As data becomes increasingly vital, a company would be very cautious about releasing data, because the competitors could use it to train high-performance models, thereby posing a tremendous threat to the company's commercial competence. To prevent training good models on the data, we could add imperceptible perturbations to it. Since such perturbations aim at hurting the entire training process, they should reflect the vulnerability of DNN training, rather than that of a single model. Based on this new idea, we seek perturbed examples that are always unrecognized (never correctly classified) in training. In this paper, we uncover them by model checkpoints' gradients, forming the proposed self-ensemble protection (SEP), which is very effective because (1) learning on examples ignored during normal training tends to yield DNNs ignoring normal examples; (2) checkpoints' cross-model gradients are close to orthogonal, meaning that they are as diverse as DNNs with different architectures. That is, our amazing performance of ensemble only requires the computation of training one model. By extensive experiments with 9 baselines on 3 datasets and 5 architectures, SEP is verified to be a new state-of-the-art, e.g., our small $\ell_\infty=2/255$ perturbations reduce the accuracy of a CIFAR-10 ResNet18 from 94.56% to 14.68%, compared to 41.35% by the best-known method. Code is available at https://github.com/Sizhe-Chen/SEP.

翻译：随着数据变得日益关键，企业在发布数据时会非常谨慎，因为竞争对手可能利用这些数据训练高性能模型，从而对企业的商业竞争力构成巨大威胁。为防止在数据上训练出良好模型，我们可向数据添加不可感知的扰动。由于此类扰动旨在破坏整个训练过程，它们应反映深度神经网络训练的脆弱性，而非单一模型的脆弱性。基于这一新思路，我们寻找在训练中始终未被识别（从未正确分类）的扰动示例。本文通过模型检查点的梯度揭示此类示例，并提出自集成保护（Self-Ensemble Protection, SEP）方法。该方法极为有效，原因如下：（1）在正常训练中被忽略的样本上学习，易导致深度神经网络忽略正常样本；（2）检查点的跨模型梯度近似正交，意味着其多样性堪比不同架构的深度神经网络。换言之，我们仅需训练一个模型的计算量即可实现令人惊叹的集成性能。通过在3个数据集、5种架构上对9个基线方法进行大量实验，SEP被验证为新的最优方法——例如，在CIFAR-10数据集上，我们施加较小的$\ell_\infty=2/255$扰动可将ResNet18的准确率从94.56%降至14.68%，而已知最佳方法仅能降至41.35%。代码已开源：https://github.com/Sizhe-Chen/SEP。