mlsanityData to 7 Oct 2026

Unlearnable Examples: Making Personal Data Unexploitable

arXiv 2101.04898 ↗First posted 13 Jan 2021cs.LG cs.CR cs.CVcited by 188

Not on the map. Why?

Cited by 43 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

The volume of "free" data on the internet has been key to the current success of deep learning. However, it also raises privacy concerns about the unauthorized exploitation of personal data for training commercial models. It is thus crucial to develop methods to prevent unauthorized data exploitation. This paper raises the question: can data be made unlearnable for deep learning models? We present a type of error-minimizing noise that can indeed make training examples unlearnable. Error-minimizing noise is intentionally generated to reduce the error of one or more of the training example(s) close to zero, which can trick the model into believing there is "nothing" to learn from these example(s). The noise is restricted to be imperceptible to human eyes, and thus does not affect normal data utility. We empirically verify the effectiveness of error-minimizing noise in both sample-wise and class-wise forms. We also demonstrate its flexibility under extensive experimental settings and practicability in a case study of face recognition. Our work establishes an important first step towards making personal data unexploitable to deep learning models.

Key facts. Cited by 188 papers in the map (data through 7 Oct 2026). Builds on 46 of its 63 references that are in the map. First posted on arXiv 13 Jan 2021.

Builds on

46 of 63 references.

References · 46

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2016Densely Connected Convolutional Networkscited by 6,691
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  9. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  10. 2013Intriguing properties of neural networkscited by 5,114
  11. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 4,993
  12. 2014Deep Learning Face Attributes in the Wildcited by 3,679
34 more
  1. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  2. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  3. 2016Deep Learning with Differential Privacycited by 2,682
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  7. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  9. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  10. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  11. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  12. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  13. 2016Universal adversarial perturbationscited by 774
  14. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  15. 2014Learning Face Representation from Scratchcited by 451
  16. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  17. 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
  18. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
  19. 2019Fast AutoAugmentcited by 243
  20. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  21. 2020Large image datasets: A pyrrhic win for computer vision?cited by 237
  22. 2018ReCoRD: Bridging the Gap between Human and Machine Commonsense Reading Comprehensioncited by 198
  23. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  24. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  25. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  26. 2019Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systemscited by 151
  27. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  28. 2016Robustness of classifiers: from adversarial to random noisecited by 87
  29. 2020A Unified Approach to Interpreting and Boosting Adversarial Transferabilitycited by 71
  30. 2019Black-box Adversarial Attacks on Video Recognition Modelscited by 58
  31. 2017Generative Poisoning Attack Method Against Neural Networkscited by 49
  32. 2017Adaptive Laplace Mechanism: Differential Privacy Preservation in Deep Learningcited by 34
  33. 2020Improving Query Efficiency of Black-box Adversarial Attackcited by 34
  34. 2020Fawkes: Protecting Privacy against Unauthorized Deep Learning Modelscited by 11

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 13; 2022: 20; 2023: 41; 2024: 56; 2025: 28; 2026: 30.

188 papers.

Sort:

By area:

  1. 2022A Survey of Machine Unlearningcited by 298
  2. 2021Fast Yet Effective Machine Unlearningcited by 209
  3. 2023Raising the Cost of Malicious AI-Powered Image Editingcited by 160
  4. 2021Adversarial Examples Make Strong Poisonscited by 115
  5. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  6. 2021Trustworthy AI: A Computational Perspectivecited by 93
  7. 2024Representation Noising: A Defence Mechanism Against Harmful Finetuningcited by 93
  8. 2023LAVA: Data Valuation without Pre-Specified Learning Algorithmscited by 69
  9. 2024Fight Back Against Jailbreaking via Prompt Adversarial Tuningcited by 63
  10. 2021Availability Attacks Create Shortcutscited by 60
  11. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  12. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 52
38 more
  1. 2021Hard to Forget: Poisoning Attacks on Certified Machine Unlearningcited by 47
  2. 2022Autoregressive Perturbations for Data Poisoningcited by 45
  3. 2021Robust Contrastive Learning Using Negative Samples with Diminished Semanticscited by 43
  4. 2023MetaCloak: Preventing Unauthorized Subject-driven Text-to-image Diffusion-based Synthesis via Meta-learningcited by 42
  5. 2022Transferable Unlearnable Examplescited by 41
  6. 2023Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compressioncited by 39
  7. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
  8. 2023Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitationcited by 37
  9. 2022Unlearnable Clusters: Towards Label-agnostic Unlearnable Examplescited by 35
  10. 2022Robust Unlearnable Examples: Protecting Data Against Adversarial Learningcited by 34
  11. 2024Machine Unlearning: A Comprehensive Surveycited by 33
  12. 2022Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learningcited by 32
  13. 2023IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AIcited by 32
  14. 2022One-Pixel Shortcut: on the Learning Preference of Deep Neural Networkscited by 29
  15. 2023Learning the Unlearnable: Adversarial Augmentations Suppress Unlearnable Example Attackscited by 28
  16. 2023What do neural networks learn in image classification? A frequency shortcut perspectivecited by 28
  17. 2023CUDA: Convolution-based Unlearnable Datasetscited by 26
  18. 2022Indiscriminate Data Poisoning Attacks on Neural Networkscited by 24
  19. 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attackscited by 23
  20. 2023Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noisecited by 23
  21. 2023What Can We Learn from Unlearnable Datasets?cited by 21
  22. 2022Self-Ensemble Protection: Training Checkpoints Are Good Data Protectorscited by 19
  23. 2023The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Modelscited by 19
  24. 2023Making Harmful Behaviors Unlearnable for Large Language Modelscited by 19
  25. 2024PointNCBW: Towards Dataset Ownership Verification for Point Clouds via Negative Clean-label Backdoor Watermarkcited by 19
  26. 2023Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspectivecited by 18
  27. 2024Purify Unlearnable Examples via Rate-Constrained Variational Autoencoderscited by 18
  28. 2024Provably Unlearnable Data Examplescited by 18
  29. 2023Unlearnable Examples Give a False Sense of Security: Piercing through Unexploitable Data with Learnable Examplescited by 17
  30. 2024Certified Robustness to Data Poisoning in Gradient-Based Trainingcited by 17
  31. 2025Rethinking Data Protection in the (Generative) Artificial Intelligence Eracited by 17
  32. 2021SoK: Anti-Facial Recognition Technologycited by 16
  33. 2022Efficient Attribute Unlearning: Towards Selective Removal of Input Attributes from Feature Representationscited by 16
  34. 2024Unlearnable 3D Point Clouds: Class-wise Transformation Is All You Needcited by 16
  35. 2022Poisons that are learned faster are more effectivecited by 14
  36. 2022Deep Learning Serves Traffic Safety Analysis: A Forward-looking Reviewcited by 13
  37. 2023Detection and Defense of Unlearnable Examplescited by 13
  38. 2024Semantic Deep Hiding for Robust Unlearnable Examplescited by 13

50 most cited of 188 All 188 (JSON)