ConfounderGAN: Protecting Image Data Privacy with Causal Confounder
Authors: Qi Tian
Kun Kuang
Kelu Jiang
Furui Liu
Zhihua Wang
Fei Wu
Venue: NeurIPS 2022 Accept (2022)
Keywords: data privacy
generative adversarial network
causal confounder

Abstract: The success of deep learning is partly attributed to the availability of massive data downloaded freely from the Internet. However, it also means that users' private data may be collected by commercial organizations without consent and used to train their models. Therefore, it's important and necessary to develop a method or tool to prevent unauthorized data exploitation. In this paper, we propose ConfounderGAN, a generative adversarial network (GAN) that can make personal image data unlearnable to protect the data privacy of its owners. Specifically, the noise produced by the generator for each image has the confounder property. It can build spurious correlations between images and labels, so that the model cannot learn the correct mapping from images to labels in this noise-added dataset. Meanwhile, the discriminator is used to ensure that the generated noise is small and imperceptible, thereby remaining the normal utility of the encrypted image for humans. The experiments are conducted in six image classification datasets, including three natural object datasets and three medical datasets. The results demonstrate that our method not only outperforms state-of-the-art methods in standard settings, but can also be applied to fast encryption scenarios. Moreover, we show a series of transferability and stability experiments to further illustrate the effectiveness and superiority of our method.

ConfounderGAN: Protecting Image Data Privacy with Causal Confounder
Qi Tian
Kun Kuang 1,5. Kelu Jiang Furui Liu Zhihua Wang"
Fei Wu 1,3,4.5
College of Computer Science and Technology. Zhejiang University, Hangzhou, China Huawei Noah's 's Ark Lab, Beijing. China
Shanghai Institute for Advanced Study of Zhejiang University, Shanghai, China Shanghai AI Laboratory, Shanghai, China
5 Key Laboratory for Corneal Diseases Research of Zhejiang Province, Hangzhou, China (tianqics, kunkuang, , fiangeelu u, thi.ua.er wang, wufei Mateeiezjjjj jz edu.
Abstract
The success of deep learning is partly attributed the availability of massive data downloaded freely from the Internet. However, it also means that users' private data may be collected by commercial organizations without consent and used to train their models. Therefore, it's important and necessary to develop a method tool prevent unauthorized data exploitation. In this paper, we propose ConfounderGAN, a generative adversarial network (GAN) that can make personal image data unlearnable the noise produced by the generator for each image has the confounder property. It can build spurious correlations between images and labels, so that the model cannot learn the correct mapping from images to labels in this noise-added dataset. Meanwhile, the discriminator is used to ensure that the generated noise is small and imperceptible, thereby remaining the normal utility of the encrypted image for humans. The experiments are conducted in six image classification datasets, consisting of three natural object datasets and three medical datasets. The results demonstrate that our method not only outperforms state-of-the-ar methods standard settings, but can also be applied to fast encryption scenarios. Moreover, we show series of transferability and stability experiments to further illustrate the effectiveness and superiority of our method.
protect the data privacy of its owners. Specifically,
1 Introduction
In recent years, deep learning has achieved great success many fields, such as computer vision [10, natural language processing (6], etc. An important factor is that large-scale datasets provide rich and diverse training examples for deep neural networks. However, many datasets are collected from some free channels without mutual consent, and this unauthorized collection of private data may violate the rights of the data owner 3.. For example, Kashmir Hill from the New York Times recently reported that a company, named Clearview.Al. used web crawler scripts collect more than billion online photos from various multimedia websites (e,g., Facebook) for training its own commercial models [35]. This large unauthorized dataset goes far beyond anything ever constructed by the United States government or Silicon Valley giants. In addition, Google's Nightingale Project has also been reported collect medical care information from tens millions of patients without their knowledge, and use advanced machine learning technology to customize medical services for individual patients [33 37].
In this context, various information privacy laws around the world have been published describe the rights of natural persons to control who is using its data 41 e.g. General Data Protection
Cooresponding author.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

