BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection
Authors: Yihan Wang
Yiwei Lu
Xiao-Shan Gao
Gautam Kamath
Yaoliang Yu
Venue: NeurIPS 2025 poster ()
Keywords: Data protection
availability attacks
diffusion bridge model
protection removal
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Availability attacks, or unlearnable examples, are defensive techniques that allow data owners to modify their datasets in ways that prevent unauthorized machine learning models from learning effectively while maintaining the data's intended functionality. It has led to the release of popular black-box tools (e.g., APIs) for users to upload personal data and receive protected counterparts. In this work, we show that such black-box protections can be substantially compromised if a small set of unprotected in-distribution data is available. Specifically, we propose a novel threat model of protection leakage, where an adversary can (1) easily acquire (unprotected, protected) pairs by querying the black-box protections with a small unprotected dataset; and (2) train a diffusion bridge model to build a mapping between unprotected and protected data. This mapping, termed BridgePure, can effectively remove the protection from any previously unseen data within the same distribution. 
BridgePure demonstrates superior purification performance on classification and style mimicry tasks, exposing critical vulnerabilities in black-box data protection. 
We suggest that practitioners implement multi-level countermeasures to mitigate such risks.

BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection
Yihan Wang University of Waterloo yihan. wangouwaterloo.co ca
Yiwei Lu University of Ottawa yiwei www.uuutttttac...mmmm
Xiao-Shan Gao
Gautam Kamath University of Waterloo Vector Institute gdcsail mit edu
AMSS, Chinese Academy of Sciences University of Chinese Academy of Sciences xgao@mmrc. iss.sss.. ac
Yaoliang Yut University of Waterloo Vector Institute
yaoliang y yuwrruuuuuuato..ccccc
Abstract
Availability attacks, or unlearnable examples, are defensive techniques that al- low data owners modify their datasets in ways that prevent unauthorized ma- chine learning models from learning effectively while maintaining the data's in- tended functionalityy It has led to the release of popular black-box tools (e.g.. APIs) for users to upload personal data and receive protected counterparts. In this work, we show that such black-box protections can be substantially com- promised if a small set of unprotected in-distribution data is available. Specif- ically, we propose a novel threat model of protection leakage, where an adver- sary can (1) easily acquire (unprotected, protected) pairs by querying the black- box protections with small unprotected dataset; and (2) train diffusion bridge model to build a mapping between unprotected and protected data. This mapping, termed BridgePure, can effectively remove the protection from any previously unseen data within the same distribution. BridgePure demonstrates superior pu- rification performance on classification and style mimicry tasks, exposing critical vulnerabilities in black-box data protection. We suggest that practitioners imple- ment lulti-level countermeasures to mitigate such risks. The code is available at https://github.comm/ www.e/a..coooooeeaeeaaeaaaaaaaaa W/bridge-puid
1 Introduction
The widespread adoption of machine learning (ML) models has raised significant concerns about data privacy, copyright, and unauthorized use of personal information. Specifically, machine learn- ing developers usually rely on crawling web data to create their training sets, which can result in data being trained on without the owners' consent. This has significant potential for misuse. For exam- ple, trained models may be used sensitive applications such as facial recognition [21], resulting in individual re-ideniification serious privacy breaches. Another example is training copyrighted images created by artists. The downstream models could be used for style mimicry and potentially
"qqual contribution. 'Corresondence author. LListed in alphabetical order.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

result in direct copyright infringement in cases where a generative model exactly replicates the same art style as the training data.
Such unauthorized data usage has served as an impetus for broad pushback against the use of MI. models. One particular demographie, artists, has been searching for solutions that prevent consensual use of their artwork for training ML models. Their desires are somewhat at odds with each other: they would like their artwork to have low value training an ML model, while simul- tancously ensuring that the artwork is of high fidelity to preserve the quality of their original work. This has given rise to a style of availability attack known as "unlearnable examples" [13, 15, 25, 59], wherein imperceptible changes are made to training data points, which nonetheless render them low value for use in ML model training. It has even led the release of popular tools that serve this or a similar purpose (e.g.. Glaze [57], Nightshade [58], and Mist [33]). These offer public APIs (denoted as P) that allow data owner to input their dataset and receive a protected version D' = P(D).
We demonstrate that such black-box protection may be susceptible to an attack wherein an adversary can potentially render the protection ineffective. Specifically, given access small Da of unprotected in-distribution data (e.g., data collected before protection is deployed; photos taken by others a party: pictures of art taken at gallery) and a public protection API P, an adversary can easily acquire (Da, P(Da)) a)) pairs by querying the black-box service. We call such a risk protection leakage. this paper, we aim to answer an intriguing question:
How can protection leakage sabotage data protection? And to what extent?
Indeed, with a small number pairs, we show that an adversary can easily train diffusson denoising bridge model (DDBM, [77]) that learns an inverse mapping P-1 such that P (P))() z x for Da. Moreover, the learned bridge model generalizes to unseen data from the same distribution and can purify a large amount of protected data, D', We call this approach BridgePure. We show small amount of unprotected in di-istriibttion data,
that, with the reasonable assumption of access BridgePure gives far better results than prior work [9, 26, 43, 73]. without requiring pre-training or fine-tuning a large diffusion model with lot of data from similar distribution. Specifically, BridgePure can almost fully restore the dataset availability by using a limited amount of protection leakage, e.g., bringing the accuracy of a trained model back to the level before protection. Moreover, compared to other purification methods based on "noise-adding and denoising" diffusion models, BridgePure avoids detail blurring, artificial distortions or artifacts, and preserves the brushstrokes in the artwork. This demonstrates critical vulnerability of black-box data protection. Furthermore, we discuss possible mitigation strategies in Appendix D. I and advocate for considering this type of risk when developing data protection applications.
In summary, our contributions are three-fold:
We reveal the possible threat of protection leakage against black-box data protection methods;
We propose BridgePure by utilizing DDBM as powerful purification algorithm that is able to exploit small amount of protection leakage;
We conduct comprehensive experiments on purifying existing data protection methods for both classification and generation tasks, where BridgePure consistently outperforms baseline methods.
2 Background and Related Work
In this section, we (1) introduce the goals and existing works of data protection on classification models and generative models; (2) outline existing countermeasures that may render the protections ineffective; (3) introduce diffusion bridge models, the key technique we will build on.
2.1 Data Protection
Data protection in machine learning aims achieve two goals: (1) Modify dataset such that it has low value to machine learning algorithmss; (2) Maintain usability for humans, such as publication purposes. We focus data protection for images.
Formally, we denote the original dataset or pre-protection dataset as D, and the protected dataset as D'. We refer to the mapping from D to DD' as data protection mechanism P (e.g., an algorithm),
2

---

where P is applied to every entry in the dataset:
p D - D'
To preserve the visual semantics (thus preserving usability for humans), the mechanism P usually prevents modification from excessively degrading image quality, often relying on an 7yp-oomm con- straint on the modification: ||x' x I ε, for some small perturbation budget 5 0.
Let M be a training algorithm for target task and M(D") be a model trained using the protected dataset D'. The protection mechanism P is successful if M(D') has degraded performance for the target task. In this paper, we consider two tasks: classification and style mimicry, and their corresponding protection.
Availability attacks. Availability attacks can be regarded as special case of data poisoning attacks. In the context of classification tasks, availability attacks subtly modify the original data, rendering the resulting model M unusable by reducing its test accuracy an unacceptable level. Thus, the protected data are often referred to as "unlearnable examples" [e.g.. 25].
Over the past few years, this field has advanced rapidly, demonstrating three key trends: (1) Im- proved performance. Recent techniques can reduce model availability to levels even lower than random guessing [5, 15]. (2) Enhanced resilience. Availability attacks can be effective against both supervised and contrastive learning [20, 49, 66]. Furthermore, robust unlearnable examples have been introduced to counteract weakened protections caused by adversarial training [12, 16, 67]. (3) Transferable protection. Recent methods leverage image concepts and semantics to generate pro- tective perturbations, enabling cross-dataset protection [4, 75J. This remarkable progress highlights the potential of availability attacks as a practical data protection strategy in real-world applications.
Style mimicry protections. Consider an artist with artwork in distinctive style Latent diffusion models (LDMs) [51] can readily fine-tune on D to generate new images mimicking style from text prompts. To prevent such unauthorized style replication, data protection mechanisms P modify the latent representation of 'D to align with a different public dataset, making style extraction through LDM fine-tuning ineffective. Our analysis focuses on two recent methods: Glaze [57] and Mist [33], which prevent mimicry by applying imperceptible protective modifications to paintings.
2.2 Circumventing Data Protection
To understand the real effecctiveness of data protection, existing approaches propose techniques that degrade data protection. Specifically:
Purification- based methods. Adversarial purification was first introduced sanitize adversarial examples at test time [53, 60, 71]. DiffPure [43] employs pre-trained diffusion models to remove undesired noise from the perturbed images. In the context of protection removal for classification tasks, AVATAR [9] borrows diffusion model pre-trained protected dataset. LE-JCDP [26] fine-tunes a pre-trained diffusion model on additional data (i.c., the test set) and regularizes the sampling stage to improve the quality of purified images. D-VAE method to disentangle protective perturbations from protected images, which requires additional data. Regarding style mimicry tasks, DiffPure, IM- PRESS [3], Noisy Upscaling [22, 42], GrIDPure [76], and PDM [69] prove effective in undermining the protection provided by current popular tools [22]. More recently, LightShed! [14] removes pro- tective perturbations by predicting them with a trained autoencoder and subtracting them from the protected images.
the unprotected dataset to purify the
[73] leverages a variational auto-ente settoo-enoder--bare
Other m The imperceptible nature of protective modifications enables adversarial train- ing to mitigate the protection efficacy for classification tasks [40, 63). Additionally, processing the
Note that while "availability attack" here refers to data protection methods, it can also mean indiscriminate data poisoning attacks. See Appendix A.1 for complete discussion.
We discuss this contemporaneous work in Appendix A.2.
We discuss the line of work that shows a "false sense of security" in current data protection in Ap- pendix A.I.
3

---

protected images by traditional and specially picked data augmentations can restore availability to some extent [35, 46, 79].
Although existing methods often rely on pretrained models or require training models from scratch with large amount of protected data, they still leave availability gap between the purified and original datasets. In this work, we show that under a novel yet realistic threat model of limited protection leakage, the strength of data protection can be almost completely diminished.
2.3 Diffusion Bridge Models
Denote by (x) the initial data distribution. We construct a diffusion process with a set of time- indexed variables {xx J Diffusion models transporting the initial distribution to standard Gaus- sian distribution are associated with the following SDE [61]:
dx; = f(x,, t) dt + g(t) dw,, Xo Qdata (x),
(1)
where f Rd x [0.7] + Rd is vector-valued drift function, [0, + IR scalar-valued diffusion coefficient and w, is Wiener process.
We are interested in the transportation between two arbitrary data distributions. Assume the diffusion process {xe)2=0 satisfies Xo Adata (x) and XT = x' as fixed endpoint. This process can be
modeled as the solution of the following SDE [10, 50]:
dx, = [xx,, t) + (t) x, T) dt + (t) dw Idma (x), X = x',
(2)
where t, T V x. log p(x (x)) x, m 2,xy is the gradient of the log transition kernel from I to T generated by the original SDE (1), One can reverse the process (2) as follows Zhou et al. [77]:
dx; [f(x,, ()))()) T)
1,x,,,,,',, [T)] di + s()) dw,, XT =x,
where W, is a reverse Wiener process, q is the transition kernel of (2), and the score function s(x, t, x', T) = Xx, log ((x, ) =xxxxx=xx The time-reversed SDE (3) is known to be asso-
ciated with a probability flow ODE [61]:
dx, [x t) - (()
h(x,, T)) dt.
(4)
Accordingly, a denoising diffusion bridge model (DDBM) parametrized by is trained by minimiz- ing the following (denoising) score matching objective:
((0) Fx No. (A(1) [|s X1, XT, Vx, log (xx:xo, x1)
(5)
where (Xo, xT) ~ Idata (x, x'), X2 (xx; XT) and A(t) is the weighting coefficient.
3 Threat Model
In this section, introduce (1) how data protection provides service for individual data owners; (2) possible loopholes and an attack pathway; (3) the notion of pro- tection leakage, and (4) differences with existing works. Figure summarizes the threat model considered in this paper.
Forward SDE
L-
I-T
Unprotectiall
Protectol
putified
Pleverse ODE/SDE
BridgePurre
Train
Purty
Protection service. To leverage avail- ability attacks for data protection, black- box service can be offered to data owners without requiring machine learning exper- tise. For instance, Glaze [57] provides a user-friendly application where individu- als can locally apply the protection mecha- nism P to their personal dataset D, gener- ating protected version 'D'. In our work, we assume attacks operate in a black-box manner, meaning both data owners and adversaries have no knowledge of P's internal mechanisms.
Protected
Lupeotested
Protected
Puniile
Collect
Scrape
images
( Call
( Exploit
Protection mechanism
Adversaries
Fusctional moddss
Figure/ 1: BridgePure. Sequential images show the ODE sam- pling (purification) process of example image pro- tected by One-Pixel Shortcut [68].
The threat model and illustration of

