Pith. sign in

REVIEW 2 major objections 6 minor 61 references

Reversible Unlearnable Examples: Towards the Copyright Protection in Deep Learning Era

T0 review · 2 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A reversible class-wise perturbation makes images unlearnable to unauthorized models while keeping watermarks extractable on both perturbed and recovered images, with near-random accuracy and sub-0.35% bit error rates on three datasets.

desk verdict Strong empirical results under a mislabeled theory: the perturbation really works, but the mutual-information story in Section III-C does not survive contact with the paper's own equations. read the letter →

arxiv 2608.06211 v1 pith:INWA3V2S submitted 2026-08-06 cs.CR cs.CV

Binze Wang , Jinyu Tian , Xingrun Wang , Xiaochen Yuan , Jianqing Li This is my paper · ORCID
classification cs.CRcs.CV
keywords copyrightprotectionunlearnableexampleswatermarkingmutualinformationminimizationavailabilityattackdatapoisoningreversibleperturbationdeeplearningsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that image copyright protection in the deep learning era can be comprehensive: one framework can stop unauthorized models from learning anything useful from published images and still let the owner prove ownership later, even if an attacker strips off the protective perturbation. The authors argue that simply stacking an availability attack on top of watermarking fails because the perturbation corrupts watermark extraction, and they propose a coordinated design instead. That design combines a class-wise unlearnable perturbation with a dual watermark extractor, so the same watermark is readable from both perturbed and recovered images. On ImageNet-100, CIFAR10, and Pets, protected data pushes unauthorized models to near-random accuracy while authorized users, who subtract the class-wise perturbation, recover almost the original model performance. A sympathetic reader would take away that dataset owners can make their data unusable for unauthorized training without losing the ability to verify ownership.

What carries the argument

The load-bearing mechanism is the mutual-information-minimization perturbation. The paper defines the goal as reducing $I(\hat{X};\hat{Y})$, the mutual information between protected inputs and model outputs; for a deterministic network the conditional entropy vanishes, so the objective collapses to minimizing the output entropy $H(\hat{Y})$, i.e., minimizing the expected softmax entropy $\hat{y}\log\hat{y}$ over protected images. This is complemented by a class-wise universal perturbation: per-image perturbations are averaged within each class to yield $C$ noise vectors that can be transmitted to authorized users and subtracted to recover watermarked images. The second pillar is the dual watermark extractor, a second decoder $D_d$ trained on perturbed watermarked images so that the framework can verify ownership in both the perturbed and the recovered state. A differentiable JPEG approximation is included in both watermark and perturbation training so the protection holds up against compression.

What would settle it

Train a self-supervised representation model on the protected images (e.g., a contrastive learner) and then fit a linear classifier on the learned representations using clean labels; if the linear probe reaches accuracy close to the clean baseline (about 72% on ImageNet-100), the perturbed data remain learnable for label-agnostic training, which would contradict the framework's semantic-information-protection claim.

Watch

Extended reading notes

Core claim

The central claim is that availability attacks and watermarking do not have to conflict, and that a perturbation that minimizes the mutual information between a model's input and output, implemented by minimizing the entropy of the victim model's softmax outputs over protected images, generalizes across architectures and leaves enough signal for a second watermark decoder. The dual-extraction design trains one decoder for perturbation-free watermarked images and a second decoder for the same images with the perturbation added; ownership is established if either decoder's extracted message matches the embedded watermark. Because the perturbation is shared across all images in a class, authorized users can remove it by a single subtraction, restoring normal learnability. The reported results on ImageNet-100 show an average unauthorized accuracy of 6.76% against 72.78% for clean training, with watermark bit error rates of 0.16% with perturbation and 0.22% without, and similar patterns on CIFAR10 and Pets.

Load-bearing premise

The attack's theory rests on the step where, for a deterministic network, the conditional entropy $H(\hat{Y}|\hat{X})$ is set to zero so that minimizing output entropy $H(\hat{Y})$ is treated as minimizing input–output mutual information; if the network is not effectively deterministic, or if the softmax entropy is not a faithful proxy for dependence between input and output, that theoretical grounding weakens.