Regulation (GDPR) in the European Union 39 Electronic Communications Privacy Act (ECPA) in the U.S. 40 38
noise (confounder)
Y
predicted label
etc. However, in addition to legal constraints, it's necessary to develop protection method to actively prevent unautho- rized data from being used by third parties to train commercial models. In this paper, we aim to develop an image encryption method. i.e., the deep classification models cannot extract any exploitable knowledge from encrypted (or processed) images. Moreover, we hope the mod- ification of the original data is strictly limited, thereby retaining the data quality for normal usage. e.g., an unlearnable photo should be free from obvious visual defects so can be shared with friends on social media.
image
(a) the causel graph leared from the original datases
(b) the causal graph leamed from our encrypted dataset
Figure I:
Causal graphs learned from the original dataset and our encrypted dataset.
Unfortunately, the existing works are very sparse and have application limitations. Shan et al. (30 first propose an paror-maximizing noise based on metric learning to make data unexploitable, but this method is mainly customized for face recognition systems. Then Huang et al. [ propose bi-level optimization based on error mrror-mmnmmizing noise (EMN) to meet the above goal, and it can be extended to various image datasets. However, these methods need multiple gradient backpropagations to generate an effective noise for each labeled image, which means they cannot encrypt an unlabeled image the fly. We emphasize that this setting is common and important for real-world applications. For example, person takes a photo with a cell phone. Then he/she wants to quickly encrypt the photo and share it on social media immediately.
In this paper, we propose a novel image data encryption method called ConfounderGAN to solve the above challenges. Figure demonstrates the core idea of our method. We suppose that the model can learn a correct causal graph from the image X to the label Y in the original dataset as illustrated in Figure aa). To prevent unauthorized models from extracting ground truth relationship X + Y from the private dataset, we deliberately introduce a confounder noise N that satisfies the relationship X <-N N + Y in the dataset shown in Figure [b). This confounder noise is correlated with both the image X and the label Y. creating a spurious correlation between X and Y. Therefore, models trained
this data would fit the negatively spurious correlation and get low test accuracy. There are many possible ways that can achieve this confounder-basee encryption framework. We instantiate this framework by generative adversarial networks (GAN) M. this implementation is more efficient and practical. Specifically, we hope that the generator can produce confounder noise that satisfies the above causal graph for each private image. The main challenge is how ensure that the noise is strongly associated with both the image and the label. Since the noise is produced by the generator with the original image as input, the former is naturally satisfied. For the latter, we directly classify the noise as the ground truth class of the original image during generator training. Meanwhile, we send the original image and its noise-added copy to the discriminator, thus ensuring the invisibility of noise. Once the generator is trained, it can quickly produce confounder noise for any image to protect its privacy, including those unlabeled ones. Our main contributions are:
We present a confounder- bassed framework for image data encryption. The confounder in this framework can create spurious correlations between images and labels, thus preventing unauthorized models from learning exploitable knowledge on the encrypted data.
By leveraging the property of generative adversarial networks, we implement the above framework as ConfounderGAN, where the generator is used to produce confounder noise to encrypt the target image and the discriminator ensures that the noise is imperceptible.
Extensive experiments six image classification datasets show that our proposed method not only outperforms state-of-the-art methods in standard settings, but can also be applied to fast encryption scenarios. Also, we conduct set of transferability and stability experiments to highlight the effectiveness and superiority of our method.
2
Related work
In this section, we briefly review some literature that is closely related to our work: data privacy, data poisoning, causal confounder in deep learning.
2

---

Data privacy. Privacy-preserv preserving techniques have been widely explored in the machine learning community and lot of excellent works have been proposed to protect data privacy [32 26 27 331. However, these methods are mainly to prevent malicious agencies from de-inferring training set information trained model. In this paper, we foeus on a more challenging scenario. ie., making private data completely unlearnable by unauthorized deep neural networks. Shan et al. [30] first propose a solution for the face recognition system. By utilizing the targeted adversarial attack to generate marimmiaiii noise, this method can close the representation of different identities so that the model trained on this dataset can only obtain poor performance. Then Huang et al. [12] propose bi-level optimization based on error- arror-mmnimizing noise (EMN) to meet the same goal, and it is a general method that can be used to various image datasets. However, these gradient- based methods need multiple optimization steps for encrypting one labeled image, and thus cannot quickly encrypt an unlabeled one. Instead, our ConfounderGANN does not have this limitation. Because once the confounder noise generator is trained, any private image be processed immediately.
Data poisoning. The goal of traditional data poisoning is to reduce the test accuracy of the model by modifying the training set. Biggio et al. [2] first introduce this type of attack in support vector machines. Then Mufioz-Gonzttez et al. (21 propose deep learning version by poisoning the most representative samples in the training examples. Although data poisoning attacks seem to share the same goal as ours, these methods have a limited impact on DNNs and are not suitable for data protection tasks. e.g., the model trained on poisoned examples can still achieve acceptable performance [2I], and the modified image can be easily distinguished from the original one 144. In addition, the backdoor attack is another type of attack that poisons training data with a trigger pattern [4 20). but this attack does not prevent the model from learning useful knowledge in the natural data. Therefore, traditional data poisoning methods cannot be used for data protection, while our proposed method can produce unlearnable examples with imperceptible noise.
Confounder in deep learning. In statistics, confounder is variable that influences both the cause variable and effect variable, causing a spurious association 244. If there are confounders in the training set, the model may be hard to learn the correct causal relationship from input to output, resulting in sub-optimal performance [17 36). A lot of works have been proposed to mitigate the negative impact of confounders in deep learning [I 42 43 [8]. e.g., Shen et al. [3]] believe that the background in the dataset plays the role of a confounder and they propose to improve by sample reweighting. However, all these methods treat the confounder as defect. Instead, our proposed method utilizes the property of the confounder to achieve data privacy protection.
3 Problem statement
In this paper, we focus on the scenario of image data encryption. There are two characters in this scenario: data owner and unauthorized model trainer. The data owner needs to encrypt their private data to prevent the model trainer from obtaining the high-performance classification model on this data. We consider two practical encryption settings:
(I) In-distribution data encryption (standard setting)
This setting follows 30
The data owner has n labeled natural (unencrypted) data Daat- He/she can actively use a protection method to obtain encryption (unlearnable) images by adding imperceptible perturbation the original images. Since the protection method has access to each data to adaptively learn and generate custom unlearnable noises, these processed data are defined as in-distribution encrypted data Din,en-
(2) Out-of-distribun
data encryption (fast encryption setting)
The data owner trains a etyptographic tool (e.g., generator) with labeled historical data. Once the encryption tool is trained, it can be used for fast encryption on any data. Specifically, if the data owner uses this tool to encrypt the historical data (i.e., the training set of the encryption tool), the processed data is denoted as D Din,en. Instead, if they use the tool to encrypt some newly unlabeled data (i.e., the non-training set of the encryption tool), the processed data is called nut-of-distributien encrypted data D Dout,en- We believe this setting is practical for the real world. e.g., a person can install the encryption app the phone in advance, and then their instant photos can be quickly encrypted by this app.
One unauthorized model trainer can download any data from public sources as the training set. i.e. Drr (Di, Dout, en, D ). where Drat is collected means that not everyone would encrypt
3

