Pith. sign in

REVIEW 3 major objections 5 minor 79 references

BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read With 500 unprotected image pairs, an adversary can break black-box data protection by training a diffusion bridge that inverts the protection on unseen data.

desk verdict A genuinely plausible attack on black-box data protection via protection leakage, with broad and mostly convincing experiments, but the headline numbers lean on a stronger leakage setup than advertised and on test-set hyperparameter tuning. read the letter →

arxiv 2412.21061 v2 pith:ACTYZOOA submitted 2024-12-30 cs.LG

Yihan Wang , Yiwei Lu , Xiao-Shan Gao , Gautam Kamath , Yaoliang Yu This is my paper · ORCID
classification cs.LG
keywords availabilityattacksunlearnableexamplesdataprotectiondiffusionbridgemodelleakagepurificationstylemimicryblack-boxAPI
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Black-box data protection services let owners upload images and receive back perturbed versions that are supposed to be useless for training machine learning models. This paper argues those services leak enough information to be broken: an adversary who submits a small in-distribution set of unprotected images to the same service obtains (unprotected, protected) pairs, trains a diffusion bridge on those pairs, and thereby learns an approximate inverse of the protection. The resulting model, BridgePure, purifies unseen protected images so that classifiers trained on them recover near-original accuracy on nine availability attacks, and so that style-mimicry protections such as Glaze and Mist no longer cloak generated artwork. The paper concludes that protection leakage is a critical vulnerability of current black-box data protection and that practitioners need countermeasures.

What carries the argument

The load-bearing object is a denoising diffusion bridge model (DDBM): a stochastic process with fixed endpoints $x_0 = x$ and $x_T = x' = P(x)$, trained from scratch by minimizing the denoising score-matching loss on leaked pairs. At purification time the bridge is sampled through the time-reversed SDE or probability-flow ODE while conditioning on the protected endpoint, so each output is drawn from a learned conditional distribution $q_\theta(x \mid x')$ that approximately reverses $P$. Two pre-processing choices carry much of the practical gain: Gaussian perturbation $G_\beta(x') = \sqrt{1-\beta}\,x' + \sqrt{\beta}\,z$ prevents overfitting when the leaked set is small, and the sampling randomness parameter $s \in [0,1]$ trades fidelity against removal strength.

What would settle it

A concrete experiment: train BridgePure on leaked pairs from one distribution and purify protected images from a different distribution, for example CIFAR-100 pairs to purify CIFAR-10 or Monet paintings to purify a contemporary artist's artwork; if purified accuracy stays near the unprotected baseline, the distribution-match assumption is not load-bearing, while if it collapses as the paper's Appendix C.10 reports, the attack's reach is limited to adversaries with in-distribution leakage.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the protection mechanism $P$ can be approximately inverted from a small number of labelled pairs. Given access to a black-box API $P$ and a small dataset $D_a$ of unprotected in-distribution images, the adversary forms $\hat{D}_a = \{(x, P(x))\}$, trains a denoising diffusion bridge model to transport between $x$ and $P(x)$, and then runs conditional sampling from the protected endpoint $x'$ to draw an approximation of $q_{\text{data}}(x \mid x')$. Experiments show this restores training availability almost completely: with 500 to 4,000 leaked pairs, BridgePure brings CIFAR-10 accuracy from attack-degraded levels back to roughly 93\%--94\% against nine attacks, outperforming adversarial training, D-VAE, AVATAR, and LE-JCDP, and it beats DiffPure on ImageNet and WebFace subsets. On style mimicry, 5 to 10 leaked paintings suffice for BridgePure to remove Glaze and Mist protection cloaks from fine-tuning data for Stable Diffusion while preserving brushstrokes. The paper also reports that 500 leaked pairs are more damaging than diluting a protected dataset with 4,000 unprotected images.

Load-bearing premise

The argument requires that the adversary's small unprotected dataset come from the same distribution as the protected data and that the protection service apply the same transformation to both; when either fails, the paper's own cross-distribution tests show purification degrades sharply.

