Pith. sign in

REVIEW 4 major objections 5 minor 97 references

MTL-UE: Learning to Learn Nothing for Multi-Task Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read MTL-UE is a generator-based framework that makes multi-task datasets unlearnable by injecting class-wise label embeddings into bounded perturbations, degrading both multi-task and single-task models trained on the protected data.

desk verdict First multi-task unlearnable-example framework with real gains and unusually broad experimental coverage, but the 'consistently' claim overreaches given the ChestX-ray14 STL results and the missing error bars. read the letter →

arxiv 2505.05279 v1 pith:TMTCDSVA submitted 2025-05-08 cs.LG cs.CRcs.CV

Yi Yu , Song Xia , Siyuan Yang , Chenqi Kong , Wenhan Yang , Shijian Lu , Yap-Peng Tan , Alex C. Kot This is my paper · ORCID
classification cs.LGcs.CRcs.CV
keywords unlearnableexamplesmulti-tasklearningdatapoisoningavailabilityattacksgenerator-basedperturbationsclass-wisefeatureembeddingsembeddingregularizationdenseprediction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to establish that multi-task data can be protected from unauthorized model training by a single generator-based perturbation framework, rather than by per-sample optimization. The proposed MTL-UE couples an encoder–decoder network with learnable class-wise embeddings for each task's labels, then adds intra-task and inter-task regularizers to make the injected spurious features more separable and less scattered. The authors claim this is the first unified framework for unlearnable examples in multi-task learning, and that it outperforms existing unlearnable-example baselines consistently across four datasets, five backbones, and five multi-task weighting strategies, while also degrading single-task models trained on any one task. They further demonstrate extension to dense prediction on NYUv2 and plug-and-play compatibility with error-minimizing, adversarial, and self-ensemble base methods. A sympathetic reading is that, if the claim holds, one protected dataset can spoil training for a broad class of both generalist and specialist models.

What carries the argument

The load-bearing object is the embedding-injection generator: an encoder $E(\cdot;\phi_E)$ maps each input to a latent $z$, task-label priors select one learnable class-wise embedding $e^k_{y_k}$ per task, the embeddings are concatenated with $z$, and a decoder $D(\cdot;\phi_D)$ turns the concatenation into a perturbation clipped to the $\ell_\infty$ bound. Intra-task embedding regularization minimizes cosine similarity between embeddings within each task, enlarging inter-class distance; inter-task embedding regularization minimizes absolute cosine similarity across tasks, promoting geometric independence. This machinery is what converts the attack from per-sample optimization into learning global spurious-feature structure, and it is the component that makes the framework plug-and-play with surrogate-dependent unlearnable-example losses such as error-minimizing and adversarial objectives.

What would settle it

Train two victim models on the same MTL-UE-protected dataset, one from scratch and one initialized from a clean pretrained checkpoint, then compare accuracy on clean test data; if the pretrained model keeps near-clean accuracy while the from-scratch model fails, the protection depends on training from scratch rather than on the perturbations themselves.

Watch

Extended reading notes

Core claim

MTL-UE's central claim is that unlearnability for multi-task data is best achieved not by optimizing a separate perturbation per sample, but by learning a dataset-wide generator that emits one bounded perturbation per sample as a function of the sample's image and its labels across all tasks. The generator selects a learnable class-wise embedding for every task according to the sample's labels, concatenates those embeddings with the image latent, and decodes the result into a perturbation clipped to an $\ell_\infty$ bound. The paper argues this narrows the search space from raw pixel perturbations to the decoder's output space, lowers the intra-class variance of spurious features, and lets corresponding spurious features from several tasks coexist in one perturbation. Two regularizers—intra-task embedding regularization, which pushes embeddings of different classes in the same task apart, and inter-task embedding regularization, which makes embeddings across tasks geometrically independent—are said to improve attack effectiveness and robustness. The reported outcome is that models trained on the protected data, whether multi-task or single-task, drop sharply in accuracy on clean test data across all tasks, with transfer held across backbones and weighting strategies.

Load-bearing premise

The load-bearing premise is that a victim model trained from scratch will preferentially learn the class-wise spurious features the generator injects, and that shrinking the spread of those features is what makes the attack succeed; the paper's own variance evidence is partly self-referential because it is measured on models trained on the generator's own output.

Editorial extensions

If this is right

  • A single protected version of a multi-task dataset can be published without revealing usable training signal for either a multi-task model or a model trained on any one of its tasks.
  • Existing single-task unlearnable methods, once wrapped by MTL-UE, inherit multi-task protection without redesigning the base loss, so the framework acts as an upgrade path rather than a replacement.
  • Because the generator is trained once and reused, the perturbation budget is spent globally; the authors report the attack still works at smaller perturbation bounds down to 4/255.
  • If the transfer results hold, protection survives changes in victim backbone and multi-task weighting strategy, meaning a data owner does not need to know the attacker's architecture in advance.
  • Dense prediction datasets with segmentation, depth, and surface-normal tasks are also coverable by replacing class-wise embeddings with task-specific embedders, extending protection beyond classification.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A causal isolation test the paper does not run is to retrain the generator with all class-wise embeddings frozen at random values; if attack strength persists, the learned embeddings and their regularizers are not the operative component.
  • The measured transfer gap between CNN surrogates and vision-transformer victims implies a boundary condition: protection strength is tied to how well the surrogate's feature geometry matches the victim's, so testing with a vision-transformer surrogate is a natural next step.
  • Hard orthogonality is the limit of the inter-task regularizer; replacing the soft penalty with exactly orthogonal embeddings would test whether the benefits saturate and would give a parameter-free version of MTL-UE.
  • The partial-data results imply the framework is best suited to full-dataset release rather than mixed-scraping scenarios, because a small fraction of clean data quickly restores learnability.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes MTL-UE, a generator-based framework for constructing unlearnable examples in multi-task learning. Instead of optimizing a perturbation for each sample, the method trains an encoder-decoder that receives latent features concatenated with per-task, per-class learnable embeddings, and injects the resulting bounded perturbation into the training images. The generator can be plugged into surrogate-dependent UE methods such as EM, TAP, and SEP by replacing the base perturbation objective with the base method's loss. Intra-task and inter-task embedding regularizations are introduced to reduce intra-class variance and increase inter-class separation of spurious features. The paper reports experiments on CelebA, ChestX-ray14, UTKFace, and NYUv2, covering classification and dense prediction tasks, multiple backbones, multiple MTL weighting strategies, ablation studies, partial task protection, partial data protection, and robustness to ISS-style defenses. The central claim is that MTL-UE achieves consistently superior attacking performance across these settings.