---

patch (confounder)
image
predicted lahel
Class
Class 24
10 30
(a) Causal graph
(b) ImageNet25
(c) Training curves
(d) Test curves
Figure 2: Introducing confounders in ImageNer25 by class-wise patches.
their data before publishing. Then the trainer can label the collected examples with classes and train the model with cross-entropy loss l, as
EgwPens (h(r),t),
(1)
where Pdota represents the distribution of the training set. Note that data eneryptors cannot predict the information of model training advance (e.g., model backbone, data augmentation), which poses a challenge to the encryption method.
Finally, measure the effectiveness of the unlearnable example by evaluating the accuracy of model on the standard test set Dtest- Intuitively, low test accuracy indicates that the model cannot learn exploitable knowledge from the encrypted dataset.
4 Methodology
In this section, we first demonstrate how the native confounder (i.e., background) in the image data affects the performance of classification model. Inspired by this phenomenon, we introduce general framework for image data encryption with the causal confounder. Then we instantiate this framework ConfounderGAN.
4.1 Motivation
We observe that the background some datasets may play the role of the confounder in model learning, thus reducing model performance. Specifically, the image classification task can be modeled as a causal graph. The input image is the cause X, and the output prediction is the effect Y. The regress
training process can be regarded as the process of using the ground truth information relationships from images to predictions X + Y. Ideally. if the model can properly learn these true causal relationships, the classification accuracy will be optimal. However, current data-driven deep learning techniques are only good at learning correlations rather than causality, thus the co-occurrence frequency of object and background may influence the model learning e-g., if the dog always on key feature of the class dog instead of the
the grass in the training set, the model may use grass dog itself. In other words, the confounder background B (i.e., grass) constructs a spurious correlation between images and predictions X + B + Y so that a biased model is learned. Nevertheless, we also need to be aware that native confounders (e.g., background) natural datasets do not play dominant role in training, as models trained on this dataset can still achieve acceptable performance.
4.2
Confounder-basee encryption framework
Inspired by the above observations, if we can deliberately introduce a confounder C' that is closely related to image X and label Y (i.e., X +- - Y), the trained model would hardly learn the correct relationship X Y from this dataset. We believe this is general data encryption framework and there are many possible ways implement it. For example, one straightforward approach is to add class-wise patches (CWP) to the training set. That is, the images of one class add the same patch, while the patches corresponding to each class are different. As shown in Figure 2(a) since the patch added to the image, P + is constructed. Meanwhile, the patch of each image is related to the image's class, so this builds the path P. - Y. To verify this idea, select the first 25 classes

---

LOCMN (cunfcurahe)
Langee
jesdicaal liaed
pieraledd dasetier
paovata dat.
oxffeende aiñe
IB Tritting
graph
de
model Iniiner
groote
used SOT GAN DELSIN
oustsender 33100
In didimbebb eacyypal Casa Mlase
Laaisrn fot the commental mode
conernrcial modal Leding commertial ridel
WWW
NOT frazing
sct of dumbbttt exczypted Peace
trainng data for Uncossstertal
crefonnder wikh
(N
Figure 3: Pipeline of ConfounderGAN: (a) Training pipeline. (b) Evaluation pipeline.
from ImageNet to establish a tiny dataset ImageNet25 for experiments. As illustrated in Figure 2(b each 224 x 224 image in the training set adds a 36 x 36 patch by class in the lower right corner. More experimental details are elaborated in Appendix G.2 Figure [(c) and Figure 2(d) shows the training and test accuracy curves during model training. where the final test accuracies on the natural ImageNet25 and the modified ImageNet25 are 70.9% and 35.4%, respectively (Figure 2 This demonstrates that such a simple confounder based method suppresses the learnable knowledge in the dataset some extent.
Unfortunately, the patch is too conspicuous in the image, affecting its natural use. A natural idea is to replace class-wise patches with imperceptible class-wise noises (CWN). However, this alternative can be circumvented by early stopping [1]. i.e. the model trainer can train a high-accuracy model on this noise-added dataset by early stopping. Meanwhile, both CWP and CWN have two important drawbackss (1) The patch or the noise is predefined and not correlated with the image, so the relationship between the patch/noise (confounder) and image X not strong enough. (2) These methods are limited to in-distribution data encryption and cannot be applied to out-of out-of-distribution data encryption. Hence, how to reasonably introduce a confounder into the training data to overcome the above trawbacks needs to be further explored.
4.3 ConfounderGAN::ooooooune generation method based on GAN
In order develop effective encryption algorithm that can cover various practical scenarios, we utilize adversarial generative networks (GAN) O to instantiate the above framework as Con- founderGAN. Our goal is train a generator whose output confounder noise N satisfies the causal relationship shown in Figure a-22). Figure 1- illustrates our overall training pipeline, which mainly consists of three parts: a generator Go with learnable parameters 6, a discriminator D& with learnable parameters 6, and pretrained classifier fw with fixed parameters w. The generator Go takes the private image x as its input and generates noise Go(z). The encrypted image Gg(z) (z) is obtained by combining the original image and noise, as highlighted in green in Figure Fa-1). We emphasize that this noise as a confounder is better than the predefined btass-wise patches and class- wise noises, because its generation relies on the original image, so that the two variables on path > X have a very strong correlation (Figure 3 a-2)). Then x + Gg(z) will be sent to the discriminator D&. which is used to distinguish the generated data and the original data The training loss of the discriminator D& is
dds (x) = En-Parr. log (z(r) + Er-Paan log(1 - Do + Go(z)))
(2)
where Poata represents the distribution of the original data. It can be found that the discriminator D binary classifier that encourages the generated noise to be imperceptible.
Meanwhile, in order to ensure that the generated noise has the confounder property, the relationship N + Y in Figure a-22) needs to be constructed. As highlighted in red in Figure B 1), we achieve
5

