用模糊数据训练模型，却能被锐化和滤波恢复，暴露了数据不可学的漏洞。
Learning from Convolution-based Unlearnable Datasets
- 对图像加类别的模糊，让模型学模糊核与标签关系而非真实特征。
- 锐化+频域滤波后，CUDA数据在多个数据集上测试准确率超越对抗训练。
- 提醒需持续改进数据污染技术，适合关注数据隐私的开发者看。
大规模深度学习数据集的构建引发了对在线数据未经授权使用的担忧，促使人们关注如何保护数据免遭第三方用于训练。卷积不可学数据集（CUDA）方法通过在数据集中每张图像上应用类别相关的模糊处理，使神经网络学习模糊核与标签之间的关联，而非用于分类干净数据的有用特征。本文评估了在图像锐化和频率滤波后，CUDA数据是否仍保持不可学性，发现这两种简单变换的组合显著提升了使用CUDA数据训练模型的实用性。特别是，在CIFAR-10、CIFAR-100和ImageNet-100上，使用该方法生成的不可学数据训练出的模型，其测试准确率高于对抗训练。本研究强调了在高精度训练中持续优化数据污染技术以保障数据隐私的重要性。我们的方法揭示了简单的锐化和频域滤波即可破坏基于卷积的不可学数据集，为增强不可学数据集的鲁棒性提供了新方向。
原文摘要 · Abstract (English)
The construction of large datasets for deep learning has raised concerns regarding unauthorized use of online data, leading to increased interest in protecting data from third-parties who want to use it for training. The Convolution-based Unlearnable DAtaset (CUDA) method aims to make data unlearnable by applying class-wise blurs to every image in the dataset so that neural networks learn relations between blur kernels and labels, as opposed to informative features for classifying clean data. In this work, we evaluate whether CUDA data remains unlearnable after image sharpening and frequency filtering, finding that this combination of simple transforms improves the utility of CUDA data for training. In particular, we observe a substantial increase in test accuracy over adversarial training for models trained with CUDA unlearnable data from CIFAR-10, CIFAR-100, and ImageNet-100. In training models to high accuracy using unlearnable data, we underscore the need for ongoing refinement in data poisoning techniques to ensure data privacy. Our method opens new avenues for enhancing the robustness of unlearnable datasets by highlighting that simple methods such as sharpening and frequency filtering are capable of breaking convolution-based unlearnable datasets.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。