Significance. If the empirical claims hold, MTL-UE is a useful and timely contribution: it is the first framework to treat unlearnable examples in a multi-task setting, it is plug-and-play with existing surrogate-dependent UE methods, and it extends to dense prediction tasks. The generator-plus-embedding design is well motivated by the observed failure modes of per-sample perturbation methods and patch-based surrogate-free methods, and the reported computational and parameter efficiency is attractive. The breadth of evaluation is a strength. However, the manuscript currently lacks the evidence needed to support the headline claim of consistent superiority: one of the four main datasets contains results that contradict the claim, no table reports seed variation or uncertainty, and at least one appendix table contains an internal numerical inconsistency. The contribution is promising, but the central empirical claim needs to be either corrected, qualified, or made reproducible before the paper can be accepted.

major comments (4)
  1. [Section 5.2, Table 2 (ChestX-ray14 STL)] The abstract and Section 5.2 claim that MTL-UE achieves 'superior attacking performance consistently across 4 MTL datasets.' Table 2 contradicts this claim on the ChestX-ray14 STL columns: lower AUC-ROC means stronger protection, but MTL-UE-TAP reports 0.6091 versus TAP's 0.6005, and MTL-UE-SEP reports 0.6068 versus SEP's 0.5926. Both MTL-UE variants are therefore less protective than their corresponding base methods on this single reported run. The MTL-side gain for MTL-UE-TAP (0.5341 versus 0.5478) is also small. The authors must either correct these numbers, explain why this case is an exception, or change the wording of the headline claim from 'consistently' to a qualified statement.
  2. [Section 5.2 and all result tables] No table reports standard deviations, confidence intervals, or the number of random seeds. Several comparisons in the paper have small gaps, such as the ChestX-ray14 MTL comparison just mentioned, and the UTKFace MTL gains in Table 2. Without repeated runs, these differences cannot be separated from training noise. Since the central claim is 'consistently superior attacking performance,' the authors should report mean and standard deviation over at least three seeds for the main tables, or provide statistical tests, and make the code or checkpoints available so that the reported numbers can be independently checked.
  3. [Appendix B.3, Table 12] The ISS-Grayscale row for MTL-UE-TAP reports per-task accuracies 10.68, 16.73, and 40.27, but the listed average is 10.68; the arithmetic mean of these three values is 22.56, so the average is internally inconsistent. In the same table, the EM row under ISS-BDR (19.81, 24.81, 58.84, 34.49) is identical to the ISS-Grayscale EM row, and the same duplicate pattern appears for TAP and SEP. These transcription issues must be fixed before the defense-robustness claims in Section B.3 can be evaluated.
  4. [Section 4.3, Table 3, Eq. (4)] The mechanism explanation for MTL-UE's success is partly self-referential. Table 3 measures intra-class standard deviation on features from models trained on the very perturbed datasets produced by the method, and Eq. (4) directly minimizes the cosine similarity between embeddings, which is a component of intra-class feature variance. Consequently, part of the reported variance reduction is enforced by construction rather than independently demonstrated. To make the mechanism claim testable, the authors should either measure intra-class variance on a fixed clean-pretrained encoder, or show that the variance reduction predicts attack success across held-out backbones and defenses, rather than only on the models used to generate the perturbations.
minor comments (5)
  1. [Table 8 caption] The caption reads 'Results of partial task protection on on the UTKFace'; the duplicated 'on' should be removed.
  2. [Section B.3] The word 'follwoing' should be 'following'.
  3. [Figure 9 caption] The caption uses 'Ours-EM', 'Ours-TAP', and 'Ours-SEP' while the body and Table 2 use 'MTL-UE-EM', 'MTL-UE-TAP', and 'MTL-UE-SEP'; the notation should be unified.
  4. [Figure 9 caption] The phrase 'in dependently normalized' should be 'independently normalized'.
  5. [Appendix A.4] The parameter count comparison counts optimized perturbation tensors for EM/TAP/SEP but generator network weights for MTL-UE; since these are different kinds of objects, the comparison would be clearer if the perturbation storage cost and generator parameter count were reported separately.

Circularity Check

1 steps flagged · score 2.0 of 10

Minor self-citation in the mechanism narrative; the central attack-evaluation claim is externally benchmarked and not circular.

  1. ansatz smuggled in via citation [Section 4.2 and Section 4.3 (discussion of Eq. 4, Intra-ER)]
    "As discussed in (Yu et al., 2024a), spurious features with lower intra-class variance and greater inter-class distance are more effective for attacks. ... For Intra-ER, as discussed in (Yu et al., 2024a), greater inter-class distance of spurious features enhances attack performance."

