论文标题
单像素快捷方式：关于深神经网络的学习偏好
One-Pixel Shortcut: on the Learning Preference of Deep Neural Networks
论文作者
论文摘要
未获得的示例（ULE）旨在保护数据免受培训DNN的未经授权用法。现有工作将$ \ ell_ \ infty $结合的扰动添加到原始样本中，以使训练有素的模型概括较差。但是，这种扰动很容易通过对抗性培训和数据增强来消除。在本文中，我们通过在每个图像中仅扰动一个像素来从新颖的角度解决这个问题。有趣的是，如此小的修改可以有效地将模型的精度降低到几乎未经训练的对应物。此外，我们生产的\ emph {One像素快捷方式（OPS）}无法通过对抗性训练和强大的增强来消除。为了生成操作，我们在相同位置的类图像上扰动了相同的目标值，该目标值大部分可能与所有原始图像偏离。由于该一代仅基于图像，因此与使用DNN发电机的先前方法相比，OPS所需的计算成本要少得多。基于OPS，我们引入了一个名为CIFAR-10-S的不可学习的数据集，该数据集与人类与CIFAR-10没有区别，但诱导训练的模型的精度极低。即使在对抗训练下，在CIFAR-10-S上接受培训的RESNET-18的精度仅为10.61％，而现有的误差最小化方法为83.02％。
Unlearnable examples (ULEs) aim to protect data from unauthorized usage for training DNNs. Existing work adds $\ell_\infty$-bounded perturbations to the original sample so that the trained model generalizes poorly. Such perturbations, however, are easy to eliminate by adversarial training and data augmentations. In this paper, we resolve this problem from a novel perspective by perturbing only one pixel in each image. Interestingly, such a small modification could effectively degrade model accuracy to almost an untrained counterpart. Moreover, our produced \emph{One-Pixel Shortcut (OPS)} could not be erased by adversarial training and strong augmentations. To generate OPS, we perturb in-class images at the same position to the same target value that could mostly and stably deviate from all the original images. Since such generation is only based on images, OPS needs significantly less computation cost than the previous methods using DNN generators. Based on OPS, we introduce an unlearnable dataset called CIFAR-10-S, which is indistinguishable from CIFAR-10 by humans but induces the trained model to extremely low accuracy. Even under adversarial training, a ResNet-18 trained on CIFAR-10-S has only 10.61% accuracy, compared to 83.02% by the existing error-minimizing method.
