Learning from Convolution-based Unlearnable Datastes

2024-11-04

arXiv.org

AI Summary

This work investigates the robustness of privacy-preserving unlearnability in Convolutionally Unlearnable Data (CUDA) under common post-processing operations—specifically, image sharpening and frequency-domain filtering. We systematically evaluate whether such transformations preserve CUDA’s claimed unlearnability. Contrary to prior assumptions, we find that simple enhancements—e.g., sharpening combined with low-frequency boosting—effectively restore discriminative features in CUDA samples, substantially improving downstream model training performance. On CIFAR-10, CIFAR-100, and ImageNet-100, models trained on recovered data consistently outperform those trained via adversarial training baselines. This study provides the first empirical evidence that CUDA-style unlearnability is highly fragile to standard image augmentations, challenging the foundational security assumptions of existing unlearnable data paradigms. Our findings offer critical insights for data poisoning defense, privacy-preserving machine learning, and robust data governance, establishing a new empirical foundation for evaluating unlearnability under realistic preprocessing threats.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Data transparency and provenance
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

The construction of large datasets for deep learning has raised concerns regarding unauthorized use of online data, leading to increased interest in protecting data from third-parties who want to use it for training. The Convolution-based Unlearnable DAtaset (CUDA) method aims to make data unlearnable by applying class-wise blurs to every image in the dataset so that neural networks learn relations between blur kernels and labels, as opposed to informative features for classifying clean data. In this work, we evaluate whether CUDA data remains unlearnable after image sharpening and frequency filtering, finding that this combination of simple transforms improves the utility of CUDA data for training. In particular, we observe a substantial increase in test accuracy over adversarial training for models trained with CUDA unlearnable data from CIFAR-10, CIFAR-100, and ImageNet-100. In training models to high accuracy using unlearnable data, we underscore the need for ongoing refinement in data poisoning techniques to ensure data privacy. Our method opens new avenues for enhancing the robustness of unlearnable datasets by highlighting that simple methods such as sharpening and frequency filtering are capable of breaking convolution-based unlearnable datasets.

Problem

• Protecting data from unauthorized deep learning training
• Evaluating CUDA method's resilience to image sharpening and filtering
• Improving robustness of unlearnable datasets against simple transforms

Innovation

• Applies class-wise blurs to images
• Uses sharpening and frequency filtering
• Enhances robustness of unlearnable datasets