UnSeg: One Universal Unlearnable Example Generator is Enough against All Image Segmentation

We sincerely appreciate your time and valuable feedback.

Q1: What are the benefits of using the SAM as the backbone for the unlearnable example generation model and the surrogate model.

One straightforward benefit of using SAM as the backbone is that it renders our entire framework interactive. This means that 1) the noise can be generated interactively during the optimization process, and 2) the surrogate model can be optimized on a small-scale interactive segmentation dataset, improving data efficiency. Furthermore, the trained noise generator inherits SAM's promptable characteristic and high transferability. This allows our method to generate the unlearnable noise for any downstream image through a single forward pass, improving generation efficiency. Additionally, since SAM is an interactive segmentation model whose predictions do not contain any class information, our approach avoids overfitting to any specific category, thus learning a universal unlearnable representation.

As suggested, we replaced the MAE-pretrained ViT surrogate model with an ImageNet-pretrained ResNet50 surrogate model, and we validated the effectiveness of the trained noise generator using Mask2Former on the ADE20K and Cityscapes datasets. We find that the performance of the noise generator significantly declined when using ResNet50 as the surrogate model. We believe that using the MAE-pretrained weights can prevent the noise generator from being biased towards specific categories, thereby enhancing its transferability.

Q2: The influence of using the SAM pretrained weight for the unlearnable example generation model?

Our primary consideration in using SAM is to ensure that the noise generator possesses promptable attributes after optimization. Therefore, we initialized the generator with the pretrained SAM weights and kept these weights frozen during training. This allows efficient fine-tuning of the newly added parameters. Here, we further test the use of randomly initialized weights for the noise generator. We run the experiments on the Pascal VOC dataset using DeepLabV1. We report two types of results in the table below: making all classes unlearnable and making only some classes unlearnable. The results indicate that our framework is not sensitive to the initial weights of the noise generator and the noise generator works well with random initialization. We will include this result in the revision.

Q3: On which dataset is the inference of UnSeg conducted (i.e., what training dataset is used for different downstream tasks)? Which dataset is used as the evaluation set for the trained models of different downstream tasks?

The outcome of our method is a single noise generator, which generates unlearnable noise for any given image in any downstream dataset. On downstream tasks, we applied our noise generator to convert the images in the training dataset into unlearnable images and train a SOTA model for the task on the unlearnable training images. We test the model’s performance on the clean test set. The lower the performance the better data protection offered by our noise generator. Please note that this setup strictly follows existing works in the field [a,b,c,d,e,f].

We will clarify this in lines 249 to 265, as suggested. The noise generator was trained on the HQSeg-44k dataset.

Here is a more detailed response to your question:

For semantic, instance and panoptic segmentation: we use the trained noise generator to convert the Pascal VOC, ADE20K, Cityscapes and COCO training sets into their corresponding unlearnable training sets. The task-specific models are then trained on the unlearnable training sets and evaluated on the original validation sets.

For Interactive segmentation: we use the trained noise generator to convert the HQSeg-44K into its unlearnable version. The SAM-HQ model is then trained on the unlearnable HQSeg-44K dataset and evaluated on the DIS, COIFT, HRSOD and ThinObject datasets.

For remote sensing instance segmentation: we use the trained noise generator to convert the WHU, NWPU, and SSDD training sets into unlearnable training sets. The Rsprompter model is then trained on the unlearnable training sets and evaluated on the WHU, NWPU, and SSDD validation sets, respectively.

For medical image segmentation: We randomly select 80% of the data from the Lung segmentation and Kvasir-seg datasets as the training sets, while using their remaining 20% as the validation sets. We then use the trained noise generator to convert the training sets into their corresponding unlearnable versions. The UNet++ model is then trained on the unlearnable training sets and evaluated on the clean validation sets.

[a] Unlearnable examples: Making personal data unexploitable, Huang et.al., ICLR 2021

[b] Adversarial examples make strong poisons, Fowl et.al., NeurIPS 2021

[c] Unlearnable clusters: Towards label-agnostic unlearnable examples, Zhang et.al., CVPR 2023

[d] Availability attacks create shortcuts, Yu et.al., SIGKDD 2022

[e] Autoregressive perturbations for data poisoning, Pedro et.al., NeurIPS 2022

[f] Cuda: Convolution-based unlearnable datasets, Sadasivan et.al., CVPR 2023

Dear Reviewer Mhnt,

Thank you for your initial comments. We appreciate your questions regarding the training of our UE generator, the datasets used for downstream tasks, and the benefits of using SAM as the backbone. We have addressed these points in our rebuttal. Please review our response to see if it adequately resolves your concerns. If any details remain unclear, we are happy to provide further explanations. We will also revise our paper to clarify these points. Thank you for your time, and we value your additional feedback.

We thank the reviewer for their time and valuable feedback.

Q1: Main concern about the author used a relatively strong segmenter to train an unlearnable sample generator, but trained unlearnable samples on a relatively weak segmenter. Is this reasonable in the real world?

While we understand the reviewer’s concern, we would like to argue that our settings are both reasonable and practical in real-world applications. As the current AI and large-scale pre-training are devouring our data and destroying our privacy, Unlearnable Examples (UEs), as a promising data protection technique, has become an active research area in the past two years, and most existing works [a,b,c,d,e,f,g,h] follow a similar setting as ours.

The use of SAM (i.e., a strong segmenter) follows the principle of using large models against large models, and this can produce a single powerful generator to provide universal protection against many downstream tasks. Please note that our setting is not only reasonable but also very challenging as the training dataset of the noise generator is completely different from the downstream datasets and the generated noise should be powerful enough to prevent model training (which is more powerful than adversarial noise as it only prevents inference). The trained unlearnable noise generator by our method can readily be applied by the data owners to protect their private data (which are not necessarily segmentation data). With our protection, the data won’t be easily exploited by a machine learning model even if the data is accidentally leaked.

Moreover, we employed state-of-the-art (SOTA) models in each domain to evaluate our method on downstream tasks. For example, the Mask2Former model we tested is a SOTA model for universal image segmentation and has become a recognized milestone in this area. Similarly, the SAM-HQ, RSPrompter, and DINO models are also SOTA in their respective domains, all of which are strong enough to assess the effectiveness of our method.

[a] Unlearnable examples: Making personal data unexploitable, Huang et.al., ICLR 2021

[b] Adversarial examples make strong poisons, Fowl et.al., NeurIPS 2021

[c] Unlearnable clusters: Towards label-agnostic unlearnable examples, Zhang et.al., CVPR 2023

[d] Availability attacks create shortcuts, Yu et.al., SIGKDD 2022

[e] Autoregressive perturbations for data poisoning, Pedro et.al., NeurIPS 2022

[f] Cuda: Convolution-based unlearnable datasets, Sadasivan et.al., CVPR 2023

[g] Transferable unlearnable examples, Ren et.al., ICLR 2023

[h] Robust unlearnable examples: Protecting data against adversarial learning, Fu et.al., ICLR 2022

Q2: Experiments on adversarial training.

Thanks for your suggestion. In fact, we have already evaluated our method against adversarial training (AT) and an advanced AT method specifically designed for segmentation tasks (DDC-AT). Please kindly find the copied results in the table below, a detailed discussion can be found in Section 4.3 of our initial submission. As shown in the table, our method is resistant to both AT and DDC-AT, reducing the test mIoU to 23.1 % and 28.5%, respectively.

Q3: This paper could not cause any societal impacts.

In terms of societal impacts, please allow us to clarify the following:

(Societal Impact) As a powerful data protection technique following the concept of Unlearnable Examples (UEs), we strongly disagree with the reviewer that our work could not cause any societal impacts. The idea of UEs has been figured by MIT Technology Review, which we believe is a clear sign of the positive societal impact of this line of work.

(Practical Application) As the release of powerful segmentation models like SAM, we recognize the potential damage it could bring to private data as personal images can now be easily segmented, interpreted, and manipulated by such models. Our work aims to stop the training of SAM or at least make the training more costly. This urges us to build a universal UE generation method that allows everyone to protect their images against (the training of) segmentation models. We anticipate our released noise generator to be a useful tool for many potential users. As demonstrated in our paper, UnSeg can be applied to protect natural scene images, remote sensing images, and even medical images. UnSeg is very lightweight, occupying less than 400 MB of memory, and can generate an unlearnable version of an image in just 113 ms. These characteristics further highlight the practical value of UnSeg.

(Novelty) To the best of our knowledge, our work is the first UE generation method for segmentation models, which we believe is a novel and important generalization of UEs to more complex and foundational fields in computer vision. Unlike all previous methods, our UnSeg generates unlearnable examples using visual prompts, which we believe is technically novel. Our extensive experiments on 7 mainstream image segmentation tasks proves the empirical novelty of our method. For the first time in the field, we could use a single universal UE generator to fight against a wide range of downstream tasks at this scale.

(Efficiency) The high practical value of UnSeg is evident in its significant improvements in data efficiency, generation efficiency, and transferability compared to previous methods. UnSeg can be fine-tuned on a 44k dataset in just 10 hours, demonstrating high data efficiency. It can convert an image into its corresponding unlearnable version in just 113 ms, showcasing high generation efficiency. The trained noise generator can be directly applied to different tasks and target models without retraining, highlighting high transferability.

We sincerely appreciate your insightful, constructive and encouraging reviews.

Q1: More details on the real-world use cases and deployment of the proposed method.

Our trained universal unlearnable noise generator is very lightweight and can be deployed similarly to SAM. Specifically, the noise generator occupies only 385.37 MB of memory. During inference on a single RTX 4090 GPU, the maximum VRAM usage is 2893 MB, and it only takes 113.52 ms to generate UEs for a single image, utilizing 2.76 GB of physical memory.

Q2: The intuition behind “Training Stability and Epsilon Generalization”.

While image classification models only focus on specific features of an image (as shown by CAM [a]), segmentation models must make accurate predictions for every pixel. Such a difference makes segmentation models more sensitive to pixel-level perturbations. Moreover, the bi-level optimization process optimizes a surrogate model and a noise generator, both aimed to reduce the prediction loss. The $\epsilon$ hyperparameter works as a knob to balance the two components. During our exploration, we find that a larger $\epsilon$ tends to hinder the training of the noise generator, as the added noise causes an extremely low loss. To solve this problem, we chose to use a smaller epsilon when training the noise generator, then magnify the noise at inference time to guarantee unlearnable effect. For this strategy to work, training under a smaller epsilon should be able to generalize to inference with a large epsilon (we call this epsilon generalization). The effectiveness of our method proves that this novel technique indeed works.

[a] Learning deep features for discriminative localization, Zhou et.al., CVPR 2016

Q3: Why the methods in [48, 61] do not serve as proper baselines.

Yes, these methods are indeed excellent. However, they were all designed for image classification and adapting them for segmentation models is very challenging. Therefore, in Table 2, we only considered training-free SynPer for comparison. To address your concern, we test two more SOTA unlearnable methods: Autoregressive Perturbations (AR) and Convolution-based Perturbations (CUDA). Due to space limitations, please refer to our response to Q4 of Reviewer 2xcM and the uploaded PDF file for further details. In summary, UnSeg consistently achieves better performance compared to other methods across different datasets and tasks. We genuinely believe that the high efficiency and transferability of UnSeg will establish it as a solid baseline for seg UEs.

Q4: Analysis of statistical significance.

Thanks for the thoughtful suggestion. As the unlearnable noise is small, the unlearnable images are statistically indistinguishable from the original images. To show this, we plot the pixel value distribution of a clean image and its unlearnable counterpart, where the two distributions are almost the same (the plots can be viewed in the PDF files we uploaded). We will add more plots to the revision.

Q5: Typo error on L223, 220.

Thanks. We will fix the error in the revision.

Q6: Is the method applicable when the model is other than the SAM?

Yes. As a simple and flexible framework, UnSeg can potentially work with segmentation models of a similar architecture to SAM, such as SEEM [a], Semantic-SAM, and Grounded SAM. UnSeg can also work with the recently released SAM 2 [b] model, which we plan to verify in our future work.

[a] Segment everything everywhere all at once, Zou et.al., NeurIPS 2023

[b] SAM 2: Segment Anything in Images and Videos, Ravi et.al, arXiv preprint arXiv:2408.00714 (2024)

Q7: Will the method work if the segmentation model leverages contextual knowledge to create better object masks?

Yes. For example, both DeepLabV1 and DeepLabV3 use dilated convolution to leverage region-level contextual knowledge. However, our method can reduce their mIoU to below 10% (please see Figure 4). Mask2Former employs a significant amount of masked transformers to learn long-range contextual knowledge, and our UnSeg can work effectively against it (Table 2). UnSeg also works on SAM-HQ and RSPrompter which both utilize SAM’s pre-trained knowledge (Figure 5 (a)(b)).

Unlike classification UE methods which add noise to the entire image, UnSeg proves that adding unlearnable noise locally/partially is sufficient to prevent the learning of segmentation models.

Q8: The limitation of UnSeg and the influence of the surrogate model.

One limitation of UnSeg is its moderate effectiveness in protecting objects with very simple textures and shapes, such as birds or bottles. We believe this is because the simplicity of these categories allows the segmentation models to make accurate predictions without relying on shortcuts. We hope to address this limitation in our future work.

We agree with the reviewer that the surrogate model plays a crucial role in optimizing the noise generator. As noted in Unlearnable Clusters, using CLIP as the surrogate model can enhance unlearnable effectiveness. Stable UEs also shows that more robust surrogate models improve the protection effectiveness. Here, we replace the surrogate model from the MAE-pretrained ViT with an ImageNet-pretrained ResNet50. We find that the performance of the noise generator significantly declined when using ResNet50. We believe that using the MAE-pretrained weights can prevent the noise generator from being biased towards specific categories, thereby enhancing its transferability.

We sincerely appreciate your insightful and valuable reviews.

Q1: Discussion about object masks, and more experiments regarding different prompts.

The reason why we consider only object masks as prompts, rather than boxes or points, is to eliminate ambiguity in the prompts. For example, in an image containing a person, if a defender clicks on a point on the person's face to make it unlearnable, the model would be uncertain about what the point refers to: the entire person or just the face? It is also unclear to the defender which object/region has been protected, leading to ambiguity. Using object masks as prompts enables precise specification of the objects to be protected, effectively avoiding the aforementioned ambiguity. In fact, with powerful tools like SAM, it is quite easy to obtain the object masks.

Here, we provide more experiments with different prompts on the Pascal VOC dataset using DeepLabV1. We report two types of results: making all classes unlearnable and making only some classes unlearnable. It shows that our method is robust across different types of prompts, achieving excellent protection even with point prompts.

Q2: Why is the surrogate model initialized with the pretrained MAE model weights instead of SAM weights?

Our bi-level (min-min) optimization alternatively optimizes the surrogate model and the noise generator to minimize the loss between the surrogate model's predictions and the true labels. This means if the surrogate model is initialized with the pre-trained SAM weights, it will lead to a very low initial loss as SAM is already sufficient for high-quality predictions. In this case, the noise generator will no longer need training. In other words, using SAM weights will hinder the optimization of the noise generator. The pre-trained MAE weights, on the other hand, can alleviate this problem and are also a common initialization for segmentation tasks.

Q3: More experiments from different networks and datasets using the clean-unlearnable mixed training dataset.

Thanks for your suggestion. Here, we add the results obtained using the DeepLabV1 on the Pascal VOC dataset.

Then, we conduct new experiments using UNet++ with 5 different backbones on the Kvasir-seg dataset.

We find that: 1) All the results on the mixed datasets are consistently lower than those on the 100% clean. Moreover, the model’s performance when trained on the mixed training set is the same as when trained only on the clean portion of the training data. This implies that the UEs generated by UnSeg contribute almost nothing to the model's training. This result aligns with existing works (UEs, UCs, SynPer, AdvPoison, etc.). 2) The model trained on a mixed dataset sometimes performs worse than the model trained on only clean data. This indicates that our method may also hinder the model's learning on clean data to some extent.

Q4: More comparisons with SOTA methods.

We believe that previous optimization-based (compared to training-free or generative) methods (e.g., UEs/RUEs/TUEs/AdvPoison) face data efficiency, generation efficiency, and transferability challenges, as they need to optimize the unlearnable noise for each new sample. These challenges render them impractical for image segmentation which has diverse scenarios (datasets), higher resolution and complex models. Therefore, we only considered training-free methods (no generative methods available) for comparison in Table 2.

Here we test two more SOTA training-free unlearnable methods: Autoregressive Perturbations (AR) [a] and Convolution-based Perturbations (CUDA) [b]. Please refer to the uploaded PDF for the complete results. For the AR method, we use its AR process to generate sample-wise noise of size $\epsilon=1$ (L2 constraint) for each category. For the CUDA method, we use filters of size 3 and set the blur parameter to 0.3 to generate the noise for each category.

As can be observed, 1) AR loses effectiveness in preventing the segmentation models; 2) CUDA works well on the ADE20K dataset yet inferior to UnSeg on the COCO and Cityscapes dataset; and 3) UnSeg achieves the best performance. We genuinely believe our UnSeg can serve as a solid baseline for segmentation UEs.

[a] Autoregressive perturbations for data poisoning, Pedro et.al., NeurIPS 2022

[b] Cuda: Convolution-based unlearnable datasets, Sadasivan et.al., CVPR 2023