Editorial extensions

If this is right

  • Unauthorized models trained on the protected data should stay near random accuracy even when the model architecture differs from the one that generated the perturbation, because the MI-based objective is tied to shared feature extraction rather than a single decision boundary.
  • Dataset owners can publish protected images and still verify ownership both on the published (perturbed) images and on any clean images that an attacker may redistribute after removing the perturbation.
  • Authorized access becomes practical: subscription or key distribution only needs to convey the class-wise perturbations and class labels, after which users subtract one vector per class and train normally.
  • The protection remains usable under common cloud-operating conditions such as JPEG compression, because differentiable JPEG is integrated into both watermark and perturbation training.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension not pursued in the paper: since the implemented loss is output entropy, an ablation that directly minimizes a nonparametric estimate of mutual information (rather than entropy) would reveal whether the MI framing adds anything beyond naive output-entropy minimization.
  • The paper assumes the unauthorized user will train a classifier with labels; a label-agnostic attack (e.g., self-supervised pretraining followed by linear probing on clean labels) might bypass the class-wise perturbation, so the framework's semantic-information-protection guarantee could be scoped to supervised training.
  • The class-wise perturbation is noise that can, in principle, be estimated from the protected dataset alone (for instance, by clustering protected images and averaging within inferred classes); the paper does not analyze this attack, and testing whether such clustering can recover the perturbations would determine the real-world security margin.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper proposes a copyright protection framework that combines reversible unlearnable perturbations with digital watermarking. The pipeline trains a watermark encoder/decoder, generates class-wise perturbations by alternating between training a victim model and updating perturbations via a first-order step on Eq. (6), and trains a dual decoder so that watermarks are extractable both from perturbed and from recovered images. Experiments on ImageNet-100, CIFAR10, and Pets report near-random accuracy for multiple architectures on protected data (e.g., 6.76% average vs. 72.78% clean on ImageNet-100) while maintaining watermark BER below 0.35%, along with robustness studies against JPEG compression, data augmentation, adversarial training, and commercial training platforms.

Significance. If the framework works as claimed, it would be a practically relevant contribution to dataset copyright protection. The empirical evaluation is extensive and honestly reports failure modes (e.g., JPEG compression can partially break the availability attack). The dual-extractor design is a clean, well-ablated solution to the interference between unlearnable perturbations and watermark extraction. The paper also provides code. However, the central theoretical claim that the perturbation minimizes mutual information is not supported by the derivation, and this weakens the claimed novelty; the contribution as implemented is an entropy-minimization availability attack combined with dual watermarking.

major comments (2)
  1. [III-C, Eqs. (4)-(6)] The derivation that replaces I(X;Y) with H(Y) and then with the average softmax entropy is internally inconsistent. For a deterministic network, H(Y|X)=0, so I(X;Y)=H(Y), where H(Y) is the entropy of the marginal distribution of the model output over the data distribution. Equation (6), however, computes E_{x_hat}[-Σ_j p_j(x_hat) log p_j(x_hat)], which is exactly the conditional entropy H(Y|X) if Y is a label sampled from the softmax probabilities. These two objects are not equal in general, and the latter does not estimate the former. Therefore the optimization implemented in Algorithm 1 minimizes per-sample conditional entropy, not mutual information. The abstract and the contribution bullet that describe the method as minimizing mutual information of input and output are unsupported as written. Please either provide a correct estimator of marginal output entropy and optimize it, or reframe the paper honestly as an entropy-minimization approach and adjust the novelty claims accordingly.
  2. [III-C, MI validation paragraph] The paragraph after Algorithm 1 reports that mutual information decreased by 97% for ResNet18, 82% for VGG19, 89% for MobileNet, 83% for GoogleNet, and 97% for Dense121, but the manuscript does not describe the estimator used to compute these numbers. Given the issue in Eqs. (5)-(6), these figures are not interpretable as mutual information unless a separate, valid estimator is used and reported. Please specify the estimator, the random variables, and the evaluation protocol, or remove the quantitative MI claim.
minor comments (6)
  1. [III-C, Eq. (6)] Equation (6) uses the shorthand -f(...) log f(...) without an explicit sum over classes; write it as -Σ_j f_j(...) log f_j(...) to avoid ambiguity.
  2. [IV-A, Table II] In Table II, the protected Pets accuracy is exactly 2.70% for all five architectures, which equals the random-guess accuracy for this dataset; please explain this uniformity (e.g., all models collapse to one class) or correct the entries.
  3. [IV-B] Section IV-B reports BER values without stating the total number of bits evaluated; specify the message length and the number of test images so the reader can assess statistical uncertainty.
  4. [IV-F, Table VII] Table VII: the rows Ours+JPEG 85 and Ours+JPEG N/A are not explained in the text; clarify what differs from the Ours+JPEG 75 row.
  5. [Algorithm 1] Algorithm 1 uses a stop criterion e that is never given a value in the experiments; report the chosen e for each dataset.
  6. [III-C, reference [50]] The citation of equation (9) in reference [50] is not verifiable from the manuscript; please provide the exact equation number or a direct quotation.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity; the MI-entropy substitution in Eq. (6) is a correctness flaw, not a circular reduction.

