Pith. sign in

REVIEW 3 major objections 5 minor 53 references

T2UE: Generating Unlearnable Examples from Text Descriptions

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read T2UE generates unlearnable noise from text captions alone, so users can protect images from CLIP training without ever exposing the images.

desk verdict Novel zero-contact UE method with real evidence of protective effect, but the missing no-text control and the Table 7 failure undercut the central text-conditioning claim. read the letter →

arxiv 2508.03091 v1 pith:KCSTSFI2 submitted 2025-08-05 cs.AI cs.CRcs.CV

Xingjun Ma , Hanxun Huang , Tianwei Song , Ye Sun , Yifeng Gao , Yu-Gang Jiang This is my paper
classification cs.AIcs.CRcs.CV
keywords unlearnableexamplesdataprotectionCLIPtext-to-imagegenerationcontrastivelearningprivacyzero-contacttext-guidednoise
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

T2UE claims that unlearnable examples—noise added to images so that models cannot learn from them—can be generated from the text description alone, without access to the image being protected. The paper's goal is to break the privacy paradox in which protecting data requires first exposing it to a third-party service. It trains a text-conditioned generator against a frozen CLIP model, minimizing the InfoNCE contrastive loss so that the noise it produces makes protected image-text pairs align incorrectly. The claim is that this text-only noise transfers to arbitrary images and to models trained from scratch, degrading cross-modal retrieval and also supervised classification. If true, users could protect personal photos by sharing only captions.

What carries the argument

The machinery is a text-guided generator adapted from Semantic-Space-Aware GAN (SSA-GAN), whose Semantic-Space Conditional Batch Normalization (SSCBN) blocks let a text embedding predict per-channel scale and shift parameters that modulate intermediate feature maps. A frozen CLIP image-text encoder pair serves as the surrogate: the generator is trained to minimize the symmetric InfoNCE loss on protected pairs, producing image-independent noise that is semantically tied to the caption. The generated perturbation is bounded by $\epsilon = 8/255$ and is added directly to any target image at protection time.

What would settle it

Train a CLIP model from scratch on T2UE-protected data where each image is paired with a randomly mismatched caption, or where the protected images come from a dataset disjoint from the generator's training data, such as medical or satellite images. If retrieval and classification accuracy stays near the no-protection level, the claim that text-only noise transfers to arbitrary images is refuted. Similarly, if paraphrasing the captions at protection time restores performance, the semantic link between text and noise is not load-bearing.

Watch

Extended reading notes

Core claim

The paper's central claim is that a mapping from text semantics to unlearnable perturbation space is sufficient to render multimodal data unexploitable. The generator $G$ takes a CLIP text embedding and a random latent, outputs a noise $\delta_u = G(\mathrm{emb}_t, z; \theta_G)$ with $\|\delta_u\|_\infty \le \epsilon$, and never sees the image $I$. Training minimizes the surrogate InfoNCE loss over protected pairs $(I+\delta_u, T)$, which teaches downstream models to latch onto the text-conditioned noise as a shortcut instead of the true image-text relationship. The paper demonstrates this protection on Flickr8k, Flickr30k, and Tiny-MSCOCO for CLIP-style contrastive pretraining, and shows the same noise transfers to supervised classification on CIFAR-10, CIFAR-100, and STL-10.

Load-bearing premise

The load-bearing premise is that image-independent noise, generated from a caption alone, reliably creates a strong shortcut for any image and for models trained from scratch on unseen datasets; if the noise only works when caption and image match, or only on the generator's training distribution, the zero-contact claim weakens.

