Title: Versatile Transferable Unlearnable Example Generator
Venue: NeurIPS 2025
Accepted: yes
Keywords: unlearnable examples

data privacy
Abstract: The rapid growth of publicly available data has fueled deep learning advancements but also raises concerns about unauthorized data usage. Unlearnable Examples (UEs) have emerged as a data protection strategy that introduces imperceptible perturbations to prevent unauthorized learning. However, most existing UE methods produce perturbations strongly tied to specific training sets, leading to a significant drop in unlearnability when applied to unseen data or tasks. In this paper, we argue that for broad applicability, UEs should maintain their effectiveness across diverse application scenarios. To this end, we conduct the first comprehensive study on the transferability of UEs across diverse and practical yet demanding settings. Specifically, we identify key scenarios that pose significant challenges for existing UE methods, including varying styles, out-of-distribution classes, resolutions, and architectures.
Moreover, we propose $\textbf{Versatile Transferable Generator}$ (VTG), a transferable generator designed to safeguard data across various conditions. Specifically, VTG integrates Adversarial Domain Augmentation (ADA) into the generator’s training process to synthesize out-of-distribution samples, thereby improving its generalizability to unseen scenarios. Furthermore, we propose a Perturbation-Label Coupling (PLC) mechanism that leverages contrastive learning to directly align perturbations with class labels. This approach reduces the generator’s reliance on data semantics, allowing VTG to produce unlearnable perturbations in a distribution-agnostic manner. Extensive experiments demonstrate the effectiveness and broad applicability of our approach. Code is available at https://github.com/zhli-cs/VTG.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents a method for generating “unlearnable” examples under feature or label distribution shifts. Unlearnable examples are data points that cause models trained on them to learn the correspondence between labels and perturbations instead of capturing the true semantics, leading to poor classification accuracy on clean test images. The paper proposes training a domain composer to generate out-of-distribution (OOD) data and a perturbation-label coupling mechanism to learn the perturbation generator in a nearly distribution-free setting. Across varying levels of distribution shift in labels or features, the authors demonstrate that their algorithm outperforms existing approaches.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths** \nI find this paper addresses an interesting problem by proposing a novel method and empirically demonstrating its superiority over existing approaches. \n\n**Weaknesses**\n\n- The definition of “unlearnable” in this context is somewhat unclear: success is measured by degraded test accuracy, which is similar to a specific type of clean-label attacks in the data-poisoning literature. \n- Although the goal is to render individual data points “unexploitable/unlearnable” by deep models and thus protect their privacy, the privacy implications of training on these modified “unlearnable” examples remain unexplored. Prior work shows that poisoned examples often exhibit higher memorization scores [1], and because the perturbations here are small, extracting an “unlearnable” example may reveal the original data. In practice, this approach may even worsen privacy, if a company unknowingly trains on poisoned data.\n\n[1] Tramèr et al. Truth Serum: Poisoning Machine Learning Models to Reveal Their Secrets. 2022.\n\nQUESTIONS:\nWhat's the difference between data poisoning attack that aims at decreasing test accuracy and generating unlearnable examples?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 2, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents a novel framework for generating Unlearnable Examples (UEs) that maintain their effectiveness across diverse machine learning scenarios. In contrast to prior methods, which often fail to generalize beyond the specific conditions of their training data, the proposed Versatile Transferable Generator (VTG) is designed to produce UEs that remain robust across varying tasks, domains, input resolutions, and model architectures. By leveraging two core components—Adversarial Domain Augmentation (ADA) and Perturbation-Label Coupling (PLC)—VTG demonstrates consistent superiority over existing UE approaches across five distinct transferability settings.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n- The paper is clearly organized and provides thorough explanations of the model architecture, loss functions, training methodology, and datasets used.\n- The proposed method, VTG, is novel and offers a partial solution to a critical challenge in machine learning privacy—the transferability of unlearnable examples. Extensive experiments validate its superiority over existing baselines across five challenging real-world scenarios.\n- The results demonstrate strong resilience against common defense strategies, including adversarial training, which has proven effective against most existing unlearnable example methods.\n\n\nWeaknesses:\n\n- The paper is lack of analyses. Although the results are compelling, there isn't enough theoretical nor empirical analyses such as visualizations to explain why the generated perturbations work.\n- The paper lacks an ablation study. For example, it does not explore how the depth of the generator affects the effectiveness of the attack.\n- The proposed method is compared to other sample-level approaches; however, since it incorporates the PLC mechanism, it raises the question of whether the generated perturbations are closer to class-level patterns. I would expect the authors to provide more clarification on this point.