How Far Are We from True Unlearnability?
Authors: Kai Ye, Liangcai Su, Chenxiong Qian
ICLR 2025 | Venue PDF | Archive PDF | Plain Text | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | However, unexpectedly, we find that on the multi-task dataset Taskonomy, UEs still perform well in tasks such as semantic segmentation, failing to exhibit cross-task unlearnability. This phenomenon leads us to question: How far are we from attaining truly unlearnable examples? We attempt to answer this question from the perspective of model optimization. To this end, we observe the difference in the convergence process between clean and poisoned models using a simple model architecture. Subsequently, from the loss landscape we find that only a part of the critical parameter optimization paths show significant differences, implying a close relationship between the loss landscape and unlearnability. Consequently, we employ the loss landscape to explain the underlying reasons for UEs and propose Sharpness-Aware Learnability (SAL) to quantify the unlearnability of parameters based on this explanation. Furthermore, we propose an Unlearnable Distance (UD) to measure the unlearnability of data based on the SAL distribution of parameters in clean and poisoned models. Finally, we conduct benchmark tests on mainstream unlearnable methods using the proposed UD, aiming to promote community awareness of the capability boundaries of existing unlearnable methods. |
| Researcher Affiliation | Academia | Kai Ye , Liangcai Su , Chenxiong Qian Q The University of Hong Kong |
| Pseudocode | Yes | Algorithm 1 Unlearnable Distance |
| Open Source Code | Yes | We made our code publicly available on Git Hub . https://github.com/MLsecurity Lab/How Far Are From True Unlearnability.git |
| Open Datasets | Yes | Surprisingly, on the Taskonomy dataset (Zamir et al., 2018), the UEs generated by existing methods have a minimal negative impact on model performance, suggesting that existing UEs do not cause model training to fail. In other words, current Unlearnable Examples have not genuinely achieved multi-task unlearnability. Furthermore, the experimental results also demonstrate that existing UEs fail in cross-task scenarios (see Appendix A.2). This observation raises the question: How far are we from attaining truly unlearnable examples? Unless stated separately, all experiments in our graphical results are on CIFAR-10 (Krizhevsky et al., 2009) trained with Res Net18 (He et al., 2016). We generate samplewise perturbations for all the UEs mentioned except for OPS and we follow their default generating setting. We limit the perturbation budget to ℓ = 8/255. After generating the poisoned dataset, the model is randomly initialized and re-trained from scratch, via SGD for 100 epochs with an initial learning rate of 0.1 and decay by 0.1 by default. For SAL searching, we set p = 2 and ϵ = 0.05, the iterative step for optimizing v is 10. |
| Dataset Splits | No | For the toy classification task, we employ a single-layer linear layer as the classification model with input and output dimensions of (12, ) and (10, ). We manually construct a dataset containing 5,000 samples and 10 classes using the make classification method in the scikit-learn library. We utilize Cross Entropy as the discriminator and SGD (with a learning rate of 0.1) as the optimizer. We train for 10 epochs and collect trajectories for plotting the loss landscape every 5 steps. For MNIST, we train a classifier using Le Net-5, with the same discriminator and optimizer (with a learning rate of 0.001 and momentum of 0.9). For both datasets, we employ OPS to generate class-wise perturbations to construct UEs. In the multi-task learning experiments we train a multi-task model based on Res Net as the backbone on Taskonomy (Zamir et al., 2018) dataset (we use the tiny split to facilitate the search for EM perturbations), which includes four tasks (Scene Cls., Keyp.2d, Depth Euc. and Segm.2D ). We refer to the experimental setup of Mod Squad (Chen et al., 2023) and train for 100 epochs. To demonstrate the universality of the proposed metrics, we have included the larger-scale dataset CIFAR-100 and Image Net (Russakovsky et al., 2015) subset (the first 100 classes, and we center-crop all the images to 224 224) in addition to CIFAR-10. |
| Hardware Specification | No | The paper does not provide specific hardware details for running its experiments. |
| Software Dependencies | No | We manually construct a dataset containing 5,000 samples and 10 classes using the make classification method in the scikit-learn library. We utilize Cross Entropy as the discriminator and SGD (with a learning rate of 0.1) as the optimizer. |
| Experiment Setup | Yes | Experimental Setting. For the toy classification task, we employ a single-layer linear layer as the classification model with input and output dimensions of (12, ) and (10, ), respectively. We manually construct a dataset containing 5,000 samples and 10 classes using the make classification method in the scikit-learn library. We utilize Cross Entropy as the discriminator and SGD (with a learning rate of 0.1) as the optimizer. We train for 10 epochs and collect trajectories for plotting the loss landscape every 5 steps. For MNIST, we train a classifier using Le Net-5, with the same discriminator and optimizer (with a learning rate of 0.001 and momentum of 0.9). For both datasets, we employ OPS to generate class-wise perturbations to construct UEs. Unless stated separately, all experiments in our graphical results are on CIFAR-10 (Krizhevsky et al., 2009) trained with Res Net18 (He et al., 2016). We generate samplewise perturbations for all the UEs mentioned except for OPS and we follow their default generating setting. We limit the perturbation budget to ℓ = 8/255. After generating the poisoned dataset, the model is randomly initialized and re-trained from scratch, via SGD for 100 epochs with an initial learning rate of 0.1 and decay by 0.1 by default. For SAL searching, we set p = 2 and ϵ = 0.05, the iterative step for optimizing v is 10. In the multi-task learning experiments we train a multi-task model based on Res Net as the backbone on Taskonomy (Zamir et al., 2018) dataset (we use the tiny split to facilitate the search for EM perturbations), which includes four tasks (Scene Cls., Keyp.2d, Depth Euc. and Segm.2D ). We refer to the experimental setup of Mod Squad (Chen et al., 2023) and train for 100 epochs. |