{"id":"b2ec1480-cb4c-40f4-a3ec-357de1367530","arxiv_id":"2608.06211","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"A reversible unlearnable-example framework that pairs output-entropy-minimizing perturbations with a dual watermark extractor, achieving near-random unauthorized accuracy and low watermark BER on three image datasets.","lead":"This paper combines unlearnable noise and hidden watermarks so image datasets can be shared publicly while blocking unauthorized model training and still proving ownership. On CIFAR10, ImageNet-100, and Pets, unauthorized models drop to near-random accuracy while watermark errors stay below about two percent.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claimed MI-minimization objective is internally inconsistent: Eq. (6) minimizes average per-sample softmax entropy (H(Y|X)), not the marginal H(Y) that Eq. (5) equates to I(X;Y).","rationale":"The reader correctly identifies Section III-C as the load-bearing step, but the stated reason is not quite right. The equality I(X;Y)=H(Y) when H(Y|X)=0 is mathematically true; the actual failure is that Eq. (6) does not compute H(Y). It computes the average entropy of the per-input softmax distribution, which under one interpretation is H(Y|X) and under the other is unrelated to any estimable H(Y). This is a sharper and more damaging inconsistency, because it cannot be patched by saying 'entropy minimization is MI minimization in this deterministic setting.' The paper's central theoretical contribution is therefore unsupported, even though the empirical availability attack may still work as a confidence-reduction / error-minimizing poison. The dual watermark extraction and reversible class-wise perturbation framework are separate contributions that are not invalidated by this flaw, and the reported BER and accuracy numbers are strong. The appropriate disposition remains conditional acceptance pending a corrected derivation or a reframing of the method, plus ideally a direct comparison with Learnability Lock [17]. Since the reader already reached CONDITIONAL, my read does not change the verdict.","tokens_in":20949,"tokens_out":7791,"duration_ms":109905,"concrete_test":"Run a minimal probe on CIFAR10 with the released code: during the perturbation loop, compute (a) the batch-average paper loss L_B = (1/B)Σ_i[-Σ_j p_{ij} log p_{ij}], (b) the marginal entropy of the argmax decisions over the same batch, and (c) the average per-sample softmax entropy, which equals L_B by definition. Report the gradient used in Eq. (7) and verify that it equals ∇L_B. If it does, the procedure optimizes H(Y|X), not H(Y)=I(X;Y), confirming the internal inconsistency. The same probe can compare the resulting gradients with those from Learnability Lock [17] to see whether the effective method is a variant of error-minimizing noise.","verdict_should_be":"UNCHANGED","load_bearing_attack":"In Section III-C, the paper defines ŷ_i = f(x̂_i) and treats the model output as a random variable Ŷ. It then uses H(Ŷ|X̂)=0 for deterministic networks to conclude I(X̂;Ŷ)=H(Ŷ), and substitutes H(Ŷ)=E[-Σ_j p_j log p_j]. This substitution is not valid. The quantity -Σ_j p_j log p_j is the Shannon entropy of the categorical distribution produced by the softmax for a single input. If Ŷ is taken to be the deterministic output vector, then H(Ŷ|X̂)=0, but H(Ŷ) is the entropy of the marginal distribution of output vectors over the data distribution, and Eq. (6) provides no estimate of that quantity. If, instead, Ŷ is a class label sampled from the softmax vector, then H(Ŷ|X̂) is exactly E[-Σ_j p_j log p_j], so Eq. (6) minimizes the conditional entropy, not the mutual information, and the equality I=H(Ŷ) is false. The two readings are mutually inconsistent. The actual optimized objective is per-sample entropy minimization, which forces confident (near one-hot) predictions on poisoned inputs rather than making predictions independent of inputs. The empirical unlearnability may survive this correction, but the abstract's central theoretical claim—'it works by minimizing the mutual information of the input and output'—and the claimed information-theoretic novelty of the perturbation do not.