Editorial extensions

If this is right

  • A user can generate protective noise from a text caption alone, so the original image never needs to leave the user's device or be uploaded to a third party.
  • Noise produced for CLIP also degrades standard supervised classifiers, so the same generator protects against multiple training paradigms.
  • The protection transfers across ResNet, VGG, GoogLeNet, DenseNet, and ViT backbones, not just the surrogate used to train the generator.
  • The effect survives data augmentations like CutOut, MixUp, and AutoAugment, and remains strong as the poisoning ratio increases.
  • Generating noise with T2UE is cheaper than existing UE methods, for example 0.3 hours versus 1.1-10.2 hours on Flickr8k in the reported setup.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A practical corollary the paper leaves implicit is that the trained generator itself becomes the sensitive artifact: whoever holds it can produce protective noise for captions it has never seen, so distributing the generator is itself a privacy decision.
  • The same text-to-perturbation mechanism could extend to other contrastive modalities such as audio-text or video-text, provided a frozen surrogate contrastive model and a text encoder exist.
  • The paper's results also imply an adversary could use guessed or scraped captions to poison images without access to the images, shifting the practical threat from image leakage to caption leakage.
  • A testable consequence of the transfer claim is that the noise should remain potent on images whose content does not match the text; the paper only tests this indirectly through dataset-level transfer.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes T2UE, a framework for generating unlearnable examples (UEs) for multimodal data using only text descriptions. A generator network maps a frozen CLIP text embedding and a random latent to an image perturbation, trained on MSCOCO by minimizing the InfoNCE loss of a frozen CLIP surrogate (Eq. 4). The resulting noise is applied to arbitrary images without access to them, giving the claimed “zero-contact” protection. Experiments evaluate CLIP retrieval on Flickr8k, Flickr30k, and Tiny-MSCOCO, supervised classification on CIFAR-10/100 and STL-10, transfer across architectures, robustness to augmentations and mixed poisoning ratios, and generation time compared with baselines. The core claim is that text-only, image-independent perturbations can render protected data unexploitable for contrastive pre-training and supervised learning.

Significance. If substantiated, the contribution is practically relevant: it decouples UE generation from the original image, removing a privacy paradox in which users must expose data to obtain protection. The paper provides extensive tables, a useful efficiency comparison, and cross-architecture transfer results. The central idea is plausible and the evaluation is broad. However, the evidence is currently incomplete in load-bearing ways: no control isolates whether text conditioning is the operative mechanism, the varied-text experiment contradicts the robustness claim, and one evaluation dataset overlaps with the generator training data. These issues prevent acceptance as is, but they are addressable within the manuscript's scope.

major comments (3)
  1. [§3.2, Tables 2 and 3] The central claim is that the learned text-to-perturbation mapping (Eq. 4) is what makes protected data unexploitable. However, no experiment compares T2UE against a control with text conditioning removed, e.g., δ = G(z) with emb_t replaced by a constant or random vector, or against random noise at the same ε = 8/255 bound. Without such a control, the degradations in Tables 2 and 3 could plausibly be caused by the mere presence of a bounded perturbation rather than by semantic alignment with the text. This is load-bearing because random noise would also be zero-contact and much cheaper, and it would undermine the necessity of the proposed text-guided generator. Please add these control conditions to the main retrieval and classification tables.
  2. [§4.2, Table 7] Table 7 is the experiment for “varying text descriptions” and is claimed to show that T2UE is robust to text variations. The Flickr8k row contradicts this: for image-to-text retrieval, Hit@10 with T2UE is 5.6 versus 5.4 for clean data, i.e., the protected model is no worse than the clean model (and slightly better), and the text-to-image Hit@10 drop is only 5.2 to 4.92. This means the protective effect essentially disappears under GIT-generated varied captions on this dataset. The paper needs to explain this failure, report variance or significance, or narrow the robustness claim accordingly.
  3. [§4, Table 2] The generator is trained on MSCOCO, and the main evaluation in Table 2 includes Tiny-MSCOCO. If Tiny-MSCOCO is a subset drawn from MSCOCO, this row is not an out-of-distribution transfer test and overstates the generalization of the method; the transfer claim should be based on Flickr8k and Flickr30k or on a disjoint held-out MSCOCO split. Please clarify the exact relationship between Tiny-MSCOCO and the generator training data; if there is overlap, remove or re-label the Tiny-MSCOCO result.
minor comments (5)
  1. [§3.2, Eq. (4)] The notation is inconsistent: Eq. (4) defines δ_u, but the following paragraph uses δ′, and δ and δ_u are used interchangeably. Please unify the notation.
  2. [§4.2, Table 5] The Table 5 caption says the experiments use ResNet-50, while the text in §4.2 says ResNet-18. One of these is incorrect and should be fixed.
  3. [Table 2 and Figure 2] There are typos: Table 2 has “Flick8k” instead of “Flickr8k”, and Figure 2 repeats “A phot of cat”. Please proofread.
  4. [Table 4] In the ResNet-50 block for T2UE(ViT/B-32) on CIFAR-10, the class-wise and sample-wise columns both list 10.41; this is likely a typo and should be checked against the raw results.
  5. [§4.2, Table 7] Table 7 reports no baselines, no confidence intervals, and no details on the GIT-generated descriptions (how many per image, how they were matched to images, whether results are averaged over runs). Please specify the protocol and, ideally, report standard deviations.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the Eq. 4 optimization is a training objective, and the main claims are checked by training fresh models out-of-sample.