    The variance/distance principle is imported from the authors' own ICML 2024 paper rather than derived or independently benchmarked here. It then motivates the Intra-ER/Inter-ER losses and is used to interpret Tables 1 and 3, so the mechanism narrative leans on a self-citation. However, the headline superiority claim is not derived from this principle: it is measured on victim models trained from scratch on poisoned data, and Table 7's ablations give internal support for the regularizations. This is therefore a minor, partial circularity rather than a forced result.

full rationale

The central empirical claim of the paper is that MTL-UE outperforms baselines across datasets, backbones, and MTL weighting strategies. That claim is supported by an external evaluation protocol: perturbations are optimized against a surrogate MTL model and then tested on independently trained victim models, including transfer to different backbones and weighting strategies. The generator is not evaluated on the same model used to fit its parameters, and the attack success is measured on clean test data. Cross-backbone and cross-weighting results provide further independence. The main circularity-adjacent element is the mechanism analysis: the claim that lower intra-class variance and larger inter-class distance of spurious features cause stronger attacks is taken from the authors' own prior work (Yu et al., 2024a) and is used to justify the embedding regularizations. The confirmatory intra-class standard deviation in Table 3 is measured on models trained on the very perturbations the method generates, so it is partly self-referential. Still, this does not make the headline comparison circular, because the attack-performance numbers do not reduce to the regularizer by construction and are tested on held-out victims. The ChestX-ray14 STL results where MTL-UE-TAP/SEP are worse than the baselines, and the absence of error bars, are correctness and robustness concerns rather than circularity. Overall, the paper has one minor self-citation in the explanatory narrative but its main derivation is self-contained against external benchmarks.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The method introduces a learned generator with class-wise feature embeddings, which is an architectural component commonly used in perturbation generators. No new physical entities, forces, or conserved quantities are postulated.

free parameters (3)
  • lambda1 (Intra-ER weight) = 20
    Weight of the intra-task embedding regularization term (Eq. 4) in the generator loss; set by hand across all datasets, with ablation (Tab. 11) showing low sensitivity.
  • lambda2 (Inter-ER weight) = 100
    Weight of the inter-task embedding regularization term (Eq. 5); set by hand; ablation shows low sensitivity.
  • Generator architecture dimensions = 128-dim latent, 16-channel per-task embeddings, 9 conv layers encoder, 4 ConvTranspose2d decoder
    Architectural choices made without theoretical derivation and not swept; they define the capacity of the perturbation generator.
assumptions (3)
  • domain assumption Supervised models trained on clean-label data with class-wise, low-variance spurious perturbations will learn those perturbations and generalize poorly to clean test data.
    This shortcut-learning premise underlies all unlearnable example methods and is used in Sec. 4.1 and Sec. 4.2 to motivate the attack objective.
  • domain assumption The surrogate MTL model is representative enough of victim models that perturbations optimized against it transfer.
    The generator is optimized against a ResNet-18 surrogate with LS weighting; transferability to other backbones and weighting strategies is tested empirically (Tab. 5, Tab. 13-15), but the method depends on this transfer holding.
  • ad hoc to paper Reducing intra-class variance and increasing inter-class separation of spurious features improves unlearnability.
    Used to justify embedding regularization (Sec. 4.3, Eq. 4-5). The evidence (Tab. 1, Tab. 3) is correlational and partially self-referential, so this is an assumption rather than an established theorem.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MTL-UE: Learning to Learn Nothing for Multi-Task Learning." pith.science (2026). https://pith.science/paper/TMTCDSVA

@misc{pith2026250505279,
  author       = {Pith},
  title        = {Pith review of: MTL-UE: Learning to Learn Nothing for Multi-Task Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TMTCDSVA}},
  note         = {Machine review of arXiv:2505.05279}
}
read the original abstract

Most existing unlearnable strategies focus on preventing unauthorized users from training single-task learning (STL) models with personal data. Nevertheless, the paradigm has recently shifted towards multi-task data and multi-task learning (MTL), targeting generalist and foundation models that can handle multiple tasks simultaneously. Despite their growing importance, MTL data and models have been largely neglected while pursuing unlearnable strategies. This paper presents MTL-UE, the first unified framework for generating unlearnable examples for multi-task data and MTL models. Instead of optimizing perturbations for each sample, we design a generator-based structure that introduces label priors and class-wise feature embeddings which leads to much better attacking performance. In addition, MTL-UE incorporates intra-task and inter-task embedding regularization to increase inter-class separation and suppress intra-class variance which enhances the attack robustness greatly. Furthermore, MTL-UE is versatile with good supports for dense prediction tasks in MTL. It is also plug-and-play allowing integrating existing surrogate-dependent unlearnable methods with little adaptation. Extensive experiments show that MTL-UE achieves superior attacking performance consistently across 4 MTL datasets, 3 base UE methods, 5 model backbones, and 5 MTL task-weighting strategies.

Figures

Figures reproduced from arXiv: 2505.05279 by the authors.

