UnSeg: One Universal Unlearnable Example Generator is Enough against All Image Segmentation

Authors: ye  sun
hao  zhang
tiehua  zhang
xingjun  ma
yu-gang  jiang
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-15 10:35:01

Abstract: Image segmentation is a crucial vision task that groups pixels within an image into semantically meaningful segments, which is pivotal in obtaining a fine-grained understanding of real-world scenes. However, an increasing privacy concern exists regarding training large-scale image segmentation models on unauthorized private data. In this work, we exploit the concept of unlearnable examples to make images unusable to model training by generating and adding unlearnable noise into the original images. Particularly, we propose a novel Unlearnable Segmentation (UnSeg) framework to train a universal unlearnable noise generator that is capable of transforming any downstream images into their unlearnable version. The unlearnable noise generator is finetuned from the Segment Anything Model (SAM) via bilevel optimization on an interactive segmentation dataset towards minimizing the training error of a surrogate model that shares the same architecture with SAM (but trains from scratch). We empirically verify the effectiveness of UnSeg across 6 mainstream image segmentation tasks, 10 widely used datasets, and 7 different network architectures, and show that the unlearnable images can reduce the segmentation performance by a large margin. Our work provides useful insights into how to leverage foundation models in a data-efficient and computationally affordable manner to protect images against image segmentation models.

