Versatile Transferable Unlearnable Example Generator
Authors: Zhihao Li
Jiale Cai
Gezheng Xu
Hao Zheng
Qiuyue Li
Fan Zhou
Shichun Yang
Charles Ling
Boyu Wang
Venue: NeurIPS 2025 poster ()
Keywords: unlearnable examples
data privacy
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: A versatile perturbation generator that achieves unlearnability across diverse scenarios.

Abstract: The rapid growth of publicly available data has fueled deep learning advancements but also raises concerns about unauthorized data usage. Unlearnable Examples (UEs) have emerged as a data protection strategy that introduces imperceptible perturbations to prevent unauthorized learning. However, most existing UE methods produce perturbations strongly tied to specific training sets, leading to a significant drop in unlearnability when applied to unseen data or tasks. In this paper, we argue that for broad applicability, UEs should maintain their effectiveness across diverse application scenarios. To this end, we conduct the first comprehensive study on the transferability of UEs across diverse and practical yet demanding settings. Specifically, we identify key scenarios that pose significant challenges for existing UE methods, including varying styles, out-of-distribution classes, resolutions, and architectures.
Moreover, we propose $\textbf{Versatile Transferable Generator}$ (VTG), a transferable generator designed to safeguard data across various conditions. Specifically, VTG integrates Adversarial Domain Augmentation (ADA) into the generator’s training process to synthesize out-of-distribution samples, thereby improving its generalizability to unseen scenarios. Furthermore, we propose a Perturbation-Label Coupling (PLC) mechanism that leverages contrastive learning to directly align perturbations with class labels. This approach reduces the generator’s reliance on data semantics, allowing VTG to produce unlearnable perturbations in a distribution-agnostic manner. Extensive experiments demonstrate the effectiveness and broad applicability of our approach. Code is available at https://github.com/zhli-cs/VTG.

Versatile Transferable Unlearnable Example Generator
Zhihao Li Jiale Cai Gezheng Xu Hao Zheng 1.2
Qiuyue Li Shichun Yang" Charles Ling! Boyu Wang 14.1
Fan Zhou²
1 Western University 2 Central South University 3 Beihang University 4 Vector Institute
{z1i3446, jcai336, gxu86, charles. ling) (liqiuyue23, zhoufan, mhoufan,yaggah yangshi chun) @buaa. edu. cn bwangOcsd.
zhenghaocsuu@gail.c
www.ccsddwww..ooo uwo. ca
Abstract
The rapid growth of publicly available data has fueled deep learning advancements but also raises concerns about unauthorized data usage. Unlearnable Examples (UEs) have emerged as data protection strategy that introduces imperceptible per- turbations to prevent unauthorized learning. However, most existing UE methods produce perturbations strongly tied specific training sets, leading significant drop in unlearnability when applied to unseen data or tasks. this paper, we argue that for broad applicability, UEs should maintain their effectiveness across diverse application scenarios. To this end, we conduct the first comprehensive study the transferability of UEs across diverse and practical yet demanding settings. Specifically, we identify key scenarios that pose significant challenges for existing UE methods, including varying styles, out-of-distribution classes, resolu- tions, and architectures. Moreover, we propose Versatile Transferable Generator (VTG), transferable generator designed to safeguard data across various condi- tions. Specifically, VTG integrates Adversarial Domain Augmentation (ADA) into the generator's 's training process synthesize out-of-distribution samples, thereby improving its generalizability to unseen scenarios. Furthermore, we propose a Perturbation-Label Coupling (PLC) mechanism that leverages contrastive learn- ing to directly align perturbations with class labels. This approach reduces the generator's 's reliance on data semanties. allowing VTG to produce unlearnable per- turbations in a distribution aggnostcc manner. Extensive experiments demonstrate the effectiveness and broad applicability of our approach. Code available https: // / thub. www.coo//oaaoo/o http:/hhiiics////
Introduction
The abundance of free internet data has facilitated the construction of numerous datasets, significantly advancing the field of deep learning II 4 Despite their pivotal roles, growing concerns exist over the potential unauthorized exploitation of online personal data. To safeguard individual privacy, Unlearnable Examples (UEs) 6 7 have gained prominence in recent years. Models trained on unlearnable data tend to learn the correspondence between labels and perturbations instead of real semantics, resulting in poor classification accuracy on clean test images.
However, most existing UE methods generate perturbations that are highly dependent on specific training data, resulting in significant performance drop when applied to unseen data or tasks. For instance, several initial works 5 g 9 10 only achieve unlearnability when both training and
Equual contribution. The author order determined by coin flip.
Corresponding authors
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

aim to improve the transferability of UEs across different datasets (e.g. CIFAR-I0 [3] SVHN (4). )
testing data are drawn from the same distribution. While some recent studies 7 II 12
their effectiveness remains substantially limited in real-world scenarios, such as when generalizing to unseen classes 7 or transferring across images with different resolutions
In this work, we argue that for UEs to be prac- tically useful, they must retain their effective- ness beyond their original training scenarios. To this end, introduce the first comprehensive transferable evaluation framework, which identi- fies four progressively challenging UE scenarios: Intra-Domain Cross-Domain, Cross-Task, and Cross-Space. Specifically, Intra-Domain represents the conventional setting, where the training and test data are drawn from the same distribution. Mooss-Domain extends this by con- sidering cases where the training and test sets share the same classes but originate from different distributions, such as images with different styles
Table 1: Comparative evaluation of existing UE methods across diverse scenarios. Symbols "V", "x", and "xx indicate "capable", "capable but inef- fective" and "incapable", respectively.
Method
Intra-
Cross-
CraSs
Cross Space
Cross-
Domain
Domain
Task
Architecture
EMN 5 TUE
x
X
x
x
x
GUE
8
x
X
14A
Ours
in domain adaptation [15] 16.
19 20 21). Cross-Task further increases the challenge by introducing both distribution shifts and class mismatches. For example, applying UEs generated from CIFAR- SVHN. Finally, Cross-Space is the most challenging scenario, where even the input space differs between training and test sets, such as transferring UEs across images of different
resolutions. In addition, following [5] T0 22 23 we also consider the crcss-Architecture scenario, where we evaluate the generalizability of UEs across different network architectures.
To enhance the transferability of unlearnable perturbations across the aforementioned scenarios, we propose Versatile Transferable Generator (VTG), a generator designed to improve the generaliza- tion of unlearnability beyond specific domains or tasks. Unlike conventional methods that produce perturbations tightly coupled with the training data, VTG incorporates Adversarial Domain Augmen- tation (ADA) during training by synthesizing diverse worst-case diitt-riitiiittion samples. Through this process, VTG compels the generator to learn perturbations that remain effective beyond fixed data distribution and is iteratively refined to produce more transferable UEs that prevent the surrogate model from capturing meaningful semantics. As a result, the generator becomes less dependent on data-specific representations, improving its transferability to unseen conditions. Moreover, we also introduce Perturbation-Labe Coupling (PL.C) to further enhance VTG's s transferability by directly aligning perturbations with class labels. Specifically, we leverage the surrogate model and CLIP text encoder to encode perturbations and labels, aligning perturbation embeddings with their correspond- ing label embeddings through a contrastive learning paradigm. Notably, this alignment is performed without relying on data semantics, enabling the generator to produce unlearnable perturbations in a cetrributionaaanostti manner. As a result, VTG achieves improved generalization across diverse data distributions, further strengthening its resilience to -ittof-distribution variations. We note that 14A [12 also employs a generator architecture to address the transferability issue. However, its effectiveness is not consistently satisfactory across comprehensive scenarios.
Table compares VTG with various state-of-the -rr methods in terms of transferability across different scenarios. As shown, only VTG is capable of generating transferable UEs that remain effective all settings, which will be further validated through empirical results in Section 4
Our main contributions are summarized as follows:
We introduce the first comprehensive evaluation framework to analyze the transferability of UEs across diverse practical scenarios, including Intra-Domain, Cross-Domain, Cross-Task
Cross-Space, and Cross-Architecture
We propose VTG, versatile transferable generator effective across diverse scenarios. VTG introduces Adversarial Domain Augmentation to generate diversified samples and compel the generator to produce perturbations beyond fixed distributions. Moreover, the Perturbation-LLabl Coupling mechanism employs contrastive learning to align perturbations with class labels, introducing unlcarnability in a distribution-agnosicc manner.
We empirically validate the efficacy of our method within the proposed comprehensive transferable setting. Extensive experiments demonstrate VTG's superior performance and broad applicability across diverse scenarios.

---

2 Related Work
Unlearnable examples [5] refer to a type of data that hinders deep learning models from acquiring informative knowledge. Models trained on such examples often achieve high accuracy on the training set but exhibit significantly degraded performance on the clean test set. This task is crucial to
improving the security of machine learning, with applications in image classification 22 24 25 26
27 [28] and segmentation [29]. Implementation strategies for unlearnable examples can be broadly categorized into three paradigms. The first paradigm concentrates on injecting perturbations into data and creating "shorteuts" to minimize the classification loss [ g The goal is to trick models into learning correspondences between perturbations and labels instead of acquiring real semantics. The second paradigm involves the strategic introduction of perturbations to deceive classifiers into associating images with incorrect classes [12 30 31]. Consequently, models trained on perturbed data tend to align images with false classes, thereby enhancing data protection. The last paradigm aims to produce perturbations without the utilization of surrogate models [1] 32 33], which crafts unlearnable perturbations that are extremely easy to classify, such as utilizing the linearly-separable property or employing random convolution filters to convolve images of different classes.
The transferability of unlearnable examples has attracted some researchers, particularly concerning their generalization across different classes 7 12 and architectures [5] g. However, related research remains relatively scarce, highlighting critical gap in the literature. In this work, we introduce comprehensive transferable study for unlearnable examples. We then propose a versatile perturbation generator to craft transferable unlearnable examples based on adversarial domain augmentation and perturbation- coupling. Our approach effectively facilitates the transfcrability of unlearnable examples across diverse practical scenarios, thereby enhancing privacy protection in various real- world machine learning applications.
3 Proposed Method
In this section, we first present our comprehensive transfer-focused UE evaluation setting. Then, we introduce our Versatile Transferable Generator in detail.
3.1 Transferable Unlearnable Examples
Let (æ,y) be labeled example, where æ X' is a data point, and y E y label. We denote the source training set, the target training set, and the target test set as D Doouree Dtarget, and D Drest, respectively. A VTG G, trained exclusively on D Dsource. applied D Ptarget to generate an unlearnable version D Diarget by introducing perturbations to each example x'
{I,..., K} is its
+ 8, where 8 = G(z) represents either sample-wise or class-wiz wise perturbations. A classifier fx. parameterized by is then trained on D' Piargets and the unlearnability of ô evaluated by measuring the performance degradation of fx on Diest- In this work, we aim to conduct a comprehensive study on the transferability of UEs across different scenarios. Therefore, Dsource can differ from Dtarget (and Drest) in various ways, such as different distributions (Cross-Domain), label space y (Cross-Task) -askk, or even input space X (Cross-Space
Our comprehensive focused evaluation setting is composed of five distinct scenarios: Intra- Domain, Domain, Cross-Task, Cross-Space, and Cross-Architecture. In the Intra-Domain scenario, the original training dataset is partitioned into two subsets: a source training set and a target training set. The distributions of these subsets remain identical, ensuring they belong to the same domain. The Cross Pross-Domain scenario represents a more challenging setting, where the source and target datasets share identical class labels but differ in their underlying data distributions, such as variations in style across paintings, photographs, and sketches. Moreover, in the Cross-Task scenario, the target dataset diverges from the source dataset not only in distributions but also in class labels. introducing a shift in task objectives. Furthermore, the Cross-Space scenario is the most complex scenario, where even the input space of the target set is different from the source set, such as differences in image resolution. Lastly, to be consistent with prior work 5 g. the Cross-Architectur scenario assesses transferability when the classifiers employed for the source and target datasets differ in architecture
3

---

Train
Test
Source Dataset
Domain Augmentation
fo
L Lug
LeR
Versatile Transferable Generator
Target Train Dataset
Perturbations 5
8
Label
table
Learnalle
airplane
Label Encodar
Lruc
parameters
Frozen
Terget Test Detaset
Decreased
bus
Coupling
Accuracy
Figure 1: Overall pipeline of the proposed approach. Our Versatile Transferable Generator (VTG) is first optimized on the source dataset. Specifically, we leverage adversarial domain augmentation diversify training samples, thereby requiring VTG generate unlearnable perturbations capable of confusing a more generalizable classifier fa- Then, we incorporate perturbation-label coupling mechanism that enhances distribution-un distribution-agnostic transferability by aligning perturbations with class labels. On the target dataset, we initially train a classifier fx on the target training dataset that has been perturbed by the VeG-generated perturbations, followed by validating its decreased accuracy on the clean target test dataset.
3.2 Versatile Perturbation Generator
Overview. To generate perturbations that can generalize to various conditions, we propose versa- tile unlearnable example generator capable of introducing unlearnability under various real- world scenarios, As shown Figure [ our VTG is primarily optimized through an alternating min-min optimization framework, where Adversarial Domain Augmentation and CLIP-guided Perturbation- Label Coupling are incorporated to equip the perturbation generator with transferability to diverse distribution variations.
In the first minimization loop, the Adversarial Domain Augmentation procedure synthesizes diversi- fied images outside original distributions to enrich the surrogate classifier with superior generalizabil- ity. During this stage, the surrogate classifier fo optimized by minimizing the classification loss while the perturbation generator G remains frozen. In the second minimization loop, the perturbation generator produces perturbations to craft unlearnable examples, which creates shortcuts and misleads the learning process of the surrogate classifier, preventing from learning real semantics. Meanwhile, the Perturbation-
Coupling mechanism conducts cross-modas alignment between perturbations and labels to enhance distribution-aannosiic transferability. In this stage, the perturbation generator G optimized with the classification loss while the surrogate classifier fo is frozen.
Adversarial Domain Augmentation. Existing UE methods generate unlearnable examples tied which lack explicit transferable designs promote the unlearnability in comprehensive real real-world scenarios. To address this issue, we draw insight from domain augmentation 15 16
specific training datasets
38 39 and learn a domain composer C₁. with parameters to diversify training samples. Specifically, the domain composer generates novel domains lying outside the original distribution. Then, we integrate both the source domain and the generated out-of- distribution domain train the surrogate classifier. We assume that if our perturbation generator can effectively create shortcuts for the more generalizable surrogate classifier, it can craft unlearnable examples that take effect across diverse scenarios.
35
36
Our domain composer has standard encoder-decoder structure 40]. as input, the domain composer C, aims to synthesize novel domains that lie outside the original distribution, thereby simulating diverse scenarios. accomplish this goal, we propose to maximize the divergence between the source distribution P. and the generated pseudo-novel distribution P,, with the Wasserstein distance Wa, also known as Optimal Transport (OT) distance, as metric:
Given source images
Wa (P. Pb) =
inf Ex.w [d (xay xb)] =EII(F..Ps)
(I)