Figure 1
Figure 1. Illustration of MTL-UE to prevent unauthorized training of MTL models on datasets like CelebA (Liu et al., 2015), having 40 binary attribute classifications. MTL-UE adds invisible, sample￾specific perturbations to transform a clean dataset into a protected one, leading to poor test performance of trained MTL models. 1. Introduction Multi-task learning (MTL) (Caruana, 1993; Guo et al., 2020) is a branch of machine le… view at source ↗
Figure 2
Figure 2. Performance of UE (Accuracy ↓) Vs. the number of tasks on the CelebA (Liu et al., 2015) for both MTL and STL models [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Visual depiction of MTL-UE, concatenating the task-specific class-wise embeddings with latents to generate UE for MTL data. Algorithm 1 Optimization of the UE Generator in MTL-UE Input: Surrogate model F ′ MTL = {f, {g k } K k=1}, encoder E(·; ϕE), decoder D(·; ϕD), embeddings  {e k i } Ck i=1 K k=1, clean multi-task dataset T = {(xi, {y k i } K k=1)} N i=1, epochs R, Adam optimizer, weights λ1 & λ2, Train-surrogat… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: MTL-UE applied to dense prediction tasks, e.g., NYUv2. unique information carried by each feature. (2) Reduced Coupling: It helps reduce coupling, and the decoder can fo￾cus on each feature independently, leading to more accurate perturbations. (3) Improved Interpretab…
Figure 6
Figure 6. Figure 6: Visual results: Odd rows show perturbations (independently normalized to [0,1]), and even rows show poisoned images [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: T-SNE results of the learned class-wise embeddings. (a) MTL models trained on clean data (b) MTL models trained on unlearnable data Age Race Gender Age Race Gender [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 9
Figure 9. Figure 9: Visual results: the odd/even rows show the perturbations/images, respectively. Perturbations are in dependently normalized to [0,1] for clarity. B.5. More visual results We provide additional visual examples of perturbations and poisoned images from the CelebA (Liu et …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

97 extracted references · 69 canonical work pages

  1. [1]

    Bayesian uncertainty for gradient aggregation in multi-task learning

    Achituve, I., Diamant, I., Netzer, A., Chechik, G., and Fetaya, E. Bayesian uncertainty for gradient aggregation in multi-task learning. In Proc. Int'l Conf. Machine Learning, 2024

    2024

  2. [2]

    and Ji, K

    Ban, H. and Ji, K. Fair resource allocation in multi-task learning. In Proc. Int'l Conf. Machine Learning, 2024

    2024

  3. [3]

    D., and Tygar, J

    Barreno, M., Nelson, B., Joseph, A. D., and Tygar, J. D. The security of machine learning. Machine Learning, 81: 0 121--148, 2010

    2010

  4. [4]

    A model of inductive bias learning

    Baxter, J. A model of inductive bias learning. J. Artif. Intell. Res., 12: 0 149--198, 2000

    2000

  5. [5]

    Poisoning attacks against support vector machines

    Biggio, B., Nelson, B., and Laskov, P. Poisoning attacks against support vector machines. In Proc. Int'l Conf. Machine Learning, pp.\ 1467--1474, 2012

    2012

  6. [6]

    Facial biometrics training dataset leads to bipa lawsuits against amazon, alphabet and microsoft, jul 2020

    Burt, C. Facial biometrics training dataset leads to bipa lawsuits against amazon, alphabet and microsoft, jul 2020. URL https://reurl. cc/dV4rD8, 2020

    2020

  7. [7]

    Multitask learning: A knowledge-based source of inductive bias

    Caruana, R. Multitask learning: A knowledge-based source of inductive bias. In Utgoff, P. E. (ed.), Proc. Int'l Conf. Machine Learning, pp.\ 41--48. Morgan Kaufmann, 1993

    1993

  8. [8]

    One for all: A universal generator for concept unlearnability via multi-modal alignment

    Chen, C., Zhang, J., Li, Y., and Han, Z. One for all: A universal generator for concept unlearnability via multi-modal alignment. In Proc. Int'l Conf. Machine Learning, 2024

    2024

Show all 97 references
  1. [9]

    Multi-task learning in natural language processing: An overview

    Chen, S., Zhang, Y., and Yang, Q. Multi-task learning in natural language processing: An overview. ACM Computing Surveys, abs/2109.09138, 2021

    2021 arXiv

  2. [10]

    Self-ensemble protection: Training checkpoints are good data protectors

    Chen, S., Yuan, G., Cheng, X., Gong, Y., Qin, M., Wang, Y., and Huang, X. Self-ensemble protection: Training checkpoints are good data protectors. In Proc. Int'l Conf. Learning Representations, 2023

    2023

  3. [11]

    Multi-task learning for dangerous object detection in autonomous driving

    Chen, Y., Zhao, D., Lv, L., and Zhang, Q. Multi-task learning for dangerous object detection in autonomous driving. Inf. Sci., 432: 0 559--571, 2018

    2018

  4. [12]

    Multinet: Multi-modal multi-task learning for autonomous driving

    Chowdhuri, S., Pankaj, T., and Zipser, K. Multinet: Multi-modal multi-task learning for autonomous driving. In IEEE Winter Conference on Applications of Computer Vision, WACV 2019, Waikoloa Village, HI, USA, January 7-11, 2019 , pp.\ 1496--1504. IEEE , 2019

    2019

  5. [13]

    Improvable gap balancing for multi-task learning

    Dai, Y., Fei, N., and Lu, Z. Improvable gap balancing for multi-task learning. In Uncertainty in Artificial Intelligence, pp.\ 496--506. PMLR, 2023

    2023

  6. [14]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., and Houlsby, N. An image is worth 16x16 words: Transformers for image recognition at scale. In Proc. Int'l Conf. Learning ...

    2021

  7. [15]

    Learning to confuse: generating training time adversarial data with auto-encoder

    Feng, J., Cai, Q.-Z., and Zhou, Z.-H. Learning to confuse: generating training time adversarial data with auto-encoder. Proc. Annual Conf. Neural Information Processing Systems, 32, 2019

    2019

  8. [16]

    Efficiently identifying task groupings for multi-task learning

    Fifty, C., Amid, E., Zhao, Z., Yu, T., Anil, R., and Finn, C. Efficiently identifying task groupings for multi-task learning. In Proc. Annual Conf. Neural Information Processing Systems, volume 34, pp.\ 27503--27516, 2021

    2021

  9. [17]

    W., and Shi, M

    Fontana, M., Spratling, M. W., and Shi, M. When multitask learning meets partial supervision: A computer vision review. Proc. IEEE , 112 0 (6): 0 516--543, 2024

    2024

  10. [18]

