mlsanityData to 7 Oct 2026

The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Models

arXiv 2303.08500 ↗First posted 15 Mar 2023cs.LG cs.CR cs.CVcited by 19

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Protecting personal data against exploitation of machine learning models is crucial. Recently, availability attacks have shown great promise to provide an extra layer of protection against the unauthorized use of data to train neural networks. These methods aim to add imperceptible noise to clean data so that the neural networks cannot extract meaningful patterns from the protected data, claiming that they can make personal data "unexploitable." This paper provides a strong countermeasure against such approaches, showing that unexploitable data might only be an illusion. In particular, we leverage the power of diffusion models and show that a carefully designed denoising process can counteract the effectiveness of the data-protecting perturbations. We rigorously analyze our algorithm, and theoretically prove that the amount of required denoising is directly related to the magnitude of the data-protecting perturbations. Our approach, called AVATAR, delivers state-of-the-art performance against a suite of recent availability attacks in various scenarios, outperforming adversarial training even under distribution mismatch between the diffusion model and the protected data. Our findings call for more research into making personal data unexploitable, showing that this goal is far from over. Our implementation is available at this repository: https://github.com/hmdolatabadi/AVATAR.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 63 of its 89 references that are in the map. First posted on arXiv 15 Mar 2023.

Builds on

63 of 89 references.

Closest ancestors · 3

Same direction, newest first

  1. 2023Better Diffusion Models Further Improve Adversarial Training9 Feb
  2. 2022Diffusion Models for Adversarial Purification16 May
  3. 2021Adversarial purification with Score-based generative models11 Jun

Other references · 60

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  5. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  6. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  7. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  8. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  9. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  10. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  11. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  12. 2016Densely Connected Convolutional Networkscited by 6,691
38 more
  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  2. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  5. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  6. 2019Analyzing and Improving the Image Quality of StyleGANcited by 3,580
  7. 2016Wide Residual Networkscited by 3,057
  8. 2022DreamFusion: Text-to-3D using 2D Diffusioncited by 3,006
  9. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  10. 2020Shortcut Learning in Deep Neural Networkscited by 1,928
  11. 2022Make-A-Video: Text-to-Video Generation without Text-Video Datacited by 1,725
  12. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  13. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
  14. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  15. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  16. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  17. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  18. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,036
  19. 2022Diffusion Models in Vision: A Surveycited by 1,008
  20. 2018Robustness May Be at Odds with Accuracycited by 873
  21. 2017Countering Adversarial Images using Input Transformationscited by 517
  22. 2018Spectral Signatures in Backdoor Attackscited by 457
  23. 2014Learning Face Representation from Scratchcited by 451
  24. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  25. 2021Come-Closer-Diffuse-Faster: Accelerating Conditional Diffusion Models for Inverse Problems through Stochastic Contractioncited by 306
  26. 2018Additive Margin Softmax for Face Verificationcited by 275
  27. 2019Fast AutoAugmentcited by 243
  28. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  29. 2020Large image datasets: A pyrrhic win for computer vision?cited by 237
  30. 2022CMX: Cross-Modal Fusion for RGB-X Semantic Segmentation with Transformerscited by 229
  31. 2023Glaze: Protecting Artists from Style Mimicry by Text-to-Image Modelscited by 200
  32. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  33. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  34. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  35. 2021Adversarial Examples Make Strong Poisonscited by 115
  36. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  37. 2023Input Perturbation Reduces Exposure Bias in Diffusion Modelscited by 88
  38. 2019Learning to Confuse: Generating Training Time Adversarial Data with Auto-Encodercited by 70

50 most cited of 60 All 60 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 5; 2024: 8; 2025: 3; 2026: 3.

19 papers.

Sort:

By area:

  1. 2023What Can We Learn from Unlearnable Datasets?cited by 21
  2. 2023Unlearnable Examples Give a False Sense of Security: Piercing through Unexploitable Data with Learnable Examplescited by 17
  3. 2024Semantic Deep Hiding for Robust Unlearnable Examplescited by 13
  4. 2024Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneouslycited by 12
  5. 2023DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Modelscited by 9
  6. 2024ECLIPSE: Expunging Clean-label Indiscriminate Poisons via Sparse Diffusion Purificationcited by 9
  7. 2024Unlearnable Examples Detection via Iterative Filteringcited by 9
  8. 2023APBench: A Unified Benchmark for Availability Poisoning Attacks and Defensescited by 7
  9. 2024Toward Availability Attacks in 3D Point Cloudscited by 7
  10. 2025A Survey on Unlearnable Datacited by 5
  11. 2024PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamicscited by 3
  12. 2024BridgePure: Limited Protection Leakage Can Break Black-Box Data Protectioncited by 3
7 more
  1. 2025Provable Watermarking for Data Poisoning Attackscited by 2
  2. 2026Why Do Unlearnable Examples Work: A Novel Perspective of Mutual Informationcited by 2
  3. 2023Unlearnable Examples Give a False Sense of Data Privacy: Understanding and Relearningcited by 1
  4. 2024Be Persistent: Towards a Unified Solution for Mitigating Shortcuts in Deep Learningcited by 1
  5. 2025Adversarially Robust AI-Generated Image Detection for Free: An Information Theoretic Perspectivecited by 1
  6. 2026Unveiling the Backdoor Mechanism Hidden Behind Catastrophic Overfitting in Fast Adversarial Trainingcited by 0
  7. 2026DiffUE: Enhancing Utility-Unlearnability Trade-off of Unlearnable Examples via Diffusion Autoencoderscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitation
  2. 2025Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade off
  3. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacy
  4. 2026Noise as a Probe: Membership Inference Attacks on Diffusion Models Leveraging Initial Noise
  5. 2025Towards Irreversible Machine Unlearning for Diffusion Models
  6. 2023Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion?
  7. 2025Latent Diffusion Unlearning: Protecting Against Unauthorized Personalization Through Trajectory Shifted Perturbations
  8. 2024Watch the Watcher! Backdoor Attacks on Security-Enhancing Diffusion Models