---

Adversary. Note that while such black-box services are convenient for data owners, they are ac- cessible to anyone, without any ownership verification. This means adversaries can potentially use these services to generate protected versions of data belonging to others. For instance, if there exist publicly available unprotected images belonging to a data owner, an adversary A might use these unprotected images to form an additional dataset Da. Note that Da must be drawn from the same distribution as D, or from a sufficiently similar distribution.
Formally, we define the adversary's capabilities as: (1) Access to a large dataset D' of protected data; (2) Access to a small additional dataset D of unprotected data, where [Dal I < [D'] and D. PanD (with D being the original unprotected dataset corresponding to D)); (3) Access to the black-box protection mechanism P.
Protection leakage. By querying the protection mechanism P on the collected dataset Da. the adversary A obtains a paired dataset D. = {xx, P(x))[x E D. containing both unprotected and protected versions of each data point. While P remains black-box A, this paired dataset Da reveals information about P. For real-world applications of data protection, a critical question emerges: Does the information leaked through D. compromise the protection provided by P??
Our main finding reveals that protection leakage enables the construction of powerful purification mechanism p-1 that approximately reverses the protection P. Using this mechanism, an adversary A can purify the protected dataset D' to obtain p-1 (D'), which closely matches the availability of the original dataset D.
Difference with other purification methods. Notably, compared to existing circumvention meth- ods discussed in Section 2.2, our approach is distinctive in two ways: (1) Our threat model assumes access to the black-box box mechanism P. providing the adversary greater (but viable) capabilities; (2) Our method requires only limited unprotected samples to develop a purification from scratch, unlike DiffPure [43] and AVATAR [9], for which models are pre-trained using enormous additional data.
We argue that even with small amount of unprotected data, attackers bypass existing data pro- tection mechanisms using moderate meths-without requiring pre-trained models on specific types of data or massive computational resources. It also confirms that protection has a time and space dimension: any information that has ever been leaked or will be leaked in the future is significantly harder to protect. Similarly, protecting data in only one place is far from sufficient (for example, securing online data while neglecting offline data).
4 Bridge Purification
In this section, specify the possible impact of protection leakage by introducing Bridge Pu- rification (BridgePure), a method that learns the inverse protection mechanism p-1 from limited protection leakage D. {xx, x'Ixx E D = P(x)). where each pair contains unprotected and protected versions of the same data. BridgePure works by modeling and then inverting the transfor- mation between the original and protected data.
Bridge training. Assume the pairs (x,x)) come from a joint distribution Jduta (x, x'), where x' = Pxx). We aim to learn P-1 that approximately samples from gdmta (x|x'),i.e purifying the protected data x'. We first construct the stochastic process {x.)²_ that starts from Xo x and ends at XT x', where q(x: xr) approximates the true distribution Qdma x'). This process can be modeled by SDE (2) in Section 2.3. We can reverse the process using the SDE (3) and ODE (4).
Given the protection leakage Da. we train a denoising diffusion bridge model [77] from scratch via minimizing the score-matching loss in eq. (5) on D...
Sampling and purification. Different from standard diffusion models which perform uncondi- tional sampling, BridgePure's s sampling process requires each step to be conditioned on the endpoint x' (i.e., the protected data). Following Zhou et al. [77], we deploy hybrid sampling approach that combines Fuler-Maruyama and Heun sampling methods, with hyperparameter s E [o, 1] control- ling the sampling randomness. When introduce greater randomness. Choosing an appropriate s can enhance sampling quality and improve purified datasets' availability, which we analyze through ablation studies on in Section 5.4.
0, the sampling is deterministic, and higher values of
5

---

BridgePure purifies the protected dataset D' by performing conditional sampling for each protected sample x'. As shown in Figure the purification process gradually removes protective features, such as the white spot on the horse's ' chest. After obtaining the purified dataset P-" we evaluate purification effectiveness through model performance on the purified data, denoted as ((P-M(DP)))) (D')).
Pre-processing. When Da contains a small number of leaked pairs, BridgePure may overfit to the limited data and fail to generalize well the protected dataset D'. To address this limitation, introduce Gaussian noise to the protected data, inspired by the diffusion process:
Ga(x') V VT Ba, Z ~ (O:
After pre-processing, the protection leakage becomes Dr = [(x, (x(x') =a,,''=P(x)) and the protected dataset is D' = {Gg(x') |xx D' P.x)]. BridgePure learns to model the transfor-
mation between and (x'x') using Da. then purifies G3 (x') E D' by sampling approximately from Gasta ( (x)).. The effectiveness of BridgePure can be enhanced through the appropriate selection of the pre-processing parameter 3, which we examine through ablation studies Section 5.4.
Purification performance on CIFAR-10 and CIFAR- 100 against nine availability attacks. The best restoration results are emphasized in bold. We underline to denote the least number of pairs required for BridgePure to surpass other baseline methods. We run five random trials for evaluation and report the mean value and standard deviation.
Table 1:
AR
DC
EM
GUE
LSP
NTGA
OPS
REM
TAP
CIFAR 10 a94)
Protected
13.52ama
15. 10
23. 23.79
12.76
13.85
12.87e0.23
13.67e).80
20.96et no
9,51
PGD-AT
81.78an.1
82.56.023
13.8660006
33.80an2s
83.46unm
83.39s0.22
9.60s1.58
85.47a0.1
81.82a0.1
VAB
90.22:0.44
88.63
88.751032
89.80.043
90.04.02:
87.88
89 19.48:033
83.07.0
83.22.0.4
AVATAR
91. 11a11
19.04.017
38.4460.24
88.0 88.05
89.05a129
88. 38.50
87 87
89 89.66am
90,76s024
LE-JCDP
92.07a021
91.63a021
90.6920.11
90.79am.0
91.22aa.31
91.57
$8.60 38.60e1.28
90,39an24
91.60a0.14
BridgePure 0.5K
93.76.0.19
93. 23.6440..2
93,70.0.1
93.76.0.1
94.07.0.16
93.31
84.34.n.2
86.81
BridgePure-11 IK
92.48-111
93. 93.78-0
93. 15
03,80an
93.84-a119
93. 93.944008
93.494406
92.69-025 25
87.624005
BeidgePure-22 2K
93
93.81 93,93.0.0
93.97.n.1
93.99.n.34
94.00x0.1
93.31
93.49...1
88 28.601022
BridgePure-44
93.56-021
-1.8
43.87.0.15
93. 84-0
93.93-027
93.93.0.1
93.50ma3
-3.50-a
42.91.012
CIFAR- 100
(74.27an455
Protected
2.02
36. 10
6.73s0.2
19.50gm
2.56
1.51
12.18
7.07
3.59
PGD-AT
26.37an25
15.21
56.25s0.29
57.38a027
19.n
54.77a025
7.592030
16.81
$4.59a0.25
D VAE
62.14:n
55.91.092
60. 60.25:0.a
60.79.nee
61.36.025
59.341054
62.8310a7
63.06.n3:
53.82m091
AVATAR
65,45
63.48.0.2
77.06
62, 10
62.95a13s
62. 60
60 00.6688.55
65, 36.33
64. 20.500
LE-JCDP
29.15
68.4920.42
67.76x0.31
67.362142
68, 68.2330.40
68.35e0.9
39. 19.10.0.40
68.76
68.3920.39
BridgePure-O.f5
67.49.n.3
73.69.0.1
73. 17.0.
72.69.n.9
73.33un.77
69. 11.36
74.18:0.1
66.53un29
62.75u0.2
BridgePure-11 1K
68.63-081
73.62-034
73.31
72.92-a
73,934024
69.96-0.47
74.2240.0
66.30+a
62.58
BridgePPur-22K 2K
68.05an.6
73.83.0.15
73.70x0.30
73.55.0.2
73,86un.56
73.90sa.1
73. 96.a
72.38an
64. 64.96.0.27
BridgePure- 4K
72.44-047
73.97-0.18
73.5210.5
73.92-00
74.56-0.0
74.23
74.18-a. w
72.95 to
70.96.0.15
5
Experiments
In this section, we (1) introduce our experimental setting, (2) present BridgePure's purification re- sults on purifying availability attacks and style mimicry protection, and (3) conduct ablation studies.
5.1
Experimental Setting
Datasets. Our classification experiments use CIFAR-10/100 [30], ImageNet-Subsett WebFace- Subset,² Cars [29], and Pets [44] datasets. For style mimiery experiments, we use artwork from artist @nulevoy,* with details provided in Section 5.3.
Protections. On classification tasks, leverage 14 availability attacks simulate different data protection tools. Among them, AR [55] and LSP [72] are L2-norm attacks, OPS [68] is an Lo-morm attack, while the rest are Loc-norm attacks including DC [13], EM [25], GUE [34], NTGA [74],
3 'ImageNet- Subset is subset of ImageNet [8] containing 100 classes. WebFace- Subset is a subset of CASIA- -eebaaee [70] containing 100 identities. See Appendix B.1 for detailed settings. 'https:/ //www, artstation.c.m wwwm nulevoy, usage with consent from the artist.

---

REM [16], TAP [15], CP [20], TUE [49], AUE [66], UC and UC-CLIP [75]. If not otherwise stated, these LS -norm attacks use a modification budget e = 8/ 255 More details about protection gener- ation are available in Appendix B.2. On generation tasks, we deploy two style mimiery protection tools, i.e., Glaze v2.1 [57] and Mist [33].
BridgePure. We train BridgePure using a small set of (unprotected, protected) pairs to purify large-scale protected data and evaluate the purified dataset's availability. We denote BridgePure-N as the model trained on N pairs, ensuring these training pairs are distinct from the protected samples to be purified. Following Section 4, we apply Gaussian perturbation with parameter 3 during pre- processing and control sampling randomness via parameter 8. For CIFAR- 10 and CIFAR- 100, we report BridgePure's s best performance across four configurations: 8 E {0.33, 0.8} and / E {0, 0.02). For ImageNet-Subee
SloFace-Subsett Cars, and Pets, we report results with E {0.33, 0.8) and 3 = O. For style mimicry protection, we set s = 3 = 0.
Purification baselines. We compare BridgePure with existing purification- methods in Sec- tion 2.2, including adversarial training [40] and three purification baselines, including D- D-VAE [73], AVATAR [9], and LE-JCDP [26] on CIFAR-10 10 and CIFAR-100, Notably, D-VAE requires no ad- ditional data, while AVATAR uses a diffusion model trained on the unprotected dataset contain- ing 50K images, and LE-JCDP fine-tunes diffusion model on the unprotected dataset containing 10K images. BridgePure leverages a significantly smaller amount of protection leakage for train- manningging from only 0.5K to 4K pairs. For IaageNet-Subsed and WebFace-Subset comparisons with DiffPure [43], details are provided in the relevant section.
5.2 Purifyyng Availability Attacks
Main results. We evaluate four levels of protection leakage: N = 500, 1000, 2000, and 4000 pairs of unprotected and protected images. For each level, an adversary trains BridgePure model to attempt purification of the protected dataset. In Table I, we compare BridgePure with four baseline methods: adversarial training using PGD-10 with budget 8/255 in L -nomm, D-VAE, AVATAR, and LE-ICDP. The results demonstrate the significant impact of protection leakage in three aspects: (1) Restoration with limited leakage: BridgePure substantially restores dataset availability even with a few leaked pairs. (2) Superior performance with higher budgets: Using up to 4K pairs, BridgePure consistently outperforms all baseline methods across nine attacks. (3) Closing the availubility gap: BridgePure's protection-speciff design increasingly eliminates the availability gap, approaching perfect restoration as protection leakage increases.
Figure 2: Performance comparison Table 2: Purification performance on ImageNet- Subset and with awgmentationnbannn based methods, and WebFace- Subset against three availability attacks. protection dilution on CIFAR-100.
EM
LSP
TAP
EM
LSP
TAP
Unprotected
ImageNer (66,
(8a1e))
Subset
Accumey
Piotected
Protected
6.83mis
26. 76.77
17.48
1.72e005
2,33a0
3.24aa52
BrdggePure- SK
54.87a03
56.31,947
62.03e0
86.54
78.01
79.59
Dauion-K
BriuggdPP-0.3 5K
63 89613
65 65.74
62.76
87.80
87,80k022
83.48
Bust the rest
DridgeP: JK
65.666us
66.02.n.0
63.59
87, 87.76un2
87.67
86 36
Aug.
Bridgel-2KK
65.96 65.96
88aass
63.96
87.77a04
87.72ams
87 87.27:242
Brioggelt-4K
66.02ea.5
66.27:a33
64.34:351
87.60w
87.64a03
87.46
QuB
Lup
oPg
REM
m
Moreover, Figures 2 and 14 demonstrate that BridgePure consistently outperforms eight augmentation-basee circumvention methods. (See Appendix C.6 for a detailed illustration of this comparison.). We also considered the scenario where the adversary dilutes the protected dataset with sufficiently large amount of unprotected data. The results indicate that 500 leaked pairs have a significantly greater destructive impact and harm than 4,000 leaked unprotected samples.
In Table 2, we evaluate BridgePure on ImageNet-Subeee and SobFace-Subsee to illustrate the risk of protection leakage in real-world scenarios. For baseline DiffPure, the diffusion model for ImageNet-Subset is trained on the entire ImageNet, and that for WebFace-Subset is trained on CelebA [36]. We report the best results of DiffPure among four selections of sampling step, i.e., 1" E (0.1, 0.2, 0.3. 0.4). When the amount of leaked pairs is 500, our BridgePure already surpasses DiffPure on the two datasets. Moreover, BridgePure can restore the availability to the original levels as the leakage grows.
7