---

20 (Eta
(xx)
d ( v%6)
=
=g
(x
1l2 12 2| (280)ll2
(2)
where [1 Pb) represents the set of all distributions (æaa Fb). denotes the feature extractor within classifier fo. Va and 24 indicate the original image samples and the generated samples, respectively, -(:,)) denotes the cost function defined by cosine distance.
The Wasserstein metric can capture high-order distributional characteristics and measure the minimal cost required to transform the source distribution PP, into the novel distribution Ps. as demonstrated
in diffusion models [41] and domain adaptation [42]. We employ the Sinkhorn algorithm
43 to
reduce the computational complexity, as detailed below.
Wa(:,-)
inf ΣIM J MEM
1,j
where the soft- matching matrix M represents the joint distribution æ in Eq. denotes the pairwise cosine distance matrix calculated by Eq. 2
The domain composer C₁2 is optimized by maximizing the divergence measure between source images and the synthesized images as:
arg max Wa (C (x).
where μ denotes the parameters of the domain composer.
After obtaining the generated diversified images, we employ the pross-entropy loss LCe to optimize the domain composer C₁. and the surrogate classifier so simultaneously, setting constraints for the domain augmentation procedure and ensuring the classifier's predictions are aligned with true labels.
arg min (CE (Jo (æ + ,), + Lce (Je (Cμ, (x) + .)]
(5)
8,
where 8 is initialized to zero at the beginning of training.
Perturbation Generator. Different from cradient-based UE approaches [5 6 that inherently depend on specific training samples to generate fixed perturbations, we develop a transferable generator that can produce unlearnable perturbations for any image in single forward pass, exhibiting superior generalizability and applicability for practical use.
Our perturbation generator G employs encoder-decoder structure [4]. Given the clean image æi, generator produces unlearnable noise as (ax; and renders data unlearnall as x! = æ; + The goal is to create shortcuts by minimizing the classification loss, thereby misleading the surrogate classifier's 's training process and associating labels with perturbations instead true semantics. We employ the cross-entropy loss Lce the classification loss and update the generator accordingly:
arg (a)) (f( + +6), v),
where fo denotes the surrogate classifier that remains frozen this stage. Meanwhile, the perturbation generator G is optimized to minimize the classification loss LCE.
To assure the imperceptibility of perturbations, we propose to constrain the magnitude of the noise 5 via a soft hinge loss on the Loo norm, which is defined as follows:
Lhinge Ex, max (0, ||0]|x e),
where denotes the perturbation bound and is set to 8/255, in accordance with prior works 5
Perturbation-Label Coupling. This procedure is designed to optimize our generator to produce unlearnable perturbations distribution-agnosicc manner. To achieve this, we aim establish strong correlation between perturbations and labels. Specifically, we utilize the surrogate model to extract perturbation embeddings and leverage CLIP's fixed text encoder T 44] to extract label embeddings. Then, we conduct cross-modal aligmments [5]46] 46) to associate perturbations with labels through a contrastive learning framework. This process guides the generator to directly associate perturbations with labels without relying on the underlying image semantics. Consequently, our VTG can produce unlearnable perturbations that remain effective under distribution shifts and resolution variations, ensuring effectiveness across diverse practical scenarios.
5

---

Given generated perturbations 8 and text labels I, we formulate the perturbation label coupling procedure follows:
P =0 (6); I- T(),
(8)
where P Ee IR BxQ and L E R denote the extracted perturbation embeddings and label embed- indicates the number of data samples in a mini-batch, K denotes the number of classes in the source dataset, Q signifies the dimensionality of the feature space, The functions 20 and T denote the feature extractor of the surrogate model fo and CLIP's text encoder, respectively. We keep both of them frozen at this stage to specifically optimize the perturbation generator.
dings, respectively,
We employ contrastive learning 47 align perturbations with text labels. The pairwise similarity matrix S is calculated as S = P. T," Then, we formulate the PL.C loss as follows:
CLCC
1
Σ
log
exp(S
B
R= exp(S..))
where indicates the size of each mini-batch.
After PLC, perturbations crafted by the generator directly align with CLIP- encoded label embeddings, yield- ing distribution-agnostii unlearnabil- ity and thus enhancing the applicabil- ity across diverse distributions. More- over, benefitting from CLIP's shared image-text space, where label em- beddings are closely associated with its extensive pre-trained image cor- pus, promoting alignments between perturbations and text labels implic- itly enriches VTG with semantic di- versity and establishes latent connec- tions unseen target images. Con-
Algorithm Transferable Unlearnable Noise Generation
Require:
Surrogate model fe. feature extractor 29. do- main composer Cy., CLIP text encoder T, training data (æ. 'Dooures. class label 1, perturbation 6, per- turbation bound e, first loop training steps training epochs E;
Ensure: Transferable perturbation generator G; I: for 1 to E do for 1 = 1 do
2:
3:
Iz 3/: (xx
4: Input æ; to C₁ to calculate Laug:
5:
Update Cp by maximizing Laugi
6: Input æ;, Cp (2x;) and 5 to so to calculate LcE:
7: Update C₁ and So by minimizing LeE:
sequently, the perturbation generator maintains unlearnability even when encountering semantically related but previously unseen classes.
8:
end for
for 2 yj in æ. y do
10: Input æj to G and get 8 )<x));
Obtain unlearnable example x²j = x; + 8;
12: Input æ'j fe to calculate LCE;
Generally, the op- timization of our Versatile Transfer- able Generator follows an alternating min-min optimization scheme. Dur-
Training Process.
Input 8 to zg and get embedding
2g z0(6);
14:
Input to T and get embedding L = T(1);
Calculate LPLC;
16:
Calculate Lhinge:
ing the first minimization loop, the do- main composer C₁ and the surrogate classifier fo are optimized to generate
17:
Update g by minimizing LCF, LPT.Cs Lningos
18: end for
19: end for
diversified images and minimize the classification loss. During the second
20: return Transferable perturbation generator G
minimization loop, the perturbation generator optimized to also minimize the classification loss. The complete training procedure is delincated in Algorithm [
arg min E(n.)))Dooure 0g
min Ctull (fe(æ + 8).
(10)
s.t. 110100 Se
Ltall = Laux + LCR + LPL. + Lhinge: where Ciull represents the final training objective.
(11)
4 Experiments
In this section, based on the comprehensive transferable UE evaluation framework introduced in Section 3.1 we rigorously evaluate our Versatile Transferable Generator across a variety of real-world scenarios. Moreover, we evaluate our method against several defense strategies. Finally, we conduct ablation studies to demonstrate the role of individual components in our training framework.

---

4.1 Experimental Settings
Datasets and Models. We evaluate VTG on CIFAR-10 [13 CIFAR-I00 [3]
14 and SVHN
PACS [17]. The first three datasets have been widely used in the UE literature, while PACS serves as standard benchmark for evaluating domain shifts and consists of four domains: Art Painting, Cartoon, Photo, and Sketch. If not specified otherwise, we use ResNet-18 48 as the surrogate classifier and target model both in training and testing. We utilize the classification accuracy on the clean test set as the evaluation metric, where lower accuracy indicates stronger unlearnability and protectiveness.
Implementation Details. Our model developed with the PyTorch frame- work and trained on a single RTX A5000 GPU. Consistent hyperparame- ter settings are employed across all ex- periments. We employ the Adam opti- mizer [50] with an initial learning rate of 0.001. We train our model for 30 epochs on CIFAR- 10 and SVHN, and 50 epochs on CIFAR- --00R-100-0 and PACS. We set the first loop training step T to 10 in all experiments. The input image resolution is standardized to 224 x 224 for PACS, while 32 x 32 for the remaining datasets. Perturba- tions are crafted ner, where we first generate perturba- tions for each sample, then we aver- age the perturbations for each class. To ensure imperceptibility, we set the perturbation bound 8/255. Re- sults are averaged over five runs with different random seeds.
Table 2: Test accuracy under the Intra-Domain and Cross- Task scenarios, with CIFAR-I0, CIFAR-I00, and SVHN as target datasets.
Source
Method
CIFAR-10 10
CIFAR-I00
SVHN
Clean Random
94.66
76.27
96.05
95.57
71.19
25.11
[
10.16
21.80
24.72
LSP 11
13.54
9.35
7.77
REM 6
15.18
69.26
95,98
10.03
12.93
CIFAR-10
GUE S
13.25
3.87
8.17
14A PUE
41.34
17.47
83.87
10.62
12.01
Ours (ResNet)
9.99
0.99
9.65
Ours (VTT)
9.54
1,21
7.94
EMN S
27.27
3,95
9.64
class-wise man-
LSP
24.16
REM 6
93.94
1.89
95.97
TUE
94.31
1,21
96.02
CIFAR-100
GUE
14A PUE 49
40.02
17.36
85,18
11.61
2.62
18.58
Ours (ResNet)
9.85
11.07
Ours (VTT)
11.40
1.09
9.39
EMN S
14.31
6.25
9.05
LSP 1
38.50
38.51
REM
94.26
49.01
TUE 7
93.91
69.42
9.12
SVHN
S
94.31
48.37
13.70
4.2 Main Results
14A
39.23
15.69
83,59
PUE 49
11.40
6.04
14,21
Intra-Domain Transferability. We first evaluate the transferability of VTG in the intra-domain scenario. Specifically, we randomly extract 50% data from the original training dataset as the source training set and utilize the remaining 50% data the target training set. Then, we utilize VTG to generate perturbations to make the target training set unlearnable and evaluate its impact on the clean test set. As shown in Table 2 our VTG demonstrates superior performance compared with baseline methods on CIFAR-10, CIFAR-100 and SVHN, achieving 9.54%. 1.09% and 6.38% test accuracy, which approximates random guessing. Given that our method evaluated under the more challenging intra-domain scenario, its exceptional unlearnability and protective effects are further verified.
(ResNet)
10.66
1.76
6,38
Ours (VTT)
11.16
1.65
7.41
Moss--Dmain Transferability. To evaluate the effectiveness of VTG in transferring to images conduct experiments
Table 3: Test accuracy results under the Cross- Domain scenario on PACS.
with different domains, on the PACS dataset with the leave-one-dome -omain- setting, where the perturbation generator is trained on three domains and evaluated on the remaining domain. As detailed in Table lect EMN 5). LSP [II]. TUE 77. GUE (8] and 14A 12 as representative methods. Our VTG demonstrates clear effectiveness in transferring unlearnability across different domains, outper- forming GUE by 75.73% and 14A by 14.25% average performance. These results highlight the strong cross-domain transferability of our method, effectively injecting unlearnability into images regardless of their diverse variations in visual styles.
Method
Art
Cartoon
Photo
Sketch
Avg.
Clean
76.92
81.25
83.75
85.42
81.84
Random
54.33
76.79
76.88
81.77
72.44
BMN S
43.75
74.11
71.88
14.58
51.08
se-
LSP [
49.48
59.81
65.62
80.99
63.98
TUE
38.71
72.05
62.50
9.11
45,59
GUE
42.71
32.81
67.19
26.56
42.32
14A [12
27.20
29.91
45.51
20.72
30.84
(ReesNet)
21.63
10.00
16.59
Ours (VIT)
20.31
15.18
17.19
20.57
18.31
7

---

Table 4: Test accuracy under the high-to-low Cross-Space scenario.
Table 5: Test accuracy under the low-to-high Cross-Space scenario.
Source
Method
CIFAR-I0
(HHAR-100
SVHN
LTP
Source
Method
Art
Cartoon
Photo
Skotch
TUE
94,06
69.76
95.45
LSP
54,69
38.02
64.06
25,00
GUEB
TUPE
47.92
69.53
82.81
Art
Ours (ResNet)
14
40.13
17.62
86.50
CIFAR-10
GUER
14
50.48
40.87
27.68
75.95
66.88
66.67
68.84
15.36
Ours (VTT)
11.12
1.67
15.04
Ours (ResNet)
11:25
4.69
Ours (VTT)
15.38
20.26
10.94
17.97
LSP
TUE
93.75
70.75
95.79
LSP
48.96
70.83
70.31
18.23
GUES
TUR
82.03
Cartoon
12
38.89
17.65
83.68
CIFAR-100
GUE
56.73
39.29
78.75
4,43
Ours (ResNet)
9.45
15.94
Ours (ResNet)
14
38.46
73.00
11.16
68.42
70.35
2.34
Ours (VTT)
10.04
3.78
10.21
Ours (VTT)
14.09
15.71
11.18
10.55
LSP
69.86
LSP
45.83
52,08
69.53
21.09
TUE
94,00
70.01
95.87
TUR
31.77
69.53
82.81
Photo
GUE 12
40.95
93.53
28.75
16.50
94.32
84.12
SVHN
GUER
12
36.54
49.04
73.84
20.09
67.25
66.25
64.32
2.60
Ours (ResNet)
Ours (ResNet)
12.05
15.00
17.97
Ours (VTT)
9.46
1,70
11.06
Ours (VIT)
13.56
11.61
12.50
15.36
LSP
TUE GUES
94.25
70.36
95.94
Sketch
[2
35.22
15,95
85,25
Ours (ResNet)
10.04
9.69
Ours (VTT)
10.00
2.16
12.65
Cross- Cross-Task Transferability. To evaluate transferability, we conduct cross-task experiments where perturbations are generated one dataset and tested another with distribution and class shifts. As shown in T methods like TUE 7 and GUE [8] perform reasonably well when transferring from CIFAR-10, but struggle when the source is CIFAR- 100 SVHN. In contrast, our method consistently achieves state-of-the-art results across most settings, effectively preventing semantic learning. Even in the challenging CIFAR-10 to SVHN case, VTG reduces accuracy to near random- guuoosing demonstrating strong unlearnability.
Cross-Space Transferability. To evaluate cross- transferabilityy. conduct experiments between two dataset groups differing in domain, class, and resolution. The low-resolution group (32 32) includes CIFAR-10, CIFAR-100, and SVHN, while the high-resolution group is PACS (224 x 224). As shown in Tables 4 and existing methods degrade significantly under resolution shifts, whereas VTG remains consistently effective in both high-to-low and low-to-high transfers. Notably, in the CIFAR-IO to Art setting, our method outperforms the second-bess by nearly 30%, demonstrating its ability to generate robust unlearnable perturbations across diverse input spaces.
Cross-Architecture Transferability. We further as- sess the transferability of VTG across network archi- tectures. Using ResNet-18 as the surrogate model, evaluate its ability to render other models learnable, including VGG16 [51), ResNet-50 [48], DenseNet-121 [52]. and VIT 5 As shown in Table 6, VTG consistently induces unlcarnability across all targets, outperforming prior UE methods with an average 3% lower test accuracy. These re- sults highlight VTG's strong cross-are aooss-acchitecture trans-
Table 6: Test accuracy under the Cross- Architecture scenario on CIFAR-10, where ResNet- 18 is used as the surrogate model.
Network Architecture ResNet-50
Method
VGG16
DenseNet-121
VIT
EMN
29.30
17.90
18.60
24.37
DC 22
25.35
20.56
21.44
28.05
CG
11.30
13.40
SG
12.32
17.35
16.59
10.64
GUB 8
13.72
12.97
13:71
16.77
Ours
8.92
10.03
9.69
10.53
ferability and practical effectiveness.
4.3 Resistance to Defense Strategies
To assess the efficacy of our method against defense strategies, we train models on perturbed data with data transformation (such Cutout (55), CutMix (56). and Mixup (37). Adversarial Training (58).
and UE-targeted defenses including D-VAE (59 and AN-SDA [60] As shown in Table existing methods exhibit substantial degradation in the unlearnable effect under defense measures. Two
model-free approaches, AR 33 and OPS (54) show partial robustness against data transformation or adversarial training, but neither maintains unlearnability against U'-ttargeted defenses. In contrast, our method employs Adversarial Domain Augmentation to strengthen the perturbation generator against diverse image transformations, Moreover, the Perturbation-Labe Coupling mechanism enables VTG
8

