Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneously
Authors: Yihan Wang
Yifan Zhu
Xiao-Shan Gao
Venue: NeurIPS 2024 poster (2024)
Keywords: availability Attacks
indiscriminate attack
unlearnable examles
contrastive learning
Primary area: safety_in_machine_learning
TL;DR: We propose efficient availability attacks for both supervised and contrastive learning

Abstract: Availability attacks provide a tool to prevent the unauthorized use of private data and commercial datasets by generating imperceptible noise and crafting unlearnable examples before release. 
Ideally, the obtained unlearnability can prevent algorithms from training usable models. 
When supervised learning (SL) algorithms have failed, a malicious data collector possibly resorts to contrastive learning (CL) algorithms to bypass the protection.
Through evaluation, we have found that most existing methods are unable to achieve both supervised and contrastive unlearnability, which poses risks to data protection by availability attacks.
Different from recent methods based on contrastive learning, we employ contrastive-like data augmentations in supervised learning frameworks to obtain attacks effective for both SL and CL.
Our proposed AUE and AAP attacks achieve state-of-the-art worst-case unlearnability across SL and CL algorithms with less computation consumption, showcasing prospects in real-world applications. 
The code is available at https://github.com/EhanW/AUE-AAP.

Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneously
Yihan Wang, Yifan Zhu, Xiao-Shan Gao"
Academy of Mathematics and Systems Science, Chinese Academy of Sciences University of Chinese Academy Sciences
fyihanwang, zhuyifan| $amss ac xgao iss.iss.... ac.
Abstract
Availability attacks provide tool to prevent the unauthorized use of private data and commercial datasets by generating imperceptible noise and crafting unlearnable examples before release. Ideally, the obtained unlearnability can prevent algorithms from training usable models. When supervised learning (SL) algorithms have failed, malicious data collector possibly resorts to contrastive learning (CL) algorithms to bypass the protection. Through evaluation, we have found that most existing methods are unable to achieve both supervised and contrastive unlcarnability, which poses risks to data protection by availability attacks. Different from recent methods based on contrastive learning,
employ contrastive-like data augmentations in supervised learning frameworks to obtain attacks effective for both SL. and CL. Our proposed AUE and AAP attacks achieve tfate-of-the-ar worst-case unlearnability across SL and CL algorithms with less computation consumption, showcasing prospects in real-world applications. The code is available https: pestpa://githar thub Com/EhanW/ANe Aww.n////EEAAA AAP
Introduction
Availability attacks add imperceptible perturbations training data, making the subsequently trained model unavailable. The motivations behind this kind of data poisoning attack involve protecting private data and commercial datasets from unauthorized use [22]. For example, according to report [19), tech company illegally obtained over 3B facial images as the training set to develop a commercial facial recognition model. In this type of scenario, availability attacks provide tools to process images before relcase, preserving legibility but impeding subsequent training. In particular, Huang et al. (22) reduces the accuracy of face recognition 50 identities in WebFace 54 from 86% to 16%. In recent years, various availability attacks against supervised learning (SL) 56 28 have been proposed.
Meanwhile, contrastive learning (CL) allows people to extract mean- ingful features from unlabeled data self-supervised way. Af- ter subsequent linear probing or fine-tuning, CL. algorithms have achieved comparable accuracy or even surpassed the performance
SenCLi
88-
of SI. 5 7 15 6 However, most attacks designed for poisoning SL are ineffective against CL, as shown in Figure It sheds light on potential issue of using availability attacks protect data: malicious data collector can traverse both supervised and contrastive algorithms effectively leverage collected data. Hence, intro- duce worst-case unlearnability (see Section 3.1 as the evaluation
20-
Figure 1: Attacks against SL
and CL on CIFAR-10. metric for availability attacks emphasize the demand to deal with trickier unauthorized data
Corresponding author. Kaiyuan International Mathematical Sciences Institute
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

of Poizoned of Prisuned
Contrantive
a-Bosed Pairening
Poséfro
Onter Componeene
X
Auga
Nogalive Pairs
Asggnnntations
Infermtion
Unisoblo Modea
Ala
Orighnl
Data
Si-Saaed Paireriny
Our
Augmented Data
RESOE
Supervioon and
Minini
Pertutted
Dats
Figure 2: Illustration of our proposed method. Separated by vertical dashed line, the left side shows the process of generating the poisoning attack, while the right side depicts the training process on the poisoned dataset. On the generation side, above the horizontal dashed line are the existing methods based on contrastive error minimization, while below the dashed line are our proposed methods based on supervised error aonnimizatio/maxxiiiiii contrastive augmentations to obtain effectiveness against both supervised learning and contrastive learning algorithms. Label information is involved in both method and CL-bbsed methods.
(the blue flow). Our attack leverages the stronger
collector. In recent years, contrastive error minimization attack is proposed to poison contrastive learning [66. and then label-dependent components are incorporated into it to simultancously achieve supervised unlearnability besides contrastive unlearnability 33 29]. However, compared to SL-based ones, these CL-based attacks lack efficiency in poisoning generation, potentially hindering availability attacks from protecting extensive data in the real world (see Section (3.3). Therefore, effective as well as efficient availability attack against both SL and CL is imminent. Specifically, our motivation for this paper comes from two aspects: 1) A fully functional availability attack needs to be effective against subsequent supervised and contrastive learning algorithms simultaneously. 2) Attacks based on supervised learning can be superior in efficiency compared to those based contrastive learning.
To design a non-CL-based attack that possesses both supervised and contrastive unlearnability, we start from an interesting obser- vation that supervised training with contrastive data augmentations mimics contrastive training some extent (see Section 4.1) As shown in Figure 2 this technique of enhancing data augmen- tations can be easily embodied in two basic supervised attack frameworks, i.c., mroormmniiizztionn and arror-mxximization, re- sulting in our proposed AUE and AAP attacks (see Sections 4.2 and 4.3). Enhanced augmentations allow us to craft perturbations for contrastive-liks reference model. These perturbations im-
Clean
60-
AUE
Acsimay
MP
20-
SimcL
Modio
BYaL
Sle
Figure 3: Attack performance of our methods on ImageNet-100.
plicitly adapt to the contrastive training process and then learn deceptive patterns that fool contrastive learning. The supervised unlearnability still preserved since the generation process is based on supervised optimization.
On experimental side, we evaluate the standard supervised learning algorithm and four representative contrastive learning algorithms, SimCLR [5], MoCo 77 BYO [15) and SimSiam [6]. Our pro- posed AUE and AAP attacks achieve the statc-of-thed the-art worst-case unlearnability on CIFAR-10/100 and mony/MiniIImageNe datasets (see Section 5.2) Specifically, our method exhibits excellent performance on the ImageNet-100 100 presented in Figure 3. showcasing its prospects in real-world applications. Meanwhile, unlike methods that add additional components to the contrastive error- minimization framework, we modify the data augmentation in the simpler supervised attack frame- works, following a minimalist approach to algorithm design. Benefiting from this, our methods are more efficient, while delivering better performance. We summarize our contributions as follows:
We evaluate existing availability attacks and point out the potential security risks of using them to protect data when facing data abusers who will traverse both supervised and contrastive learning algorithms.
We start from supervised poisoning approaches and enhance data augmentations to attain attacks against both supervised and contrastive learning.

---

Our attacks achieve state-of-thee the-ttt-rrt worst-case unlearnability with less computation con- sumption and are more adept handling high-resolution datasets.
2
Background
We will introduce some notions of contrastive learning and availability attacks. Besides, we provide more preliminaries contrastive learning in Appendix B
2.1 Contrastive Learning
Contrastive learning trains feature encoders in self-supervised way. It first transforms image into two views, i.e., a positive pair, using augmentations sampled from a strong augmentation distribution μ.. Two views augmented from different images constitute a negative pair. Extracted features are trained to be aligned between positive pairs but distinct between negative pairs. It does not require label information until downstream tasks such linear probing or fine-tuning. Wang and Isola [50] introduced two key properties for contrastive learning, alignment and uniformity. The former measures the similarity of features from positive pairs and the latter reflects the uniformity feature distribution on the hypersphere. Let be a normalized encoder. The alignment loss and uniformity loss on a dataset D. are defined as the following:
A(D,)
= E
[l](<(()) - g (() U(Dz) = log E (e=Bllattte)) e-
w. mitropp
The alignment gap and uniformity gap between clean and poisoned datasets are defined as follows:
Let D', be poisoned version of a clean dataset De.-
AG = A(D.) - A(D'). ug = (DD)
Intuitively, these gaps characterize the difference between clean features and poisoned features. We will check the relationship between these gaps and contrastive unlearnability in Section 3.2
2.2 Basic Availability Attacks
The essence of availability attacks is to prevent a trained model from well generalizing to clean data. We will revisit two representative approaches to poisoning supervised learning.
Error minimization. Unlearnable example attack (UE) generates poisoning by alternately optimizing the reference model and perturbations
[22]
min min E [C + 8(x, v). yi f)], 6 f
(2)
D.
where f is classifier, ())())))) is the supervised loss, De is dataset to be processed and 8 is poisoning map.
Error maximization. Adversarial poisoning (AP) optimizes perturbations through pre-trained classifier to equip them with non-robus: but useful features from a different label 13:
min EE [Lss(x= + 5(x, y + K; f"),
De
s.t. f" E arg min mjn E [Cst (1r, yi f)]]
D.
where K the label shift. Self-ensemble protection (SEP) generates adversarial poisons using several checkpoints to improve attack performance [4.
Contrastive error minimization. Contrastive poisoning (CP) extends the error minimization framework to contrastive error minimization to poison contrastive learning [16]:
min min [Feu(æ 8(2, g):
y D.
where is an encoder and Le (-:-): denotes the contrastive loss for simplicity. Later, the transferable unlearnable example attack (TUE) introduces regularization term called class-wise separability discriminant to equip CP noises with supervised unlearnability [36]. Then, transferable poisoning (TP) combines contrastive error minimization with supervised adversarial poisoning to obtain both supervised and contrastive unlearnability (29). It is worth mentioning that both TUE and TP leverage label information their proposed schemes, while CP requires no label information but lacks stable effect on supervised learning.