---

Label-agnostic case. We consider label- agnostic variants of availability attacks, i.e. UC and UC-CLIP, whose protection generation depends on clustering in the feature space of a pre-trained encoder such as CLIP [47]. We adopt their default im- plementation settings where the number of surrogate clusters is 10 and the protection budget is 16/25 255 in Loe norm. In Table 3, BridgePure with most 1000 leaked pairs can purify the protected datasets to the original availability levels.
Table 3: Purification performance on Cars and Pets
against two label-agnostic availability attacks.
UC
UC-CLIP
UC
UC-CLIP
Cars (43.25at77)
Pets (49, S65081)
Protected
25.91
10.93,276
20.91
24.07
BridgeP-0.55K
43.65-1.2
42.72-164
50.03+am0
44
BridgeP--IK
42.32a1:25
43.45s2.44
49.27
49.75 79
100
CIFAR-10
68
CIFAR-100
AVATAR
Protected
D-VAE 1.0
LE-JCDP
BridgePure-1K
Accurscy
Accuracy
30-
0.-
Baseline CP
Baselina
PSNR
0.8
20
CP
15-
AUE
AUE
2000
oue
NYRa
OPg
new
Protection Leokage
Proticttoon Leakage
Figure 3: Purification performance against Figure 4: PSNR and SSIM between processed datasets availability attacks that SimCLR evaluates. and the original CIFAR-10.
Origital
Prosected
DifPure
BridgePuee
Original
Protected
DyfPare
BriderPare
Figure 5: Purification outcomes on UC- -ropretee Cars. The left is the overview comparison and the right shows local details around the wheel. We point out (1) the light, (2) the tire, and (3) the wheel hub where BridgePure-O..5 -O5K preserves the original texture while DiffPure (t" 0.2) blurs details.
Contrastive learning case. We consider availability attacks that transfer contrastive learning algorithms. We purify CP, TUE, and AUE by BridgePure and then train classifiers using SimCLR [6] and linear probing. Figure 3 shows that limited protection leakage enables BridgePure to recover the availability for contrastive learning significantly.
Purified image quality. A distinct feature of BridgePure is its conditional generation based on the protected images. We observe that this approach enables high-quality restoration, preserves image details, and avoids artificial distortions or artifacts. Specifically, in Figure 4, we evaluate the similar- ity between the original (unprotected) data and their purified versions with PSNR and SSIM metrics. We also present the similarity between the protected and unprotected pairs as a baseline. We observe that our method outperforms all baseline purification methods in terms of restoring the unprotected data. Moreover, our method consistently improves image similarity through purification, while other methods downgrade the similarity compared with the protected baseline.
Moreover, in Figure 5, we compare the details of the purified images gen- erated by DiffPure and BridgePure. In terms of the purification mecha- nism, DiffPure adds Gaussian noise to protected images and aligns them with learned trajectories before re- verse sampling. We observe that such an unconditional process could cause the loss of texture details. In con- trast, BridgePure's 's conditional sam- pling preserves fine-grained features. Concretely, details of the vehicle pu- rified by BridgePure, such as lights, tires, and wheel hubs, are in sharper clarity than those purified by DiffPure.
Nomveesed
Oweel
Accurncy
4 10000 6 5 1ab 333 14
Protection Leakage in Each Class
Protection in Each Class
Figure 6: Performance with partial protection leakage within 10 classes (left) and 20 classes (right) of LSP- protected CIFAR-100. The x-axis represents the number of leaked pairs in each leaked class and "B" stands for the un- protected baseline. Here 0.33 and 0.
8

---

Partial protection leakage. The adversary is often limited by cost and capability, making it im- possible to collect all types of clean images, or they may only be interested in specific categories within the dataset. Thus, we consider scenario where the adversary aims to purify protected images from certain classes rather than the whole protected dataset DD' In Figure 6, we purify LSP--protected CIFAR-100 100 using partial protection leakage within 10/20 random classes and report the accuracy of leaked, non-leaked, and all classes, respectively. The results demonstrate that partial protection leak- age poses an even more significant risk to relevant classes. For example, 5 pairs from each class are sufficient to make the test accuracy of the target classes better than the unprotected baseline, and more pairs will improve it further.
Mixture of protection. The mechanism P could possibly employ multiple availability attacks to protect data. In such cases, the protection leakage also contains mixture of differently protected pairs. In Table 4, we consider a scenario in which P randomly applies one of five attacks to a given input data. We observe that, firstly, the mixture of protection harms the protection performance and this approach is not desirable; secondly, BridgePure is still very effective in restoring availability when the leakage amount is relatively small.
Table 4: Purification performance in the mixed-attacks scenario, where five availability attacks in- cluding AR, EM, LSP, OPS, and TAP are randomly applied.
BridgePure 0.5K
Protected
0.25K
1K
CIFAR-I0 (94.01)
61.60+178
93.00+a.26
94.144
93.01+020
CIFAR- 100 (74.27)
51.5712.15
71.31
72.00a0.4
72.7720.33
5.3 Purifying Style Mimicry Protection
In this section, we investigate the threat of protection leakage to copyright protection for generative models. We consider art style mimicry on the artwork from artist @ @nulevoy with consent. We first fine-tune Stable Diffusion v2.1 [51] using 20 captioned paintings following the implementation of Hönig et al. [22]. We then reproduce the style of the artist with list of prompts during inference. Our implementation details are available in Appendix B.5.
Original
Giose
Purifed
Purifedd
Original
Glier
Ads!
Purited Glex
PutiSed Mur
Figure 7: Purification performance of BridgePure-5 (top) and BridgePure- 10 (bottom) for style mimicry. The presented paintings are mimicry outcomes of fine-tuned generative models.
For style mimicry protection, we apply Glaze and Mist to protect the 20 paintings we used previ- ously. We assume protection leakage of only 5 or 10 unprotected paintings of the same artist and call these public protection tools obtain (unprotected, protected) pairs for BridgePure training. Finally, the 20 protected paintings are purified by BridgePure and fed into the style mimicry pipeline.
Figures 7 and 10 show the style mimicry outcomes given different text prompts. Models fine-tuned on Glazc-protected artwork produce images filled with irregular patterns, while artwork protected by Mist leads fine-tuned models to generate artistic works with regular block-like perturbations. After purification by BridgePure, images protected by Glaze and Mist can no longer cause fine-tuned models to generate artwork with protective cloaks. Our results again suggest that for style mimicry, protection leakage poses a strong threat to existing data protection tools.
Due to page limitations in the main text, we will compare our BridgePure and other advanced ap- proaches, including GrIDPure [76), PDM [69], and NoisyUpsealing [22], for purifying protected paintings in Appendix C.4. As shown in Figures 11 and 12, there BridgePure effectively removes

---

protective perturbations while preserving the intricate details of the painting an achievement that other approaches fall short of.
5.4 Ablation Study
Figure 8 shows that pre-processing with Gaussian noise improve the availability restoration against some availability attacks which "harder" to purify, e.g., TAP. How- ever, it also presents a performance ceiling for other protections, c.g., EM and LSP, and harms their purifica- tion results. Regarding the sam- pling randomness, while larger ran- domness slightly reduces the accu- racy for some protections, e.g., EM, LSP, and OPS, it can largely benefit the purification against TAP, REM, and AR.
9-0.33, B-O
S=O p=0
a=0.33, p=0.02
8-0.8, B-0.02
100
Aczuracy
80
8 LSP Pe
GUE
La0
OPe
REW
Figure 8: Influence of and B on BridgePure- IK perfor- mance CIFAR-10 (left) and CIFAR-IO0 (right).
In summary, different protection methods are subject different choices of the optimal hyperpa- rameter. Our results in this section reveal the worst-case damage caused by protection leakage by reporting the best-performing BridgePure within limited number of trials.
6 Potential Countermeasures
To mitigate protection leakage and defend against BridgePure, both service providers and users can adopt proactive countermeasures. For service providers, the critical safeguard is to limit their ability to use the protection mechanism to generate the corresponding protected versions. Potential countermeasures include limiting the reproducibility of protection, avoiding offline deployment, and verifying user identity and data ownership. An alternative line of defense against the BridgePure threat to design protection mechanisms that are resilient its purification capabilities.
For protection service users, the most straightforward defense is to minimize the exposure of un- protected images and rely trustworthy protection service providers. Another promising strategy to design preprocessing techniques that work jointly with the protection mechanism to enhance resistance against BridgePure. In addition, users may strategically release crafted decoy images to contaminate an attacker's training data, thereby diminishing BridgePure's effectiveness on their genuine protected content.
The effectiveness of these mitigation strategies remains to be thoroughly evaluated, and we plan to explore them further in future work. A more detailed discussion of potential countermeasures is provided in Appendix D.I.
Conclusion
In this paper, identify critical vulnerability in black-box data protection systems: protection leakage. We demonstrate that using small number of leaked pairs, an adversary can train diffu- sion bridge model, BridgePure, to effectively circumvent the protection mechanism. Our empirical results show that under this threat model, BridgePure exposes fundamental vulnerabilities in current data protection systems for both classification and generation tasks.
Limitations and future work. Our findings underscore the urgent need to address protection leak- age. For protection service providers, it is essential to develop both system-level and algorithm-level countermeasures to mitigate the threat posed by BridgePure. We have already notified several black- box protection service providers of these risks and shared our recommendations. Furthermore, ploring user-oriented defense strategies represents another promising direction for future research.
In addition, the data protection methods discussed in this paper are limited to the image domain. Investigating the reliability of data protection approaches in other domains another important direction for future work.
10

---

Acknowledgment
We sincerely thank Stanislav Voloshin (@nulevoy) for his permission present experimental re- sults based on his artwork in our paper. GK and YY gratefully acknowledge NSERC, the Canada CIFAR AI Chairs program and the Ontario Early Researcher program for funding support. XSG is supported by the Strategic Priority Research Program of CAS Grant XDA0480502, Robotic AI- Scientist Platform of CAS, and NSFC Grants 12288201 and 92270001.
References
[1] H. Aghakhani, D. Meng, Y.-.. Wang, C. Kruegel, and G. Vigna. "Bullseye polytope: A scal- able clean-label poisoning attack with improved transferability". In: IEEE European Sympo- sium on Security and Privacy (EuroS&P). 2021, pp. 159-178.
[2] B. Biggio, B. Nelson, and P. Laskov. "Poisoning attacks against support vector machines". In: Proceedings of the 29th International Conference on Machine Learning (ICML). 2012, pp. 1467-1474.
[3] B. Cao, C. Li, Т. Wang. J. Jia, B. Li, and Chen. "Impress: Evaluating the Resilience of Imperceptible Perturbations against Unauthorized Data Usage in Diffusion-Based Generative Ai". Advances in Neural Information Processing Systems, vol. 36 (2023), pp. 10657-10677.
[4] C. Chen, J. Zhang, Y. Li, and Z. Han. "One for All: A Universal Generator for Concept Un- learnability via Multi-Modal Alignment". In: Forty-first International Conference on Machine Learning. 2024.
[5] S. Chen, G. Yuan, X. Cheng. Gong, M. Qin. Wang, and Huang. "Self- Ensemble Protection: Training Checkpoints Are Good Data Protectors". In: The Eleventh International Conference on Learning Representations. 2023.
[6] T. Chen, S. Kornblith, M. Norouzi, and G. Hinton. "A simple framework for contrastive learning of visual representations" In: International conference on machine learning. PMLR. 2020, pp. 1597-1607.
[7] X. Chen, C. Liu, B. Li, K. Lu, and D. Song. "Targeted backdoor attacks deep learning systems using data poisoning". arXiv: 171.:1712.00526 2017.
[8] J. Deng, W. Dong, R. Socher, L.-J. Li. K. Li, and L. Fei-Fei. "Imagenet: A large-scale hicrar- chical image database". In: 2009 IEEE conference on computer vision and pattern recogni- tion. leee. 2009, pp. 248-255.
[9] M. Dolatabadi, Erfani, and C. Leckie. "The devil's advocate: Shattering the illusion of unexploitable data using diffusion models"" In: 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). IEEE. 2024, pp. 358-386.
[10] J. L. Doob. "Classical potential theory and its probabilistic counterpart". Vol. 262. Springer, 1984.
[11] Dosovitskiy et al. "An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale". In: International Conference Learning Representations. 2021.
[12] B. Fang, B. Li, S. Wu, S. Ding. T. Zheng, R. Yi, and L. Ma. "Collapsing the Learning: Crafting Broadly Transferable Unlearnable Examples". 2024.
[13] J. Feng, Q--.. Cai, and Z..H. Zhou. "Learning to confuse: Generating training time adversarial data with auto-encoder". Advances in Neural Information Processing Systems, vol. 32 (2019).
[14] H. Foerster, S. Behrouzi, P. Rieger, M. Jadliwala, and A.-R. Sadeghi. "LightShed: Defeat- ing Perturbation- based Image Copyright Protections". In: 34th USENIX Security Symposium (USENIX Security 25). 2025, pp. 7271-7290.