full rationale

The paper's derivation chain has three load-bearing moves. First, it defines a text-conditioned generator delta_u = G(emb_t, z; theta_G) (Eq. 1) and trains it with Eq. 4 to minimize a surrogate CLIP InfoNCE loss on protected image-text pairs. This is a training objective, not an evaluation outcome; nothing in Eq. 4 forces the later retrieval or classification numbers by construction. Second, the protected data are evaluated by training new CLIP models from scratch on Flickr8k, Flickr30k, and Tiny-MSCOCO, and by training ResNet/VGG/GoogLeNet/DenseNet models on CIFAR-10/100 and STL-10; these are datasets and architectures not used in optimizing theta_G, so the reported degradations are out-of-sample empirical measurements. Third, the use of the error-minimization framework and hyperparameters cites [16], whose author list overlaps with the present paper, but [16] is a published, externally evaluated method used as a component, not as an authority that forecloses alternatives; no uniqueness theorem is imported. The class-wise supervised variant uses fixed text templates and fixed z, so it produces a per-class constant perturbation; this is the known shortcut mechanism cited in prior work, but the paper does not present a derivation that assumes the conclusion. The paper's own limitation section acknowledges sensitivity to prompt quality, but that is an effectiveness limitation, not a circular step. The skeptic's point about the absence of a text-ablated or random-noise control is a legitimate experimental-attribution gap: the paper has not shown that semantic text conditioning, rather than mere perturbation magnitude, is the operative cause. However, it is not an equation-level circularity. Under the required standard of exhibiting a specific reduction of a prediction to its inputs, no such reduction is present in the manuscript.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central claim relies on the generator generalizing from MSCOCO to unseen datasets and on the frozen CLIP surrogate being a valid proxy for a from-scratch attacker, neither of which is proven. One test set (Tiny-MSCOCO) overlaps with training, weakening the generalization evidence. The noise bound and unspecified prompt templates are additional under-specified choices.

free parameters (3)
  • Noise bound epsilon = 8/255
    Hand-chosen bound on the infinity norm of the generated perturbation; affects visibility and protective strength, not tuned in the paper.
  • CIFAR text prompts = Not specified
    The paper uses text descriptions for CIFAR-10/100 but never states the exact prompt templates or latent sampling procedure for class-wise and sample-wise patterns, making the protection recipe partly underdetermined.
  • Generator hyperparameters = batch 128, lr 1e-4, 300/500 epochs
    Training setup for the generator; standard choices but the paper does not study sensitivity.
assumptions (3)
  • standard math InfoNCE is the attacker's training objective
    Used in Eq. 3 to define the contrastive learning objective that T2UE disrupts.
  • domain assumption A frozen pre-trained CLIP is a faithful proxy for a model trained from scratch on protected data
    Used throughout Section 3.2 to justify optimizing against the surrogate; the transfer to from-scratch training is empirical, not proven.
  • domain assumption Noise delta_u independent of the image content still creates a learnable shortcut
    Core premise of zero-contact protection, tested in Section 4.1 but only on three datasets, one of which overlaps with training.

how reviews work

0 comments
Cite this review

Pith. "Pith review of T2UE: Generating Unlearnable Examples from Text Descriptions." pith.science (2026). https://pith.science/paper/KCSTSFI2