Editorial extensions

If this is right

  • If the paper is right, a black-box protection API is itself a bypass: anyone who can query it with a few hundred in-distribution images can undo protection on much larger unseen datasets.
  • Models trained on BridgePure-purified data regain near-original accuracy, so availability attacks offer little protection once any unprotected sample from the same distribution has leaked.
  • Style protections that work by cloaking fine-tuning data can be neutralized with as few as 5--10 leaked paintings, without pre-training a large diffusion model.
  • Because 500 leaked pairs outperform 4,000 diluted unprotected images, the risk is not mere data contamination but explicit inversion of the protection mechanism.
  • Partial leakage is enough to target specific classes: a handful of pairs per class can bring that class's accuracy above the unprotected baseline.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the same paired-query attack should apply to any deterministic, queryable per-sample protection, so APIs should randomize or authenticate before returning protected versions; the effectiveness of such a countermeasure is directly measurable by running BridgePure against it.
  • Editorial inference: the strong dependence on distribution match suggests an adversarial data owner could defend by making the public or leaked portion of their data distributionally distinct from the protected portion, for example time-shifted or style-shifted.
  • Editorial inference: BridgePure learns a per-protection inverse, so mixing multiple mechanisms may raise the required leakage; the paper's mixture experiment indicates that mixing alone still does not stop a moderate number of pairs.
  • Editorial inference: because the bridge is trained from scratch, the attack's cost is dominated by training time, so future protections should be evaluated not only against pre-trained diffusion purifiers but against adversaries who can train a small bridge on their own leaked pairs.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes BridgePure, a purification method that trains a denoising diffusion bridge model (DDBM) on (unprotected, protected) image pairs obtained by querying a black-box data protection API with a small unprotected dataset Da. It claims that the resulting model can approximately invert the protection mechanism P on unseen protected data, restoring the accuracy of downstream classifiers to near-original levels and removing style-mimicry protection from artwork. The paper evaluates BridgePure against nine availability attacks on CIFAR-10/100, three attacks on ImageNet-Subset and WebFace-Subset, two label-agnostic attacks on Cars/Pets, and two style-mimicry protections (Glaze and Mist), comparing against prior purification baselines and augmentation-based defenses.

Significance. If the central claim holds, the paper identifies a practically important vulnerability: black-box data protection services can be undermined by an adversary who possesses a small amount of unprotected in-distribution data and can query the protection API. The paper is commendable for its breadth of experiments, including multiple datasets, attacks, and architectures, and for its transparent discussion of the leakage setup in Appendices B.2 and C.12. It also provides useful ablations on the leakage amount, hyperparameters s and beta, partial leakage, and protection mixtures. However, two issues currently limit the force of the headline claim: the main experiments use a stronger same-run leakage for several dataset-dependent attacks, and the reported results select hyperparameters using test accuracy. These are fixable with additional experiments or scoped claims, but they are load-bearing for the stated threat model.

major comments (3)
  1. [Section 3, Appendix B.2, Appendix C.12, Tables 1 and 2] The threat model in Section 3 states that the adversary queries P with Da alone to obtain paired data bDa. However, for dataset-dependent protections such as EM, REM, DC, GUE, NTGA, and TAP, the protection transformation is optimized on the dataset it protects, so querying P on Da alone may yield a different transformation than the one applied to D. The main experimental protocol (Appendix B.2) generates protection on the combination of the protection set and the reference set, and extracts pairs from the protected reference set, which is a same-run leakage that is strictly stronger than the stated black-box query assumption. Tables 1 and 2 therefore do not establish the claimed attack for these protections. Appendix C.12 provides independent-query variants for only EMC*, OPS*, and TAP*, and the TAP* results in Table 9 are materially lower than the corresponding entries in Table 1 (e.g., 80.20% vs 86.81% at 0.5K on CIFAR-10). The authors should either provide independent-query evaluations for all dataset-dependent attacks in the main tables, or explicitly scope the claims to the same-run leakage setting.
  2. [Section 5.1, Section 5.4, Tables 1 and 3] The main results report 'BridgePure's best performance across four configurations: s in {0.33, 0.8} and beta in {0, 0.02}' (Section 5.1), and Section 5.4 states that the paper reports 'the best-performing BridgePure within a limited number of trials.' This is a post-hoc selection on test accuracy, which inflates the reported numbers and creates an unfair comparison with baselines that are not given the same selection procedure. The authors should either tune hyperparameters on a validation split derived from the leakage pairs, or report the results for all configurations and the selection rule. At minimum, the main tables should indicate which s and beta were used for each attack.
  3. [Section 5.3, Appendix C.4] The style mimicry evaluation is entirely qualitative: Figures 7, 10, 11, and 12 are visual comparisons, and no quantitative metric (e.g., distance to the original style, LPIPS, or detection rate of protective patterns) is reported. The claim that BridgePure demonstrates 'superior purification performance' on style mimicry tasks therefore rests on visual inspection. A quantitative evaluation would strengthen this part of the paper, especially because the central contribution also covers generation tasks.
minor comments (5)
  1. [Appendix C.10] There is a typo in the first paragraph: 'BidgePure' should be 'BridgePure'.
  2. [References] Reference [16] has a garbled title: 'Witches' Brew: ial Scale Data Poisoning via Gradient Matching' should likely be 'Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching'.
  3. [Section 5.4] The sentence 'Our results in this section reveal the worst-case damage caused by protection leakage by reporting the best-performing BridgePure' is confusing: reporting the best-performing configuration reveals the best-case for the adversary, not the worst-case. Please rephrase to avoid ambiguity.
  4. [Appendix C.12] The first sentence, 'Note that our threat model assumes that the protection mechanism P can generate (unprotected, protected) pairs using only the additional data Da,' is misleading: in the threat model, the adversary generates pairs by querying P, rather than P generating pairs on its own. Please rephrase.
  5. [Section 2.3, Eq. (5)] In Eq. (5), the conditioning variable is written as xT, but in the bridge setup xT is the fixed protected endpoint. Using x' instead of xT for the conditioning variable in s_theta and in the score notation would clarify the distinction between time index and data endpoint.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: BridgePure's purification is an independently evaluated empirical attack; the same-run leakage and best-of-hyperparameter reporting are soundness limitations, not circular reasoning.