---

[15] L. Fowl, M. Goldblum, P.y. Chiang, J. Geiping, W. Czaja, and T. Goldstein. "Adversarial examples make strong poisons". In: Advances in Neural Information Processing Systems. Vol. 34. 2021, pp. 30339-30351.
[16] S. Fu, F. He, Y. Liu, L. Shen, and D. Tao. "Robust Unlearnable Examples: Protecting Data Privacy Against Adversarial Learning". In: International Conference on Learning Represen- tations. 2022.
[17] J. Geiping, L. H. Fowl, W. R. Huang, W. Czaja, G. Taylor, M. Moeller, and T. Goldstein. "Witches' Brew: ial Scale Data Poisoning via Gradient Matching". In: International Confer- ence on Learning Representations. 2021.
[18] T. Gu, B. Dolan-Gand Gavitt, and S. Garg. "Badnets: Identifying vulnerabilities in the machine learning model supply chain". arXiv:1708.066. 2017.
[19] J. Guo and C. Liu. "Practical Poisoning Attacks on Neural Networks". In: European Confer- ence on Computer Vision. 2020, pp. 142-158.
[20] H. He, K. Zha, and D. Katabi. "Indiscriminate Poisoning Attacks on Unsupervised Con- trastive Learning.. In: The Eleventh International Conference on Learning Representations. 2023.
[21] K. Hill. "Your Face Belongs Us: The Secretive Startup Dismantling Your Privacy". Simon and Schuster, 2023.
[22] R. Hönig, J. Rando, N. Carlini, and F. Tramèr. "Adversarial Perturbations Cannot Reliably Protect Artists From Generative AT", arXiv preprint arXiv:2406.12027 (2024).
[23] J. Hu, L. Shen, and G. Sun. "Squeeze- aauueeze-and-eree and-excitation networks". In: Proceedings of the IEEE conference on computer vision and pattern recognition. 2018, pp. 7132-7141.
[24] G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger. "Densely connected convo- lutional networks". In: Proceedings of the IEEE conference on computer vision and pattern recognition. 2017, pp. 4700-4708.
[25] H. Huang, X. Ma, S. M. Erfani, J. Bailey, and Y. Wang. "Unleamnale Examples: Making Personal Data Unexploitable". In: ICLR. 2021.
[26] W. Jiang. Y. Diao, H. Wang. J. Sun, M. Wang, and R. Hong. "Unlearnable examples give a false sense of security: Piercing through unexploitable data with learnable examples", Proceedings of the 31st ACM International Conference Multimedia. 2023, pp.
[27] P. Koh and Liang. "Understanding black-box predictions via influence functions". In: Proceedings of the 34th International Conference on Machine Learning (ICML). 2017, pp. 1885-1894.
[28] P. W. Koh, J. Steinhardt, and P. Liang. "Stronger Data Poisoning Attacks Break Data Saniti- zation Defenses". Machine Learning, vol. 111 (2022), pp. 1-47.
[29] J. Krause, M. Stark, J. Deng, and L.. Fei-Fei. "3D Object Representations for Fine-Grained Categorization". In: 4th International IEEE Workshop 3D Representation and Recognition (3dRR-13). Sydney, Australia, 2013.
[30] A. Krizhevsky. "Learning multiple layers of features from tiny images". tech. report. 2009.
[31] Krizhevsky, Sutskever, and G. E. Hinton. "Imagenet classification with deep convolu- tional neural networks". Advances in neural information processing systems, vol. 25 (2012).
[32] Li, D. Li, Savarese, and S. Hoi. "Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models". In: International conference on machine learning. PMLR. 2023, pp. 19730-19742.
12

---

[33] C. Liang. X. Wu, Y. Hua. J. Zhang, Y. Xue, T. Song, Z. Xue, R. Ma, and H. Guan. "Adversar- ial example does good: Preventing painting imitation from diffusion models via adversarial examples". In: International Conference on Machine Learning. PMLR. 2023, pp. 20763- 20786.
[34] S. Liu, Y. Wang, and X.-S. Gao. "hemeetheoretic unlearnable example generator". In: Pro- ceedings of the AAAI Conference on Artificial Intelligence. Vol. 38. 19. 2024, pp. 21349- 21358.
[35] Z. Liu, Z. Zhao, and M. Larson. "Image shorteut squeezing: Countering perturbative avail- ability poisons with compression". In: International conference on machine learning. PMLR. 2023, pp. 22473-22443
[36] Z. Liu, Luo, X. Wang. and X. Tang. "Deep Learning Face Attributes in the Wild". In: Proceedings of International Conference on Computer Vision (ICCV). 2015.
[37] Lu, G. Kamath, and Yu. "Indiscriminate Data Poisoning Attacks on Neural Networks". Transactions on Machine Learning Research (2022).
[38] Y. Lu, G. Kamath, and Y. Yu. "Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks". In: Proceedings of the 40th International Conference on Machine Learn- ing. 2023.
[39] Y. Lu, M. Y. Yang, G. Kamath, and Y. Yu. "Indiscriminate Data Poisoning Attacks on Pre- trained Feature Extractors". In: 2024 IEEE Conference on Secure and Truslworthy Machine Learning (SaTML). IEEE. 2024, pp. 327-343.
[40] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. "Towards Deep Learning Models Resistant to Adversarial Attacks". In: International Conference on Learning Repre- sentations. 2018.
[41] L. MunozzGonzález, B. Biggio, A. Demontis, A. Paudice, V. Wongrassamee, E. C. Lupu, and F. Roli. "Towards Poisoning of Deep Learning Algorithms with Back gradient Optimization". In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security (AlSec). 2017.
[42] Mustafa, S. H. Khan, M. Hayat, Shen, and L. Shao. "Image super-resolution as de- fense against adversarial attacks". IEEE Transactions Image Processing, vol. 29 (2019), pp. 1711-1724.
[43] W. Nie, B. Guo, Y. Huang, C. Xiao, A. Vahdat, and A. Anandkumar. "Diffusion models for adversarial purification". In: International Conference on Machine Learning (ICML). 2022.
[44] O. M. Parkhi, A. Vedaldi, A. Zisserman, and C. V. Jawahar. "Cats and Dogs". In: IEEE Conference on Computer Vision and Patlern Recognition. 2012.
[45] O. Pooladzandi, S. G. Bhat, J. Jiang, A. Branch, and G. Pottie. "PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamics". . In: The Thirty- eighth Annual Conference on Neural Information Processing Systems. 2024.
[46] T. Qin, X. Gao, J. Zhao, K. Ye, and C.-Z. Xu. "Learning the unleamable: Adversarial augmen- tations suppress unlearnable example attacks". In: 4th Workshop on Adversarial Robustness In the Real World (AROW), ICCV 2023. 2023.
[47] A. Radford et "Learning transferable visual models from natural language supervision". In: International conference on machine learning. PMLR. 2021, pp. 7768-8763.
[48] E. Radiya-Dixit, S. Hong, N. Carlini, and Tramer. "Data Poisoning Won't Save You From Facial Recognition".. In: International Conference on Learming Representations. 2022.
[49] J. Ren, H. Xu, Y. Wan, X. Ma, L. Sun, and J. Tang. "Transferable Unlearnable Examples", In: The Eleventh International Conference on Learning Representations. 2023.
13

---

[50] L. C. G. Rogers and D. Williams. "Diffusions, Markov processes. and martingales: Itō calcu-
lus". Vol. 2. Cambridge university press, 2000.
[51] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer. "High- Friig-RReoolution Image Synthesis With Latent Diffusion Models". In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 2022, pp. 10684-10695.
[52] A. Saha, A. Subramanya, and H. Pirsiavash. "Hidden trigger backdoor attacks". In: Proceed- ings of the AAAI Conference on Artificial Intelligence. 2020.
[53] P. Samangouei, M. Kabkab, and R. Chellappa. "Defense-GAN Protecting Classifiers Against Adversarial Attacks Using Generative Models". In: International Conference on Learning Representations. 2018.
[54] M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen. "Mobilenetv2: Inverted residuals and linear bottlenecks". In: Proceedings of the IEEE conference on computer vision and pattern recognition. 2018, pp. 4510-4520.
[55] P. Sandoval-Segura, V. Singla, J. Geiping, M. Goldblum, T. Goldstein, and D. Jacobs. "Au- toregressive Perturbations for Data Poisoning". In: Advances in Neural Information Process- ing Systems. Ed. by S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh. Vol. 35. Curran Associates, Inc., 2022. pp. 27374-27386.
[56] A. Shafahi, W. R. Huang, M. Najibi, O. Suciu, C. Studer, T. Dumitras, and T. Goldstein. "Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks". In: Advances in Neural Information Processing Systems (NeurIPS). 2018, pp. 6103-6113.
[57] S. Shan, J. Cryan, E. Wenger, H. Zheng. R. Hanocka, and B. Y. Zhao. "Glaze: Protecting artists from style mimicry by [TTxtt-o-Imagee Image] models". In: 32nd USENIX Security Sympo- sium (USENIX Security 23). 2023, pp. 2187-2204.
[58] S. Shan, W. Ding, J. Passananti, S. Wu, H. Zheng, and B. Y. Zhao. "Nightshade: Prompt- Specific Poisoning Attacks on Text-to-Image Generative Models". In: 2024 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society. 2024, pp. 212-212.
[59] S. Shan, E. Wenger, J. Zhang, H. Li, H. Zheng, and B. Y. Zhao. "Fawkes: Protecting privacy against unauthorized deep learning models". In: 29th USENIX security symposium (USENIX Security 20). 2020, pp. 1589-1604.
[60] C. Shi, C. Holtz, and G. Mishne. "Online Adversarial Purification based on Self-supervised Learning.. In: International Conference on Learning Representations. 2021.
[61] Y. Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole. "Score-Basse BaseB Generative Modeling through Stochastic Differential Equations". In: International Confer- ence on Learning Representations. 2021.
[62] F. Suya, S. Mahloujifar, A. Suri, D. Evans, and Tian. "Model-targeted poisoning attacks with provable convergence". In: Proceedings of the 38th International Conference Ma- chine Learning. 2021, pp. 10000-10010.
[63] L. Tao, L. Feng. J. Yi, S.-J. Huang, and S. Chen. "Better safe than sorry: Preventing delusive adversaries with adversarial training". Advances in Neural Information Processing Systems, vol. 34 (2021), pp. 16209-16225.
[64] H. Touvron, M. Cord, A. Sablayrolles, G. Synnaeve, and H. Jégou. "Going deeper with image transformers". In: Proceedings of the IEEE/CVF international conference on computer vision. 2021. pp. 32-42.
[65] B. Tran, J. Li, and A. Madry. "Spectral Signatures in Backdoor Attacks".. In: Advances in Neural Information Processing Systems (NeurIPS). 2018.
14