    Adversarial examples make strong poisons

    Fowl, L., Goldblum, M., Chiang, P.-y., Geiping, J., Czaja, W., and Goldstein, T. Adversarial examples make strong poisons. Proc. Annual Conf. Neural Information Processing Systems, 34: 0 30339--30351, 2021

    2021

  11. [19]

    Robust unlearnable examples: Protecting data privacy against adversarial learning

    Fu, S., He, F., Liu, Y., Shen, L., and Tao, D. Robust unlearnable examples: Protecting data privacy against adversarial learning. In Proc. Int'l Conf. Learning Representations, 2022

    2022

  12. [20]

    Dynamic channel pruning: Feature boosting and suppression

    Gao, X., Zhao, Y., Dudziak, ., Mullins, R., and Xu, C.-z. Dynamic channel pruning: Feature boosting and suppression. In Proc. Int'l Conf. Learning Representations, 2019

    2019

  13. [21]

    Mora: Improving ensemble robustness evaluation with model reweighing attack

    Gao, X., Xu, C.-Z., et al. Mora: Improving ensemble robustness evaluation with model reweighing attack. In Proc. Annual Conf. Neural Information Processing Systems, pp.\ 26955--26965, 2022

    2022

  14. [22]

    Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses

    Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., and Goldstein, T. Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses. IEEE Trans. on Pattern Analysis and Machine Intelligence , 45 0 (2): 0 1563--1...

    2022

  15. [23]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain

    Gu, T., Dolan-Gavitt, B., and Garg, S. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017

    2017 arXiv

  16. [24]

    Dynamic task prioritization for multitask learning

    Guo, M., Haque, A., Huang, D.-A., Yeung, S., and Fei-Fei, L. Dynamic task prioritization for multitask learning. In Proc. IEEE European Conf. Computer Vision, pp.\ 270--287, 2018

    2018

  17. [25]

    Learning to branch for multi-task learning

    Guo, P., Lee, C.-Y., and Ulbricht, D. Learning to branch for multi-task learning. In Proc. Int'l Conf. Machine Learning, pp.\ 3854--3863. PMLR, 2020

    2020

  18. [26]

    S., and Osadchy, R

    Hadash, G., Shalom, O. S., and Osadchy, R. Rank and rate: multi-task learning for recommender systems. In Pera, S., Ekstrand, M. D., Amatriain, X., and O'Donovan, J. (eds.), Proceedings of the 12th ACM Conference on Recommender Systems , pp.\ 451--454. ACM , 2018

    2018

  19. [27]

    Indiscriminate poisoning attacks on unsupervised contrastive learning

    He, H., Zha, K., and Katabi, D. Indiscriminate poisoning attacks on unsupervised contrastive learning. In Proc. Int'l Conf. Learning Representations. OpenReview.net, 2023

    2023

  20. [28]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, pp.\ 770--778, 2016

    2016

  21. [29]

    Lead: Exploring logit space evolution for model selection

    Hu, Z., Li, X., Tang, S., Liu, J., Hu, Y., and Duan, L.-Y. Lead: Exploring logit space evolution for model selection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 28664--28673, 2024

    2024

  22. [30]

    Huang, G., Liu, Z., Van Der Maaten, L., and Weinberger, K. Q. Densely connected convolutional networks. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, pp.\ 4700--4708, 2017

    2017

  23. [31]

    M., Bailey, J., and Wang, Y

    Huang, H., Ma, X., Erfani, S. M., Bailey, J., and Wang, Y. Unlearnable examples: Making personal data unexploitable. In Proc. Int'l Conf. Learning Representations, 2021

    2021

  24. [32]

    Jin, C., Li, Y., Zhao, M., Zhao, S., Wang, Z., He, X., Han, L., Che, T., and Metaxas, D. N. Lor- VP : Low-rank visual prompting for efficient vision model adaptation. In Proc. Int'l Conf. Learning Representations, 2025 a

    2025

  25. [33]

    N., and Che, T

    Jin, C., Peng, H., Zhang, Q., Tang, Y., Metaxas, D. N., and Che, T. Two heads are better than one: Test-time scaling of multi-agent collaborative reasoning. arXiv preprint arXiv:2504.09772, 2025 b

    2025 arXiv

  26. [34]

    and Joo, J

    Karkkainen, K. and Joo, J. Fairface: Face attribute dataset for balanced race, gender, and age for bias measurement and mitigation. In Proceedings of the IEEE/CVF winter conference on applications of computer vision, pp.\ 1548--1558, 2021

    2021

  27. [35]

    Multi-task learning using uncertainty to weigh losses for scene geometry and semantics

    Kendall, A., Gal, Y., and Cipolla, R. Multi-task learning using uncertainty to weigh losses for scene geometry and semantics. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, pp.\ 7482--7491, 2018

    2018

  28. [36]

    Koh, P. W. and Liang, P. Understanding black-box predictions via influence functions. In Proc. Int'l Conf. Machine Learning, pp.\ 1885--1894. PMLR, 2017

    2017

  29. [37]

    Reasonable effectiveness of random weighting: A litmus test for multi-task learning

    Lin, B., Ye, F., Zhang, Y., and Tsang, I. Reasonable effectiveness of random weighting: A litmus test for multi-task learning. Transactions on Machine Learning Research, 2022

    2022

  30. [38]

    Pareto multi-task learning

    Lin, X., Zhen, H.-L., Li, Z., Zhang, Q.-F., and Kwong, S. Pareto multi-task learning. In Proc. Annual Conf. Neural Information Processing Systems, volume 32, 2019

    2019

  31. [39]

    Safeguarding medical image segmentation datasets against unauthorized training via contour-and texture-aware perturbations