full rationale

The paper's central claims are evaluated against held-out clean test data and external baselines (Emax, Emin, Tattack, GEAA, Adv-watermark), so no fitted parameter is reused as a prediction. The unlearnable perturbations are optimized on the protected training set and then assessed by training five architectures on that set and testing on clean test data; the watermark BER is measured with a separately trained dual decoder and a standard decoder, with the watermark test set described as a validation set (Section IV-D). The class-wise perturbation is an average of per-image perturbations (Eq. 8), and reversibility is a deterministic subtraction, not a fitted quantity. The only potentially load-bearing citation to a coauthored work is [59], used for the differentiable JPEG implementation in Eq. (6); this is a standard preprocessing component and does not supply the watermark or unlearnability results. The derivation from Eq. (4) to Eq. (6) is formally incorrect because H(Y|X)=0 for deterministic networks makes I(X;Y)=H(Y), yet Eq. (6) evaluates the per-sample softmax entropy, which is E[H(Y|X=x)], not H(Y). That invalidates the paper's claim that the objective minimizes mutual information, but it is not circular: the implemented objective is not defined in terms of the claimed outcome, and the empirical comparison remains self-contained. No self-citation chain or uniqueness theorem is invoked to force the method, so the circularity score is low.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The framework depends on standard hyperparameters (epsilon, victim model, JPEG quality factor) and several domain assumptions; no new physical entities are introduced. The most consequential assumption is the deterministic-network reduction of MI to H(Y), which is mathematically invalid as stated.

free parameters (5)
  • L_inf perturbation budget epsilon = 4 (default); 8 and 16 also tested
    Chosen by hand in Eq. (4) and Algorithm 1; controls the strength of unlearnable noise and visual quality, and is central to the availability attack.
  • Victim model f used for perturbation generation = ResNet18
    Perturbations are optimized against this surrogate model; transferability to other architectures depends on this choice.
  • Stop criterion e for victim accuracy = not specified numerically
    Algorithm 1 terminates when victim accuracy on protected data falls below e; this threshold controls perturbation optimization effort.
  • JPEG quality factor in differentiable JPEG = 75
    Used in both watermark and perturbation training to match deployment; directly affects reported robustness results.
  • Watermark message length = 64 bits for ImageNet-100 and Pets; 32 bits for CIFAR10
    Chosen by hand; capacity affects BER and image quality, and differs per dataset.
assumptions (6)
  • standard math Mutual information identity I(X;Y)=H(Y)-H(Y|X)
    Used in Eq. (3) as the starting point for the perturbation objective.
  • domain assumption Neural network output is deterministic given input, so H(Y|X)=0
    Invoked in Section III-C to reduce MI to H(Y); this assumption enables the flawed equivalence and is the load-bearing premise.
  • domain assumption Different models extract shared semantic features from the same images
    Motivates transferability of perturbations in Section III-C and Fig. 4, citing [45]-[49]; if false, cross-architecture unlearnability would not follow.
  • domain assumption Differentiable JPEG is a faithful gradient proxy for standard JPEG
    Used in Eq. (6) and watermark training via [39]; the robustness results depend on this proxy.
  • domain assumption Class-wise perturbations transmitted over a secure channel can be subtracted by authorized users without other degradation
    Reversibility in Section III-E assumes authorized users receive the perturbations intact and know the class labels.
  • ad hoc to paper Watermark verification can accept if either of two decoders matches
    Ownership rule in Section III-A; no explicit BER threshold or false-positive analysis is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Reversible Unlearnable Examples: Towards the Copyright Protection in Deep Learning Era." pith.science (2026). https://pith.science/paper/INWA3V2S