---

[66] Y. Wang, Y. Zhu, and X.-S. Gao. "Efficient Availability Attacks against Supervised and Con- trastive Learning Simultaneously". In: The Thirty-eighth Annual Conference on Neural Infor- mation Processing Systems. 2024.
[67] R. Wen, Z. Zhao, Z. Liu, M. Backes, T. Wang, and Y. Zhang. "Is Adversarial Training Really a Silver Bullet for Mitigating Data Poisoning?" In: The Eleventh International Conference on Learning Representations. 2023.
[68] S. Wu, S. Chen, C. Xie, and X. Huang. "One-Pixel Shortcut: On the Learning Preference of Deep Neural Networks". In: The Eleventh International Conference on Learning Represen- tations. 2023.
[69] H. Xue and Y. Chen. "Pixel is barrier: Diffusion models more adversarially robust than we think". arXiv preprint arXiv:2404.13322 (2024).
[70] D. Yi, Z. Lei, S. Liao, and S. Z. Li. "Learning face representation from scratch". arXiv preprint
/41 1411:9241..922. (2014).
[71] J. Yoon, J. Hwang, and J. Lee. "Adversarial purification with score-based generative mod- els". In: International Conference on Machine Learning. PMLR. 2021, pp. 12062-12072.
[72] D. Yu, H. Zhang, W. Chen, Yin, and T.-Y. Liu. "Availability attacks create shortcuts". In: Proceedings of the 28th ACM SIGKDD Conference Knowledge Discovery and Data Mining. 2022, pp. 2367-2376.
[73] Y. Yu, Y. Wang. S. Xia, W. Yang. S. Lu, Y-p. Tan, and A. Kot. "Purify Unleamable Examples via Rate- CoattrCCndd Variational Autoencoders". In: Forty-first International Conference on Machine Learning. 2024.
[74] C.-H. Yuan and S.-H. Wu. "Neural Tangent Generalization Attacks". In: International Con- ference Machine Learning. PMLR. 2021, pp. 12230-12240.
[75] J. Zhang, X. Ma, Q. Yi, J. Sang, Y-G. Jiang, Y. Wang, and C. Xu. "Unlearnable clusters: Towards lages-ig unlearnable examples". In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023, pp. 3984-3992
[76] Z. Zhao, J. Duan, K. Xu, C. Wang, R. Zhang, Z. Du, Q Guo, and X. Hu. "Can protective per- turbation safeguard personal data from being exploited by stable diffusion?" In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024, pp. 24398- 24407.
[77] L. Zhou, A. Lou, S. Khanna, and S. Ermon. "Denoising Diffusion Bridge Models". In: The Twelfth International Conference on Learning Representations, 2024.
[78] Zhu, W. R. Huang, H. Li, G. Taylor, C. Studer, and T. Goldstein. "Transferable clean-label poisoning attacks on deep neural nets". In: International Conference on Machine Learning. 2019, pp. 7614-7623.
[79] Y. Zhu, L. Yu, and X.-S. Gao. "Detection and defense of unlearnable examples". In: Proceed- ings of the AAAI Conference on Artificial Intelligence. Vol. 38. 15. 2024, pp. 17211-17211 17219.
15

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The main claims accurately and clearly reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
The last section of this paper states the limitations.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specificatton, asymptotic approximations only holding locally). The au- thors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, c.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the ap- proach. For example, facial recognition algorithm may perform poorly when image resolution is low images taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to ad- dress problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers grounds for rejection, worse outcome might be that reviewers discover limitations that aren't it acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
16

---

Justification:
This paper does not include theorems.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theo- rems.
The proof' can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be comple- mented by formal proof's provided in appendix or supplemental material. Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclu- sions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: This paper describes the experimental setting in detail for reproducibility. Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary either make it possible for others replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all sub- missions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or a way to re- produce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case au- thors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
17

---

Answer: [Yes]
Justification: Abstract includes the code link.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines thttps://nips cc/
cesssinnnoicyyll for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: //nips.ce.
ssi onPolicy) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: This paper provides detailed experimental setting in Appendix B. Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropri- ate information about the statistical significance of the experiments?
Answer: [Yes]
Justification:
This paper reports error bars over multiple random trials in main tables.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
18

---

is OK to report I-sigma error bars, but one should state it. The authors should prefer- ably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative emror rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
This paper specifies experiment platforms and resources in Appendices B and C.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't t make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https: h/tp:r///eeeiseeeeeeeeeee httpp///../..ttttttcceiiilelllll
Answer: [Yes]
Justification: This paper uses copyrighted artwork with content from the artist. This search aims to advance the field of data protection, as stated in Appendix D.2 "Broader Impacts" section. This paper provides potential countermeasures in Appendix D.1 against the revealed protection leakage threat.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative socictal impacts of the work performed?
Answer: [Yes]
Justification:
This paper discusses broader impacts in Appendix D.2.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact spe- cific groups), privacy considerations, and security considerations.
19

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitiga- tion strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: This paper itself is studying the reliability of safeguard methods.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards allow for controlled use of the model, for example by re- quiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided relcasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
This paper uses an artist's copyrighted data with his consent. Other data and models used in this paper properly credited.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use the pack- age should be provided. For popular datasets, paperswithee www.swwwthhhhe...c.. com/ datasts has curated licenses for some datasets. Their licensing guide can help determine the li- cense of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
20

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documenta- tion provided alongside the assets?
Answer: [NA]
Justification:
This paper does not introduce new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the pa- per include the full text instructions given to participants and sereenshots, applicable, well as details about compensation (if any)?
Answer: [NA]
Justification: This paper does not include crowdsourcing experiments.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contri- bution of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, cura- tion, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equiva- lent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
21

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: In this paper, LLM is only used for editing (e.g.. grammar, spelling, word choice).
Guidelines:
that the method development in this research does involve LLMs as any important, original, or non-standard components.
The answer NA
Please refer to our LLM policy peetps://neur/e / for what should or should be described.
22

---

A More Related Work
A.1 Data Protection and Data Poisoning Attacks
In this section, we formalize the relationship between data protection and data poisoning attacks. First, let define data poisoning attacks: given a clean training set De. data poisoning attacks create an additional poisoned set Dp such that model trained on D UDp exhibits behavior aligned with the adversary's objective. These attacks
be categorized as: availability (or indiscriminate) attacks [e.g.. 2, 27, 28, 37, 38, 39, 41, 62] that reduce overall test performance, targeted attacks (e.g., 1, 17, 19, 56, 78], backdoor attacks [e.g.. 7, 18, 52, 65] that compromise model integrity for specific test samples or trigger patterns.
Data protection can be viewed as special case of availability attacks where: (1) P (2) D;, is the protected dataset '', and (3) the adversary role taken by the data protection service provider.
Finally, the inadequacy of data poisoning as protection mechanism has been conclusively demon- strated, both through conceptual analysis [48] and technical evaluation [22, 45J. Radiya-Dixit et al. [48] identify a fundamental limitation in data protection methods: their "once for all" deploy- ment mechanism fails to protect historical data and lacks cross-model transferability. While recent advances in transferable availability attacks [20, 49, 66) have partially addressed the model transfer- ability challenge, our work reveals that the vulnerability of historical unprotected data (protection leakage) poses even more significant security risk.
A.2 Similarities and Differences from LightShed
We note that a contemporaneous work, i.c., LightShed [14], also investigates the removal of pro- tective perturbations. To better contextualize our contributions, we describe the similarities and differences between BridgePure and LightShed below.
Similarities. Both BridgePure and LightShed study the reliability of data protection mechanisms. In addition, both approaches assume that the adversary has access to unprotected images and their corresponding protected versions obtained by querying the protection mechanism.
Differences. BridgePure considers both classification and generative tasks, whereas LightShed focuses exclusively generative tasks. Moreover, BridgePure directly transforms protected data into their unprotected counterparts, rather than first reconstructing the protective perturbations as done in LightShed. BridgePure further leverages ffate-of-the-ar bridge models to capture subtle transformations, while LightShed relies on a task-specific autoencoder. Finally, LightShed assumes adversarial access tens of thousands of clean images. In contrast, systematically investigate the minimum data requirements for training an effective BridgePure model, demonstrating that several hundred clean images sufficient for classification tasks, and that only tens of clean paintings suffice for generative tasks.
B Experiment Settings
B.1 Datasets
CIFAR-10/100. For CIFAR-10 and CIFAR-100 set to be protected which contains 40,000 images, and reference set comprising the remaining data. The images are x2x pixels.
[31], the training set divided into two parts:
ImageNet-Suuset. The ImageNet- 100 dataset consists of 100 classes selected from the full Ima- geNet dataset [8]. Following Fu al. [16]. Huang et al. [25], and Qin al. [46], we use subset of ImageNet-100 100 containing 85,000 images. The test set includes 50,000 images, the set to be pro- tected contains 25,000 images, and the reference includes 10,000 images. Images in both the protection and reference sets are resized to x24x224 pixels. For test images, the shorter edge is resized 256 pixels, followed by center crop 224x224.
dataset [70] contains 494,414 face images of 10,575 real identities. We select the top 100 identities with the most images, resulting in a dataset of 44,697
WebFace-Subset.
The
23

---

images. This dataset is split into three parts: a test set comprising 4518 images, a protection set with 25,000 images, and a reference set containing the remainder. The images are 112x 12 pixels.
Pets and Cars. Pets [44] contains 37 categories of animals, in which the set to be protected in- cludes 3680 images and the test set contains 3669 images. Cars [29] contains 197 categories of automobiles, in which the set to be protected includes 8144 images, and the test set contains 8041 images. Similar to ImageNet-Subset, images are processed be 224x224.
Table 5 summarizes the information about the datasets used for classification tasks. We delay the details of data preparation for the style mimicry task to Appendix B.5.
Table 5: Dataset details.
Protection
Reference
Test
Categories
Balanced
CIFAR-10
40,000
10,000
10,000
CIFAR-100
40,000
10,000
10,000
100
ImageNet-Subee
25,000
10,000
50,000
WebFace-Subeee
25,000
15,179
4,518
Cars
8144
8041
197
Pets
3680
3669
37
B.2 Protection
For CIFAR-10/100, ImageNet-Subsee Subsett, and WebFace-Subsee we generate the availability attacks on the combination of the protection set and reference set to simulate the exact protection mechanism. The additional paired data are collected from the original and protected reference datasets. In Ap- pendix C.11, we will investigate more protections whose generation does not involve reference dataset and present additional results showing the consistent effectiveness of BridgePure against them.
For Cars and Pets. the protection generation of UC(-CLIP) is determined by the clustering of the protection dataset. The generated protection can be easily applied to unseen data. Thus, we collect additional paired data from the protected test dataset.
For style mimicry protection, we will detail the implementation of Glaze and Mist in Appendix B.5.
B.3 BridgePure
Training. We train BridgePure from scratch using each paired dataset for 100,000 steps. The batch size is 256 for CIFAR-10, CIFAR-100, 100; 32 for WebFace- Subset; 16 for ImageNet-Subset, Cars, Pets, and @nulevoy's artwork. Training on CIFAR-10/100 and WebFace-Subset can run single NVIDIA L40S/RTXX 6000 Ada GPU with 40 GB of memory. Training on ImageNet-Subset, Cars, and Pets can run on single NVIDIA A100 GPU with 80 GB of memory. Training on artwork can run on 4 NVIDIA A 100 GPUs in parallel. By default, we use the VE mode for bridge models and will compare VE and VP modes in Appendix C.10.
Sampling. We adopt 40-step sampling for all evaluated datasets. As recommended by DDBM [77], the guidance coyper-paramete is set to 1 for VP bridge models and to 0.5 for VE bridge models.
B.4 Evaluation for Classification
To evaluate the restoration of availability, we train classifiers the original/protected/pprrrree datasets (i.e., protection set in Table 5) and calculate their accuracy on the test set. If not other- wise stated, we train ResNet-18 classifier for 120 epochs using an SGD optimizer with initial learning rate of 0.1, a momentum of 0.9, and weight decay of 0.0005. The learning rate decays by 0.1 the 80th and 100th epochs. The batch size is 128. For ViT and CaiT, with an initial learning rate of 0.0005. We follow the evaluation setting from Zhang et al. [75] for UC and UC-CLIP.
Adam optimizer
For contrastive learning, we train an encoder with the ResNet-18 backbone using SimCLR with temperature of 0.5. The batch size is 512. We use SGD optimizer with initial learning
24

