Pith. sign in

REVIEW 3 major objections 4 minor 42 references

Injecting defensive noise into an image's semantic code, not its pixels, makes personal photos unlearnable to AI while keeping them looking natural.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-14 10:40 UTC pith:BJLHGZW2

load-bearing objection Moving error-minimizing noise into a DiffAE semantic latent is a clean engineering step that measurably improves the quality-unlearnability trade-off against the usual pixel-domain relearners. the 3 major comments →

arxiv 2607.10580 v1 pith:BJLHGZW2 submitted 2026-07-12 cs.CV cs.AI

DiffUE: Enhancing Utility-Unlearnability Trade-off of Unlearnable Examples via Diffusion Autoencoders

Syed Irfan Ali Meerza , Oktay Ozturk , Amir Sadovnik , Jian Liu This is my paper
classification cs.CV cs.AI
keywords unlearnable examplesdiffusion autoencoderssemantic noiseprivacy-preserving datautility-unlearnability trade-offadversarial training resistanceperceptual quality
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Personal images scraped from the web are routinely used to train AI models without consent. Existing unlearnable-example methods add imperceptible pixel noise so that models extract almost nothing useful, but those defenses are easily undone by adversarial training, filtering, compression, or purification, and stronger versions ruin visual quality. DiffUE instead encodes an image with a diffusion autoencoder, optimizes a small defensive perturbation inside the high-level semantic latent, and decodes a new image that still looks natural. Because the change lives on the image manifold rather than as high-frequency static, it survives the usual relearning attacks and preserves perceptual quality far better than prior pixel-space methods. Experiments on CIFAR, CelebA-HQ and ImageNet, plus a user study with photographers and creators, show markedly lower test accuracy under attack together with higher FID, SSIM and PSNR scores.

Core claim

By solving a bi-level optimization that places bounded defensive noise only in the 512-dimensional semantic code of a pre-trained diffusion autoencoder and then reconstructing via conditional DDIM, DiffUE produces images that remain unlearnable even after adversarial training, grayscale conversion, UEraser, diffusion purification and lossy compression, while delivering substantially higher perceptual quality than error-minimizing, robust and stable pixel-space baselines at equal or smaller effective budgets.

What carries the argument

Semantic-space defensive noise optimized by projected gradient descent inside a diffusion autoencoder's latent (Eq. 3): the encoder yields z_sem and stochastic code x_T; a constrained z_δ is added so that the decoded image drives surrogate-model loss near zero, yet the resulting pixel changes stay photorealistic.

Load-bearing premise

A fixed semantic noise radius chosen so that pixel change stays around 4/255 will stay both invisible to people and hard for future attacks that themselves work in latent space to remove.

What would settle it

Train a new surrogate that itself operates inside the same diffusion-autoencoder latent, apply DiffUE-protected images at the paper's reported radii, and check whether clean-test accuracy rises above 40 percent on CIFAR-10 or ImageNet after standard adversarial training.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Users can post photos that look ordinary yet yield near-random accuracy for any model trained on them, even after common relearning pipelines.
  • Photographers and social-media creators gain a practical tool that does not force a choice between privacy and visual quality.
  • Future unlearnable-example research can treat semantic latents as the natural place for defensive noise rather than the pixel grid.
  • Controlled attribute edits (smile, hair color, tone) can be made simultaneously unlearnable and aesthetically useful.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If semantic defenses prove durable, platforms may start offering one-click 'make unlearnable' filters that operate in latent space before upload.
  • The same diffusion-autoencoder pipeline could be inverted to audit whether a scraped dataset already contains semantic unlearnable noise.
  • Adaptive attackers will likely shift from pixel purification to latent-space purification, creating the next round of the arms race.
  • Because the method relies on a pre-trained autoencoder, its protection may weaken for image domains far from the autoencoder's training distribution.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces DiffUE, which generates unlearnable examples (UEs) by optimizing defensive noise z_δ inside the semantic latent code of a pre-trained diffusion autoencoder (DiffAE) rather than in pixel space. An input image is encoded to z_sem and stochastic code x_T; a bi-level PGD optimization (Eq. 3) finds a bounded semantic perturbation so that the DDIM-reconstructed image x_u drives near-zero loss on a surrogate classifier. The resulting images are claimed to resist adversarial training, grayscale conversion, UEraser, LUE purification, and lossy compression while retaining higher perceptual quality (FID/SSIM/PSNR) and human acceptability than pixel-space baselines EM, REM and SEM. Experiments cover CIFAR-10/100, an ImageNet subset and CelebA-HQ, plus architecture transfer, class-wise analysis, controlled attribute edits, and a 56-participant user study.