full rationale

BridgePure's derivation chain is empirical and not circular. The method trains a denoising diffusion bridge model with the standard score-matching objective (eq. 5) on (x, P(x)) pairs and then purifies protected endpoints by conditional sampling; the reported accuracies come from training a fresh classifier on purified data and testing on a held-out test set. The target result (downstream accuracy) is not used to define the training loss, so success is not forced by construction. The main experimental caveat is that for dataset-dependent attacks (EM, REM, DC, GUE, NTGA, and partly TAP), Appendix B.2 states that protection is generated on the combination of the protection set and the reference set, so the paired data come from the same protection run as D rather than from an independent query of P on Da alone. This is a threat-model/soundness limitation, and the authors partially acknowledge it in Appendix C.12 ('performing the protections on D and Da separately may result in different protection mechanisms') and provide Da-only variants (EMC*, OPS*, TAP*). Similarly, reporting the best of s in {0.33, 0.8} and beta in {0, 0.02} in Section 5.1 is a selection-bias concern, not a circular reduction, because the evaluation metric is independently measured. No load-bearing self-citation appears: DDBM is an external method [76], and the availability attacks are treated as fixed benchmarks. Therefore no circular step is identified.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new physical or mathematical entities. Its two main free parameters (s and beta) are test-set-tuned, which is the key caveat in interpreting the quantitative claims. The other assumptions are standard domain assumptions about the black-box protection query and distribution match.

free parameters (2)
  • s (sampling randomness) = 0.33 or 0.8 (chosen per attack as best on test)
    Controls the stochasticity of BridgePure's ODE sampling. The paper selects s per attack to maximize purified accuracy on the test set (Section 5.1, Section 5.4), making it a tuned parameter that directly affects reported performance.
  • beta (pre-processing Gaussian noise) = 0 or 0.02 (chosen per attack)
    Gaussian perturbation applied to protected data before training and purification, intended to reduce overfitting with limited pairs. Selected per attack based on test accuracy, so it is a fitted hyperparameter.
assumptions (3)
  • domain assumption The protection mechanism P can be queried freely by an adversary without ownership verification, yielding valid (x, P(x)) pairs.
    Core to the threat model. If protection APIs required proof of ownership, the attack would be infeasible. Stated in Section 3.
  • domain assumption The adversary's unprotected set Da is drawn from the same distribution as the protected set D.
    BridgePure's generalization depends on distribution match. Cross-distribution results in Appendix C.10 show limited transfer, confirming this premise is load-bearing.
  • domain assumption The denoising diffusion bridge model (DDBM, Zhou et al., 2024) provides a valid score-matching objective for learning the inverse map.
    BridgePure builds directly on DDBM without re-deriving its correctness; the paper relies on the published framework. Invoked in Sections 2.3 and 4.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection." pith.science (2026). https://pith.science/paper/ACTYZOOA

@misc{pith2026241221061,
  author       = {Pith},
  title        = {Pith review of: BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ACTYZOOA}},
  note         = {Machine review of arXiv:2412.21061}
}
read the original abstract

Availability attacks, or unlearnable examples, are defensive techniques that allow data owners to modify their datasets in ways that prevent unauthorized machine learning models from learning effectively while maintaining the data's intended functionality. It has led to the release of popular black-box tools (e.g., APIs) for users to upload personal data and receive protected counterparts. In this work, we show that such black-box protections can be substantially compromised if a small set of unprotected in-distribution data is available. Specifically, we propose a novel threat model of protection leakage, where an adversary can (1) easily acquire (unprotected, protected) pairs by querying the black-box protections with a small unprotected dataset; and (2) train a diffusion bridge model to build a mapping between unprotected and protected data. This mapping, termed BridgePure, can effectively remove the protection from any previously unseen data within the same distribution. BridgePure demonstrates superior purification performance on classification and style mimicry tasks, exposing critical vulnerabilities in black-box data protection. We suggest that practitioners implement multi-level countermeasures to mitigate such risks.

Figures

Figures reproduced from arXiv: 2412.21061 by the authors.