Main paper: 
 introduction: 
 With the growing popularity of large models, more and more data are being crawled and curated "freely" into massive pre-training datasets to support large-scale pre-training. This has raised public concerns about the unauthorized usage of private data posed on the web for training large-scale deep learning models or even illegal purposes [1] . For example, it has been found that the startup company Clearview AI developed its commercial facial recognition models by illicitly scraping vast amounts of personal images from online social networks [23] . This has motivated researchers to develop proactive defense measures to prevent deep learning models from exploiting private data.One promising technique is called unlearnable examples (UEs) [25] which adds small unlearnable noise into images to make them unexploitable to deep neural networks (DNNs). In the context of image classification, the unlearnable noise was generated to reduce the error (or difficulty) of an image so as to trick the model into believing that there is nothing to learn from the image. When all the samples in a dataset are modified by unlearnable noise, they will become unexploitable to DNN training and thus are protected. Data protection techniques with a similar objective are also known as availability attacks [58] or indiscriminate poisoning attacks [19] . Although UEs have been extensively studied in image classification tasks, their effectiveness for more complex vision tasks such as image segmentation remains unclear. In this work, we aim to develop an effective UE generation method for image segmentation, a fine-grained vision task that segments the detailed elements in an image. Our work is largely motivated by the recent progress of the Segment Anything Model (SAM) [31] which demonstrates the possibility of large-scale object segmentation from daily images. Meanwhile, the recent advancement of vision-language models (VLMs) also alerts the risk of segmenting and interpreting the semantic content within the images we posted online [62, 5, 6, 54, 57] . These potential risks highlight the imperative to develop effective UEs against image segmentation models. Moreover, there is also an increasing need to protect sensitive objects such as faces, persons, buildings, or locations from being utilized to train commercial or even illegal segmentation models for malicious purposes.There exist three key challenges for generating UEs for image segmentation: 1) data efficiency challenge, 2) generation efficiency challenge, and 3) transferability challenge. First, an effective UE generation method should learn to craft effective UEs based on a small number of images rather than existing large-scale image segmentation datasets, which refers to the data efficiency challenge. Second, when applied to protect private images, the method should be able to craft UEs directly without the need to optimize for each image, which is called the generation efficiency challenge. As for the transferability challenge, the UE generation method should stay effective when transferred to protect different downstream tasks and datasets. By examining existing UE generation methods designed for image classification, we find that none of them can address all three challenges. Specifically, gradient-based UE methods like UE [25] , robust UE (RUE) [17] , stable UE (SUE) [39] , and transferable UE (TUE) [48] all fail to address the generation efficiency challenge. Generation-free UE methods like Synthetic Perturbations (SynPer) [58] are limited to classification UEs and thus cannot be directly applied to image segmentation. Furthermore, these methods all face transferability issues to different datasets, architectures, and training approaches, making them less suitable for image segmentation where the images and task scenarios are diverse and complex.In this paper, we propose a novel UE generation framework called Unlearnable Segmentation (UnSeg) to tackle the above three key challenges. UnSeg is a generative framework that finetunes the pre-trained SAM into a universal UE generator via bilevel min-min optimization. As shown in Figure 1 , UnSeg is the first interactive model capable of generating unlearnable noise for any object in an image. Furthermore, different from all previous methods, UnSeg requires no additional label information beyond the mask prompt for the object region to protect. Finetuned on a small-scale interactive segmentation dataset, the UE generator can be immediately and effectively applied to protect downstream image segmentation datasets.In Summary, our main contributions are:• We propose a novel UE generation framework UnSeg for image segmentation to finetune a universal UE generator from pre-trained SAM. To the best of our knowledge, UnSeg is the first UE generation method developed to protect images from image segmentation models. • In UnSeg, we formulate the fine-tuning of UE generator as a novel interactive segmentationbased bilevel min-min optimization, which is defined on a small-scale interactive segmentation tasks and achieved by iteratively optimize a pre-trained SAM and a train-from-scratch SAM. We also propose an epsilon generalization technique to stabilize the finetuning using a smaller noise budget ϵ which can be directly scaled up to larger noise at inference time.  
related work: 
 Image Segmentation There exist different types of image segmentation tasks such as instance segmentation [21] , semantic segmentation [9] , and panoptic segmentation [30] . All these tasks group pixels within an image into multiple semantic segments or groups [35, 44] , but assign concepts of different granularity. The segmentation models adopted for different tasks may vary, mostly following a similar architecture. Particularly, existing image segmentation models can be categorized into two types: 1) pixel-based classification models such as DeepLab [9] , U-Net [49] , PSPNet [65] , and SegFormer [55] ; and 2) mask-based classification models such as Mask2Former [11] and its variants [61, 26, 34] . Recently, the Segment Anything Model (SAM) [31] has emerged as a foundation model for segmentation. Trained on the large-scale interactive dataset SA-1B [31] , SAM demonstrates strong generalization capabilities in handling various types of visual segmentation tasks [42, 4, 33, 7] . In this paper, we leverage the zero-shot capability of SAM to train a universal and transferable UE generator to protect images against mainstream image segmentation models.The concept of UEs was first introduced in [25] , where small protective noise can be injected into the training dataset to prevent machine learning models from learning useful representations. This was achieved by generating error-minimizing noise that can remove errors from the dataset such that the training model finds no error to minimize (learn). Targeted adversarial poisoning [16] has also been demonstrated to be an effective approach to creating such shortcuts to mislead model training. The working mechanism of UEs was explained by later work as creating a "shortcut" between the input and output using linearly separable features [58] . They further introduced the Synthetic Perturbations (SynPer) method to craft synthetic patterns as UEs. However, the linear separability has recently been shown by Pedro et al. [52, 51] to be unnecessary for UEs. There exist several remaining key challenges for the practical adoption of UEs for private data protection: 1) robustness to adversarial training [43] , 2) transferability from supervised