Towards Provably Unlearnable Examples via Bayes Error Optimisation

2025-11-11

AI Summary

This paper addresses the challenge of constructing “unlearnable examples” for data privacy protection. We propose the first provably robust defense framework grounded in Bayesian error maximization theory. Methodologically, we optimize input perturbations via projected gradient ascent to systematically increase the Bayesian error of classification tasks, thereby theoretically guaranteeing suppression of model learning on sensitive samples; the generated examples preserve naturalness and retain unlearnability even when mixed with clean data during training. Our contributions are threefold: (1) introducing Bayesian error as the first optimization- and verification-friendly metric for unlearnability; (2) providing tight theoretical guarantees on unlearnability; and (3) empirically validating effectiveness across CIFAR-10/100, ImageNet subsets, and diverse network architectures—achieving over 40% average test accuracy reduction. Theory and experiments exhibit strong consistency.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Security and Privacy: Data transparency and provenance
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

The recent success of machine learning models, especially large-scale classifiers and language models, relies heavily on training with massive data. These data are often collected from online sources. This raises serious concerns about the protection of user data, as individuals may not have given consent for their data to be used in training. To address this concern, recent studies introduce the concept of unlearnable examples, i.e., data instances that appear natural but are intentionally altered to prevent models from effectively learning from them. While existing methods demonstrate empirical effectiveness, they typically rely on heuristic trials and lack formal guarantees. Besides, when unlearnable examples are mixed with clean data, as is often the case in practice, their unlearnability disappears. In this work, we propose a novel approach to constructing unlearnable examples by systematically maximising the Bayes error, a measurement of irreducible classification error. We develop an optimisation-based approach and provide an efficient solution using projected gradient ascent. Our method provably increases the Bayes error and remains effective when the unlearning examples are mixed with clean samples. Experimental results across multiple datasets and model architectures are consistent with our theoretical analysis and show that our approach can restrict data learnability, effectively in practice.

Problem

• Protecting user data from unauthorized machine learning training
• Creating provably unlearnable examples via Bayes error optimization
• Maintaining unlearnability when mixed with clean training data

Innovation

• Maximizing Bayes error for unlearnable examples
• Using projected gradient ascent optimization
• Effective when mixed with clean data samples