Figure 1
Figure 1. The threat model and illustration of BridgePure. Se [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Performance comparison with augmentation-based methods, and protection dilution on CIFAR-100. Moreover, Figures 2 and 14 demonstrate that BridgePure consistently outperforms eight augmentation￾based circumvention methods. (See Appendix C.6 for a detailed illustration of this comparison.). We also con￾sidered the scenario where the adversary dilutes the pro￾tected dataset with a sufficiently large amount of unpro￾tec… view at source ↗
Figure 4
Figure 4. PSNR and SSIM between processed datasets and [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figures from the paper (14 more)
Figure 5
Figure 5. Figure 5: Purification outcomes on UC-protected Cars. The [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Performance with partial protection leakage within 10 [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Purification performance of BridgePure-5 ( [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Influence of s and β on BridgePure-1K performance on CIFAR-10 (left) and CIFAR-100 (right) [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: Visualization of our BridgePure-1K on CIFAR-10 ( [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]
Figure 10
Figure 10. Figure 10: Additional results to Figure [PITH_FULL_IMAGE:figures/full_fig_p021_10.png]
Figure 11
Figure 11. Figure 11: Paintings purified by recent purification methods and BridgePure-10. [PITH_FULL_IMAGE:figures/full_fig_p022_11.png]
Figure 12
Figure 12. Figure 12: Comparison of purified painting details (cropped from Figure [PITH_FULL_IMAGE:figures/full_fig_p023_12.png]
Figure 13
Figure 13. Figure 13: Purification performance of BridgePure with small protection leakages to purify LSP-protected [PITH_FULL_IMAGE:figures/full_fig_p024_13.png]
Figure 14
Figure 14. Figure 14: Performance comparison with augmentation-based methods, and protection dilution on CIFAR [PITH_FULL_IMAGE:figures/full_fig_p024_14.png]
Figure 15
Figure 15. Figure 15: Transferablity of BridgePure-4K across different protections on CIFAR-10. The [PITH_FULL_IMAGE:figures/full_fig_p026_15.png]
Figure 16
Figure 16. Figure 16: Transferability across style mimicry protections. [PITH_FULL_IMAGE:figures/full_fig_p028_16.png]
Figure 17
Figure 17. Figure 17: Transferability across datasets for style mimicry. We train BridgePure-10 on Monet’s paintings [PITH_FULL_IMAGE:figures/full_fig_p029_17.png]
Figure 18
Figure 18. Figure 18: Comparison between VP and VE modes of BridgePure-1K with [PITH_FULL_IMAGE:figures/full_fig_p029_18.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

79 extracted references · 72 canonical work pages

  1. [1]

    Bullseye polytope: A scalable clean- label poisoning attack with improved transferability

    H. Aghakhani, D. Meng, Y.-X. Wang, C. Kruegel, and G. Vigna. “Bullseye polytope: A scalable clean- label poisoning attack with improved transferability”. In:IEEE European Symposium on Security and Privacy (EuroS&P). 2021, pp. 159–178

    work page 2021

  2. [2]

    Poisoning attacks against support vector machines

    B. Biggio, B. Nelson, and P. Laskov. “Poisoning attacks against support vector machines”. In:Proceed- ings of the 29th International Conference on Machine Learning (ICML). 2012, pp. 1467–1474

    work page 2012

  3. [3]

    Impress: Evaluating the Resilience of Imperceptible Perturbations against Unauthorized Data Usage in Diffusion-Based Generative Ai

    B. Cao, C. Li, T. Wang, J. Jia, B. Li, and J. Chen. “Impress: Evaluating the Resilience of Imperceptible Perturbations against Unauthorized Data Usage in Diffusion-Based Generative Ai”.Advances in Neural Information Processing Systems, vol. 36 (2023), pp. 10657–10677

    work page 2023

  4. [4]

    One for All: A Universal Generator for Concept Unlearnability via Multi-Modal Alignment

    C. Chen, J. Zhang, Y. Li, and Z. Han. “One for All: A Universal Generator for Concept Unlearnability via Multi-Modal Alignment”. In:Forty-first International Conference on Machine Learning. 2024

    work page 2024

  5. [5]

    Self-Ensemble Protec- tion: Training Checkpoints Are Good Data Protectors

    S. Chen, G. Yuan, X. Cheng, Y. Gong, M. Qin, Y. Wang, and X. Huang. “Self-Ensemble Protec- tion: Training Checkpoints Are Good Data Protectors”. In:The Eleventh International Conference on Learning Representations. 2023

    work page 2023

  6. [6]

    A simple framework for contrastive learning of visual representations

    T. Chen, S. Kornblith, M. Norouzi, and G. Hinton. “A simple framework for contrastive learning of visual representations”. In:International conference on machine learning. PMLR. 2020, pp. 1597–1607

    work page 2020

  7. [7]

    Targeted backdoor attacks on deep learning systems using data poisoning

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song. “Targeted backdoor attacks on deep learning systems using data poisoning”. arXiv:1712.05526. 2017

    arXiv 2017

  8. [8]

    Imagenet: A large-scale hierarchical image database

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. “Imagenet: A large-scale hierarchical image database”. In: 2009 IEEE conference on computer vision and pattern recognition. Ieee. 2009, pp. 248–255

    work page 2009

Show all 79 references
  1. [9]

    The devil’s advocate: Shattering the illusion of unex- ploitable data using diffusion models

    H. M. Dolatabadi, S. Erfani, and C. Leckie. “The devil’s advocate: Shattering the illusion of unex- ploitable data using diffusion models”. In:2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). IEEE. 2024, pp. 358–386