to unsupervised learning, 3) transferability to protect differently labeled data, and more importantly 4) the extension to broad vision tasks beyond image classification. The robustness of UEs to adversarial training has been effectively addressed by the RUE method introduced in [17] which directly minimizes the adversarial training loss. And, the transferability challenges across different learning paradigms and labeling granularities have been effectively addressed by the TUEs [48] and Unlearnable Clusters (UCs) [63] methods. Despite these advances, all existing UE methods are exclusively focused on image classification tasks, limiting their effectiveness to coarse-level vision tasks. Inspired by the potential of SAM and the increasing demand for protecting images against fine-grained probing and learning, in this work, we extend UEs to image segmentation tasks and propose a data-efficient and computationally affordable approach to turn SAM into a universal data protector.Question: Does the paper discuss the limitations of the work performed by the authors?Answer: [Yes] Justification: We note that our method still has limitations and room for improvement in our experiments.Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 
proposed method: 
 We focus on generating UEs against image segmentation models and aim to address three key challenges discussed in Section 1, including data efficiency, generation efficiency, and transferability challenges. Next, we introduce our threat model and then present the proposed UnSeg framework.Threat Model Our threat model assumes a data protection scenario where a data owner wants to protect his/her images posted on online social media platforms from being collected and exploited to train large-scale image segmentation models without their consent. Examples of the data include selfies, travel photos, photos of family, friends, and pets, photos of special events and activities, or even user-generated content. These images contain semantically rich content and appear frequently in large-scale image segmentation datasets crawled on the web. The data owner can also be an institute that aims to protect the sensitive information (e.g., objects, persons, or buildings) contained in the images they release online for data transparency purposes. The data owner adds unlearnable noise generated by a certain UE method to all the images as a type of protection before releasing them. The images were then collected into an image segmentation dataset to train a segmentation model without the data owner's consent. But the data owner does not know what segmentation task it will be used for, what models to train, nor the labels annotated to train the models. Thus, the data owner wants the unlearnable noise to be effective, generalizable, and robust. This can be verified by the low test performance of the model trained on the unlearnable (protected) dataset, across different tasks, datasets, and model architecture.Overview As illustrated in Figure 2 , the proposed UnSeg framework consists of an unlearnable noise generator and a surrogate model. The unlearnable noise generator is finetuned based on the pre-trained SAM, while the surrogate model is a re-initialized SAM that needs to be trained from scratch along with the noise generator. Specifically, we keep the parameters of the pre-trained SAM frozen and then add three new learnable tokens (size of 3 × C, where C is the embedding dimension) to SAM's mask decoder, which we refer to as noise tokens. The noise tokens will be concatenated with SAM's output tokens (size of 4 × C) and prompt tokens (size of N prompt × C, where N prompt is the number of input prompts) to serve as the inputs for the mask decoder. Subsequently, the noise tokens perform self-attention and cross-attention with image embeddings to update features. We define the updated noise tokens as T noise ∈ R 3×C and the image features processed by the mask decoder as F ∈ R H×W ×C . The operation to generate the unlearnable noise can then be defined as:δ u = tanh(F ⊗ T ⊤ noise ) × ϵ s.t. ∥δ u ∥ ∞ ≤ ϵ (1)where ⊗ denotes the dot product operation, × represents element-wise multiplication. We highlight that Equation (1) represents a more flexible decoupling setup than traditional clipping-based methods.The noise of varying intensities can be generated by setting different ϵ in Equation ( 1). Additionally, based on mask information, we apply a ϵ t = 8/255 to the protected object regions and a ϵ u = 2/255 to unrelated regions to make the generator focus more on optimizing the protected areas.Motivated by the superior generalization capabilities of SAM [31] , we propose to adopt interactive image segmentation (IIS) as the proxy task to train the unlearnable noise generator. Choosing IIS as the proxy task not only allows the generator to better utilize the pre-trained knowledge in SAM (as it was also trained on IIS), but also makes the generator promptable which offers more flexibility in applying the generator. We will experimentally show that the noise generator trained on an IIS dataset is fully capable of generating UEs that are universally effective against different image segmentation tasks and models, addressing the transferability challenge. Moreover, we find that a small-scale IIS dataset is sufficient to train an unlearnable noise generator that works reasonably well, and thus is also training data efficient. We believe this is also attributed to the representation learning capability of the pre-trained SAM. The proxy IIS task can be formulated as follows.D c = {(x i , p i , y i )} n i=1, where x i ∈ R H×W ×3 is the input image, p i represents the visual prompt information related to x i (e.g., point, box, and mask), and y i ∈ {0, 1} H×W denotes the corresponding binary ground truth. The goal of IIS is to optimize a neural network F(•; θ) to learn the mapping from (x, p) to y, which can be formulated as:EQUATIONwhere L seg is typically the pixel-wise binary cross-entropy loss and θ is the trainable parameters of F. UEs are generated by adding imperceptible unlearnable noise δ u to images in the training dataset D c . Models trained on the unlearnable images will be misled into learning non-robust shortcuts δ u rather than informative knowledge, thus exhibiting poor generalization performance on the test set (i.e., the unlearnable effect). Unlearnable noise δ u can be generated via bi-level optimization as follows:EQUATIONwhere F ′ denotes the surrogate model used to simulate potential data exploitation, the unlearnable noise δ u is bounded by ∥δ u ∥ ∞ ≤ ϵ with ∥ • ∥ ∞ is the L ∞ norm, and ϵ is set to be small for invisibility. The parameters θ of the surrogate model and the generator (see Equation ( 1)) that produces the unlearnable noise δ u are alternately optimized to minimize L seg . However, when evaluated on the Pascal VOC dataset using DeepLabV1 [8] model, the baseline's protection performance is suboptimal, reducing the mIoU to only 20%. This was not a problem for previous UE generation methods on image classification models [25] . However, segmentation images contain more fine-grained semantic segments that are more sensitive to perturbations.To stabilize the training of the surrogate model (as well as the noise generator), we propose to train both models with a proportionally reduced ϵ. Specifically, during training, we divide the ϵ in Table 1 : A summary of our considered evaluation tasks, datasets, models, and performance metrics.Semantic segmentation [41] DeepLabV1 [8] /DeepLabV3 [10]/Mask2Former [11] Pascal