@misc{pith2026250803091,
  author       = {Pith},
  title        = {Pith review of: T2UE: Generating Unlearnable Examples from Text Descriptions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KCSTSFI2}},
  note         = {Machine review of arXiv:2508.03091}
}
read the original abstract

Large-scale pre-training frameworks like CLIP have revolutionized multimodal learning, but their reliance on web-scraped datasets, frequently containing private user data, raises serious concerns about misuse. Unlearnable Examples (UEs) have emerged as a promising countermeasure against unauthorized model training, employing carefully crafted unlearnable noise to disrupt the learning of meaningful representations from protected data. Current approaches typically generate UEs by jointly optimizing unlearnable noise for both images and their associated text descriptions (or labels). However, this optimization process is often computationally prohibitive for on-device execution, forcing reliance on external third-party services. This creates a fundamental privacy paradox: users must initially expose their data to these very services to achieve protection, thereby compromising privacy in the process. Such a contradiction has severely hindered the development of practical, scalable data protection solutions. To resolve this paradox, we introduce \textbf{Text-to-Unlearnable Example (T2UE)}, a novel framework that enables users to generate UEs using only text descriptions. T2UE circumvents the need for original image data by employing a text-to-image (T2I) model to map text descriptions into the image (noise) space, combined with an error-minimization framework to produce effective unlearnable noise. Extensive experiments show that T2UE-protected data substantially degrades performance in downstream tasks (e.g., cross-modal retrieval) for state-of-the-art models. Notably, the protective effect generalizes across diverse architectures and even to supervised learning settings. Our work demonstrates the feasibility of "zero-contact data protection", where personal data can be safeguarded based solely on their textual descriptions, eliminating the need for direct data exposure.

Figures

Figures reproduced from arXiv: 2508.03091 by the authors.

Figure 1
Figure 1. Illustration of our T2UE data protection approach. Existing image-dependent methods [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. An overview of our proposed T2UE framework, which leverages text description embed [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Architecture of T2UE generation model. 3.1 T2UE Generator Architecture To achieve the mapping from text semantics to unlearnable noise, we instantiate the generator G by adapting the generator architecture from the Semantic-Space-Aware GAN (SSA-GAN) [23], which was originally designed for high-fidelity text-to-image synthesis. We selected it over alternatives like large diffusion models primarily for its balance of … view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: (a-b): For class-wise noise, learning curves of ResNet50 on CIFAR-10 dataset with dif [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Visualization of different UEs and their corresponding protective noise generated on [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Acc across test set with epoch of generator training in CLIP (a) ViT-B/16 and (b) ViT-B/32 [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

53 extracted references · 37 canonical work pages

  1. [1]

    Large image datasets: A pyrrhic win for computer vision? In WACV, 2021

    Abeba Birhane and Vinay Uday Prabhu. Large image datasets: A pyrrhic win for computer vision? In WACV, 2021

    2021

  2. [2]

    Microsoft coco captions: Data collection and evaluation server.arXiv preprint arXiv:1504.00325, 2015

    Xinlei Chen, Hao Fang, Tsung-Yi Lin, Ramakrishna Vedantam, Saurabh Gupta, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco captions: Data collection and evaluation server.arXiv preprint arXiv:1504.00325, 2015

    arXiv 2015

  3. [3]

    An analysis of single-layer networks in unsuper- vised feature learning

    Adam Coates, Andrew Ng, and Honglak Lee. An analysis of single-layer networks in unsuper- vised feature learning. In Proceedings of the fourteenth international conference on artificial intelligence and statistics, 2011

    work page 2011

  4. [4]

    Cubuk, Barret Zoph, Dandelion Mané, Vijay Vasudevan, and Quoc V

    Ekin D. Cubuk, Barret Zoph, Dandelion Mané, Vijay Vasudevan, and Quoc V . Le. Autoaug- ment: Learning augmentation strategies from data. In CVPR, 2019

    work page 2019

  5. [5]

    Improved regularization of convolutional neural networks with cutout

    Terrance DeVries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. arXiv preprint arXiv:1708.04552, 2017

    arXiv 2017

  6. [6]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. ICLR, 2021

    2021

  7. [7]

