How Far Are We from True Unlearnability?

Thanks for the insightful comments and evaluation. ___ (1) *While the paper highlights the limitations of existing unlearnable example (UE) methods in multi-task scenarios, it does not provide solutions or adaptations to improve UE robustness across tasks.* We indeed do not propose a method for constructing multi-task UEs in this paper for several reasons: 1. The primary contribution of our paper lies in identifying issues with existing UE methods from a multi-task perspective, analyzing the essence of unlearnability, and introducing a novel quantitative metric combined with model parameters to assess the non-learnability of datasets; 2. Due to the unknown training objectives, multi-task UE is clearly a greater challenge in the practical realm of data privacy protection, which has not yet been emphasized by current scholars, thus we leave this challenge for future discussions and endeavours; 3. Nonetheless, we have offered two new insights to inform future research on multi-task UEs: (1) construction of UEs should not be decoupled from the model itself, as the manifestation of sample unlearnability stems from abnormal updates during the model parameter optimization process, with samples predating model selection in the training process. Therefore, the construction of UEs should consider the underlying training objectives and the model; (2) the construction of multi-task UEs should focus more on the feature extraction from the model backbone; only if the feature extraction of multi-task learning is affected can the performance of the model's multi-task heads be further impacted, thereby demonstrating unlearnability. 4. For other practical impacts of our research, please see our No.(2) response to Reviewer 6Uf4. ___ (Q1) *could SAL and UD metrics be used to improve UE robustness across diverse tasks?* Yes, as mentioned in the above response, the key to multi-task UEs lies in their impact on the extraction of shared features among multiple tasks. Most of the parameters in a multi-task model are located in the backbone, and the influence of UEs on neurons at different layers and positions varies. By employing the SAL and UD metrics we propose, we can analyze the unlearnability of UEs from the perspective of parameter updates, rather than solely relying on simple task metrics, which is clearly insufficient.

Thank you for the insightful comments and evaluation, and sorry for the late response because we have been fully engaged in supplementing new experiments. ___ (1) *It would be valuable to see results on larger and more complex datasets, like ImageNet.* Thanks for the suggestions. We have added results on ImageNet-100. The majority of unlearnable methods perform similarly on the ImageNet-100 dataset as they do on the CIFAR dataset. For instance, EM significantly outperforms REM, despite its perturbations lacking sufficient robustness. Notice that OPS exhibits the largest UD on ImageNet-100 accompanied by an increasing \#LP as epochs grow, showing a weirdly opposite trend to the CIFAR dataset. We leave this observation for future discussions. | Unlearnable Method | Test Acc | #LP | UD | | |--------------------|----------|-------|-------|---| | Vanilla | 69.13 | 3.10 | \ | | | EM | 1.25 | 0.42 | 0.136 | | | REM | 4.90 | 2.50 | 0.805 | | | LSP | 5.33 | 1.83 | 0.590 | | | OPS | 5.73 | 4.37 | 1.406 | | The full results have been added to Table 1 in the revised manuscript (experiments of a small number of UE methods have not yet been completed, and we will update them as soon as they are completed; these do not affect the analysis of the overall experimental results). ___ (Q1) *Revisiting Figure 1, it highlights that the Error Minimization (EM) method struggles to perform effectively in multi-task scenarios. I'm curious if any recent methods have also faced similar limitations.* We apologize for the lack of clarity in Figure 1 of our previous submission. We have redrawn Figure 1 based on new experimental results: we include two additional popular UE methods besides EM (OPS and AR) and also introduce random noise for comparison (the perturbations for OPS and AR are based on classification tasks). We selected 12 different tasks for our analysis. The figure now demonstrates that existing UEs do not perform well in multi-task scenarios. This is not only because previous UE methods are primarily designed for simple classification tasks, but also due to the conflicts between multiple tasks and the fact that multi-task UEs noise features (with perturbation less than 8/255) are more challenging for models to learn compared to sample features. Furthermore, it should be noted that regarding cross-task scenarios—where UEs crafted for one task are tested for their transferability to other tasks—please refer to Appendix A.2, which illustrates that existing UEs also fail in cross-task contexts. We apologize for any confusion caused by our previous unclear distinction between cross-task and multi-task scenarios. (Q2) *generalizability of the evaluation metrics.* Although our primary experiments on the proposed metrics are conducted on classification tasks, we also conduct experiments on multi-task scenarios (see Section 3.4). The results indicate that the SAL across different tasks does not maintain a consistent trend, providing a deeper explanation for the difficulty in making multi-task UEs work effectively. Moreover, our proposed metrics are not specific to classification tasks; we calculate them using Sharpness analysis, which only requires the computation of loss and is independent of classification tasks. Nevertheless, your concern does make sense. There is a scarcity of research on existing UE methods for tasks beyond classification, which makes it challenging to conduct more comprehensive experimental analyses for other domains. Therefore, we also look forward to a more comprehensive dataset and benchmark that includes multi-task UEs to evaluate their unlearnability across various tasks.