---

Threat Model
In our threat model, an unauthorized data collector assembles labeled data into dataset. The access to label information is reasonable since the collector can crawl individual images from certain accounts or steal (and annotate) commercial dataset. data publisher supposed to process data before release using an availability attack such that processed data is resilient to subsequent supervised learning algorithms as well as contrastive learning algorithms adopted by the data collector. We will define worst-case unlearnability and discuss the contrastive unlearnability of existing attacks.
3.1 Worst-Case Unlearnability
Suppose unprocessed dataset D. i.i.d sampled from a data distribution D. An availability attack maps a data-label pair (æ: y) E De to noise 6(æ, y) within an 4p ---norm ball Bp (E). In this paper, we set p = oo and = 8/ 3/255. It results in a protected dataset D' {(x + 8(x y), y) y) E De) to which a data collector has only access. For potential algorithms, we refer f to supervised learning classifier and g to a contrastive learning encoder beyond which is a linear probing head h. The goal of the data publisher is to find a poisoning map å that significantly degrades the generalization performance both fs and h& o gs which are trained on D' We define the worst-case unlearnability across supervised and contrastive learning algorithms of the following form:
min max(E [1(6(x)) = w)]. [1s go(x)) - w)])
(5)
8
s.t.
fa E arg mig EE [Csn (x 6(x. v). y: f)].
D.
ga E arg min E (L v):,))
D.
hg E arg E [a + 8(x, y) y h g6)].
h D.
It is fair metric that accurately depicts scenarios facing more cunning data abusers the real world. In contrast, other metrics, such as average-case unlearnability, can be heavily influenced by the attack's strong preference for certain algorithm. Our threat model differs from the setting adopted by He et al. [16] in which the linear probing stage relies on the unprocessed clean data as downstream tasks; see more discussion in Appendix D.10
3.2 Existing Attacks against Contrastive Learning
In Table D we evaluate the attack performance of existing poisoning approaches against the SimCLR algorithm on CIFAR-10 and ResNet-18. To better understand contrastive unlcarnability, also check aligmment and uniformity gaps between clean and poisoned data defined in Equation (I). In non-CL- based poisoning attacks, except for AP and SEP, all other methods fail deceive the contrastive learning algorithm. The alignment and uniformity gaps of AP and SEP attacks are prominently larger than those of others. CL-based attacks including CP, TUE, and TP are effective against contrastive learning and possess huge alignment and uniformity gaps.
Table 1: Alignment gap, uniformity gap, and test accuracy(%) of poisoned SimCLR [S]
models. Attacks are grouped according to whether they are based on contrastive error
minimization. Bold fonts emphasize promi- nent contrastive unlearnability values.
Attacks
Ag
Ug
Test Acc.
DC
11
0.12
0.07
86.1
UE 22
0.05
0.03
89.0
AR 41
0.07
0.09
88.8
NTGA 58
0.12
0.12
86.9
SN [56
0.08
0.00
90.6
OPS 52
0.04
0.01
86.7
The Pearson correlation coefficient (PCC) between the alignment gap and SimCLR accuracy is -0.82, and the PCC between the uniformity gap and Sim- CLR accuracy is - -0.88. It reveals that contrastive unlearnability is highly related to huge alignment and uniformity gaps. When the encoder is fixed after poisoned contrastive training, linear layer learns to classify poisoned features, i.e., features of poi- soned (training) data. Note that evaluation is to clas- sify clean features, i.c., features of clean (test) data.
GUE 28
0.07
0.03
88.8
REM
0.12
0.04
88.6
EntF 51
0.01
-0,04
87.5
HYPO
47
0.11
0.13
86.9
AP
13
0.18
0.44
48.4
SEP
0.24
0.25
37.3
CP 16
0.55
0.87
38.7
TUE 36
0.30
0.76
48.1
TP 29
0.52
0.82
31.4

---

Prominent gaps indicate a significant difference between clean and poisoned feature distributions. Thus, no matter how well the classifier performs on poisoned features, hardly generalizes clean features and the attack is successful. In contrast, small gaps likely imply that clean features are similar to poisoned features. When gaps are small, the test accuracy high and the attack fails.
4 Method
Since contrastive loss is related to alignment and uniformity [50], the contrastive error minimization (CP) attack optimizes the loss directly and obtains contrastive unlearmability. Beyond this, TUE and TP incorporate additional label-dependent components to obtain supervised unlearnability. However, optimizing contrastive loss very time and
impeding their applications in real- world scenarios. Different from them, we start from more efficient supervised poisoning frameworks instead to achieve both supervised unlearnability and contrastive unlearnability simultaneously. The key point to get there is data augmentation. In the rest of this section, we first illustrate how contrastive learning data augmentations help mimic contrastive learning with supervised models through empirical observations and intuition from toy example. In other words, enhancing data augmentation helps supervised learning implicitly optimize the contrastive loss. Then we combine this very effective technique with supervised error minimization and maximization frameworks and propose augmented unlearnable examples (AUE) attacks and augmented adversarial poisoning (AAP) attacks.
4.1 Mimic Contrastive Learning with Supervised Models
Contrastive learning employs strong data augmentations including resized crop, color jitter, horizontal flip, and grayscale [53 18] while supervised learning adopts mild data augmentations such as horizontal flip and crop. In Appendix C.2 Code Issows detailed im- plementations for these two different settings. Naturally, contrastive error minimization uses stronger data augmentation compared to supervised error minimization. However, what if we use strong contrastive augmentations when optimizing supervised losses? On CIFAR-10, 10, we train a supervised ResNet-18 18 classifier using con- trastive augmentations. At each checkpoint, we log the supervised cross-entropy (CE) loss and the contrastive InfoNCE loss (33 on the training set. In Figure when the optimization object CE loss goes down, the InfoNCE loss decreases as well. It indicates that training a supervised model with contrastive augmentations implicitly optimizes the contrastive loss. In other words, supervised eтror minimization mimics contrastive error minimization to some extent. Therefore, incorporating stronger data augmentation potentially enables availability attacks based on supervised error minimization maximization to deceive contrastive learning.
2.0%
CowsEntropy
LGG
Cross-Enrrapy Loss InfoNCE Loss
InfoNCE
1.2
23
60
100
Epoch
Figure 4: InfoNCE loss de-
creases with CE loss.
To provide more intuition about this idea, we give a toy example and have a closer look at the relationship between supervised loss and contrastive loss. For a supervised model f f h o g. assume a balanced distribution, [Asa]] and La. contains only one negative example. In this
g is normalized feature extractor, is a square full-rank linear classifier, La. is MSE loss, training error &s. toy example, if La. and Ls. employ the same data augmentation and f is well-trained, it holds with high probability that La < ((Es.), where 1(-) is increasing function. In other words, the upper bound of contrastive loss decreases as the supervised loss decreases. We have a more detailed and formal discussion on this toy example in Appendix E
Based on these interesting observations, instead of adding components to contrastive error minimiza- tion to achieve supervised unlearabilityy we opt for deriving stronger contrastive unlearnability from supervised error minimization and maximization.
4.2 Augmented Unlearnable Examples (AUE)
Recall unlearnable examples (UB) are generated by supervised error minimization which alternately updates reference model and noises in Equation (2). Now we employ contrastive-like strong data aug- mentation distribution j and add perturbations in differentiable way, i.e., л(x 5(xr y)), ग ~ p. As discussed in the previous section, minimizing the augmented supervised loss (s + v)
5

---

implicitly minimizes the contrastive loss (a + 8(, (): which appears in contrastive error minimization, i.e., Equation (4). In other words, supervised minimizing noises with enhanced data augmentation can partially replace the functionality of contrastive error-minimizing noises to deceive contrastive learning.
We can control the intensity of contrastive aug-
mentations in Code [ via a strength parame- ter 8 E [o, 1]. We increase the augmentation strength and generate the poisoning attack us-
Clean
0.6
Algimaat Gap Unifomiity
InfeNCE losg
ing Algorithm [ Implementation details are shown in Appendix C.3 In Table 2 while UE
attacks do not work for SimCLR on CIFAR- 10 and CIFAR-100, our AUE attacks success- fully reduce the SimCLR accuracy by 38.9% and 50.3%. Enhanced data augmentation in- deed makes supervised error-minimizing noises effective for contrastive learning. In Figure 5a AUE noises largely reduce the contrastive loss during SimCLR training compared to UE noises. In Figure [bb we investigate the alignment and uniformity gaps and discuss more about the poisoned training process in Appendix [D.2] The final gaps AUE are AG 0.27, ug = 0.34 while those of UE are Ag = 0.05,249 0.03.
280
0.0
600
1003
Epoch
(a)
(h)
Figure 5: (a) Contrastive losses during SimCLR training under UE and AUE attacks. (b) Alignment and uniformity gaps during the SimCLR training on CIFAR-10 poisoned by our AUE attack.
Algorithm 1 Augmented Unlearnable Examples (AUE)
Require: Augmentation strength and corresponding augmentation distribution pa. A labeled training De = ((x.. y1) y) An initialized classifier fo. Total epochs T, model update iterations Ts. poisons update iterations T'. and perturbation steps Tp. Learning rate cig, Cr..
Ensure: Perturbations {6, H.
ō; 0, 1,2,
Initialize perturbations
for 1,............... do
for to = 1....,T, ,To do
Update the reference model Sample data batch {(mI, Mt }1 and an augmentation hatch (Mi 14
0 0 ca -5m VoLLL(MT (xi, + dt,), My, (oy
for is = 1, ... Ts do
b Update perturbations
Sample data batch { M1, b for 4p 1.... .Tp do
Sample an augmentation batch { ~ p=]
ō1 + Clip, (ō1, as sign( (SL (an, +
1,2,
4.3 Augmented Adversarial Poisoning (AAP)
Adversarial poisoning (AP) attacks in Equa- tion (3) first train a supervised reference model, then generate its adversarial examples. When replacing mild supervised augmentations with stronger contrastive ones, the training pro- cess of the reference model, i.e., minimizing (sL(T(a) yi f), ~ I concerning f mimics updating its encoder with contrastive learning. The final reference model f has contrastive-lic encoder. Then, generating perturbations via minimizing Lst (π + 8(xx y)), y + K; f*) with respect to is to deceive the contrastive-like model. Consequently, the resulting poisoning attack learns more about confounding contrastive learning algorithms.
Table 2: Accuracy drop(%) of SimCLR caused by basic attacks and our methods.
Datascts
Clean
UE
AUE
AP
AAP
CIPAR-I0
91.3
-2.3
-38.9
-42.9
-52.2
100
63.9
-3.9
-50.3
-38.3
-43.8
According to Algorithm 2 we increase the augmentation strength in both reference model pre- training and noise update where the label translation = Implementation details are shown in Appendix C.3 In Table 2 the AAP attack further enlarges the SimCLR accuracy drop of AP by 9.3% on CIFAR-10 and 5.5% on CIFAR- 100. Enhanced data augmentations indeed improve the contrastive unlearnability of supervised emror maxormmaxiizzig noises.

---

Algorithm 2 Augmented Adversarial Poisoning (AAP)
Require: Similar to the setting in Algorithm
Ensure: Perturbations {6, F==1 å; 1,2, 1......." for 1...., do
Initialize perturbations
,T.
Update the reference model
for tg 1. To do Sample data batch
{m M1, 1 and an augmentation hatch (my ~ Ju Ma
0 0 aa -
Vo VoLsi(Mi (m,, (, vo)
for == 1, do
Update adversarial examples
for 1, 1, Tp do
Sample πт. fha
-lip, (ò: - sign( Vo, Lsi (Nr((>; + &.). vs +1:
5 Experiments
We will evaluate the worst-case unlearnability of our proposed AUE and AAP attacks on multiple datasets and compare the poisoning generation efficiency with other methods. Besides, will check the efficacy of our method against more evaluation algorithms and the transferability across network architectures. Then will perform ablation study of decoupling argumentation components in our method.
5.1 Setup
We conduct experiments CIFAR- 10/100 (26). Tiny-ImageNet 27 modified Mini- Mini-ImageNet 49) and ImageNet-100 [38] ResNet-18 [7] is used for poison generation and evaluation not otherwise stated. Our threat model considers the worst-case unleamability across supervised and contrastive -self-supervised) algorithms including standard SL, SimCLR, MoCo, BYOL, and SimSiam. We implement linear probing the encoder to evaluate contrastive unleamnailltyy.
We adopt AP, SEP-FA-VR, CP, TUE, and TP as baseline methods for the worst-case unlearnability. Since the generation of untargeted adversarial poisoning is unstable 13] AP and AAP attacks are targeted not otherwise stated (see more discussion in Appendix D.5). In particular, only CIFAR- 10 results in Table 3 report untargeted AP and AAP. For CP and TUE attacks, report the best results across the CL algorithms they depend on (see additional results in Appendix D.6). Detailed settings for attack implementation and evaluation shown in Appendix
Table Attack Performance (%) CIFAR-10 10 and CIFAR-100. The lower the value, the better the
unlcarnability.
CIFAR-10 BYOL
CIFAR-100 BYOL
Attacks
SimCLR
SimNiam
Worst
SimCLR
SimSiam
None
95.5
91.3
91.5
92.3
90.7
95.5
77.4
63,9
67.9
63.7
77.4
AP
9.6
41.5
31.5
44,0
42.8
44.0
3.2
25.6
26.6
26.1
28.8
28.8
2.3
37.3
35.8
42.8
36.7
42.8
2.4
25.2
25.9
26.6
28.4
28.4
CP
11.0
39.3
32.7
41.8
37.9
41.8
74.4
15.2
13.4
16.4
14.1
74.4
TUE
10.1
57.2
$1.6
60.1
58.5
60.1
1.0
19.9
19.6
22.3
18.6
22.3
TP
14.8
31.4
61.8
30.7
61.8
7.5
21.9
27.0
4.1
27.0
AAP
29.7
32.3
23.2
35.5
34.1
35.5
7.3
20.1
18.6
21.1
21.3
21.3
AUE
18.9
52.4
57.0
58.2
34.5
58.6
6.9
13.6
19.0
19.2
19,2
5.2
Attack Performance
Worst-case unlearnability. In Table 3 our AAP attack achieves the best worst-case unlearnability on CIFAR-10 and both AAP and AUE attacks outperform other methods on CIFAR- Particularly, AAP improves the performance by 8.5%/7.5% on CIFAR- 10/100 and AUE becomes better than AAP on CIFAR-100 100. In other methods, CP loses supervised unlearnability better than TP on both datasets. Furthermore, we evaluate attacks on higher-resolution datasets including Imay- (64x64) and Mini-ImageNNe (84x84) in Table On both datasets, AUE outperforms other methods in terms of the worst-case unlearnability. Besides, AUE also achieves the best supervised unlcarnability. For AAP, its worst-case unlearnability is better than AP but not as
CIFAR-100 and TUE