VOC2012 [14] /ADE20K [66] /Cityscapes [13] mIoU [15] Instance segmentation [21] Mask2Former [11] ADE20K [66] /COCO [37] /Cityscaptes [13] AP [37] Panoptic segmentation [30] Mask2Former [11] ADE20K [66] /COCO [37] /Cityscaptes [13] PQ [30] Interactive segmentation [31] SAM-HQ [29] HQSeg-44K [29] /DIS [45] /COIFT [36] /HRSOD [59] /ThinObject [36] mIoU [15] Remote sensing instance segmentation [7] Rsprompter [7] WHU [28] /NWPU [12] /SSDD [64] mAP [7] Medical image segmentation [49] UNet++ [67] Lung segmentation [2] /Kvasir-seg [27] IoU [67] Object detection [3] DINO [60] COCO [37] AP [37] Equation ( 1) by a positive integer scaling factor v (i.e., ϵ/v) to reduce the impact of the generator. This can effectively reduce the error-minimizing strength of the noise, leaving more room for the optimization of the surrogate model. When applying the trained noise generator to protect images, we remove the scaling factor v to maintain the original value of ϵ in Equation ( 1), thereby ensuring the effectiveness of the generated noise. We call this capability that can train under a small epsilon via proportionally scaling while inference under a large epsilon as epsilon generalization (EG). As shown in Figure 3 , the training loss of UnSeg combined with EG decreases more steadily, ultimately reducing the target model's mIoU to around 7%. Additionally, we explore a label modification technique to assess whether this change can induce the generator to produce noise that is more misleading. Specifically, during generator training, we change all background labels from 0 to 1 to align them with foreground labels. We empirically find that such a modification can strengthen the unlearnable effect of the generated noise as it forces the model to focus on the entire image.The IIS Dataset D c We employ the high-quality interactive segmentation dataset HQSeg-44K [29] as D c to optimize the proposed pipeline. HQSeg-44K contains 44,320 images, each with extremely precise mask annotations, and covers more than 1,000 distinct semantic categories, which enhances the robustness of UnSeg to new data.Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?Answer: [Yes] Justification: Source code will be released to foster the community.Guidelines:• The answer NA means that paper does not include experiments requiring code. • Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted. 
experimental setup: 
 Training Configuration The weights of the noise generator are initialized using the pre-trained ViT-Base SAM [31] . The surrogate model adopts the same architecture as SAM but initializes its backbone network with the MAE [22] pre-trained ViT-Base. We alternately optimize the noise generator and surrogate model: first, training the surrogate model for one epoch, followed by training the noise generator for three epochs. We use a total batch size of 32, a learning rate of 0.0001, and train our framework for 27 epochs, with a learning rate decay after 20 epochs. Training UnSeg on 8 Nvidia GeForce RTX 3090 GPUs takes about 10 hours.UEs Generation Unlike previous methods, our approach generates UEs for the mask-defined regions. We determine the masks by selecting the classes of objects to be protected based on the ground-truth annotations. The masks and images are then passed into the trained noise generator to generate the unlearnable noise, which is then added back to the images to create UEs.Evaluation Datasets and Models Table 1 summarizes the considered tasks, models, and datasets in our experiments. For the three mainstream image segmentation tasks including semantic segmentation, instance segmentation, and panoptic segmentation, we select four widely used datasets: Pascal VOC 2012 [14] , Cityscapes [13] , ADE20K [66] , and COCO [37] . Specifically, for semantic segmentation, we employ the representative convolutional segmentation models, DeepLabV1 [8] and DeepLabV3 [10] , to test the effectiveness of our method on Pascal VOC 2012. We also consider three high-resolution, real-world datasets with more complex scenes: Cityscapes, ADE20K, and COCO2017, along with the state-of-the-art (SOTA) model Mask2Former [11] in this field. We follow the same procedure in the original paper [11] to train Mask2Former. For interactive segmentation, SAM-HQ [29] is a high-quality interactive segmentation model improved upon SAM [31] . We train SAM-HQ [29] using the generated unlearnable dataset HQSeg-44k [29] and then evaluate the segmentation performance on four datasets (DIS [45] /COIFT [36] /HRSOD [59] /ThinObject [36] ) as described in the paper [29] . For remote sensing instance segmentation, we select three representative datasets: SSDD [64] , WHU [28] , and NWPU [12] . We use the SOTA model Rsprompter [7] in the field and test our method's effectiveness following the training settings described in the paper [7] .For medical image segmentation, we evaluate our method using UNet++ [67] with five different backbones (ResNet50 [20] /DenseNet169 [24] /EfficientNetB6 [53] /Res2Net [18] /RegNetX [47] ) on the Lung segmentation dataset [2] and the Kvasir-seg dataset [27] . We randomly select 80% of the data for training and use the remaining 20% for validation. We train Unet++ for a total of 150 epochs. Finally, we also test the cross-task effectiveness of our method on the COCO [37] dataset against a SOTA object detection model DINO [60] . EvaluationComparison to Random Noise and Synthetic Perturbations (SynPer) We first compare our UnSeg method with two types of random noise, i.e., class-wise random noise, sample-wise random noise, and the synthetic noise crafted by SynPer. These two types of noise have been shown to trigger an unlearnable effect on classification datasets [25, 58] . We employ the SOTA Mask2Former model with two different backbones (ResNet50, Swin-Tiny) to comprehensively evaluate the effectiveness of our method across three widely-used datasets (COCO, ADE20K, Cityscapes) and three mainstream tasks (panoptic segmentation, semantic segmentation, instance segmentation). Here, we compare our UnSeg with three SOTA training-free unlearnable methods: SynPer, Autoregressive Perturbations (AR) [51] and Convolution-based Perturbations (CUDA) [50] .For the AR method, we use its AR process to generate sample-wise noise of size ϵ = 1 (L2 constraint) for each category. For the CUDA method, we use filters of size 3 and set the blur parameter to 0.3 to generate the noise for each category. The results reported in Table 2 reveal the following findings.