{"id":"cf0a032b-f53e-41e2-9dca-1fb206be1a3a","arxiv_id":"2607.28862","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A reinforcement-learned text rewriter creates 'unlearnable' instruction data that degrades LLMs fine-tuned on it while preserving human readability.","lead":"TextCloak rewrites text so that AI models fine-tuned on it perform much worse, while human readers still understand the original meaning. It is a proactive defense against unauthorized use of scraped or licensed text for LLM training.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"One-step LoRA reward is an unvalidated proxy; if it does not predict full fine-tuning degradation, the RL policy optimizes an artifact and the central claim collapses.","rationale":"The paper's contribution is an RL-driven generator whose entire mechanism hinges on the reward being a faithful predictor of downstream harm. The reward is computed after one LoRA step on one batch (Algorithm 1 step 8; Appendix A.3). No experiment validates that this correlates with the full fine-tuning runs used in Tables 2–3. Since GRPO-UE optimizes this proxy over two epochs, the policy can overfit to properties of the single gradient step or to the fixed validation mini-batch. The transfer results are uneven (Table 3: Mistral-7B RACE +1.3; several near-zero drops), and the text itself acknowledges limited transferability in §5.3.1. The unexplained gap between Table 2's average Δ=12.4 and Table 4's full-method Δ=54.7 is a separate reporting problem that reinforces the need for verification. We are not rejecting the idea: the code is public, Table 2 is directionally consistent, and human evaluation suggests utility is preserved. But the central claim should be conditional on the reward-proxy check, which is exactly the reader's weakest assumption; the verdict remains CONDITIONAL.","tokens_in":19223,"tokens_out":6482,"duration_ms":76586,"concrete_test":"Compute, using the released code, the Spearman correlation between the one-step LoRA reward (Eq. 9–11) and the final accuracy drop after a full LoRA fine-tuning (e.g., 200 steps, rank 64) of Qwen3-8B and one unseen LLM (e.g., Mistral-7B) over at least 50 protected batches from MMLU-Pro. If ρ < 0.3, the one-step reward does not predict realistic fine-tuning degradation, and the central claim loses its main support.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim depends on the reward in Eq. 9–11: after a single LoRA step of a Qwen3-8B surrogate on one protected batch, the change in held-out validation loss is taken as the training signal for the RL policy. Nothing in the paper shows this one-step, one-batch signal ranks candidates the same way a full unauthorized fine-tuning run would. The policy is optimized for two epochs against this proxy, so it can exploit transient gradient directions or the fixed validation mini-batch rather than produce stable unlearnability. Table 3's transfer numbers are uneven (Mistral-7B RACE +1.3; several near-zero drops), and §5.3.1 concedes that transferability is limited because perturbations are specific to the surrogate. The unexplained Table 4 value (Δ=54.7) versus Table 2's average Δ=12.4 further undermines confidence. If the proxy does not transfer to realistic fine-tuning schedules, the RL policy is optimizing an artifact and the headline drop in Table 2 is not evidence for consistent unauthorized-fine-tuning impairment.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TextCloak, a defense that rewrites a released text corpus so that an LLM fine-tuned on it performs worse, while human readers can still use the text. The method trains a Llama-3-8B generative policy with a GRPO variant (GRPO-UE); the reward is the degradation of a Qwen3-8B surrogate fine-tuned with one LoRA step on the protected batch, measured on a clean validation mini-batch. Semantic fidelity (SBERT) and naturalness (GPT-2 perplexity) are added as penalty terms. The authors evaluate on six datasets and nine target LLMs, reporting an average absolute performance drop of Δ=12.4 pp in Table 2 and claiming transfer across architectures and fine-tuning configurations, robustness to defenses, and good human-judged quality.","tokens_in":19498,"tokens_out":4601,"duration_ms":56605,"significance":"If the central claim held, TextCloak would be a useful addition to proactive data-protection tools for LLM fine-tuning: it is a genuinely different formulation from classification-bound textual UEs, the problem is timely, and the paper is unusually broad in covering six datasets and nine models. The authors also release code (https://github.com/ympc08/TextCloak), which is a concrete strength. However, the central claim currently rests on an unvalidated reward proxy and on two inconsistent reported numbers for the same method. The significance of the contribution is therefore conditional on resolving these internal inconsistencies and on showing that the one-step surrogate reward is a faithful predictor of full fine-tuning degradation.","major_comments":[{"comment":"Table 4 reports the full TextCloak variant with Δ=54.7, while Table 2 reports an average Δ=12.4 for the same method. Neither the caption nor the text explains this large discrepancy (e.g., a different dataset, a different aggregation, or a different training schedule). Because the ablation conclusions hinge on this number (w/o degradation reward 9.0 vs. 54.7; w/o GRPO-UE 7.2 vs. 54.7), the reader cannot tell whether the headline effect is 12.4 or 54.7. Please report Table 4 under the same protocol as Table 2 and include per-seed values.","section":"§5.4, Table 4"},{"comment":"The reward is the change in validation loss after a single LoRA step of a Qwen3-8B surrogate on a single protected batch, evaluated on a clean validation mini-batch. This is an unvalidated proxy for the actual threat: a full unauthorized fine-tuning run on an arbitrary LLM. No correlation analysis is provided between the one-step reward and final test performance after full fine-tuning. Since the fixed validation mini-batch and the single gradient step are part of the policy objective, the RL policy can overfit to that batch and those transient gradients. Table 3’s uneven transfer (e.g., Mistral-7B RACE +1.3 and several near-zero drops) is consistent with this risk. Please add experiments correlating the one-step proxy with full fine-tuning outcomes across epochs, model families, and validation batches, or train with a more faithful (even if more expensive) reward on a subset.","section":"§4.3.1, Eq. (9)–(11), Algorithm 1 step 8, App. A.3"},{"comment":"The claim that TextCloak 'consistently achieves satisfactory transferability' is not supported by the numbers in Table 3: Mistral-7B on RACE shows Δ=+1.3, and several TextCloak cells are near zero (e.g., GPT-20B ARC Δ=6.1; Llama-8B MATH Δ=3.5; GLM-9B MedQA Δ=6.3). The text itself concedes in §5.3.1 that 'the transferability of TextCloak is limited since the error-minimized text perturbations are specific to the surrogate.' This tension with the abstract’s 'consistently impairs' claim needs either a statistical comparison (with error bars) or a more careful wording that distinguishes strong protection on the surrogate family from weaker, variable transfer elsewhere.","section":"§5.3.1, Table 3"}],"minor_comments":[{"comment":"Typo: 'Classific textual UEs' should presumably read 'Classical textual UEs.'","section":"§3.2"},{"comment":"The paper says experiments are repeated with three random seeds and the average is reported, but no standard deviations or significance tests are shown anywhere. Please add error bars or state that they are omitted for space.","section":"§5.1.4, Tables 2–4"},{"comment":"Table 5 is labeled 'Human evaluations' but the appendix says scores are averaged across three human annotators and three LLM judges. Please clarify in the main text which rows come from humans and which from LLMs, and note the small sample (20 per dataset).","section":"§5.6, App. B.1"},{"comment":"Several baseline parentheses are negative, e.g., Textual UE on MMLU-Pro/Phi-4 Δ=-20.3 and MEM-3/MEM-5 on MMLU-Pro also negative, meaning protected text improves performance relative to clean. These values are unexplained and make the baseline comparison hard to interpret; please add a note.","section":"Table 3"},{"comment":"The robustness figure lacks error bars and details of the adversarial-training (AT) defense (e.g., number of AT steps, whether AT is applied to the surrogate or the target). Without these, the 'robustness' claim is difficult to assess.","section":"Figure 4"}],"recommendation":"major_revision","confidential_remarks":"The main blockage is the internal inconsistency between Table 2 (Δ=12.4) and Table 4 (Δ=54.7) for the same method; if Table 4 is computed on a single favorable dataset, the headline claims should be recalibrated. The one-step LoRA reward proxy is the other load-bearing issue: unless the authors show it predicts full fine-tuning degradation, the RL training signal could be optimizing an artifact. I would recommend major revision rather than rejection because the framework is novel, the code is available, and both concerns are addressable with additional experiments and careful reporting."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a real contribution to unlearnable examples for LLM fine-tuning, but the paper's main evidence has two problems that need fixing before I'd trust the headline claim.\n\nWhat's actually new: TextCloak treats text protection as a constrained bi-level optimization and uses GRPO-UE, where a generative policy rewrites whole batches and gets rewarded by the degradation a one-step LoRA fine-tune of a Qwen3-8B surrogate produces on held-out validation data. That is not just re-skinned classification UE. Batch-level generative rewriting, with semantic and perplexity constraints, is a sensible step past token-flip methods, and the idea of optimizing directly for downstream validation loss is a legitimate advance. The experiments cover six datasets and nine LLMs, with a code release, ablations, transfer tests, robustness checks, and human evaluation. That is a reasonably thorough package for a preprint.\n\nThe soft spots are real. First, Table 2 says TextCloak averages a 12.4-point drop, but Table 4, the ablation, reports the full method at 54.7. Those cannot both be the same metric on the same setup. The paper never explains the discrepancy. Maybe Table 4 uses a different test set or a different target model, but as written it looks like an internal contradiction, and a referee will need it resolved.\n\nSecond, the one-step LoRA reward is an unvalidated proxy. The policy is trained for two epochs against the degradation after a single LoRA step on one batch. Nothing in the paper shows that this signal ranks candidates the way a full fine-tuning run would. The transfer results in Table 3 are consistent with that worry: Mistral-7B on RACE gets +1.3, several drops are near zero, and the paper itself concedes transferability is limited because perturbations are surrogate-specific. If the proxy doesn't correlate with longer schedules, the policy is optimizing an artifact.\n\nAlso, the paper claims three-seed averages but the main tables have no error bars, and Figure 3-4 are not supported by numeric values. Minor but annoying.\n\nCredit where due: the problem formulation is clean, the utility constraints are sensible, the human evaluation shows the protected text stays usable, and the authors do not oversell the transferability. The central mechanism is worth pursuing.\n\nWho this is for: people working on data protection, unlearnable examples, and LLM fine-tuning defenses. It deserves a serious referee, not a desk reject. My recommendation: send it to review, with the clear expectation that the authors reconcile Tables 2 and 4, provide variances, and validate the one-step reward against a longer fine-tuning schedule before publication.","headline":"A promising RL-driven text protection method with a genuinely new optimization loop, but the headline numbers are inconsistent and the reward signal is unvalidated; worth referee time.","tokens_in":19989,"tokens_out":1548,"would_cite":true,"duration_ms":20941,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a generative policy trained with group-relative policy optimization can rewrite clean text into unlearnable examples—readable to humans, degrading to LLMs fine-tuned on them—with an average 12.4 percentage-point drop","keywords":["unlearnable examples","LLM fine-tuning defense","data protection","reinforcement learning","group-relative policy optimization","text rewriting","privacy","instruction tuning"],"falsifier":"Fine-tune a held-out model family not seen during GRPO-UE training on both clean and TextCloak-protected copies of the same corpus using a full protocol (multiple epochs, LoRA-64 or full fine-tuning), and compare the true test-set gap; then compute the Spearman rank correlation between candidate rankings by the one-step surrogate reward and by their true long-run degradation. A near-zero gap or a near-zero rank correlation would falsify the claim that the surrogate reward drives genuine unlearnability.","tokens_in":19109,"feed_emoji":"🛡️","tokens_out":5940,"duration_ms":68346,"temperature":0.7,"pith_summary":"TextCloak tries to establish that a data owner can defend text against unauthorized LLM fine-tuning by rewriting it with an RL-trained generation policy. The protected text remains semantically faithful and natural to human readers while degrading the downstream performance of models trained on it, by 12.4 percentage points on average across six datasets. The mechanism is a bi-level loop: candidate rewrites are rewarded by how much they degrade a surrogate LLM after a single LoRA step on a clean held-out batch, and the policy is updated with group-relative policy optimization (GRPO-UE). TextCloak is claimed to transfer across unseen model architectures and fine-tuning configurations, and to resist common cleaning and adversarial-training defenses. If right, it gives data owners a practical tool to make scraped text costly to exploit.","feed_headline":"12.4-point drop: RL-rewritten text resists unauthorized fine-tuning","feed_subtitle":"Sentences stay readable to humans but sabotage LLMs trained on them—across model families and fine-tuning setups.","key_machinery":"The key machinery is GRPO-UE combined with a batch-level generative policy. The policy, initialized from Llama-3-8B, is prompted to rewrite a clean batch into protected inputs under an editing instruction. For each clean batch, K candidate rewrites are sampled; each candidate is used to fine-tune an independent surrogate copy (Qwen3-8B with one LoRA update), which is then evaluated on clean held-out data to compute degradation d_k. Rewards combine d_k with penalties for SBERT cosine similarity and GPT-2 perplexity falling below thresholds. Group-relative advantages are computed across the K candidates and used to update the policy with a clipped, KL-regularized GRPO objective. The loop alter","core_discovery":"The central discovery is that unlearnable text for LLMs can be generated in natural language space by optimizing a policy against the quantity that matters—downstream degradation—rather than a training-loss proxy. TextCloak's generative policy rewrites an entire batch of instruction-response pairs in one pass, and GRPO-UE rewards each candidate with the difference in held-out evaluation loss between a surrogate fine-tuned on the protected batch and one fine-tuned on the clean batch, penalized for violating semantic-fidelity and perplexity thresholds. This reward signal allows the policy to discover instance-specific 'reasoning cues' that act as shortcuts, so the fine-tuned model learns cues","pith_inferences":["If the one-step LoRA reward correlates only weakly with full fine-tuning outcomes on far-afield architectures, transferability claims would shrink; averaging the reward over a batch of diverse surrogate architectures during training is a natural, testable hardening step.","The authors leave open whether an attacker who knows the exact editing prompt and thresholds could detect or invert the rewriting; a prompt-aware filtering attack would probe this blind spot.","Because protection is applied at corpus level before release, TextCloak could plausibly be combined with watermarking to give owners both deterrence and attribution—if a model is later found to use protected text, the watermark signals provenance.","The roughly 40-seconds-per-batch training cost suggests scaling to very large corpora may be expensive; a distilled smaller policy or a one-shot rewrite mode could make the defense practical at web scale."],"forward_implications":["If TextCloak works, data owners can publish or expose corpora that remain useful to humans but sabotage unauthorized instruction fine-tuning, making scraping-for-fine-tuning far less profitable.","The claimed transferability means protection computed once with a Qwen3-8B surrogate degrades unseen models such as Phi-4, Qwen3-14B, and GLM-9B on the same tasks.","The reported robustness suggests the defense survives lowercasing, punctuation removal, whitespace stripping, paraphrasing, and even adversarial training—with adversarial training as the strongest counter.","Because the policy rewrites at batch level and enforces semantic and perplexity thresholds, the protected text retains near-clean human utility (SBERT 0.95, PPL 20.1 vs 18.7), so the defense does not sacrifice readability.","The success below zero-shot on HumanEval implies the method can actively poison, not just neutralize, unauthorized fine-tuning—a stronger form of protection than simple dataset obfuscation."],"fun_headline_variants":["RL-driven text cloaking degrades unauthorized LLM fine-tuning","Readable but unlearnable: RL text sabotages LLM training","TextCloak: RL-crafted unlearnable text for LLM defense","Policy-optimized text that LLMs can't exploit","RL text that reads fine but wrecks LLM fine-tuning"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the reward computed from one LoRA fine-tuning step of a single surrogate on one batch—the paper itself concedes in §5.3.1 that perturbations are surrogate-specific—predicts how much a full unauthorized fine-tuning run on an arbitrary LLM will be impaired.","fun_headline_variants_meta":{"raw":{"variants":["RL-driven text cloaking degrades unauthorized LLM fine-tuning","Readable but unlearnable: RL text sabotages LLM training","TextCloak: RL-crafted unlearnable text for LLM defense","Policy-optimized text that LLMs can't exploit","RL text that reads fine but wrecks LLM fine-tuning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000239,"raw_usage":{"total_tokens":1382,"prompt_tokens":807,"completion_tokens":575,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":551,"completion_tokens_details":{"reasoning_tokens":484}},"tokens_in":551,"tokens_out":575,"duration_ms":6896,"temperature":1.0,"reasoning_tokens":484,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-03T01:27:19.833398+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fine-tune a held-out model family not seen during GRPO-UE training on both clean and TextCloak-protected copies of the same corpus using a full protocol (multiple epochs, LoRA-64 or full fine-tuning), and compare the true test-set gap; then compute the Spearman rank correlation between candidate rankings by the one-step surrogate reward and by their true long-run degradation. A near-zero gap or a near-zero rank correlation would falsify the claim that the surrogate reward drives genuine unlearnability.","supporting_citations":[],"review_version":1}