---

Table 7: Test accuracy of ResNet-18 against defense under the Intra-Domain scenario, where ResNet- 18 is used as the surrogate model. "AT" denotes Adversarial Training.
Method
w/o
Cutout
CutMix
Mixup
AT
D-VAE
AN-SDA
Clean
94.66
95.10
95.50
95.01
84.99
93.29
92.76
NTGA 9
42.46
42.07
27.16
43.03
70.05
89.21
89.00
EMN
5
10.16
20.63
26.19
32.83
84.80
91.42
88.01
REM 6
15.18
26.54
29.02
34,48
47.51
86.38
79.28
SG 10
24.42
24.12
29.46
39,66
76.38
38.89
59.80
LSP
13.54
19.87
20.89
26.99
84.59
91.20
64.34
AR 33
11.75
12.36
18.02
14.59
83.17
91.77
80.20
OPS[54
15.56
61.68
76.40
33.13
11.08
88.95
78.83
Ours
9.99
10.03
14.11
13.71
10.83
10.57
28.27
Table 8: Test accuracy of ResNet-18 18 with ImageNet" as the source dataset. Results of 14A on Flowers, Cars, and Food are cited from the original paper, with models trained on the full ImageNet.
Source
Method
CIFAR-10
CIFAR-
SVHN
Art
Cartoon
Photo
Sketch
Flowers
Cars
Food
Clean
94.66
76.27
96.05
76.92
81.25
83.75
85.42
84.47
40.43
65.45
ImaggeNe**
LSP [
29.04
11.32
8.90
28. 12
74.48
74.22
79.95
10.13
1.95
1.16
39.90
11.40
80.38
15.15
6.69
16.01
Ours
15.04
5,68
7.60
27.60
24.11
12.50
15.10
9.28
1.93
9,34
produce distribution-agnosiic perturbations with reduced reliance on image semantics. As result, VTG ensures unlearnability while providing robust protection against various defense strategies.
4.4 More Comparison on ImageNet
To further evaluate the transferability of VTG with SOTA UE studies, such the data-free LSP and the transfer-oriented 14A [1]. we utilize the ImageNet dataset [ as the source dataset and assess the effectiveness of perturbations downstream datasets. Specifically,
randomly select subset from the first 100 classes of ImageNet to construct a smaller ImageNet". The downstream datasets include CIFAR-10, CIFAR-100 [13), SVHN (14, PACS (17), Flowers [61], Cars 622, and Food (3), where the last three datasets are in accordance with previous work [12]. As presented in Table our method outperforms competing approaches across most target datasets. This superior performance not only underscores the strong transferability but also highlights its remarkable adaptability, thereby demonstrating its potential for reliable deployment in diverse and challenging environments.
4.5 Effectiveness of Different Components
Our framework incorporates several key components to facilitate the transferability of UEs, includ- ing vanilla Perturbation Generator, Adversarial Domain Augmentation, and Perturbation-Labe Coupling. In this section, we meticulously assess the effect of these components rendering data unlearnable. Table illustrates the contributions of these components in both intra-domain and cross-task scenarios. Specifically, Adversarial Domain Augmentation improves transferability by exposing the surrogate model diverse distiiiibitttnioonnnn samples, enabling the generator craft more generalizable perturbations. Meanwhile, the Perturhation-l.an Coupling mechanism reduces the generator's 's reliance on image semantics by aligning perturbations with text labels. The synergistic interaction between these two components substantially enhances UE's transfcrability, underscoring their essential role in our framework.
4.6 Further Analyses
Visualizations of Perturbed Images. the task of Unlearnable Examples, the imperceptibility of added perturbations human eyes serves critical evaluation criterion, and specifically incorporate a soft hinge loss to constrain the norm the generated perturbations. To provide a more vivid demonstration, then transfer it across various datasets and visualize the crafted unlearnable examples. The target
utilize the CIFAR-10 10 dataset [13] the source dataset to train VTG,
datasets consist of CIFAR-10 10 (3). CIFAR-I00 [13), and PACS [17]. As illustrated in Figure 2 the results demonstrate that the unlearnable examples generated by our VTG maintain good quality and the perturbations are basically invisible to humans.

---

Clean
Ous
CIFAR-10
CIFAR- 100
Clean
A
Owr
Art
Cartoon
Photo
Sketch
Figure 2: Visualization of clean images and unlearnable examples generated by VTG. The bottom two rows display results from PACS, which consists of four styles: Art, Cartoon, Photo, and Sketch.
Table 9: Ablation study on individual components of our versatile transferable generator. "PG", "ADA", and "PLC" denote the vanilla Perturbation Generator, Adversarial Domain Augmentation, and Perturbation-Label Coupling, respectively. All variants are trained on CIFAR- and evaluated under the
and Cross- Task scenarios with ResNet-18.
Variant
PG
ADA
PLC
CIFAR-10
CIFAR-100
SVHN
16.53
10.19
19.59
10.92
3.36
15.94
4
12.89
5.73
11.05
Ours
9.64
0.99
9.65
Inference Cost Comparison. To eval- uate the practical applicability of VTG across various scenarios, we measure the inference cost and compare it with several generator- generator-based approaches. Specifically, feed each generator with a total of 3,200 images of size 224 224, using batch size of 32. To ensure reliable and fair compari- son, compute the average inference time five runs. All experiments conducted consistent hardware setup comprising an Intel(R) Xeon(R) Silver 4210R CPU and an RTX A5000 GPU, As summarized in Table our VTG contains fewer parameters and achieves reduced inference time and computational cost, highlighting its efficiency and practicality for real-world deployment.
Table 10: Comparison of inference cost and generator param- eters across different methods.
Method
Time (ms /mm))
GFLOPs
Parameters (M)
GUE 14A
3.7
8927.76
7.79
6.3
15506.28
121.13
Ours
0.4
868.99
0.09
5 Conclusion
In this paper, we introduce the first comprehensive transferable study on unlearnable examples, which encompasses five progressive scenarios: Intra-Domann Cross-Domain Cross-Task, Cross-Space, and Fross-Architccture. This study establishes a new standard to rigorously assess the generalization performance of UE methods. Moreover, propose novel Versatile Transferable Generator with specialized designs to facilitate the transferability across various scenarios. Specifically, VTG employs Adversarial Domain Augmentation and Perturbation-Label Coupling to promote superior transferable unlearnable example generator. Extensive experiments demonstrate the remarkable performance of our method compared with other state-of-the -f- methods.
Limitations. While our method demonstrates strong transferability and superior applicability prac- tice, it still requires the VTG generator to craft perturbations at test time. Compared to methods that store fixed precomputed noises (e.g., EMN and TUE), our approach incurs marginal computational overhead during deployment, which have discussed in the Supplementary.
10

---

Acknowledgements
Z. Li, Cai, G. Xu, C. Ling and Wang are supported by the Natural Sciences and Engineering Research Council of Canada (NSERC), Discovery Grants program. Q. Li, F. Zhou, and S. Yang are supported by the National Natural Science Foundation of China (No.52302487).
References
[1] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hicrarchical image database. In 2009 IEER conference on computer vision and pattern recognition, pages 248-255. Iece, 2009.
[2] Tom B Brown. Language models are few-shot learners. arXiv preprint vrXiv:2005.41100 2020.
[] Weiming Liu, Xiaolin Zheng, Jiajie Su, Longfei Zheng. Chaochao Chen, and Mengling Hu. Contrastive proxy kernel stein path alignment for cross-domain cold-start recommendation, IEEE Transactions on Knowledge and Data Engineering, 35(1 ((11))11111-111 1216-1 2023.
[4] YuTeng Yc, Jiale Cai, Hang Zhou, Guanwen Li, Youjia Zhang, Zikai Song, Chenxing Gao, Junqing Yu, and Wei Yang. Progressive text-to-image diffusion with soft latent direction. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 6693-6701, 2024.
[5] Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unleamnale examples: Making personal data unexploitable. International Conference on Learning Representations, 2021.
[6] Shaopeng Fu, Fengxiang Hc, Yang Liu, Li Shen, and Dacheng Tao. Robust unlcarnable examples: Protecting data against adversarial learning. In International Conference on Learning Representations, 2022.
[7] Jie Ren, Han Xu, Yuxuan Wan, Xingjun Ma, Lichao Sun, and Jiliang Tang. Transferable unlearnable examples. arXiv preprint arXiv:22 10. 101 14, 2022.
[8] Shuang Liu, Yihan Wang, and Xiao-Shar Shao-Shn Gao. Game Game-thcoretic unlcarnable example generator. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 21349 21358, 2024.
[9] Chia-Hung Yuan and Shan-Hung Hung Wu. Neural tangent generalization attacks. In International Conference on Machine Learning, pages 12240. PMIR, 2021.
[10] Dirren van Vlijmen, Alex Kolmus, Zhuoran Liu, Zhengyu Zhao, and Martha Larson. Generative poisoning using random discriminators. arXiv preprint arXiv:221 220:22011000066 2022.
[11] Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie- Yan Liu. Availability attacks create shortcuts. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 2367-2376 2022.
[12] Chaochao Chen, Jiaming Zhang, Yuyuan Li, and Zhongxuan Han. One for all: A universal generator for concept unlcarnability via multi-modal alignment. In International Conference Machine Learning, pages 7700 7711, 2024.
[13] Alex Krizhevsky, Geoffrey Hinton, et Learning multiple layers features from tiny images. 2009.
[14] Yuval Netzer. Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Reading digits natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning, volume 201 1, page 7. Granada, 2011.
[15] Kaiyang Zhou, Yongxin Yang. Timothy Hospedales, and Tao Xiang. Learning to generate novel domains for domain generalization. In European Conference on Computer Vision, pages 561-578. Springer, 2020.
[16] Zijian Wang, Yadan Luo, Ruihong Qiu, Zi Huang, and Mahsa Baktashmotlagh. Learning diversify for single domain generalization. Proceedings of the IEEE International Conference on Computer Vision, pages 834 843, 2021.
[17] Da Li, Yongxin Yang, Yi-Zhe Song, and Timothy M Hospedales. Deeper, broader and artier domain generalization. In Proceedings of the IEEE International Conference on Computer Vision, pages 5542-5550 5550. 2017.

---

[18] Ruiyi Fang, Liangjian Wen, Zhao Kang, and Jianzhuang Liu. Strueture-preservingg graph representation learning. In 2022 IEEE International Conference on Data Mining, pages 927-932. IEEE, 2022.
[19] Qiuhao Zeng. Changjian Shui, Long- Kai Huang, Peng Liu, Xi Chen, Charles Ling, and Boyu Wang. Latent trajectory learning for limited timestamps under distribution shift over time. In The Twelfth International Conference on Learning Representations, 2024.
[20] Qiuhao Zeng, Long-Ka Kai Huang, Qi Chen, Charles Ling, and Boyu Wang. Towards understanding evol patterss in sequential data, Advances in Neural Information Processing Systems, 37:132747-132777, 2024.
[21] Ruiyi Fang, Bingheng Li, Zhao Kang, Qiuhao Zeng, Nima Hosscini Dashtbayaz, Ruizhi Pu, Boyu Wang. and Charles Ling. On the benefits of attribute crrivu graph domain adaptation. The Thirteenth International Conference on Learning Representations, 2025.
[22] Ji Feng, Qi-Zhi Cai, and Zhi-Hua Zhou. Learning to confuse: Generating training time adversarial data with auto-encoder. Advances in Neural Information Processing Systems, 32, 2019.
[23] Qi Tian, Kun Kuang, Kelu Jiang, Furui Liu, Zhihua Wang, and Fei Wu. Confoundergan: Protecting image data privacy with causal confounder. Advonces in Neural Information Processing Systems, 2022.
32800,
[24] Zhirui Wang. Yifei Wang, and Yisen Wang. Fooling adversarial training with inducing noise. arXiv preprint xxXiv:2111.10130 2021.
[25] Rui Wen, Zhengyu Zhao, Zhuoran Liu, Michael Backes, Tianhao Wang, and Yang Zhang. Is adversarial training really silver bullet for mitigating data poisoning? In International Conference on Learning Representations, 2023.
[26] Yihan Wang, Yiwei Lu, Xiao-Shan Gao, Gautam Kamath, and Yaoliang Yu. Bridgepure: Limited protection leakage can break black-box data protection. arXiv preprint arXiv:2412.2106/ 2024.
[27] Ruizhi Pu, Gezheng Xu, Ruiyi Fang. Bing- Kun Bao, Charles Ling, and Boyu Wang. Leveraging group classification with descending soft labeling for deep imbalanced regression. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 19978-19985, 2025.
[28] Hui Guo, Boyu Wang. and Grace Yi. Label correction of crowdsourced noisy annotations with instance- dependent noise transition model. Advances Neural Information Processing Systems, 36:347-386, 2023.
[29] Ye Sun, Hao Zhang, Tichua Zhang, Xingjun Ma, and Yu- Yu-Gang Jiang. Unseg: One universal unlcarnable example generator is enough against all image segmentation. arXiv preprint arXiv:2410. 2024.
[30] Jiaming Zhang, Xingjun Ma. Qi Yi, Jitao Sang, Yu-Gang Jiang. Yaowei Wang, and Changsheng Xu. Unleamable clusters: Towards label-agnostic unlearnable examples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 3984-3993, 2023.
[31] Xinwei Liu, Xiaojun Jia, Yuan Xun, Siyuan Liang, and Xiaochun Cao. Multimodal unlearnable examples: Protecting data against multimodal contrastive learning. arXiv preprint vVXiv:2407.16307 2024.
[32] Vinu Sankar Sadasivan, Mahdi Soltanolkotabi, and Soheil Feizi. Cuda: Convolution- unleamable datasets. In Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition, pages 3862 1862-3871, 2023.
[33] Pedro Sandoval- Sandoval-Segura, Vasu Singla, Jonas Geiping, Micah Goldblum, Tom Goldstein, and David Jacobs. Autoregressive perturbations for data poisoning. Advances in Neural Information Processing Systems. 35:27374-27386, 2022.
[34] Yixin Liu, Kaidi Xu, Xun Chen, and Lichao Sun. Stable unlearnable example: Enhancing the robustness of unlearnable examples via stahle arrommiin noise. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 3783-3791, 2024.
[35] Fengchun Qiao, Long Zhao, and Xi Peng. Learning to leam single domain generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2256-12565. 2020.
[36] Gezheng Xu, Li Yi. Pengcheng Xu, Jiaqi Li, Ruizhi Pu, Changjian Shui, Charles Ling, A Ian McLeod, and Boyu Wang. Unraveling the mysteries of label noise in source- free domain adaptation: Theory and practice. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025.
12