@misc{pith2026260806211,
  author       = {Pith},
  title        = {Pith review of: Reversible Unlearnable Examples: Towards the Copyright Protection in Deep Learning Era},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/INWA3V2S}},
  note         = {Machine review of arXiv:2608.06211}
}
read the original abstract

Significant advancements in deep learning have been made possible by the utilization of large datasets, underscoring the critical importance of copyright protection. Adding meticulously designed perturbations to examples, making them unlearnable has become a crucial approach for safeguarding data copyright. Existing methods for creating unlearnable examples overlook the risk of data leakage, which can threaten data ownership. Thus, copyright protection in deep learning faces two main threats: illegal model training and malicious data leakage. We investigate that these two threats cannot be solved by straightforwardly combining existing availability attacks and watermarking techniques as their negative interaction effects. Therefore, in this paper, we propose a novel copyright protection mechanism for the aforementioned security concerns. Considering that the prevention of unauthorized model training requires powerful generalizability of unlearnable perturbations, we generate perturbations to induce the model to learn uncorrelated features of input images. It works by minimizing the mutual information of the input and output of the model. On the other hand, to eliminate the side impact of unlearnable perturbations on the watermark extraction, we design a dual extraction strategy by using two distinct watermark extractors. Extensive experiments on the image datasets {ImageNet, CIFAR10, and Pets} show that our proposed method could provide comprehensive copyright protection to images. The code is available at {https://github.com/Yeah21/ReversibleUnlearnableExamples}.

Figures

Figures reproduced from arXiv: 2608.06211 by the authors.

Figure 1
Figure 1. Impact of unlearnable perturbations on watermark extraction perfor [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Application scenario involving data owner, authorized user, unauthorized user, and attacker. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. The pipeline of the proposed copyright protection framework. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: The CAM visualization of the clean model and the poisoned model. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Clean images (Top) VS. Images with the watermark and perturbation [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Performance comparison (BER↓ and PSNR↑) of two dual watermark extraction methods. A and B mean dual and dualf method respectively. BER w/o and BER w/ are the watermark robustness of images without and with unlearnable perturbation. Line-style stands for BER value refer…
Figure 7
Figure 7. Figure 7: Visualization of unlearnable images with different [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Training accuracy (↓) of networks on protected CIFAR10 dataset using various availability attack methods. Curves show mean accuracy over 6 experimental repetitions, with shading indicating standard deviation. TABLE VI GENERALIZABILITY COMPARISON OF UNLEARNABLE PERTURBA…
Figure 9
Figure 9. Figure 9: Visualization of images with and without perturbation generated by different methods. [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

61 extracted references · 57 canonical work pages

  1. [1]

    Prest-net: Multi-domain probability estimation network for robust image forgery detection,

    J. Chen, X. Liao, Z. Qian, and Z. Qin, “Prest-net: Multi-domain probability estimation network for robust image forgery detection,”ACM Trans. Multimedia Comput. Commun. Appl., vol. 21, no. 3, Mar. 2025

    work page 2025

  2. [2]

    A recent survey on image watermarking using scaling factor techniques for copyright protection,

    F. Ernawan and D. Ariatmanto, “A recent survey on image watermarking using scaling factor techniques for copyright protection,”Multimedia Tools and Applications, pp. 1–41, 2023

    work page 2023

  3. [3]

    Client-side embedding of screen-shooting resilient image watermarking,

    X. Xiao, Y . Zhang, Z. Hua, Z. Xia, and J. Weng, “Client-side embedding of screen-shooting resilient image watermarking,”IEEE Transactions on Information Forensics and Security, vol. 19, pp. 5357–5372, 2024

    work page 2024

  4. [4]

    Robust reversible watermarking in encrypted image with secure multi-party based on lightweight cryptography,