---

rate of 0.5, a momentum of 0.9, and a weight decay of 0.0001. The learning rate scheduler is cosine annealing with a 10-epoch warm-up. The linear probing stage uses an SGD optimizer for 100 epochs with an initial learning rate of 1.0 and scheduler that decays by 0.2 at 60, 75, and 90-th epochs.
B.5 Style Mimicry
Artwork. After obtaining the artist's permission via email, we collect @nulevoy's artwork from his homepage on ArtStation. The paintings are x920x 1080 pixels. Since Hönig et al. [22] verified that Stable Diffusion v2.1 without fine-tuning fails to generate paintings of @nulevoy's 's style, is reasonable to use these artworks for the style mimicry task.
Protections. Glaze v2.1 takes an image of any shape as input and outputs modified image of the same shape. Since it is cossed-soure tool that only supports Windows and macOS platforms, we process the paintings on MacBook Pro with an M3 Max chip. The protected paintings have the same shape as the original ones. The protection intensity is High and the render quality is Slowest.
Mist takes square images and outputs images of the same shape. However, the size it supports is 768x x 768. To preserve the object ratios in the painting and the image quality, we first resize the short edge of images to 768, center-crop them square ones, and then feed them into Mist. The resulting protected paintings are 768 x 768 pixels.
Mimicry pipeline. We adopt the style mimicry implementation from Hönig al. [22], which involves fine-tuning Stable Diffusion v2.1 [51] using a set of captioned paintings. For fine-tuning, the images are first center-cropped to 512x512 and their captions are auto-generated by BLIP- 2 model [32]. The fine-tuned model generates 768 768-778--p -ixell images based on predefined test prompts.
We randomly select 20 paintings from artist @ @ulevvyy for fine-tuning and use the same 10 prompts from Hönig al. [22] to evaluate the mimicry performance. For Mist, the mimicry process performs center-cropping on the 768 x 768 squared images, while for Glaze, the mimicry process performs center-cropping on the original images.
BridgePure implementation. Assume a protection leakage consists of 5 or 10 pairs of original and protected artwork. To augment this dataset, randomly crop the artwork to 512x512 pixels, generating a paired dataset with 1,000 pairs of paintings. BridgePure is then trained using this augmented paired dataset.
For the style mimicry task, the protected fine-tuning set comprises 20 paintings, which are center- cropped to 512x512 pixels from the protected outputs of Glaze Mist. BridgePure sanitizes these images, and the purified outputs are subsequently fed into the mimicry pipeline.
C Additional Experiment Results
C.1 Time Consumption
On our machine with NVIDIA A100 GPUs, training BridgePure on CIFAR-10/100 costs around 22.5 hours with a single GPU, and that on ImageNet-Subset costs around 24 hours with a single GPU. For sampling a batch of 64 images from ImageNer-Subsee with a single GPU, BridgePure costs 138 seconds on average while DiffPure (t*=0.1) costs 165 seconds.
On one hand, we empirically observed that carly-stopping could reduce the time cost in BridgePure training. For example, BridgePure-4K trained with 40K steps on WebFace-Subset, which only costs 450 minutes in training, recovers the test accuracy of EW/LSSP/AAP-proeecee dataset to 87. 088/87.87/87.66 %. On the other hand, BridgePure follows an offline training scheme similar to other models models-once once trained, the model can purify an unlimited number of protected samples within the same domain. The additional computational overhead for each new sample is limited to
'The prompts for style mimicry include mountain by nulevoy". "a piano by nulevoy". shoe by nulevoy", "a candle by nulevoy", "a astronaut riding a horse by nulevoy", "a shoe with a plant growing inside by nulevoy", "a feathered car by nulevoy". "a golden apple by nulevoy", "a castle in the jungle by nulevoy". and "a village in thunderstorm by nulevoy".
25

---

inference cost only, which is minimal compared to the initial training. In other words, the purifica- tion cost for each image is amortized. Therefore, the training consumption shows no obstacle for malicious adversaries.
C.2 Visualization of Sanitized Images
We show original, protected, and iilggePure-purfffeee images from CIFAR- 10 and WebFace-Subee Subset Figure 9. Although availability attacks make perturbations less noticeable by imposing norm constraints, upon zooming in and comparing the protected image with the original, one can observe slight differences. However, images purified by BridgePure are indistinguishable from the original to human eyes.
C.3 Additional Generated Images in Style Mimicry Task
Figure 10 provides additional generated images in the style mimiery task investigated by Section 5.3. As discussed in Section 5.3, BridgePure eliminates the protective cloaks the mimicry outputs.
C.4 Purification Quality for Style Mimicry
Figure 11 compares the purification effects with recent methods, including GrIDPure [76), PDM [69], and NoisyUpscaling [22]. For both Glaze and Mist, BridgePure- 10 effectively removes the protective cloaks, whereas other methods leave behind visually perceptible patterns.
Since PDM performs comparably to BridgePure, Figure 12 provides a comparison of the fine details in the purified paintings. PDM automatically smooths sharp brushstrokes, whereas BridgePure preserves them perfectly. The preservation of these details is crucial for faithfully mimicking the artist's style. Our results demonstrate that BridgePure achieves superior purification performance, particularly in preserving fine details while effectively removing protection cloaks.
C.5 Minor Protection Leakage
In previous tables, we report the results of BridgePure trained with protection leakage ranging from 500 4000 pairs. Figure 13 investigates the performance of BridgePure with less leakage, i.e., from 20 to 500 pairs, on CIFAR- 10 and CIFAR-100 protected by LSP. For CIFAR-10, 100 pairs are sufficient for BridgePure to improve the test accuracy to 93%. while for CIFAR-100 100, BridgePure- 100 only restores the accuracy to 50%, and BridgePure-2000 improves it to 69%. This difference in purification performance with minor protection leakage is because CIFAR-100 has times more categories, and thus, the leakage in each class is much less than that for CIFAR-10.
C.6 Comparison with Augmentation-Raan Methods and Protection Dilution
Figure 14 shows the detailed performance comparison with augmentation-base methods and pro- tection dilution on CIFAR-10 10 and CIFAR- 100, complementary to Figure The augmentation-bant methods include Cutout, Cutmix, Mixup, Gaussian Blur, Grayscale, JPEG Compression, bit depth (BDD)) and UEraser [46]. Regarding protection dilution, Dilution-4K means adding 4,000 unprotected images to the protected dataset and training classifier using the combined data. On both CIFAR- 10 and CIFAR-100, our BridgePure-0.55K (sky blue dots in figures) consistently sur- passes these other methods (dots with other colors).
Furthermore, it is well known that availability attacks are sensitive to the dilution of clean images. That is, mixing some unprotected images into the protected dataset could improve the test accuracy of trained classifiers. However, protection leakage poses much more severe risk than protection dilution since it exposes the protection mechanism. Table 6 compares BridgePure with dilution on CIFAR- 10 and CIFAR-100. With the same number of accessible unprotected images, BridgePure shows much better availability restoration than dilution.
26

---

Table Comparison between BridgePure and protection dilution. For example, Dilution-4K means adding 4,000 unprotected images to the protected dataset and training a classifier using the combined
data.
AR
DC
EM
GUE
LSP
NTGA
OPS
REM
TAP
Average
Dilution-O.5K
36.6
46.4
43.6
45.8
48.5
54.7
54.0
42.5
71.3
49.3
BridgePure-0.5K
93.9
93.8
93.6
93.7
93.8
94.1
93.3
84.3
86.8
91.9
CIFARIO
Dilution-4K
79.6
80.3
77.9
79.4
80.1
80.7
80.6
79.2
84.9
80.3
BridgePure-4K
93.6
93.8
93.9
93.8
93.9
93.9
93.5
93.5
92.9
93.7
Dilution-O, 0,5K
15.8
51.9
14.0
31.3
13.5
15,9
28.2
17.7
27.7
24.0
BridgePure-O..e K
67.5
73.7
73.2
72.7
73.3
69.1
74.2
66.5
62.8
70.3
CIFAR100
Dilution-44 4K
48.7
64.4
40.6
52.8
45.2
52.1
42.0
54.6
49.6
BridgePure-4K
72.4
74.0
73.5
74.6
74.2
74.2
73.0
71.0
73.4
C.7 Evaluation with More Network Architectures
Table 7, we evaluate the purified CIFAR-10 datasets for classification using various network architectures, including SENet-18 [23], MobileNer v2 [54], DenseNet-121 121 [24], VIT [11], and CaiT [64]. shows that the purification effect BridgePure is consistent across networks.
Table 7: We evaluate BridgePure- K-sanitized CIFAR-10 datasets using different network architec- tures. The baseline is trained on unprotected data,
Baseline
DC
EM
GUE
LSP
NTGA
OPS
REM
TAP
SENet-18 18
94,00mm
91.79au
93.78
93.73pu
93.77
93.96
93.96 23.96uus
93.28aue
92.32
87.37
MobileNet v2
90.60wes
m3.6
90.29.am
90.17aass
90.40uxm
90.43.a
90.73ux4
90,32au:
89.05ueas
84.54
DenseNet-122 121
94,44mm
92.24aue
94.32
93.92ozz
9
94.07
94.37uu
93.74au:
92.93
87. 87.75uum
84.80 34.80was
84.61am
84.48ass
84.26wa
83.94wes
84.80am
84.82mm
84,89ave
83.95uss
80.05wa
CaiT
82,73
82.53aaus
82.20
81.91
81.58a0
82.55.m
82.71
82.41aaz
81.90
78.09
Table 8: Transferablity of BridgePure-44, across CIFAR-10 and CIFAR-100. For example, CIFAR- 100 CIFAR-10 means BridgePure is trained using protection leakage of CIFAR- 1100R-100- and used to purify protected CIFAR-10 10. Here 0.33 and | 0.
DC
CIFAR-100 CIFAR-10
Protected
13.52400
23 23.79-111
12,76-0-4
1385aass
12.87-431
13.67-130
20 96- 3
9.51-247
(94.01a015)
Purified
32.16.0.6
37.334am
63.90 90
27.65.m
90.26wa2s
65.94x1 c2
93.43a027
30.2 30.22w011
78.18-a45
CIFAR-10 CIFAR-100
Protected
2.02+au
36. 10007
6.73wa13
19.50-e-s
2.56mas
1.51w033
12.18405
7.07
3.59-a1
(74:27a0as)
Poritied
13.74
53.22
59
33.55
54.33s0x
28.91e139
58.18-10
13.886
41.75-a33
C.8 Transferability across Protections
Although Table 4 demonstrates that randomly mixing multiple protection mechanisms fails to hinder an adversary from deriving an effective BridgePure, we consider a different scenario in which the adversary collects some additional data D, but calls different protection mechanism P', derives BridgePure using such pairs, and then purifies a dataset protected by P. In this case, the purification ability of BridgePure reflects its transferability across different protections.
On classification tasks, Figure 15 shows that BridgePure has limited transferability across protec- tions, and adnaned purification relies on the awareness of the underlying mechanism for the pro- tected data.
On style mimicry tasks, Figure 16 shows that BridgePure trained on Mist effectively purifies Glaze- protected paintings, and BridgePure trained on Glaze largely reduces Mist-patterns in the generated paintings.
In summary, although BridgePure exhibits varying degrees of cross-protection transferability on different tasks, this does not undermine the main claim of this paper-namely, that the protection leakage outlined in the threat model poses serious security risk.
27

---

C.9 Transferability across Data Distributions
In our threat model, we assume the additional dataset Da is sampled from the same distribution as that for D. Now we consider different scenario where an adversary cannot collect additional data from the same distribution but from another distribution, e.g. D is from CIFAR-10 and Da is from CIFAR- 100, vice versa.
On classification tasks, we investigate the influence of such distribution mismatch on the purification performance of BridgePure in Table 8. When BridgePure is trained on pairs from CIFAR-100 and used to purify protected images from CIFAR- 10, the accuracy for OPS and LSP over 90%, but that for other protections is lower than 80%. When BridgePure is trained on pairs from CIFAR-10 10 and is used to purify protected images from CI0,R-100, the accuracy for all nine protections is lower than 60%. The reasons why BidgePure transfers well from CIFAR- 100 to CIFAR-IO for LSP and OPS could be (1) OPS and LSP create rather regular patterns for protection while other methods generate irregular patterns (see Figure 9); (2) CIFAR-100 is more fine- fine-grained than CIFAR-10 and thus CIFAR- 100 pairs might cover the protection mechanism for CIFAR-10.
On style mimicry tasks, we train BridgePure using painting pairs by the renowned Impressionist artist Claude Monet and use to purify protected @nulevoy's artwork. Figure 17 shows that the generated images are free of any protective patterns, indicating that BridgePure transfers well across different art styles.
C.10 Comparison between VE and VP Bridges
DDBM [77] supports two modes for the diffusion process: variance exploding (VE) and variance preserving (VP). Figure 18 compares the performance of VE and VP bridges on CIFAR-10 and 100. When facing REM and TAP attacks on CIFAR-100, the VE bridge consistently outper- forms the VP bridge for two values of 8. In other cases, the purification effects of the two modes are comparable. Therefore, adopt the VE bridge as the default setting in this paper.
Table 9: Purification performance on CIFAR-10 and CIFAR-100 against EMC*, OPS* and TAP* protections.
EMC
OPS
TAP=
EMC
OPS
TAPS
CIFAR- 10 (94001a015)
CIFAR- 100 (74.27a045)
Protected
13.05
12.01
7.6820.5
1.41aa11
12.442006
3.2420.22
BridgePure-O.55
93. 13
92.99s002
80.20s022
74,462016
73.70a011
$9.31
BridgePure-I K
94.06+a.1
93.52-033 30
82.44-040
74.54s017
74.26=016
63.79-0.29
BridgePure-29
93 852117
93.142025
90.55
74.224039
74.38a025
63.01
BridgePure-4K
93. 15
93.92s0.8
93.07s0.19
74.00s0.9
74.36
69.92s0.13
C.11 More Discussion on Protection for Additional Data
Note that our threat model assumes that the protection mechanism P can generate (unprotected, protected) pairs using only the additional data D,. While some availability attacks such as LSP, UC, UC-CLIP, Glaze, and Mist are precisely examined in this way, some other attacks may not fit exactly into the threat model. For example, EM and REM generate sample-wist wise protection on the dataset they optimize. Thus performing the protections on D and D, separately may result in different protection mechanisms.
To ensure that the protection is consistent for 'D and Da. we generate the protection using both 'D and the reference set from which D. is sampled and evaluate the attacks in Tables 1 and 2. This may pose a slightly stronger protection leakage that allows an adversary to directly obtain the additional pairs. Here we consider three additional variants of the attacks we considered previously and allow access to D. only:
EMC*: We generate class-wise EM protection [25] using the 40K images to be protected and apply the protection to additionally collected data.
Similar to EMC*, we generate OPS protection [68] using the 40K images to be protected and apply the protection to additionally collected data.
OPS*:
28