---

[37] Gezheng Xu, Hui Guo. Li Yi, Charles Ling, Boyu Wang, and Grace Yi. Revisiting source-free free domain adaptation: new perspective via uncertainty control. In The Thirteenth International Conference on Learning Reprexentatinns 2024.
[38] Qiuhao Zeng, Wei Wang. Fan Zhou, Charles Ling, and Boyu Wang. Foresee what you will learn: data augmentation for domain generalization in non-stationary environment. In Proceedings of the AAAI conference on artificial intelligence, volume 37, pages 11147-11155, 2023.
[39] Ruiyi Fang, Bingheng Li, Jingyu Zhao, Ruizhi Pu, Qiuhao Zeng, Gezheng Xu, Charles Ling, and Boyu Wang. Homophily enhanced graph domain adaptation. Forty-Second International Conference Muchine Learning, 2025.
[40] Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversarial perturhations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4422-4431, 2018.
[41] Xuefeng Gao, Hoang M. Nguyen, and Lingjiong Zhu. Wasserstein convergence guarantees for general class of score-based generative models. Journal of Machine Learning Research, 26(43):1-54, 2025.
[42] Yuwu Lu, Xue Hu, Waikeung Wong, and Haoyu Huang. Collaborative semantic consistency alignment for blended-targe domain adaptation. In Proceedings of the AAAI Conference on Artificial Intelligence. volume 39, pages 1977099999, 2025.
[43] Aude Genevay. Gabriel Peyré, and Marco Cuturi. Learning generative models with sinkhorn divergences. In International Conference Artificial Intelligence and Statistics, pages 1608-1617. PMLR, 2018
[44] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, pages 3748-8763. PMLR, 2021.
[45] Zhong Ji, Zhihao Li, Yan Zhang. Haoran Wang, Yanwei Pang. and Xuelong Li. Hierarchical matching and reasoning for multi-query image retrieval. Neural Networks, 173:106200, 2024.
[46] Zhong Ji, Zhihao Li, Yan Zhang, Yanwei Pang, and Xuelong Li. Visual semantic contextualization network for multi-query image retrieval, IEEE Transactions on Multimedia, 27:7067-7080, 2025.
[47] Raia Hadsell, Sumit Chopra, and Yann LeCun, Dimensionality reduction by learning an invariant mapping. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, volume 2, pages 1735-1742. IEEE, 2006.
[48] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 770-778,
2016.
[49] Derui Wang, Minhui Xue, Bo Li, Scyit Camtope, and Liming Zhu. Provably unlcamable data examples. arXiv preprint arXiv:2405.033/1 0,.316 2024.
[50] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In International Conference on Learning Representations, 2015.
[51] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recogni- tion. arXiv preprint w:Xiv:1409.11 1550, 2014.
[52] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4700-4708, 2017.
[53] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua 7hai, Thomas Unterthiner, Mostafa Dehghami, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words:
Transformers for image recognition scale. arXiv preprint arXiv:2010.
2020.
[54] Shutong Wu, Sizhe Chen, Cihang Xie, and Xiaolin Huang. One-pixel shortcut: On the learning preference of deep neural networks. In International Conference on Learning Representations, 2023.
[55] Terrance DeVries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. arXiv preprint 1705:1708.04552,, 2017.
13

---

[56] Sangdoo Yun. Dongyoon Han. Seong Joon Oh. Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy train strong classifiers with localizable features. In Proceedings of the IEEE International Conference on Computer Vision, pages 6023-6032, 2019.
[57] Hongyi Zhang. Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz, mixup: Beyond empirical risk minimization. International Conference on Learning Representations, 2018.
[58] Aleksander Madry. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018
[59] Yi Yu, Yufei Wang. Song Xia, Wenhan Yang. Shijian Lu. Yap-Peng Tan, and Alex C. Kot. Purify unlearnable examples via rate-constrained variational autoencoders. In International Conference on Machine Learning, pages S7678 - 57702, 2024.
[60] Yifan Zhu, Lijia Yu, and Xiao-Shan Gao. Detection and defense unlearnable examples. Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 17211-17219, 2024.
[61] Maria-Elena Nilsback and Andrew Zisserman. Automated flower classification over a large number of classes. In 2008 Sixth Indian Conference on Computer Vision, Graphics & Image Processing, pages 722-729. IEEE, 2008.
[62] Jonathan Krause, Michael Stark, Jia Deng, and Li Fei-Fei. 3d object representations for fine- tieeggraned categorization. In Proceedings of the IEEE International Conference on Computer Vision Workshops. pages 554-561, 2013.
[63] Lukas Bossard, Matthieu Guillaumin, and Luc Van Gool. Food-101 1ea--10--iinn mining discriminative components with random forests. In European Conference Computer Vision, pages 446-461. Springer, 2014.
[64] Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278 222222327 1998.
[65] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning rexearch, 9(11), 2008.
[66] Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. In Interna- tional Conference Machine Learning, pages 1180 1189. PMLR, 2015.
[67] Bingheng Li, Xuanting Xie. Haoxiang Lei, Ruiyi Fang, and Zhao Kang. Simplified penet with robustness. Neural Networks, 184: 107099, 2025.
14

---

NeurIPS Paper Checklist
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification:
We have presented the contributions and scope in the abstract and introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how be expected to generalize other settings.
much the results
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We have discussed that our method still has limitations.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
15

---

Justification:
This paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification:
Information related the experiment is detailed in the experiment settings
section.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
16

---

Answer: [Yes]
Justification:
Source code will be released to foster the community.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cm
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ ccpppp.ccppulli//guiii wwwiii/gguie///eeeeeeoeic CoodeSubeiiieeee ssi wswinnolli onnolicy)))) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: All relevant settings are described in the experimental settings section.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification:
We report results averaged over five runs with different random seeds.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
17

---

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of enrors is not verified.
For asymmetric distributions, the authors should be careful to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative eтror rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of exccution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We describe the training settings for each experiment in the experimental section.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: sesttp:://euuipps cttpuubicc/thhicceuuuuiiiaooaaee
Answer: [Yes]
Justification:
The research in the paper conforms with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is special consid- cration due to laws or regulations their jurisdiction..
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We explore some possible societal impacts of our method the conclusion.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
18

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
This paper proposes a new data protection method, so there is no safety risk.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: Relevant sources used in this paper appropriately cited.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
19

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Our code will be released foster the community.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/cood/mmodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The experiments in this paper do not include these contents.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The experiments in this article do not involve human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
20

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: The core method development in this research does not involve LLMs as important components.
Guidelines:
The answer NA means that the method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should be described.
21

---

Appendix
This appendix provides comprehensive analysis and in-depth exploration of our proposed Versatile Transferable Generator (VTG).
A
Experimental Details
A.1 More Implementation Details
Implementation of VTG. For the perturbation generator and the domain composer ADA, we employ the Adam optimizer (50) with initial learning rate of 0.001. For different surrogate models, we employ the SGD (64] optimizer with an initial learning rate of 0.1 for ResNet-18 and 0.01 for ViT.
Baseline Types. We conducted a comprehensive comparison against baseline methods, including both class-wise and sample-wise perturbation approaches, as shown in Tables of our paper.
We included comparisons with the class- wise version of EMN and PUE [49].
We compared TUE 7 and LSP [T], two sample-wise methods that exhibit class-wise characteristics their implementations: TUE employs a Class-wise Separability Discrimi- nant produce transferable. linearly separable perturbations, while LSP exhibits class-wise clustering, indicating strong class-dependent structures.
Our comparison also covered three strict sample-wise approaches, including REM 6 GUE [8. and 14A [12].
These comparisons enable comprehensive and fair evaluation of VTG against both class-wise and sasple-wise baselines, where VTG consistently achieves superior performance in various scenarios.
Implementation of Baselines. Since non-gent generetor-baseeee baselines (c.g.. LSP [T]. TUE (7). and REM (6) generate fixed perturbations, first resample these perturbations before applying them to the images to ensure a fair comparison.
(1) In the Cross-Task scenario, when the number of samples differs, generate new perturbation samples using uniform sampling strategy introduced by TUE (7]. thereby ensuring compatibility with the target dataset.
If more classes are required, we interpolate two classes to create new class-wise perturbations:
8 ad; + (1 a)o,, where y: Vj-
(12)
If more samples within one class are required, we interpolate two samples create new sample- wise perturbations:
a + - a)oj, where y: y/j
(13)
Note that and denotes perturbations and class labels; The subscripts denote class indexes; the number of newly created perturbations is controlled by varying a, which is generally set as 0.5.
(2) In the Cross-Space scenario, when resolution mismatch occurs between the fixed perturbations and the target dataset, we resample the perturbations to match the target resolution.
A.2 The Architecture of Perturbation Generator
In the main paper, devise VTG produce transferable perturbations and craft unlearnable exam- ples. We denote our perturbation generator as G. which employs a standard encoder-decoder architec- ture. This structure comprises three down-sampling convolution layers, four residual blocks [48). and three transposed convolution layers. The detailed architecture is shown in Table II
B Additional Experimental Results
B.1 Further Analysis of Perturbations
We further conduct an in-depth analysis the perturbations by examining their spatial dispersion and quantitative data quality, as summarized in Table I2
The Shannon entropy of the perturbations reflects
22

---

Table 11: The architecture of the perturbation generator.
Block Name
Layer
Number
Down-sampling layers
Conv (3 x 3) InstanceNorm ReLU
Conv
3
Bottleneck layers
ReflectionPad
Conv (3 3) BatchNorm
Residual
ReLU
x
ReflectionPad
Conv BatchNorm
Up-sampling layers
ConvTranspose (3 x 3)
Conv ConyTranspose
InstanceNorm
x 2
ReLU
Conv ConyTranspa Transpose (6 x 6)
Conv Transpose
x
Tanh
their spatial dispersion, where higher entropy values indicate that perturbations are more uniformly distributed across spatial regions rather than concentrated in localized areas. Our perturbations achieve an average entropy 6.02 on CIFAR-10 10, substantially higher than those of baseline methods. At the same time, VTG maintains comparable PSNR and SSIM values relative to other baselines, demonstrating high data quality. This globally distributed perturbation pattern mitigates reliance on the object shapes of individual samples and enhances the transferability of unlearnability across diverse scenarios.
Table 12: Quantitative comparison of perturbation properties and image quality.
Metric
EMN
L.SP
TUE
GUE
Ours
Shannon Entropyt
1.47
2.22
3.13
1.96
6.02
PSNR (dB) f
37.06
34.94
34.43
37.72
35.77
SSIM
0.9963
0.9930
0.9869
0.9960
0.9894
B.2 Test Accuracy Curves
In this section, we display the test accuracy curves ResNet-18 48 models trained on the poisoned CIFAR-10 10 dataset under various unlearnable attacks, as shown in Figure 3, It can be observed that other UE methods, particularly EMN 5 exhibit an initial accuracy peak the start of training. In this regard, hackers can employ early stopping to acquire semantics within the training data. Compared with EMN (5] and GUE g our method successfully injects unlearnability at the first epoch, which validates the efficacy of our perturbation generation approach. Additionally, our method exhibits superior unlearnable effects throughout the entire training process, further highlighting effectiveness of our proposed VTG.
B.3 Visualization
T-SNE Visualization. To illustrate the superior transferability of our VTG, we further present the 1-SNE visualization [65], as shown in Figure 4 Our VTG exhibits notable transferability both in Intra-Domaie and Cross-Task scenarios, which leads to the misclassification of clean test samples by the classifier. In contrast, while GUB successfully generates unlearnable perturbations within the CIFAR- 10 Sitra-Dmaain scenario, it fails to transfer the unlcarnability of generated perturbations
23

---

CIFAR 10 CIRAR:
Test Accuracy Curve
50-
EMN
GUB
Our
Ours
Accuracy
50-
CIFAR-100 CIFAR 10
94.28%
10
Clean
10
30
Epochs
Figure 4: t-SNE visualization of classifier's last layer features, where classifiers are trained on the poisoned training set and tested the clean test set. In the first row, perturbations are trained and tested CIFAR-10 10. In the second row, perturba- tions are trained on CIFAR- 100 and transferred to CIFAR-10.
Figure 3: Test accuracy curves of ResNet- 18 trained on poisoned CIFAR-10 10 under the Intra- Domain scenario with different unlearnable ex- ample methods.
Clean
9
5
4
7
5
Ours
9
4
7
5
MNIST
MNIST-M
Clean
23
3
63
28
5 5
Ours
2
63
28
SVHN
SYN
Figure 5: Visualization of clean images and unlearnable examples generated by VTG on MNIST, MNIST-M, SVHN, and SYN datasets.
from CIFAR-100 1100 to CIFAR-10 in the Cross-Task scenario, thereby compromising the protection of real semantics in the target dataset.
Perturbed Image Visualization. Besides visualizations in Section 4.6 we provide more demon-
strations on the Digits dataset. including MNIST (64), MNIST-M [66], SVHN [4] and SYN (66). Similarly, utilize the CIFAR-10 10 dataset [ source to train VTG, then transfer it to tar- get datasets and visualize the crafted unlearnable examples. As illustrated in Figure [ the results demonstrate that the perturbations generated by VTG are generally invisible human eyes.
B.4 Cross-Space Results on Digital Dataset
We further evaluate the transfer performance of VTG on Digital datasets, including MNIST (64.
MNIST-M (66), and SYN (6). As shown in Table [3] VTG consistently outperforms baseline meth- ods and exhibits substantial average improvement, further verifying its remarkable transfcrability.
24