---

good as TUE. Moreover, compared to AP, AAP suffers a trade-off between supervised unlearnability and contrastive unlearnability.
Comparison between AUE and AAP. On simpler datasets (low resolution, few classes), AAP has advantage over AUE. However, more complex datasets (high resolution, many classes), AUE outperforms AAP. One possible reason for this could be that optimizing AAP is more challenging. Firstly, generating adversarial poisoning inherently depends well-performing reference classifier. For instance, Fowl et al. 13 uses a pre-trained ImageNet model, whereas in this paper we train classifiers from scratch. Additionally, stronger data augmentation used in the reference model training can affect its accuracy, which in turn impacts the quality of the generated adversarial perturbations. Enhancing the performance of AAP an interesting direction for future work.
Algorithm transferability. CL-bbased methods face the issue of transferability from the generation CL. algorithm and the evaluation CL algorithm. For example, TP is generated using the SimCLR, which performs well against SimCLR evaluation, but its performance sharply declines when tested with BYOL. The same phenomenon also occurs with TUE and CP and their worst-case unlearnability is highly dependent on the appropriate generation algorithm, which you can check in Appendix D.6 In contrast, our SL-based attacks get rid of this issue because their poisoning generation involves no CL algorithms.
Table 4: Attack Performance (%) on Mini- and Tmny-ImageNet. The lower the value, the better the unlearnability.
MINN-EMAGENET BYOL
TINY-IMAGENET MoCo
Attacks
SL.
SimCLR
MoCo
SimSiam
Worst
SL
SimCLR
BYOL
SimSiam
Worst
None
66.2
55.3
57.6
48.7
$4.5
66.2
53.5
39.6
43.3
33.9
42.4
53.5
AP
11.3
48.9
50.1
44.0
48.5
50.1
11.3
32.8
34.7
27.2
34,3
34.7
TUE
20.7
20.6
20.8
21.2
21.2
8.5
13.3
13.4
15.9
AUE
8.7
15.0
20.4
14.5
18.2
20.4
7.1
10.8
11.7
9.6
11.6
11.7
AAP
24.0
43.8
41.9
40.2
41.8
43.8
28.4
27.6
25.2
28.2
28.4
Efficiency Poisoning Generation
In real-world scenarios, availability attacks need to generate pertur- bations for accumulating data as quickly as possible. For expanding datasets. like continually updated social media user data, the poison- ing used for data protection also needs to be updated periodically. Since contrastive learning involves larger batches (e.g., 512) and a longer training process (e.g., 1000 epochs), these contrastive error minimization-bant attacks require more time and memory sumption to generate perturbations.
36-
Hours
24
In Figure 6 we report the time cost of poisoning CIFAR-10/100 using the same device. Baseline methods adopt their default con- Figure 6: Time consumption figurations. Our supervised learning-basedn approaches are 3x, 6x, of poisoning generation.
TP TUE AUE AAP
and 17x faster than TUE. CP, and TP. Additionally, our methods admit smaller batches and simpler cross-entropy loss which require less memory, allowing for the generation of availability attacks larger datasets with fewer devices. Refer to Appendix D.J for more results about the efficiency of methods. Overall, method is more promising than CL-based methods due to the time and memory efficiency real-world applications.
Table 5: Attack performance (%) against SimCLR Table 6: Architecture transferability CIFAR- 10. Evaluation includes SL and SimCLR.
k-NN, SupCL and FixMatch.
CIFAR-10
CIFAR-100
Alg.
ResNet-50
VGG
MobileNe
Attacks
b-NN
SupCL
FixMatch
i-NN
SupCL
FixMatch
Clean
88.9
94.6
95.7
55.2
72.5
77.0
AAP
10.7
10.4
12.1
33.0
AAP
42.6
24.7
18.7
21.7
17.9
25.5
CL
AAP
AUE
41.
53.4
41.
48.2
35.3
50.5
29.8
41.4
45
40.2
5.4
More Evaluation Algorithms
Besides linear probing, we also apply the k-nearest neighbors (k-NN) algorithm to the feature space to evaluate the contrastive unlearnability. In Table 5 both AUE and AAP prominently reduce the

---

k-NN accuracy. It indicates that the features of poisoned training inputs largely differ from those of clean test imputs. Non-robust features in imperceptible perturbations heavily affect the encoder's behavior and hinder its generalization ability.
CL.-like algorithms including supervised contrastive learning. i.c., SupCL [24] and semi-supervised learning algorithm FixMatch [45]. FixMatch uses WideResNet [59] and detailed settings Appendix C.5 Table 5 demonstrates that our attacks are still effective against SupCL and FixMatch. It indicates that our methods can handle more variants derived from supervised learning and contrastive learning algorithms.
In addition supervised learning and contrastive learning algorithms, consider
5.5 Transferability across Networks
Since the data protector unaware of networks used future training, availability attacks should be effective for different architectures. We generate AUE and AAP using ResNet-18 and test them on ResNet-50, VGG-19 44,, DenseNet-122 121 [2I], MobileNet v2 (20) 40), and ViT [0]. Table both
supervised and contrastive unlearnability of AUE and AAP can transfer across these architectures.
5.6 Ablation Study of Decoupling Augmentations
In settings of AUE and AAP, we control the strength of ResizedCrop, ColorJitter, and Grayscale through single strength hyperparameter for the poison generation, as shown in Code [ In Table 7 we decouple the strength hyperparameters for these three random transforms and evaluate the resulting attacks against SimCLR. Different factors show different influences the contrastive unlearnability for AUE and AAP. For example, enhancing ResizedCrop strength alone is less effective than enhancing Grayscale alone in AUE generation. However, adjusting three factors together generally outperforms other options in conclusion.
Table 7: SimCLR accuracy () of attacks generated with decoupled strength parameters on CIFAR-1O. For example, 0-0-s means that ResizedCrop strength is O, ColorJitter strength is 0, and Grayscale strength is s.
Attacks
0-0-0
0-0-s
0-s-0
8-0-0
0-s-8
s-0-8
8-3-0
AUB
83.5
58.7
79.4
88.7
60.8
56.2
87.7
52.4
AAP
52.3
52.0
52.9
44.9
51.4
42.2
44.8
39.1
Related Works
When generating availability attacks, the gradient of perturbations is often computed through data augmentations. In literature, SL-based attacks generally use mild supervised data augmentation, i.c., RandomCrop and RandomHorizootalFFin [3] The expectation over transformation (EOT) technique [ adopted by Fu et al. [14] first samples several such mild augmentations and then computes the average gradient over them. Note that our proposed method is not variant of EOT. CL-based attacks use contrastive augmentations [6 36 29]. To our knowledge, we are the first to use contrastive like strong data augmentations in SL-based poisoning frameworks. Besides, provide additional related works on availability attacks in Appendix A
7 Conclusion
Since contrastive learning algorithms bring new challenges to protect data using availability attacks, we explore effective attacks against both supervised and contrastive learning. We introduce very effective modification of data augmentation in supervised poisoning frameworks and propose attacks achieving superior performance and efficiency compared to existing methods, offering more potential in real-world applications. Considering availability attacks still face obstacles such as adversarial training mitigation and poisoning ratio sensitivity, addressing these challenges while maintaining both supervised and contrastive unlearnability will be important direction for our future research.

---

Acknowledgments
This work is also supported by NKRDP grant No.2018YFA0704705, grant GJ0090202, NSFC grant No.12288201. The authors thank anonymous referees for their valuable comments.
References
[1] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adver- sarial examples. In International conference machine learning, pages 284-293, PMLR, 2018.
[2] Battista Biggio and Fabio Roli. Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84:317-331, 2018.
[3] Chaochao Chen, Jiaming Zhang, Yuyuan Li, and Zhongxuan Han. One for all: A universal generator for concept unlearnability via multi-modal alignment. In Forty-first International Conference on Machine Learning, 2024.
[4] Sizhe Chen, Geng Yuan, Xinwen Cheng, Yifan Gong, Minghai Qin, Yanzhi Wang, and Xiaolin Huang. Self-ensemble protection: Training checkpoints are good data protectors. In The Eleventh International Conference on Learning Representations, 2023.
[5] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. simple framework for contrastive learning of visual representations. In International conference machine learning, pages 1597-1607. PMLR, 2020.
[6] Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 15750-15758, 2021.
[7] Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He. Improved baselines with momentum contrastive learning, arXiv preprint 2rXiv:2003.04297 2020.
[8] Terrance DeVries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. arXiv preprint arXiv: 04552, 2017.
[9] Hadi M Dolatabadi, Sarah Erfani, and Christopher Leckie. The devil's advocate: Shattering the illusion of unexploitable data using diffusion models. arXiv preprint SiV::2333008000 2023.
[10] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. image is worth 16x16 words: Transformers for image recognition scale. arXiv preprins
20Xv:2010.11929, 2020.
[11] Ji Feng, Qi-Zhi Cai, and Zhi-Hua Zhou. Learning to confuse: generating training time ad- versarial data with auto-encoder. Advances in Neural Information Processing Systems, 32. 2019.
[12] Liam Fowl, Ping-ych Chiang, Micah Goldblum, Jonas Geiping, Arpit Bansal, Wojtek Czaja, and Tom Goldstein. Preventing unauthorized use of proprietary data: Poisoning for secure dataset release. arXiv preprint arXiv:2103.00 0266833 2021.
[13] Liam Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojeiech Czaja, and Tom Goldstein. Adversarial examples make strong poisons. Advances in Neural Information Processing Systems, 34:30339-3000 30351,03111111 2021.
[14] Shaopeng Fu, Fengxiang He, Yang Liu, Li Shen, and Dacheng Tao. Robust unlearnable examples: Protecting data against adversarial learning. In International Conference Learning Representations, 2022.
[15] Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, al. Bootstrap your own latent-a new approach to self-supervised learning. Advances in neural information processing systems, 33:21271-21284, 2020.
10