    L. Xiong, X. Han, C.-N. Yang, and Y .-Q. Shi, “Robust reversible watermarking in encrypted image with secure multi-party based on lightweight cryptography,”IEEE Transactions on Circuits and Systems for Video Technology, vol. 32, no. 1, pp. 75–91, 2022

    work page 2022

  5. [5]

    Truncated robust natural watermarking with hungarian optimization,

    J. You, Y .-G. Wang, G. Zhu, and S. Kwong, “Truncated robust natural watermarking with hungarian optimization,”IEEE Transactions on Cir- cuits and Systems for Video Technology, vol. 32, no. 2, pp. 483–495, 2022

    work page 2022

  6. [6]

    Independent embedding domain based two- stage robust reversible watermarking,

    X. Wang, X. Li, and Q. Pei, “Independent embedding domain based two- stage robust reversible watermarking,”IEEE Transactions on Circuits and Systems for Video Technology, vol. 30, no. 8, pp. 2406–2417, 2020

    work page 2020

  7. [7]

    A highly robust reversible watermarking scheme using embedding optimization and rounded error compensation,

    Y . Tang, S. Wang, C. Wang, S. Xiang, and Y .-M. Cheung, “A highly robust reversible watermarking scheme using embedding optimization and rounded error compensation,”IEEE Transactions on Circuits and Systems for Video Technology, vol. 33, no. 4, pp. 1593–1609, 2023

    work page 2023

  8. [8]

    Mbrs: Enhancing robustness of dnn- based watermarking by mini-batch of real and simulated jpeg compres- sion,

    Z. Jia, H. Fang, and W. Zhang, “Mbrs: Enhancing robustness of dnn- based watermarking by mini-batch of real and simulated jpeg compres- sion,” inProceedings of the 29th ACM International Conference on Multimedia, 2021, pp. 41–49

    work page 2021

Show all 61 references
  1. [9]

    Hidden: Hiding data with deep networks,

    J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei, “Hidden: Hiding data with deep networks,” inProceedings of the European Conference on Computer Vision, 2018, pp. 657–672

    2018

  2. [10]

    Copy, right? a testing framework for copyright protection of deep learning models,

    J. Chen, J. Wang, T. Peng, Y . Sun, P. Cheng, S. Ji, X. Ma, B. Li, and D. Song, “Copy, right? a testing framework for copyright protection of deep learning models,” in2022 IEEE Symposium on Security and Privacy (SP), 2022, pp. 824–841

    2022

  3. [11]

    Modellock: Locking your model with a spell,

    Y . Gao, Y . Sun, X. Ma, Z. Wu, and Y .-G. Jiang, “Modellock: Locking your model with a spell,” inProceedings of the 32nd ACM International Conference on Multimedia, 2024, p. 11156–11165

    2024

  4. [12]

    The secretive company that might end privacy as we know it,

    K. Hill, “The secretive company that might end privacy as we know it,” inEthics of Data and Analytics. Auerbach Publications, 2022, pp. 170–177

    2022

  5. [13]

    Adversarial privacy-preserving filter,

    J. Zhang, J. Sang, X. Zhao, X. Huang, Y . Sun, and Y . Hu, “Adversarial privacy-preserving filter,” inProceedings of the 28th ACM International Conference on Multimedia, 2020, pp. 1423–1431

    2020

  6. [14]

    Adversarial examples make strong poisons,

    L. Fowl, M. Goldblum, P.-y. Chiang, J. Geiping, W. Czaja, and T. Gold- stein, “Adversarial examples make strong poisons,” inProceedings of Advances in Neural Information Processing Systems, 2021, pp. 30 339– 30 351

    2021

  7. [15]

    Autoregressive perturbations for data poisoning,

    P. Sandoval-Segura, V . Singla, J. Geiping, M. Goldblum, T. Goldstein, and D. Jacobs, “Autoregressive perturbations for data poisoning,” in Proceedings of Advances in Neural Information Processing Systems, 2022, pp. 27 374–27 386

    2022

  8. [16]

    Availability attacks create shortcuts,

    D. Yu, H. Zhang, W. Chen, J. Yin, and T.-Y . Liu, “Availability attacks create shortcuts,” inProceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2022, pp. 2367–2376

    2022

  9. [17]

    Learnability lock: Authorized learnability con- trol through adversarial invertible transformations,