---

Table 13: Test accuracy ResNet-18 under the Cross-Space scenario, with Digits as target datasets.
Digits MNIST-M
Source Datasct
Method
MNIST
SYN
Avg.
Clean
99.61
100.00
97.90
99.17
Random
99.60
99.01
97.65
98.75
LSP I
9.83
9.95
97.75
39.18
TUE 7
33.15
27.57
10.05
23.59
CIFAR-10
GUE 8
9.74
55,47
98.05
54.42
Ours
9.93
10.15
9.65
9.91
LSP |
9.80
9.28
96.25
38.44
TUE 7
33.69
38.75
10.15
27.53
CIFAR-100
GUE
21.75
99.02
97.95
72.91
Ours
9.82
10.44
10.60
10.29
LSP 11
9.74
10.21
95.65
38.53
TUE 7
8.93
44.16
77.40
43.50
SVHN
GUE
10.28
66.60
96.70
57.86
Ours
10.28
9.74
40.45
22.92
14A [12 97.05
30.06
79.70
68.94
ImageNet*
Ours
10.08
73.00
97.90
60.33
B,5 More Analyses with Defenses
Details of Defense Strategies. We conduct series of experiments evaluate the effectiveness of VTG against different defense strategies. For data transformation, we employ Cutout (55), CutMix [56), and Mixup (57). For adversarial training, which generally enhances robustness against adversarial perturbations 67 we utilize PGD-10 [58] with poison radius 4/255 and a step size of 2/255.
Table 14: Test accuracy of ResNet- 18 under the Intra-Domain scenario with our VTG, Different defense strategies applied, with "AT" denoting Adversarial Training.
Dataset
w/o
Cutout
CutMix
Mixup
AT
CIFAR-100
1.14
1.29
1.20
2.40
1.98
SVHN
6.38
8.97
9.15
9.69
7.75
Defenses under the Intra-Domain Scenario. our supplementary experiments, we evaluate the robustness of our approach under the Intra-Domain scenario using CIFAR-100 and SVHN as datasets. As shown in Table [4] our method consistently maintains a strong unlearnable effect across all defense strategies, effectively reducing model performance to levels approaching random guessing. This demonstrates the robustness and superiority of our approach in preserving unlearnability under varied
defense strategies.
Defenses under the Cross-Task Scenario. Moreover, we assess VTG's resilience defenses under the Cross-Task scenario. As illustrated in Table 15 VTG consistently induces a significant unlearnability effect across diverse source-target pairs. For example, when CIFAR-10 used as the source dataset and CIFAR- 100 or SVHN the target, VTG reduces test accuracy to extremely low levels, with similar patterns observed when CIFAR-100 and SVHN serve as sources. These findings substantiate that, even under the more demanding Cross- Task conditions, VTG effectivvly degrades model performance to levels approaching random guessing, thereby demonstrating its superior capacity preserve unlearnability across diverse defense strategies.
B.6 More Ablation Studies
Ablation Studies with Adversarial Training. To assess the contribution of each component of our VTG to its robustness against adversarial training, conducted an ablation experiment CIFAR- 10.
25

---

Table 15: Test accuracy of ResNet-18 under the Cross-Task scenario with our VTG. Different defense strategies are applied, with "AT" denoting Adversarial Training.
Source Dataset
Target Dataset
w/o
Cutout
CutMix
Mixup
AT
CIFAR-100
0.99
0.93
1.28
1.47
1.33
CIFAR-10
SVHN
9.70
15.88
9.92
6.28
9.18
CIFAR-10
9.85
10.14
10.09
13.14
11.86
CIFAR-100
SVHN
11.07
15.94
8.72
19.59
16.08
CIFAR-10
10.66
10.43
9.52
69.70
89.08
SVHN
CIFAR- 100
1.76
41.81
10.38
34.13
55.01
Table 16 presents the results of this study. With only the baseline PG, the test accuracy is 13.27%, indicating a moderate unlearnability effect. The incorporation of ADA (Variant 2) improves this effect, reducing the accuracy to 10. 10.17%, while the inclusion of PL.C (Variant 3) yields accuracy of 11.72%. Notably, when both ADA and PLC are integrated with PG (Ours), the test accuracy further decreases 9. 9.79%, demonstrating synergistic improvement. These findings indicate that while the baseline generator provides some robustness against adversarial training, the additional components further enhance the unlearnability of the generated perturbations.
Table 16:
Ablation study the impact of individual components under adversarial training for our VTG. "PG", "ADA", and "PLC" denote the vanilla perturbation generator, Adversarial Domain Augmentation, and Perturbation-Label Coupling, respectively. All variants trained CIFAR-10 and evaluated under the Intra-Domain scenario with ResNet-18.
Variant
PG
ADA
PLC
AT Radius
Accuracy
1
4/255
13.27
2
V
V
4/255
10.17
3
V
4/255
11.72
Ours
4/255
9.79
Ablation Studies the Strength of Perturbations. We conduct series of ablation studies by varying the noise strength in the sora-Domain scenario and the Cross-Task scenario, as shown in T7 Overall, unlearnabilityy is approaching chance level as perturbation strength increases, while the imperceptibilityy to human eyes correspondingly degrades.
Table 17: Ablation study on perturbation strengths, with ResNet-18 18 as the surrogate model.
Source Dataset
Target Dataset
2/255
4/255
8/255
16/255
CIFAR-10 CIFAR-10
CIFAR-10
11.88
10.00
9.99
10.03
CIFAR- -00
1.54
1.49
0.99
1.23
CIFAR-10
SVHN 9.71
15.12
9.65
6.52
Ablation Studies ADA. To further validate the role of ADA in boosting the transferability of perturbations, we replace ADA with commonly adopted data augmentation techniques, including Cutout (55). Cutmix (56). and Mixup [57]. As shown in Table T8] ADA consistently outperforms these standard augmentations, especially for cross-task transfer (e.g., CIFAR-10 to CIFAR-100), while other augmentation strategies perform poorly this transfer scenario. This observation highlights the effectiveness of ADA in crafting transferable unlearnable examples across various scenarios.
Ablation Studies Wasserstein Distance. We adopt the Wasserstein distance in ADA for its ability to capture high-order distributional characteristics. It efficiently computed via the Sinkhorn algorithm with minimal overhead. In contrast, simple metries (e.g., L2 distance) only capture point- wise discrepancies and mean shifts, overlooking high-order information essential for quantifying domain shifts. We report results in Table and exclude PL.C for better clarity.
A Ablation studies on the pre-trained text encoder of PL.C. To assess the sensitivity of our approach to text encoders pretrained on different datasets in PLC, we conduct ablation studies using several
26

---

Table 18: Ablation studies of ADA against standard data augmentation strategies under the Intra- Domain and Cross Task scenarios, where ResNet- 18 is used as the surrogate model.
Source Dataset
Target Dataset
Cutout
Cutmix
Mixup
ADA (Ours)
CIFAR-I0
CIFAR-I0
12.93
10.52
11.25
9.99
CIFAR-I0
CIFAR-100
8.12
7.83
2.87
0.99
CIFAR-10
SVHN
19.59
16.27
10.66
9.65
CIFAR-100
CIFAR-10
19.57
13.85
13.20
9.85
CIFAR-100
CIFAR-100
3.06
14.98
4.05
1.14
CIFAR-100
SVHN
23.81
18.07
18.90
11.07
SVHN
SVHN
14.68
10.48
14.79
10.66
SVHN
CIFAR-I00
47.06
3.31
6.96
1.76
SVHN
SVHN
15.06
15.94
11.07
6.38
Table 19: Comparison of distance metrics ADA, with ResNet- the surrogate model.
Source Dataset
CIFAR-10
SVHN CIFAR-100
WO ADA L.2 Distance Wasserstein
CIFAR-10
16.53
10.19
9.91
CIFAR-10
14.33
4.56
9.93
CIFAR-10
10.92
3.36
7.07
CLIP variants trained on diverse corpora (YFCC-15M, CC12M, and LAION-400M), Additionally, include the multi-modal model BLIP for further comparison. All models are kept fixed and are employed solely to extract label embeddings within the PLC mechanism. The results, summarized in Table 20 show that across all settings, the generated unlearnable examples consistently reduce model performance to near random sundom-guessing levels. This indicates that our method is not dependent on a specific CLIP variant or pretraining corpus but instead exploits the general semantic alignment properties inherent to large-scale multi-modal pretraining. Consequently, the PLC mechanism is resistant to -pecifcc artifacts and biases arising from large-scale web pretraining.
Table 20: Impact of text encoders pretrained on different datasets in PLC on unlearnable performance.
Label Encoder
CIFAR-10 CIFAR-10 CIFAR-10 CIFAR-100 CIFAR-10 SVHN
CLIP (YFCC-15M) CLIP (CC12M)
12.72
1.03
9.21
10.02
1.71
8.62
BLIP (14M)
10.54
2.03
8.62
CLIP (LAION-400M
9.99
0.99
9.65
Ablation studies on PLC loss weightings. We conduct ablation studies on different PLC loss weightings in the Cross-Space scenario, as shown Table 2T] The results show that removing the PLC loss leads to the worst performance, confirming its necessity. Meanwhile, varying the PLC weight has a relatively minor impact, indicating the stability of our method to this hyperparameter.
Ablation studies on the depth of the generator. To examine the effect of generator depth, we train four generator variants containing 4, 8, and residual blocks. The source dataset CIFAR- 10, and the target datasets are CIFAR- 10, CIFAR- 100, and SVHN. As shown in Table [2] all variants reduce test accuracy to near random- -uuessingg levels, indicating that unlearnability performance is largely consistent across different generator depths.
B.7 Impact of Training Ratio
In the context of Intra-Domain transferability, we split the original training dataset, designating portion of samples as the source training dataset and the remaining samples as the target training set. Results presented in Table demonstrate that the ratio the source training dataset to the overall training dataset exerts an insignificant influence the unlearnable effects of our VTG. Leveraging the collaborative effects of Adversarial Domain Augmentation and Perturbation-Laate Coupling, our method can generate highly effective unlearnable perturbations with limited training data, which
27

---

Table 21: Performance with varying PLC loss weightings under the Cross-Space scenario, with CIFAR-10 and PACS being utilized as the source and target dataset, respectively.
PLC Weight
Source Dataset
Art
Cartoon
Photo
Sketch
0
CIFAR-10
22.60
22.32
16.88
20.27
1.0
CIFAR-10
11.98
10.71
11.25
4.69
2.0
CIFAR-10
9.13
18.75
10.00
4.43
Table 22: Effect of generator depth unlearnable performance.
Depth
CIFAR-I0 CIFAR-10
CIFAR-IO CIFARI00 CIFAR-10 SVHNN
2
11.63
1.11
9.57
4
9.99
0.99
9.65
8
10.05
1.22
9.35
16
8.11
1.22
8.69
Table 23: Ablation study on the selected portion of the source dataset in the Intra-Domain scenario. A portion value of indicates the use of random noise as input.
Portion
0.1
0.2
0.3
0.4
Test accuracy
95.57
10.09
10.03
10.01
9.99
Portion
0.5
0.6
0.7
0.8
0.9
Test accuracy
9.99
10.02
10.01
9.99
10.09
efficiently introduces unlearnability and prevents classification models from extracting meaningful semantics from the protected dataset.
B.8 Training Time Comparison
Table 24: Training time comparison (slepoch) with ResNet-18 as the surrogate model.
Method CIFAR10 Training Time
SVHN Training Time
EMN
18.72
32.50
TUE
22.12
55.77
GUE
644.97
719.31
14A
1158.09
1690.09
Ours
46.60
65.72
To evaluate the training cost in practical scenarios, we report the per-epoch training time on CIFAR-10 (50,000 samples) and SVHN (73,257 samples), comparing method with both gradient-bart based baselines (EMN, TUE) and generator-based baselines (GUE, 14A). All experiments are conducted on single NVIDIA RTX A5000 GPU. As shown in Table 24 gradient-based methods require less training time to obtain unlearnable perturbations; however, their applicability to new classes and unseen samples is limited. In contrast, generator-based methods incur higher training are capable of crafting unlearnable examples for novel data, thereby exhibiting superior practical applicability. We observe that our method incurs a moderately higher training cost than EMN (5) and TUE [7], yet demonstrates greater transferability across diverse scenarios. Compared with GUE (which relies on implicit gradients) and 14A (which employs a much larger generator, 121.13M vs. 0.09M parameters), our approach achieves superior efficiency and transferability.
but
28


