The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Models

Abstract

Protecting personal data against the exploitation of machine learning models is of paramount importance. Recently, availability attacks have shown great promise to provide an extra layer of protection against the unauthorized use of data to train neural networks. These methods aim to add imperceptible noise to clean data so that the neural networks cannot extract meaningful patterns from the protected data, claiming that they can make personal data "unexploitable." In this paper, we provide a strong countermeasure against such approaches, showing that unexploitable data might only be an illusion. In particular, we leverage the power of diffusion models and show that a carefully designed denoising process can defuse the ramifications of the data-protecting perturbations. We rigorously analyze our algorithm, and theoretically prove that the amount of required denoising is directly related to the magnitude of the data-protecting perturbations. Our approach, called AVATAR, delivers state-of-the-art performance against a suite of recent availability attacks in various scenarios, outperforming adversarial training. Our findings call for more research into making personal data unexploitable, showing that this goal is far from over.

DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models

“…This defense mechanism operates in a black-box manner, without prior knowledge of the attack settings (e.g., the target label, poison rate and trigger functions), as well as any known benign or poisoned samples from the given data. We assume that the defender has access to pre-trained diffusion models representing identical or similar distributions (consistent with prior studies (Nie et al 2022;Xiao et al 2023;May et al 2023;Shi et al 2023;Dolatabadi, Erfani, and Leckie 2023;Jiang et al 2023)), which can be sourced as off-the-shelf models or trained using data provided from authoritative and trustworthy communities and institutions. Beyond this assumption, our experiments also validate the effectiveness of DATAELIXIR using diffusion models trained on disparate data and even poisoned data.…”

Unlearnable Examples Give a False Sense of Security: Piercing through Unexploitable Data with Learnable Examples

“…Countermeasures against UEs have only been attempted very recently [7,24,33]. Adversarial Training (AT) [21] has been shown to partially resist UE protection, but robust UE soon broke through this countermeasure [11,44].…”

“…However, these methods are associated with specific training schemes, which limits the use of unauthorized data for other training schemes and tasks. The recent arXiv paper [7] applies diffusion models to counter UEs. The major differences to our approach are that we propose a new joint-conditional diffusion model instead of a naive application of the diffusion model, tackling the trade-off between perturbation purification and image semantic retaining.…”

Discrete-time resilient-distributed secondary control strategy against unbounded attacks in polymorphic microgrid

“…Sandoval-Segura et al (2023) suggests that the orthogonal projection technique is effective against class-wise attacks. Diffusion models have been proposed to purify unlearnable perturbations (Jiang et al, 2023;Dolatabadi et al, 2023). Qin et al (2023a) introduced a benchmark for availability attacks.…”

“…12, the larger the poisoning budgets, the better the attack performance. On the defense side against availability attacks, AT (Madry et al, 2018) and AdvCL (Kim et al, 2020)) applied adversarial training in supervised learning and contrastive learning respectively; ISS (Liu et al, 2023b) and UEraser (Qin et al, 2023b) leveraged designed data augmentations to eliminate supervised unlearnability; AVATAR (Dolatabadi et al, 2023) employed a diffusion model to purify poisoned data. In Table 13, we evaluate our attacks through these defense methods as well as SimCLR with Cutout (DeVries & Taylor, 2017), Random noise, and Gaussian Blur.…”