\n- The PLC procedure relies on CLIP to extract text embeddings, which may inherit biases or vulnerabilities from its pretraining data.\n\nQUESTIONS:\n- Since the method leverages the PLC mechanism, do the generated perturbations tend to resemble class-level patterns rather than being strictly sample-specific?\n- Does the use of CLIP introduce additional vulnerabilities, given its potential biases and limitations inherited from pretraining on large-scale web data?\n- Regarding the results in Table 7, were all defense strategies applied simultaneously during the generation of the perturbed data, or was each evaluated defense strategy applied individually?\n\nLIMITATIONS:\n- As stated in the paper, the proposed method introduces additional computational overhead.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies the problem of generating unlearnable examples by perturbing the data. The idea is that we want to perturb inputs such that when you train a classifier on these inputs, it does not learn the semantics, and only learns the features of the perturbation. Compared to prior work, the authors propose a more rigorous evaluation framework where the perturbation generator is learned in one source task, and then applied to other target tasks that are unknown during training. They propose Versatile Transferable unlearnable example Generator (VTG), which is a complex method for training the perturbation generator. They show that VTG achieves superior unlearnability performance compared to prior state of the art in several of their evaluation settings.\n\nSTRENGTHS AND WEAKNESSES:\nFor calibration,  I want to mention that I was previously not aware of the field of generating unlearnable perturbations, and so I am not familiar with the prior work in this field.\n\n# Strengths\n\n**S1.** The evaluation setting that the authors develop appears to be more realistic than the evaluations done in the previous literature. It seems important to evaluate unlearnability under diverse tasks.\n\n**S2.** The authors do a careful evaluation with many baselines and evaluation settings.\n\n**S3.** The authors perform an ablation of the various components of the method suggesting that the different components are indeed useful.\n\n**S4.** The proposed method performs well in the evaluations presented by the authors, outperforming the baselines significantly in most of the distribution shift settings.\n\n**S5.** The paper is generally well-written.\n\n# Weaknesses\n\n**W1.** The proposed VTG method is quite complicated, and it's hard to understand what exactly each component is doing. I will ask several questions about the method in the questions section. But overall, I feel like the presentation of the method does not do a good enough job of explaining what is the motivation behind each component and how all of them fit together.\n\n**W2.** The only metric that is considered in evaluation is the test accuracy, which should be as low as possible. Generally, it is very easy to generate perturbations that lead to poor accuracy: $\\delta(x) = G(x) = -x$. You would get exactly random guess performance on any data distribution by applying this perturbation. Consequently, what makes the task non-trivial is that there should be some constraint on what the perturbation should be. The authors mention that the perturbation should be imperceptible, which seems like a reasonable requirement: if you want to apply the perturbations to the images you upload to the internet, you don't want the images to be visibly affected. The authors do incorporate a hinge loss on the size of the perturbation in Eq. (7), towards this goal. However, the imperceptability of the perturbations is not a part of the evaluations, as far as I understand. In particular, if I understand correctly, the perturbations could actually be quite large, if the optimization pressure is insufficient to make them small. Moreover, it is unclear how the size of the perturbations compares to the other baselines considered.\n\nOverall, only using low test accuracy as a measure of performance without any additional constraints on the perturbations seems wrong. Another trivial way to game this objective is to use a very bad classifier, or use inadequate hyper-parameters for the classifier. Possibly there should be constraints such as high train accuracy, and high accuracy when trained on clean data with the same hyper-parameters. Perhaps this last concern is partially evaluated by reusing the same architecture and hyper-parameters for the classifier across all baselines.\n\nQUESTIONS:\n**Q1.** Please comment on W2.\n\n**Q2.** Do I understand that the Adversarial Domain Augmentation could in principle be replaced with any other data augmentation strategy? If so, I would suggest to abstract it away in the presentation of the method, and present it after the core part of the method. I.e. you could just say that the first loop in your method is to train a classifier on the original data, with any strategy you may like. You could also ablate different kinds of augmentation strategies potentially (I am not requesting this for the rebuttal, just a suggestion).\n\n**Q3.** What is Concat in Eq. (5)? Are you concating the images, or are you just aggregating the dataset across all augmentations? I think it's the latter, but then the notation is confusing.\n\n**Q4.** Overall, it wasn't clear to me how the objectives (4) and (5) interact with each other? Do you first train against (4) for some number of steps and then train against (5)? Or do you train against a combination of both (4) and (5) simultaneously? \n\n**Q5.** Could you present examples of what augmentations $C_\\mu$ actually learns? I am not sure if you can put images in the rebuttal, but please include these in the updated versions of the paper, and describe in text in the rebuttal, if not.