---

Algorithm 1: Minibatch training of ConfounderGAN
Input: a generator Gg with learnable parameters 0, discriminator Da with learnable parameters di a pretrained classifier Jw with fixed parameters w; the training epoch is M, the loss weight factor a.
for m = 1, .M do
Sample minibatch of B examples {x(A), ,..,,,,.......... x!Bi) with labels {1()),. ,.... ,0.,,,(1)))) ((B))
from data
distribution Pdata
Update the discriminator D& by ascending its gradient: V m Σ Ca (x!(0)
Update the generator Gg by descending its gradient:
Vo b=1 Lo
cconfounder (x((0),((0) + ao chinge (z)
this by classifying noise into the ground truth class t of the original image. Thus training loss of the confounder noise generator Gg is
Lgon foondornder (x, EerPasn (fw (Go(())
(3)
where L denotes the cross-entropy loss commonly used in classification tasks. Note that (Gg(() t) in Equation (3) cannot be replaced with f(f + Go(z)),t), since (x) usu- ally has a high classification accuracy for the original image I. This means that the loss (z),
low enough, then (((fw(z + Go(z)), t) can be minimized as long as Go(z)= O.
To bound the magnitude of the noise and stabilize the GAN's training [3], we add a soft hinge loss on the L2 norm
chinge (x) EawPPaon max(0, [])](z) c)),
(4)
where denotes user specifidd bound, Finally, we train the generator Go and discriminator De by solving max-min game, as
arg min max L (x:) L. Go D
Cronfounder (x., (s,t) cochinge (x:)
where controls the weight of Lg Cconfounder (x, f) and Lg chinge during generator training. See Algorithm for the pseudo-code of ConfounderGAN.
Once Gg is trained, as illustrated in Figure 3)) the data owner only needs to input the image into the generator for one forward propagation achieve the data encryption. If private data is used to train the generator, the processed data is called in-distribution encryption data. Conversely, if private data is NOT used to train the generator, the processed data is called outtt--distributtin encryption data. The latter setting is especially useful when the user has some new unlabeled data to encrypt, as does not need extra training. After this private data encrypted, the data owner can upload it to the World Wide Web. When the model trainer downloads these images, he/she cannot exploit useful knowledge from these processed images, thus protecting the data privacy the data owner.
Experiments
In this section, we first introduce our experimental setup. Then we demonstrate the effectiveness of our proposed method in creating unlearnable examples under in in-disrribttion and out-of-distribbe distribution data encryption settings. Next, we conduct a series of transferability and stability of our confounder noise to further illustrate the effectiveness and superiority of our method. Finally, we show some visualizations to better understand our confounder noise.
5.1 Experimental setup
We select three natural object datasets and three medical datasets for algorithm evaluation, including
(5), BloodMNIST (45), Keratitis and ISIC [.. See Appendix F for more details on these datasets. We mainly focus sample-wise noise since it can be applied to various scenarios (e.g., encrypting unlabeled out-of-distribution data). The proposed method is compared with the error- arror-mnimiziin noise (EMN) [2]. which is the strongest baseline for
SVHN [22] CIFARIO (16), ImageNet25

---

Care io (idhnddd) only lo% Now
C (TuN)) oets The 1i5iii Cavee 4:02500 only Pare
Caron (ikke) 9%% Paye 118% Pue
BM0
Oko
Carre S0tki aay 27%2lams
70y
(00public ?lyyr?
Paac)
(4) SVIIN
(d) BlodNNIST
Figure 4: (a)~(b) Test accuracies (%) of the model trained on 100% in-distribution encryption data D Din,en with ResNet18. (c)~(d) Test accuracy curves SVHN and BloodMNIST
Bodiae (Soadart) Dum Podylined (Dea) al (1-01) Beaces
Polyfio:2 (raaded)) estyclon)) Per
2: you PAu (1-hh) Rea
Palyticc4 (Dun) piu Da (i-y P.
SVIN
(b) CIFARIO
(c)
BisudMNIST
(d) Keratiis
Figure 5: (d)~(d) Effectiveness under different combinations of training data on various datasets with ResNet18 model: lower test accuracy indicates better effectiveness.
data privacy protection. We employ ResNet18 100 as the source model or pretrained classifier for generating noise, and train R on the unlearnable training sets. Referring to Huang al. [12). the maximum perturbation is set to 8/255 in SVHN and CIFAR10, and 16/255 in other datasets, thus ensuring it is imperceptible human observers. These settings are fixed for all experiments, unless otherwise explicitly stated. See Appendix G for more experimental details. Effectiveness of ConfounderGAN
5.2
5.2.1
In-distribution data encryption
We first examine an extreme case, if all data collected by the model trainer is in-distribution encryption data (i.e.. Drr- = .00%D,,.en.. how does the model trained on this data perform? The results are illustrated in Figure Ja) and Figure where 'natural' represents the original image. The corresponding test accuracies EMN and our method demonstrate that the learnable knowledge of images is effectively suppressed. More importantly, all datasets processed by our method have the lowest accuracy, which proves the superiority of our method in data privacy protection.
However, in most situations, not all the training data collected by the model trainer are unlearnable examples. For example, only certain number of web users have decided use protection techniques but not all users. Thus, one question is naturally raised: If the trainer uses p% in-distribution encryption data Din.en and (1 p%) natural data Drat for model training. can these encryption data Din,en still maintain the unlearnable property in this mixed dataset? For validation, we train the model on only the natural proportion (1 p%) Dnat for comparison. The results are shown in F where the X-axis represents the proportion p% of Din,en to the original total dataset and the Y-axis represents the classification accuracy on the same test set Drest- A quick glance at Polyline and Polyline 4 tells us that the effectiveness of both EMN and our method drops quickly when the data are not made 100% unlearnable, because their accuracy is close to Beeline (i.e., 100% natural dataset). This means that the encryption effect can be approximately ignored even when the noise is applied to 50% of the data. However, we can also observe that Polyline is close to Polyline 3 and Polyline 4, which may indicate that the high test accuracy in Polyline 3 and Polyline 4 is caused by (%)% natural data Drat-
To illustrate this, we take p 90% in SVHN and BloodMNIST as examples and plot their test accuracy curves during training as shown in Figure cc) and dd. We additionally add Curve 4 and Curve 5 that only use 90% in-distribution encryption data Din,en for model training. The result of these two curves demonstrates that 90% Den.nn is still unlearnable and the test accuracy curve of our method is significantly lower than that of EMN on BloodMNIST, which is consistent with the
7