Significance. If the empirical trade-off holds under fair budgets, DiffUE supplies a practical semantic-space route to privacy-preserving image sharing that is more robust to common relearning pipelines and more usable for photographers and social-media users than existing pixel-noise UEs. The multi-dataset evaluation, transferability results, Grad-CAM analysis, compression tests and human preference study constitute solid empirical support and are strengths of the work. The approach also demonstrates optional controllable edits (smile, hair, style) that keep images natural. Dependence on a specific DiffAE model and the absence of latent-space adaptive attacks limit immediate generality, yet the core idea of manifold-aligned defensive noise is a useful contribution to the UE literature.

major comments (3)
  1. [§5.2, Tables 1–4] Section 5.2 and Tables 1–4: Semantic radii ρ_u = 0.20 (CIFAR) / 0.35 (ImageNet/CelebA) are chosen so that random 50-dimensional perturbations produce a maximum pixel change of 4/255, while all baselines are run at ρ_u = 8/255 (and REM/SEM with additional ρ_a or ρ_r = 4/255). The paper never reports the actual pixel-space L_∞, L_2 or mean absolute deviation of the final optimized DiffUE images x_u − x_0. Without these numbers (or an explicit budget-matched ablation), it remains unclear whether the large accuracy gaps under AT/UEraser/LUE/compression and the FID/SSIM/PSNR gains are caused by the semantic formulation or by a systematically smaller/different effective perturbation. Reporting the realized pixel norms of the optimized examples is load-bearing for the claimed superiority of the utility–unlearnability trade-off.
  2. [§5.4] Section 5.4 (and the robustness claims of the abstract and introduction): All evaluated relearning strategies (adversarial training, mean/Gaussian filters, grayscale, UEraser, LUE, JPEG/WebP/HEIC) act in pixel space or with standard image transforms. No experiment considers an adaptive adversary that knows the DiffAE encoder/decoder and optimizes purification or relearning inside the same 512-dimensional semantic space (e.g., by projecting or inverting z_δ). Because the central technical claim is that semantic-space noise is inherently more robust, the absence of any latent-aware attack leaves the robustness argument only partially stress-tested.
  3. [Eq. (3), §5.2] Equation (3) and Section 5.2: The single fixed radii are never ablated. A trade-off curve of clean-test accuracy versus FID/SSIM (or versus realized pixel L_∞) over a range of ρ_u would make the claimed “enhanced utility–unlearnability trade-off” quantitative rather than a single operating point. The current hand-chosen values leave open how sensitive the results are to this free parameter.
minor comments (4)
  1. [§5.7] Section 5.7 contains two nearly identical paragraphs describing the controlled-modification procedure; the second appears to be an accidental duplication and should be removed.
  2. [Fig. 1] Figure 1 caption and the surrounding text use both “defensive noise radii (ρ_u)” and parenthetical test accuracies; clarifying that DiffUE’s ρ_u lives in semantic space while the baselines’ radii are pixel-space would avoid reader confusion.
  3. [title page] Author affiliations list both “Oak Ridge National University” and later “Oak Ridge National Laboratory”; the correct institutional name should be verified.
  4. [§5.1] The termination criterion “surrogate reaches over 99 % training accuracy” (Sec. 5.1) is stated without the corresponding number of outer-loop iterations or a sensitivity check; a brief note on typical wall-clock cost would help reproducibility.