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a copyright protection framework that combines reversible unlearnable perturbations with digital watermarking. The pipeline trains a watermark encoder/decoder, generates class-wise perturbations by alternating between training a victim model and updating perturbations via a first-order step on Eq. (6), and trains a dual decoder so that watermarks are extractable both from perturbed and from recovered images. Experiments on ImageNet-100, CIFAR10, and Pets report near-random accuracy for multiple architectures on protected data (e.g., 6.76% average vs. 72.78% clean on ImageNet-100) while maintaining watermark BER below 0.35%, along with robustness studies against JPEG compression, data augmentation, adversarial training, and commercial training platforms.","tokens_in":21290,"tokens_out":9592,"duration_ms":118982,"significance":"If the framework works as claimed, it would be a practically relevant contribution to dataset copyright protection. The empirical evaluation is extensive and honestly reports failure modes (e.g., JPEG compression can partially break the availability attack). The dual-extractor design is a clean, well-ablated solution to the interference between unlearnable perturbations and watermark extraction. The paper also provides code. However, the central theoretical claim that the perturbation minimizes mutual information is not supported by the derivation, and this weakens the claimed novelty; the contribution as implemented is an entropy-minimization availability attack combined with dual watermarking.","major_comments":[{"comment":"The derivation that replaces I(X;Y) with H(Y) and then with the average softmax entropy is internally inconsistent. For a deterministic network, H(Y|X)=0, so I(X;Y)=H(Y), where H(Y) is the entropy of the marginal distribution of the model output over the data distribution. Equation (6), however, computes E_{x_hat}[-Σ_j p_j(x_hat) log p_j(x_hat)], which is exactly the conditional entropy H(Y|X) if Y is a label sampled from the softmax probabilities. These two objects are not equal in general, and the latter does not estimate the former. Therefore the optimization implemented in Algorithm 1 minimizes per-sample conditional entropy, not mutual information. The abstract and the contribution bullet that describe the method as minimizing mutual information of input and output are unsupported as written. Please either provide a correct estimator of marginal output entropy and optimize it, or reframe the paper honestly as an entropy-minimization approach and adjust the novelty claims accordingly.","section":"III-C, Eqs. (4)-(6)"},{"comment":"The paragraph after Algorithm 1 reports that mutual information decreased by 97% for ResNet18, 82% for VGG19, 89% for MobileNet, 83% for GoogleNet, and 97% for Dense121, but the manuscript does not describe the estimator used to compute these numbers. Given the issue in Eqs. (5)-(6), these figures are not interpretable as mutual information unless a separate, valid estimator is used and reported. Please specify the estimator, the random variables, and the evaluation protocol, or remove the quantitative MI claim.","section":"III-C, MI validation paragraph"}],"minor_comments":[{"comment":"Equation (6) uses the shorthand -f(...) log f(...) without an explicit sum over classes; write it as -Σ_j f_j(...) log f_j(...) to avoid ambiguity.","section":"III-C, Eq. (6)"},{"comment":"In Table II, the protected Pets accuracy is exactly 2.70% for all five architectures, which equals the random-guess accuracy for this dataset; please explain this uniformity (e.g., all models collapse to one class) or correct the entries.","section":"IV-A, Table II"},{"comment":"Section IV-B reports BER values without stating the total number of bits evaluated; specify the message length and the number of test images so the reader can assess statistical uncertainty.","section":"IV-B"},{"comment":"Table VII: the rows Ours+JPEG 85 and Ours+JPEG N/A are not explained in the text; clarify what differs from the Ours+JPEG 75 row.","section":"IV-F, Table VII"},{"comment":"Algorithm 1 uses a stop criterion e that is never given a value in the experiments; report the chosen e for each dataset.","section":"Algorithm 1"},{"comment":"The citation of equation (9) in reference [50] is not verifiable from the manuscript; please provide the exact equation number or a direct quotation.","section":"III-C, reference [50]"}],"recommendation":"major_revision","confidential_remarks":"The empirical results are strong and the robustness evaluation is thorough. My main concern is whether the paper's contribution can be reframed without losing significance: the entropy-minimization attack may already be known in the availability-attack literature, so the novelty after correction hinges on the combination with dual watermarking. I would support a major revision that removes the MI claim, but if the authors insist on the MI interpretation, the paper should be rejected because the derivation cannot be fixed within the current scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The empirical package here is genuinely solid, and the core idea is worth taking seriously. The authors combine reversible, class-wise unlearnable perturbations with a dual watermark extractor, so ownership can be verified on both perturbed and recovered images. The experiments are extensive: ImageNet-100, CIFAR10, and Pets, five architectures, comparisons against GEAA and Adv-watermark, JPEG and data-augmentation robustness, and a real-world test on Baidu EasyDL. The attack drops accuracy to near random while watermark BER stays below 0.5%, and the recovery accuracy is close to clean training. That is a real engineering contribution, and the dual-extractor design is a sensible fix for the interference between perturbation and watermark.