---

[16] Hao He, Kaiwen Zha, and Dina Katabi. Indiscriminate poisoning attacks on unsupervised contrastive learning. In The Eleventh International Conference on Learning Representations. 2022.
[17] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition, In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[18] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVE conference on computer vision and pattern recognition, pages 9729-9738, 2020.
[19] K. Hill. The secretive company that might end privacy as we know it, 2020. URL https cww.vvVDC
[20] Andrew G Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang. Tobias Weyand, Marco Andrectto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv: 04861, 2017.
[21] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4700 2017.
[22] Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearn- able examples: Making personal data unexploitable. In International Conference on Learning Representations, 2020.
[23] Wan Jiang, Yunfeng Diao, He Wang, Jianxin Sun, Meng Wang, and Richang Hong. Unlearnable examples give a false sense of security: Piercing through unexploitable data with learnable examples. arXiv preprint 2xXiv22305.0924: 2023.
[24] Prannay Khosla, Piotr Teterwak, Chen Wang, Aaron Sama,, Yonglong Tian, Phillip Isola, Aaron Maschinot, Ce Liu, and Dilip Krishnan. Supervised contrastive learning. Advances in neural information processing systems, 33: 8661-18673, 2020.
[25] Minseon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-supervised contrastive learning. Advances in Neural Information Processing Systems, 33:2983 2294,, 2020.
[26] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical Report TR-2009, 2009.
[27] Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 7(7):3, 2015.
[28] Shuang Liu, Yihan Wang, and Xiao-Shan Gao. Game-theoretic unlearnable example gen- erator. In Proceedings of the AAAI conference on artificial intelligence; arXiv preprini arXiv:2401. 17523,, 2024.
[29] Yiyong Liu, Michael Backes, and Xiao Zhang. Transferable availability poisoning attacks. arXiv preprint arXiv:2310.05141, 2023.
[30] Zhuoran Liu, Zhengyu Zhao, and Martha Larson. Image shortcut squeezing: Countering perturbative availability poisons with compression. International conference on machine learning, 2023.
[31] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018
[32] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anand- kumar. Diffusion models for adversarial purification. In International Conference on Machine Learning, pages 16805-16827. PMLR, 2022.
[33] Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding, arXiv preprint 180700807. 2018

---

[34] Tianrui Qin, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu. Apbench: A unified benchmark for availability poisoning attacks and defenses. arXiv preprint 2rXi1:2308.03258. 2023.
[35] Tianrui Qin, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu. Learning the unlearnable: Adversarial augmentations suppress unlearnable example attacks. arXiv preprint arXiv:2303.1512 2023.
[36] Jie Ren, Han Xu, Yuxuan Wan, Xingjun Ma, Lichao Sun, and Jiliang Tang. Transferable unlearnable examples. In The Eleventh International Conference Learning Representations, 2022.
[37] Edgar Riba, Dmytro Mishkin, Daniel Ponsa, Ethan Rublee, and Gary Bradski. Kornia: an open souree differentiable computer vision library for pytorch. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 3674-3683, 2020.
[38] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International internationaaourruae journal of computer vision, 1 115:21 1-252, 2015.
[39] Vinu Sankar Sadasivan, Mahdi Soltanolkotabi. and Soheil Feizi. Cuda: Convolution-basee unlearnable datasets. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3862 3871, 2023.
[40] Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4510-4520, 2018
[41] Pedro Sandoval-Segura, Vasu Singla, Jonas Geiping, Micah Goldblum, Tom Goldstein, and David Jacobs. Autoregressive perturbations for data poisoning. Advances in Neural Information Processing Systems, 35:27374- 2022.
[42] Pedro Sandoval-Segura, Vasu Singla, Jonas Geiping, Micah Goldblum, and Tom Goldstein. What can we learn from unlearnable datasets? arXiv preprint arXiv:2305. 2023.
[43] Yucheng Shi, Mengnan Du, Xuansheng Wu, Zihan Guan, Jin Sun, and Ninghao Liu. Black- box backdoor defense via zero-shot image purification. In Thirty-seventh Conference on Neural Information Processing Systems, 2023. URL M6U2xSbiE1
[44] K Simonyan and A Zisserman. Very deep convolutional networks for large-scale image recognition. In 3rd International Conference on Learning Representations, 2015.
[45] Kihyuk Sohn, David Berthelot, Nicholas Carlini, Zizhao Zhang. Han Zhang, Colin A Raf- fel, Ekin Dogus Cubuk, Alexey Kurakin, and Chun-Liang Li. Fixmatch: Simplifying semi- supervised learning with consistency and confidence. Advances in neural information processing systems, 33:596 608,,0088800 2020.
[46] Lue Tao, Lei Feng, Jinfeng Yi, Sheng-Jun Huang, and Songcan Chen. Better safe than sorry: Preventing delusive adversaries with adversarial training. Advances in Neural Information Processing Systems, 34:16209-16225, 2021.
[47] Lue Tao, Lei Feng, Hongxin Wei. Jinfeng Yi, Sheng-Jun Huang, and Songean Chen. Can adversarial training be manipulated by non-robust features? Advances in Neural Information Processing Systems, 35:26504-26511 2022.
[48] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9(1 1),, 2008
[49] Oriol Vinyals, Charles Blundell, Timothy Lillicrap. Daan Wierstra, et al. Matching networks for one shot learning. Advances in neural information processing systems, 29, 2016.
[50] Tongzhou Wang and Phillip Isola. Understanding contrastive representation learning through alignment and uniformity on the hypersphere. In International Conference on Machine Learning, pages 2020.
12

---

[51] Rui Wen, Zhengyu Zhao, Zhuoran Liu, Michael Backes, Tianhao Wang, and Yang Zhang. Is adversarial training really silver bullet for mitigating data poisoning? In International Conference Learning Representations, 2023.
[52] Shutong Wu, Sizhe Chen, Cihang Xie, and Xiaolin Huang. One-pixel shorteut: On the learning preference deep neural networks. The Eleventh International Conference on Learning Representations, 2022.
[53] Zhirong Wu, Yuanjun Xiong, Stella X Yu, and Dahua Lin. Unsupervised feature learning via non non-parametric instance discrimination. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 3733-3742, 2018.
[54] Dong Yi, Zhen Lei, Shengeai Liao, and Stan Z Li. Learning face representation from scratch. arXiv preprint
1.7923, 2014.
[55] Jongmin Yoon, Sung Ju Hwang, and Juho Lee. Adversarial purification with score-hased generative models. In International Conference on Machine Learning, pages 12062-12072. PMLR, 2021.
[56] Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie- Yan Liu. Availability attacks create shortcuts. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 2367-2376, 2022.
[57] Yi Yu, Yufei Wang, Song Xia, Wenhan Yang, Shijian Lu, Yap peng Tan, and Alex Kot. Purify unlearnable examples via rate-constrained variational autoencoders. In Forty-first International Conference on Machine Learning, 2024.
[58] Chia Hung Yuan and Shan-Hung Wu. Neural tangent generalization attacks. In International Conference Machine Leurning, pages 12230-12240. PMLR, 2021.
[59] Sergey Zagoruyko and Nikos Komodakis. arXiv:1605.07146 2016.
Wide residual networks. arXiv preprint
[60] Jiaming Zhang. Xingjun Ma, Qi Yi, Jitao Sang, Yu-Gang Jiang, Yaowei Wang. and Changsheng
Xu. Unlearnable clusters: Towards label-agnostic unlearnable examples. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1984-3993, 2023.
[61] Yifan Zhu, Lijia Yu, and Xiao-Shan Gao. Detection and defense of unlcarnable examples. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 17211-17211 2024.
13

---

A Additional Related Works
Availability attacks for supervised learning include minimmiiiiizing noises [22], adversarial example poisoning 13 neural tangent generalization attack [58], generative poisoning attack [[] au-
one-pixel perturbation [52, convolution- attack [39,, synthetic perturbation [56], and theertte unlearnable examples (28). Yu et al. [56] illustrated linearly separable perturbations work as shortcuts for supervised learning. Robust arror-miniizzing noises [14, entangled features strategy [51]. and hypocritical perturbation [47] were designed to deceive adversarial training. Contrastive poisoning [T6] aimed at poisoning contrastive learning. Transferable unlearnable examples [36] and transferable poisoning (29 improved the supervised unlearnability of contrastive poisoning. Zhang et al. [60] proposed to generate label-agnostic noises with cluster-wing wise perturbations. Chen et al. [3] introduced CLIP-guidee unlearnable perturbation generators that can transfer across different datasets.
toregression perturbation
On the defense side, adversarial training can largely mitigate the unlearnability [46] Liu et al. 30). Qin et al. [35], Zhu al. [6]] leverages crafted data augmentations defense. Sandoval-Segura et al. 42 suggests that the orthogonal projection technique is effective against class-wise attacks.
Diffusion models have been proposed to purify unlearnable perturbations [23 9]. al. [57
proposed VAE-based purification method that requires no additional clean data. Qin et al.
introduced a benchmark for availability attacks.
B Contrastive Learning
Here introduce Info-NCE-based contrastive learning. As shown in Code strong augmentation is a key component in contrastive learning. Different augmented views of an image focus on various details. If æ. pos are augmented views of the same image, we say (ax (pos) ) is positive pair. Conversely, a negative pair (x, &neg) contains two augmented views of two different images. Given an encoder g, denote g(x) for simplicity and the InfoNCE loss is defined as:
1 Σ
8(2,,
LINTONCE
N,
where = is a set of features of positive pairs and {(z,, 2110 is a set of features of negative pairs for each æ;; the function s(z, = exp( z'z' ||=
with a temperature parameter T. This object function aims to maximize the cosine similarity of positive pairs while minimizing the cosine similarity of negative pairs.
C Experiment Details
C.1 Datasets and Networks
CIFAR. CIFAR- 1AE--O///FARRRII 100 (26 consists 50000 training images and 10000 test images in 10/100 classes. All images 32 32 colored ones.
Timy-ImageNee.. Tiny- ImageNet classification challenge is similar the classification challenge in the full ImageNet ILSVRC [38]. It contains 200 classes. The training has 500 images for each class and the test set has 100 images for each class. All images are x 64 colored ones.
Mini-ImageNNe.. Mini-ImageNNet dataset was originally designed for few-shot learning [49 We modify it for a classification task. The modified dataset contains 100 classes. The training set has 500 images for each class. The test set has 100 images for each class. All images are 84 84 colored ones.
ImageNeet100. ImageNet- 100 is a subset of ImageNet- 1k Dataset from ImageNet Large Scale Visual Recognition Challenge 2012 B8). It contains 100 random classes. The training set has 130,000 images. The test set has 5,000 images. Images are processed to 224x224 colored ones as input data models.
ResNet. On CIFAR-1O/CIFAR- 100, we set the kernel size of the first convolutional layer to 3 and removed the following max-pooling layer. On other datasets, do not modify the models.
14