    Lin, X., Yu, Y., Xia, S., Jiang, J., Wang, H., Yu, Z., Liu, Y., Fu, Y., Wang, S., Tang, W., et al. Safeguarding medical image segmentation datasets against unauthorized training via contour-and texture-aware perturbations. arXiv preprint arXiv:2403.14250, 2024

    2024 arXiv

  32. [40]

    Liu, S., Johns, E., and Davison, A. J. End-to-end multi-task learning with attention. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, pp.\ 1871--1880. Computer Vision Foundation / IEEE , 2019 a

    2019

  33. [41]

    Liu, S., Johns, E., and Davison, A. J. End-to-end multi-task learning with attention. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, pp.\ 1871--1880, 2019 b

    2019

  34. [42]

    Game-theoretic unlearnable example generator

    Liu, S., Wang, Y., and Gao, X.-S. Game-theoretic unlearnable example generator. In Proc. AAAI Conf. on Artificial Intelligence, volume 38, pp.\ 21349--21358, 2024 a

    2024

  35. [43]

    Breaking free from MMI : A new frontier in rationalization by probing input utilization

    Liu, W., Deng, Z., Niu, Z., Wang, J., Wang, H., Zeng, Z., and Li, R. Breaking free from MMI : A new frontier in rationalization by probing input utilization. In Proc. Int'l Conf. Learning Representations, 2025 a

    2025

  36. [44]

    Adversarial cooperative rationalization: The risk of spurious correlations in even clean datasets

    Liu, W., Niu, Z., Gao, L., Deng, Z., Wang, J., Wang, H., and Li, R. Adversarial cooperative rationalization: The risk of spurious correlations in even clean datasets. In Proc. Int'l Conf. Machine Learning, 2025 b

    2025

  37. [45]

    Multimodal unlearnable examples: Protecting data against multimodal contrastive learning

    Liu, X., Jia, X., Xun, Y., Liang, S., and Cao, X. Multimodal unlearnable examples: Protecting data against multimodal contrastive learning. In Proceedings of the 32nd ACM International Conference on Multimedia, pp.\ 8024--8033, 2024 b

    2024

  38. [46]

    Deep learning face attributes in the wild

    Liu, Z., Luo, P., Wang, X., and Tang, X. Deep learning face attributes in the wild. In Proc. IEEE Int'l Conf. Computer Vision, pp.\ 3730--3738, 2015

    2015

  39. [47]

    Image shortcut squeezing: Countering perturbative availability poisons with compression

    Liu, Z., Zhao, Z., and Larson, M. Image shortcut squeezing: Countering perturbative availability poisons with compression. Proc. Int'l Conf. Machine Learning, 2023

    2023

  40. [48]

    Exploring the limits of model-targeted indiscriminate data poisoning attacks

    Lu, Y., Kamath, G., and Yu, Y. Exploring the limits of model-targeted indiscriminate data poisoning attacks. In Proc. Int'l Conf. Machine Learning, 2023

    2023

  41. [49]

    Towards deep learning models resistant to adversarial attacks

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In Proc. Int'l Conf. Learning Representations, 2018

    2018

  42. [50]

    Meng, R., Yi, C., Yu, Y., Yang, S., Shen, B., and Kot, A. C. Semantic deep hiding for robust unlearnable examples. IEEE Transactions on Information Forensics and Security, 2024

    2024

  43. [51]

    Cross-stitch networks for multi-task learning

    Misra, I., Shrivastava, A., Gupta, A., and Hebert, M. Cross-stitch networks for multi-task learning. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, pp.\ 3994--4003. IEEE Computer Society, 2016

    2016

  44. [52]

    Nathan Silberman, Derek Hoiem, P. K. and Fergus, R. Indoor segmentation and support inference from rgbd images. In Proc. IEEE European Conf. Computer Vision, 2012

    2012

  45. [53]

    Multi-task learning as a bargaining game

    Navon, A., Shamsian, A., Achituve, I., Maron, H., Kawaguchi, K., Chechik, G., and Fetaya, E. Multi-task learning as a bargaining game. In Proc. Int'l Conf. Machine Learning, pp.\ 16428--16446. PMLR, 2022

    2022

  46. [54]

    Destruction-restoration suppresses data protection perturbations against diffusion models

    Qin, T., Gao, X., Zhao, J., and Ye, K. Destruction-restoration suppresses data protection perturbations against diffusion models. In 2023 IEEE 35th International Conference on Tools with Artificial Intelligence (ICTAI), pp.\ 586--594. IEEE, 2023 a

    2023

  47. [55]

    Learning the unlearnable: Adversarial augmentations suppress unlearnable example attacks

    Qin, T., Gao, X., Zhao, J., Ye, K., and Xu, C.-Z. Learning the unlearnable: Adversarial augmentations suppress unlearnable example attacks. arXiv preprint arXiv:2303.15127, 2023 b

    2023 arXiv

  48. [56]

    Apbench: A unified availability poisoning attack and defenses benchmark

    Qin, T., Gao, X., Zhao, J., Ye, K., and Xu, C.-z. Apbench: A unified availability poisoning attack and defenses benchmark. Transactions on Machine Learning Research, 2024

    2024

  49. [57]

    Scalarization for multi-task and multi-domain learning at scale

    Royer, A., Blankevoort, T., and Ehteshami Bejnordi, B. Scalarization for multi-task and multi-domain learning at scale. In Proc. Annual Conf. Neural Information Processing Systems, volume 36, 2023

    2023

  50. [58]

    An overview of multi-task learning in deep neural networks

    Ruder, S. An overview of multi-task learning in deep neural networks. arXiv preprint arXiv:1706.05098, 2017

    2017 arXiv

  51. [59]