(1) Our method significantly reduces the clean test performance of the models across all tasks and datasets. Specifically, UnSeg can reduce the PQ metric of ResNet50-based models by 28%, 47.7%, and 56.4% across the three datasets, significantly outperforming SynPer and AR. (2) When using Swin-Tiny as the backbone, our method is even more effective at reducing the model's performance. On the ADE20K dataset, UnSeg reduces the PQ and AP scores of the Swin-Tiny-based model by 37.5% and 23.8%, respectively. We believe this is because UnSeg's surrogate model adopts a Transformer architecture. (3) Our method is particularly effective for large datasets and large objects. For example, it can reduce the AP-L (Average Precision for Large Objects) metric Effectiveness and Transferability on Related Vision Tasks Surprisingly, we found that UnSeg can effectively generalize to other related tasks that have very different image distributions. Please refer to Section 4.1 for a detailed description of the datasets and models used in this set of experiments. For the interactive segmentation task, as shown in Figure 5 (a), although SAM-HQ freezes the parameters of the pre-trained SAM during training to leverage its generalization capabilities, our method can still degrade its test performance by a notable margin, especially on the ThinObject dataset [36] . This indicates that our method has the potential to prevent large foundation models from extracting useful information from the protected images. For remote sensing segmentation, RSPrompter is an improved method based on SAM and also freezes the parameters of the pre-trained SAM during training. As illustrated in Figure 5 (b), the test performance of RSPrompter drops significantly after training on the unlearnable training dataset crafted by our method, with the mAP metric on the WHU dataset dropped by 60%. Our method can even be applied to protect medical images against medical image segmentation models. And, we found that setting ϵ = 4/255 is sufficient to drastically reduce the model performance. As shown in Figure 5 (c), the test performance of UNet++ with 5 different backbones trained on our unlearnable datasets drops badly. The performance on the Lung Segmentation dataset even degrades to 0%. Our method also has a strong cross-task effectiveness. To test this, we train the SOTA object detection model DINO on the unlearnable COCO dataset initially generated by our UnSeg for segmentation tasks. The performance of the trained DINO is reported in Table 3 , where it shows that our UnSeg can reduce the AP metric of DINO by 42.6%.Resistance to Potential Defenses Here, we evaluate UnSeg against 4 potential defense methods, including Gaussian filtering, JPEG Compression (JPEG) [40] , adversarial training (AT) [43] , and DDC adversarial training [56] (DDC-AT, an advanced AT method specifically designed for segmentation tasks). Following [56] , we choose white-box BIM (with L ∞ constraint) [32] to generate adversarial samples during training. We set the adversarial perturbation size to a high value (ϵ=0.03×255) to demonstrate the effectiveness of our method under a more harsh condition. As shown in Table 4 , our method effectively resists DDC-AT, reducing the test mIoU to 28.5%. Amongst all the defense methods, JPEG is the most effective. However, our UnSeg can still compromise its mIoU to 44.8% which is 30.3% lower than the original clean performance.Mixing UEs with Clean Data In practical scenarios, not all training data need to be unlearnable. For example, only a group of users adopt this technology to protect their data while others do not. This results in a partially unlearnable dataset with mixed clean and unlearnable examples. We simulate this scenario on Pascal VOC 2012 and report the result in Table 5 . As can be inferred, the mIoU on the mixed dataset is consistently lower than that on the clean dataset which is 76.2%. Moreover, the model's performance when trained on the mixed training set is the same as it was trained on the only the clean proportion of the training data. This implies that the UEs generated by UnSeg contribute (almost) nothing to model training. This result aligns with previous findings [25, 58, 16] .Parameter Analysis Here, we conduct comprehensive parameter analysis with two models on two datasets: 1) the Mask2Former model for panoptic segmentation on the Cityscapes dataset, and 2) the DeepLabV1 model for semantic segmentation on the Pascal VOC 2012 dataset. On the Pascal VOC dataset, we test two settings: a) making all classes unlearnable, and b) making only a subset of classes (e.g., the first five classes) unlearnable. We note that the latter is a more challenging setup. As the results presented in Table 6 , incorporating EG significantly reduces most model metrics than that without EG. Meanwhile, we observe that solely relying on label modification technique to optimize the generator fails to achieve satisfactory protection performance due to unstable training. By integrating our EG strategy, the impact of the generator on the surrogate model can be significantly reduced, which eventually leads to a much better performance. Our UnSeg also has limitations.In the multi-class protection setting on the Pascal VOC dataset, for the bird and bottle categories, which both have simple shapes and textures, UnSeg can only reduce their mIoU to 58.6% and 40.4%, respectively. We leave the exploration of this limitation to our future work. 
conclusion: 
 In 2) The model trained on a mixed dataset sometimes performs worse than the model trained on only clean data. This indicates that our method may also hinder the model's learning on clean data to some extent. Influence of the Surrogate Model Here, we replace the surrogate model from the ImageNet MAE pre-trained ViT with an ImageNet supervised pre-trained ResNet50. We evaluate the performance of the noise generator trained with different surrogate models using Mask2Former on the ADE20K and Cityscapes datasets. As shown in Table 10 , the performance of the noise generator significantly declined when using ResNet50 as surrogate model. We believe that using the MAE pre-trained weights can prevent the trained noise generator from being biased towards specific categories, thereby enhancing its transferability. We agree that the surrogate model plays a crucial role in optimizing the noise generator, and further exploration of different surrogate models would be valuable. Guidelines:• The answer NA means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper. 
experimental setting/details: 
 Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?Answer: [Yes]Justification: All relevant settings are described in the experimental setup section.Guidelines:• The answer NA means that the paper does not include experiments.• The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 
experiment statistical significance: 
 Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?Answer: [No] Justification: The experimental results in this paper require no further error analysis to be reported.Guidelines:• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).• The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. • It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified. • For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates). • If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text. 
experiments compute resources: 
 Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?Answer: [Yes]Justification: We describe the training settings for each experiment in the experimental section.Guidelines:• The answer NA means that the paper does not include experiments.• The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. • The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper). 
code of ethics: 
 Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines?Answer: [Yes] Justification: This research complied fully with the NeurIPS Code of Ethics.Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes] Justification: We explore some possible societal impacts of our method in the conclusion and appendix.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.• Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pre-trained language models, image generators, or scraped datasets)? Answer: [NA] Justification: This paper proposes a new data protection method, so there is no safety risk. Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort. 12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: Relevant sources used in this paper are appropriately cited. Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. 
 
