Paper: Availability Attacks Need to Create Shortcuts for Contrastive Learning (ICLR-2024)

Reviewer comment (Presentation):
The paper is difficult to read and the organization of the content is not very clear.

Author response:
Thanks for your comments and questions. 

We have uploaded a new version of our paper. Based on your suggestions and other reviewers’ feedback, we adjusted the paper structure, improved the presentation, and added more experiments. We summarize these modifications in ‘Author’s comments’.

Reviewer comment (Theory):
The Cross-Entropy (CE) loss and InfoNCE loss may be essentially similar, and using these two losses to reflect the relationship between the two tasks is not particularly convincing.

Author response:
- [CE and InfoNCE]  CE and InfoNCE are typical loss functions for SL and CL respectively. Therefore, a decrease in CE loss signifies optimization of the SL task, while a decrease in InfoNCE loss indicates optimization of the CL task.  By employing enhanced data augmentations, the observation that minimizing CE also leads to a decrease in InfoNCE suggests implicit optimization of the CL task. Building upon this insight, we then analyze the toy model and propose that supervised error minimization with enhanced data augmentations can partially replace the role of contrastive error minimization to enlarge the alignment and uniformity gaps and bring contrastive unlearnability. Moreover, stronger augmentations help adversarial poisoning regarding the CE loss generate poisons to deceive a contrastive-like reference model and thus improve the contrastive unlearnability as well.

Reviewer comment (Novelty):
Although the paper emphasizes sampling in data augmentation as being introduced from contrastive learning, it bears a resemblance to the Expectation Over Transformation (EOT) used in the reference paper on REM. EOT also involves sampling from data augmentation, and this technique is commonly used in adversarial settings.

Author response:
- [Augmentations and EOT] The motivation, technique, and goal of augmentations in our methods are different from EOT. The augmentations used by EOT are standard supervised augmentations including RandomCrop and RandomHorizontalFlip. EOT sampling several augmentations and computes the average gradient over these samples. 
However, we use much stronger contrastive augmentations for both reference model update and perturbation update to equip the attack with contrastive unlearnability. In addition, we just do sampling but don’t take expectations.

Reviewer comment (Experiments):
The resolution of the Tiny-ImageNet dataset is not down-sampled, and the Mini-ImageNet dataset has a limited number of samples per class.

Author response:
- [ImageNet-like datasets] We added experiments on ImageNet-100 in Table 3 of the new version. Moreover, Tiny-ImageNet with 64x64 images was also used in [1]. Each class in the train/test set of Mini-ImageNet has 500/100 images, which is the same as Tiny-ImageNet and CIFAR-100.
| ImageNet-100 | SL   | SimCLR | MoCo | BYOL | SimSiam |
|--------------|------|--------|------|------|---------|
| Clean        | 77.8 | 61.8   | 61.8 | 62.2 |    65.8 |
| AUE          | 5.1  | 5.2    | 6.2  |  7.5 |     4.7 |
| T-AAP        | 14.4 | 20.3   | 14.5 | 24.8 |    16.6 |

Reviewer comment (Evaluation):
Does the value of the GAP affect accuracy? According to the paper, GAP reflects the difference between clean and poison distributions. Logically, the greater the difference, the better the protection effect should be. However, the results in Table 1 do not seem to support this notion.

Author response:
- [Gaps and contrastive unlearnability] Based on suggestions from Reviewer zrxn, we conducted Pearson correlation coefficient analysis of gaps and contrastive unlearnability in Section 4. In Table 1, the PCC between the alignment gap and the SimCLR accuracy is -0.78, and the PCC between the uniformity gap and the SimCLR accuracy is -0.87.  It is revealed that contrastive unlearnability highly relates to alignment and uniformity gaps. Though the statistical metric reflects the relationship, it does not mean accuracy will change monotonically with the gaps. 
On the other hand, in certain settings, the relationship is more clear. In Appendix B.6, we gradually increase the augmentation strength from 0 to the default setting, i.e. s=0.6 in the generation of AUE attacks, and evaluate the alignment and uniformity gaps. In this case, the larger the gaps, the lower the accuracy of SimCLR.

| Strength | Alignment Gap | Uniformity Gap | SimCLR |
|---------:|---------------:|---------------:|-----------------:|
|        0 |          0.14 |           0.07 |            83.5 |
|      0.2 |          0.21 |           0.24 |            64.1 |
|      0.4 |          0.25 |           0.28 |            56.7 |
|      0.6 |          0.25 |           0.39 |            52.4 |

Reviewer comment (Evaluation):
Why does the loss of Alignment in Figure 3(c) first decrease and then increase?

