自集成保护：训练检查点是良好的数据保护者
Self-Ensemble Protection: Training Checkpoints Are Good Data Protectors
AI总结：
本文提出自集成保护（SEP）方法，利用训练检查点梯度生成始终无法被正确分类的扰动数据，以极低计算成本实现类似多模型集成的数据保护效果，显著降低攻击者模型准确率。
摘要：
随着数据变得日益重要，公司在发布数据时会非常谨慎，因为竞争对手可以利用这些数据训练高性能模型，从而对公司的商业竞争力构成巨大威胁。为了防止在数据上训练出好的模型，我们可以向数据中添加难以察觉的扰动。由于此类扰动的目标是损害整个训练过程，它们应当反映 DNN 训练的脆弱性，而不是单个模型的脆弱性。基于这一新思路，我们寻找在训练中始终不被识别（从未被正确分类）的扰动样本。在本文中，我们通过模型检查点的梯度来发现这些样本，形成所提出的自集成保护（SEP），该方法非常有效，原因在于：（1）在正常训练过程中被忽略的样本上进行学习，往往会使 DNN 忽略正常样本；（2）检查点的跨模型梯度接近正交，这意味着它们与具有不同架构的 DNN 一样具有多样性。也就是说，我们出色的集成性能只需要训练一个模型的计算量。通过在 3 个数据集和 5 种架构上与 9 个基线方法进行大量实验，SEP 被验证为新的最先进方法，例如，我们的小型 $\ell_\infty=2/255$ 扰动将 CIFAR-10 ResNet18 的准确率从 94.56% 降低到 14.68%，而已知最佳方法仅降低到 41.35%。代码可在 https://github.com/Sizhe-Chen/SEP 获取。
英文摘要：
As data becomes increasingly vital, a company would be very cautious about releasing data, because the competitors could use it to train high-performance models, thereby posing a tremendous threat to the company's commercial competence. To prevent training good models on the data, we could add imperceptible perturbations to it. Since such perturbations aim at hurting the entire training process, they should reflect the vulnerability of DNN training, rather than that of a single model. Based on this new idea, we seek perturbed examples that are always unrecognized (never correctly classified) in training. In this paper, we uncover them by model checkpoints' gradients, forming the proposed self-ensemble protection (SEP), which is very effective because (1) learning on examples ignored during normal training tends to yield DNNs ignoring normal examples; (2) checkpoints' cross-model gradients are close to orthogonal, meaning that they are as diverse as DNNs with different architectures. That is, our amazing performance of ensemble only requires the computation of training one model. By extensive experiments with 9 baselines on 3 datasets and 5 architectures, SEP is verified to be a new state-of-the-art, e.g., our small $\ell_\infty=2/255$ perturbations reduce the accuracy of a CIFAR-10 ResNet18 from 94.56% to 14.68%, compared to 41.35% by the best-known method. Code is available at https://github.com/Sizhe-Chen/SEP.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