    W. Peng and J. Chen, “Learnability lock: Authorized learnability con- trol through adversarial invertible transformations,” inProceedings of International Conference on Learning Representations, 2022, pp. 1–12

    2022

  10. [18]

    Preventing unauthorized use of proprietary data: Poisoning for secure dataset release,

    L. Fowl, P.-y. Chiang, M. Goldblum, J. Geiping, A. Bansal, W. Czaja, and T. Goldstein, “Preventing unauthorized use of proprietary data: Poisoning for secure dataset release,” inProceedings of International Conference on Learning Representations Workshop, 2021, pp. 1–10

    2021

  11. [19]

    Robust unlearnable examples: Protecting data against adversarial learning,

    S. Fu, F. He, Y . Liu, L. Shen, and D. Tao, “Robust unlearnable examples: Protecting data against adversarial learning,” inProceedings of International Conference on Learning Representations, 2022, pp. 1– 13

    2022

  12. [20]

    Unlearnable examples: Making personal data unexploitable,

    H. Huang, X. Ma, S. M. Erfani, J. Bailey, and Y . Wang, “Unlearnable examples: Making personal data unexploitable,” inProceedings of International Conference on Learning Representations, 2021, pp. 1–12

    2021

  13. [21]

    Unlearnable clusters: Towards label-agnostic unlearnable examples,

    J. Zhang, X. Ma, Q. Yi, J. Sang, Y .-G. Jiang, Y . Wang, and C. Xu, “Unlearnable clusters: Towards label-agnostic unlearnable examples,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 3984–3993

    2023

  14. [22]

    Guided erasable adversarial attack (geaa) toward shared data protection,

    M. Zhao, B. Wang, W. Wang, Y . Kong, T. Zheng, and K. Ren, “Guided erasable adversarial attack (geaa) toward shared data protection,”IEEE Transactions on Information Forensics and Security, pp. 2468–2482, 2022

    2022

  15. [23]

    Adv-watermark: A novel watermark perturbation for adversarial examples,

    X. Jia, X. Wei, X. Cao, and X. Han, “Adv-watermark: A novel watermark perturbation for adversarial examples,” inProceedings of the 28th ACM International Conference on Multimedia, 2020, pp. 1579–1587

    2020

  16. [24]

    A self- supervised cnn for image watermark removal,

    C. Tian, M. Zheng, T. Jiao, W. Zuo, Y . Zhang, and C.-W. Lin, “A self- supervised cnn for image watermark removal,”IEEE Transactions on Circuits and Systems for Video Technology, vol. 34, no. 8, pp. 7566– 7576, 2024

    2024

  17. [25]

    Poisoning attacks against support vector machines,

    B. Biggio, B. Nelson, and P. Laskov, “Poisoning attacks against support vector machines,” inProceedings of the International Conference on Machine Learning, 2012, pp. 1467–1474

    2012

  18. [26]

    Towards poisoning of deep learning algorithms with back-gradient optimization,

    L. Mu ˜noz-Gonz´alez, B. Biggio, A. Demontis, A. Paudice, V . Wongras- samee, E. C. Lupu, and F. Roli, “Towards poisoning of deep learning algorithms with back-gradient optimization,” inProceedings of the 10th ACM workshop on artificial intelligence and security, 2017, pp. 27–38

    2017

  19. [27]

    Metapoison: Practical general-purpose clean-label data poisoning,

    W. R. Huang, J. Geiping, L. Fowl, G. Taylor, and T. Goldstein, “Metapoison: Practical general-purpose clean-label data poisoning,” in Proceedings of Advances in Neural Information Processing Systems, 2020, pp. 12 080–12 091

    2020

  20. [28]

    Witches’ brew: Industrial scale data poisoning via gradient matching,

    J. Geiping, L. Fowl, W. R. Huang, W. Czaja, G. Taylor, M. Moeller, and T. Goldstein, “Witches’ brew: Industrial scale data poisoning via gradient matching,” inProceedings of the International Conference on Learning Representations, 2020, pp. 1–13

    2020

  21. [29]

    Neural tangent generalization attacks,

    C. Yuan and S. Wu, “Neural tangent generalization attacks,” inPro- ceedings of International Conference on Machine Learning, 2021, pp. 12 230–12 240

