Paper: Corrupting Unbounded Unlearnable Datasets with Pixel-based Image Transformations (ICLR-2024)

Reviewer comment (Evaluation):
Overclaim. 1. It is not true that existing defenses are not effective against unbounded UDs. For example, as can be seen from Table 2, ISS-J is consistently the best defense across all model architecture and largely surpasses COIN. Related to this point, the authors are highly recommended to highlight the superiority of ISS-J in the table and the text. Currently, it is completely not mentioned at all. In addition, the authors of OPS have also admitted that OPS is clearly vulnerable to median filtering (see the concerns from multiple reviewers about this and the authors’ response in https://openreview.net/forum?id=p7G8t5FVn2h).

Author response:
A1. Thank you for highlighting the importance of precise language in our claims. We have revised our statement to more accurately reflect the current state of defense solutions against unbounded UDs. The revised claim now reads: "While some existing defense solutions show effectiveness against specific instances of unbounded UDs, a universally effective defense for all such scenarios is yet to be developed." We acknowledge the significant performance of ISS-J, as evidenced in Tab. 2 (already moved to Tab. 1), and have accordingly highlighted its superiority in both the table and our text in our updated paper. Your feedback has been instrumental in enhancing the precision and clarity of our manuscript, and we sincerely appreciate your constructive suggestions.

Reviewer comment (Novelty):
Questionable idea. Actually, it is obvious that intra-class consistency and inter-class inconsistency are needed for any classification problem (simply say a dog is consistent with another dog but inconsistent with a cat). This is also the natural reason why previous work on (bounded) UDs has started their studies with the so-called class-wise perturbations, which directly satisfy both intra-class consistency and inter-class inconsistency. Recent work of Segura et. al has specifically explored the vulnerability of such class-wise UDs and proposed orthogonal projection (OP) to counter them. It is somehow strange OP does no work against unbounded UDs (CUDA) because it follows the same idea of disrupting intra-class consistency and inter-class inconsistency. Can the authors provide any explanations? This question motivates my following point about the design of COIN. Specifically, I suppose the reason why COIN works (but OP does not) on CUDA is that COIN is specifically designed to disrupt the matrix structure in CUDA. If this is the case, intra-class matrix inconsistency and inter-class matrix consistency become irrelevant to the success and should be removed from the paper.

Author response:
A3. Thank you for your comment. It seems there might be a misunderstanding regarding the metrics we introduced. Unlike traditional intra-class consistency and inter-class inconsistency in image classification, our metrics – intra-class matrix inconsistency and inter-class matrix consistency – are specifically designed to quantify the unique characteristics of multiplicative matrix noise in unbounded UDs. This is a distinct form of noise compared to the additive noise commonly found in bounded UDs. For example, as illustrated in Fig. 10, unbounded perturbations within the same class (in CUDA) demonstrate non-identical noise patterns, a phenomenon differs to the class-wise form we understand in additive noise. These new metrics are crucial for understanding the behavior of unbounded UDs and guiding our development of effective defense strategies against them. 
 
A4. Your question about the effectiveness of OP against CUDA is insightful. The key reason OP does not perform well against CUDA perturbations lies in the nature of the noise. CUDA introduces a type of noise that is fundamentally different from the traditional class-wise noise, for which OP was designed. As shown in Fig. 10, unbounded perturbations in CUDA within the same class exhibit distinct noise patterns, rendering OP's matrix decomposition approach ineffective. In contrast, our COIN method is tailored to specifically address the different noise structure of unbounded UDs, enabling it to effectively counter these perturbations where OP falls short. This distinction is crucial and underlines the novelty and necessity of our approach in handling unbounded UDs.

Reviewer comment (Theory):
Lack of motivation for COIN. Although intra-class matrix inconsistency and inter-class matrix consistency are indeed demonstrated to be relevant to the accuracy recovery, it is not clear why the specific design of COIN, i.e., random matrix multiplication, explicitly addresses these two factors. Instead, its design is specifically tailored for CUDA, based on the matrix operations the authors have explained. In general, this is also a problem that the defense is designed based on the knowledge of a specific attack. This suggests that the defense may not be generalizable to other possible attacks (under the same threat model but with a different way of matrix formulation).