    2024

  2. [10]

    Classical potential theory and its probabilistic counterpart

    J. L. Doob. “Classical potential theory and its probabilistic counterpart”. Vol. 262. Springer, 1984

    1984

  3. [11]

    An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale

    A. Dosovitskiy et al. “An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale”. In: International Conference on Learning Representations. 2021

    2021

  4. [12]

    Collapsing the Learning: Crafting Broadly Transferable Unlearnable Examples

    B. Fang, B. Li, S. Wu, S. Ding, T. Zheng, R. Yi, and L. Ma. “Collapsing the Learning: Crafting Broadly Transferable Unlearnable Examples”. 2024

    2024

  5. [13]

    Learning to confuse: Generating training time adversarial data with auto-encoder

    J. Feng, Q.-Z. Cai, and Z.-H. Zhou. “Learning to confuse: Generating training time adversarial data with auto-encoder”.Advances in Neural Information Processing Systems, vol. 32 (2019)

    2019

  6. [14]

    Adversarial examples makestrongpoisons

    L. Fowl, M. Goldblum, P.-y. Chiang, J. Geiping, W. Czaja, and T. Goldstein. “Adversarial examples makestrongpoisons”.In: Advances in Neural Information Processing Systems.Vol.34.2021,pp.30339– 30351

    2021

  7. [15]

    Robust Unlearnable Examples: Protecting Data Privacy Against Adversarial Learning

    S. Fu, F. He, Y. Liu, L. Shen, and D. Tao. “Robust Unlearnable Examples: Protecting Data Privacy Against Adversarial Learning”. In:International Conference on Learning Representations. 2022

    2022

  8. [16]

    Witches’ Brew: ial Scale Data Poisoning via Gradient Matching

    J. Geiping, L. H. Fowl, W. R. Huang, W. Czaja, G. Taylor, M. Moeller, and T. Goldstein. “Witches’ Brew: ial Scale Data Poisoning via Gradient Matching”. In:International Conference on Learning Representations. 2021. 12

    2021

  9. [17]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain

    T. Gu, B. Dolan-Gavitt, and S. Garg. “Badnets: Identifying vulnerabilities in the machine learning model supply chain”. arXiv:1708.06733. 2017

    2017 arXiv

  10. [18]

    Practical Poisoning Attacks on Neural Networks

    J. Guo and C. Liu. “Practical Poisoning Attacks on Neural Networks”. In:European Conference on Computer Vision. 2020, pp. 142–158

    2020

  11. [19]

    Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learn- ing

    H. He, K. Zha, and D. Katabi. “Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learn- ing”. In:The Eleventh International Conference on Learning Representations. 2023

    2023

  12. [20]

    Your Face Belongs to Us: The Secretive Startup Dismantling Your Privacy

    K. Hill. “Your Face Belongs to Us: The Secretive Startup Dismantling Your Privacy”. Simon and Schuster, 2023

    2023

  13. [21]

    Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI

    R. Hönig, J. Rando, N. Carlini, and F. Tramèr. “Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI”.arXiv preprint arXiv:2406.12027(2024)

    2024 arXiv

  14. [22]

    Squeeze-and-excitation networks

    J. Hu, L. Shen, and G. Sun. “Squeeze-and-excitation networks”. In:Proceedings of the IEEE conference on computer vision and pattern recognition. 2018, pp. 7132–7141

    2018

  15. [23]

    Densely connected convolutional networks

    G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger. “Densely connected convolutional networks”. In:Proceedings of the IEEE conference on computer vision and pattern recognition. 2017, pp. 4700–4708

    2017

  16. [24]

    Unlearnable Examples: Making Personal Data Unexploitable

    H. Huang, X. Ma, S. M. Erfani, J. Bailey, and Y. Wang. “Unlearnable Examples: Making Personal Data Unexploitable”. In:ICLR. 2021

    2021

  17. [25]

    Unlearnable examples give a false sense of security: Piercing through unexploitable data with learnable examples

    W. Jiang, Y. Diao, H. Wang, J. Sun, M. Wang, and R. Hong. “Unlearnable examples give a false sense of security: Piercing through unexploitable data with learnable examples”. In:Proceedings of the 31st ACM International Conference on Multimedia. 2023, pp. 8910–8921

    2023

  18. [26]

    Understanding black-box predictions via influence functions

    P. W. Koh and P. Liang. “Understanding black-box predictions via influence functions”. In:Proceedings of the 34th International Conference on Machine Learning (ICML). 2017, pp. 1885–1894

    2017

  19. [27]

    Stronger Data Poisoning Attacks Break Data Sanitization Defenses

    P. W. Koh, J. Steinhardt, and P. Liang. “Stronger Data Poisoning Attacks Break Data Sanitization Defenses”. Machine Learning, vol. 111 (2022), pp. 1–47

    2022

  20. [28]

