Armor: Shielding Unlearnable Examples Against Data Augmentation
- Published
- Record updated
Summary
Researchers show that data augmentation, a standard pre-processing step, can undo the protection of unlearnable examples, raising the accuracy of a model trained on protected data from 21.3% to 66.1%. They propose Armor, a defense framework that uses a non-local module-assisted surrogate model, a surrogate augmentation selection strategy and dynamic step size adjustment to preserve unlearnability under augmentation. Across 4 datasets and 5 augmentation methods, Armor reduces test accuracy on augmented protected samples by as much as 60% more than six baseline defenses.
Mitigation
Armor is the proposed defense: it adds defensive noise to samples, using a surrogate model and augmentation selection to keep protected data unlearnable under data augmentation. The authors state they will open-source their code upon publication.