Author response:
A5. Thank you for your constructive feedback. We understand your concern regarding the specific design of COIN and its generalizability. Due to space limitation, we expanded the explanation of our random matrix multiplication design in Appendix A.1.2, as referenced in Section 3.5 in our original paper. Our design philosophy for COIN is not limited to countering CUDA's matrix operations but is grounded in a broader understanding of unbounded UDs, including various matrix forms such as diagonal and triangular matrices.
We acknowledge that designing a defense based on specific attack knowledge presents challenges in generalizability. However, our approach with COIN is to establish a strong foundation against known unbounded UD forms, with the anticipation that this foundation will provide robustness against future, yet-to-be-seen attacks within the same threat model. We believe this strategy balances the need for specificity in counteracting known threats while maintaining a degree of flexibility for adaptation to new challenges.

Reviewer comment (Evaluation):
The paper mentions the efficiency of the COIN method but falls short of providing a detailed computational analysis. Understanding the computational overhead is important for assessing the practicality of the method.

Author response:
> Q1. Provide a detailed computational analysis.

A1. Thank you very much for your suggestion!  Assuming that the time complexity of each line of code in Algorithm 2 is ***O*(1)**, then for an unbounded UD $D_u=${$x_i \in R^{C\times H\times W}, i=1,2,...,N$}, the overall time complexity of performing COIN is ***O*(N×C×H×W)+*O*(N×H×W)+*O*(N)**.  Due to the fact that the values of C, H, and W of image $x_i$ are constant, *e.g.,* C=3, H=32, and W=32 for CIFAR-10 images, the final time complexity is optimized to: ***O*(N)+*O*(N)+*O*(N)=*O*(N)**. We appreciate your valuable feedback and have clarified this point in our revised paper. Your comments help us improve the clarity and quality of our research.  

Additionally, we used the same training parameter settings as mentioned in the main text to obtain the time overhead for each defense scheme on ResNet18 (Using one Nvidia GeForce 3090 GPU and Intel(R) Xeon(R) Gold 5218R CPU @ 2.10GHz), as shown in the table below, which demonstrates the efficiency of our scheme.


|        Defenses         |  AT  | AVATAR |  AA  |  OP  | ISS-G | ISS-J | **COIN (Ours)** |
| :---------------------: | :--: | :----: | :--: | :--: | :---: | :---: | :-------------: |
| Time overhead (minutes) | 131  |  129   |  66  |  35  |  24   |  25   |       32        |

Reviewer comment (Experiments):
While the paper makes a significant contribution to image-based tasks, it does not explore the applicability of the COIN method to other model architectures and other types of data. This limitation narrows the paper's impact and leaves questions about its generalizability.

Author response:
> Q2. Transfer COIN to other architectures, other types of data, other datasets, and other tasks.

A2. Thank you for your detailed review and valuable comments on our paper. The issue you raised regarding the applicability of the COIN method to different model architectures, data types, datasets, and tasks is indeed crucial. Allow me to elaborate on how we have addressed this concern.

 Firstly, addressing different computer vision architectures, we have extended the application of the COIN method to two state-of-the-art architectures: GoogleNet [1] and InceptionNetV3 [2], using the CIFAR-10 dataset against CUDA. The experimental results, detailed in the table below, demonstrate a significant improvement in test accuracy (%), robustly attesting to the effectiveness of the COIN method.

| Architectures↓Defenses→ |  w/o  |  MU   |  CM   |  CO   | DP-SGD |  AT   | AVATAR |  AA   |  OP   | ISS-G | ISS-J | COIN (Ours) |
| :---------------------: | :---: | :---: | :---: | :---: | :----: | :---: | :----: | :---: | :---: | :---: | :---: | :---------: |
|     InceptionNetV3      | 18.73 | 26.04 | 20.11 | 18.87 | 17.65  | 50.62 | 30.40  | 38.58 | 26.52 | 15.41 | 38.49 |  **72.88**  |
|        GoogleNet        | 21.10 | 24.99 | 24.25 | 26.06 | 21.18  | 47.66 | 24.68  | 39.01 | 23.94 | 22.63 | 41.49 |  **69.07**  |