 Appendix:  


Decision: This paper originally received mixed reviews. After rebuttal, all reviews became positive. The authors addressed the major concerns regarding experiments. The AC decides to accept the paper. The authors should include the discussions and new results in the rebuttal into the final version.

Reviews: review: paper_summary: paper_summary: The paper addresses the issue of privacy concerns in training large-scale image segmentation models using unauthorized private data. The authors propose a novel framework called Unlearnable Segmentation (UnSeg) to generate unlearnable noise that, when added to images, makes them unusable for model training. This framework involves training a universal unlearnable noise generator by fine-tuning the Segment Anything Model (SAM) through bilevel optimization on an interactive segmentation dataset. The effectiveness of UnSeg is demonstrated across six mainstream image segmentation tasks, ten widely used datasets, and seven different network architectures, significantly reducing segmentation performance when unlearnable images are used.
strength_weakness: strength_weakness: 1. The generation of unlearnable examples (UEs) requires object masks, which can be challenging to obtain in common practice. The authors should discuss this issue and consider using bounding boxes or clicks as alternative options. Reporting the results of these alternatives would be beneficial.
2. Why is the surrogate model initialized with the pretrained MAE model weights instead of SAM weights?
3. As shown in Table 5, the model trained with a mixed dataset of clean and unlearnable data achieves similar or even better performance compared to the model trained with only clean data. This suggests that unlearnable data might not reduce performance and could even enhance it. Consequently, network trainers might still collect images without concern, despite the proposed method, unless all images available on the internet are unlearnable samples.
4. Can the authors provide more results from different networks and datasets using the clean-unlearnable mixed training dataset in Table 5?
5. Table 2 only compares one state-of-the-art (SOTA) method. The authors should include more SOTA methods, including attack methods for segmentation and classification, to effectively validate the superiority of the proposed method.
questions: questions: See Q1 and Q3 in weaknesses, pls.
limitations: limitations: The authors have introduced the limitations and broader impact of the proposed method.
paper_summary: paper_summary: Aiming to provide a solution for protecting sensitive/private images, this paper introduces UnSeg, a framework designed to generate unlearnable examples (UEs) to protect images from unauthorized usage in image segmentation models. Utilizing the Segment Anything Model (SAM) and bilevel optimization, UnSeg creates noise that renders images unusable for training segmentation models. The framework is validated through extensive experiments across multiple segmentation tasks, datasets, and architectures (listed in Table 1).
strength_weakness: strength_weakness: The reviewer did not find major flaws with the paper.
- **(Method)** The reviewer feels there will be restrictions due to prevalent memory bandwidth for adoption of this method. The authors can expand on the real-world use cases of the proposed method (in terms of deployment).
- **(Method)** The reviewer doesn’t clearly understand the intuition behind the Section “Training Stability and Epsilon Generalization”. The point of segmentation methods being more fine-grained doesn’t justify balancing the perturbations by scaling factor $v$. 
- **(Experiments)** The reviewer fails to understand why the methods in [48, 61] do not serve as proper baselines. Since the authors compare their method in cross domain/task settings (like in Table 3), these works also serve as good baselines.
- **(Experiments)** This paper would definitely benefit from analysis of statistical significance. Localized perturbations may get distributed in different patterns and hence may affect the segmentation performance.  
- **(Typo)** L223, 220 v -> $v$
questions: questions: 1. Is the method applicable when the model is other than the SAM?