\n\nThe soft spot is exactly where the stress-test note lands. Section III-C claims the perturbation minimizes mutual information between input and output. The derivation goes: I(X;Y) = H(Y) - H(Y|X), and because neural networks are deterministic, H(Y|X) = 0, so I(X;Y) = H(Y). Then they substitute H(Y) with the average per-sample softmax entropy, E[-Σ p_j log p_j]. That step is wrong. If Y is the deterministic output vector, H(Y) is the entropy of the marginal distribution of output vectors, which is not what Eq. (6) computes. If Y is instead a label sampled from the softmax, then E[-Σ p_j log p_j] is exactly H(Y|X), so Eq. (6) minimizes conditional entropy, not mutual information. Either way, the objective is per-sample entropy minimization, i.e., it makes the model confident on poisoned inputs. That may still be a perfectly good unlearnable perturbation, and it is closely related to error-minimizing noise, but it is not a new information-theoretic mechanism. The MI reduction numbers in Section III-C (97%, 82%, etc.) are also stated without explaining how MI was estimated on high-dimensional outputs, which is itself a nontrivial problem.\n\nI would not call this fatal. The attack works in practice, the comparisons are fair, and the reversibility and dual-extractor machinery are useful. The paper is not incoherent; it just over-claims the theory. The fix is straightforward: either correct the derivation or reframe the contribution as entropy minimization with a heuristic motivation. The reader's suggestion to compare with Learnability Lock is largely covered already, since Table V includes Linear* and Conv* from that work.\n\nVerdict: worth sending to review. The authors should be asked to rewrite the theory section and be honest about what the objective actually is. The empirical work deserves to see the light after that.","headline":"Strong empirical results under a mislabeled theory: the perturbation really works, but the mutual-information story in Section III-C does not survive contact with the paper's own equations.","tokens_in":21775,"tokens_out":1748,"would_cite":true,"duration_ms":25027,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A reversible class-wise perturbation makes images unlearnable to unauthorized models while keeping watermarks extractable on both perturbed and recovered images, with near-random accuracy and sub-0.35% bit error rates on three datasets.","keywords":["copyright protection","unlearnable examples","watermarking","mutual information minimization","availability attack","data poisoning","reversible perturbation","deep learning security"],"falsifier":"Train a self-supervised representation model on the protected images (e.g., a contrastive learner) and then fit a linear classifier on the learned representations using clean labels; if the linear probe reaches accuracy close to the clean baseline (about 72% on ImageNet-100), the perturbed data remain learnable for label-agnostic training, which would contradict the framework's semantic-information-protection claim.","tokens_in":20776,"feed_emoji":"🛡️","tokens_out":9554,"duration_ms":105166,"temperature":0.7,"pith_summary":"The paper sets out to show that image copyright protection in the deep learning era can be comprehensive: one framework can stop unauthorized models from learning anything useful from published images and still let the owner prove ownership later, even if an attacker strips off the protective perturbation. The authors argue that simply stacking an availability attack on top of watermarking fails because the perturbation corrupts watermark extraction, and they propose a coordinated design instead. That design combines a class-wise unlearnable perturbation with a dual watermark extractor, so the same watermark is readable from both perturbed and recovered images. On ImageNet-100, CIFAR10, and Pets, protected data pushes unauthorized models to near-random accuracy while authorized users, who subtract the class-wise perturbation, recover almost the original model performance. A sympathetic reader would take away that dataset owners can make their data unusable for unauthorized training without losing the ability to verify ownership.","feed_headline":"One perturbation makes data unlearnable, watermarks stay readable","feed_subtitle":"Unauthorized models fall to near-random accuracy