Secondly, to further validate the adaptability of COIN, we have conducted experiments on a larger image dataset, ImageNet100, with an image size of 224×224. These additional experimental results have also been incorporated into our updated paper and are presented in the following table:


| Defenses↓Models→ | ResNet18 | ResNet50 | DenseNet121 | MobileNetV2 |   **AVG**  |
|:----------------:|:--------:|:--------:|:-----------:|:-----------:|:------:|
|        w/o       |  25.74   |  26.66   |    21.70    |    16.30    | 22.60  |
|        MU        |  34.96   |  19.38   |    27.78    |    15.60    | 24.43  |
|        CM        |  16.54   |  24.04   |    23.58    |    8.00     | 18.04  |
|        CO        |  25.46   |  29.20   |    23.90    |    17.58    | 24.04  |
|        AT        |  **37.82**   | 36.80   |    30.34    |    41.42    | 36.60 |
|       ISS-G      |  14.92   |  13.50   |    9.78     |    5.78     | 11.00  |
|       ISS-J      |  30.10   |  **37.04**   |    25.52    |    28.04    | 30.18  |
|    **COIN (Ours)**   |  37.80   |  35.38   |    **35.22**    |    **41.50**    | **37.48** |




Regarding the applicability of the COIN method to other types of data and tasks, we note that the concept of Unlearnable Dataset (UD) currently predominates in the image domain for classification tasks, aiming to protect the privacy of image data. The feasibility and practical significance of UD in other data types or tasks have not been explored in the literature to date. Therefore, we are currently unable to extend the COIN defense method for UD to other data types or tasks. Our paper also refrains from making any claims regarding the effectiveness of COIN for other data types.

Finally, I would like to express my gratitude once again for your insightful feedback. Your comments significantly contribute to enhancing the clarity and quality of our research. We also look forward to exploring the potential application of COIN to different data types and tasks in future studies, further expanding the scope of our research.
We appreciate your attention and look forward to making further improvements to our paper.

 [References]

[1] [CVPR'15] Going Deeper with Convolutions

[2] [CVPR'16] Rethinking the Inception Architecture for Computer Vision

Reviewer comment (Evaluation):
What is the computational overhead for the intra-class matrix inconsistency and inter-class matrix consistency, compared with the computation cost of the baselines?

Author response:
> Q3. The computational overhead for the intra-class matrix inconsistency and inter-class matrix consistency, compared with the computation cost of the baselines?

A3.  Thanks for your comments. The computational overheads of running calculations for intra-class matrix inconsistency and inter-class matrix consistency are both within one second on Intel(R) Xeon(R) Gold 5218R CPU @ 2.10GHz, with specific hyperparameter settings provided in Appendix A.2. Additionally, since we are the first to introduce the metrics of intra-class matrix inconsistency and inter-class matrix consistency specifically for unbounded UDs, there are currently no baselines available for comparison in calculating these two metrics.

Reviewer comment (Experiments):
What's the performance of the proposed COIN on other tasks or other datasets?

Author response:
> Q2. Transfer COIN to other architectures, other types of data, other datasets, and other tasks.

A2. Thank you for your detailed review and valuable comments on our paper. The issue you raised regarding the applicability of the COIN method to different model architectures, data types, datasets, and tasks is indeed crucial. Allow me to elaborate on how we have addressed this concern.

 Firstly, addressing different computer vision architectures, we have extended the application of the COIN method to two state-of-the-art architectures: GoogleNet [1] and InceptionNetV3 [2], using the CIFAR-10 dataset against CUDA. The experimental results, detailed in the table below, demonstrate a significant improvement in test accuracy (%), robustly attesting to the effectiveness of the COIN method.

| Architectures↓Defenses→ |  w/o  |  MU   |  CM   |  CO   | DP-SGD |  AT   | AVATAR |  AA   |  OP   | ISS-G | ISS-J | COIN (Ours) |
| :---------------------: | :---: | :---: | :---: | :---: | :----: | :---: | :----: | :---: | :---: | :---: | :---: | :---------: |
|     InceptionNetV3      | 18.73 | 26.04 | 20.11 | 18.87 | 17.65  | 50.62 | 30.40  | 38.58 | 26.52 | 15.41 | 38.49 |  **72.88**  |
|        GoogleNet        | 21.10 | 24.99 | 24.25 | 26.06 | 21.18  | 47.66 | 24.68  | 39.01 | 23.94 | 22.63 | 41.49 |  **69.07**  |