    Autoregressive perturbations for data poisoning

    Sandoval-Segura, P., Singla, V., Geiping, J., Goldblum, M., Goldstein, T., and Jacobs, D. Autoregressive perturbations for data poisoning. Proc. Annual Conf. Neural Information Processing Systems, 35: 0 27374--27386, 2022

    2022

  52. [60]

    P., and Goldstein, T

    Schwarzschild, A., Goldblum, M., Gupta, A., Dickerson, J. P., and Goldstein, T. Just how toxic is data poisoning? a unified benchmark for backdoor and data poisoning attacks. In Proc. Int'l Conf. Machine Learning, pp.\ 9389--9398. PMLR, 2021

    2021

  53. [61]

    and Koltun, V

    Sener, O. and Koltun, V. Multi-task learning as multi-objective optimization. In Proc. Annual Conf. Neural Information Processing Systems, volume 31, 2018

    2018

  54. [62]

    Independent component alignment for multi-task learning

    Senushkin, D., Patakin, N., Kuznetsov, A., and Konushin, A. Independent component alignment for multi-task learning. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, pp.\ 20083--20093, 2023

    2023

  55. [63]

    and Zisserman, A

    Simonyan, K. and Zisserman, A. Very deep convolutional networks for large-scale image recognition. In Bengio, Y. and LeCun, Y. (eds.), Proc. Int'l Conf. Learning Representations, 2015

    2015

  56. [64]

    Which tasks should be learned together in multi-task learning? In Proc

    Standley, T., Zamir, A., Chen, D., Guibas, L., Malik, J., and Savarese, S. Which tasks should be learned together in multi-task learning? In Proc. Int'l Conf. Machine Learning. PMLR, 2020

    2020

  57. [65]

    Unseg: One universal unlearnable example generator is enough against all image segmentation

    Sun, Y., Zhang, H., Zhang, T., Ma, X., and Jiang, Y.-G. Unseg: One universal unlearnable example generator is enough against all image segmentation. arXiv preprint arXiv:2410.09909, 2024

    2024 arXiv

  58. [66]

    Google accused of inappropriate access to medical data in potential class-action lawsuit, jun 2019

    Vincent, J. Google accused of inappropriate access to medical data in potential class-action lawsuit, jun 2019. URL https://reurl. cc/bzK69v, 2019

    2019

  59. [67]

    Benchmarking adversarial robustness of image shadow removal with shadow-adaptive attacks

    Wang, C., Yu, Y., Guo, L., and Wen, B. Benchmarking adversarial robustness of image shadow removal with shadow-adaptive attacks. In Proc. IEEE Int'l Conf. Acoustics, Speech, and Signal Processing, pp.\ 13126--13130. IEEE, 2024 a

    2024

  60. [68]

    Wang, X., Peng, Y., Lu, L., Lu, Z., Bagheri, M., and Summers, R. M. Chestx-ray8: Hospital-scale chest x-ray database and benchmarks on weakly-supervised classification and localization of common thorax diseases. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition...

    2017

  61. [69]

    Unlearnable 3d point clouds: Class-wise transformation is all you need

    Wang, X., Li, M., Liu, W., Zhang, H., Hu, S., Zhang, Y., Zhou, Z., and Jin, H. Unlearnable 3d point clouds: Class-wise transformation is all you need. arXiv preprint arXiv:2410.03644, 2024 b

    2024 arXiv

  62. [70]

    A3: Few-shot prompt learning of unlearnable examples with cross-modal adversarial feature alignment

    Wang, X., Gao, X., Liao, D., Qin, T., Lu, Y., and Xu, C.-Z. A3: Few-shot prompt learning of unlearnable examples with cross-modal adversarial feature alignment. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, 2025 a

    2025

  63. [71]

    Lie detector: Unified backdoor detection via cross-examination framework

    Wang, X., Liang, S., Liao, D., Fang, H., Liu, A., Cao, X., Lu, Y.-l., Chang, E.-C., and Gao, X. Lie detector: Unified backdoor detection via cross-examination framework. arXiv preprint arXiv:2503.16872, 2025 b

    2025 arXiv

  64. [72]

    One-pixel shortcut: On the learning preference of deep neural networks

    Wu, S., Chen, S., Xie, C., and Huang, X. One-pixel shortcut: On the learning preference of deep neural networks. In Proc. Int'l Conf. Learning Representations, 2023

    2023

  65. [73]

    Transferable adversarial attacks on sam and its downstream models

    Xia, S., Yang, W., Yu, Y., Lin, X., Ding, H., DUAN, L., and Jiang, X. Transferable adversarial attacks on sam and its downstream models. In Proc. Annual Conf. Neural Information Processing Systems, 2024 a

    2024

  66. [74]

    Mitigating the curse of dimensionality for certified robustness via dual randomized smoothing

    Xia, S., Yi, Y., Jiang, X., and Ding, H. Mitigating the curse of dimensionality for certified robustness via dual randomized smoothing. In Proc. Int'l Conf. Learning Representations, 2024 b

    2024

  67. [75]

    C., and Jiang, X

    Xia, S., Yu, Y., Yang, W., Ding, M., Chen, Z., Duan, L., Kot, A. C., and Jiang, X. Theoretical insights in model inversion robustness and conditional entropy maximization for collaborative inference systems. arXiv preprint arXiv:2503.00383, 2025

    2025 arXiv

  68. [76]

    Is feature selection secure against training data poisoning? In Proc

    Xiao, H., Biggio, B., Brown, G., Fumera, G., Eckert, C., and Roli, F. Is feature selection secure against training data poisoning? In Proc. Int'l Conf. Machine Learning, pp.\ 1689--1698. PMLR, 2015

    2015

  69. [77]