    Adversarial examples make strong poisons

    Liam Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojciech Czaja, and Tom Goldstein. Adversarial examples make strong poisons. NeurIPS, 2021

    work page 2021

  8. [8]

    Robust unlearnable exam- ples: Protecting data against adversarial learning

    Shaopeng Fu, Fengxiang He, Yang Liu, Li Shen, and Dacheng Tao. Robust unlearnable exam- ples: Protecting data against adversarial learning. In ICLR, 2022

    work page 2022

Show all 53 references
  1. [9]

    Datacomp: In search of the next generation of multimodal datasets

    Samir Yitzhak Gadre, Gabriel Ilharco, Alex Fang, Jonathan Hayase, Georgios Smyrnis, Thao Nguyen, Ryan Marten, Mitchell Wortsman, Dhruba Ghosh, Jieyu Zhang, et al. Datacomp: In search of the next generation of multimodal datasets. In NeurIPS, 2023

    2023

  2. [10]

    Armor: Shielding unlearnable examples against data augmentation

    Xueluan Gong, Yuji Wang, Yanjiao Chen, Haocheng Dong, Yiming Li, Mengyuan Sun, Shuaike Li, Qian Wang, and Chen Chen. Armor: Shielding unlearnable examples against data augmentation. arXiv preprint arXiv:2501.08862, 2025

    2025 arXiv

  3. [11]

    Medgan: An adaptive gan approach for medical image generation

    Kehua Guo, Jie Chen, Tian Qiu, Shaojun Guo, Tao Luo, Tianyu Chen, and Sheng Ren. Medgan: An adaptive gan approach for medical image generation. Computers in Biology and Medicine, 163:107119, 2023

    2023

  4. [12]

    Indiscriminate poisoning attacks on unsupervised contrastive learning

    Hao He, Kaiwen Zha, and Dina Katabi. Indiscriminate poisoning attacks on unsupervised contrastive learning. In ICLR, 2023

    2023

  5. [13]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016

    2016

  6. [14]

    The secretive company that might end privacy as we know it

    Kashmir Hill. The secretive company that might end privacy as we know it. In Ethics of Data and Analytics, pages 170–177. Auerbach Publications, 2022

    2022

  7. [15]

    Densely con- nected convolutional networks

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely con- nected convolutional networks. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 4700–4708, 2017

    2017

  8. [16]

    Un- learnable examples: Making personal data unexploitable

    Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Un- learnable examples: Making personal data unexploitable. In ICLR, 2021. 12

    2021

  9. [17]

    Unlearnable examples: Protecting open-source software from unauthorized neural code learning

    Zhenlan Ji, Pingchuan Ma, and Shuai Wang. Unlearnable examples: Protecting open-source software from unauthorized neural code learning. In SEKE, 2022

    2022

  10. [18]

    Scaling up visual and vision-language representation learning with noisy text supervision

    Chao Jia, Yinfei Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hieu Pham, Quoc Le, Yun- Hsuan Sung, Zhen Li, and Tom Duerig. Scaling up visual and vision-language representation learning with noisy text supervision. In ICML, 2021

    2021

  11. [19]

    Unlearnable examples for time series

    Yujing Jiang, Xingjun Ma, Sarah Monazam Erfani, and James Bailey. Unlearnable examples for time series. In PAKDD, 2024

    2024

  12. [20]

    Understanding black-box predictions via influence functions

    Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In ICML. PMLR, 2017

    2017

  13. [21]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky. Learning multiple layers of features from tiny images. 2009

    2009

  14. [22]

    Text to image generation with semantic-spatial aware gan

    Wentong Liao, Kai Hu, Michael Ying Yang, and Bodo Rosenhahn. Text to image generation with semantic-spatial aware gan. arXiv preprint arXiv:2104.00567, 2021

    2021 arXiv

  15. [23]

    Text to image generation with semantic-spatial aware gan

    Wentong Liao, Kai Hu, Michael Ying Yang, and Bodo Rosenhahn. Text to image generation with semantic-spatial aware gan. In CVPR, 2022

    2022

  16. [24]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In ECCV, 2014

    2014

  17. [25]

    Multimodal unlearnable examples: Protecting data against multimodal contrastive learning