Author response:
- [Alignment] The alignment loss on poisoned data decreases at first while the alignment loss on clean data increases. Thus the alignment gap increases rapidly. Since what we emphasize is the alignment and uniformity gaps which play the role of shortcuts for CL, we replaced Figure 3(c) with a figure of gaps to avoid distraction in the new version. Comparing Figure 3(c) and Figure 4, we find that the trend of CL accuracy aligns with the overall trend of alignment and uniformity gaps. More detailed discussions are added in Section 6.3.

Reviewer comment (Novelty):
As shown in the pseudo-code in Section 4.1, the proposed method employs a tuning hyperparameter to control the strength of the data augmentation. While the considered threat model is of practical importance, the technical contributions of the paper are not strong enough.

Author response:
1. [Novelty] We are the first to introduce stronger contrastive augmentations into the poison generation process using supervised models. Our proposed poisoning attacks achieve SOTA worst-case unlearnability across SL and CL algorithms compared to existing methods.

Reviewer comment (Presentation):
In Section 3, the definitions of alignment loss and uniformity loss are introduced in existing work (Wang & Isola, 2020), so they should be moved to the previous background section.

Author response:
- We relocated the definitions of alignment and uniformity to the ‘Threat Model and Background’ section.

Reviewer comment (Presentation):
The main empirical finding of Section 3 is that contrastive unlearnability seems correlated with alignment and uniformity gaps. However, there is no clear explanation of how these poisoning methods are grouped in Table 1.

Author response:
3. [Shortcuts] Table 1 illustrates gaps are the key to shortcuts. It is the reason why AP-based attacks are effective for CL while other non-contrastive poisoning attacks are not. On the other hand, contrastive error-minimization attacks, i.e. CP and TUE naturally possess huge gaps since their generation process optimizes the contrastive loss [1]. It inspires us that if we can mimic the contrastive error-minimization in a supervised way, the resulting attacks possibly obtain both supervised and contrastive unlearnability. In the next section, we analyze how enhanced data augmentations can boost the contrastive unlearnability of basic supervised poisoning approaches.

Reviewer comment (Evaluation):
It would be useful to conduct a correlation analysis to demonstrate how strong the correlation is, such as providing the Pearson correlation coefficients.

Author response:
2. [Pearson correlation coefficient] In Table 1, the PCC between the alignment gap and the SimCLR accuracy is -0.78, and the PCC between the uniformity gap and the SimCLR accuracy is -0.87.  It is revealed that contrastive unlearnability highly relates to alignment and uniformity gaps.

Reviewer comment (Evaluation):
There is a lack of clarity on why clean/poisoned alignment & uniformity scores and SL accuracy are also demonstrated in Table 3, which appear redundant.

Author response:
4. [Redundant information in Table 1] We emphasize the alignment and uniformity gaps, so we remove alignment and uniformity losses for a clear presentation. We also include SL accuracy in Table 1 because in later experiments we do not evaluate attacks without CL unlearnability such as UE and DC.

Reviewer comment (Evaluation):
It is hard to understand why the results of Table 1 imply the need for enhanced data augmentation.

Author response:
3. [Shortcuts] Table 1 illustrates gaps are the key to shortcuts. It is the reason why AP-based attacks are effective for CL while other non-contrastive poisoning attacks are not. On the other hand, contrastive error-minimization attacks, i.e. CP and TUE naturally possess huge gaps since their generation process optimizes the contrastive loss [1]. It inspires us that if we can mimic the contrastive error-minimization in a supervised way, the resulting attacks possibly obtain both supervised and contrastive unlearnability. In the next section, we analyze how enhanced data augmentations can boost the contrastive unlearnability of basic supervised poisoning approaches.

Reviewer comment (Theory):
In Section 4, the role of Theorem 4.1 is unclear, and the presented theoretical results are particularly hard to parse.

Author response:
5. [Theorem] Recall that contrastive error-minimization replaces the supervised loss in the supervised error-minimization with contrastive loss. The theorem says that the upper bound of contrastive loss decreases with the supervised loss if their data augmentations obey the same distribution. Thus, supervised error minimization with enhanced data augmentations can partially replace the role of contrastive error minimization to enlarge the alignment and uniformity gaps and bring contrastive unlearnability. Moreover, stronger augmentations help adversarial poisoning generate poisons to deceive a contrastive-like reference model and thus improve the contrastive unlearnability as well.