    3D Object Representations for Fine-Grained Categoriza- tion

    J. Krause, M. Stark, J. Deng, and L. Fei-Fei. “3D Object Representations for Fine-Grained Categoriza- tion”. In:4th International IEEE Workshop on 3D Representation and Recognition (3dRR-13). Sydney, Australia, 2013

    2013

  21. [29]

    Learning multiple layers of features from tiny images

    A. Krizhevsky. “Learning multiple layers of features from tiny images”. tech. report. 2009

    2009

  22. [30]

    Imagenet classification with deep convolutional neural networks

    A. Krizhevsky, I. Sutskever, and G. E. Hinton. “Imagenet classification with deep convolutional neural networks”. Advances in neural information processing systems, vol. 25 (2012)

    2012

  23. [31]

    Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models

    J. Li, D. Li, S. Savarese, and S. Hoi. “Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models”. In:International conference on machine learning. PMLR. 2023, pp. 19730–19742

    2023

  24. [32]

    Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples

    C. Liang, X. Wu, Y. Hua, J. Zhang, Y. Xue, T. Song, Z. Xue, R. Ma, and H. Guan. “Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples”. In: International Conference on Machine Learning. PMLR. 2023, pp. 20763–20786

    2023

  25. [33]

    Game-theoretic unlearnable example generator

    S. Liu, Y. Wang, and X.-S. Gao. “Game-theoretic unlearnable example generator”. In:Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 38. 19. 2024, pp. 21349–21358. 13

    2024

  26. [34]

    Imageshortcutsqueezing:Counteringperturbativeavailabilitypoisons with compression

    Z.Liu,Z.Zhao,andM.Larson.“Imageshortcutsqueezing:Counteringperturbativeavailabilitypoisons with compression”. In:International conference on machine learning. PMLR. 2023, pp. 22473–22487

    2023

  27. [35]

    Deep Learning Face Attributes in the Wild

    Z. Liu, P. Luo, X. Wang, and X. Tang. “Deep Learning Face Attributes in the Wild”. In:Proceedings of International Conference on Computer Vision (ICCV). 2015

    2015

  28. [36]

    Indiscriminate Data Poisoning Attacks on Neural Networks

    Y. Lu, G. Kamath, and Y. Yu. “Indiscriminate Data Poisoning Attacks on Neural Networks”.Trans- actions on Machine Learning Research(2022)

    2022

  29. [37]

    Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks

    Y. Lu, G. Kamath, and Y. Yu. “Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks”. In:Proceedings of the 40th International Conference on Machine Learning. 2023

    2023

  30. [38]

    Indiscriminate Data Poisoning Attacks on Pre-trained Fea- ture Extractors

    Y. Lu, M. Y. Yang, G. Kamath, and Y. Yu. “Indiscriminate Data Poisoning Attacks on Pre-trained Fea- ture Extractors”. In:2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). IEEE. 2024, pp. 327–343

    2024

  31. [39]

    Towards Deep Learning Models Resis- tant to Adversarial Attacks

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. “Towards Deep Learning Models Resis- tant to Adversarial Attacks”. In:International Conference on Learning Representations. 2018

    2018

  32. [40]

    Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization

    L. Muñoz-González, B. Biggio, A. Demontis, A. Paudice, V. Wongrassamee, E. C. Lupu, and F. Roli. “Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization”. In:Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security (AISec). 2017

    2017

  33. [41]

    Image super-resolution as a defense against adversarial attacks

    A. Mustafa, S. H. Khan, M. Hayat, J. Shen, and L. Shao. “Image super-resolution as a defense against adversarial attacks”.IEEE Transactions on Image Processing, vol. 29 (2019), pp. 1711–1724

    2019

  34. [42]

    Diffusion models for adversarial purification

    W. Nie, B. Guo, Y. Huang, C. Xiao, A. Vahdat, and A. Anandkumar. “Diffusion models for adversarial purification”. In:International Conference on Machine Learning (ICML). 2022

    2022

  35. [43]

    Cats and Dogs

    O. M. Parkhi, A. Vedaldi, A. Zisserman, and C. V. Jawahar. “Cats and Dogs”. In:IEEE Conference on Computer Vision and Pattern Recognition. 2012

    2012

  36. [44]

    PureGen: Universal Data Purifica- tion for Train-Time Poison Defense via Generative Model Dynamics

    O. Pooladzandi, S. G. Bhat, J. Jiang, A. Branch, and G. Pottie. “PureGen: Universal Data Purifica- tion for Train-Time Poison Defense via Generative Model Dynamics”. In:The Thirty-eighth Annual Conference on Neural Information Processing Systems. 2024

    2024

  37. [45]

    Learning the unlearnable: Adversarial augmentations suppress unlearnable example attacks

    T. Qin, X. Gao, J. Zhao, K. Ye, and C.-Z. Xu. “Learning the unlearnable: Adversarial augmentations suppress unlearnable example attacks”. In:4th Workshop on Adversarial Robustness In the Real World (AROW), ICCV 2023. 2023

    2023

  38. [46]

    Learning transferable visual models from natural language supervision

    A. Radford et al. “Learning transferable visual models from natural language supervision”. In:Inter- national conference on machine learning. PMLR. 2021, pp. 8748–8763