---

SVHN
CIFARTO
ImageNet2s
Daiaset
Natural
EMN
Natural
EMI
VGGI
95.0
32.6
25.4
86.2
19.1
16.9
62.6
34.0
26.5
ResNet10
95.9
10.6
10.1
91.5
17.9
11.3
73.6
12.3
8.4
DenseNet121
96.3
10.9
8,9
92.6
18.6
13.4
80.0
11.3
BloodMNIST
Keratitis
ISIC
Dataset
Natural
EMN
Ours
Natural
EMN
Ours
Natural
EMN
Ours
VGGHT
96.3
35.4
29.7
79.8
55.4
35.6
72.6
45.6
18.7
ResNet50
95.7
41.7
31.4
80.2
34.4
26.6
75.3
24.3
18.0
121
97.0
35.4
27.5
88.4
30.7
27.0
81.9
26.7
22.7
Table 1: Transferability results: the unlearnable noise is customized for ResNet18, while the evalua- tion is performed on VGG11, ResNet50, De1seNet121.
augmentation
RHF
EMN
17.4
17.9
18.0
18.3
Ours
11.2
11.9
14.8
14,9
Method
CurOut
MixUp
CunMix
EMN
18.2
25.7
18.6
38.4
Ours
15.0
19.3
13.6
39.3
Table 2: Test accuracies (%) of the ResNet18 model trained on unlearnable CIFAR-IO with various data augmentation.
result of BloodMNIST in Figure 4lb) (100% ein.en). Meanwhile, Curve 1, Curve 2 and Curve 3 are almost the same, showing that the exploitable knowledge in Curve 2 and Curve mainly comes from 10% natural data. Therefore, we conclude that both images encrypted by our method or EMN remain unlearnable property even as part of the dataset, and our method maintains its superiority to some extent. In addition, also provide training gradient analysis on encrypted images in the Appendix A to better understand the effectiveness of our method.
5.2.2 Out-of-distribution data encryption
In real-world scenarios, people sometimes want to quickly encrypt their instant photos with little computing resources. For example, a person takes a photo with a cell phone and plans to upload it social media immediately. EMN is hard deploy in this lightweight computing setting, as needs multiple bi-level gradient optimizations to generate an effective noise. In contrast, in our ConfounderGAN, once the confounder noise generator Go is trained, it only needs to input any image into Go for one forward-propagatioo to achieve encryption, and no label information is required, which is ideal for the above practical scenario. However, since the generator has seen these newly captured images during training, the effectiveness of the generated noise on these images is unknown. Therefore, we try to explore the following question: If the trainer uses p% in-distribution encryption data Din.n and (1 p%) ont-of-distribution encryption data Dout.en for model training, can these out-of-distribution encryption data Douteen effectively suppress the learnable information? For brevity, we plot the experimental results to Polyline 5 in Figure 5 The generator for each point in Polyline 4 and Polyline 5 is trained with the same p% data, and performs in-distribution encryption on these data after training. The main difference between Polyline 4 and Polyline that the former does not encrypt the remaining (1 - p%) natural data, while the latter performs out-of diitt--diitiitttion encryption for these remaining data. It can find that the test accuracies of Polyline 5 are obviously lower than those of Polyline 4, which demonstrates that the out-of-distribmn data encrypted by our method has significantly less learnable knowledge than the natural data Pnot. thus proving the effectiveness of our method for out-of-distributtin personal data. See Appendix E for more experiments.
5.3 A Series of Analytical Experiments about ConfounderGAN
For simplicity, the analytical experiments in this subsection are conducted under the 100% in-distribution encryption setting (i.e., 100% ei), unless otherwise stated.
5.3.1
Transferability analysis
Both EMN and our ConfounderGAN rely on a pretrained classifier f to generate effective unlearnable noise. Specifically, EMN uses this classifier source model compute the gradient of emror-

