Armor: Shielding Unlearnable Examples Against Data Augmentation.

Area of Science:

• Computer Science
• Artificial Intelligence
• Data Privacy

Background:

• Online private data is vulnerable to unauthorized collection for training deep neural networks (DNNs).
• Unlearnable examples aim to protect data by minimizing DNN training loss, making data difficult to learn.
• Data augmentation, a common pre-processing step, can inadvertently restore privacy in protected data.

Purpose of the Study:

• To investigate and reveal the privacy violation risks introduced by data augmentation on unlearnable examples.
• To propose a novel defense framework, ARMOR, against data augmentation-induced privacy breaches.
• To develop methods for defending data privacy without direct access to the model training process.

Main Methods:

• A non-local module-assisted surrogate model was designed to simulate data augmentation effects.
• A surrogate augmentation selection strategy was developed to optimize augmentation for each class.
• A dynamic step size adjustment algorithm was used for generating defensive noise.
• Extensive experiments were conducted on 4 datasets and 5 augmentation methods.

Main Results:

• Data augmentation significantly increased model accuracy on unlearnable examples from 21.3% to 66.1%.
• ARMOR successfully preserved the unlearnability of protected private data against data augmentation.
• ARMOR reduced test accuracy by up to 60% more than baseline methods.
• The proposed defense framework demonstrated robustness against adversarial training.

Conclusions:

• Data augmentation poses a significant threat to privacy when applied to unlearnable data.
• The ARMOR framework provides an effective defense mechanism against these privacy vulnerabilities.
• ARMOR offers a robust solution for protecting private data in machine learning pipelines, even with complex pre-processing techniques.