\n\n**Q6.** I found the CLIP-based contrastive learning bit quite confusing. Is there any reason for the encodings of the classifier to be aligned with the text encoder of CLIP? In theory, they don't even need to be of the same dimension? My understanding is that $z_\\theta$ is a part of the classifier $f_\\theta$, and that it is frozen during the training on objective (9)? Overall, what is the motivation here, why do you want to use the image embedding?\n\n**Q7.** In the experiments, are all the models (domain composer, classifier, perturbation generator) trained from scratch? Is CLIP text encoder the only pretrained model used?\n\n**Q8.** At test time, is the perturbation generator $G$ only conditioned on the input image? It is not using the labels or any other information?\n\n**Q9.** What are the limitations on the scalability of the method? Is it possible to apply it to the full ImageNet, as opposed to the first 100 classes? How does the runtime for training compare to the baselines? (not request for rebuttal, just a question)\n\n**Q10.** When tuning the hyper-parameters such as the weights for the different losses, learning rates, etc, do you use the performance on the in-domain test set as a target?\n\nLIMITATIONS:\nLimitations adequately addressed.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper aims to improve the transferability of unlearnable examples across various scenarios. It combines Adversarial Domain Augmentations and the Perturbation-Label Coupling mechanism to train a Versatile Transferable Generator. The trained generator generalizes very well to unseen data from multiple domains.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1. This paper systematically benchmarks the transferability of unlearnable examples across multiple scenarios, including intra-domain, cross-domain, cross-task, cross-space, and cross-architecture, which is very important for applying UEs as a practical real-world data protection tool.\n\n2. It introduces a novel component, the domain composer, into the UE area, which leads to the enhancement of the domain transferability. \n\n3. The results in Table 8 are impressive, as they show that a generator trained on ImageNet can serve as a \"foundation\" model to execute protections for different domains simultaneously.\n\n4. Experiments are comprehensive. The structure is well-organized. It's easy to read.\n\n\nWeakness:\n\n1. It's unclear why aligning the perturbation feature extracted by a surrogate model with the label feature extracted by the CLIP text encoder can lead to Perturbation-Label Coulpling. This process seems to make perturbations in the same class cluster around a certain point.  I don’t see the CLIP text encoder playing an irreplaceable role here.\n\n2. This paper did not present augmented images after the domain composer $C_\\mu$. I'm curious about how much the composer distorts the clean images and if it works precisely as the illustration (various planes) in Figure 1 shows. \n\n3. The defense part missed diffusion-based purification methods (refer to [1,2,3]).\n\t[1] Diffusion models for adversarial purification.\n\t[2] The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Models.\n        [3] BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection.\n\nQUESTIONS:\nHow do you generate EMN and TUE perturbations for the target training data since both of them are neither generator-based methods like GUE, 14A, nor label-determined methods like LSP?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a transferable generator to safeguard data across various conditions. The proposed method improves its generalizability to unseen scenarios by integrating adversarial domain augmentation into the generator’s training process. The generator becomes less dependent on data-specific representations, improving its transferability to unseen conditions. In addition, contrastive learning was leveraged to align perturbations with class labels. This approach reduces the generator’s reliance on data semantics, allowing the proposed method to produce unlearnable perturbations in a distribution-agnostic manner.\n\nSTRENGTHS AND WEAKNESSES:\nStrength\n1. The transferability of unlearnable examples is very important to real safeguard individual privacy. This paper introduces comprehensive transferable evaluation framework, including Intra-Domain, cross-domain, cross-task, and cross-space, and cross-architecture. \n2. The proposed method uses the domain composer to generate novel domains lying outside the original distribution, so the generator becomes less dependent on data-specific representations, improving its transferability to unseen conditions. \n3. The paper is well-written with a clear logical flow. The experimental results are promising, demonstrating the superior performance and wide applicability of the proposed approach across various scenarios.\n\nWeakness\n1. Although the quantitative evaluation results of the paper show a significant improvement in transferability of the proposed method, there is a lack of comparison in terms of visual quality of images or subjective evaluation metrics. This is crucial because, in addition to untrainable aspects, data quality is also very important in unlearnable examples.\n2. The proposed method requires a generator to create perturbations at test time, resulting in computational overhead during deployment.\n3. The proposed study includes empirical validation but lacks a thorough theoretical analysis of the diversity of generated samples or the influence of out-of-distribution samples on the transferability of the proposed method.\n\nQUESTIONS:\nplease refer to the Weakness part\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-03"}