Reviews:
[{"review_id": "zMor3XRp5Z", "reviewer": "Reviewer_K9MH", "summary": "This paper proposes a transferable generator to safeguard data across various conditions. The proposed method improves its generalizability to unseen scenarios by integrating adversarial domain augmentation into the generator’s training process. The generator becomes less dependent on data-specific representations, improving its transferability to unseen conditions. In addition, contrastive learning was leveraged to align perturbations with class labels. This approach reduces the generator’s reliance on data semantics, allowing the proposed method to produce unlearnable perturbations in a distribution-agnostic manner.", "questions": "please refer to the Weakness part", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strength\n1. The transferability of unlearnable examples is very important to real safeguard individual privacy. This paper introduces comprehensive transferable evaluation framework, including Intra-Domain, cross-domain, cross-task, and cross-space, and cross-architecture. \n2. The proposed method uses the domain composer to generate novel domains lying outside the original distribution, so the generator becomes less dependent on data-specific representations, improving its transferability to unseen conditions. \n3. The paper is well-written with a clear logical flow. The experimental results are promising, demonstrating the superior performance and wide applicability of the proposed approach across various scenarios.\n\nWeakness\n1. Although the quantitative evaluation results of the paper show a significant improvement in transferability of the proposed method, there is a lack of comparison in terms of visual quality of images or subjective evaluation metrics. This is crucial because, in addition to untrainable aspects, data quality is also very important in unlearnable examples.\n2. The proposed method requires a generator to create perturbations at test time, resulting in computational overhead during deployment.\n3. The proposed study includes empirical validation but lacks a thorough theoretical analysis of the diversity of generated samples or the influence of out-of-distribution samples on the transferability of the proposed method.", "was_revised": true, "final_justification": "The rebuttal has addressed most of my concerns. After reviewing the other feedback, I am willing to raise my rating.", "rebuttal": "We thank reviewer K9MH for the positive feedback and valuable suggestions. Below we provide responses to each weakness.\n\n**W1:** We emphasize that our perturbed images exhibit comparable visual quality to existing unlearnable example (UE) methods, and remain sufficiently clear for semantic interpretation. Due to rebuttal policy, we cannot present images to compare their visual quality. However, following your suggestion, we evaluate the quality of perturbed images from two aspects. \n\n**(1) Qualitative visualizations.** We have included some visualizations of the perturbed images in Figure 3 of Supplementary Section 1.4, where we compared the perturbed images with clean images across seven datasets, including CIFAR-10, CIFAR-100, MNIST, MNIST-M, SVHN, SYN, and PACS. The quality of perturbed images is generally acceptable, especially on CIFAR-10 and CIFAR-100. For comparison with other UE methods, please see visualizations in Figure 1 of [1].  \n**(2) Quantitative Evaluations.** To further justify the visual quality of our method, we evaluate the structural similarity between perturbed and clean images using two widely adopted metrics: PSNR [2] and SSIM [3]. These metrics are known to reflect both low-level pixel fidelity and high-level structural consistency. As shown in the table below, we report the average values computed on 100 image samples of CIFAR10. The quality of our perturbed images is relatively comparable to existing UE methods.\n\n|Method | EMN   | LSP   | TUE   | GUE   | Ours  |\n| :---: |  :-:   | :-:   | :-:   | :-:   | :--:  |\n|PSNR (dB) ↑| 37.06 | 34.94 | 34.43 | **37.72** | 35.77 |\n| SSIM ↑  |  **0.9963** | 0.9930 | 0.9869| 0.9960 | 0.9894 |\n\n**W2:** We acknowledge that the generator structure introduces additional computational overhead during deployment, which we have identified as a limitation and discussed in the Conclusion section. In addition, we also compared the efficiency of VTG  against two other generator-based approaches, and the results are shown in Table 9 in our supplementary. It can be observed that **our generator is small in size (0.09M parameters)**. Owing to its lightweight structure, **it also generates perturbations efficiently (requiring only 0.4 ms per image)**. This indicates that VTG incurs minimal computational overhead at inference while effectively introducing unlearnability across diverse scenarios. We will include above inference cost analyses in the updated paper for better presentation. \n\n**W3:** We sincerely thank the reviewer for this insightful observation. We acknowledge that the theoretical analysis on the diversity of generated samples is indeed critical for a complete understanding of our transferability-focused UE framework. On the other hand, we would like to note that the theoretical analysis of UEs in the context of transferability is inherently challenging. To the best of our knowledge, no existing work has addressed this issue. We consider this a core focus of our future work. \n\nAs a preliminary step toward this goal, we provide a theoretical understanding of our method through the lens of the Wasserstein distance between real samples and generated diversified samples. \n\nSpecifically, given a predictor $f$, for any distributions $\\mathbb{P}_a$ and $\\mathbb{P}_b$, it can be shown that for any $0<\\delta<1$, the following holds with probability at least $1-\\delta$ [4]: \n$$\\underset{(x,y)\\sim\\mathbb{P}_b}{\\mathbb{E}}\\mathcal{L}(f(x),y) \\le \\underset{(x,y)\\sim\\mathbb{\\hat{P}}_a}{\\mathbb{E}}\\mathcal{L}(f(x),y)+W_d(\\mathbb{\\hat{P}}_a, \\mathbb{\\hat{P}}_b)+\\mathcal{O}(\\sqrt{\\frac{\\log (1/\\delta)}{N_a}},\\sqrt{\\frac{\\log (1/\\delta)}{N_b}}),$$ \nwhere $\\mathcal{L}$ is a loss function (e.g., cross-entropy loss), $\\mathbb{\\hat{P}}$ is the empirical counterpart of $\\mathbb{{P}}$ (i.e., a data set sampled from $\\mathbb{{P}}$), $N_a$ and $N_b$ are, respectively, the sample size of $\\mathbb{\\hat{P}}_a$ and $\\mathbb{\\hat{P}}_b$. The inequality reveals that we can upper bound the expected loss of $\\mathbb{{P}}_b$ in terms of the empirical loss on $\\mathbb{\\hat{P}}_a$ and their empirical Wasserstein distance $W_d(\\mathbb{\\hat{P}}_a, \\mathbb{\\hat{P}}_b)$.\n    \nFor the problem studied in this work, however, we cannot estimate $W_d(\\mathbb{\\hat{P}}_a, \\mathbb{\\hat{P}}_b)$, since we only have a training set $\\mathbb{\\hat{P}}_a$, but the test data $\\mathbb{\\hat{P}}_b$ is unknown. As our objective is to enhance the transferability in various distinct scenarios, we address this issue by training a domain composer $\\mathcal{C}\\_{\\mu}$ to synthesize the worst-case out-of-distribution [5, 6] samples: \n$${\\mu} = \\underset{\\mu}{\\arg\\max} \\mathcal{W}_d(\\mathcal{C}\\_{\\mu}({x}), {x}).$$ In practice, the computation of $\\mathcal{W}_d(\\mathcal{C}\\_{\\mu}({x}),x)$ involves a linear programming problem whose cost is prohibitive, and therefore we adopt the Sinkhorn distance [7, 8] as defined in Eq. (3) in our paper. Additionally, it can be shown that under certain conditions, the Sinkhorn distance is equivalent to the Wasserstein distance [7, 8]. Putting all together, we can show that, the following holds with probability at least $1-\\delta$:\n$$\\underset{x\\sim \\mathcal{C}\\_\\mu(x)}{\\mathbb{E}}\\mathcal{L}(f(x),y) \\le \\underset{(x,y)\\sim\\mathbb{\\hat{P}}_a}{\\mathbb{E}}\\mathcal{L}(f(x),y)+W_d(\\mathcal{C}\\_\\mu(x), x)+\\mathcal{O}(\\sqrt{\\frac{\\log (1/\\delta)}{N_a}}).        \\qquad     (*)$$\n    \nIn summary, our domain composer leverages Wasserstein distance to generate worst-case samples and its diversity can be roughly analyzed via Eq. (*) by examining the loss on synthetic samples. On the other hand, we note that this analysis is only an initial step. For example, it does not examine how the composer $\\mathcal{C}_\\mu$ affects the transferability of the noise $\\delta$. Besides, conducting a lower-bound analysis of the loss is also a promising direction for improving our understanding of sample diversity and noise transferability.\n\n\n[1] Detecting and Corrupting Convolution-based Unlearnable Examples. AAAI 2025.\n\n[2] Scope of validity of PSNR in image/video quality assessment. Electronics Letters 2008.\n\n[3] Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing 2004.\n\n[4] Theoretical Analysis of Domain Adaptation with Optimal Transport. ECML 2017\n    \n[5] Certifying Some Distributional Robustness with Principled Adversarial Training. ICLR 2018\n    \n[6] Out-of-Domain Generalization From a Single Source: An Uncertainty Quantification Approach. IEEE TPAMI 2022.\n    \n[7] Sinkhorn Distances: Lightspeed Computation of Optimal Transport. NeurIPS 2013.\n    \n[8] Learning Generative Models with Sinkhorn Divergences. AISTATS 2018."}, {"review_id": "STH3uGhnGq", "reviewer": "Reviewer_pQ4b", "summary": "This paper aims to improve the transferability of unlearnable examples across various scenarios. It combines Adversarial Domain Augmentations and the Perturbation-Label Coupling mechanism to train a Versatile Transferable Generator. The trained generator generalizes very well to unseen data from multiple domains.", "questions": "How do you generate EMN and TUE perturbations for the target training data since both of them are neither generator-based methods like GUE, 14A, nor label-determined methods like LSP?", "limitations": "yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 4, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1. This paper systematically benchmarks the transferability of unlearnable examples across multiple scenarios, including intra-domain, cross-domain, cross-task, cross-space, and cross-architecture, which is very important for applying UEs as a practical real-world data protection tool.\n\n2. It introduces a novel component, the domain composer, into the UE area, which leads to the enhancement of the domain transferability. \n\n3. The results in Table 8 are impressive, as they show that a generator trained on ImageNet can serve as a \"foundation\" model to execute protections for different domains simultaneously.\n\n4. Experiments are comprehensive. The structure is well-organized. It's easy to read.\n\n\nWeakness:\n\n1. It's unclear why aligning the perturbation feature extracted by a surrogate model with the label feature extracted by the CLIP text encoder can lead to Perturbation-Label Coulpling. This process seems to make perturbations in the same class cluster around a certain point.  I don’t see the CLIP text encoder playing an irreplaceable role here.\n\n2. This paper did not present augmented images after the domain composer $C_\\mu$. I'm curious about how much the composer distorts the clean images and if it works precisely as the illustration (various planes) in Figure 1 shows. \n\n3. The defense part missed diffusion-based purification methods (refer to [1,2,3]).\n\t[1] Diffusion models for adversarial purification.\n\t[2] The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Models.\n        [3] BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection.", "was_revised": true, "final_justification": "I maintained my positive score after the rebuttal.", "rebuttal": "We thank reviewer pQ4b for the positive feedback and valuable suggestions. Below we provide responses to each weakness and question.\n\n**W1:** We would like to clarify the effectiveness of PLC from two aspects. \n\n**(1) The rationale behind Perturbation-Label Coupling.** \nThe goal of PLC is to build strong associations between perturbations and labels, thus introducing shortcuts. To achieve this, we perform direct perturbation-label alignment by aligning the perturbation $\\delta$, rather than the perturbed image $x+\\delta$, with the label $y$, and we name this process as Perturbation-Label Coupling. Perturbations from the same class are clustering around the corresponding labels and are distant from other classes, tricking the model to classify based on the introduced shortcuts. Therefore, PLC improves UE's transferability by reducing reliance on specific data, playing a collaborative role in promoting unlearnability across various scenarios. \n\n**(2) The role of CLIP text encoder.** \n\nWe note that the CLIP text encoder serves two roles and cannot be replaced with any random encoder. \n- **Anchors for perturbations to align with.** As mentioned above, the rationale behind PLC is to establish direct associations between perturbations and labels, where the plug-and-play CLIP text encoder holds exceptional zero-shot capability to encode class labels as anchors in the contrastive alignment paradigm, guiding the optimization of perturbations towards corresponding classes and away from other classes. \n- **Implicit connections with its vast image base.** Another reason for using CLIP text encoder derives from its superior cross-modal associations. It is known that CLIP's label encodings are closely associated with its extensive pre-trained image base. Therefore, by aligning perturbations with CLIP-encoded labels, the perturbation generator is able to implicitly connect with unseen images, which enhances its effectiveness across unseen classes.  \n\n\n**W2:** We appreciate your observation. Our augmented images generated by the domain composer exhibit a similar degree of distributional shift and semantic consistency as the illustrative examples shown in Figure 1. Since we are not allowed to provide images in rebuttal, **we provide quantitative evaluations to confirm that the composer does introduce meaningful domain-level diversity without compromising class semantics**. We use PSNR (Pixel-level Fidelity) [1], SSIM (Structural Similarity) [2], and LPIPS (Perceptual Similarity) [3] to jointly assess the quality of diversified samples, ensuring they remain structurally consistent while exhibiting meaningful domain-level variation. We report average values over 100 randomly sampled augmented images, and include comparisons with both Gaussian-blurred images (as a weak baseline with few domain shifts) and the illustrative examples in Figure 1. Results are summarized below:\n|Metric|Generated Examples|GaussianBlur Examples|Examples in Figure 1| \n|:-:|:-:|:-:|:-:|\n|PSNR(dB)| 18.85| 23.20|16.35|\n|SSIM|0.6039|0.7290|0.5651|\n|LPIPS|0.5131|0.3379|0.5303|\n\nThese results show that the augmentations generated by the domain composer match the examples in Figure 1 in terms of fidelity, distortion, and semantic similarity, which successfully diversifies training samples to optimize more transferable perturbations.\n\n**W3:** We value your advice and add evaluations against diffusion-based purification methods. As the code for BridgePure [4] is not publicly available, we adopt AVATAR [5], a recent representative diffusion-based defense, for comparison. As shown below, diffusion-based defense indeed exhibits strong capabilities in purifying perturbed images into trainable data, where the unlearnability of VTG degrades moderately. This is somewhat expected since VTG does not include specific mechanisms to resist diffusion-based defenses, a limitation shared by existing UE methods. Despite this challenge, VTG still **outperforms other UE methods** under AVATAR, demonstrating **superior robustness**. We consider the resistance of UEs to diffusion-based defense as an important future research direction.\n\n|Defense|Dataset|VTG|EMN|TAP|AR|REM|SHR|\n|:------:|:-----:|:------:|:------:|:------:|:------:|:------:|:------:|\n|AVATAR|CIFAR-10|**34.61**|90.95|90.71|91.57|88.49|85.69|\n||CIFAR-100|**23.40**|65.73|64.99|64.54|64.88|58.52|\n\n\n**Q1:** We note that we use class-wise EMN perturbations and sample-wise TUE perturbations as baselines. The corresponding details for applying them to target datasets were mainly included in Supplementary 1.2. The implementation process can be categorized into two different scenarios. \n\n**(1) For target data with different numbers of classes or samples, we follow the interpolation operation introduced by TUE.**\n \nSpecifically, if more classes are required, we interpolate two classes to create new class-wise perturbations:\n\n$\\delta^* = \\alpha \\delta_i + (1 - \\alpha) \\delta_j, \\text{where } y_i \\neq y_j.$\n\nIf more samples within one class are required, we interpolate two samples to create new sample-wise perturbations:\n\n$\\delta^* = \\alpha \\delta_i + (1 - \\alpha) \\delta_j, \\text{where } y_i = y_j.$\n\nThe subscripts denote class indexes, and the number of newly created perturbations is controlled by varying $\\alpha$, which is generally set as 0.5.\n\n**(2) For target data with different resolutions, we simply resample the perturbations to match the resolution of the target dataset.**\n\n[1] Scope of validity of PSNR in image/video quality assessment. Electronics Letters 2008.\n\n[2] Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing 2004.\n\n[3] Investigating loss functions for extreme super-resolution. CVPRW 2020.\n\n[4] BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection. arXiv 2024.\n\n[5] The devil’s advocate: Shattering the illusion of unexploitable data using diffusion models. IEEE SaTML 2024."}, {"review_id": "QhxieXEmqd", "reviewer": "Reviewer_Dthy", "summary": "The paper studies the problem of generating unlearnable examples by perturbing the data. The idea is that we want to perturb inputs such that when you train a classifier on these inputs, it does not learn the semantics, and only learns the features of the perturbation. Compared to prior work, the authors propose a more rigorous evaluation framework where the perturbation generator is learned in one source task, and then applied to other target tasks that are unknown during training. They propose Versatile Transferable unlearnable example Generator (VTG), which is a complex method for training the perturbation generator. They show that VTG achieves superior unlearnability performance compared to prior state of the art in several of their evaluation settings.", "questions": "**Q1.** Please comment on W2.\n\n**Q2.** Do I understand that the Adversarial Domain Augmentation could in principle be replaced with any other data augmentation strategy? If so, I would suggest to abstract it away in the presentation of the method, and present it after the core part of the method. I.e. you could just say that the first loop in your method is to train a classifier on the original data, with any strategy you may like. You could also ablate different kinds of augmentation strategies potentially (I am not requesting this for the rebuttal, just a suggestion).\n\n**Q3.** What is Concat in Eq. (5)? Are you concating the images, or are you just aggregating the dataset across all augmentations? I think it's the latter, but then the notation is confusing.\n\n**Q4.** Overall, it wasn't clear to me how the objectives (4) and (5) interact with each other? Do you first train against (4) for some number of steps and then train against (5)? Or do you train against a combination of both (4) and (5) simultaneously? \n\n**Q5.** Could you present examples of what augmentations $C_\\mu$ actually learns? I am not sure if you can put images in the rebuttal, but please include these in the updated versions of the paper, and describe in text in the rebuttal, if not.\n\n**Q6.** I found the CLIP-based contrastive learning bit quite confusing. Is there any reason for the encodings of the classifier to be aligned with the text encoder of CLIP? In theory, they don't even need to be of the same dimension? My understanding is that $z_\\theta$ is a part of the classifier $f_\\theta$, and that it is frozen during the training on objective (9)? Overall, what is the motivation here, why do you want to use the image embedding?\n\n**Q7.** In the experiments, are all the models (domain composer, classifier, perturbation generator) trained from scratch? Is CLIP text encoder the only pretrained model used?\n\n**Q8.** At test time, is the perturbation generator $G$ only conditioned on the input image? It is not using the labels or any other information?\n\n**Q9.** What are the limitations on the scalability of the method? Is it possible to apply it to the full ImageNet, as opposed to the first 100 classes? How does the runtime for training compare to the baselines? (not request for rebuttal, just a question)\n\n**Q10.** When tuning the hyper-parameters such as the weights for the different losses, learning rates, etc, do you use the performance on the in-domain test set as a target?", "limitations": "Limitations adequately addressed.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "For calibration,  I want to mention that I was previously not aware of the field of generating unlearnable perturbations, and so I am not familiar with the prior work in this field.\n\n# Strengths\n\n**S1.** The evaluation setting that the authors develop appears to be more realistic than the evaluations done in the previous literature. It seems important to evaluate unlearnability under diverse tasks.\n\n**S2.** The authors do a careful evaluation with many baselines and evaluation settings.\n\n**S3.** The authors perform an ablation of the various components of the method suggesting that the different components are indeed useful.\n\n**S4.** The proposed method performs well in the evaluations presented by the authors, outperforming the baselines significantly in most of the distribution shift settings.\n\n**S5.** The paper is generally well-written.\n\n# Weaknesses\n\n**W1.** The proposed VTG method is quite complicated, and it's hard to understand what exactly each component is doing. I will ask several questions about the method in the questions section. But overall, I feel like the presentation of the method does not do a good enough job of explaining what is the motivation behind each component and how all of them fit together.\n\n**W2.** The only metric that is considered in evaluation is the test accuracy, which should be as low as possible. Generally, it is very easy to generate perturbations that lead to poor accuracy: $\\delta(x) = G(x) = -x$. You would get exactly random guess performance on any data distribution by applying this perturbation. Consequently, what makes the task non-trivial is that there should be some constraint on what the perturbation should be. The authors mention that the perturbation should be imperceptible, which seems like a reasonable requirement: if you want to apply the perturbations to the images you upload to the internet, you don't want the images to be visibly affected. The authors do incorporate a hinge loss on the size of the perturbation in Eq. (7), towards this goal. However, the imperceptability of the perturbations is not a part of the evaluations, as far as I understand. In particular, if I understand correctly, the perturbations could actually be quite large, if the optimization pressure is insufficient to make them small. Moreover, it is unclear how the size of the perturbations compares to the other baselines considered.\n\nOverall, only using low test accuracy as a measure of performance without any additional constraints on the perturbations seems wrong. Another trivial way to game this objective is to use a very bad classifier, or use inadequate hyper-parameters for the classifier. Possibly there should be constraints such as high train accuracy, and high accuracy when trained on clean data with the same hyper-parameters. Perhaps this last concern is partially evaluated by reusing the same architecture and hyper-parameters for the classifier across all baselines.", "was_revised": true, "final_justification": "The rebuttal addressed my concerns, and so I increase the score to 5. I encourage the authors to include all the new results and clarifications, as well as examples of generated images in the final version of the paper.", "rebuttal": "We thank reviewer Dthy for the positive feedback and valuable suggestions. Below we provide responses to each weakness and question.\n\n**W1:** We will elaborate on the motivation behind each module and the joint roles below.\n\n**(1) Overall Motivation.** Existing UE methods generate perturbations that are highly dependent on specific training data, which results in substantial performance drops when applied to unseen data. To address this issue, we aim to generate unlearnable examples that remain effective across various scenarios. To do so, we design the Versatile Transferable Generator, and incorporate Adversarial Domain Augmentation and Perturbation-Label Coupling to improve transferability by enhancing effectiveness under distribution shifts and reducing reliance on specific data to craft shortcuts.\n\n**(2) Motivation of Adversarial Domain Augmentation.