ARMOR：为不可学习样本提供抵御数据增强的防护
ARMOR: Shielding Unlearnable Examples against Data Augmentation
AI总结：
针对数据增强会破解不可学习样本隐私防护的问题，提出ARMOR防御框架，通过非局部模块代理模型、代理增强选择策略和动态步长算法生成防御噪声，在多数据集上验证其防护效果显著优于现有基线。
摘要：
隐私数据在网上发布后，可能被未经授权的主体收集用于训练深度神经网络（DNNs）。为保护隐私，可向原始样本添加防御性噪声，降低DNN对样本的可学习性。近年来，研究者提出不可学习样本的概念，通过最小化训练损失使模型几乎学不到任何信息。然而，原始数据在用于训练前通常会经过预处理，这可能恢复受保护数据的隐私信息。\n本文揭示了由数据增强（一种常用于提升模型泛化能力的数据预处理技术）引发的数据隐私泄露问题，据我们所知，这是首次针对该问题的研究。我们通过实验证明，数据增强可将在不可学习样本上训练的模型准确率从21.3%大幅提升至66.1%。为解决这一问题，我们提出名为ARMOR的防御框架，保护数据隐私免受数据增强带来的潜在泄露风险。\n为克服无法获取模型训练过程的难题，我们设计了一个由非局部模块辅助的代理模型，能更好地捕捉数据增强的影响。此外，我们设计了代理增强选择策略，最大化增强样本与非增强样本之间的分布对齐，为每个类别选择最优增强策略。我们还采用动态步长调整算法优化防御噪声的生成过程。\n我们在4个数据集、5种数据增强方法上开展了大量实验验证ARMOR的性能，与6种当前最优的防御方法对比表明，ARMOR能在数据增强场景下维持受保护隐私数据的不可学习性。与基线方法相比，ARMOR可使在增强后受保护样本上训练的模型测试准确率额外降低多达60%。
英文摘要：
Private data, when published online, may be collected by unauthorized parties to train deep neural networks (DNNs). To protect privacy, defensive noises can be added to original samples to degrade their learnability by DNNs. Recently, unlearnable examples are proposed to minimize the training loss such that the model learns almost nothing. However, raw data are often pre-processed before being used for training, which may restore the private information of protected data. In this paper, we reveal the data privacy violation induced by data augmentation, a commonly used data pre-processing technique to improve model generalization capability, which is the first of its kind as far as we are concerned. We demonstrate that data augmentation can significantly raise the accuracy of the model trained on unlearnable examples from 21.3% to 66.1%. To address this issue, we propose a defense framework, dubbed ARMOR, to protect data privacy from potential breaches of data augmentation. To overcome the difficulty of having no access to the model training process, we design a non-local module-assisted surrogate model that better captures the effect of data augmentation. In addition, we design a surrogate augmentation selection strategy that maximizes distribution alignment between augmented and non-augmented samples, to choose the optimal augmentation strategy for each class. We also use a dynamic step size adjustment algorithm to enhance the defensive noise generation process. Extensive experiments are conducted on 4 datasets and 5 data augmentation methods to verify the performance of ARMOR. Comparisons with 6 state-of-the-art defense methods have demonstrated that ARMOR can preserve the unlearnability of protected private data under data augmentation. ARMOR reduces the test accuracy of the model trained on augmented protected samples by as much as 60% more than baselines.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
