Dual-branch Robust Unlearnable Examples

2026-05-03

AI Summary

Existing methods for generating unlearnable examples exhibit insufficient robustness against advanced defenses. This work proposes DUNE, the first approach to extend perturbation optimization into both spatial and color domains, jointly generating cross-domain perturbations through a dual-branch architecture. It further introduces an enhanced ensemble strategy based on pretrained models to significantly boost perturbation strength and generalization of interference. By effectively inducing models to learn spurious features, DUNE severely degrades their generalization performance. Evaluated on CIFAR-10 and ImageNet against seven state-of-the-art defense mechanisms, DUNE reduces the average test accuracy of victim models to 14.95%–50.82%, substantially outperforming twelve existing state-of-the-art methods.

Abstract

Unlearnable examples (UEs) aim to compromise model training by injecting imperceptible perturbations to clean samples. However, existing UE schemes exhibit limited robustness against advanced defenses due to their heuristic design or narrowly scoped domain perturbations. To address this, we propose \texttt{DUNE}, a \underline{\textbf{D}}ual-branch \underline{\textbf{UN}}learnable \underline{\textbf{E}}nsemble perturbation optimization approach. Specifically, \texttt{DUNE} separately optimizes perturbations in the spatial and color domains to establish the mapping between perturbations and shift-induced labels. This design extends the perturbation domain to increase noise intensity for improving robustness and drives the models to learn perturbation-oriented features with degraded generalization, thereby achieving unlearnability. To strengthen \texttt{DUNE}'s performance, we further propose an unlearnability-enhancing ensemble strategy that aggregates diverse pre-trained models during the dual-branch optimization. Extensive experiments on benchmark datasets CIFAR-10 and ImageNet verify that \texttt{DUNE}'s robustness outperforms 12 SOTA UE schemes under 7 mainstream defenses, yielding a lower average test accuracy of 14.95\% to 50.82\%.

Problem

• Unlearnable Examples
• Robustness
• Perturbation
• Model Training
• Defenses

Innovation

• Unlearnable Examples
• Dual-branch Optimization
• Perturbation Robustness
• Ensemble Strategy
• Adversarial Defense