** ADA aims at synthesizing worst-case out-of-distribution samples, which compels the perturbation generator to craft perturbations that remain effective for a more robust surrogate model. As a result, the optimized perturbation generator possesses better transferability and is capable of introducing unlearnability under distribution shifts.\n\n**(3) Motivation of Perturbation-label Coupling.** PLC aims at reducing UE's reliance on specific data when introducing shortcuts, playing a collaborative role in transferring perturbations to unseen samples. Its direct perturbation-label alignment is achieved without relying on data semantics, which improves the effectiveness of the perturbation generator with unseen data.\n\nOverall, VTG is superior in transferability to diverse scenarios by **leveraging ADA's generalizability over distribution shifts and PLC's less reliance on specific data**. We will revise the motivation accordingly in the updated paper for better clarification.\n\n**W2&Q1:** We emphasize that our perturbations are visually imperceptible and do not compromise image quality, and we will make clarifications below.\n\n**(1) The imperceptibility of perturbations.** We consider it from two aspects. \n- **Qualitative Visualizations.** We have included qualitative visualizations of the perturbed images in Figure 3 of Supplementary Section 1.4, where we compared the perturbed images with clean images across seven datasets, including CIFAR-10, CIFAR-100, MNIST, MNIST-M, SVHN, SYN, and PACS. The quality of perturbed images is generally acceptable, especially on CIFAR-10 and CIFAR-100. Since we are not allowed to upload images, please see Figure 1 of [1] for visualizations of other UE methods. \n- **Quantitative Evaluations.** To further justify the visual quality of our method, we add evaluations between perturbed and clean images using two widely adopted metrics: PSNR (Pixel Fidelity) [2] and SSIM (Structural Similarity) [3]. We report the average values computed on 100 perturbed images on CIFAR10 below. Our perturbations are relatively comparable with existing UE methods, indicating that the perturbed images maintain high visual quality.\n\n|Method|EMN|LSP|TUE|GUE|Ours|\n|:-:|:-:|:-:|:-:|:-:|:-:|\n|PSNR (dB) ↑|37.06|34.94|34.43|**37.72**|35.77|\n|SSIM ↑|**0.9963**|0.9930|0.9869|0.9960|0.9894|\n\n**(2) The size of the perturbations compared to other baselines.** We follow the same perturbation size (8/255) as other UE methods [4, 5, 6] for fair comparison.  \n\n**(3) Additional constraints besides low test accuracy.** We clarify that we follow the standard protocol and use the same architectures and hyper-parameters for the classifier as existing UE works [4, 5, 6]. The classifier has good test accuracy if trained on clean data (please see Table 2, Table 3, and Table 8 in the main paper). Moreover, when a classifier is trained on perturbed images and evaluated on clean test images, the training accuracy reaches nearly 100\\%, showing the classifier has learned to classify training samples. However, when testing on clean test samples, its prediction approximates random guessing, indicating the drop in test performance is not due to underfitting but because it's learning shortcuts instead of real semantics.\n\n**Q2:** We would like to clarify from two aspects that the Adversarial Domain Augmentation is important for optimizing transferable perturbations and is not replaceable with some standard data augmentation. \n\n**(1) The core motivation of ADA.** ADA aims at mimicking worst-case scenarios across distribution shifts, so that perturbations that can mislead the more robust surrogate model optimized by ADA are able to remain effective across various scenarios.  \n\n**(2) Empirical Justification.** As shown in the table below, ADA consistently outperforms standard augmentations, especially for cross-task transfer (e.g., CIFAR-10 to CIFAR-100), while other augmentation strategies perform poorly in this transfer scenario. This observation highlights the effectiveness of ADA in improving the transferability of unlearnable examples.\n|Source|Target|Cutout|Cutmix|Mixup|ADA (Ours)|\n|:-:|:-:|:-:|:-:|:-:|:-:|\n|CIFAR-10|CIFAR-10|12.93|10.52|11.25|**9.99**|\n||CIFAR-100|8.12|7.83|2.87|**0.99**|\n||SVHN|19.59|16.27| 10.66|**9.65**|\n|CIFAR-100|CIFAR-10|19.57|13.85|13.20| **9.85**|\n||CIFAR-100|3.06|14.98|4.05| **1.14**|\n||SVHN|23.81|18.07|18.90|**11.07**|\n|SVHN|CIFAR-10|14.68|10.48|14.79|**10.66**|\n||CIFAR-100|47.06|3.31|6.96| **1.76**|\n||SVHN|15.06|15.94|11.07|**6.38**|\n\n**Q3:** We clarify that in Eq. (5), Concat does refer to aggregating the original and augmented samples within each mini-batch. We revise Eq. (5) as follows for better clarification:\n$$\\underset{\\theta,\\mu}{\\arg \\min}[ \\mathcal{L}\\_{\\mathrm{CE}}\\left(f\\_{\\theta}\\left( x+\\delta \\right), y \\right) +\\mathcal{L}\\_{\\mathrm{CE}}\\left(f\\_{\\theta}\\left( C\\_{\\mu}\\left(x\\right)+\\delta \\right), y \\right)],\n$$\n\n**Q4:** We note that **the two objectives are optimized sequentially** rather than jointly. We first use Eq. (4) to optimize the domain composer $C_\\mu$ to generate diversified samples, and then use Eq. (5) to train the composer $C_\\mu$ and the classifier $f_\\theta$ with the cross-entropy loss, which prevents $C_\\mu$ from over-distorting the images to other classes. \n\n**Q5:** Since we are unable to include images in the rebuttal, we clarify that the augmented samples generated by our domain composer exhibit similar visual diversity and semantic consistency as those shown in Figure 1. To support this, we compute PSNR, SSIM, and LPIPS (Perceptual Similarity) [7] over 100 randomly selected samples as below. Figure 1 examples are representative samples that contain desirable domain shifts, while Gaussian-blurred examples serve as a weaker baseline with fewer domain shifts.\n\n|Metric|Generated Examples|GaussianBlur Examples|Examples in Figure 1| \n|:-:|:-:|:-:|:-:|\n|PSNR(dB)|18.85|23.20|16.35|\n|SSIM|0.6039|0.7290|0.5651|\n|LPIPS|0.5131|0.3379|0.5303|\n\nThese results show that the augmentations generated by the domain composer match the examples in Figure 1 in terms of fidelity, distortion, and semantic similarity, which successfully diversifies training samples to optimize more transferable perturbations.\n\n**Q6:** We clarify that we use the feature extractor $z_\\theta$ within the classifier $f_\\theta$ to encode perturbations instead of images. We also leverage CLIP text encoder to obtain label embeddings. Both the feature extractor $z_\\theta$ and CLIP text encoder are kept frozen during optimization of Eq. (9). **The motivation behind PLC is to reduce reliance on specific samples when generating perturbations.** As a result, strong perturbation-label associations are established, enhancing the transferability of unlearnable examples.\n\n**Q7:** Yes. We clarify that the domain composer, the surrogate classifier, and the perturbation generator are all trained from scratch, while the CLIP text encoder is the only pretrained model and is kept frozen.\n\n**Q8:** Yes. We note that the perturbation generator only receives raw images as input and produces corresponding perturbations. There are no labels or other information.\n\n**Q9:** We clarify that the limitation on the scalability of our method mainly derives from the moderately increased training time compared to gradient-based methods. \n\n**For runtime comparison**, we report the per-epoch training time on CIFAR-10 (50000 samples) and SVHN (73257 samples), and compare it against gradient-based baselines (EMN, TUE) and generator-based baselines (GUE, 14A). All experiments are conducted on a single NVIDIA RTX A5000 GPU. While our method has a moderately higher training cost than EMN and TUE, it holds greater transferability across various scenarios. When compared with GUE (requiring implicit gradient) and 14A (using a much larger generator, 121.13M vs. our 0.09M), our method is superior in both efficiency and transferability. \n\n**Regarding full ImageNet**, our method is fully compatible with large-scale datasets like ImageNet. Due to time and computational constraints during the rebuttal period, we are currently unable to provide results using a full 1000-class ImageNet.\n|Method|CIFAR10 Training Time (s/epoch)|SVHN Training Time (s/epoch)|\n|:-:|:-:|:-:|\n|EMN|18.72|32.50|\n|TUE|22.12|55.77|\n|GUE|644.97|719.31|\n|14A|1158.09|1690.09|\n|Ours|46.60|65.72|\n\n**Q10:** Yes, we used performance on the Intra-Domain test set to tune the hyper-parameters. Since our VTG targets transferability, we also used evaluations on the Cross-Task and Cross-Space scenarios. \n\n[1] Detecting and Corrupting Convolution-based Unlearnable Examples. AAAI 2025.\n\n[2] Scope of validity of PSNR in image/video quality assessment. Electronics Letters 2008.\n\n[3] Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing 2004.\n\n[4] Unlearnable Examples: Making Personal Data Unexploitable. ICLR 2021.\n\n[5] Transferable Unlearnable Examples. ICLR 2023.\n\n[6] Game-Theoretic Unlearnable Example Generator. AAAI 2024.\n\n[7] Investigating loss functions for extreme super-resolution. CVPRW 2020."}, {"review_id": "ATSyBWis77", "reviewer": "Reviewer_bdeR", "summary": "This paper presents a novel framework for generating Unlearnable Examples (UEs) that maintain their effectiveness across diverse machine learning scenarios. In contrast to prior methods, which often fail to generalize beyond the specific conditions of their training data, the proposed Versatile Transferable Generator (VTG) is designed to produce UEs that remain robust across varying tasks, domains, input resolutions, and model architectures. By leveraging two core components—Adversarial Domain Augmentation (ADA) and Perturbation-Label Coupling (PLC)—VTG demonstrates consistent superiority over existing UE approaches across five distinct transferability settings.", "questions": "- Since the method leverages the PLC mechanism, do the generated perturbations tend to resemble class-level patterns rather than being strictly sample-specific?\n- Does the use of CLIP introduce additional vulnerabilities, given its potential biases and limitations inherited from pretraining on large-scale web data?\n- Regarding the results in Table 7, were all defense strategies applied simultaneously during the generation of the perturbed data, or was each evaluated defense strategy applied individually?", "limitations": "- As stated in the paper, the proposed method introduces additional computational overhead.", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "Strengths:\n\n- The paper is clearly organized and provides thorough explanations of the model architecture, loss functions, training methodology, and datasets used.\n- The proposed method, VTG, is novel and offers a partial solution to a critical challenge in machine learning privacy—the transferability of unlearnable examples. Extensive experiments validate its superiority over existing baselines across five challenging real-world scenarios.\n- The results demonstrate strong resilience against common defense strategies, including adversarial training, which has proven effective against most existing unlearnable example methods.\n\n\nWeaknesses:\n\n- The paper is lack of analyses. Although the results are compelling, there isn't enough theoretical nor empirical analyses such as visualizations to explain why the generated perturbations work.\n- The paper lacks an ablation study. For example, it does not explore how the depth of the generator affects the effectiveness of the attack.\n- The proposed method is compared to other sample-level approaches; however, since it incorporates the PLC mechanism, it raises the question of whether the generated perturbations are closer to class-level patterns. I would expect the authors to provide more clarification on this point.\n- The PLC procedure relies on CLIP to extract text embeddings, which may inherit biases or vulnerabilities from its pretraining data.", "was_revised": true, "final_justification": "After discussions with the authors, my primary concern remains the focus on class-level perturbations. As the authors themselves noted, prior work has shown that class-wise perturbations are easier to detect and recover, which may limit the stealthiness and effectiveness of the attack. Therefore, I will maintain my score as “Borderline Accept.”", "rebuttal": "We thank reviewer bdeR for the positive feedback and valuable suggestions. Below we provide responses to each weakness and question.\n\n**W1:** To better explain why our generated perturbations are effective, we have presented **t-SNE visualizations** in the supplementary material and add **additional empirical analyses on the spatial dispersion of perturbations** in the rebuttal.\n\n**(1) T-SNE visualizations on classifier’s last layer features.** As shown in Supplementary Figure 3, we have presented t-SNE visualizations of model's learned feature representations on the clean test set, after training models on perturbed (unlearnable) data. We observe that GUE still yields well-separated class clusters when transferring perturbations from CIFAR-100 to CIFAR-10, which fails to prevent model from learning real semantics. In contrast, model trained on our unlearnable examples produce entangled and overlapping feature distributions on the clean test data, indicating that the model did not learn useful semantics from the perturbed training set.\n\n**(2) Perturbations' spatial dispersion.** Moreover, we assess the spatial dispersion of perturbations by computing the Shannon entropy of each perturbation map. A higher entropy reflects that the perturbation values are more evenly distributed across spatial locations, rather than being concentrated in localized areas. As shown below, our perturbations achieve an average entropy of 6.02 on CIFAR-10, markedly higher than other baseline methods while keeping comparable data quality (as the PSNR and SSIM metrics show below). **This global coverage reduces reliance on object shapes of specific samples and enhances the transferability of unlearnability across diverse scenarios.**\n|Metric | EMN   | LSP   | TUE   | GUE   | Ours  |\n| :---: |  :-:   | :-:   | :-:   | :-:   | :--:  |\n|Shannon Entropy of Perturbations ↑| 1.47 | 2.22 | 3.13 | 1.96 |**6.02** |\n|PSNR (dB) ↑| 37.06 | 34.94 | 34.43 | **37.72** | 35.77 |\n| SSIM ↑  |  **0.9963** | 0.9930 | 0.9869| 0.9960 | 0.9894 |\n\n**W2:** We add an ablation study on generator depth by training generators with 2, 4, 8, and 16 residual blocks on CIFAR-10, and evaluating their effectiveness on CIFAR-10, CIFAR-100, and SVHN. Results are shown below:\n| Depth  |  CIFAR-10→CIFAR-10 |  CIFAR-10→CIFAR100 |  CIFAR-10→SVHN |\n| :---------: | :-------: | :--------: | :----: |\n| 2           | 11.63   | 1.11     | 9.57 |\n| 4           | 9.99    | 0.99     | 9.65 |\n| 8           | 10.05   | 1.22     | 9.35 |\n| 16          | 8.11    | 1.22     | 8.69 |\n\nWe observe that all variants achieve test accuracy close to the random guess level (10% for CIFAR-10/SVHN, 1% for CIFAR-100). **This indicates that the method is insensitive to the depths of the generator.**\n\n**W3&Q1:** **We clarify that our generated perturbations are indeed class-wise**. Specifically, we first generate perturbations for each sample, then we average the perturbations for each class and add the same perturbations for samples within the same class. This is also in accordance with the Perturbation-Label Coupling (PLC) mechanism that aligns perturbation embeddings with CLIP-encoded class-specific label embeddings. The class-wise perturbations are thus encouraged to cluster towards corresponding class labels, establishing direct and close associations between perturbations and labels.\n\n**W4&Q2:** We appreciate your insightful comment. While we acknowledge that pre-trained models may inherit biases or vulnerabilities from their training data, we believe the impact on our method is minimal. Specifically, **PLC does not use CLIP for prediction; it only leverages CLIP’s frozen text embeddings as a class-level prior to guide the clustering of class-wise perturbations**. This indirect integration limits the propagation of CLIP-specific biases into our model.\n\nTo evaluate whether our approach is sensitive to potential biases from CLIP's pretraining data, we conduct ablation experiments using different CLIP checkpoints trained on different corpora (YFCC-15M, CC12M, and LAION-400M). We also include an alternative multi-modal model (BLIP). All models are solely used to extract label embeddings in the PLC procedure. The results are summarized below:\n| Label Encoder of PLC | CIFAR-10→CIFAR-10  | CIFAR-10→CIFAR-100 | CIFAR-10→SVHN   |\n| :-------------------: | :------: | :------: | :------: |\n|       CLIP (YFCC-15M)        |  12.72   |   1.03   |   9.21   |\n|         CLIP (CC12M)         |  10.02   |   1.71   |   8.62   |\n|         BLIP (14M)       |  10.54   |   2.03   |   8.62   |\n| CLIP (LAION-400M) | 9.99 | 0.99 | 9.65 |\n\nAcross all settings, the generated unlearnable examples consistently reduce model performance to random guess level (10% for CIFAR-10/SVHN, 1% for CIFAR-100). This indicates that **our approach is not reliant on any specific CLIP variant or pretraining corpus, but instead leverages the general semantic alignment inherent in multimodal embeddings**. As a result, the PLC mechanism is robust to dataset-specific artifacts and potential biases arising from large-scale web-based pretraining data.\n\n**Q3:** We clarify that **we follow existing UE works [1, 2, 3] to evaluate each defense strategy individually**.  Defenses such as Cutout, CutMix, and Mixup are mutually exclusive by design, so we apply them independently. \n\n[1] Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compression. ICML 2023.\n\n[2] Purify unlearnable examples via rate-constrained variational autoencoders. ICML 2024.\n\n[3] Detection and defense of unlearnable examples. AAAI 2024."}, {"review_id": "yUhNsejKlD", "reviewer": "Reviewer_mhbh", "summary": "This paper presents a method for generating “unlearnable” examples under feature or label distribution shifts. Unlearnable examples are data points that cause models trained on them to learn the correspondence between labels and perturbations instead of capturing the true semantics, leading to poor classification accuracy on clean test images. The paper proposes training a domain composer to generate out-of-distribution (OOD) data and a perturbation-label coupling mechanism to learn the perturbation generator in a nearly distribution-free setting. Across varying levels of distribution shift in labels or features, the authors demonstrate that their algorithm outperforms existing approaches.", "questions": "What's the difference between data poisoning attack that aims at decreasing test accuracy and generating unlearnable examples?", "limitations": "Yes", "rating": 3, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "**Strengths** \nI find this paper addresses an interesting problem by proposing a novel method and empirically demonstrating its superiority over existing approaches. \n\n**Weaknesses**\n\n- The definition of “unlearnable” in this context is somewhat unclear: success is measured by degraded test accuracy, which is similar to a specific type of clean-label attacks in the data-poisoning literature. \n- Although the goal is to render individual data points “unexploitable/unlearnable” by deep models and thus protect their privacy, the privacy implications of training on these modified “unlearnable” examples remain unexplored. Prior work shows that poisoned examples often exhibit higher memorization scores [1], and because the perturbations here are small, extracting an “unlearnable” example may reveal the original data. In practice, this approach may even worsen privacy, if a company unknowingly trains on poisoned data.\n\n[1] Tramèr et al. Truth Serum: Poisoning Machine Learning Models to Reveal Their Secrets. 2022.", "was_revised": true, "final_justification": "The authors study a setting where data must be released with visual similarity to the original points but rendered useless for training machine learning models. This goal differs from the standard notion of privacy protection, which typically aims to prevent leakage of private (e.g., visual) information about training data from model outputs.\n\nTheir results rely on the strong assumption that the defender can manipulate all examples in the training set. In scenarios where this is not possible, a model may memorize the “outlier” perturbed (unlearnable) data points, potentially increasing privacy leakage for those specific points. However, the results use test accuracy as the only metric, and does not consider the partial-perturbation setting, which makes it less clear whether the proposed method helps provide privacy. \n\nThe paper would also benefit from a clearer statement of the problem setting and motivation, as well as a precise definition of “unlearnable examples.”  I will keep my score and lean toward rejection. However, I am less confident in my assessment due to limited familiarity with this setting, and my main concerns focus on the privacy implications of unlearnable examples, which may be tangential to the paper’s primary contribution of providing a universal, distribution-free generator for unlearnable examples.", "rebuttal": "We thank reviewer mhbh for the positive feedback and valuable suggestions. Below, we provide responses to each weakness and question.\n\n**W1&Q1:** We would like to clarify the difference between data poisoning attacks and unlearnable examples from three aspects [1, 2, 3, 4].\n\n**(1) Different Goals**. Data poisoning is an **attack technique** that aims to manipulate model behavior of specific samples during inference (e.g., causing cats to be misclassified as dogs). In contrast, unlearnable examples are a **defense technique** designed to protect privacy. They introduce imperceptible perturbations, encouraging the model to **rely on perturbations for classification rather than learning meaningful semantic features**. As a result, the model is learning nothing meaningful from unlearnable examples, effectively enhancing privacy protection.\n\n**(2) Different Methodological Designs.** Data poisoning attacks operate as an adversarial game, often employing strategies like feature collision or gradient matching to craft poisoned samples that deliberately collide with target class features. In contrast, **unlearnable examples aim at decouple model learning from real data semantics**, which establishes direct associations between perturbations and labels, instead of images and labels. Therefore, privacy is protected since models are not learning real semantics for classification but relying on perturbations. \n\n**(3) Different Perturbed Ratios for Decreasing Test Accuracy**. While data poisoning and unlearnable examples both decrease the test accuracy, data poisoning attacks typically inject **a small number** of imperceptibly poisoned samples into the training set, aiming to achieve poisoning effect (manipulate model prediction) and remain stealthy. In contrast, unlearnable examples aim at preventing **the entire dataset** from unauthorized exploitation. Therefore, it adds perturbations to each sample and tricks the model to learn perturbations instead of real semantics, leading to good privacy protection.\n\n**W2:** We clarify that unlearnable examples do not increase the risk of privacy leakage. To evaluate whether our method compromises data privacy, we conduct a standard **Membership Inference Attack (MIA) [5]**, which attempts to determine whether a given sample was part of the model’s training set based solely on its outputs. This attack is **widely used as a proxy for measuring privacy leakage**.\n\nWe compare our method against representative UE baselines, including EMN, LSP, TUE, and GUE. Instead of reporting absolute attack accuracy that may vary with dataset and task, we report below each method's difference in MIA accuracy compared to an anchor model trained with clean data. All models are trained and evaluated on CIFAR-10 to ensure consistent and fair comparison.\n\n| Method       | EMN   | LSP   | TUE    | GUE    | Ours   |\n|:------------:|:-----:|:-----:|:------:|:------:|:------:|\n| ΔMIA vs. Clean ↓ | +0.06 | +0.02 | -4.48  | +6.94  | -8.24  |\n\nWe observe that all evaluated UE methods, except GUE, either maintain MIA accuracy at clean baseline levels or further reduce privacy risks. Notably, **our method achieves the greatest reduction in MIA accuracy, indicating strong protection against training data extraction**. Contrary to concerns about data exposure, **our unlearnable perturbations actually enhance the model's resilience to membership inference attacks**. \n\n[1] Unlearnable Examples: Making Personal Data Unexploitable. ICLR 2021.\n\n[2] A Survey on Unlearnable Data. arXiv 2025.\n\n[3] Transferable Clean-Label Poisoning Attacks on Deep Neural Nets. ICML 2019.\n\n[4] Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks. NeurIPS 2018.\n\n[5] Membership inference attacks against machine learning models. IEEE Symposium on Security and Privacy 2017."}]