---

C.2 Data Augmentation
In Code [ we show the different implementations of data augmentation between supervised learning and contrastive learning. For supervised learning, we consider the typical augmentations including Crop and HorizontalFlip. For contrastive learning, we consider the typical augmentations including ResizedCrop, HorizontalFlip. ColorJitter, and Grayscale, and its default strength 8 1. In the generation process of our AUE and AAP attacks, we replace the supervised augmentations with contrastive-lit like augmentations of strength parameter
Code Listing I: Different data augmentations used in supervised learning and contrastive learning on datasets. The intensity of contrastive augmentations can be adjusted via strength
Supervised augmentations
Compose ( ([RandomCrop ( (size=32, padding=4) Randomforiiznntalllipp..
ToTensor ()])
Contrastive augmentations
s = 1.0 # Strength is 1.0 by default for contrastive learning. scale=(1-0.9*s, 1.0)),
Compose (RandonkesszzedCopppeeee
Raudolloorizoontallliippp......1
BaudoaAplyy((Coolorittttttrorr (wwggggeeeeeo. saturation-0..*s, hue 0.es). p-0.8+s),
contrast-0.4*
RandomGrayscale ( ToTensor ()))
C.3 Details of AUE and AAP
We leverage differentiable augmentation modules in Konie which is differentiable computer vision library for PyTorch. The contrastive augmentations for many/Mnni-lmmghhe and ImageNet- 100 are similar those for LIFAR-10/106 Code but only adapt the image size.
AUE. We train the reference model for = 60 epochs with SGD optimizer and cosine annealing learning rate scheduler. The batch size of training data is 128. The initial learning rate 0g is 0.1, weight decay is 10 and momentum is 0.9. In each epoch, we update the model for To = 391 iterations and update poisons for T, 391 iterations. For maaeNNet1100
set Tp = T, 1016. The PGD process for noise generation takes T, 5 steps with step size as = 0.8/255. The augmentation strength 0.6 for CIFAR-10 and 1.0 for CIFAR-100 100, Tiny-ImageNer, Mini- ImageNet, and ImageNet-100. Additional experiments of the selection of strength parameters are shown in Appendix D.4
We train the reference model for T = 40 epochs, and the initial learning rate ag is 0.5. The PGD process for noise generation takes Tр 250 steps with step size as 0.08 2.08/255. Other settings are the same as AUE. The label translation is K = 1. The augmentation strength 0.4 for CIFAR-10 and s = 0.8 for CIFAR-10M 100, Tiny-Ima Mini-ImageNet,
AAP.
ImageNet-100.
Besides targeted AP and AAP attacks described in Equation (3) and Algorithm 2 untargeted attacks refer to maximizing the loss between the image and its true label, rather than minimizing the loss between the image and shifted label. We only report untargeted attack results in Table for CIFAR-10 and discuss them more in Appendix D.5
Sample-wise Attack. When a poisoning map 8(ar, y) only depends label y, the resulting attack is called class-wise attack; otherwise, it sample-wise attack. this paper, we generate sample-wise attacks.
C.4 Baseline attacks.
CP attack implements contrastive enror minimization on a specific contrastive learning algorithm. There three specified attacks including CP-SimCLL CP-MoCo, and CP-BYOL. Similarly, TUE has three specified attacks including TUE-SimCLR, TUE-MoCo, and TUE-SimSiann We report the best results of CP attacks and TUE attacks according the worst-case unlcarnability. Besides, provide detailed results in Appendix D.6 for more discussion.
"hatss//gitubb.oo/oommooooo
15

---

C.5 Evaluation Algorithms
Contrastive learning. The setup for SimCLR, MoCo, BYOL, and SimSiam are shown in Table The 100-epoch linear probing stage uses an SGD optimizer and a scheduler that decays 0.2 at 60, 75, and 90 epochs. The probing learning rate is 1.0 for SimCLR, MoCo, BYOL, and 5.0 for SimSiam on CIFAR- 10/100, Tiny/Miii-Imagehh optimizes 200 epochs and the linear probing uses a learning rate of 10.0. Other settings are the same as other datasets. After generating our attacks on CIFAR-10/100 we report average test accuracy after 3 evaluations with random seeds.
On ImageNet- 100,, the unsupervised contrastive learning
Supervised learning. We augment the training data by RandomHorizomtlFFiig and RandomCrop with padding size 1/8 on CIFAR- and Tiny/Mini-ImageNee is the image size. On ImageNet-100, we augment using RandompesizedCropp and RandomHoriizotallPlip.
SupCL and FixMatch. We use ResNet-18 18 for SupCL evaluation CIFAR-10 10 and CIFAR-100 For FixMatch evaluation, we use WideResNet-28. and 4000 labeled data on CIFAR-I0; we use Weet and 10000 labeled data CIFAR-100.
Table 8: Details of supervised and contrastive evaluations.
SL
SimCLR
MoCo
BYOL
SimSiam
Batch size Epochs
512
512
512
512
512
200
1000
1000
1000
1000
Loss function
CE
InfoNCE
InfoNCE
MSE
Similarity
Optimizer
SGD
SGD
SGD
SGD
SGD
Learning rate
0.5
0.5
0.3
1.0
0.1
Weight decay
le-4
le-4
le-4
le-4
le-4
Momentum
0.9
0.9
0.9
0.9
0.9
Scheduler
Cosine
Cosine
Cosine
Cosine
Cosine
Warmup
10
10
10
10
10
Temperature
0.5
0.2
Encoder momentum
0.99
0.999
D
Additional Experiments
D.1
Computation Consumption
We report the time consumption of generating AUE and AAP attacks. For CIFAR-10/100, Tiny/Mini- ImageNet, experiments are conducted using single NVIDIA GeForce RTX 3090 GPU. For ImageNNet100, experiments are conducted using single NVIDIA A800 GPU. On CIFAR-10/100 AUÉ/AAP costs around 2.7/2.2 hours. On Mini-ImageNet, AUE/AAP costs around 2.5/2 hours. Tiny-ImageNet, AUE/AAP costs around 2.5/3.8 hours. On ImageNet-100, AUE/AAP costs around 12/10 hours. In comparison, on LIFAR-10/100 and using the same device, CP-SimCLR costs around 48 hours, TUE-MoCo costs around 8.5 hours, and TP costs around 16 hours generate poisons. Our supervised poisoning attacks are much more efficient than contrastive poisoning attacks.
D.2 Training Process on Poisoned Data
In Figure 7 we evaluate the training and test accuracy during SL and SimCLR training on poisoned data. In very early epochs where the training underfits the poisoned data, checkpoints from both SL and SimCLR possibly process weak usability. After a few epochs, the test accuracy rapidly goes down to an unusable level. For SimCLR, the accuracy slowly increases in the middle and later stages of training. It aligns with the overall trend of gradually decreasing uniformity gap and relatively stable alignment gap shown in Figure 5b for AUE.
Epech
Figure 7: Training process on poisoned CIFAR-10 Left: Supervised learning. Right: SimCLR.
16

---

D.3 Visualization
We scale imperceptible perturbations from [-8/253, 8/255] to [0.1] and show their images in Figure 8 Enhanced data augmentations endow AUE with more complicated patterns than UE. In terms of frequency, they are more high-frequency than UE. Since contrastive augmentations include grayscale that squeezes low-frequeccy shortcuts [30), attacks against CL first need to come through them and patterns. Moreover, we check the class-wisc separability of perturbations using t-SNE visualization [48] in Figure [ Perturbations from AUE and T-AAP are less separable than those from UE and T-AP and coincide with the characteristics of perturbations from contrastive error minimization [66]
thus prefer high-frequene
UC
AR
NTGA
SN
OPS
REM
Emif
HYPO
RC
16
AG
VIAA
2N
OPS
T-AP
UT-AP SAPPSEP-FNNN
FA-A CP
TUE
TP
AUE
T-MP
UT-MAP
(a)
(h)
Figure 8: (a) Perturbation images of availability attacks on CIFAR-10. (b) T-SNE visualization of perturbations. In each figure, the top row includes attacks that are not effective against contrastive learning, and the bottom row includes attacks that have contrastive unlearnaillity.
D.4 Strength Selection
We gradually increase the data augmen- tation strength s in the supervised error min- imization according to Algorithm [ In Fig- ure Pa] the SimCLR accuracy prominently de- creases the strength grows, while the super- vised learning accuracy slightly increases. Com- pared to UE, our AUE attacks largely improve contrastive unlearnability while keeping simi- lar supervised unlearnability. On CIFAR-I0, 10, too strong strengths might compromise the un- learnability. Thus, we generate our augmented unlearnable example (AUH) attacks taking s = 0.6 for CIFAR- 10, and s 1.0 for CIFAR-100.
AUE.
(a)
(b)
Figure 9: (a) Influence of augmentations in AUE.
(b) Influence of augmentations in AAP.
AAP. We gradually increase the data augmentation strength in the supervised error maximization according Algorithm 2 In Figure 9h] the SimCLR accuracy decreases with the strength, while the supervised learning accuracy slightly increases. Proper augmentation strengths improve the contrastive unlearnability but too large s might introduce difficulty in poison generation and harm the supervised un- learnability. We select 0.4 for CIFAR-10 and 0.8 for CIFAR-100.
Table 9: Alignment and uniformity gaps of AUE with different strengths.
Strength
AG
Ug
Accuracy
0.0
0.14
0.07
83.5
s 0.2
0.21
0.24
64.1
= 0.4
0.25
0.28
56.7
0.6
0.27
0.34
52.4
Strength and Gaps On CIFAR-10, we gradually increase the augmentation strength from 0 to the default setting, i.e. 0.6 in the generation of AUE attacks and evaluate the alignment gaps, uniformity gaps, and the SimCLR Accuracy in Table In this case, the larger the gaps, the lower the accuracy of SimCLR.
D.5 Targeted and Untargeted AAP
Instead of Equation
3 the untargeted attack refers to the following optimization:
max EE [Cst + 6(x, v), v: f*]]
D.
17

---

In targeted attack, the perturbations for class of data are optimized to fit another label, so they finally contain the non-robust feature of the target class. However, there is no consistent target label for class of data in an untargeted attack. Since availability attacks create shortcuts for the classification task [56]. the untargeted attack becomes more difficult than the targeted one when the number of classes increases. [3] also reports that the generation of untargeted attacks is unstable and they focus on targeted attacks on more complex datasets. Thus, we only perform untargeted AAP attacks the simple dataset CIFAR-10 and report the results in Table 3 As complement to it, present the performance of targeted attacks on CIFAR-10 Table where the untargeted attacks are better than targeted ones in the worst-case unlearnability.
Table 10: Targeted and untargeted AP and AAP attacks CIFAR-10.
Attacks
SL
SimCLR
MoCo
BYOL
SimSiam
Worst
Untargeted Targeted
9.6
41.5
31.5
44.0
42.8
44.0
AP
9.5
48.4
53.8
53.0
51.1
53.8
Untargeted Targeted
29.7
32.3
23,2
35.5
34.1
35.5
AAP
9.2
39.1
40.4
43.3
42.1
43.3
D.6 Additional results for CL-based attacks
CP and TUE attacks are based on contrastive error minimization. The poisoning generation depends specific contrastive learning algorithm. For example, CP-SimCLR is generated by minimizing the contrastive error of SimCLR. To check the effect of generation algorithm selection on the worst- case unlearnability, we present detailed attack performance of specified CP and TUE attacks on CIFAR-10/100 in Table For CP attacks, only CP-BYOL effective against supervised learning CIFAR-10 10 and no variants work for SL 100. For TUE attacks, the TUE-MoCo is significantly better than other variants on both CIFAR- 10 and CIFAR-100.
Table 1I: Detailed attack performance of CP and TUE attacks by specifying the underlying algorithm for poisoning generation.
CIFAR-I0 BYOL
CIFAR-100 BYOL
SI.
SimCLR
MaCo
SimSiam
Worst
SI.
SimCLR
MoCo
SimSiam
Worst
SimCLRR
38.7
10.5
74.7
CP-MoCo
94.5
53.7
47.9
56.8
47.1
94.5
74.4
15.2
13.4
16.4
14.1
74.4
CP-BYOL
39.3
32.7
41.8
37.9
74.7
29.7
35.5
35.7
29.5
74.7
TUE-SimCLR
10.6
48.1
71.2
79.5
39.0
79.5
1.0
16.9
36.7
40.6
7.8
40.6
19.9
22.3
TUE SimSSam
9.9
82,5
80.7
84.3
81.8
84.3
1.1
33.9
31.0
40.9
10.3
40.9
D.7 Poisoning Budget
In the main body, we consider the poisoning attacks constrained in L -nrm ball with radius 8/ 8/255. The constraint is to ensure perturbations are imperceptible to human eyes. We investigate influence of different poisoning budgets. AUE and AAP attacks are generated with poisoning budgets of 2/255, 4/ 4/255, 6/ /55 and are evaluated by SL and SimCLR. In Table 12 the larger the poisoning budgets, the better the attack performance.
Table 12:
Performance(%) of attacks generated with different poisoning budgets on CIFAR-10.
Table 13: Performance(%) of attacks with differ- ent poisoning ratios on CIFAR-10.
Budget
AUE
AAP
Ratio
AUE
AAP
2/255
34.5
50.7
95%
75.6
82.1
SL
4/255
28.5
19.7
SL
90%
82.2
86.6
6/255
26.8
12.3
80%
87.6
89.8
2/255
84.8
87.0
95%
69.7
76.8
SimCLR
4/255
70.1
66.6
SimCLR
90%
74.5
82.1
6/255
59.4
51.1
80%
79.7
85.5
18