---

Orig.
(Ours) (EMN)
Noiso (Oun)
ImngeNat25 Class 22 (I:: 25250)
ImageNee25 Class 22 (I): 29575)
Figure 6: Visualization: Orig. represents the original image, Enc. represents the encrypted image.
minimizing noise, and our ConfounderGAN needs this classifier learn the correlation between the confounder noise and the label. Therefore, can be considered that unlearnable noise is customized for this classifier f. If the pretrained classifier used by the data owner and the commercial model trained by the unauthorized company share the same backbone, the protection performance should be optimal and the above experiments follow this setting (i.e., both are ResNet18). However, in practical scenarios, the data owner cannot predict which model h the trainer will choose as the backbone. A natural concern is raised: If the architecture of classifier f and model h are different, can the unlearnable property of the noise Irained on classifter J be transferable to the model h.? Table ssowss the results of the transferability under in-distribution encryption setting (i.e., 100% Din, ewn.en). where the classifier f employs ResNet18 and the model f selects VGG11 [34] ResNet50 and DenseNet121 [T. The results show our method outperforms EMN on all datasets and evaluated models, especially for VGGII, indicating that our confounder noise is more practical and effective.
5.3.2 Stability analysis
Model trainers are likely to use some data augmentation techniques to improve their model per- formance during the training phase, so question is introduced: Can noise still work well with different data augmentations? To answer this question, we select 7 commonly used and advanced data augmentation techniques for evaluation
CIFAR10: Random Horizontal Flip (RHF), Random Crop (RC), Combination of Horizontal Flip and Crop (RHF+RC), CutOut 7ZI. Mix [4]]. CutMix 46). Fast Autoaugment (FA) [9]. See Appendix G.6 for detailed experimental setup. The results shown in Table 2 It can be observed that the noise still maintains high effectiveness in most settings. Meanwhile, the test accuracies of our method are also lower than those EMN in all cases, which further proves that our method is better than EMN. In addition. we also investigate the stability of ConfounderGAN under early stopping and adaptive setting. See Appendix C and Appendix D for more details.
5.4 Visualizations
As shown in Figure we randomly select two images from the ImageNet225 for visualization. Since noises are all limited to a small range, all noises are scaled to the interval [0, 255] according their maximum and minimum values. We can obverse that the noises EMN are small disordered dots in most cases, while the noises of our method show some high-level representations. e.g., feather- like textures can be observed. These high-level representations may lead to the better transferability of method (as mentioned in Section 5.3.I), since different backbones may share some common representations. See Appendix for more visualizations.
Conclusion
We focus on the image data encryption task, its goal is to use small and invisible noise to prevent personal data from being freely exploited by deep neural networks. By leveraging confounder property, we propose a confounder-bar confounder that is strongly correlated with both images and labels the dataset, that the model trained on this dataset can only learn the spurious correlations between images and labels. Based on this framework, we develop confounderGAN, a novel image data encryption method that covers various practical scenarios. Empirically, we demonstrate that our method outperforms the state-of-the- art algorithm the in-distribution data encryption and can be effectively applied to out-of-distribution data encryption. Moreover, we also verify that the transferability and robustness of our confounder noise. We believe this paper provides new insight into data privacy protection and could have a broad impact both the public and the deep learning community.
encryption framework for image data. i.e., introduce

---

7 Acknowledgements
This work supported in part by National Natural Science Foundation of China (No. 62006207, No. 62037001), the Starry Night Science Fund of Zhejiang University Shanghai Institute for Advanced Study BEN-JJU-SIAS-0111 Project by Shanghai AI Laboratory (P22KS00111), Program of Zhejiang Province Science and Technology (2022C01044), the Fundamental Research Funds for the Central Universities (226-2022- 00142, 226-2022-00057 I), Zhejiang Province Natural Science Foundation (No. LQ2IF020020) and National Natural Science Foundation of China (Grant No. U20A20387).
Key Laboratory for Corneal Diseases Research of Zhejiang Province,
References
[1] Matt Berseth. Isic 2017-skin lesion analysis towards melanoma detection. arXiv preprint 1.Xi::1703.00523.. 2017.
[2] Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. arXiv preprint arXiv: 6389, 2012.
[3] Abeba Birhane and Vinay Uday Prabhu. Large image datasets: A pyrrhic win for computer vision? In WACV, 2021.
[4] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks deep learning systems using data poisoning. arXiv preprint 1rXiv:1712.0553 2017.
[5] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, 2009.
[6] Jacob Devlin, Ming- Wing-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In NAACL-HLT, 2019.
[7] Terrance Vries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. arXiv preprint arXiv:1708, 04552, 2017.
[8] Ji Feng, Qi-Zii Cai, and Zhi-Hua Zhou. Learning to confuse: generating training time adversar- ial data with auto-encoder. 2019.
[9] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In NeurIPS, 2014.
[10] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016
[11] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In CVPR, 2017.
[12] Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearn- able examples: Making personal data unexploitable. In ICLR, 2021.
[13] Phillip Isola, Jun-Yan Zhu, Tinghui Zhou, and Alexei A Efros. Image-to-image translation with conditional adversarial networks. In CVPR, 2017.
[14] Xiaojun Jia, Xingxing Wei, Xiaochun Cao, and Xiaoguang Han. Adv-watermark: A novel watermark perturbation for adversarial examples. In MM, 2020.
[15] Jayendra Kantipudi, Shiv Ram Dubey, and Soumendu Chakraborty, Color channel perturbation attacks for fooling convolutional neural networks and defense against such attacks. 77P, 2020.
[16] Alex Krizhevsky et al. Learning multiple layers of features from tiny images. 2009.
[17] Kun Kuang, Lian Li, Zhi Geng, Lei Xu, Kun Zhang, Beishui Liao, Huaxin Huang, Peng Ding, Wang Miao, and Zhichao Jiang. Causal inference. Engineering, 2020.
[18] Jiahui Li, Kun Kuang, Baoxiang Wang, Furui Liu, Long Chen, Changjie Fan, Fei Wu, and Jun Xiao. Deconfounded value decomposition for multi-agent reinforcement learning. In ICMI. 2022.
10