Author rebuttal:

Meta-review: The paper discusses “unlearnable examples” that continue to work outside their training setup, i.e., across new datasets, tasks, resolutions, and architectures. This is the primary contribution of the paper: taking the concept of unlearnable examples and making it work across diverse settings. It trains a Versatile Transferable Generator (VTG) with two key ideas: adversarial domain augmentation to expose the generator to OOD shifts, and perturbation–label coupling (via contrastive alignment) so models latch onto the perturbation rather than semantics, making the result largely distribution-agnostic. In rigorous transfer tests spanning five settings, VTG consistently outperforms prior UE methods.

Most reviewers agree that the paper shows strong transferability evaluations (intra-domain, cross-domain/task/space/architecture) with consistently strong numbers. The method components are well-motivated and empirically supported. The writing is also generally clear and well organised.

On the weakness front, multiple reviewers asked for a theoretical explanation of why the method works. The authors attempted to provide a Wasserstein-distance-based explanation, upon which the reviewer increased their score. However, after reading the authors’ response, I think the provided theoretical expressions do not shed much light on the success of the method. The inequalities stated in the rebuttal hold under several non-trivial assumptions on the data, the distribution shift, the model, and the loss function. The equivalence between OT and Sinkhorn is also not as clear as the authors stated. Nevertheless, most reviewers agreed that the absence of theory is not a concern here and I agree with that. Nevertheless, I would suggest that in a future draft if these mathematical arguments were included, they be made more rigorous.

A second weakness discussed by multiple reviewers was using test accuracy as the only metric. The authors rebutted by saying this is standard in the UE literature. However, there are two aspects to this criticism, and I agree with both of them:

1. If only test accuracy were used without any constraint on the perturbation magnitude, this would make the problem trivial. The authors rebut by saying the perturbations are indeed small, but I think this should be a standard part of the evaluations, not something shown selectively in response to reviews.

2. More importantly, the authors say that the main difference between this and the classical poisoning literature (response to reviewer mhbh) is that the goal of unlearnable examples is to protect privacy. This appears to be the biggest flaw to me because (a) the paper does not mention what privacy means in this context, (b) the measured quantities (e.g., test accuracy) are not valid indicators of privacy: it is very easy to have bad accuracy on a set but still leak information about that set, and (c) in fact, as reviewer mhbh highlights, adding noisy ``shortcuts'' to images so that the model remembers those shortcuts is a clear violation of privacy. The model will remember the shortcuts and hence the associated image.

Nevertheless, despite the above two weaknesses, I believe the contributions of the paper outweigh these weaknesses. The main contribution, namely generalising the concept of "unlearnable examples" to diverse settings and providing a strong and comprehensive experimental evaluation to make that point was received very well by all reviewers. Additionally, the proposed algorithm is intuitive and cleverly combines techniques present in the ood robustness literature. Given this, I recommend acceptance.
Decision: Accept (poster)