    2021

  39. [47]

    Data Poisoning Won’t Save You From Facial Recognition

    E. Radiya-Dixit, S. Hong, N. Carlini, and F. Tramer. “Data Poisoning Won’t Save You From Facial Recognition”. In:International Conference on Learning Representations. 2022

    2022

  40. [48]

    Transferable Unlearnable Examples

    J. Ren, H. Xu, Y. Wan, X. Ma, L. Sun, and J. Tang. “Transferable Unlearnable Examples”. In:The Eleventh International Conference on Learning Representations. 2023

    2023

  41. [49]

    Diffusions, Markov processes, and martingales: Itô calculus

    L. C. G. Rogers and D. Williams. “Diffusions, Markov processes, and martingales: Itô calculus”. Vol. 2. Cambridge university press, 2000

    2000

  42. [50]

    High-Resolution Image Synthesis With Latent Diffusion Models

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer. “High-Resolution Image Synthesis With Latent Diffusion Models”. In:Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 2022, pp. 10684–10695. 14

    2022

  43. [51]

    Hidden trigger backdoor attacks

    A. Saha, A. Subramanya, and H. Pirsiavash. “Hidden trigger backdoor attacks”. In:Proceedings of the AAAI Conference on Artificial Intelligence. 2020

    2020

  44. [52]

    Defense-GAN: Protecting Classifiers Against Adver- sarial Attacks Using Generative Models

    P. Samangouei, M. Kabkab, and R. Chellappa. “Defense-GAN: Protecting Classifiers Against Adver- sarial Attacks Using Generative Models”. In:International Conference on Learning Representations. 2018

    2018

  45. [53]

    Mobilenetv2: Inverted residuals and linear bottlenecks

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen. “Mobilenetv2: Inverted residuals and linear bottlenecks”. In:Proceedings of the IEEE conference on computer vision and pattern recognition. 2018, pp. 4510–4520

    2018

  46. [54]

    Autoregressive Perturbations for Data Poisoning

    P. Sandoval-Segura, V. Singla, J. Geiping, M. Goldblum, T. Goldstein, and D. Jacobs. “Autoregressive Perturbations for Data Poisoning”. In:Advances in Neural Information Processing Systems. Ed. by S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh. Vol. 35. Curr...

    2022

  47. [55]

    PoisonFrogs! Targeted Clean-Label Poisoning Attacks on Neural Networks

    A.Shafahi,W.R.Huang,M.Najibi,O.Suciu,C.Studer,T.Dumitras,andT.Goldstein.“PoisonFrogs! Targeted Clean-Label Poisoning Attacks on Neural Networks”. In:Advances in Neural Information Processing Systems (NeurIPS). 2018, pp. 6103–6113

    2018

  48. [56]

    Glaze: Protecting artists from style mimicry by{Text-to-Image} models

    S. Shan, J. Cryan, E. Wenger, H. Zheng, R. Hanocka, and B. Y. Zhao. “Glaze: Protecting artists from style mimicry by{Text-to-Image} models”. In:32nd USENIX Security Symposium (USENIX Security 23). 2023, pp. 2187–2204

    2023

  49. [57]

    Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models

    S. Shan, W. Ding, J. Passananti, S. Wu, H. Zheng, and B. Y. Zhao. “Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models”. In:2024 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society. 2024, pp. 212–212

    2024

  50. [58]

    Fawkes: Protecting privacy against unauthorized deep learning models

    S. Shan, E. Wenger, J. Zhang, H. Li, H. Zheng, and B. Y. Zhao. “Fawkes: Protecting privacy against unauthorized deep learning models”. In: 29th USENIX security symposium (USENIX Security 20). 2020, pp. 1589–1604

    2020

  51. [59]

    Online Adversarial Purification based on Self-supervised Learning

    C. Shi, C. Holtz, and G. Mishne. “Online Adversarial Purification based on Self-supervised Learning”. In: International Conference on Learning Representations. 2021

    2021

  52. [60]

    Score-Based Gener- ative Modeling through Stochastic Differential Equations

    Y. Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole. “Score-Based Gener- ative Modeling through Stochastic Differential Equations”. In:International Conference on Learning Representations. 2021

    2021

  53. [61]

    Model-targeted poisoning attacks with provable convergence

    F. Suya, S. Mahloujifar, A. Suri, D. Evans, and Y. Tian. “Model-targeted poisoning attacks with provable convergence”. In: Proceedings of the 38th International Conference on Machine Learning. 2021, pp. 10000–10010

    2021

  54. [62]

    Better safe than sorry: Preventing delusive adver- saries with adversarial training

    L. Tao, L. Feng, J. Yi, S.-J. Huang, and S. Chen. “Better safe than sorry: Preventing delusive adver- saries with adversarial training”.Advances in Neural Information Processing Systems, vol. 34 (2021), pp. 16209–16225

    2021

  55. [63]