    Xinwei Liu, Xiaojun Jia, Yuan Xun, Siyuan Liang, and Xiaochun Cao. Multimodal unlearnable examples: Protecting data against multimodal contrastive learning. In MM, 2024

    2024

  18. [26]

    Stable unlearnable example: Enhancing the robustness of unlearnable examples via stable error-minimizing noise

    Yixin Liu, Kaidi Xu, Xun Chen, and Lichao Sun. Stable unlearnable example: Enhancing the robustness of unlearnable examples via stable error-minimizing noise. In AAAI, volume 38, pages 3783–3791, 2024

    2024

  19. [27]

    The data provenance initiative: A large scale audit of dataset licensing & attribution in ai

    Shayne Longpre, Robert Mahari, Anthony Chen, Naana Obeng-Marnu, Damien Sileo, William Brannon, Niklas Muennighoff, Nathan Khazam, Jad Kabbara, Kartik Perisetla, et al. The data provenance initiative: A large scale audit of dataset licensing & attribution in ai. Nature Machine ...

    2023

  20. [28]

    Safety at scale: A comprehensive survey of large model safety

    Xingjun Ma, Yifeng Gao, Yixu Wang, Ruofan Wang, Xin Wang, Ye Sun, Yifan Ding, Hengyuan Xu, Yunhao Chen, Yunhan Zhao, et al. Safety at scale: A comprehensive survey of large model safety. arXiv preprint arXiv:2502.05206, 2025

    2025 arXiv

  21. [29]

    Conditional generative adversarial nets

    Mehdi Mirza and Simon Osindero. Conditional generative adversarial nets. Computer Science, pages 2672–2680, 2014

    2014

  22. [30]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In ICML, 2021

    2021

  23. [31]

    Transferable unlearnable examples

    Jie Ren, Han Xu, Yuxuan Wan, Xingjun Ma, Lichao Sun, and Jiliang Tang. Transferable unlearnable examples. arXiv preprint arXiv:2210.10114, 2022

    2022 arXiv

  24. [32]

    Cuda: Convolution-based unlearnable datasets

    Vinu Sankar Sadasivan, Mahdi Soltanolkotabi, and Soheil Feizi. Cuda: Convolution-based unlearnable datasets. In CVPR, 2023

    2023

  25. [33]

    Autoregressive perturbations for data poisoning

    Pedro Sandoval-Segura, Vasu Singla, Jonas Geiping, Micah Goldblum, Tom Goldstein, and David Jacobs. Autoregressive perturbations for data poisoning. NeurIPS, 2022

    2022

  26. [34]

    What can we learn from unlearnable datasets? NeurIPS, 2023

    Pedro Sandoval-Segura, Vasu Singla, Jonas Geiping, Micah Goldblum, and Tom Goldstein. What can we learn from unlearnable datasets? NeurIPS, 2023

    2023

  27. [35]

    Laion-400m: Open dataset of clip-filtered 400 million image-text pairs

    Christoph Schuhmann, Richard Vencu, Romain Beaumont, Robert Kaczmarczyk, Clayton Mullis, Aarush Katta, Theo Coombes, Jenia Jitsev, and Aran Komatsuzaki. Laion-400m: Open dataset of clip-filtered 400 million image-text pairs. arXiv preprint arXiv:2111.02114, 2021. 13

    2021 arXiv

  28. [36]

    Laion- 5b: An open large-scale dataset for training next generation image-text models.NeurIPS, 2022

    Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. Laion- 5b: An open large-scale dataset for training next generation image-text models.NeurIPS, 2022

    2022

  29. [37]

    Very deep convolutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  30. [38]

    Unseg: One universal unlearnable example generator is enough against all image segmentation

    Ye Sun, Hao Zhang, Tiehua Zhang, Xingjun Ma, and Yu-Gang Jiang. Unseg: One universal unlearnable example generator is enough against all image segmentation. In NeurIPS, 2024

    2024

  31. [39]

    Going deeper with convolutions

    Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In CVPR, 2015

    2015

  32. [40]

    Generating videos with scene dy- namics

    Carl V ondrick, Hamed Pirsiavash, and Antonio Torralba. Generating videos with scene dy- namics. NeurIPS, 29, 2016