Secondly, to further validate the adaptability of COIN, we have conducted experiments on a larger image dataset, ImageNet100, with an image size of 224×224. These additional experimental results have also been incorporated into our updated paper and are presented in the following table:


| Defenses↓Models→ | ResNet18 | ResNet50 | DenseNet121 | MobileNetV2 |   **AVG**  |
|:----------------:|:--------:|:--------:|:-----------:|:-----------:|:------:|
|        w/o       |  25.74   |  26.66   |    21.70    |    16.30    | 22.60  |
|        MU        |  34.96   |  19.38   |    27.78    |    15.60    | 24.43  |
|        CM        |  16.54   |  24.04   |    23.58    |    8.00     | 18.04  |
|        CO        |  25.46   |  29.20   |    23.90    |    17.58    | 24.04  |
|        AT        |  **37.82**   | 36.80   |    30.34    |    41.42    | 36.60 |
|       ISS-G      |  14.92   |  13.50   |    9.78     |    5.78     | 11.00  |
|       ISS-J      |  30.10   |  **37.04**   |    25.52    |    28.04    | 30.18  |
|    **COIN (Ours)**   |  37.80   |  35.38   |    **35.22**    |    **41.50**    | **37.48** |




Regarding the applicability of the COIN method to other types of data and tasks, we note that the concept of Unlearnable Dataset (UD) currently predominates in the image domain for classification tasks, aiming to protect the privacy of image data. The feasibility and practical significance of UD in other data types or tasks have not been explored in the literature to date. Therefore, we are currently unable to extend the COIN defense method for UD to other data types or tasks. Our paper also refrains from making any claims regarding the effectiveness of COIN for other data types.

Finally, I would like to express my gratitude once again for your insightful feedback. Your comments significantly contribute to enhancing the clarity and quality of our research. We also look forward to exploring the potential application of COIN to different data types and tasks in future studies, further expanding the scope of our research.
We appreciate your attention and look forward to making further improvements to our paper.

 [References]

[1] [CVPR'15] Going Deeper with Convolutions

[2] [CVPR'16] Rethinking the Inception Architecture for Computer Vision

Reviewer comment (Novelty):
I think the observation about intra-class matrix inconsistency and inter-class matrix consistency is not closely correlated with the property of unbounded unlearnable attack. From my perspective, it essentially has no difference with the findings widely discussed in previous works: linearity separability is a important factor for crafting powerful unlearnable examples. Increasing intra-class matrix inconsistency or inter-class matrix consistency actually impair this separability to defend unlearnable examples.

Author response:
Thank you for your insightful perspective! We appreciate the opportunity to clarify the distinction between our findings and the broader concept of linear separability in unlearnable attacks. It's important to note that linear separability, as discussed in the works of Yu *et al.* [1], primarily applies to additive noise in bounded UDs. However, not all additive noise exhibits linear separability, as indicated in [2]. This suggests that the principles governing bounded UDs may not directly apply to unbounded UDs.

In our study, we specifically address the unique characteristics of unbounded UDs, which exhibit distinct noise patterns compared to bounded UDs. For example, as shown in Fig. 10, unbounded perturbations within the same class demonstrate non-identical noise in CUDA. This pattern of noise differs fundamentally from the class-wise noise in bounded UDs and necessitates a different analytical approach.

Therefore, we introduced two new metrics—namely, intra-class matrix inconsistency and inter-class matrix consistency. These metrics are designed to quantify the unique properties of multiplicative matrix noise in unbounded UDs, which, in our observations, significantly influence their linear separability. By focusing on these metrics, we aim to provide a more nuanced understanding of how unbounded UDs behave and how they can be effectively countered.

Our revised paper includes a detailed explanation of the logical relationship between these metrics and the linear separability of unbounded UDs. We believe this clarification will enhance the comprehensibility of our approach. Again, we thank you for your valuable feedback, which has greatly contributed to the improvement of our research.