---

D.8 Poisoning Ratio
Availability attacks are sensitive to the proportion of poisoned data in the dataset and usually need to poison the whole dataset 13]. In the main body, we report results when the poisoning ratio is 100%. Here, we investigate the influence of the poisoning ratio on the attack performance of AUE and AAP. Table 13 illustrate that our augmented methods inherit the vulnerability to poisoning ratio from basic approaches, i.e. UE and AP, though AUE more robust than AAP. This characteristic also necessitates the prompt processing of newly acquired clean data, imposing higher efficiency demands on the generation of attacks.
D.9 Defense
On the defense side against availability attacks, AT 31 and AdvCI. (25) applied adversarial training in supervised learning and contrastive learning respectively: ISS [30 and UEraser [5 leveraged designed data augmentations to eliminate supervised unlearnability; AVATAR [9] employed a diffusion model to purify poisoned data. In Table I4] we evaluate our attacks through these defense methods as well SimCLR with Cutout (8), Random noise, and Gaussian Blur. The defensive budget for AT and AdvCL is 8/255; the length parameter for Couout 8; the kernel size for Gaussian Blur is 3; the variance for Random noise is 8/255.
The defense performance of method differs when facing different attacks. For example, UEraser can recover the accuracy of TUE-SimCLR from 10.6% to above 92.7%. while its effect on our AUE attack is much weaker. At the cost of a significant amount of extra training time, adversarial training, i.e. AT and AdvCI., can increase accuracy to around 80%. ISS mitigates the supervised unlearnability of evaluated attacks back to levels close 85%, but its Grayscale component may even have negative effects. Gaussian Blur is more effective than Cutout and Random noise for contrastive learning.
Recently, diffiusion models have provided powerful tool to purify image perturbations (55
32
Here we evaluate AVATAR which employs a diffusion model trained on the CIFAR-I0 10 training dataset. From the table, AVATAR generally achieves the best defense against our proposed attacks, but the final accuracy still exhibits gap compared to training with clean data. We believe it's an interesting and worthy future direction to improve attacks' resilience to potential defenses while maintaining algorithm transferability
Table 14: Performance ()) under defenses on CIFAR-10. Here TUE is based on SimCLR.
Figure 10: Clean and poisoned linear probing CIFAR-10.
Delense
AUE
AAP
AP
TUE
No Defense
18.9
9.2
10.6
Clean Linner Probing Palnorted Lineer Proding
UEraser
63.2
64.7
68.0
92.7
-Lite
60.6
66.8
70.7
92.2
72.8
79.5
80.2
SL
ISS
82.6
82.3
81.7
82.7
-Gmyscale
18.2
11.4
28.0
-JPEG
84.9
84.3
84.6
82.1
AVATAR
85.0
88.0
87.7
83,2
83.8
81.6
81.0
81.7
No Delense
52.4
39.1
48.4
48.1
Curout
51.8
37.9
49.2
49.6
SimCLR
Random Notse
60.5
62.4
66.4
70.0
Gaussian
76.7
AVATAR
83.1
80.8
81.1
83.0
AdvCI.
80.9
78.4
77.5
80.1
Avcilabiitty Attacks
D.10
Discussion of Clean Linear Probing
While our threat model linear probes on poisoned data, He al. [16] use clean data for linear probing instead. In Figure 10 we compare the final classification performance of SimCLR models in these two settings. Feature extractors are trained on poisoned data and are fixed. We focus on the classification performance after linear probing on clean or poisoned data. While CP and TUE obtain similar attack performance in both cases, clean linear probing can mitigate SL-based attacks including AP, SEP-FA-VR, AAP, and AUE. On one hand, for SL-based poisoning, the dissimilarities between clean features and poisoned features hinder a classifier head obtained by poisoned linear probing in generalizing to clean features, as discussed in Section 3.2 However, clean features still
19

---

contain useful information and can derive another classifier head to perform classification. On the other hand, contrastive error- minimizing noises confuse the feature extractor directly such that even clean data fail to activate useful features for classification. But in general, given responsible data publisher who protects data using availability attacks before release, an unauthorized data collector has no access to unprocessed data for clean linear probing. Thus, it is sufficient to achieve contrastive unlearnability with poisoned linear probing in real scenarios.
E
Toy Example
We study a model f g Rd + R" with normalized feature extractor g IRd + R" such that [[]())]] with a full rank square matrix W E Rax" By singular values decomposition (SVD), W = UEV with orthogonal matrices U, V R and Σ diag(o1.... ,r)), 01 balanced data distribution, i.c. each class would be sampled with the same probability, Dz be the
and full rank linear classifier h RR' - IR" in the sense that l(z) W
on 0. Let D be
margin distribution, and y be an augmentation distribution. Assume the supervised loss Lst. is the mean squared error, and the contrastive loss Le1 contains only one negative example:
- ||h o g(((<))) - e
L La.
n
ca(a(>))) a(((x))
Ca x T. =log(1 (a( ,(
Proposition E.1. Let Es. ED,, (Cai y: x)].
With probability at least 4 it holds
T, r, (a ,
1
log(1 +
On
n
On 2n Esl
n n-1 log(1 ofon - o,, - v 22
TE
oi 2no VEsI.
Remark E.2. 1) Assumptions of square matrix and positive singular values are necessary. Oth- erwise, the dimensional reduction of feature space impairs the relation between supervised and contrastive losses. 2) Since supervised losses contain limited information about negative pairs, this inequality is naturally loose. However, the case that supervised learning fits very well, it at least implies that positive features g(T (x)) closer ((T(x)) than negative features g(p(x=)) )).
E.1 Lemmas
Lemma E.3. For any E R",
nn xz||2|| < [2| S 01||=1]
Proof. Denote & (.1, = Vz. Since orthogonal matrices preserve the norm,
W = |UEV= = ||
Σ
of 2
|/|| 1
on
0n||211 <
Σ of = ||||
Lemma E.4. Es. S e, then with probability least Ve
| g(T((()))) eyll Vnve.
where (x. ~ D. a
20

---

Proof. As
ESt =
E (w am
- l g(((T))) -(((())))eelll) eyll"
by Markov's inequality, it has
1
- vc) S Ve.
Lemma E.S. Es. S e, then with probability at least 2VE
(((x)))((T(()))) > 2nve
where x ~ Day T,
Proof. By Lemma E.4 with probability at least 2v/,,
| g(T(()) - e,ll < Vnve and [Ihog(T(xx)) - cyll < VnVe.
By the triangle inequality,
|| [ - h ( <2
Since g is normalized, by Lemma E.3 we have
((<(a)) g(((x)) =
2 [1(( 9(T(x))
h (()(()))) h a(T(2))1?
20
2nve
On
Lemma E.6. Assume D is balanced dataset. If Est. S e, then with probability at least 1 2 one of the following two conditions holds
1. with probability n-1
g(((x)) g(((x=)) ((T(())T((7((7)) < - (1 V 2e
of
2. with probability
((<(x)) g((((=))) ((((()))(((<>>")) I 1.
Proof.
1. With probability n-1 for (x, v), (a . D. y + V-. By Lemma E.4 with
probability at least 22.e.
|| (()())))) evll < nive and [ -e--ll < nve.
By the triangle inequality.
(((()(z)) g( [|)[=)111
))1l 2 | [ - h hog(T(x=)) ))1l
σ1
1
(lle, ey- ( - eyll - -Ilh g(((x ey-
σ1
22 - 2//2///// nnve
σ1
21

---

Since is normalized,
(()())) g(T(x =1 1
--121l((ri =[(((T(x)) ((T ))
1 (1 /22
of
2. As we assume D balanced dataset, with probability +, for (x D.
y y Since g is normalized,
g(T(())) ((((((())))))))))>)))) ))= =1 >1lo(T(x)) - g(+(2x))))
2
$ 1 11 o g((((()))) h ((T(x>))]
20
S
E.2 Proof of Proposition E.1
Proof. Let Est. Combining Lemma E.5 and Lemma E.6 for sample and its negative sample x i.i.d from D... and data augmentation method æ, т, iid from J4, with probability at least
1 1- 1-4/Est, it holds that
(a(((())) ((((w))
T,, = - looog ca(a(1)) ((r(x=) ca(x(())) ((o(() s(o(x=)) ))
log(1 c0(x(x)))
[(((()))T((((>)))) g(p(c=))
1 (1- 2 /EsL)
--1 1
log(1 + 1
log(1 1 +
11
2n ESL
1 / EsL
nn
on
log(1
On
1
log(1 (1
oi on v 2/2
On
2n Est.
n
ofo, -2no7 EEs
22

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
We summarize our work in the abstract and list our contribution at the end of the introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as is clear that these goals attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: In Section 5.2 we discuss limitations of the AAP attack. In Appendix D we discuss challenges inherited from basic availability attacks such as defensive methods and poisoning ratio sensitivity.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "I "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full of assumptions and complete (and correct) proof?
23

---

Answer: [Yes]
Justification: We provide theoretic analysis for toy model to illustrate the intuition of our proposed method. The formal statement and proof are shown in Appendix
Guidelines:
The answer NA means that the paper does not include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification:
We provide details to reproduce our experiments in Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e-g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
5. Open access to data and code
24

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification: We public datasets in experiments and provide code in the supplementary material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nnis.cc
mublicc/qudees/Codeuubbss www.eeeeuuumissioooooooooooo for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ wwtp:/cccppppgguuuiiaeoeaec
Saaeee/CCoSSSubisss..S.. www.sssoiicgyyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
These setting and details are described in Appendix D
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Question: Does the report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: In Tables and we report accuracy after 3 evaluations with random seeds for fair comparison. Due to space constraints, we did not report error bars in the table, which is common in papers within this field.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
25

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We report computation consumption of our method in Appendix D.I
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https: /itt://nnesisppe cc/ppblll//thhhhcsuieeeellle
Answer: [Yes]
Justification:
We read the code of ethics and obey it.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- cration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We discuss in the paper that the availability attacks provide tool to protect private and commercial data.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
26

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), faimess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best. faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
We use public GitHub repositories and public packages. We cite them in our paper.
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
27

---

If assets are released, the license, copyright information, and terms of use in the thcode. has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
latasets.paperssi
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Our new assets are well documented.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/codeemoode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: Our paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
28