Reviewer comment (Theory):
The implication of the upper bound proven in Theorem 4.1 is unclear, and there should be a detailed discussion of how Theorem 4.1 connects to the main messages of the paper.

Author response:
5. [Theorem] Recall that contrastive error-minimization replaces the supervised loss in the supervised error-minimization with contrastive loss. The theorem says that the upper bound of contrastive loss decreases with the supervised loss if their data augmentations obey the same distribution. Thus, supervised error minimization with enhanced data augmentations can partially replace the role of contrastive error minimization to enlarge the alignment and uniformity gaps and bring contrastive unlearnability. Moreover, stronger augmentations help adversarial poisoning generate poisons to deceive a contrastive-like reference model and thus improve the contrastive unlearnability as well.

Reviewer comment (Evaluation):
The empirical improvements on worst-case unlearnability are not strong. For example, CP-BYOL achieves 41.8% performance on CIFAR-10, which is relatively competitive compared with the proposed methods, while TUE-MoCo achieves relatively similar worst-case unlearnability on CIFAR-100. It would be useful to study why these existing methods can attain good performance and explain how the proposed method improves over them.

Author response:
7. [Comparison with CP and TUE] Our proposed poisoning attacks achieve SOTA worst-case unlearnability across SL and CL algorithms compared to existing methods. Moreover, the unlearnability of CP is not stable: CP-BYOL becomes ineffective for SL on CIFAR-100. On higher-resolution datasets with more classes such as Mini/Tiny-ImageNet, our AUE outperforms TUE-MoCo by 13%/28% which is a great advantage.

Reviewer comment (Experiments):
It would be useful to explain the existing poisoning attacks and their abbreviations in Section 3 before the introduction of Table 1 (instead of Section 5.1). In particular, how these methods are selected and grouped in the table should be explained clearly. Two considered methods, _EntF_ and _HYPO_, are neither effective against _SimCLR_ nor _SL_, so the reason for testing them is unclear.

Author response:
9. [HYPO, EntF] These two availability attacks were proposed to deceive adversarial training and degrade the final robust SL accuracy. We test them for a comprehensive evaluation. In the new version, we just group the attacks into contrastive and non-contrastive attacks.

Reviewer comment (Experiments):
In the pseudo-code provided in Section 4.1, a single parameter _s_ is used to control the augmentation strength, applied to three augmentation functions: _RandomsizedCrop()_, _RandomApply()_, and _RandomGrayscale()_. It is unclear whether worst-case unlearnability can be improved if different hyperparameters are applied to different augmentation functions. There is also a broader question of how the defender should choose the right augmentation functions and their corresponding hyperparameters to achieve the best protection performance.

Author response:
10. [Decoupled augmentations] In Table 4, we decouple the strengths of RandomResizedCrop, RandomColorJitter, and RandomGrayscale and evaluate the CL unlearnability of alternatives. By default, s=0.6 for AUE and s=0.4 for T-AAP. For example, 0-0-s means that RandomResizeCrop strength is 0, RandomColorJitter strength is 0, and RancomGrayscale strength is s. The results illustrate that adjusting these three factors together outperforms adjusting them separately.

|       | 0-0-0 | 0-0-s | 0-s-0 | s-0-0 | 0-s-s | s-0-s | s-s-0 | s-s-s |
|-------|-------|-------|-------|-------|-------|-------|-------|-------|
| AUE   |  83.5 |  58.7 |  79.4 |  88.7 |  60.8 |  56.2 |  87.7 |  52.4 |
| T-AAP |  52.3 |  52.0 |  52.9 |  44.9 |  51.4 |  42.2 |  44.8 |  39.1 |

Reviewer comment (Experiments):
It is unclear whether the augmentation method has been applied to other alternative poisoning attacks, such as TUE and CP, and whether worst-case learnability can be further improved based on their method.

Author response:
8. [Augmentations in CP and TUE] These two contrastive error-minimization methods have already involved contrastive training in the poison generation process that employs standard contrastive augmentations (i.e. s=1).  So our methods are not applicable to CP and TUE.

Reviewer comment (Presentation):
Tables 3-6 are difficult to read and should be replaced with larger ones in the next version of the paper.

Author response:
- We moved the tables of  ‘transferability across networks’, ‘poisoning ratio’, and ‘poisoning budget’ to Appendix B.3-B.5.

Reviewer comment (Writing):
There are several typos in the text, such as the need to replace "argmax" with "argmin" in Eq. 1.