---

TAP*: The reference classifier is trained on the 40K images, and the protection for addi- tional data search adversarial examples for this classifier [15].
We evaluate these three protections on CIFAR-10 10 and CIFAR- 100 in Table 9 and the results confirm the potent purification ability of BridgePure that is consistent with the previous results in Section 5.2.
D
Countermeasures and Broader Impacts
D.I Possible Countermeasures against Protection Leakage
Service provider side. To prevent malicious adversaries from training a powerful BridgePure model, the most effective strategy is to restrict their access to protection leakage (paired data) de- rived from unauthorized sources. While may be impossible to stop adversaries from acquiring limited number of unprotected images, the critical safeguard is to limit their ability to use the pro- tection mechanism (e.g., an API) to generate the corresponding protected versions. To implement this, we propose the following recommendations:
Include special parameters random seeds in open- open-sourced methods control repro- ducibility. real-world deployment, such configurations should prevent malicious adver- saries from fully replicating the protection algorithm.
Avoid offline protection services, such as standalone applications, as they lose control over the invocation of the protection mechanism and cannot prevent protection leakage. Offline data protection services should not guarantee strong security.
Incorporate identity and data ownership verification into protection services. For exam- ple, in the case of artistic style protection, users should be required to declare and prove copyright ownership the artwork to be protected, subject to provider review. The service should maintain registry of verified styles and enforce that: (1) No single style can be registered by multiple users. (2) No single user can register multiple, conflicting styles. (3) Each user may only protect artworks consistent with their registered style.
alternative line of defense against the BridgePure threat to design protection mechanisms that are resilient to its purification capabilities. However, to the best of our knowledge, no exist- ing availability attack or copyright protection method has been proposed that can effectively resist purification techniques based on diffusion models. Given that BridgePure directly learns the trans- formation between distributions- pipeline-we we believe that developing robust protection methods specifically against BridgePure rep- resents a more compelling and challenging direction for future research, with promising potential for broad
than relying on the traditional noise-adding and denoising
applications.
Service user side. For protection service users, the most straightforward defense to minimize leaking unprotected images and choose trustworthy protection service providers. We also believe the following directions show promise as additional defense strategies:
Preemptive defenses: Users can develop adversarial preprocessing techniques that make their images inherently resistant to BridgePure attacks. One approach could involve gradient-based methods that require differentiating through the stochastic purification pro- cess, presenting an interesting direction for future research.
Strategic decoys: Users can strategically release crafted decay images designed to poison the attacker's training data, reducing BridgePure's 's effectiveness on their actual protected content. Potential approaches include madient-based perturbation search, visible or invisi- ble watermarking, and inducing significant domain shifts, among others.
The effectiveness of these mitigation strategies requires further investigation, and we look forward investigating further in future work.
D.2 Broader Impacts
This research focuses on the reliability of data protection methods in real-world scenarios. Through the deployment of BridgePure, we discovered that limited protection leakage can lead to the failure
29

---

of existing protection mechanisms. Our findings have profound implications for the community. underscores the urgent need for more resilient data protection frameworks. Additionally, it in- forms researchers and practitioners about the risks associated with current black-box protection approaches, fostering the development of more secure methodologies. Finally, empowers data owners and service users by increasing awareness of the potential weaknesses in protection systems, helping them make more informed decisions when sharing sensitive data.
30

---

EM
GUE
LSP
NTGA
OPS
REM
TAP
Original
Protected
Purified
EM
LSP
TAP
Original
Protected
Purified
Figure 9: Visualization of BridgePure-IK 1K CIFAR-10 (top) and SebFace-Subsee (bottom). ).
Purifed
Purited
Original
Ghiee
PoxtDd Giose
PuriSed
Figure 10: Additional results to Figure 7, Performance BridgePure-S (left) and BridgePure-10 10 (right) for style mimicry.
31

---

Clean
Protected
PurD
PDM
NoisyUpscaling
BridgePure
(a) Purifying Glaze-protected @ @nulevoy's 's paintings.
Clean
Protocted
GrIDPure
PDM
NoisyUpscaling
BridgePure
(b) Purifying Mist-protected @nulevoy's ' paintings.
Figure 11: Paintings purified by recent purification methods and BridgePure- 10.
Clean
PDM
BridgePure
Figure 12: Comparison of purified painting details (cropped from Figure 11) between PDM and BridgePure. Red boxes emphasize the details that PDM blurs.
32

---

80
90
Accuracy
Accuracy
Baseline
Baseline
80
000.33
5=0.33
s=0.8
s=0.8
70
20
20
60
100
200
300
400
500
20
60
100
200
300
400
500
Protection Leakage
Protection Leakage
Figure 13: Purification performance of BridgePure with small protection leakages purify LSP- protected CIFAR-10 (left) and CIFAR-100 (right). Here / 0 and 8 E {0.33, 0.8}.
100
80
Unprotacied
BrdgePure
60
Diluion-IK
Accuracy
Accuracy
40
Cutnix
40
Moup
20
Gaussian
Grayscale
JPEG
AR
DC
EM
GUE
LSP
NTGA
OPg
REM
TAP
AR
0C
EM
GUE
LSP
NTGA
OPS
REM
TAP
UEraser
Figure 14: Performance comparison with augmentation- based methods, and protection dilution on
CIFAR-10 (left) and CIFAR- 100 (right). The sky blue dots show the performance BridgePure- 0.5. Dots with other colors stand for other circumvent methods. The dashed lines represent the unprotected baselines. The higher the dots, the better the accuracy recovery.
AR
80.0
5.0
-1.0
-2.1
-1.6
-0.5
-0.4
11.1
24.0
DC
0.4
78.7
40.3
7.9
-0.6
11.6
EM
For purification
GUE
0.8
24.7
81.1
0.2
1.3
34.0
-0.1
LSP
3.8
42.5
20.0
10.1
80.1
27.4
2.8
15.9
15.6
NTGA
8.4
46.8
37.4
1.7
4.5
81.1
4.8
44.
36.6
OPS
0.1
0.2
0.8
1.4
-0.6
1.5
79.6
-0.8
2.2
REM
TAP
-0.4
0.0
0.8
0.0
0.7
-0.5
2.3
83.4
AR
DC
EM
GUE
LSP
NTGA
OPS
REM
TAP
For BridgePure ure training
Figure 15: Transferablity of BridgePure-4K across different protections on CIFAR-10. The x-axis represents the protection leakage on which BridgePure is trained. The y-axis represents the pro- tected dataset which the pre-trained BridgePure applied for purification. Each cell shows an improvement in test accuracy compared to the unpurified dataset. Here = 0.33 and B 0.
33

---

Paintings for fine-tuning
Paintings for fine-tuning
Clean
Protected
Purified
Clean
Protected
Purified
Generated artwork after purification
Generated artwork after purification
Glaze
Mist
Mist
Glaze
Figure 16:
Transferability across style mimicry protections. Left: Using BridgePure- 10 trained
with (clean, Glaze-protected) pairs to purify Mist-protected paintings. Right: Using BridgePure- 10 trained with (clean, Mist-protected) pairs to purify Glaze-protectee paintings. Top: Clean paint- ings by @ @nulevoy, protected ones, and BridgePure-puriine purified ones. Bottom: Mimicked artwork by prompting the Stable Diffusion v2.1 that is fine-tuned on the BridgePure-purifeed paintings.
34

---

Paintings for fine-tuning
Paintings for fine-tuning
Clean
Protected
Purified
Clean
Protected
Purified
Generated artwork after purification
Generated artwork after purification
Mist Monet's
Mist Nulevoy's
Glaze Monet's Glaze Nulevoy's
Transferability across datasets for style mimiery. We train BridgePure- 10 on Monet's paintings and use it to purify @nulevoy's protected artwork. Left: Both Monet's and @ @nulevoy's paintings are protected by Mist. Right: Both Monet's and @nulevoy's paintings are protected by Glaze. Top: Clean paintings by @nulevoy, protected ones, and BridgePure purified ones. Bottom: Mimicked artwork by prompting the Stable Diffusion v2.1 that fine-tuned on the BridgePure- purified paintings.
Figure 17:
100
100
80
80
Accuracy
Accuracy
60
CIFAR-10
VE
60
CIFAR-10
CIFAR-10
VP
CIFAR-10
CIFAR-100
CIFAR-100
40
40
CIFAR-100
VP
CIFAR-100
LSP
REM
TAP
LSP
REM
TAP
Figure 18: Comparison between VP and VE modes of BridgePure- IK with = 0.33 (Ieft) and with
s = 0.8 (right). Here 3 =
35


