Dual-branch Robust Unlearnable Examples

TL;DR

DUNE introduces a dual-branch ensemble perturbation method optimizing spatial and color domain noise to create robust unlearnable examples that resist advanced defenses.

Contribution

The paper proposes DUNE, a novel dual-branch ensemble approach that enhances unlearnable example robustness by optimizing perturbations across spatial and color domains.

Findings

DUNE outperforms 12 state-of-the-art schemes under 7 defenses.

Achieves lower average test accuracy of 14.95% to 50.82%.

Extends perturbation domain to improve robustness.

Abstract

Unlearnable examples (UEs) aim to compromise model training by injecting imperceptible perturbations to clean samples. However, existing UE schemes exhibit limited robustness against advanced defenses due to their heuristic design or narrowly scoped domain perturbations. To address this, we propose \texttt{DUNE}, a \underline{\textbf{D}}ual-branch \underline{\textbf{UN}}learnable \underline{\textbf{E}}nsemble perturbation optimization approach. Specifically, \texttt{DUNE} separately optimizes perturbations in the spatial and color domains to establish the mapping between perturbations and shift-induced labels. This design extends the perturbation domain to increase noise intensity for improving robustness and drives the models to learn perturbation-oriented features with degraded generalization, thereby achieving unlearnability. To strengthen \texttt{DUNE}'s performance, we further propose an unlearnability-enhancing ensemble strategy that aggregates diverse pre-trained models during the dual-branch optimization. Extensive experiments on benchmark datasets CIFAR-10 and ImageNet verify that \texttt{DUNE}'s robustness outperforms 12 SOTA UE schemes under 7 mainstream defenses, yielding a lower average test accuracy of 14.95\% to 50.82\%.