    Coding for intelligence from the perspective of category

    Yang, W., Hu, Z., Lin, L., Liu, J., and Duan, L.-Y. Coding for intelligence from the perspective of category. arXiv preprint arXiv:2407.01017, 2024

    2024 arXiv

  70. [78]

    Availability attacks create shortcuts

    Yu, D., Zhang, H., Chen, W., Yin, J., and Liu, T.-Y. Availability attacks create shortcuts. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp.\ 2367--2376, 2022 a

    2022

  71. [79]

    Gradient surgery for multi-task learning

    Yu, T., Kumar, S., Gupta, A., Levine, S., Hausman, K., and Finn, C. Gradient surgery for multi-task learning. In Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., and Lin, H. (eds.), Proc. Annual Conf. Neural Information Processing Systems, 2020

    2020

  72. [80]

    Lafeat: Piercing through adversarial defenses with latent features

    Yu, Y., Gao, X., and Xu, C.-Z. Lafeat: Piercing through adversarial defenses with latent features. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.\ 5735--5745, 2021

    2021

  73. [81]

    Yu, Y., Yang, W., Tan, Y.-P., and Kot, A. C. Towards robust rain removal against adversarial attacks: A comprehensive benchmark analysis and beyond. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, pp.\ 6013--6022, 2022 b

    2022

  74. [82]

    Lafit: Efficient and reliable evaluation of adversarial defenses with latent features

    Yu, Y., Gao, X., and Xu, C.-Z. Lafit: Efficient and reliable evaluation of adversarial defenses with latent features. IEEE Trans. on Pattern Analysis and Machine Intelligence , 46 0 (1): 0 354--369, 2023 a

    2023

  75. [83]

    Yu, Y., Wang, Y., Yang, W., Lu, S., Tan, Y.-P., and Kot, A. C. Backdoor attacks against deep image compression via adaptive frequency trigger. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, pp.\ 12250--12259, 2023 b

    2023

  76. [84]

    Yu, Y., Wang, Y., Xia, S., Yang, W., Lu, S., Tan, Y.-P., and Kot, A. C. Purify unlearnable examples via rate-constrained variational autoencoders. In International Conference on Machine Learning, ICML 2024 , 2024 a

    2024

  77. [85]

    Yu, Y., Wang, Y., Yang, W., Guo, L., Lu, S., Duan, L.-Y., Tan, Y.-P., and Kot, A. C. Robust and transferable backdoor attacks against deep image compression with selective frequency prior. IEEE Trans. on Pattern Analysis and Machine Intelligence , 2024 b

    2024

  78. [86]

    Unlearnable examples detection via iterative filtering

    Yu, Y., Zheng, Q., Yang, S., Yang, W., Liu, J., Lu, S., Tan, Y.-P., Lam, K.-Y., and Kot, A. Unlearnable examples detection via iterative filtering. In International Conference on Artificial Neural Networks, pp.\ 241--256. Springer, 2024 c

    2024

  79. [87]

    Backdoor attacks against no-reference image quality assessment models via a scalable trigger

    Yu, Y., Xia, S., Lin, X., Yang, W., Lu, S., Tan, Y.-P., and Kot, A. Backdoor attacks against no-reference image quality assessment models via a scalable trigger. In Proc. AAAI Conf. on Artificial Intelligence, volume 39, pp.\ 9698--9706, 2025

    2025

  80. [88]

    and Wu, S.-H

    Yuan, C.-H. and Wu, S.-H. Neural tangent generalization attacks. In Proc. Int'l Conf. Machine Learning, pp.\ 12230--12240. PMLR, 2021

    2021

  81. [89]

    and Cho, H

    Yun, H. and Cho, H. Achievement-based training progress balancing for multi-task learning. In Proc. IEEE Int'l Conf. Computer Vision, pp.\ 16935--16944, 2023

    2023

  82. [90]

    Unlearnable clusters: Towards label-agnostic unlearnable examples

    Zhang, J., Ma, X., Yi, Q., Sang, J., Jiang, Y.-G., Wang, Y., and Xu, C. Unlearnable clusters: Towards label-agnostic unlearnable examples. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, pp.\ 3984--3993, 2023

    2023

  83. [91]

    and Yang, Q

    Zhang, Y. and Yang, Q. A survey on multi-task learning. IEEE transactions on knowledge and data engineering, 34 0 (12): 0 5586--5609, 2021

    2021

  84. [92]

    Age progression/regression by conditional adversarial autoencoder

    Zhang, Z., Song, Y., and Qi, H. Age progression/regression by conditional adversarial autoencoder. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition. IEEE, 2017

    2017

  85. [93]

    and Lao, Y

    Zhao, B. and Lao, Y. Clpa: Clean-label poisoning availability attacks using generative adversarial nets. In Proc. AAAI Conf. on Artificial Intelligence, volume 36, pp.\ 9162--9170, 2022

    2022

  86. [94]

    Towards physical world backdoor attacks against skeleton action recognition

    Zheng, Q., Yu, Y., Yang, S., Liu, J., Lam, K.-Y., and Kot, A. Towards physical world backdoor attacks against skeleton action recognition. In Proc. IEEE European Conf. Computer Vision, pp.\ 215--233. Springer, 2024

    2024

  87. [95]

    Toward availability attacks in 3d point clouds

    Zhu, Y., Miao, Y., Dong, Y., and Gao, X.-S. Toward availability attacks in 3d point clouds. arXiv preprint arXiv:2407.11011, 2024 a

    2024 arXiv

  88. [96]

    Detection and defense of unlearnable examples

    Zhu, Y., Yu, L., and Gao, X.-S. Detection and defense of unlearnable examples. In Proc. AAAI Conf. on Artificial Intelligence, volume 38, pp.\ 17211--17219, 2024 b

    2024

  89. [97]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.