pith. sign in

arxiv: 2606.26719 · v1 · pith:VIQFS7LOnew · submitted 2026-06-25 · 💻 cs.CV

Full spectrum Unlearnable Examples via Spectral Equalization

Jiale Cai , Gezheng Xu , Zhihao Li , Ruiyi Fang , Ruizhi Pu , Di Wu , Qicheng Lao , Charles Ling
show 1 more author
Boyu Wang
This is my paper

Pith reviewed 2026-06-26 05:34 UTC · model grok-4.3

classification 💻 cs.CV
keywords unlearnable examplesspectral equalizationfrequency maskingdata protectionadversarial perturbationsmachine learning securityimage classification
0
0 comments X

The pith

Unlearnable examples can be made effective across the full frequency spectrum by equalizing band contributions during generation.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Existing unlearnable examples lose their protective power once low-pass filtering removes high frequencies, because the added perturbations concentrate in those high bands. The paper establishes that reliable protection instead requires spectrum-agnostic perturbations that keep models from extracting useful representations no matter which frequency range remains. FUSE reaches this by training a generator under random removal of contiguous frequency bands, forcing every surviving band to carry an unlearnable signal, while an additional consistency term ties high- and low-frequency components together. This produces data that stays protected under varied filtering conditions, across datasets and architectures, yet the changes remain small enough to preserve image appearance.

Core claim

The paper claims that unlearnable examples must remain effective after low-pass filtering to be trustworthy. FUSE achieves spectrum-agnostic perturbations by equalizing contributions from different frequency bands and enforcing cross-band consistency. It implements this through Random Spectral Masking, which randomly removes a contiguous frequency band during generator training so the remaining bands must still induce unlearnability, and Cross-Band Guidance, which enforces mutual consistency between high- and low-frequency components to strengthen low-frequency unlearnability while regulating high-frequency changes to keep images semantically faithful.

What carries the argument

Random Spectral Masking combined with Cross-Band Guidance, which together equalize the unlearnable signal across frequency bands.

If this is right

  • FUSE perturbations continue to block learning even after low-pass filtering removes high frequencies.
  • Protection holds across multiple datasets and model architectures without per-dataset retuning.
  • Images retain visual semantics and remain imperceptible to human observers despite the added signal.
  • Unlearnability is enforced simultaneously in both high- and low-frequency regimes.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same band-equalization logic could be applied to other poisoning or backdoor methods to make them robust against common preprocessing filters.
  • Frequency content may explain why some protection techniques transfer poorly between model families, suggesting a diagnostic role for spectral analysis.
  • Testing the approach on sequential data such as video frames or audio could show whether cross-band consistency generalizes beyond static images.

Load-bearing premise

That randomly masking frequency bands during generator training combined with cross-band consistency enforcement will produce perturbations that remain unlearnable in low-frequency regimes while keeping perturbations imperceptible and semantically faithful, without requiring dataset-specific tuning.

What would settle it

Train a standard classifier on low-pass filtered versions of FUSE-protected images and check whether test accuracy stays near random-guess levels or recovers to the level achieved on clean data.

Figures

Figures reproduced from arXiv: 2606.26719 by Boyu Wang, Charles Ling, Di Wu, Gezheng Xu, Jiale Cai, Qicheng Lao, Ruiyi Fang, Ruizhi Pu, Zhihao Li.

