Protecting personal data against exploitation of machine learning models is crucial. Recently, availability attacks have shown great promise to provide an extra layer of protection against the unauthorized use of data to train neural networks. These methods aim to add imperceptible noise to clean data so that the neural networks cannot extract meaningful patterns from the protected data, claiming that they can make personal data "unexploitable." This paper provides a strong countermeasure against such approaches, showing that unexploitable data might only be an illusion. In particular, we leverage the power of diffusion models and show that a carefully designed denoising process can counteract the effectiveness of the data-protecting perturbations. We rigorously analyze our algorithm, and theoretically prove that the amount of required denoising is directly related to the magnitude of the data-protecting perturbations. Our approach, called AVATAR, delivers state-of-the-art performance against a suite of recent availability attacks in various scenarios, outperforming adversarial training even under distribution mismatch between the diffusion model and the protected data. Our findings call for more research into making personal data unexploitable, showing that this goal is far from over. Our implementation is available at this repository: https://github.com/hmdolatabadi/AVATAR.

翻译：保护个人数据免受机器学习模型的利用至关重要。近年来，可用性攻击在防止个人数据被用于训练神经网络方面展现出巨大潜力。这些方法旨在向干净数据中添加难以察觉的噪声，使得神经网络无法从受保护数据中提取有效模式，声称能让个人数据变得“不可利用”。本文提出了一种针对此类方法的强效对抗手段，证明所谓的不可利用数据可能仅是幻觉。具体而言，我们借助扩散模型的能力，展示了一种精心设计的去噪过程能够抵消数据保护扰动的效果。我们对算法进行了严格分析，并从理论上证明所需去噪量直接与数据保护扰动的幅度相关。我们的方法名为AVATAR，在多种场景下针对近期一系列可用性攻击取得了最先进性能，即使在扩散模型与受保护数据存在分布失配的情况下，其表现也优于对抗训练。我们的研究结果表明，实现个人数据的不可利用性目标仍任重道远，亟需更多相关研究。我们的实现代码已公开于以下仓库：https://github.com/hmdolatabadi/AVATAR。