梯度驱动的对抗增强框架可攻破不可学习数据保护
A Gradient based Adversarial Augmentation Framework for Mitigating Unlearnable Datasets
有人用梯度方法破解了'防爬虫训练'的不可学习数据集，CIFAR-10 上干净准确率大幅回升，做数据保护的人得看看。
不可学习数据方法（ULD）通过在图片中加入不可感知扰动制造学习捷径，阻止模型学到可泛化特征。该论文提出基于梯度的对抗增强框架，利用可微数据增强管线在最多 18 种增强技术中搜索策略，以随机梯度上升最大化代理模型的分类损失。为保留图像语义，作者引入感知加像素正则化。在 EMIN 保护的 CIFAR-10 上，ResNet-18 的干净测试准确率达 80.0%，超过随机采样基线的 77.29%；在 NTGA 保护的 CIFAR-10 上，MobileNet-V2 达到 83.28%，对比基线 66.45%。
A Gradient based Adversarial Augmentation Framework for Mitigating Unlearnable Datasets
Unlearnable data methods (ULD) protect public data from unauthorized model training by adding imperceptible perturbations that create a learning shortcut. A deep neural network can exploit the shortcut learning path to minimize training loss without learning generalizable features. Intuitively, finding adversarial versions of perturbed images that can substantially increase the model's loss can force the model to learn generalizable features. Existing data augmentation based attacks rely on heuristic search strategies/random sampling over a curated augmentation set to identify adversarial augmentation operations, an approach that often does not scale when the number of candidate operations is large. To address the challenge of a large search space, we propose {\techname}, a gradient based adversarial augmentation framework that learns an augmentation policy via stochastic gradient ascent. {\techname} leverages a differentiable data augmentation pipeline to efficiently search a set of up to 18 augmentation techniques, from which a grid search selects a protection-specific subset. The augmentation subset is trained to maximize a surrogate model's classification loss. We introduce a perceptual-plus-pixel regularization to learn operation parameters that preserve image semantics. Under a controlled ablation, {\techname} consistently outperforms an equivalent random sampling baseline (80.0\% vs. 77.29\% clean test accuracy on EMIN-protected CIFAR-10 for ResNet-18 and 83.28\% vs. 66.45\% on NTGA-protected CIFAR-10 for MobileNet-V2), demonstrating that gradient guidance drives the clean test accuracy recoverability rather than the expanded search space. {\techname} offers an effective and scalable adversarial augmentation framework for stress-testing ULD methods, a critical tool for developing robust ULD methods.