Figure 1
Figure 1. Figure 1: t-SNE visualization of the last-layer features, where classifiers are trained on the perturbed CIFAR-10 dataset and evaluated on the clean test set. Visualizations are shown for different UE methods under the unfiltered setting (top) and when a low-pass filter is applied to the perturbed images before training (bottom). While existing approaches (e.g., LSP (Yu et al., 2022), TUE (Ren et al., 2022), GUE (Li… view at source ↗
Figure 2
Figure 2. Figure 2: Overview of the proposed Full-spectrum Unlearnable Examples via Spectral Equalization (FUSE) framework. FUSE consists of two complementary components: (i) Random Spectral Masking (RSM), which applies randomized band suppression in the Fourier domain to prevent perturbations from collapsing into specific frequencies, and (ii) Cross-Band Guidance (CBG), which enforces mutual consistency between low- and high… view at source ↗
Figure 3
Figure 3. Figure 3: Test accuracy (%) ↓ of unlearnable example methods under low-pass filtering with varying cutoff frequencies on CIFAR￾10 (a) and CIFAR-100 (b), using ResNet-18 as the backbone. Example (GUE) (Liu et al., 2024a), Provably Unlearnable Examples (PUE) (Wang et al., 2024a). Implementation Details. Our model is developed with the PyTorch framework and trained on a single NVIDIA L40S GPU. We employ the Adam optimi… view at source ↗
Figure 4
Figure 4. Figure 4: Effect of the structural consistency weight λ on test accuracy under full-spectrum and low-pass settings [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Test accuracy (%) ↓ of unlearnable example methods under low-pass filtering with varying cutoff frequencies on SVHN (a) and ImageNet∗ (b), using ResNet-18 as the backbone [PITH_FULL_IMAGE:figures/full_fig_p016_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Visual examples of FUSE-generated unlearnable images under different perturbation strengths. D.3. Cross-Dataset Transferability of UEs We further evaluate cross-dataset unlearnability by generating perturbations on one dataset (CIFAR-10, CIFAR-100, or SVHN) and applying them to other datasets. Results are reported for both the unfiltered setting ( [PITH_FULL_IMAGE:figures/full_fig_p017_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Confusion matrices on CIFAR-10 under partial protection settings. In (a), only the bird class is perturbed; in (b), multiple classes are perturbed while the remaining classes stay clean. Protected classes become effectively unlearnable and are mostly misclassified into other classes, whereas unprotected classes largely preserve their classification accuracy [PITH_FULL_IMAGE:figures/full_fig_p020_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: t-SNE visualization under JPEG compression (Q=70) with and without low-pass filtering [PITH_FULL_IMAGE:figures/full_fig_p021_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Test accuracy curves of ResNet-18 trained on perturbed CIFAR-10 under low-pass filtered UEs with different unlearnable example methods. 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Clean CIFAR-10 CIFAR-100 SVHN Cutoff 0.1 [PITH_FULL_IMAGE:figures/full_fig_p025_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Visualization of perturbed images under different low-pass cutoffs (0.1–1.0) on CIFAR-10, CIFAR-100, and SVHN. Despite progressively removing high-frequency components, images retain recognizable semantic structures, which explains why models can still extract useful information from low-pass filtered data. Our perturbations remain visually similar to clean samples across all cutoffs, indicating strong im… view at source ↗
read the original abstract

Unlearnable examples (UEs) protect training data by injecting imperceptible perturbations so that models fail to extract exploitable representations. In this paper, we reveal that existing UEs exhibit a critical failure once low-pass filtering is applied, indicating that the effective perturbation signals for unlearnability concentrate predominantly in high frequencies. Hence, we argue that reliable UEs should remain effective across the full spectrum. To this end, we propose Full-spectrum Unlearnable examples via Spectral Equalization (FUSE), which aims to generate spectrum-agnostic perturbations by equalizing the contributions from different bands and enforcing cross-band consistency. Specifically, FUSE adopts a Random Spectral Masking (RSM) strategy during generator training, which randomly removes a contiguous frequency band, forcing the remaining bands to maintain unlearnability. In addition, FUSE further integrates Cross-Band Guidance (CBG), which enforces mutual consistency between high- and low-frequency components, thereby further enhancing low-frequency unlearnability and regulating high-frequency perturbations to preserve the semantic fidelity of images. Extensive experiments across multiple datasets, architectures, and spectral filtering demonstrate the strong protection achieved by FUSE.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper claims that existing unlearnable examples (UEs) fail under low-pass filtering because their effective perturbation signals concentrate in high frequencies. It proposes Full-spectrum Unlearnable examples via Spectral Equalization (FUSE), which generates spectrum-agnostic perturbations by equalizing contributions across frequency bands. This is achieved via Random Spectral Masking (RSM), which randomly removes contiguous frequency bands during generator training to force unlearnability in the remaining bands, combined with Cross-Band Guidance (CBG) to enforce mutual consistency between high- and low-frequency components. The method is claimed to deliver strong protection across multiple datasets, architectures, and spectral filtering conditions.