[References]

[1] [KDD'22] Availability Attacks Create Shortcuts

[2] [NeurIPS'23] What Can We Learn from Unlearnable Datasets?

Reviewer comment (Experiments):
Though the authors claim performing experiments on ImageNet, they only select a very small fraction of vanilla dataset (20 class, 2%) and resize the image to $64\times64$ which is still a low-resolution and small dataset. To further demonstrate the effectiveness of COIN on large dataset and considering the computational cost during pre-processing, I would recommend performing experiments on ImageNet-100 with $224\times224$ image size to further demonstrate the superiority of the proposed method.

Author response:
A2. Thank you for your valuable suggestion to conduct experiments on a larger and higher resolution dataset. In response to your recommendation, we have expanded our experimental setup to include ImageNet100 with 224x224 image size. This adjustment not only aligns with your suggestion but also allows us to test the effectiveness of COIN in a more challenging and realistic scenario.  

In our updated paper, we have replaced the initial experimental data from ImageNet20 (64x64) with these new results. These experiments on ImageNet100 not only demonstrate the adaptability of COIN to larger and higher resolution datasets but also reinforce the superiority of our approach.  We also show the experimental results as below:

| Defenses↓Models→ | ResNet18 | ResNet50 | DenseNet121 | MobileNetV2 |   **AVG**  |
|:----------------:|:--------:|:--------:|:-----------:|:-----------:|:------:|
|        w/o       |  25.74   |  26.66   |    21.70    |    16.30    | 22.60  |
|        MU        |  34.96   |  19.38   |    27.78    |    15.60    | 24.43  |
|        CM        |  16.54   |  24.04   |    23.58    |    8.00     | 18.04  |
|        CO        |  25.46   |  29.20   |    23.90    |    17.58    | 24.04  |
|        AT        |  **37.82**   |  36.80    |    30.34    |    41.42    |  36.60 |
|       ISS-G      |  14.92   |  13.50   |    9.78     |    5.78     | 11.00  |
|       ISS-J      |  30.10   |  **37.04**   |    25.52    |    28.04    | 30.18  |
|    **COIN (Ours)**   |  37.80   |  35.38   |    **35.22**    |    **41.50**    | **37.48**  |

We believe these additional experiments substantially strengthen the evidence for COIN's effectiveness and are grateful for your feedback, which has been instrumental in enhancing the quality of our research.

Reviewer comment (Experiments):
From the perspective of integrity, I would suggest testing the performance of COIN against OPS on CIFAR-100 dataset. Furthermore, combing Table 1 and Table 2 together to a large table will enhance the visual representation of experimental results for easy comparison.

Author response:
A3. Thank you for your constructive suggestion to evaluate COIN's performance against OPS on the CIFAR-100 dataset. In response, we have incorporated additional experiments with OPS on CIFAR-100 into Tab. 1. These experiments were conducted following the same rigorous standards as our other tests, ensuring consistency and reliability in the results.

Furthermore, based on your advice, we have combined Tab. 1 and Tab. 2 into a single, comprehensive table. This integration enhances the visual representation of our experimental results, facilitating easier comparison and better understanding of COIN's performance across different scenarios.

The revised table showcases the superiority of COIN, especially in terms of average test accuracy (%) against OPS and CUDA, further supporting our claims about its effectiveness.

We truly value and appreciate your feedback, which has significantly contributed to enhancing the clarity and quality of our research. The detailed experimental results and comparisons are now more effectively presented, thanks to your insightful comments.

Reviewer comment (Experiments):
Acknowledging that COIN is a defense methods designed for unbounded UDs, however, in real situation, defenders do not have any knowlege about the kind of attacks adopted by attackers. Thus, I am curious whether COIN is effctive to defend bounded UDs.

Author response:
A5. Thank you for your inquiry. We provided specific details in Tab. 10 in Appendix A.5.1, demonstrating that COIN has a defensive effect against certain bounded UDs.

Reviewer comment (Experiments):
Is COIN still effective when the perturbation for OPS is sample-wise [1]?

Author response:
A6. COIN is ineffective against error-minimizing noise + OPS, as it is also ineffective against error-minimizing noise belonging to bounded noise. Thank you for your attention.