Circularity Check

0 steps flagged

No circularity: DiffUE is an empirical bi-level optimization of semantic noise evaluated on independent held-out accuracy and perceptual metrics.

full rationale

The paper's central claim is an engineering method (Eq. 3 bi-level min-min optimization of defensive semantic noise z_δ via PGD inside a pre-trained DiffAE latent, followed by DDIM reconstruction) whose success is measured by external, non-tautological quantities: clean-test accuracy of models trained on the resulting UEs under adversarial training / filters / UEraser / LUE / compression (Tables 1-3), plus FID/SSIM/PSNR and a user study (Table 4, Sec. 5.9). The sole free parameter ρ_u is chosen by a separate empirical calibration (max pixel shift ≈4/255 on 2000 samples) and is never used to define those success metrics; nothing reduces by construction to a fitted constant or self-referential definition. Citations (DiffAE [25], EM/REM/SEM baselines) are external prior art, not load-bearing uniqueness theorems or self-citations that force the result. The derivation chain is therefore self-contained and non-circular.

Axiom & Free-Parameter Ledger

3 free parameters · 3 axioms · 1 invented entities

The central empirical claim rests on a small set of free radii chosen to match a pixel budget, the standard bi-level UE optimization template, and the assumption that a pre-trained DiffAE semantic latent is a suitable place to inject defensive noise. No new physical entities are postulated; the method re-uses existing DiffAE and PGD machinery.

free parameters (3)
  • semantic noise radius ρ_u = 0.20 / 0.35
    Hand-set to 0.20 (CIFAR) / 0.35 (ImageNet/CelebA) after measuring max pixel shift on 2 000 samples so that the effective pixel change stays ≤4/255; directly controls the strength of unlearnability and visual change.
  • controlled-modification scale γ
    Scaling factor on the cosine-similarity term that steers noise toward a desired attribute direction; chosen by the authors for the optional attribute-edit experiments.
  • PGD inner steps and step size η = 10 steps
    Fixed at 10 steps per outer surrogate update; standard but still free hyper-parameters of the bi-level solver.
axioms (3)
  • domain assumption A pre-trained diffusion autoencoder (Preechakul et al.) supplies a semantically meaningful, decodable latent in which small additive noise produces photorealistic pixel changes.
    Invoked throughout Section 4 and Fig. 2; without a high-quality DiffAE the method collapses to ordinary latent-space noise.
  • domain assumption Error-minimizing noise that drives surrogate training loss near zero renders the sample uninformative for other models (the classic UE premise of Huang et al.).
    Eq. 2–3 and the entire optimization objective rest on this established but still empirical claim.
  • standard math Projected Gradient Descent with an ℓ_p ball constraint finds a sufficiently strong defensive semantic shift.
    Eq. 4; standard first-order adversarial optimization.
invented entities (1)
  • defensive semantic noise z_δ no independent evidence
    purpose: The optimized additive vector in the 512-dim semantic code that makes the reconstructed image unlearnable.
    Defined in Section 4.1–4.2; it is simply the optimization variable of the bi-level problem, not a new physical or mathematical object with independent existence.

pith-pipeline@v1.1.0-grok45 · 19452 in / 2865 out tokens · 30512 ms · 2026-07-14T10:40:05.052267+00:00 · methodology

0 comments
read the original abstract

AI models are increasingly trained on personal images scraped from social media and public platforms, often without consent, leading to serious privacy violations, such as unauthorized facial recognition and targeted advertising. To counter this, researchers have developed unlearnable examples (UEs), images modified with imperceptible noise to prevent AI models from extracting meaningful information. However, existing UE methods primarily rely on pixel-space noise, which can be bypassed by relearning strategies such as adversarial training, image transformation, and compression. While some techniques improve robustness, they often come at the expense of significant degradation in image utility and perceptual quality. In this paper, we introduce DiffUE to overcome these limitations by injecting noise into the semantic space of images instead of the pixel space. Instead of corrupting pixel values, DiffUE modifies high-level semantic features of images, ensuring robust unlearnability while preserving visual quality and utility. By leveraging a diffusion-based autoencoder framework to manipulate semantic features, DiffUE generates purposeful, natural-looking modifications that effectively resist advanced relearning strategies. Extensive experiments on four datasets, CIFAR-10, CIFAR-100, CelebA-HQ, and ImageNet, as well as a subjective user study, demonstrate that DiffUE significantly enhances the trade-off between image quality and unlearnability, offering a more robust and effective solution for safeguarding personal data in an increasingly exploitative AI landscape.