2. Will the method work if the segmentation model leverages contextual knowledge in the input images to create better object masks?
limitations: limitations: Authors do not describe any limitations clearly. The reviewer feels the if the surrogate model is not strong/robust enough, the perturbations might not be potent to break the target segmentation models. The reviewer did not find any particular negative societal impact.
paper_summary: paper_summary: This article uses the powerful SAM to fine-tune a non-learnable examples generator, achieving good protection effects on downstream datasets and models.
strength_weakness: strength_weakness: I am mainly concerned about whether the unlearnable samples proposed in this paper on segmentation have much practical application? The author used a relatively strong segmenter to train an unlearnable sample generator, but trained unlearnable samples on a relatively weak segmenter. Is this reasonable in real world?
questions: questions: Please show experiments on adversarial training on non-learnable examples.
limitations: limitations: This paper could not cause any societal impacts.
paper_summary: paper_summary: This paper aims to design a universal unlearnable example generator for image segmentation tasks. Specifically, this paper aims to address three important factors for unlearnable examples in image segmentation:1) data efficiency 2) generation efficiency 3)  transferable efficiency. 

To design such a model, the author makes use of the pretrained SAM model to conduct a min-min optimization problem, which involves two models) a noise generation model based on the pretrained SAM model; 2) a surrogate model training from scratch for minimizing the training loss given the corrupted unlearnable image. 