Significance. If the central claims hold, FUSE would address a key robustness gap in unlearnable examples by making perturbations effective across the full frequency spectrum rather than relying on high-frequency signals. This could strengthen data-protection techniques in machine learning pipelines where inputs may undergo spectral preprocessing or filtering. The combination of random band masking and cross-band consistency provides a concrete mechanism for spectral equalization that is worth further exploration in the UE literature.

major comments (2)
  1. [Abstract / RSM strategy] Abstract / RSM description: randomly removing a contiguous frequency band during generator training does not explicitly ensure that unlearnability transfers to low-frequency regimes. Because masking is random and contiguous, high-frequency bands remain unmasked in many training iterations; nothing in the objective is described that penalizes a solution in which unlearnability remains carried primarily by high frequencies while the low-frequency component is only made consistent (via CBG) rather than independently effective. When a low-pass filter is applied at inference, protection therefore rests on an unverified transfer of the unlearnability signal.
  2. [Abstract / Cross-Band Guidance (CBG)] Abstract / CBG description: while CBG is said to enhance low-frequency unlearnability by enforcing mutual consistency, the description provides no explicit loss term or regularization that directly measures or enforces unlearnability within the low-frequency band alone. It is therefore unclear whether consistency alone suffices to make the low-frequency perturbation independently protective rather than merely correlated with the high-frequency component.
minor comments (2)
  1. [Abstract] The abstract states that 'extensive experiments' demonstrate strong protection but supplies no quantitative metrics, error bars, ablation results, or baseline comparisons; adding one or two key numbers (e.g., accuracy drops under low-pass filtering) would improve the summary.
  2. [Method] Notation for frequency bands and masking (e.g., how 'contiguous band' is formally defined and how the mask is sampled) should be introduced with an equation or pseudocode in the method section for reproducibility.

Simulated Author's Rebuttal

2 responses · 0 unresolved

Thank you for the opportunity to respond to the referee's comments. We appreciate the careful reading and the identification of areas where our description of the method could be strengthened. We provide point-by-point responses below.

read point-by-point responses

  1. Referee: [Abstract / RSM strategy] Abstract / RSM description: randomly removing a contiguous frequency band during generator training does not explicitly ensure that unlearnability transfers to low-frequency regimes. Because masking is random and contiguous, high-frequency bands remain unmasked in many training iterations; nothing in the objective is described that penalizes a solution in which unlearnability remains carried primarily by high frequencies while the low-frequency component is only made consistent (via CBG) rather than independently effective. When a low-pass filter is applied at inference, protection therefore rests on an unverified transfer of the unlearnability signal.

    Authors: We thank the referee for this observation. The RSM strategy applies the unlearnability objective directly to the unmasked frequency bands in each training iteration. Because the contiguous mask is sampled randomly across iterations, every band (including low-frequency ones) is periodically the sole available band and must therefore independently support unlearnability; otherwise the generator would fail on those iterations. The low-pass filtering results in the manuscript provide empirical evidence that this transfer occurs. We nevertheless agree that the abstract is too terse on this point and will revise both the abstract and the method section to state explicitly that the unlearnability loss is computed on the remaining bands after masking. revision: yes

  2. Referee: [Abstract / Cross-Band Guidance (CBG)] Abstract / CBG description: while CBG is said to enhance low-frequency unlearnability by enforcing mutual consistency, the description provides no explicit loss term or regularization that directly measures or enforces unlearnability within the low-frequency band alone. It is therefore unclear whether consistency alone suffices to make the low-frequency perturbation independently protective rather than merely correlated with the high-frequency component.

    Authors: We acknowledge that the abstract description of CBG focuses on consistency rather than an isolated low-frequency unlearnability term. In the full method, CBG operates in conjunction with RSM: when high-frequency bands are masked, the unlearnability loss is applied to the low-frequency component alone, and CBG then aligns the high-frequency component to this already-effective low-frequency signal. We will revise the manuscript to make this interaction and the relevant loss terms explicit, and we will consider adding a short ablation that isolates low-frequency performance when high frequencies are removed at training time. revision: yes

Circularity Check

0 steps flagged

No circularity; new training procedure independent of target result

full rationale

The paper introduces FUSE via two explicit training components (Random Spectral Masking during generator training and Cross-Band Guidance) whose definitions and objectives are stated directly in procedural terms rather than derived from equations that reduce to the claimed low-frequency unlearnability. No self-definitional loop, fitted-input prediction, or load-bearing self-citation appears in the provided text; the central claim rests on the empirical behavior of the described optimization rather than any algebraic identity or prior-author uniqueness theorem. The derivation chain is therefore self-contained as a methodological contribution.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The approach rests on standard domain assumptions about frequency content in natural images and the feasibility of imperceptible perturbations; no free parameters or invented entities are explicitly introduced in the abstract.

axioms (1)
  • domain assumption Small, imperceptible perturbations can systematically prevent neural networks from extracting usable representations from images.
    This is the foundational premise of all unlearnable-example research invoked by the abstract.