Figures

Figures reproduced from arXiv: 2607.10580 by Amir Sadovnik, Jian Liu, Oktay Ozturk, Syed Irfan Ali Meerza.

Figure 1
Figure 1. Figure 1: Usability vs. unlearnability comparison under adversarial training with [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of DiffUE: DiffUE leverages a diffusion autoencoder to en￾code the input image into a semantic code zsem and a stochastic code xT . It then iteratively optimizes a defensive semantic code zδ so that the resulting un￾learnable image xu, generated by the conditional DDIM decoding process, tricks the surrogate model gθ into believing there is nothing to learn. code zsem, a compact 512-dimensional vec… view at source ↗
Figure 3
Figure 3. Figure 3: Visualization of noise types and crafted examples for the ImageNet Subset. [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Classwise unlearnability analysis. In (a), we have perturbed only one class [PITH_FULL_IMAGE:figures/full_fig_p012_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Defensive noise as attribute modification [PITH_FULL_IMAGE:figures/full_fig_p013_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Comparison of the spatial regions in the input image that contribute to [PITH_FULL_IMAGE:figures/full_fig_p014_6.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

42 extracted references · 8 linked inside Pith

  1. [1]

    arXiv preprint arXiv:1206.6389 (2012)

    Biggio, B., Nelson, B., Laskov, P.: Poisoning attacks against support vector ma- chines. arXiv preprint arXiv:1206.6389 (2012)

    Pith/arXiv arXiv 2012

  2. [2]

    In: 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)

    Dolatabadi, H.M., Erfani, S., Leckie, C.: The devil’s advocate: Shattering the il- lusion of unexploitable data using diffusion models. In: 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). pp. 358–386. IEEE (2024)

    2024

  3. [3]

    https://arstechnica.com/information-technology/2022/09/artist-finds-private- medical-record-photos-in-popular-ai-training-data-set/ (2022), [Accessed 22-06- 2026]

    Edwards, B.: Artist finds private medical record photos in popular AI training data set. https://arstechnica.com/information-technology/2022/09/artist-finds-private- medical-record-photos-in-popular-ai-training-data-set/ (2022), [Accessed 22-06- 2026]

    2022

  4. [4]

    In: International Conference on Learning Representations (2022)

    Fu, S., He, F., Liu, Y., Shen, L., Tao, D.: Robust unlearnable examples: Protect- ing data against adversarial learning. In: International Conference on Learning Representations (2022)

    2022

  5. [5]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 770–778 (2016)

    2016

  6. [6]

    Advances in neural information processing systems30(2017)

    Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., Hochreiter, S.: Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems30(2017)

    2017

  7. [7]

    In: Ethics of Data and Analytics, pp

    Hill, K.: The secretive company that might end privacy as we know it. In: Ethics of Data and Analytics, pp. 170–177. Auerbach Publications (2020)

    2020

  8. [8]

    NeurIPS (2020)

    Ho, J., Jain, A., Abbeel, P.: Denoising diffusion probabilistic models. NeurIPS (2020)

    2020

  9. [9]

    In: ICLR (2021)

    Huang, H., Ma, X., Erfani, S.M., Bailey, J., Wang, Y.: Unlearnable examples: Making personal data unexploitable. In: ICLR (2021)

    2021

  10. [10]

    The Business Lawyer 75(1), 1637–1646 (2019)

    Illman, E., Temple, P.: California consumer privacy act. The Business Lawyer 75(1), 1637–1646 (2019)

    2019

  11. [11]

    Instruments, N.: Peak signal-to-noise ratio as an image quality metric (2013)

    2013

  12. [12]

    In: Proceedings of the 31st ACM International Conference on Multime- dia

    Jiang, W., Diao, Y., Wang, H., Sun, J., Wang, M., Hong, R.: Unlearnable examples give a false sense of security: Piercing through unexploitable data with learnable examples. In: Proceedings of the 31st ACM International Conference on Multime- dia. pp. 8910–8921 (2023)

    2023

  13. [13]

    In: Pacific-Asia Conference on Knowledge Discovery and Data Mining

    Jiang, Y., Ma, X., Erfani, S.M., Bailey, J.: Unlearnable examples for time series. In: Pacific-Asia Conference on Knowledge Discovery and Data Mining. pp. 213–225. Springer (2024)