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
29


Reviews:
[{"review_id": "u6R5hiRQL8", "reviewer": "Reviewer_61jU", "summary": "This paper aims to address the issue of effectively conducting availability attacks on both supervised learning (SL) and contrastive learning (CL) algorithms. Specifically, the paper highlights that existing methods fail to simultaneously achieve \"unlearnability\" for both SL and CL, posing risks to data protection. To tackle this challenge, the paper proposes a novel approach that employs contrastive-like data augmentation within the supervised learning framework to execute effective attacks on both SL and CL.", "questions": "Nowadays, one of the most popular ways to build classifiers is to leverage CLIP as a feature encoder with or without additional head to do classification. Is the perturbation crafted from AUE and AAP transferable to this setting?", "limitations": "Yes", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The proposed methods achieve better efficiency and Pareto improvement for both the SL and CL tasks. \n\n2. the first work that demonstrates adding contrastive augmentation resilience with an SL-based surrogate can fool CL-based models.", "weaknesses": "1. The proposed AUE and AAP are all brittle under diffusion-based purification, which limits the practical usage of unlearnable examples in the real world. \n\n2. Lack of discussion and comparison with recent work [1] that leverages CLIP latent as guidance for crafting transferable and label-agnostic perturbation, which could potentially achieve efficient perturbation crafting for both SL and CL tasks. \n\n3. The results in Table 3 show that the proposed methods did not consistently outperform other methods under different SL and CL settings, which makes the stability of improvement questionable. \n\n4. This work essentially works by crafting perturbation that resilience to augmentations for both supervised learning and contrastive learning, which is a conceptually simple extension of the transformation augmentation technique in REM [2]. One of the fundamental limitations of such a direction is that unauthorized trainer might leverage stronger transformations like super-resolution or diffusion-based augmentation [3] in their training pipeline. \n\nTypos: Line 20: Change \"particular, Huang et al. [20] reduces\" to \"particular, Huang et al. [20] reduced.\"\n\nRef.\n\n[1]. One for All: A Universal Generator for Concept Unlearnability via Multi-Modal Alignment, ICML'24\n\n[2]. Robust Unlearnable Examples: Protecting Data Against Adversarial Learning, ICLR'22'\n\n[3]. DiffAug: Enhance Unsupervised Contrastive Learning with Domain-Knowledge-Free Diffusion-based Data Augmentation, ICML'24", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank the reviewers for their thorough and constructive feedback! We aim to clarify and address your concerns through our detailed replies.\n\n**[Weakness1] Comparison with “One for All (14A)”** We believe that \"14A\" and our work are more orthogonal in nature and will explain it in detail.\n\n- The biggest difference between our method and “14A” is that we are studying different types of transferability. Specifically, “14A” studies **cross-dataset transferability**, meaning that the noise generator should produce UEs effective against supervised learning on different datasets. However, our paper investigates **cross-algorithm transferability**, meaning the generated UEs should be effective not only against SL but also against CL on the same dataset. \n\n- “14A” does not claim to work for CL, nor does it present any experimental results related to CL. Meanwhile, we don't claim that our attacks transfer well across datasets since they are based on dataset-specific optimization instead of a noise generator and directly applying off-the-shell perturbations to a different dataset is much more difficult and less realistic.\n\n**[W2] Non-consistent advantage** The reviewer mentioned that our proposed attacks do not consistently outperform baseline methods against different CL algorithms.\nWe believe this phenomenon is **not a weakness** of our method; rather, it reflects the vulnerability of CL-based methods including CP, TUE, and TP, in terms of cross-algorithm transferability.\n\n- CL-based attacks show varying performance against different CL algorithms (see Table 11 in our paper). For example, since TP is generated using SimCLR, it achieves rather low accuracy against SimCLR evaluation, i.e., 6.7% for CIFAR-100, while our AUE achieves 13.6%. However, when facing a different evaluation algorithm, saying BYOL, TP’s accuracy drastically increases to 27%, which is higher than AUE’s 19.2%. \n\n- In contrast, our SL-based attacks demonstrate relatively stable performance against different CL algorithms and surpass CL-based baseline methods in worst-case unlearnability.\n\n**[W3] REM's augmentation** The reviewer mentioned that our technique is an extension of the technique used by REM. We believe there are some misunderstandings here and we will elaborate below. \n\n- “Expectation over transformation (EOT)” was proposed to make robust adversarial examples in the physical world[1], for example, a 3D-printed \"adversarial\" turtle that can be classified as a rifle from different views.\n \n- Then REM uses a modified EOT in which the transformation distribution only contains Crop and Horizontal Flip.\nNote that these transformations are common in standard supervised learning and not exclusive to adversarial training.\nThe ablation study empirically shows EOT can improve the performance of REM against adversarial training.\n\n- We want to clarify that our method is **not an EOT variant** at all since it does not involve taking expectations. \nMoreover, our SL-based method contains contrastive augmentation that does not appear in SL.\nWe leverage contrastive augmentation since it is a fundamental component of CL and our goal is to achieve unlearnability for CL. \n\n- In summary, in terms of both motivation and technical details, our method is not an extension of EOT, but a technique specifically designed to address a particular problem.\n\n[1] Athalye A, et al. Synthesizing robust adversarial examples. ICML 2018\n\n**[W5] Diffusion purification** \n- We acknowledge that at this stage of development, diffusion-based purification techniques have impacted all methods that aim to protect images through subtle perturbations, not only the method we studied, which uses availability attacks to prevent unauthorized data usage, but also methods that protect the copyrights of artists’ works [2,3,4].\n\n- In Appendix D.9 of our paper, we discussed these techniques. We consider the defensive capability of diffusion purification as a limitation of this work, and exploring how to overcome this limitation is a promising direction for future research, such as incorporating the diffusion process into perturbation generation. \n\n- Since the code in DiffAug's GitHub repository does not include implementations for commonly used datasets such as CIFAR and ImageNet, we needed to spend additional time modifying the code to adapt it to our problem. \nOnce the results are available, we will update them in a subsequent version.\n\n\n\n[2] Shan S, et al. Glaze: Protecting artists from style mimicry by {Text-to-Image} models. USENIX Security 2023\n\n[3] Liang C, et al. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. ICML 2023\n\n[4] Hönig R, et al. Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI.arXiv:2406.12027\n\n**[W6] Typo** Thank you for pointing out it. We will correct it in the next version. \n\n**[Question] CLIP** We conduct linear probing upon CLIP on CIFAR-10 following the official example in the GitHub repository. The CLIP encoder is pre-trained by OpenAI and fixed.\n- The following results show that both AUE and AAP can make CLIP-extracted representations of training data deviate from the true representation distribution. Compared to AUE, AAP achieves more unlearnability in such scenarios.\n\n    ||Clean|AUE|AAP|\n    |-|-|-|-|\n    |CIFAR-10|94.99|90.63|51.22|\n    |CIFAR-100|80.00|72.56|66.82|\n\n- The reason for this could be that, CLIP exhibits adversarial vulnerability, making it easy to find pixel-level perturbations that alter feature semantics [5]. Although our attacks were not designed specifically for CLIP, the perturbations they generate might share some commonalities with CLIP’s adversarial examples. Compared to AUE, AAP, as an adversarial example for SL, possibly plays a greater role in confusing the feature semantics extracted by CLIP.\n\n[5] Fort S. Adversarial examples for the OpenAI CLIP in its zero-shot classification regime and their semantic generalization", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rwIHiVcLwD", "reviewer": "Reviewer_5WZD", "summary": "This paper claims to introduce a threat scenario where the adversary may use contrastive learning to bypass the unlearnable examples that are crafted only for supervised learning. In this threat model, the authors showcase that previous works on unlearnable examples crafted only for supervised learning may fall short of contrastive learning. Based on this observation, the authors propose a new approach that considers both supervised and contrastive learning when generating unlearnable examples. The proposed approach is also efficient due to the augmentation adopted augmentation strategies. Extensive experiments show that the proposed method is effective in this new threat scenario.", "questions": "Please motivate the threat scenario where the proposed unlearnable examples are necessary. Further analysis of the augmentation strategies could be clarified.", "limitations": "The authors have discussed most limitations adequately.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The paper is clearly presented. The proposed approach is efficient thanks to the augmentation strategies that imitate the CL. As a consequence, AUE and AAP are also easily scalable to practical datasets, like ImageNet subsets.\n\nThe authors provided a very complete analysis to evaluate the proposed methods, including discussions on limitations and performance under different defenses. It provides a relatively complete understanding of the proposed approaches in different threat scenarios.", "weaknesses": "The introduced topic is interesting but also limited. The authors point out that there is a lack of unlearnable approaches that are effective against both supervised learning (SL) and contrastive learning (CL). This observation is not fully novel, since CP, TP, and TUE have similar observations and are effective in most cases against both types of learning. For example, CP is an approach that is designed for contrastive learning but is also effective against supervised learning. I would suggest that the author could tone down the claims that hint at this observation as a novel finding. \n\nThe main contribution of this work is to employ both SL and CL losses in the generation of unlearnable examples, including augmentations that imitate the CL in the SL scenario. The proposed approaches show better average and worst-case performance, but the improvement is incremental, according to Table 3 and Table 4. I would suggest that the authors could provide a deeper and more detailed analysis of the difference between SL and CL unlearnable examples by conducting more ablation studies on the augmentation strategies.  The working mechanism behind the augmentation strategies is of interest to the research community.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewers for their constructive feedback and valuable suggestions! We hope that our clarifications address your queries and concerns effectively.\n\n\n**[Weakness1] Topic novelty and previous works** \n\n- As the reviewer mentioned, the CP and TUE papers were the first to point out the vulnerability of unlearnable examples to contrastive learning.\n\n- However, we notice that CL-based attacks are time-consuming and suffer the vulnerability of algorithm transferability, for example, CP is not consistently effective for SL and TP's performance decreases against different evaluation CL algorithms (see Section 5.2 in our paper). \n\n- Regarding the challenges in efficiency and effectiveness, our work provides two SL-based attacks that achieve both SL and CL unlearnability.\n\n- In summary, we sincerely accept your suggestions and will adopt a more modest tone in the abstract and introduction versions and will clarify our contributions in the subsequent. \n\n\n**[W2] Augmentation strategies** We indeed conducted more ablation studies on augmentation strategies. Here are our results.\n\n \n\n\n- **(1)Dynamic augmentation scheme.** In the paper, we implement the proposed attacks with a constant augmentation strength. We also attempt dynamic augmentation schemes including annealing and tempering which linearly change augmentation strength during the perturbation generation process. In Figure 1 of the additional document, the annealing scheme achieves better supervised unlearnability than the tempering scheme; regarding contrastive unlearnability, annealing outperforms tempering for small final strengths and just the opposite for large final strengths. Compared with the constant scheme in the paper, the tempering scheme with a particular final strength is marginally better, while other options are worse. In summary, these two dynamic schemes do not outperform the default constant scheme used in the paper.\n\n- **(2) Applying perturbation before/after augmentation**\nAnother key factor in the effectiveness of our method is that perturbation should be added **before** augmentation. In the perturbation generation process, if the perturbation is added before augmentation $\\mu$, then its gradient propagates through $\\mu$, i.e., $\\nabla_\\delta f(\\mu(x+\\delta))$; otherwise, its gradient does not go through $\\mu$, i.e., $\\nabla_\\delta f(\\mu(x)+\\delta)$.\nWe conduct an ablation study of applying perturbation **after** augmentation for AUE in Figure 3 of the additional document. In that case, enhancing augmentation strength does not improve the effectiveness against contrastive learning. \n\n**[Question1] Scenario** \nLet’s continue the scenario described in [1]: Given that facial recognition tools can be trained by scraping people’s photos from the public web, can people still feel secure uploading their selfies to social media? \nAvailability attacks (unlearnable examples) provide a tool that allows AI systems to ignore a person’s selfies; however, this is limited to AI systems based on supervised learning algorithms.\nConsidering contrastive learning algorithms can currently achieve performance comparable to that of supervised learning, once AI systems begin to use contrastive learning, the protection of selfies collapses.\nThis is why the effectiveness of attacks against contrastive learning in real-world scenarios is important.\nOur work provides an efficient method that is effective for both supervised learning and contrastive learning.\n\n[1] Will Douglas. How to stop AI from recognizing your face in selfies. MIT Technology Review. https://www.technologyreview.com/2021/05/05/1024613/stop-ai-recognizing-your-face-selfies-machine-learning-facial-recognition-clearview/ \n\n**[Q2] Augmentation strategies** See our reply to [W2]", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FcQhxjfArl", "reviewer": "Reviewer_J4Hn", "summary": "This paper explores efficient availability attacks that target both supervised and contrastive learning algorithms simultaneously. The authors propose two attack methods, named AUE (Augmented Unlearnable Examples) and AAP (Augmented Adversarial Poisoning), which utilize enhanced data augmentations to craft effective poisoning attacks. These methods achieve state-of-the-art unlearnability with reduced computational demands, showing promise for practical applications. The paper evaluates the effectiveness of these attacks across multiple datasets and demonstrates their superiority over existing methods in achieving worst-case unlearnability while handling high-resolution datasets efficiently.", "questions": "What is the biggest challenge in this work?", "limitations": "None", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The motivation behind the study is sound, as it addresses an important gap in existing methods, which are unable to achieve unlearnability for both supervised and contrastive learning. This realization underscores the need to explore techniques that can simultaneously achieve supervised and contrastive unlearnability.\n- The two proposed attack methods, AAP (Augmented Adversarial Poisoning) and AUE (Augmented Unlearnable Examples), are presented as simple yet effective.\n- The experiments conducted are comprehensive and robust.", "weaknesses": "- While the motivation is justified, the technical contributions could be considered direct. Integrating data augmentation into the generation of poisons is a straightforward approach, which may not reflect a non-trivial technical contribution.\n- The methods lack theoretical analysis, which raises questions about the guaranteed effectiveness of data augmentation in all scenarios. Additionally, there is no explanation of why data augmentation works effectively or if it completely addresses the issue at hand through augmentation alone.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We would like to thank the reviewers for their valuable comments and suggestions! We hope our responses sufficiently address the concerns raised.\n\n**[Weakness1] Theoretical guarantees and why the enhancing data augmentation works.**\n\n- In fact, we conduct theoretical analysis for a toy model in the appendix to verify the intuition of our proposed method (**Proposition E.1**): if the supervised training process uses the same data augmentation as CL, then this process also optimizes an upper bound of the contrastive loss. As a result, supervised error minimization mimics contrastive error minimization. Such mimicry makes the modified SL-based generation process enhance the contrastive unlearnability of final perturbations.\n\n- By the way, we agree with the reviewer that availability attacks currently lack theoretical guarantees similar to those provided by certified adversarial robustness or differential privacy. Although some works have clarified the optimization objectives of such attacks, it is still insufficient to guarantee the final achievement of unlearnability. \n\n**[W2] Technical contribution** To obtain unlearnability for CL, we are the first to adopt contrastive augmentation in the SL-based training process. The proposed method is simple, effective, and efficient. Compared to other more complex algorithms, it is easier to scale to large datasets and has greater potential for real-world applications.\n\n**[Question] Biggest challenge** \nIn our opinion, the biggest challenge in this work is breaking free from the reliance on existing paths. Current methods on this topic, including CP, TUE, and TP, are all based on the contrastive training process which is time-consuming and meets challenges in scaling up to real-world datasets. We believe it’s possible to obtain effective availability attacks through the supervised training process which is more efficient and easier to optimize. The remaining task is to consider how to connect the characteristics of contrastive learning and supervised learning and propose an effective algorithm.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "yNU5uOMLch", "reviewer": "Reviewer_vjzY", "summary": "This paper studies the transferability of unlearnable examples (UEs) across different learning paradigms, i.e., supervised learning and self-supervised contrastive learning. Different from existing works including both supervised UE generation methods and hybrid methods, this paper argues that strong data augmentations with supervised learning are sufficient for unsupervised unlearnability. It then proposes two strong data augmentations equipped UE generation methods AUE (with standard training) and AAP (with adversarial training). The two proposed methods demonstrate certain superiority over the existing methods on low- and high-resolution datasets.", "questions": "1. Should the worst-case unlearnability contain other learning paradigms rather than just supervised learning and contrastive learning? For example, MAE or autoregressive pretraining. We cannot enumerate all training paradigms.\n\n2. Why data augmentation is so important for obtaining unsupervised unlearnability, what if there are non-data-augmention-based unsupervised learning methods?\n\n--------\nPost rebuttal: I have increased my rating according to the authors' responses.", "limitations": "The technical novelty of this work is somewhat limited.", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The proposed methods are extremely efficient than contrastive learning involving UE generation methods. It leverages supervised learning with strong data augmentation to achieve unsupervised unlearnability against contrastive learning.\n\n2. The proposed method is simple but effective. The revealed finding that strong data augmentation is important for contrastive learning is interesting.\n\n3. Extensive experiments confirmed the capability and efficiency of the proposed attacks.", "weaknesses": "1. The alignment and uniformity metrics are all from existing works, which lowers the novelty of the finding in Table 1: \"contrastive unlearnability is highly related to huge alignment and uniformity gaps\". And the two proposed methods have little to do with the two gaps?\n\n2. While the finding that \"supervised learning with strong data augmentation can achieve unsupervised unlearnability\" is interesting, the two proposed methods have limited technical novelty. In other words, they do not explore the power of data augmentation more systematically. The current mechanism is very ad-hoc.\n\n3. The performance difference (AUE vs AAP) between low- vs high-resolution datasets is intriguing. AAP targets adversarial training exploitation, so why it should perform better or worse than AUE against contrastive learning? Does contrastive learning have anything to do with adversarial training?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are grateful to the reviewers for their detailed and thoughtful reviews!\nWe aim to resolve the issues highlighted and believe our answers will do so.\n\n\n**[Weakness1] Alignment and uniformity gaps** \n- Alignment and uniformity are widely adopted illustrations for the mechanism of contrastive learning. In our problem settings, although the final effectiveness of availability attacks is evaluated through classification accuracy, we still need to carefully examine how the attacks affect contrastive learning at the encoder level. Thus, we borrow the concepts of alignment and uniformity and introduce the gaps between them on clean and poisoned data respectively.\nBy studying the gaps, we explain why some attacks are effective against CL algorithms while others are not. \n\n- Effective attacks cause significant differences between the features of poisoned samples and those of clean samples, ultimately rendering the learned classifier ineffective on the ground truth distribution. \n\n- Regarding our proposed methods, Figure 5(b) demonstrates that AUE exhibits significant alignment and uniformity gaps, whereas unenhanced UE does not, as shown in Table 1.\n\n\n\n**[W2] Systematical study on data augmentation** The review said our proposed method is ad-hoc. We believe some misunderstandings need to be clarified.\n\n- *[Technique novelty]* To obtain unlearnability for CL, we are the first to adopt contrastive augmentation in the SL-based training process. On this topic, we have moved away from the path dependence on contrastive error minimization.\n\n- *[Theoretical results]* We provide a toy model in the appendix to theoretically verify the intuition of our method (Proposition E.1): if the supervised training process uses the same data augmentation as CL, then this process also optimizes the contrastive loss.\n\n- *[Augmentation strategies]* In the discussion with Reviewer 5WZD, we explore more data augmentation strategies in our proposed attacks, including augmentation decoupling, augmentation differentiability, and dynamic strategies.\n\n**[W3] AAP better or worse than AUE** \n- On the one hand, when the dataset becomes higher-resolution and more category, the optimization difficulty in generating adversarial poisoning from scratch increases since AP finds non-robust features that rely on a good classifier.\n\n- On the other hand, since supervised error minimization is easy to optimize, the high resolution provides more room for AUE to create effective poisoning patterns to fool the subsequent algorithms.\n\n**[W4] Contrastive learning and adversarial training** \nIf we understand correctly, the reviewer's question is why adversarial poisoning (AP) is effective for contrastive learning. We have discussed it in Appendix D.3 of our paper. On the one hand,  [1] shows that some contrastive augmentation can squeeze low-frequency \"shortcuts\" in unlearnable examples. \nOn the other hand, contrastive error minimization-based attacks such as CP and TP generate high-frequency perturbations (see Figure 8 in our paper).\nFrom the visualization, perturbations from AP contain more high-frequency patterns, which may deceive contrastive learning more easily.\n\n[1] Liu Z, et al. Image shortcut squeezing: Countering perturbative availability poisons with compression. ICML 2023.\n\n\n**[Q1] Learning paradigms other than contrastive learning**\n\n- In Table 5 of our paper, we have checked the supervised contrastive learning (SupCL) and a semi-supervised method FixMatch.\n\n- We evaluate our attacks against MAE by end-to-end fine-tuning on CIFAR-10. In the presence of AUE/AAP, the test accuracy of fine-tuning decreases by 57%/37%. In Figure 2 of the additional document, the training accuracy in the presence of attacks increases more quickly than that in the clean case, while the test accuracy is the opposite, meaning that the attacks create shortcuts for MAE. \nAlthough our methods were not specifically designed for MAE, they can transfer to MAE.\n\n    |Clean | AUE | AAP |\n    | --- | --- | --- |\n    | 89.63 | 32.36 | 51.93 |\n \n\n    \n  \n**[Q2] Importance of data augmentation.**\n\n- Data augmentation is an essential component for CL since it creates different views of the same data point, which is fundamental for learning useful representations. Our work leverages stronger data augmentation to improve the effectiveness of SL-based attacks against CL. \n\n- As other reviewers pointed out, there is a special case in CL, i.e., Text-Image contrastive learning algorithm CLIP. The image encoder of CLIP does not involve contrastive augmentation. We conduct experiments on linear probing upon the CLIP encoder and show that our attacks take effect on this algorithm. See our discussion with Reviewer 61jU for detailed results.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We would like to express our gratitude to the reviewers for their careful consideration and valuable feedback!