---

[19] Sungbin Lim, Ildoo Kim, Taesup Kim, Chiheon Kim, and Sungwoong Kim. Fast autoaugment. In NeurIPS. volume 32, 2019.
[20] Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack deep neural networks. In ECCV, 2020.
[21] Luis Mluñoz-Gonzáles Battista Biggio, and Ambra Demontis. Towards poisoning of deep learning algorithms with back- graddett optimization. In AlSec, 2017.
[22] Yuval Netzer, Tao Wang, Adam Coates, and Alessandro Bissacco. Reading digits in natural images with unsupervised feature learning. 2011.
[23] Nature News. Google health-data scandal spooks researchers. Nature News, 2019.
[24] Judea Pearl. Causality. Cambridge university press, 2009.
[25] Fabien Petitcolas. La cryptographie militaire. J. des Sci. Militaires, 1883.
[26] NhatHai Phan, Yue Wang, and Xintao Wu. Differential privacy preservation for deep auto- encoders: application of human behavior prediction. In AAAI, 2016.
[27] NhatHai Phan, Xintao Wu, Han Hu, and Dejing Dou. Adaptive laplace mechanism: Differential privacy preservation in deep learning. In ICDM, 2017.
[28] Evani Radiya-Dixii Dixit and Florian Tramèr. Data poisoning won't save you from facial recognition. arXiv preprint arXiv:2 200:://0/// 14851, 2021.
[29] Ali Shafahi, W Ronny Huang, Mahyar Najibi, and Octavian Suciu. Poison frogs! targeted clean-label poisoning attacks on neural networks. NeurlPS, 2018.
[30] Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Zhao. Fawkes: Protecting privacy against unauthorized deep learning models. In USENIX Security, 2020.
[31] Zheyan Shen, Peng Cui, Kun Kuang, Bo Li, and Peixuan Chen. Causally regularized learning with agnostic data selection bias. In MM, 2018.
[32] Reza Shokri and Vitaly Shmatikov. Privacy- deep learning. In SIGSAC, 2015.
[33] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In SP, 2017.
[34] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint urXiv:1409, 1556, 2014.
[35] New York Times. The secretive company that might end privacy we know it. New York Times, 2020.
[36] Tan Wang, Jianqiang Huang, Hanwang Zhang, and Qianru Sun. Visual commonsense r-cnn. In CVPR, 2020.
[37] Wikipedia. Project nightingale. Wikipedia, 2019.
[38] Wikipedia. Electronic communications privacy act. Wikipedia, 2021.
[39] Wikipedia. General data protection regulation. Wikipedia, 2021.
[40] Wikipedia. Health insurance portability and accountability act. Wikipedia, 2021.
[41] Wikipedia, Information privacy law. Wikipedia, 2021.
[42] Anpeng Wu, Kun Kuang, Bo Li, and Fei Wu. Instrumental variable regression with confounder balancing. In JCML, 2022.
[43] Anpeng Wu, Junkun Yuan, Kun Kuang, Bo Li, Runze Wu, Qiang Zhu, Yue Ting Zhuang, and Fei Wu. Learning decomposed representations for treatment effect estimation. TKDE, 2022.

---

[44] Chaofei Yang, Qing Wu, Hai Li, and Yiran Chen. Generative poisoning attack method against neural networks. arXiv preprint arXiv:/703.01 340, 2017.
[45] Jiancheng Yang, Rui Shi, Donglai Wei, Zequan Liu, Lin Zhao, and Bilian Ke. Medmnist v2: A large-scale lightweight benchmark for 2d and 3d biomedical image classification. arXiv preprint arXiv:21 10. 14795, 2021.
[46] Sangdoo Yun. Dongyoon Han, and Scong Joon Oh. Cutmix: Regularization strategy to train strong classifiers with localizable features. In 2019.
[47] Hongyi Zhang. Moustapha Cisse, Yann Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. arXiv preprint
2017.
[48] Kai Zhang, Wangmeng Zuo, Yunjin Chen, Deyu Meng, and Lei Zhang. Beyond gaussian denoiser: Residual learning of deep enn for image denoising. TIP, 2017.
Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes]
(c) Did you discuss any potential negative societal impacts of your work? [N/A]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [N/A]
(b) Did you include complete proofs of all theoretical results? [N/A]
3. If you ran experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main exper- imental results (either in the supplemental material or as a URL)? [Yes] We provide
instructions needed reproduce our experimental results in Appendix G
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] See Appendix G
(c) Did you report error bars (e.g., with respect to the random seed after running exper- iments multiple times)? [No] classification tasks, the variance of each result is small.
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes] See Appendix G
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]] See Appendix F
(b) Did you mention the license of the assets? [Yes] See Appendix F
(c) Did you include any new assets either in the supplemental material as URL? [N/A]
(d) Did you discuss whether and how consent was obtained from people whose data you't 're using/curating? [N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
5. If you used crowdsoureing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if applicable? [N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, applicable? [N/A]
(c) Did you include the estimated hourly wage paid participants and the total amount spent on participant compensation? [N/A]
12