    2024

  14. [14]

    arXiv preprint arXiv:1710.10196 (2017)

    Karras, T., Aila, T., Laine, S., Lehtinen, J.: Progressive growing of gans for im- proved quality, stability, and variation. arXiv preprint arXiv:1710.10196 (2017)

    Pith/arXiv arXiv 2017

  15. [15]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Karras, T., Laine, S., Aila, T.: A style-based generator architecture for generative adversarial networks. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 4401–4410 (2019)

    2019

  16. [16]

    In: International conference on machine learning

    Koh, P.W., Liang, P.: Understanding black-box predictions via influence functions. In: International conference on machine learning. pp. 1885–1894. PMLR (2017)

    2017

  17. [17]

    Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)

    2009

  18. [18]

    Advances in Neural Infor- mation Processing Systems38, 17495–17522 (2026)

    Li, Z., Cai, J., Xu, G., Zheng, H., Li, Q., Zhou, F., Yang, S., Ling, C., Wang, B.: Versatile transferable unlearnable example generator. Advances in Neural Infor- mation Processing Systems38, 17495–17522 (2026)

    2026

  19. [19]

    arXiv preprint arXiv:2403.14250 (2024)

    Lin, X., Yu, Y., Xia, S., Jiang, J., Wang, H., Yu, Z., Liu, Y., Fu, Y., Wang, S., Tang, W., et al.: Safeguarding medical image segmentation datasets against DiffUE: Enhancing Utility-Unlearnability Trade-off 17 unauthorized training via contour-and texture-aware perturbations. arXiv preprint arXiv:2403.14250 (2024)

    Pith/arXiv arXiv 2024

  20. [20]

    In: Proceedings of the AAAI Conference on Artificial Intelligence

    Liu, Y., Xu, K., Chen, X., Sun, L.: Stable unlearnable example: Enhancing the ro- bustness of unlearnable examples via stable error-minimizing noise. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 38, pp. 3783–3791 (2024)

    2024

  21. [21]

    arXiv preprint arXiv:2111.13244 (2021)

    Liu, Z., Zhao, Z., Kolmus, A., Berns, T., van Laarhoven, T., Heskes, T., Larson, M.: Going grayscale: The road to understanding and improving unlearnable examples. arXiv preprint arXiv:2111.13244 (2021)

    Pith/arXiv arXiv 2021

  22. [22]

    In: International Conference on Learning Representations (2018)

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: International Conference on Learning Representations (2018)

    2018

  23. [23]

    In: 2025 IEEE Symposium on Security and Privacy (SP)

    Meerza, S.I.A., Sun, L., Liu, J.: Harmonycloak: Making music unlearnable for gen- erative ai. In: 2025 IEEE Symposium on Security and Privacy (SP). pp. 430–448. IEEE (2025)

    2025

  24. [24]

    IEEE Transactions on Information Forensics and Security (2024)

    Meng, R., Yi, C., Yu, Y., Yang, S., Shen, B., Kot, A.C.: Semantic deep hiding for robust unlearnable examples. IEEE Transactions on Information Forensics and Security (2024)

    2024

  25. [25]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Preechakul, K., Chatthee, N., Wizadwongsa, S., Suwajanakorn, S.: Diffusion au- toencoders: Toward a meaningful and decodable representation. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 10619– 10629 (2022)

    2022

  26. [26]

    arXiv preprint arXiv:2303.15127 (2023)

    Qin, T., Gao, X., Zhao, J., Ye, K., Xu, C.Z.: Learning the unlearnable: Ad- versarial augmentations suppress unlearnable example attacks. arXiv preprint arXiv:2303.15127 (2023)

    Pith/arXiv arXiv 2023

  27. [27]

    arXiv preprint arXiv:2210.10114 (2022)

    Ren, J., Xu, H., Wan, Y., Ma, X., Sun, L., Tang, J.: Transferable unlearnable examples. arXiv preprint arXiv:2210.10114 (2022)

    Pith/arXiv arXiv 2022

  28. [28]