while owners still verify images before and after perturbation removal.","key_machinery":"The load-bearing mechanism is the mutual-information-minimization perturbation. The paper defines the goal as reducing $I(\\hat{X};\\hat{Y})$, the mutual information between protected inputs and model outputs; for a deterministic network the conditional entropy vanishes, so the objective collapses to minimizing the output entropy $H(\\hat{Y})$, i.e., minimizing the expected softmax entropy $\\hat{y}\\log\\hat{y}$ over protected images. This is complemented by a class-wise universal perturbation: per-image perturbations are averaged within each class to yield $C$ noise vectors that can be transmitted to authorized users and subtracted to recover watermarked images. The second pillar is the dual watermark extractor, a second decoder $D_d$ trained on perturbed watermarked images so that the framework can verify ownership in both the perturbed and the recovered state. A differentiable JPEG approximation is included in both watermark and perturbation training so the protection holds up against compression.","core_discovery":"The central claim is that availability attacks and watermarking do not have to conflict, and that a perturbation that minimizes the mutual information between a model's input and output, implemented by minimizing the entropy of the victim model's softmax outputs over protected images, generalizes across architectures and leaves enough signal for a second watermark decoder. The dual-extraction design trains one decoder for perturbation-free watermarked images and a second decoder for the same images with the perturbation added; ownership is established if either decoder's extracted message matches the embedded watermark. Because the perturbation is shared across all images in a class, authorized users can remove it by a single subtraction, restoring normal learnability. The reported results on ImageNet-100 show an average unauthorized accuracy of 6.76% against 72.78% for clean training, with watermark bit error rates of 0.16% with perturbation and 0.22% without, and similar patterns on CIFAR10 and Pets.","pith_inferences":["A testable extension not pursued in the paper: since the implemented loss is output entropy, an ablation that directly minimizes a nonparametric estimate of mutual information (rather than entropy) would reveal whether the MI framing adds anything beyond naive output-entropy minimization.","The paper assumes the unauthorized user will train a classifier with labels; a label-agnostic attack (e.g., self-supervised pretraining followed by linear probing on clean labels) might bypass the class-wise perturbation, so the framework's semantic-information-protection guarantee could be scoped to supervised training.","The class-wise perturbation is noise that can, in principle, be estimated from the protected dataset alone (for instance, by clustering protected images and averaging within inferred classes); the paper does not analyze this attack, and testing whether such clustering can recover the perturbations would determine the real-world security margin."],"forward_implications":["Unauthorized models trained on the protected data should stay near random accuracy even when the model architecture differs from the one that generated the perturbation, because the MI-based objective is tied to shared feature extraction rather than a single decision boundary.","Dataset owners can publish protected images and still verify ownership both on the published (perturbed) images and on any clean images that an attacker may redistribute after removing the perturbation.","Authorized access becomes practical: subscription or key distribution only needs to convey the class-wise perturbations and class labels, after which users subtract one vector per class and train normally.","The protection remains usable under common cloud-operating conditions such as JPEG compression, because differentiable JPEG is integrated into both watermark and perturbation training."],"supporting_citations":[{"why":"GEAA is the baseline that combines an erasable adversarial attack with watermarking; the paper must beat its poor watermark accuracy without perturbation.","marker":"[22]"},{"why":"Adv-watermark is a visible-watermark attack that doubles as an unlearnable perturbation; the paper compares reversibility and availability with it.","marker":"[23]"},{"why":"MBRS supplies the watermark encoder-decoder architecture and differentiable JPEG training that the framework adapts.","marker":"[8]"},{"why":"HiDDeN is the DNN watermarking framework that the paper places as the ancestor of encoder-decoder watermarking.","marker":"[9]"},{"why":"Learnability Lock is a prior reversible unlearnable example approach, and the reversibility of the perturbation is