ARMOR: Shielding Unlearnable Examples against Data Augmentation

TL;DR

This paper reveals that data augmentation can compromise the privacy of unlearnable examples and proposes ARMOR, a defense framework that effectively preserves data privacy against augmentation-induced privacy breaches.

Contribution

We introduce ARMOR, a novel defense framework that protects unlearnable data from privacy breaches caused by data augmentation, using surrogate models and adaptive augmentation strategies.

Findings

Data augmentation significantly increases model accuracy on unlearnable examples.

ARMOR effectively reduces the model accuracy on protected data by up to 60%.

ARMOR outperforms six state-of-the-art defense methods across multiple datasets.

Abstract

Private data, when published online, may be collected by unauthorized parties to train deep neural networks (DNNs). To protect privacy, defensive noises can be added to original samples to degrade their learnability by DNNs. Recently, unlearnable examples are proposed to minimize the training loss such that the model learns almost nothing. However, raw data are often pre-processed before being used for training, which may restore the private information of protected data. In this paper, we reveal the data privacy violation induced by data augmentation, a commonly used data pre-processing technique to improve model generalization capability, which is the first of its kind as far as we are concerned. We demonstrate that data augmentation can significantly raise the accuracy of the model trained on unlearnable examples from 21.3% to 66.1%. To address this issue, we propose a defense framework, dubbed ARMOR, to protect data privacy from potential breaches of data augmentation. To overcome the difficulty of having no access to the model training process, we design a non-local module-assisted surrogate model that better captures the effect of data augmentation. In addition, we design a surrogate augmentation selection strategy that maximizes distribution alignment between augmented and non-augmented samples, to choose the optimal augmentation strategy for each class. We also use a dynamic step size adjustment algorithm to enhance the defensive noise generation process. Extensive experiments are conducted on 4 datasets and 5 data augmentation methods to verify the performance of ARMOR. Comparisons with 6 state-of-the-art defense methods have demonstrated that ARMOR can preserve the unlearnability of protected private data under data augmentation. ARMOR reduces the test accuracy of the model trained on augmented protected samples by as much as 60% more than baselines.