    International journal of computer vision115(3), 211–252 (2015)

    Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al.: Imagenet large scale visual recog- nition challenge. International journal of computer vision115(3), 211–252 (2015)

    2015

  29. [29]

    In: NeurIPS (2018)

    Shafahi, A., Huang, W.R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., Gold- stein, T.: Poison frogs! targeted clean-label poisoning attacks on neural networks. In: NeurIPS (2018)

    2018

  30. [30]

    In: International Conference on Learning Representations (2021)

    Song, J., Meng, C., Ermon, S.: Denoising diffusion implicit models. In: International Conference on Learning Representations (2021)

    2021

  31. [31]

    Advances in neural information processing systems31(2018)

    Song, Y., Shu, R., Kushman, N., Ermon, S.: Constructing unrestricted adversar- ial examples with generative models. Advances in neural information processing systems31(2018)

    2018

  32. [32]

    In: Advances in neural information processing systems

    Tao, L., Feng, L., Yi, J., Huang, S.J., Chen, S.: Better safe than sorry: Preventing delusive adversaries with adversarial training. In: Advances in neural information processing systems. pp. 16209–16225 (2021)

    2021

  33. [33]

    A Practical Guide, 1st Ed., Cham: Springer International Publishing10(3152676), 10–5555 (2017)

    Voigt, P., Von dem Bussche, A.: The eu general data protection regulation (gdpr). A Practical Guide, 1st Ed., Cham: Springer International Publishing10(3152676), 10–5555 (2017)

    2017

  34. [34]

    arXiv preprint arXiv:2405.03316 (2024)

    Wang, D., Xue, M., Li, B., Camtepe, S., Zhu, L.: Provably unlearnable data ex- amples. arXiv preprint arXiv:2405.03316 (2024)

    Pith/arXiv arXiv 2024

  35. [35]

    IEEE Trans- actions on Neural Networks and Learning Systems (2023)

    Wang, S., Chen, S., Chen, T., Nepal, S., Rudolph, C., Grobler, M.: Generating se- mantic adversarial examples via feature manipulation in latent space. IEEE Trans- actions on Neural Networks and Learning Systems (2023)

    2023

  36. [36]

    In: Digital Video image quality and perceptual coding, pp

    Wang, Z., Bovik, A.C., Sheikh, H.R.: Structural similarity based image quality assessment. In: Digital Video image quality and perceptual coding, pp. 225–242. CRC Press (2017) 18 Meerza et al

    2017

  37. [37]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Wu, Q., Yu, Y., Kong, C., Liu, Z., Wan, J., Li, H., Kot, A.C., Chan, A.B.: Tem- poral unlearnable examples: Preventing personal video data from unauthorized exploitation by object tracking. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 11110–11121 (2025)

    2025

  38. [38]

    In: Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence (IJCAI)

    Xiao, C., Li, B., Zhu, J., He, W., Liu, M., Song, D.: Generating adversarial examples with adversarial networks. In: Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence (IJCAI). pp. 3905–3911 (2018)

    2018

  39. [39]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Xie, C., Wu, Y., Maaten, L.v.d., Yuille, A.L., He, K.: Feature denoising for im- proving adversarial robustness. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 501–509 (2019)

    2019

  40. [40]

    arXiv preprint arXiv:2306.01902 (2023)

    Zhao, Z., Duan, J., Hu, X., Xu, K., Wang, C., Zhang, R., Du, Z., Guo, Q., Chen, Y.: Unlearnable examples for diffusion models: Protect data from unauthorized exploitation. arXiv preprint arXiv:2306.01902 (2023)

    Pith/arXiv arXiv 2023

  41. [41]

    In: Proceedings of the IEEE/CVF international conference on computer vision

    Zhu, P., Osada, G., Kataoka, H., Takahashi, T.: Frequency-aware gan for adver- sarial manipulation generation. In: Proceedings of the IEEE/CVF international conference on computer vision. pp. 4315–4324 (2023)

    2023

  42. [42]

    In: Proceedings of the AAAI Conference on Artificial Intelligence

    Zhu, Y., Yu, L., Gao, X.S.: Detection and defense of unlearnable examples. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 38, pp. 17211– 17219 (2024)

    2024