Author response:
Thanks for your feedback and questions! We have uploaded a new version of our paper. Specifically, based on your suggestion, we have made some modifications as follows:
- We repositioned the ‘Related Works’ section to the main body of the paper.
- We rectified some typos.
- We incorporated the evaluation of OPS and REM attacks in Table 1
- We included the attack performance on ImageNet-100 in Table 3.
- We added defenses including ISS-JPEG, ISS-Grayscale, UEraser-Lite, UEraser-Max, and AVATAR in Table 5.

We summarize other modifications in ‘Author’s comments’.

Reviewer comment (Experiments):
Expanding the experiments to include a wider range of methods, such as surrogate-free methods like OPS [1] and robust methods like REM [2], would enhance the comprehensiveness of the evaluation and allow for a more thorough comparison.

Author response:
Thanks for your feedback and questions! We have uploaded a new version of our paper. Specifically, based on your suggestion, we have made some modifications as follows:
- We repositioned the ‘Related Works’ section to the main body of the paper.
- We rectified some typos.
- We incorporated the evaluation of OPS and REM attacks in Table 1
- We included the attack performance on ImageNet-100 in Table 3.
- We added defenses including ISS-JPEG, ISS-Grayscale, UEraser-Lite, UEraser-Max, and AVATAR in Table 5.

We summarize other modifications in ‘Author’s comments’.

Reviewer comment (Experiments):
Consider conducting experiments on the ImageNet-subset dataset, which includes the first 100 classes of ImageNet data.

Author response:
Thanks for your feedback and questions! We have uploaded a new version of our paper. Specifically, based on your suggestion, we have made some modifications as follows:
- We repositioned the ‘Related Works’ section to the main body of the paper.
- We rectified some typos.
- We incorporated the evaluation of OPS and REM attacks in Table 1
- We included the attack performance on ImageNet-100 in Table 3.
- We added defenses including ISS-JPEG, ISS-Grayscale, UEraser-Lite, UEraser-Max, and AVATAR in Table 5.

We summarize other modifications in ‘Author’s comments’.


Besides, we’ll make some clarifications as follows:
- [ImageNet-100] Our AUE and AAP attacks are also effective on ImageNet-100.
| ImageNet-100 | SL   | SimCLR | MoCo | BYOL | SimSiam |
|--------------|------|--------|------|------|---------|
| Clean        | 77.8 | 61.8   | 61.8 | 62.2 |    65.8 |
| AUE          | 5.1  | 5.2    | 6.2  |  7.5 |     4.7 |
| T-AAP        | 14.4 | 20.3   | 14.5 | 24.8 |    16.6 |

Reviewer comment (Evaluation):
Consider adding the mean performance value in addition to the worst-case performance in the tables reporting the results.

Author response:
Besides, we’ll make some clarifications as follows:
- [Mean performance of unlearnability] Our threat model in Equ (1) considers the worst-case unlearnability since the worst performance across different algorithms determines the reliability of using availability attacks to protect private data, namely the "wooden barrel theory".
Average unlearnability has two major problems: 1) Fairness. It’s difficult to set proper weights for different evaluation algorithms. For example, it seems to be unfair to take a simple mean of one SL algorithm and multiple CL algorithms. 2) Soundness. Average unlearnability has the potential to underestimate the learnability of the most powerful algorithm.  The reliability of attack methods with the same average unlearnability can vary significantly. For example, under 3 evaluation algorithms, alg A (5%, 10%, 90%)  and alg B (30%, 35%, 40%) have the same average unlearnability of  35%.

Reviewer comment (Novelty):
It appears the primary factor contributing to the improvements in results are because of the more aggressive augmentations. It has been known to the community for a while that stronger data augmentations can lead to better defenses against existing unlearnability attacks. ISS and UEraser(-Max) also demonstrated stronger resilience against adaptive attacks in their original papers. It appears that the novelty is diminished slightly by the earlier discoveries regarding stronger augmentations, although they focused on defenses.

Author response:
- [Novelty] We are the first to introduce stronger contrastive augmentations into the poison generation process using supervised models. Our proposed poisoning attacks achieve SOTA worst-case unlearnability across SL and CL algorithms compared to existing methods.

Reviewer comment (Evaluation):
In Figure 1, UT-AAP is not strictly better than UT-AP.

Author response:
- [UT-AAP and UT-AP] The utilization of stronger augmentations in our methods enhances contrastive unlearnability, but it may potentially weaken supervised unlearnability. This compromise is further complicated by the inherent instability in generating untargeted adversarial poisoning [1].