In our responses to each reviewer, we have clarified and addressed the weaknesses and issues raised, including many additional supplementary experiments. 
Due to the word limit of the rebuttal and the design of the review system, we were unable to fully present the information from the tables and figures in our responses. 

Here, we have consolidated the charts and tables from the supplementary experiments into an additional document and uploaded it.

- **Figure 1** Based on Reviewer 5WZD’s suggestion, we conducted more ablation studies on augmentation strategies. Figure 1 shows the experimental results of using a dynamic augmentation scheme for AUE.

- **Figure 2** Based on Reviewer 2’s suggestion, we conducted experiments with MAE. Figure 2 shows the training process of MAE fine-tuning under attacks.

- **Figure 3** The results of applying perturbations after augmentation for AUE, which is also an ablation study on augmentation strategies.

- **Table 1** To address Reviewer 3’s questions, we tested the effectiveness of our attacks against CLIP and showed results in Table 1.

- **Table 2** The performance of our attacks against MAE.

Meta-review: The paper introduces two novel attack methods, AUE (Augmented Unlearnable Examples) and AAP (Augmented Adversarial Poisoning), designed to thwart both supervised learning (SL) and contrastive learning (CL) algorithms. It paper addresses a crucial gap in the field: while availability attacks have been proposed to prevent unauthorized use of private data in SL settings, they many fail to be effective against CL algorithms. The paper received a generally positive response from the reviewers, who appreciated its timely and relevant contributions. However, concerns were raised regarding the novelty and depth of the technical contributions, as well as the robustness of the proposed methods under certain conditions. The authors provided a comprehensive rebuttal addressing most of the concerns raised by the reviewers. They clarified the differences between their work and prior approaches, particularly emphasizing the distinctiveness of their focus on cross-algorithm transferability rather than cross-dataset transferability. These efforts were generally well-received by the reviewers, leading to score adjustments in favor of the paper. Overall, this paper makes a meaningful contribution to the field of availability attacks by proposing methods that are both effective and efficient across supervised and contrastive learning paradigms. It would benefit from a more modest presentation of its novelty and an expanded discussion on the theoretical implications and potential limitations of the proposed methods.
Decision: Accept (poster)