The open source of large amounts of image data promotes the development of deep learning techniques. Along with this comes the privacy risk of these open-source image datasets being exploited by unauthorized third parties to train deep learning models for commercial or illegal purposes. To avoid the abuse of public data, a poisoning-based technique, the unlearnable example, is proposed to significantly degrade the generalization performance of models by adding a kind of imperceptible noise to the data. To further enhance its robustness against adversarial training, existing works leverage iterative adversarial training on both the defensive noise and the surrogate model. However, it still remains unknown whether the robustness of unlearnable examples primarily comes from the effect of enhancement in the surrogate model or the defensive noise. Observing that simply removing the adversarial noise on the training process of the defensive noise can improve the performance of robust unlearnable examples, we identify that solely the surrogate model's robustness contributes to the performance. Furthermore, we found a negative correlation exists between the robustness of defensive noise and the protection performance, indicating defensive noise's instability issue. Motivated by this, to further boost the robust unlearnable example, we introduce stable error-minimizing noise (SEM), which trains the defensive noise against random perturbation instead of the time-consuming adversarial perturbation to improve the stability of defensive noise. Through extensive experiments, we demonstrate that SEM achieves a new state-of-the-art performance on CIFAR-10, CIFAR-100, and ImageNet Subset in terms of both effectiveness and efficiency. The code is available at https://github.com/liuyixin-louis/Stable-Unlearnable-Example.

翻译：大量图像数据的开源促进了深度学习技术的发展。然而，随之而来的隐私风险在于，这些开源图像数据集可能被未经授权的第三方利用，以训练用于商业或非法目的的深度学习模型。为避免公共数据被滥用，一种基于投毒的技术——不可学习示例被提出，通过向数据添加一种难以察觉的噪声，显著降低模型的泛化性能。为进一步增强其对对抗训练的鲁棒性，现有工作利用迭代对抗训练同时优化防御噪声和代理模型。然而，不可学习示例的鲁棒性究竟主要源自代理模型的增强效果还是防御噪声的贡献，这一问题仍不明确。通过观察发现，在防御噪声的训练过程中简单移除对抗噪声可提高鲁棒不可学习示例的性能，我们确定仅代理模型的鲁棒性对性能有所贡献。此外，我们发现防御噪声的鲁棒性与保护性能之间存在负相关，表明防御噪声存在不稳定性问题。基于此，为进一步提升鲁棒不可学习示例，我们引入稳定误差最小化噪声（SEM），该方法通过训练防御噪声以抵抗随机扰动而非耗时的对抗扰动，从而提高防御噪声的稳定性。大量实验表明，SEM在CIFAR-10、CIFAR-100和ImageNet子集上就有效性和效率而言均达到了新的最优性能。代码已开源至https://github.com/liuyixin-louis/Stable-Unlearnable-Example。