As data becomes increasingly vital, a company would be very cautious about releasing data, because the competitors could use it to train high-performance models, thereby posing a tremendous threat to the company's commercial competence. To prevent training good models on the data, we could add imperceptible perturbations to it. Since such perturbations aim at hurting the entire training process, they should reflect the vulnerability of DNN training, rather than that of a single model. Based on this new idea, we seek perturbed examples that are always unrecognized (never correctly classified) in training. In this paper, we uncover them by model checkpoints' gradients, forming the proposed self-ensemble protection (SEP), which is very effective because (1) learning on examples ignored during normal training tends to yield DNNs ignoring normal examples; (2) checkpoints' cross-model gradients are close to orthogonal, meaning that they are as diverse as DNNs with different architectures. That is, our amazing performance of ensemble only requires the computation of training one model. By extensive experiments with 9 baselines on 3 datasets and 5 architectures, SEP is verified to be a new state-of-the-art, e.g., our small $\ell_\infty=2/255$ perturbations reduce the accuracy of a CIFAR-10 ResNet18 from 94.56% to 14.68%, compared to 41.35% by the best-known method. Code is available at https://github.com/Sizhe-Chen/SEP.

翻译：随着数据日益重要，企业发布数据时会极为谨慎，因为竞争对手可能利用这些数据训练高性能模型，从而对企业的商业竞争力构成巨大威胁。为防止利用数据训练出优秀模型，我们可向数据添加难以察觉的扰动。由于此类扰动旨在破坏整个训练过程，其应反映深度神经网络训练的脆弱性，而非单一模型的脆弱性。基于这一新思路，我们寻找在训练中始终无法被识别（从未正确分类）的扰动样本。本文通过模型检查点的梯度发现这些样本，构建所提出的自集成保护（SEP）方法，该方法效果显著，原因在于：（1）在正常训练中被忽略的样本上学习，易导致深度神经网络忽略正常样本；（2）不同检查点的跨模型梯度近乎正交，这意味其多样性堪比不同架构的深度神经网络。即，我们集成方案的惊人性能仅需训练一个模型的计算量。通过在3个数据集和5种架构上与9个基线方法进行广泛实验，SEP被验证为新的最优方法，例如，我们设置的微小$\ell_\infty=2/255$扰动可将CIFAR-10 ResNet18的准确率从94.56%降至14.68%，而已知最优方法仅能降至41.35%。代码已开源至https://github.com/Sizhe-Chen/SEP。