Reviewer comment (Presentation):
It is confusing why Sections 4.2 and 4.3 are separate. The difference between AUE, AAP exists only in the use of existing error-minimizing and maximizing objectives employed in existing attacks, which are not the core contribution of the paper. It would be better to refactor Section 4 to combine both algorithms and sections for clarity, as it appears redundant in the current format.

Author response:
- [AUE and AAP] The roles of augmentations in AUE and AAP are somewhat different. In the case of AUE, supervised error minimization with enhanced data augmentations can partially replace the role of contrastive error minimization to enlarge the alignment and uniformity gaps and bring contrastive unlearnability. Moreover, stronger augmentations help adversarial poisoning generate poisons to deceive a contrastive-like reference model and thus improve the contrastive unlearnability as well.

Reviewer comment (Experiments):
Please consider adding more defense baselines against the proposed attacks, e.g. the ISS variants, UEraser variants, and AVATAR [1].

Author response:
- We added defenses including ISS-JPEG, ISS-Grayscale, UEraser-Lite, UEraser-Max, and AVATAR in Table 5.

Reviewer comment (Theory):
The motivation for improved / stronger augmentation (the key contribution of this paper) should be further strengthened. The rationale behind Theorem 4.1 could benefit from additional clarification, as its purpose remains somewhat ambiguous. In Section 4.1, the primary takeaway appears to be the notion that to effectively generate poisons, it is imperative to employ stronger augmentations in line with those utilized by contrastive learning algorithms.

Author response:
- [Theorem] Recall that contrastive error-minimization replaces the supervised loss in the supervised error-minimization with contrastive loss. The theorem says that the upper bound of contrastive loss decreases with the supervised loss if their data augmentations in SL obey the same distribution as CL. Thus, optimizing the augmented supervised loss in the poison generation process implicitly optimizes the contrastive loss.

Reviewer comment (Experiments):
It would be better to consider ImageNet-100 instead of Mini-ImageNet to align with previous work.

Author response:
- We included the attack performance on ImageNet-100 in Table 3.  
- [ImageNet-100] Our AUE and AAP attacks are also effective on ImageNet-100.  
| ImageNet-100 | SL   | SimCLR | MoCo | BYOL | SimSiam |  
|--------------|------|--------|------|------|---------|  
| Clean        | 77.8 | 61.8   | 61.8 | 62.2 |    65.8 |  
| AUE          | 5.1  | 5.2    | 6.2  |  7.5 |     4.7 |  
| T-AAP        | 14.4 | 20.3   | 14.5 | 24.8 |    16.6 |

Reviewer comment (Presentation):
Avoid breaking Code Listing 1 between two pages.

Author response:
- We moved the pseudo-code of augmentations to Appendix A.2.

Reviewer comment (Experiments):
An existing method SEP seems to demonstrate a Pareto improvement over every attack this work proposes, except for UT-AAP.

Author response:
Besides, we’ll make some clarifications as follows:
- [About SEP] On CIFAR-10, SEP is not a Pareto improvement of AUE since for SimSiam evaluation, AUE outperforms SEP (34.5% v.s 36.7%).
Furthermore, on CIFAR-100, both AUE and T-AAP attacks outperform SEP in the worst-case unlearnability.

Reviewer comment (Novelty):
I do appreciate the authors principled approach, and intuition, and analysis. Although I think the finding that strong augmentations during poison crafting improves unlearnable examples was also found in [1]. But this work does include very thorough analysis of this, as well as introducing more augmentations during training of the generating model.

Author response:
Besides, we’ll make some clarifications as follows:
- [Augmentations] The motivation, technique, and goal of augmentations in our methods are different from [1]. Differential augmentations employed by [1] contain only standard SL augmentations including RandomCrop and RandomHorizontalFlip. However, our method is motivated by empirical observations and theoretical analysis that combining supervised poisoning approaches with much stronger contrastive augmentations can craft effective poisons for both SL and CL.

Reviewer comment (Presentation):
This isn't a weakness of the core work, but tables 3-6 are way too small and it can be aggravating to have to zoom in significantly while reading the work. I would suggest moving to the appendix. Also legends/labels on several of the figures had this same problem.

Author response:
Thank you for your recognition and feedback!  We have uploaded a new version of our paper. Specifically, based on your suggestions, we have moved some tables to the appendix and rectified the typos. We summarize other modifications in ‘Author’s comments’.