    2021

  22. [30]

    Transferable unlearnable examples,

    J. Ren, H. Xu, Y . Wan, X. Ma, L. Sun, and J. Tang, “Transferable unlearnable examples,” inInternational Conference on Learning Repre- sentations, 2023, pp. 1–9

    2023

  23. [31]

    Unseg: One universal unlearnable example generator is enough against all image segmentation,

    Y . Sun, H. Zhang, T. Zhang, X. Ma, and Y .-G. Jiang, “Unseg: One universal unlearnable example generator is enough against all image segmentation,” inNeurIPS, 2024

    2024

  24. [32]

    Red- mark: Framework for residual diffusion watermarking based on deep networks,

    M. Ahmadi, A. Norouzi, N. Karimi, S. Samavi, and A. Emami, “Red- mark: Framework for residual diffusion watermarking based on deep networks,”Expert Systems with Applications, vol. 146, p. 113157, 2020

    2020

  25. [33]

    A novel two-stage separable deep learning framework for practical blind watermarking,

    Y . Liu, M. Guo, J. Zhang, Y . Zhu, and X. Xie, “A novel two-stage separable deep learning framework for practical blind watermarking,” in Proceedings of the 27th ACM International conference on multimedia, 2019, pp. 1509–1517

    2019

  26. [34]

    Stegastamp: Invisible hyperlinks in physical photographs,

    M. Tancik, B. Mildenhall, and R. Ng, “Stegastamp: Invisible hyperlinks in physical photographs,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020, pp. 2117–2126

    2020

  27. [35]

    Robust high- capacity watermarking over online social network shared images,

    W. Sun, J. Zhou, Y . Li, M. Cheung, and J. She, “Robust high- capacity watermarking over online social network shared images,”IEEE Transactions on Circuits and Systems for Video Technology, vol. 31, no. 3, pp. 1208–1221, 2021

    2021

  28. [36]

    Waverecovery: Screen- shooting watermarking based on wavelet and recovery,

    L. Fu, X. Liao, J. Guo, L. Dong, and Z. Qin, “Waverecovery: Screen- shooting watermarking based on wavelet and recovery,”IEEE Transac- tions on Circuits and Systems for Video Technology, vol. 35, no. 4, pp. 3603–3618, 2025

    2025

  29. [37]

    Screen-shooting resistant watermarking with grayscale deviation simulation,

    Y . Li, X. Liao, and X. Wu, “Screen-shooting resistant watermarking with grayscale deviation simulation,”IEEE Transactions on Multimedia, vol. 26, pp. 10 908–10 923, 2024

    2024

  30. [38]

    The unreasonable effectiveness of deep features as a perceptual metric,

    R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a perceptual metric,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2018, pp. 586–595

    2018

  31. [39]

    The jpeg still picture compression standard,

    G. K. Wallace, “The jpeg still picture compression standard,”IEEE Transactions on Consumer Electronics, vol. 34, no. 4, pp. 30–44, 1991

    1991

  32. [40]

    Squeeze-and-excitation networks,

    J. Hu, L. Shen, S. Albanie, G. Sun, and E. Wu, “Squeeze-and-excitation networks,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2017, pp. 7132–7141

    2017

  33. [41]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” inProceedings of International Conference on Learning Representations, 2015

    2015

  34. [42]

    Deepfool: a simple and accurate method to fool deep neural networks,

    S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” inProceedings of JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 14 the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2016, pp....

    2021

  35. [43]

    The robustness of deep networks: A geometrical perspective,

    A. Fawzi, S.-M. Moosavi-Dezfooli, and P. Frossard, “The robustness of deep networks: A geometrical perspective,”IEEE Signal Processing Magazine, vol. 34, no. 6, pp. 50–62, 2017

    2017

  36. [44]

    Delving into transferable adversarial examples and black-box attacks,

    Y . Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable adversarial examples and black-box attacks,” inProceedings of 5th International Conference on Learning Representations, 2017

    2017

  37. [45]

    Revisiting model stitching to compare neural representations,

    Y . Bansal, P. Nakkiran, and B. Barak, “Revisiting model stitching to compare neural representations,” inProceedings of Advances in Neural Information Processing Systems, vol. 34, 2021, pp. 225–236