pith-pipeline@v0.9.1-grok · 5751 in / 1251 out tokens · 32336 ms · 2026-06-26T05:34:16.413967+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

22 extracted references · 3 canonical work pages

  1. [1]

    Brown, T. B. Language models are few-shot learners.arXiv preprint arXiv:2005.14165,

    Pith/arXiv arXiv 2005

  2. [2]

    Experimental Evaluation of WLAN-based Object Detection Using CSI in Outdoor and Large-scale Indoor Environments,

    Chen, C., Zhang, J., Li, Y ., and Han, Z. One for all: A universal generator for concept unlearnability via multi- modal alignment. InInternational Conference on Ma- chine Learning, pp. 7700 – 7711, 2024a. Chen, Y ., Fang, F., Wang, B., and Zhang, L. An ef- ficient federated learning framework for iot intrusion detection. In2024 IEEE 100th Vehicular Techn...

    work page doi:10.1109/vtc2024-fall63153.2024.10757488 2024

  3. [3]

    Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L

    doi: 10.1109/JIOT.2025.3603885. Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In2009 IEEE conference on computer vision and pattern recognition, pp. 248–255. Ieee,

    work page doi:10.1109/jiot.2025.3603885 2025

  4. [4]

    and Taylor, G

    DeVries, T. and Taylor, G. W. Improved regularization of convolutional neural networks with cutout.arXiv preprint arXiv:1708.04552,

    Pith/arXiv arXiv

  5. [5]

    An image is worth 16x16 words: Transformers for image recognition at scale.arXiv preprint arXiv:2010.11929,

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al. An image is worth 16x16 words: Transformers for image recognition at scale.arXiv preprint arXiv:2010.11929,

    Pith/arXiv arXiv 2010

  6. [6]

    Eagle: Elevating geomet- ric reasoning through llm-empowered visual instruction tuning.arXiv preprint arXiv:2408.11397, 2024b

    Li, Z., Du, Y ., Liu, Y ., Zhang, Y ., Liu, Y ., Zhang, M., Cai, X., Ling, C., and Wang, B. Eagle: Elevating geomet- ric reasoning through llm-empowered visual instruction tuning.arXiv preprint arXiv:2408.11397, 2024b. Li, Z., Cai, J., Xu, G., Zheng, H., Li, Q., Zhou, F., Yang, S., Ling, C., and Wang, B. Versatile transferable unlearn- able example genera...

    arXiv

  7. [7]

    Multimodal unlearnable examples: Protecting data against multimodal contrastive learning.arXiv preprint arXiv:2407.16307, 2024b

    Liu, X., Jia, X., Xun, Y ., Liang, S., and Cao, X. Multimodal unlearnable examples: Protecting data against multimodal contrastive learning.arXiv preprint arXiv:2407.16307, 2024b. Madry, A. Towards deep learning models resistant to adver- sarial attacks. InInternational Conference on Learning Representations,

    arXiv

  8. [8]

    Y ., et al

    Netzer, Y ., Wang, T., Coates, A., Bissacco, A., Wu, B., Ng, A. Y ., et al. Reading digits in natural images with unsupervised feature learning. InNIPS workshop on deep learning and unsupervised feature learning, volume 2011, pp

    2011

  9. [9]

    J., Scimeca, L., Chun, S., Poli, M., Yun, S., et al

    Oh, S. J., Scimeca, L., Chun, S., Poli, M., Yun, S., et al. Which shortcut cues will dnns choose? a study from the parameter-space perspective. InInternational Conference on Learning Representations 2022 (ICLR 2022). nterna- tional Conference on Learning Representations,

    2022

  10. [10]

    Transferable unlearnable examples.arXiv preprint arXiv:2210.10114,

    11 FUSE: Full-spectrum Unlearnable Examples via Spectral Equalization Ren, J., Xu, H., Wan, Y ., Ma, X., Sun, L., and Tang, J. Transferable unlearnable examples.arXiv preprint arXiv:2210.10114,

    arXiv

  11. [11]

    Bernstein, Alexander C

    doi: 10.1007/s11263-015-0816-y. Sadasivan, V . S., Soltanolkotabi, M., and Feizi, S. Cuda: Convolution-based unlearnable datasets. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 3862–3871,

    work page doi:10.1007/s11263-015-0816-y

  12. [12]

    and Zisserman, A

    Simonyan, K. and Zisserman, A. Very deep convolu- tional networks for large-scale image recognition.arXiv preprint arXiv:1409.1556,