a key point of contrast.","marker":"[17]"},{"why":"Error-minimizing unlearnable examples (Emin) is a primary availability-attack baseline; the paper reports consistently lower accuracy with its perturbation.","marker":"[20]"},{"why":"The differentiable JPEG approximation from this reference is reused inside both watermark and perturbation training to make protection survive compression.","marker":"[39]"},{"why":"The paper follows this reference's derivation that for deterministic models mutual information reduces to output entropy, the step underlying the perturbation objective.","marker":"[50]"}],"fun_headline_variants":["Unlearnable for thieves, reversible for owners","Watermarks stay readable on unlearnable images","One perturbation blocks theft, preserves watermark","Mutual info minimizes learning, keeps watermark intact","Reversible unlearnable images: dual watermark extraction"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's theory rests on the step where, for a deterministic network, the conditional entropy $H(\\hat{Y}|\\hat{X})$ is set to zero so that minimizing output entropy $H(\\hat{Y})$ is treated as minimizing input–output mutual information; if the network is not effectively deterministic, or if the softmax entropy is not a faithful proxy for dependence between input and output, that theoretical grounding weakens.","fun_headline_variants_meta":{"raw":{"variants":["Unlearnable for thieves, reversible for owners","Watermarks stay readable on unlearnable images","One perturbation blocks theft, preserves watermark","Mutual info minimizes learning, keeps watermark intact","Reversible unlearnable images: dual watermark extraction"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000177,"raw_usage":{"total_tokens":1306,"prompt_tokens":974,"completion_tokens":332,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":590,"completion_tokens_details":{"reasoning_tokens":262}},"tokens_in":590,"tokens_out":332,"duration_ms":4492,"temperature":1.0,"reasoning_tokens":262,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T12:27:00.561806+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a self-supervised representation model on the protected images (e.g., a contrastive learner) and then fit a linear classifier on the learned representations using clean labels; if the linear probe reaches accuracy close to the clean baseline (about 72% on ImageNet-100), the perturbed data remain learnable for label-agnostic training, which would contradict the framework's semantic-information-protection claim.","supporting_citations":[{"cited_title":"Guided erasable adversarial attack (geaa) toward shared data protection,","cited_arxiv_id":null,"evidence_quote":"GEAA is the baseline that combines an erasable adversarial attack with watermarking; the paper must beat its poor watermark accuracy without perturbation."},{"cited_title":"Adv-watermark: A novel watermark perturbation for adversarial examples,","cited_arxiv_id":null,"evidence_quote":"Adv-watermark is a visible-watermark attack that doubles as an unlearnable perturbation; the paper compares reversibility and availability with it."},{"cited_title":"Mbrs: Enhancing robustness of dnn- based watermarking by mini-batch of real and simulated jpeg compres- sion,","cited_arxiv_id":null,"evidence_quote":"MBRS supplies the watermark encoder-decoder architecture and differentiable JPEG training that the framework adapts."},{"cited_title":"Hidden: Hiding data with deep networks,","cited_arxiv_id":null,"evidence_quote":"HiDDeN is the DNN watermarking framework that the paper places as the ancestor of encoder-decoder watermarking."},{"cited_title":"Learnability lock: Authorized learnability con- trol through adversarial invertible transformations,","cited_arxiv_id":null,"evidence_quote":"Learnability Lock is a prior reversible unlearnable example approach, and the reversibility of the perturbation is a key point of contrast."},{"cited_title":"Unlearnable examples: Making personal data unexploitable,","cited_arxiv_id":null,"evidence_quote":"Error-minimizing unlearnable examples (Emin) is a primary availability-attack baseline; the paper reports consistently lower accuracy with its perturbation."},{"cited_title":"The jpeg still picture compression standard,","cited_arxiv_id":null,"evidence_quote":"The differentiable JPEG approximation from this reference is reused inside both watermark and perturbation training to make protection survive compression."},{"cited_title":"Maximum-entropy adver- sarial data augmentation for improved generalization and robustness,","cited_arxiv_id":null,"evidence_quote":"The paper follows this reference's derivation that for deterministic models mutual information reduces to output entropy, the step underlying the perturbation objective."}],"review_version":1}