To this end, the author conducts comprehensive experiments for a diverse set of downstream tasks to verify the effectiveness of the proposed method.
strength_weakness: strength_weakness: The key experiment setup is not clear (see questions). 

What are the benefits of using the SAM as the backbone for the unlearnable example generation model and the surrogate model, I  miss the ablation on this.  Besides, what is the benefit of using the SAM pretrained weight for the unlearnable example generation model? Is this crucial for the success of the proposed method?
questions: questions: It appears that the UnSeg model is trained on the HQSeg44k dataset. Consequently, the unlearned dataset is also HQSeg44k, but with added unlearnable noise. The authors subsequently used the HQSeg44k dataset to fine-tune different models for downstream tasks, including semantic segmentation, instance segmentation, and panoptic segmentation.

If my previous explanation is correct, I am concerned about the fairness of this approach. Specifically, there may be a significant domain gap between the fine-tuning dataset and the evaluation dataset. Furthermore, this setup does not demonstrate that the proposed method can generate unlearnable noise for example beyond the training data used for the UnSeg model.

But from the caption of Figure 5, it seems that the UnSeg model is employed to generate unlearnable noise for new datasets used in training different downstream tasks, the authors should clarify this in lines 249 to 265.

Please clarify the following:

On which dataset is the inference of UnSeg conducted (i.e., what training dataset is used for different downstream tasks)?
Which dataset is used as the evaluation set for the trained models of different downstream tasks?
limitations: limitations: Limitations have been discussed.

Comments: title: Thanks for your feedback.
Thank you very much!
Your additional feedback means a lot to us.
Concerns are addressed.
Your further feedback is greatly appreciated.
Thank you for your valuable feedback.
Thanks for your valuable and timely feedback.
Author-reviewer discussion
Response to rebuttal
comment: Thank you for taking the time to review our paper. We greatly appreciate your feedback.
Thanks for the author's response, this solves most of my concerns, and I will raise my rating to 5 (reflected in the revised rating). Though I am quite familiar with SAM, I am not an expert in "Unlearnable Example Generator". I'd like AC to downweight my review in the final decision.
We’re glad that our responses have addressed your concerns. We sincerely appreciate your prompt and positive feedback. Thank you very much!
Dear Reviewer Mhnt,

Thank you for your initial comments. We appreciate your questions regarding the training of our UE generator, the datasets used for downstream tasks, and the benefits of using SAM as the backbone. We have addressed these points in our rebuttal. Please review our response to see if it adequately resolves your concerns. If any details remain unclear, we are happy to provide further explanations. We will also revise our paper to clarify these points. Thank you for your time, and we value your additional feedback.
The authors have addressed my concerns, and I decide to raise my score.
Dear Reviewer zWqb,

Thank you for your initial comments. We understand your concern about the practical application of our work and have prepared a detailed response to address it. Please have a look at our response and kindly let us know if it addresses your concerns. Your further feedback is valuable to us, and we hope to resolve any remaining issues before the rebuttal period ends. Thanks again for your time.
We greatly appreciate your recognition of our hard work and your quality review. Your valuable comments have significantly improved our work. Your encouragement means everything to us. We will carefully revise our paper following your suggestions. Thank you very much!
We greatly appreciate your recognition of our work and your positive feedback. Your acknowledgment means a lot to us. We will incorporate the new results into our revision. Thank you very much!
Dear reviewer zWqb and Mhnt,

Since the authors provided their responses, please read the responses, respond to them on in the discussion, and discuss points of disagreement if necessary by Aug 13.

Best regards,

AC
Thank you authors for your rebuttal and hard work. My concerns are cleared and I will maintain my rating. Good luck!
Thanks a lot to the authors for their responses, which have addressed most of my concerns. While the effectiveness of the proposed method on clean-unlearnable mixed data in Q3 is not particularly impressive, I still believe this is a solid piece of work and will maintain my original score.