    Pith/arXiv arXiv

  13. [13]

    Provably unlearnable data examples.arXiv preprint arXiv:2405.03316, 2024a

    Wang, D., Xue, M., Li, B., Camtepe, S., and Zhu, L. Provably unlearnable data examples.arXiv preprint arXiv:2405.03316, 2024a. Wang, X., Li, M., Liu, W., Zhang, H., Hu, S., Zhang, Y ., Zhou, Z., and Jin, H. Unlearnable 3d point clouds: Class- wise transformation is all you need. InProceedings of the 38th Annual Conference on Neural Information Pro- cessin...

    arXiv

  14. [14]

    Revisiting source-free domain adaptation: a new perspec- tive via uncertainty control

    Xu, G., Guo, H., Yi, L., Ling, C., Wang, B., and Yi, G. Revisiting source-free domain adaptation: a new perspec- tive via uncertainty control. InInternational Conference on Learning Representations, volume 2025, pp. 92900– 92939, 2025a. Xu, G., Yi, L., Xu, P., Li, J., Pu, R., Shui, C., McLeod, A. I., Wang, B., and Ling, C. Unraveling the mysteries of labe...

    2025

  15. [15]

    I., and Wang, B

    Yi, L., Xu, G., Xu, P., Li, J., Pu, R., Ling, C., McLeod, A. I., and Wang, B. When source-free domain adapta- tion meets learning with noisy labels.arXiv preprint arXiv:2301.13381,

    arXiv

  16. [16]

    The Architecture of Perturbation Generator In the main paper, we devise a generator to produce transferable perturbations and craft unlearnable examples

    13 FUSE: Full-spectrum Unlearnable Examples via Spectral Equalization APPENDIX A. The Architecture of Perturbation Generator In the main paper, we devise a generator to produce transferable perturbations and craft unlearnable examples. We denote our perturbation generator as G, which employs a standard encoder-decoder architecture. This structure comprise...

    2016

  17. [17]

    To evaluate unlearnability, we employ the cross-entropy loss as the training objective in unauthorized supervised learning

    with an initial learning rate of 0.1, applied to ResNet-18, ResNet-50, VGG-11, DenseNet-121, and ViT. To evaluate unlearnability, we employ the cross-entropy loss as the training objective in unauthorized supervised learning. Our method is a class-wise UE method and we add perturbations to the entire training dataset, which is the common practice in UE li...

    2021

  18. [18]

    and GUE (Liu et al., 2024a) employ asample-wiseapproach, where each image is perturbed independently. We reproduce all baselines using their official implementations or configurations reported in the original papers, and tune the perturbation budget to align with our setting (ϵ= 8/255) for consistency. 14 FUSE: Full-spectrum Unlearnable Examples via Spect...

    2015

  19. [19]

    Across both conditions, FUSE generally achieves the lowest transfer accuracy, indicating the strongest unlearnable effect

    or randomly cropping the saved perturbations to remove redundant portions, thereby ensuring compatibility with the target dataset. Across both conditions, FUSE generally achieves the lowest transfer accuracy, indicating the strongest unlearnable effect. In particular, when perturbations are generated on CIFAR-100 and transferred to CIFAR-10, FUSE reduces ...

    1987

  20. [20]

    When low-pass filtering is applied after JPEG compression, FUSE’s performance remains close to random-guess level

    The results show that under full-spectrum conditions, FUSE’s perturbations result in a low accuracy, lower than other methods. When low-pass filtering is applied after JPEG compression, FUSE’s performance remains close to random-guess level. These results further support our claim that FUSE is more robust to JPEG compression than other methods. D.6. Ablat...

    arXiv

  21. [21]

    Notably, the observation that prior UE methods also remain effective under high-pass filtering is consistent with our analysis in the paper

    and high-frequency removal and supporting our spectrum-agnostic claim. Notably, the observation that prior UE methods also remain effective under high-pass filtering is consistent with our analysis in the paper. In contrast, their failure under low-pass filtering (as shown in Table 1, Figure 3a and Figure 3b) arises because the high-frequency components a...

    2018

  22. [22]

    models trained on the perturbed CIFAR-10 dataset. As shown in Figure 9, most existing UE methods (e.g., EMN (Huang et al., 2021), GUE (Liu et al., 2024a), and PUE (Wang et al., 2024a)) still retain non-trivial accuracy after filtering, and some even exhibit early accuracy peaks, which may lead to semantic leakage. In contrast, our proposed FUSE consistent...

    arXiv 2021