    2021

  38. [46]

    Grounding representation similarity with statistical testing,

    F. Ding, J.-S. Denain, and J. Steinhardt, “Grounding representation similarity with statistical testing,” inProceedings of Advances in Neural Information Processing Systems, 2021, pp. 1–13

    2021

  39. [47]

    Similarity of neural network representations revisited,

    S. Kornblith, M. Norouzi, H. Lee, and G. Hinton, “Similarity of neural network representations revisited,” inInternational Conference on Machine Learning, 2019, pp. 3519–3529

    2019

  40. [48]

    Insights on representational similarity in neural networks with canonical correlation,

    A. Morcos, M. Raghu, and S. Bengio, “Insights on representational similarity in neural networks with canonical correlation,” inProceedings of Advances in Neural Information Processing Systems, vol. 31, 2018, pp. 1–10

    2018

  41. [49]

    Do wide and deep networks learn the same things? uncovering how neural network representations vary with width and depth,

    T. Nguyen, M. Raghu, and S. Kornblith, “Do wide and deep networks learn the same things? uncovering how neural network representations vary with width and depth,” inInternational Conference on Learning Representations, 2021, pp. 1–9

    2021

  42. [50]

    Maximum-entropy adver- sarial data augmentation for improved generalization and robustness,

    L. Zhao, T. Liu, X. Peng, and D. Metaxas, “Maximum-entropy adver- sarial data augmentation for improved generalization and robustness,” inProceedings of Advances in Neural Information Processing Systems, 2020, pp. 14 435–14 447

    2020

  43. [51]

    Ima- genet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Ima- genet: A large-scale hierarchical image database,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2009, pp. 248–255

    2009

  44. [52]

    Cifar-10 image classification with con- volutional neural networks for embedded systems,

    R. C. C ¸ alik and M. F. Demirci, “Cifar-10 image classification with con- volutional neural networks for embedded systems,” in2018 IEEE/ACS 15th International Conference on Computer Systems and Applications, 2018, pp. 1–2

    2018

  45. [53]

    Cats and dogs,

    O. M. Parkhi, A. Vedaldi, A. Zisserman, and C. V . Jawahar, “Cats and dogs,” inIEEE Conference on Computer Vision and Pattern Recognition, 2012

    2012

  46. [54]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2016, pp. 770–778

    2016

  47. [55]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” inProceedings of International Conference on Learning Representations, 2015, pp. 1–10

    2015

  48. [56]

    Mo- bilenetv2: Inverted residuals and linear bottlenecks,

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “Mo- bilenetv2: Inverted residuals and linear bottlenecks,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2018, pp. 4510–4520

    2018

  49. [57]

    Going deeper with convolutions,

    C. Szegedy, W. Liu, Y . Jia, P. Sermanet, S. Reed, D. Anguelov, D. Erhan, V . Vanhoucke, and A. Rabinovich, “Going deeper with convolutions,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2015, pp. 1–9

    2015

  50. [58]

    Densely connected convolutional networks,

    G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger, “Densely connected convolutional networks,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2017, pp. 4700–4708

    2017

  51. [59]

    Robust image forgery detection against transmission over online social networks,

    H. Wu, J. Zhou, J. Tian, J. Liu, and Y . Qiao, “Robust image forgery detection against transmission over online social networks,”IEEE Trans- actions on Information Forensics and Security, pp. 443–456, 2022

    2022

  52. [60]

    Learning the unlearnable: Adversarial augmentations suppress unlearnable example attacks,

    T. Qin, X. Gao, J. Zhao, K. Ye, and C.-Z. Xu, “Learning the unlearnable: Adversarial augmentations suppress unlearnable example attacks,”arXiv preprint arXiv:2303.15127, 2023

    2023 arXiv

  53. [61]

    Dual defense: Adversarial, traceable, and invisible robust watermarking against face swapping,

    Y . Zhang, D. Ye, C. Xie, L. Tang, X. Liao, Z. Liu, C. Chen, and J. Deng, “Dual defense: Adversarial, traceable, and invisible robust watermarking against face swapping,”IEEE Transactions on Information Forensics and Security, vol. 19, pp. 4628–4641, 2024. Binze Wangreceived t...

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.