Reviews:
[{"review_id": "kUwt8Szz2N", "reviewer": "Reviewer_wUPu", "summary": "The paper discusses the vulnerability of protection leakage in black-box data protection systems, which arises when an adversary has access to the black-box API, introducing a novel threat model. The authors propose a model, BridgePure, that exploits a limited number of leaked data pairs to reverse data protection mechanisms. BridgePure trains a diffusion-based model to map the protected data back to its original, unprotected form. Experiments show that BridgePure outperforms existing purification methods, even when the number of leaked data pairs is minimal.", "questions": "- In what way is BridgePure technically novel compared to other works, or what specific technical contributions does this paper make? Please provide further clarification. \n\n- I would be willing to adjust my score if the authors address my concerns.", "limitations": "Yes.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths \n- The paper introduces a novel threat model that includes access to the black-box APIs of protection methods and demonstrates an unignorable privacy breach under such assumption.\n- The paper provides extensive experiments demonstrating that BridgePure consistently outperforms traditional purification methods across multiple datasets.\n- The paper is overall well-presented, making it easy to follow.\n\nWeaknesses\n- The technical contribution is somewhat limited. BridgePure appears to be built on existing work with Diffusion Denoising Bridge Models [1], incorporating a Gaussian noise trick to address overfitting.\n- The paper assumes that the additional dataset is sampled from the same distribution as the attacked dataset, which is a relatively idealized assumption. When this condition does not hold, the performance of BridgePure is not well evaluated. Specifically, there is a lack of comparison with other baselines in such a case, such as baselines that rely on no additional data or large amounts of additional data. The robustness requires further validation.\n\n\n[1] L. Zhou, A. Lou, S. Khanna, and S. Ermon. “Denoising Diffusion Bridge Models”. In: The Twelfth International Conference on Learning Representations. 2024.", "was_revised": true, "final_justification": "The rebuttal primarily clarifies the technical novelty and justifies the evaluation of transferability across distributions, thereby providing a deeper understanding of the significance of this work. Considering these points, I've updated my score to a borderline accept.", "rebuttal": "We thank the reviewer for recognizing our contribution. Here we address your comments.\n\n\n[**W1: Technical Novelty**]: We believe our work represents the first application of diffusion bridge models to the data protection domain. This adaptation is not straightforward for several reasons:\n- Diffusion bridge models were primarily designed for scenarios with drastic domain shifts, while data protection mechanisms typically introduce subtle, human-imperceptible perturbations rather than obvious domain changes. The effectiveness of bridge models in recovering clean data from such subtle perturbations was not guaranteed or obvious prior to our investigation.\n- We introduce specific modifications to the diffusion bridge approach for this application, including a conditioning mechanism that balances protection removal and content preservation.\n- Our comprehensive analysis across different protection methods provides novel insights into the vulnerabilities of various protection schemes that were previously unexplored.\n- The fact that our approach effectively neutralizes these carefully designed protections demonstrates the non-obvious nature of our solution.\n\n\n\n\n[**W2: Assumption and Comparison**]: \n- [*Baselines without additional data*] The comparison in Table 1 includes two baseline methods, i.e., PGD-AT and D-VAE, that rely on no additional data. Note that other baseline methods, including AVATAR, LE-JCDP, and DiffPure, use diffusion models that are pre-trained (and then fine-tuned) with large amounts of in-distribution unprotected data.\n- [*Real-world datasets*] Real-world datasets, such as ImageNet, Pets, Cars, and WebFace, may contain blurring, occlusion, complex backgrounds, various lighting conditions, and even some mislabeled categories as pointed out in [a]. Our experiments on these datasets (Tables 2, 3) demonstrate that BridgePure is robust to the noise introduced by this level of real-world image collection.\n- [*Transferability across distributions*] In Appendix C.10, we systematically discuss the transferability of BridgePure across data distributions for both classification and style mimicry tasks. For classification tasks, we found that BridgePure underperforms on most availability attacks when the distribution of additional data does not match that of the data to be purified, e.g., between CIFAR-10 and CIFAR-100. However, for style mimicry tasks, BridgePure performs better when transferring across different artists' painting styles, e.g., between @nulevoy and Claude Monet.\n\n[a] Northcutt C G, Athalye A, Mueller J. Pervasive label errors in test sets destabilize machine learning benchmarks, 2021."}, {"review_id": "v2f1aKK6Wl", "reviewer": "Reviewer_bUys", "summary": "This paper addresses the problem of the protecting public datasets from being used for training machine learning models through the use of availability attacks. Specifically, they investigate how online black-box models for creating unlearnable examples can be exploited to create a small training set of (clean, protected) data pairs. These training examples can be used to train diffusion model that can recover an original data point from a given unlearnable example. Their empirical results show that their approach train a recovery model using substantially fewer training examples than state-of-the-art methods in the literature.", "questions": "Have you tested the sensitivity of the performance of the methods in [9] and [25] to the number of clean training examples that they use?\n\nWhile there is some discussion in Section C.1 of the computation time for your approach, can you provide any comparison or analysis of time required by the other baseline methods [9] and [25]?\n\nCan you provide more details on possible countermeasures against your protection leakage attack?", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n\nThe paper presents a new threat model to methods that aim to provide unlearnable examples from given clean example. This threat model considers how online services for generating unlearnable examples can be used to construct training data, which in turn can be used to learn a model of how to reverse the protections provided to unlearnable examples.\n\nThey present a novel algorithm for training a purification model to attack unlearnable examples, based on the theory of diffusion models.\n\nThey demonstrate that their approach can effectively attack methods for creating unlearnable examples by using a much smaller set of training data than existing methods.\n\nWeaknesses\n\nWhile they provide some discussion of possible defences against such a protection leakage attack, they do not provide any concrete defence strategies that could be followed by users.", "was_revised": true, "final_justification": "My main comment was about possible defences. The authors have addressed this at a high level. Overall, I support this paper's acceptance.", "rebuttal": "We thank the reviewer for the overall positive feedback! Here we address your concerns:\n\n[**W&Q3: Defense Mechanism**]:\n\n- Indeed, in Appendix D.1, we focus on countermeasures that protection service providers can implement to prevent malicious adversaries from training an effective BridgePure model. These providers are obligated to deliver responsible, reliable, and robust data protection in line with their claims. Specifically, we encourage protectors to consider BridgePure threats when crafting images and adopt both system-level and algorithmic approaches.\n\n- On the user side, the most straightforward defense is to minimize leaking unprotected images and choose trustworthy protection service providers. We also believe the following directions show promise as additional defense strategies:\n\n  (a) *Preemptive defenses*: Users can develop adversarial preprocessing techniques that make their images inherently resistant to BridgePure attacks. One approach could involve gradient-based methods that require differentiating through the stochastic purification process, presenting an interesting direction for future research.\n\n  (b) *Strategic decoys*: Users can strategically release crafted decoy images designed to poison the attacker's training data, reducing BridgePure's effectiveness on their actual protected content. Potential approaches include gradient-based perturbation search, visible or invisible watermarking, and inducing significant domain shifts, among others.\n\n  Of course, the effectiveness of these mitigation strategies requires further investigation, and we look forward to investigating further in future work. \n\nWe will add the above discussion to our draft.\n\n\n\n[**Q1&Q2: Comparison with AVATAR[9] and LE-JCDP[25]**]\n\n- We did not retrain the diffusion models from [9] and [25] as both repositories released pre-trained checkpoints rather than detailed training scripts.\n- Regarding sensitivity to the number of training samples, we followed the experimental settings from [9] and [25] using their released models: [9]'s model is trained on 50K unprotected images while [25]'s model is pre-trained and then fine-tuned on 10K unprotected images. We believe our test case represents typical practical settings.\n\n    Notably, our BridgePure-0.5K (using only 500 paired images) outperforms both baselines on 7 of 9 attacks for CIFAR-10 and surpasses [9]/[25] on 8/6 of 9 attacks respectively for CIFAR-100. BridgePure can outperform both methods using at most 4K pairs in the remaining cases.\n\n- Regarding runtime, neither [9] nor [25] disclosed the computational cost of diffusion model training. Unfortunately, reproducing their training time is not feasible due to computational costs and a lack of implementation details."}, {"review_id": "FuO2dvfZmw", "reviewer": "Reviewer_nN4s", "summary": "This paper studies attacks against black-box tools that allow data owners to input their dataset and receive a protected version that is “unlearnable” by an ML model. The authors show that, given access to a small set of unprotected in-distribution data and their protected counterparts, an adversary can easily train a diffusion denoising bridge model that learns an inverse mapping, and which generalizes to unseen data from the same distribution. They call this approach BridgePure, and they show that it gives better results than prior work without requiring pretraining or fine-tuning a large model using a lot of data.", "questions": "- Could the work be generalized to non-image datasets?\n- How robust is BridgePure to small variations in the unprotected data from the original distribution?", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths\n- The authors give extensive experimental results on a range of image datasets for the classification tasks, with comparisons against multiple existing purification-based methods, where they show significant improvements.\n- This work shows a vulnerability in the existing protection APIs, which is important for the API providers to come up with ways to protect against these attacks. \n\nWeaknesses\n- This approach assumes that the attacker can query the same protection API and has access to sufficiently many unprotected data from the same distribution. It is unclear whether these assumptions hold in practice. For instance, leaked images from the same distribution may have some noise or have a slightly different distribution, and it is unclear how these differences may affect the effectiveness of BridgePure.\n- This work only focuses on image datasets, and it is unclear whether BridgePure works with other types of data.", "was_revised": true, "final_justification": "The authors added some clarifications about W1 but did not address W2, hence I will keep my score.", "rebuttal": "We thank the reviewer for the overall positive feedback, here we address your concerns.\n\n[**W1: Assumption**] \n\n(1) *Noisy datasets:* Real-world datasets such as ImageNet, Pets, Cars, and WebFace contain natural variations including blurring, occlusion, complex backgrounds, various lighting conditions, and even mislabeled categories as noted in [a]. Our experiments on these datasets (Tables 2, 3) demonstrate that BridgePure is robust to the noise inherent in real-world image collections.\n\n\n(2) *Distribution shift*: We also address potential concerns about distribution mismatch between BridgePure's training data and the protected target data. In Appendix C.10, we systematically analyze BridgePure's transferability across data distributions for both classification and style mimicry tasks. For classification tasks, BridgePure underperforms on most availability attacks when the training data distribution does not match the target distribution (e.g., between CIFAR-10 and CIFAR-100). However, for style mimicry tasks, BridgePure transfers effectively across different artistic styles (e.g., between @nulevoy and Claude Monet).\n\n[**W2: Beyond Image Datasets**] \n\nWe focus on gradient-based methods, which are most naturally applied to continuous domains like images. We agree that extending data protection to discrete domains such as text, tabular data, or voice is an interesting direction for future work.\n\n[a] Northcutt C G, Athalye A, Mueller J. Pervasive label errors in test sets destabilize machine learning benchmarks, 2021."}, {"review_id": "v4YVFdDhGi", "reviewer": "Reviewer_YM14", "summary": "This paper investigates the problem of protection leakage against black-box data protection methods. Specifically, it proposes BridgePure, which utilizes DDBM as a powerful purification algorithm to purify the perturbations used to protect the images. The key idea is to query the black-box data protection APIs and obtain a set of paired images, which are used to build this purification model. The authors conduct sufficient experiments to demonstrate the effectiveness of the proposed attack.", "questions": "1) How does BridgePure perform against adaptive defenses, particularly in light of the concerns raised in Weakness 3? Evaluating the method under such settings would provide a clearer picture of its robustness and practical utility.\n2) Can you clarify the novelty and significance of BridgePure, especially considering the concerns outlined in Weaknesses 1 and 2?", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths:**\n1) The paper is well-written and easy to follow\n2) The authors introduce a new threat model: the protection leakage attack against black-box data protection APIs.\n3) The authors conduct sufficient experiments on both classification (availability attacks) and generation (style mimicry protections) tasks.\n\n**Weaknesses:**\n1) While the paper introduces a new threat model, the technical novelty remains limited. The core idea of using a purification model closely resembles existing adversarial purification methods. The main difference lies in leveraging prior knowledge of the black-box protection API during training, which is a relatively modest extension.\n2) The reported performance gains, even with 0.5K to 4K queried samples, appear incremental. As shown in Tables 1 and 2, the improvements over baselines are relatively small.\n3) The paper lacks a defense evaluation. The proposed attack is not tested against any existing or adaptive defenses, making it difficult to assess its robustness and practical impact.", "was_revised": true, "final_justification": "I will keep my score as positive.", "rebuttal": "We thank the reviewer for the overall positive feedback. Here we address your concerns.\n\n[**W1&Q2:Technical Novelty**] \n\nWe believe our work represents the first application of diffusion bridge models to the data protection domain. This adaptation is not straightforward for several reasons:\n- Diffusion bridge models were primarily designed for scenarios with drastic domain shifts, while data protection mechanisms typically introduce subtle, human-imperceptible perturbations rather than obvious domain changes. The effectiveness of bridge models in recovering clean data from such subtle perturbations was not guaranteed or obvious prior to our investigation\n- We introduce specific modifications to the diffusion bridge approach for this application, including a conditioning mechanism that balances protection removal and content preservation.\n- Our comprehensive analysis across different protection methods provides novel insights into the vulnerabilities of various protection schemes that were previously unexplored.\n- The fact that our approach effectively neutralizes these carefully designed protections demonstrates the non-obvious nature of our solution.\n\n[**W2&Q2: Performance Improvement**]\n\nWe believe that BridgePure's performance improvements are not incremental, as achieving complete availability recovery is the adversary's ultimate goal, making the marginal utility of the final percentage points highly significant.\n\nFor example, previous methods could only restore CIFAR-100 dataset availability under EM protection from 6.73% to at most 67.76%, which remains far from the unprotected baseline of 74.27%. In contrast, our BridgePure-2K achieves 73.70%, nearly complete recovery. This performance improvement is highly valuable to adversaries but poses a critical threat to data protection systems.\n\n\n\n[**W3&Q1: Adaptive Defenses**]\n\n- In the Appendix, we conducted experiments demonstrating various aspects of BridgePure's robustness, including different levels of protection leakage (App C.4), mixtures of multiple protection methods (App C.7), transferability across network architectures (App C.8), transferability across protection methods (App C.9), and transferability across data distributions (App C.10).\n- Regarding adaptive defenses, we want to clarify a key difference between data protection and adversarial attacks: in adversarial attacks, the defender receives the perturbed image and can process it further, while in data protection, the attacker receives the perturbed image and can process it further (after the defender can no longer modify it). The defender could potentially account for BridgePure during the initial protection crafting stage, but this would require differentiating through BridgePure—a significant technical challenge that has not been achieved in existing literature and represents an important direction for future work."}]

Author rebuttal:

Meta-review: "BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection" describes a vulnerability that arises when users (e.g. artists) are using black-box APIs to attempt to make their data points unlearnable. An adversary is able to query the API with their own unprotected dataset and, with a limited number of queries, is able to train a type of image-to-image diffusion model to compltely undo the protection.

Reviewers unanimously consider this work to be interesting, and the threat to be noteworthy. While the solution to use learned image-to-image models mirrors other diffusion models employed for e.g. adversarial perturbation, or paraphrasing models in language domains, and it was pointed out by reviewers to be not totally unexpected, the submission precisely delimits the threat model, evaluates the approach very clearly and without the need of unnecessary complexity, shows that this attacks works - especially when facilitated through diffusion bridge models, and should be strongly considered in any future work on defenses.

From my side, while the submission discusses related work on purification schemes, I would have liked to see a few more simple baseline comparisons, using e.g. JPEG compression, which can help to better place the achieved purification gains in a context of familiar image operations. Reviewers also point out a few remaining limitations, such as questions regarding defenses against this type of attack, and generalizability to other domains, but the submission is complete enough as it stands, as these limitations may be the focus of future work.
Decision: Accept (poster)