    Going deeper with image trans- formers

    H. Touvron, M. Cord, A. Sablayrolles, G. Synnaeve, and H. Jégou. “Going deeper with image trans- formers”. In:Proceedings of the IEEE/CVF international conference on computer vision. 2021, pp. 32– 42

    2021

  56. [64]

    Spectral Signatures in Backdoor Attacks

    B. Tran, J. Li, and A. Madry. “Spectral Signatures in Backdoor Attacks”. In: Advances in Neural Information Processing Systems (NeurIPS). 2018. 15

    2018

  57. [65]

    Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneously

    Y. Wang, Y. Zhu, and X.-S. Gao. “Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneously”. In:The Thirty-eighth Annual Conference on Neural Information Processing Systems. 2024

    2024

  58. [66]

    Is Adversarial Training Really a Silver Bullet for Mitigating Data Poisoning?

    R. Wen, Z. Zhao, Z. Liu, M. Backes, T. Wang, and Y. Zhang. “Is Adversarial Training Really a Silver Bullet for Mitigating Data Poisoning?” In:The Eleventh International Conference on Learning Representations. 2023

    2023

  59. [67]

    One-Pixel Shortcut: On the Learning Preference of Deep Neural Networks

    S. Wu, S. Chen, C. Xie, and X. Huang. “One-Pixel Shortcut: On the Learning Preference of Deep Neural Networks”. In:The Eleventh International Conference on Learning Representations. 2023

    2023

  60. [68]

    Pixel is a barrier: Diffusion models are more adversarially robust than we think

    H. Xue and Y. Chen. “Pixel is a barrier: Diffusion models are more adversarially robust than we think”. arXiv preprint arXiv:2404.13320(2024)

    2024 arXiv

  61. [69]

    Learning face representation from scratch

    D. Yi, Z. Lei, S. Liao, and S. Z. Li. “Learning face representation from scratch”. arXiv preprint arXiv:1411.7923 (2014)

    2014 arXiv

  62. [70]

    Adversarial purification with score-based generative models

    J. Yoon, S. J. Hwang, and J. Lee. “Adversarial purification with score-based generative models”. In: International Conference on Machine Learning. PMLR. 2021, pp. 12062–12072

    2021

  63. [71]

    Availabilityattackscreateshortcuts

    D.Yu,H.Zhang,W.Chen,J.Yin,andT.-Y.Liu.“Availabilityattackscreateshortcuts”.In: Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 2022, pp. 2367–2376

    2022

  64. [72]

    Purify Unlearnable Examples via Rate-Constrained Variational Autoencoders

    Y. Yu, Y. Wang, S. Xia, W. Yang, S. Lu, Y.-p. Tan, and A. Kot. “Purify Unlearnable Examples via Rate-Constrained Variational Autoencoders”. In:Forty-first International Conference on Machine Learning. 2024

    2024

  65. [73]

    Neural Tangent Generalization Attacks

    C.-H. Yuan and S.-H. Wu. “Neural Tangent Generalization Attacks”. In:International Conference on Machine Learning. PMLR. 2021, pp. 12230–12240

    2021

  66. [74]

    Unlearnableclusters:Towardslabel- agnostic unlearnable examples

    J.Zhang,X.Ma,Q.Yi,J.Sang,Y.-G.Jiang,Y.Wang,andC.Xu.“Unlearnableclusters:Towardslabel- agnostic unlearnable examples”. In:Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023, pp. 3984–3993

    2023

  67. [75]

    Can protective perturbation safeguard personal data from being exploited by stable diffusion?

    Z. Zhao, J. Duan, K. Xu, C. Wang, R. Zhang, Z. Du, Q. Guo, and X. Hu. “Can protective perturbation safeguard personal data from being exploited by stable diffusion?” In:Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024, pp. 24398–24407

    2024

  68. [76]

    Denoising Diffusion Bridge Models

    L. Zhou, A. Lou, S. Khanna, and S. Ermon. “Denoising Diffusion Bridge Models”. In:The Twelfth International Conference on Learning Representations. 2024

    2024

  69. [77]

    Transferableclean-label poisoning attacks on deep neural nets

    C. Zhu, W. R. Huang, H.Li,G. Taylor, C. Studer, and T.Goldstein. “Transferableclean-label poisoning attacks on deep neural nets”. In:International Conference on Machine Learning. 2019, pp. 7614–7623

    2019

  70. [78]

    Detection and defense of unlearnable examples

    Y. Zhu, L. Yu, and X.-S. Gao. “Detection and defense of unlearnable examples”. In:Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 38. 15. 2024, pp. 17211–17219. 16 A Data Protection and Data Poisoning Attacks In this section, we formalize the relationship b...

    2024

  71. [100]

    C.7 Mixture of Protection The mechanism P could possibly employ multiple availability attacks to protect data

    With the same number of accessible unprotected images, BridgePure shows much better availability restoration than dilution. C.7 Mixture of Protection The mechanism P could possibly employ multiple availability attacks to protect data. In such cases, the protection leakage also...

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.