    2016

  33. [41]

    Provably unlearnable data examples

    Derui Wang, Minhui Xue, Bo Li, Seyit Camtepe, and Liming Zhu. Provably unlearnable data examples. arXiv preprint arXiv:2405.03316, 2024

    2024 arXiv

  34. [42]

    Git: A generative image-to-text transformer for vision and language

    Jianfeng Wang, Zhengyuan Yang, Xiaowei Hu, Linjie Li, Kevin Lin, Zhe Gan, Zicheng Liu, Ce Liu, and Lijuan Wang. Git: A generative image-to-text transformer for vision and language. arXiv preprint arXiv:2205.14100, 2022

    2022 arXiv

  35. [43]

    Unlearnable 3d point clouds: Class-wise transformation is all you need

    Xianlong Wang, Minghui Li, Wei Liu, Hangtao Zhang, Shengshan Hu, Yechao Zhang, Ziqi Zhou, and Hai Jin. Unlearnable 3d point clouds: Class-wise transformation is all you need. In NeurIPS, 2024

    2024

  36. [44]

    Dcgan-based data augmentation for tomato leaf disease identification

    Qiufeng Wu, Yiping Chen, and Jun Meng. Dcgan-based data augmentation for tomato leaf disease identification. IEEE access, 8:98716–98728, 2020

    2020

  37. [45]

    Demystifying clip data

    Hu Xu, Saining Xie, Xiaoqing Tan, Po-Yao Huang, Russell Howes, Vasu Sharma, Shang-Wen Li, Gargi Ghosh, Luke Zettlemoyer, and Christoph Feichtenhofer. Demystifying clip data. In ICLR, 2024

    2024

  38. [46]

    Robust contrastive language-image pretraining against data poisoning and backdoor attacks

    Wenhan Yang, Jingdong Gao, and Baharan Mirzasoleiman. Robust contrastive language-image pretraining against data poisoning and backdoor attacks. NeurIPS, 2024

    2024

  39. [47]

    Data poisoning attacks against multimodal encoders

    Ziqing Yang, Xinlei He, Zheng Li, Michael Backes, Mathias Humbert, Pascal Berrang, and Yang Zhang. Data poisoning attacks against multimodal encoders. In ICML. PMLR, 2023

    2023

  40. [48]

    How far are we from true unlearnability? In ICLR, 2025

    Kai Ye, Liangcai Su, and Chenxiong Qian. How far are we from true unlearnability? In ICLR, 2025

    2025

  41. [49]

    From image descriptions to visual denotations: New similarity metrics for semantic inference over event descriptions

    Peter Young, Alice Lai, Micah Hodosh, and Julia Hockenmaier. From image descriptions to visual denotations: New similarity metrics for semantic inference over event descriptions. Transactions of the Association for Computational Linguistics, 2:67–78, 2014

    2014

  42. [50]

    Availability attacks create shortcuts

    Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie-Yan Liu. Availability attacks create shortcuts. In SIGKDD, 2022

    2022

  43. [51]

    Stackgan: Text to photo-realistic image synthesis with stacked generative adversarial networks

    Han Zhang, Tao Xu, Hongsheng Li, Shaoting Zhang, Xiaogang Wang, Xiaolei Huang, and Dimitris N Metaxas. Stackgan: Text to photo-realistic image synthesis with stacked generative adversarial networks. In ICCV, 2017

    2017

  44. [52]

    mixup: Beyond empirical risk minimization

    Hongyi Zhang. mixup: Beyond empirical risk minimization. arXiv preprint arXiv:1710.09412, 2017

    2017 arXiv

  45. [53]

    Unlearnable clusters: Towards label-agnostic unlearnable examples

    Jiaming Zhang, Xingjun Ma, Qi Yi, Jitao Sang, Yu-Gang Jiang, Yaowei Wang, and Chang- sheng Xu. Unlearnable clusters: Towards label-agnostic unlearnable examples. In CVPR, 2023. 14 A More Ablation Results A.1 Impact of Generator Training Duration (a) ViT-B/16 (b) ViT-B/32 Figur...

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.