Reviews:
[{"review_id": "tJUJl49fWu", "reviewer": "Reviewer_oeZM", "summary": "This paper proposes ConfounderGAN, a GAN whose generator can be used to create a noise to an image to make it *unlearnable*, by creating a spurious correlation between the image and the label. The proposed approach has been evaluated on several image classification tasks and the results show it can help reduce the accuracy of a model trained on noisy data in the *non-adaptive* setting.", "questions": "\n- Please consider discussing the relation between this solution and data poisoning in more detail. \n- I suggest, using \"perturbed\" images instead of \"encrypted\" images\n- The current discussion on how attackers can bypass the defence is a bit limited. What happens when some users have both their perturbed and un-perturbed data online? Since ConfounderGAN can be obtained by any user, the attacker can also use it to train a denoiser. Overall, more discussion on the adaptive setting could help. ", "limitations": "Nothing to report.\n", "rating": 6, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "\n**Strengths** \n\nThe paper tackles an important issue. The results seem promising. However, several issues need to be addressed to make the paper more convincing.\n\n**Weaknesses** \n\n- The proposed approach seems a lot like a data poisoning attack. However, discussions on data poisoning and its relation to this solution are missing. Instead, terms like encryption are used, which can be misleading. \n- The paper did not discuss the asymmetry between users and attackers as discussed in recent literature (e.g., [a]), which may give a false sense of security to users as these types of countermeasures have been proven to be ineffective.\n\n[a]- Data Poisoning Won't Save You From Facial Recognition. (Radiya-Dixit et al., 2021)", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "rcJgz2rPQnh", "reviewer": "Reviewer_rw45", "summary": "This paper proposes a GAN that makes personal image data unlearnable by DL methods for data protection. The authors utilize the confounder property present in the noise produced by the generator. This property builds spurious correlations between images and labels, disallowing the model to learn the correct mappings. The discriminator is used to ensure that this generated noise is undetectable. The authors conduct experiments using six image classification datasets, 3 of which are natural object datasets and 3 are medical datasets. Specifically, a confounder based framework has been proposed for image data encryption. ", "questions": "Section 2, Related work reviews data privacy, data poisoning and causal confounder in DL. However, only data privacy and confounder in deep learning have been discussed. Has data poisoning been combined with data privacy? There was no clear demarcation in the discussion of the two concepts under Data Privacy.\nSection 5.2.1 could be better structured for ease of reading. ", "limitations": "There are very few possible negative societal impacts, that are not straightforward in nature. The authors have, however, discussed the positive impact, which is data privacy in DL.", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The paper has been very well written, introduction to concepts have been well laid out and the structure of the paper is clear. The authors have done a thorough study of the past works in this particular domain. There are, however, some typos throughout the paper. For example: Line 12 -> \"thereby, remaining the normal utility\", Line 14 -> \"The experiments are conducted in six image classification datasets, including three natural object datasets and three medical datasets\" (this reads slightly ambiguous so a better choice of word for including might be consisting/comprising), Line 237 -> sentence capitalization.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "ZUrDSk7uP5F", "reviewer": "Reviewer_Bo5j", "summary": "This paper proposed using GAN to produce confounder noise for unlearnable examples. The proposed method address an important issue that personal data is being used for unauthorized machine learning training. Unlike existing methods that require bi-level optimizations with multiple backward passes, the proposed method can generate confounder noise in a forward pass after training, making it very practical in a real-world application. Empirically, the proposed method outperforms existing methods. \n", "questions": "Please address the questions in the Strengths And Weaknesses section.\n\n", "limitations": "Please address the potential limitations in the Strengths And Weaknesses section.", "rating": 7, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n- Well-motivated method for efficiently generating unlearnable examples, and the context of unauthorized machine learning training is well explained. \n- The proposed method is efficient and technically sound. Existing works rely on optimizations that may not be practical for a user to generate unlearnable examples on the fly. Using GAN, the unlearnable version of the image can be generated in a forward pass, which improves usability in a practical setting. \n- Comprehensive empirical evaluations of different datasets and models are appreciated. Results demonstrated the proposed method consistently outperforms existing methods.\n\n---\nWeaknesses/Limitations:\n- For experiments on the different proportions of unlearnable examples, it does not make sense to compare Polyline 5 with others. Polyline 5 is still regarded as the 100% unlearnable case. It would be interesting to see $ D_{out,en} $ with $D_{nat}$. \n- Legends on Fig 5 (c-d) color is not clear for EMN v.s. the proposed method for only $ D_{in,en} $\n- Line 215, \"When the model trainer downloads these images...\" I believe the goal of unlearnable examples is to make the model unable to predict the protected classes/users rather than high-performing models. \n- Line 237 \"we first\" -> \"We first\"\n- Once the data is released, the defender may not modifies the data anymore, and the model trainer can retroactively apply new models/methods [1]. An adaptive case should be carefully examined.\n- Comparison with DeepConfuse [2], which also able to generate unleranable samples for $ D_{out,en} $\n\n[1] Data Poisoning Won’t Save You From Facial Recognition, ICML 2021 Workshop AML\n[2] Learning to Confuse: Generating Training Time Adversarial Data with Auto-Encoder. NeurIPS 2019\n\n\n---\nAfter the author's response, I increased my rating score to 7. \n\nA detailed analysis of the adaptive method to reverse the original image is well explained and discusses the potential limitation of the proposed method. Based on the author's response, in practice, the owner should keep the parameters of ConfounderGAN private to prevent the model trainer reverse the unlearnable data. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept