, Junqing Yu, Zikai Song, and Wei Yang. Video anomaly detection with motion and appearance guided patch diffusion model. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 10761-10769, 2025.
Yifan Zhu, Yibo Miao, Yinpeng Dong, and Xiao-Shan Gao. Toward availability attacks in 3d point clouds. In Forty-first International Conference on Machine Learning, 2024.
15

---

Published as a conference paper at ICLR 2026
APPENDIX: TABLE OF CONTENTS
The Use of Large Language Models (LLMs)
Discussion on Parameter Updates and Semantic Learning
B.
Details of the Parameter Updates Illustration
Learning Curve of Train-from-Seratch Backbones
he Architecture of Perturbation Generator
More Experiments
19
D.1
Impact of Pretraining Priors against Unlearnability
19
D.2
Performance Variation on Original Pretraining Data during Finetuning
19
D.3
Performance with a Randomly Initialized Surrogate
19
D
4
Cross-Task Task Transfcrability
19
D
Verification with Different Data Protection Ratios
20
More Visualizations of Unlearnable Examples
16

---

Published as a conference paper at ICLR 2026
A THE USE OF LARGE LANGUAGE MODELS (LLMS).
We declare that Large Language Models were used exclusively for language polishing, including correcting grammar, improving readability, and ensuring consistency terminology. All core ideas, empirical demonstration, experimental design, and result analyses were entirely conceived and con- ducted by the authors.
B DISCUSSION ON PARAMETER UPDATES AND SEMANTIC LEARNING
B. DETAILS THE PARAMETER UPDATES ILLUSTRATION
In Figure lc we present the total parameter updates when models are training on clean data and unlearnable data crafted by EMN and our method. We use the global maximum normalization to process the parameter update data, with details shown below.
Given the six groups parameter changes measured during training, we use the 1.2 norm to calculate the parameter updates between epochs and denote the cumulative change of group & at epoch t
1/2
1
(5)
where A represents the parameter update at epoch i for group k. Since 1/ is monotonically non-decreasing with respect its maximum is attained at the final epoch T. Therefore, the global normalization factor is defined as
M
max (k) 15k56
The normalized cumulative change is then computed
(A)
Lt=
k=
M
This normalization ensures that all curves are scaled into the interval [0, 1]. facilitating a fair com- parison of their relative growth dynamics during training.
100
80
Accuracy (%)
Train Acc (Clean)
60
Train Acc (Ours)
40
Test Acc (EMN)
(Ours)
20
0
20
30 Epoch
50
60
Figure 6: Learning curves illustration during standard UE evaluation on CIFAR-I0 with ResNet-18 where training starts from randomly initialized backbone.
B.2 LEARNING CURVE TRAIN-FROM SCRATCH BACKBONES
To further investigate the relationship between parameter update magnitude and model perfor- mance (Ye et al. 2025). and to validate that effective UEs suppress parameter updates and limit semantic acquisition,
visualize the accuracy curves of conventional UE evaluation that targets randomly initialized model. As illustrated in Figure [6] we observe that both EMN and our method yield consistently low test accuracy. This observation aligns with the empirical findings in Figure Tc
17

---

Published as a conference paper at ICLR 2026
Table 9: The architecture of the perturbation generator.
Block Name
Layer
Number
Down- wwwpllsnliing layers
Conv (3 x 3) InstanceNorm ReI.U
Conv
6
Bottleneck layers
ReflectionPad Conv (3 x 3)
BatchNorm
Residual
ReLU
8
ReflectionPad Conv (3 x
BatchNorm
Up-sane ii-sammling layers
ConyTranspuse (3 3)
ConyTranspose
InstanceNorm
x
ReLU
ConyTranspose (6 Tanh
Conv ConvTranspaa Transpose
Freeze Layer
Layer
Freeze Layer
80
Layer
Chance Level
Test Accuracy (%)
60
40
20
EMN
LSP
GUE UE Method
REM
Figure Effect of each pretraining layer of ResNet-18 against unlearnability on CIFAR-10.
where minimal parameter updates are recorded on train-from-scratee models. These results demon- strate that randomly initialized models fail learn meaningful semantic knowledge and are misled by the UE-induced shortcuts.
C THE ARCHITECTURE OF PERTURBATION GENERATOR
In the main paper, we devise generator to produce perturbations and craft unlearnable examples. We denote our perturbation generator G. which employs standard encoder-decoder architecture. This structure comprises six down-sampling convolution layers, eight residual blocks (He et al, 2016), and six transposed convolution layers. The detailed architecture shown in Table
18

---

Published as a conference paper at ICLR 2026
Table 10: Test accuracy change (AAcc) on the original 1000-class ImageNet validation set when the ImageNet-pretrainee model is finetuned on CIFAR-10.
Accuracy Variation (AAcc)
Finctuning Dataset
Epoch
Epoch 2
Epoch 60
Clean CIFAR-10
-36.45
-53.83
-55.28
Unlearnable CIFAR-I0 (Ours)
-40.66
-55.11
-55.35
D MORE EXPERIMENTS
D.1 IMPACT OF PRETRAINING PRIORS AGAINST UNLEARNABILITY
To further examine the role of pretraining priors on unlearnability, we freeze each layer of an imageNet- ResNet-18 model independently and analyze its specific impact on test ac- curacy. As shown in Figure 7 freezing layer I or layer 2 leads an increase in test accuracy for several UE methods. This suggests that when low-level priors, which typically encode pixels, edges, and textures, preserved from disruption by UEs, models are able to acquire more genuine seman- ties from the data. Notably, GUE exhibits a pronounced accuracy surge when the first layer is frozen, indicating that its perturbations mainly target shallow priors and thus become ineffective once these priors are fixed. In contrast, our method remains relatively effective even when shallow layers are frozen. Furthermore, freezing deeper layers, such layer and layer 4, results in a decrease in accuracy, suggesting that perturbations are now having no choice but to disrupt shallow priors and consequently achieve stronger unlearnability compared the fully trainable pretrained scenario.
D.2 PERFORMANCE VARIATION ON ORIGINAL PRETRAINING DATA DURING FINETUNING
To elucidate the interplay between downstream finetuning and pretraining priors, we conduct addi- tional experiments to examine performance variation on the original source domain during finetun- ing. It is well-known consensus transfer learning that finetuning on distinct downstream tasks typically induces catastrophic forgetting. leading performance decline the original pretraining data (Lee et al. 2017 Kemker et al. 2018). To rigorously assess this, we report the relative perfor- mance variation when models finetuned either clean downstream data backbone on CIFAR- 10 while monitoring the accuracy variation on the source ImageNet-Ik dataset. As shown in Table [0] we observe that the magnitude of performance decline is comparable between models finetuned on clean data and those trained on our UEs. This indicates that the observed performance degradation attributable the intrinsic catastrophic forgetting, rather than being caused by the unlearnable perturbations. Consequently, we demonstrate that our method effectively protects downstream data privacy without exacerbating the risk of catastrophic forgetting or incurring additional damage to the pretrained knowledge within models.
UEs. Specif-
ically, we finetune an ImageNet-pretraing
D.3 PERFORMANCE WITH A RANDOMLY INITIALIZED SURROGATE
To further evaluate the generalizability of the proposed method, we optimize BAIT with a randomly initialized surrogate model. We then evaluate performance against the ImageNet-pretrained ResNet-18 model on three distinct datasets, including CIFAR-10, CIFAR-100, and SVHN. As shown in Table || our method outperforms baseline methods and exhibits strong capabilities in rendering data unlearnable, which further demonstrates its effectiveness against pretraining priors.
D.4 CROSS-TASK TRANSFERABILITY
The transferability of unlearnalle examples other tasks (Fang al. 2022 Zeng et al. 2024 Ji
et al. 2024 Zhao et al. 2024 Zhou et al. 2025 Pu et al. 2025a) is crucial for practical applications. To this end, conduct additional evaluations the segmentation task, employing perturbations that are optimized on the CIFAR-10 classification dataset. We note that directly transferring per- turbations may not be suitable since segmentation requires dense, pixel-wise predictions, whereas
19

---

Published as a conference paper at ICLR 2026
Table 11: Test accuracy (%) evaluation against ImageNet-pretrainte backbones, where BAIT uti- lizes randomly initialized surrogate instead of pretrained surrogate for perturbation optimization.
Dataset
EMN
TUE
REM
LSP
GUE
14A
Ours
CIFAR-10
61.82
82.72
74.46
54.20
23.17
65.70
15.97
CIFAR-100
55.53
55.20
55.22
36.98
54.09
33.67
22.83
SVHN
37.55
41.15
76.45
38.91
39.68
81.47
17.93
Table 12: Evaluation of cross-task transferability on Pascal VOC 2012.
Pascal VOC 2012 Semantic (mloU (%) D)
Method
Acroplane
Bicycle
Bird
Boat
Bottle
Clean
80.9
35.6
84.4
65.8
74.7
UnSeg
30.5
16.4
58.6
19.1
40.4
LSP
41.3
50.2
63.3
46.9
57.1
Ours
40.0
49.0
60.4
44.6
53.5
Table 13: Test accuracy (%) 4 with different poisoning ratios against a ImageNet-pretrained ResNet- 18 on CIFAR-10.
Poison Ratio r
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Clean (1 r)
83.13
82.97
82,20
81.40
80.02
78.40
76.96
73.88
67.57
EMN
83.58
83.41
83.32
83.08
83.04
82.37
81.24
80.52
77.28
61.82
TUE
83.87
83.83
83.81
83.79
83.54
83.43
83.39
83.03
82.97
82.72
REM
84.18
83.79
83.63
83.05
82.69
82.90
81.96
81.09
79.81
74.46
LSP
83.56
83.51
82.53
82,49
81.48
80.29
79.68
77.97
74.91
54.20
GUE
83.94
83.58
83.48
82,48
81.79
81.14
79.88
78.18
74.50
23.17
Ours
83.06
82.94
81.67
81.51
81.11
79.43
78.13
74.95
71.88
14.40
classification relies single, image-level labels. This discrepancy is likely to impact the effective- ness of UEs. Following the evaluation setup UnSeg (Sun et al., 2024), we conduct experiments on the Pascal VOC 2012 dataset (Everingham et al. (0100). Note that UnSeg is specifically designed for segmentation and considered to be a very strong baseline. We also evaluate the cross-task transferabilityy of I.SP YYu et al. 2022) for comparison. As shown in Table T2 observe that although not explicitly designed for cross-task transferability, our method can reduce the mloU for several classes compared clean training, indicating that our method maintains certain unlearn- ability when transferred to other downstream tasks. Moreover, our method outperforms LSP across five classes, demonstrating superior cross-task transferability compared with other classification- oriented UE baselines. We acknowledge that there is still room for improvement in bridging the performance between our method and segmentation-ss -spationsseeeillstt method UnSeg. Given the broad potential of cross-task UEs, we consider this as important future research direction.
D.5 VERIFICATION WITH DIFFERENT DATA PROTECTION RATIOS.
Although the standard UE setting applies perturbations to the entire training set, in practical see- narios, there may be only a portion of the data that protected. To this end, following previous UE studies (Huang et al. 2021: Yu et al. 2022, (adasivan et al. (003). we also explore the impact of the data protection ratio on unlearnability. The experimental results are presented in Table [3 We observe that mixing clean samples with poisoned samples leads to small performance increase compared to the clean training, indicating that models gain little semantic information from the UEs. Moreover, observe that method successfully reduces the test accuracy slightly compared to clean training at poison ratios 10%, 20%, and 30%, and exhibits the smallest accuracy increase compared to baseline methods other poison ratios, demonstrating its superior effectiveness.
20

---

Published as a conference paper at ICLR 2026
Clean
Ours
CIFAR-10
Clean
Ours
CIFAR-100
Clean 2
3
19
2
4
58
9
7
58
63
2
3
2
4
5
9
7
58
63
Ours
SVHN
Figure 8: More visualizations of the unlearnable examples crafted by BAIT.
MORE VISUALIZATIONS OF UNLEARNABLE EXAMPLES
To further ensure the imperceptibility of unlearnable examples, we provide additional visual- izations on CIFAR-10, CIFAR- 100, and SVHN, as illustrated in Figure 8 Across all datasets, the perturbations remain visually subtle, generally exhibiting small magnitudes that do degrade the perceptual quality of the images. These results further confirm that the crafted perturbations main- tain imperceptibility human observers while still enforcing unlearnability on models.
21


Reviews:
[{"review_id": "laoBs4vbrh", "reviewer": "Reviewer_TKJA", "summary": "This paper propose a method to generate unlearnable examples for pretrained models. The pretrained model can be robust to unlearnable examples generated by previous methods since there is prior knowledge and model is able to ignore the shortcut. This paper propose to change the learning target while optimizing the perturbation, which violates the model prior and thus generates effective perturbation. The experiments are conducted on different datasets and model backbones and show consistent improvement on misguiding the model learning proess. Compared with other methods targeting for model-from-scratch, this method works better on pretrained models.", "questions": "In figure 3, what samples are used to test the surrogate model accuracy? Are they used in the perturbation optimization step?\nAlso, just to confirm, is the perturbed data in figure 3 generated with the optimized surrogate model or it is changing as the perturbation optimization goes on?\n\nIn table 1, other methods are under the setting where the surrogate model is randomly initialized, what is the result if testing the proposed method under this setting? This could be a strong proof of generalizability", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The proposed strategy for generating perturbations with changed target effectively attack the learning process of a pretrained model.\n\nSome analysis on parameter updates provide insights on difference between scratched model and pretrained model.\n\nAdequate ablations on datasets and model backbones to show the generalizability.\n\nThe comparison is made on both randomly initialized and pretrained surrogate model, both showing good improvement with previous methods", "weaknesses": "No major weaknesses in this paper. See the questions part for minors.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "gOYG7xGYSL", "reviewer": "Reviewer_vgQM", "summary": "This paper asks whether unlearnable examples are effective when training begins from a pretrained model. The authors find that error-minimizing noise, transferable unlearnable examples, robust error-minimizing noise, linearly separable perturbations, and a few other unlearnable examples cannot consistently reduce the test accuracy over the course of training. The authors propose optimizing class-wise, error-minimizing perturbations that make it so that when someone trains a new model starting from pretrained weights, the test accuracy can be reduced.", "questions": "1. If the authors believe their statement of Eq. 1 is correct, can they explain it in more detail to an undergraduate? How does it line up with the steps they propose in L176-188? Ideally follow the format of the last sentence of pg.3 of [2] where they say \"this is a min-min bi-level optimization: the inner minimization...finds the bounded noise that...while the outer minimization finds the parameters that...\"\n2. For L313 \"Reimplementeed baselines with imagenet-pretrained priors\", did you use a surrogate model that was finetuned on the target dataset? For example, for generating CIFAR-10 perturbations, did you first finetune the ImageNet-pretrained model on CIFAR-10 or did you use the ImageNet-pretrained weights directly as the surrogate?", "limitations": "", "rating": 4, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "Based on Figure 1 (a) it appears that the proposed class-wise perturbations reduce the test accuracy of both pretrained and trained-from-scratch models, whereas other unlearnable example methods only reduce test accuracy for train-from-scratch models. I also agree that for unlearnable examples the case of utilizing pretrained weights is much more likely (and a more realistic scenario) than train-from-scratch, so unlearnable examples must be able to hold up to this approach (please see weaknesses 3. on how to properly see whether the current method holds up to defenses).\n\nStarting from ImageNet pretrained models, Table 1 shows that their unlearnable examples reduce test accuracy by a wide margin. Their perturbations can prevent training (by reducing accuracy to nearly chance) on CIFAR-10, CIFAR-100, and SVHN.\n\nBecause unlearnable examples like [2] use a surrogate for a particular dataset (i.e. CIFAR-10), the authors consider a fair comparison where they re-implement [2] but using an imagenet-pretrained model as the surrogate. Here, they again find that their approach is better.", "weaknesses": "1. The \"core innovation\" (L180-181) is an error-minimizing noise, which is explored in [2]. Technically, the original error-minimizing noise of [2] also \"binds perturbations to designated incorrect labels that are semantically different from the ground truth, deliberately steering learning away from genuine semantics.\" (L157-158) because [2] uses a pretrained surrogate model. By using a pretrained surrogate, the perturbations are like features of the pretrained model. \n\n2. I think Eq. 1 does not line up with what the authors are proposing. The authors state that \"the inner level mirrors the standard UE objective by injecting perturbations that discourage the model from encoding genuine semantic\" implying the optimization is over the perturbation but the inner \"s.t.\" objective says that we seek to find a theta (model params) that minimizes the expected loss (train a model on perturbed images). The $\\theta_i$ probably requires an additional \"level\" of optimization because those aren't fixed.\n\n3. Line 427 \"Resistance to defense strategies\". The only defense that should be considered is ISS [1] : I am particularly interested in an evaluation of *just ISS* (different JPEG compression qualities must be tried: 0.9, 0.8, 0.7, etc) instead of all the other \"defenses\" (cutout, cutmix, mixup, etc.) because JPEG has been shown to be so effective. This paper broke a number of existing \"unlearnable datasets\" but this submission only considers cutout, cutmix, mixup (which can no longer be considered a defense after the ISS paper). Additionally, being a class-wise perturbation, I recommend looking at the orthogonal projection [3] defense (Section 4.4 of [3]). They argue class-wise perturbations can be easily broken.\n\n4. Line 249: \"we evaluate the effectiveness of the proposed optimization framework against pretrained backbones on standard benchmarks\". The paper doesn't specify what evaluation means exactly. Do you mean that we finetune only the last linear layer of a model? If so, does the last linear layer starting from random weights or the pretrained weights? Alternatively, do you mean that we finetune all model parameters? Based on Eq. 2 it seems the answer is finetune all model parameters starting from pretrained model parameters, but this has to be stated clearly in words somewhere. Using the phrase \"craft effective UEs against pretrained backbones\" (L083) makes it sound like only the last layer is finetuned.\n\n[1] Image shortcut squeezing: Countering perturbative. Liu et al. 2023\n\n[2] Unlearnable Examples: Making Personal Data Unexploitable. Huang et al., 2021\n\n[3] What Can We Learn from Unlearnable Datasets?. Sandoval-Segura et al., 2023\n\nMinor: \n- Acronyms are used before they are defined: L072 has \"EMN\" but defined until L267. Please check if there are other instances of acronyms.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LiR7FUw0xG", "reviewer": "Reviewer_rRcL", "summary": "The paper introduces BAIT to solve the problem that existing UE methods fail when fine-tuning on clean pre-trained image-classification models by binding perturbations to incorrect target labels. Even though the proposed method seems to work only on small models (compared to the CV models mostly talked about nowadays) for image classification (which happens to be one of the easiest models to train from scratch for now), the results on common datasets look promising.", "questions": "Could the author focus on answering the first three concerns in the weakness section? It would be even better if the authors could provide some additional explanation or verification for the 4th point in weakness.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. Despite some discussions in previous research, there are few solutions before to address the failure of UEs on pre-trained models.\n2. The method description, experiment design, and the results seem convincing.\n3. Despite some formatting issues, the writing and presentation are generally good.", "weaknesses": "1. The findings highlighted at the beginning of the paper that current UEs fail on pre-trained models do not seem to be that surprising, as this issue has been expressed in many previous studies.\n2. From a practical perspective, the key to solving this problem, in my opinion, is to fine-tune a larger model using the additional data collected. Although this experiment will be more difficult, the authors should try to discuss the practical significance of this issue.\n3. The paper doesn't seem to provide a thorough analysis or discussion of the relationship between pre-training data and fine-tuning data, or their impact on training, which is exactly what I'm most concerned about. If I perturb some data to prevent it from being trained and the model from learning, I'd first justify that the reduction in model performance (e.g., accuracy) is specific to the new data, and not to the original data. For example, a face recognition model might still accurately recognize the pre-trained data, but fail to recognize the perturbed data used in subsequent fine-tuning. This isn't a requirement for the author to verify this on a face recognition model, but I'd appreciate more in-depth analysis of this aspect.\n4. The authors use three figures in Figure 1 to demonstrate the failure of existing UEs on pre-trained models. Figures 1a and 1b are convincing, but Figure 1c is not. Although PT and TS have significant differences in the dynamics of parameter updates, the authors appear to assume that parameter updates correspond to the model's actual learning of semantic knowledge from the data, a claim they haven't carefully justified. In fact, the relationship between the update amplitude of model parameters, training epochs and model performance is more complicated ([How far are we from true unlearnability?(ICLR'25)]).\n5. The experimental part uses the Imagenet pre-trained model, but there is no experimental result on Imagenet and other larger datasets.\n6. Although the authors discussed transferability, they only discussed the transferability of pre-trained models and architectures, and lacked discussion of the transferability of more important downstream tasks. Furthermore, lack of verification and discussion of the data protection ratio (i.e., the poisoning ratio).\n7. Some papers also discussed the content related to UEs and pre-trained models, but the authors did not cite or mention them. [Learning the Unlearnable: Adversarial Augmentations Suppress Unlearnable Example Attacks(ICCV-AROW)] [UnSeg: One Universal Unlearnable Example Generator is Enough against All Image Segmentation(NeurIPS 2024)]\n8. Some citation formatting issues", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)