Thanks for the insightful comments and evaluation, and sorry for the late response because we have been fully engaged in supplementing new experiments. ___ (1) *Limited explanation of multi-task unlearnability failure and Limited scope of multi-task experiments.* Thanks for your suggestion. We have included additional experimental results and explanations regarding the failure of multi-task UEs (see Figure 1 in the Introduction and Figure 7-8 in the Appendix). We believe this is crucial because the primary objective of this paper is to explore the nature of UEs. The failure of existing UEs in multi-task scenarios has provided us with valuable insights, guiding us to understand the essence of UEs from the perspective of parameter learning. Given the unknown training objectives, data privacy protection based on UEs must overcome the challenges posed by multi-task scenarios to be effective in practice. We have provided two insights for future research aimed at addressing multi-task UEs, as detailed below: 1. construction of UEs should not be decoupled from the model itself, as the manifestation of sample unlearnability stems from abnormal updates during the model parameter optimization process, with samples predating model selection in the training process. Therefore, the construction of UEs should consider the underlying training objectives and the model; 2. the construction of multi-task UEs should focus more on the feature extraction from the model backbone; only if the feature extraction of multi-task learning is affected can the performance of the model's multi-task heads be further impacted, thereby demonstrating unlearnability. ___ (2) *Lack of discussion on practical implications.* Advancing the practicality of unlearnable data is our common goal, and it is also the starting point of our work. Let's explore the practical impact of our research from two angles. - **For Current Work: Unmasking the Critical Gap in UE Methods.** Our study highlights the limitations of existing UE methods and underscores the importance of cross/multi-task unlearnability for data protection. Essentially, current UEs are ineffective when deployed, and we seek to alert data protectors to these inherent limitations. Additionally, we aim to provoke significant attention, calling for a comprehensive reevaluation of how UEs handle cross/multi-task unlearnability. - **For Future Work: Providing an Effective Tool for Evaluating UE Methods.** We provide a powerful tool to assess the practical unlearnability of UE methods, introducing two metrics (i.e., SAL and UD) during training. These metrics help data protectors and researchers predict UE effectiveness, minimizing resource waste. Moreover, SAL and UD could guide the development of more effective UEs by highlighting the essential characteristics they should possess. ___ (3) *Poor visualization of figures.* Thanks for pointing out the issue with the visualization of figures. To address this issue, we have revised our figures to enhance their readability and clarity. For instance, - In Figure 1, we have **redrawn** Figure 1 based on new experimental results with three popular UE methods (EM, OPS and AR) and random noise for comparison (perturbations for OPS and AR are based on classification tasks). We select 12 different tasks. We can see that existing UEs fail in multi-task scenarios. - In Figure 2, we adjust the size of the displayed loss landscape region to more clearly reflect the process of model convergence. - In Figure 4, we increase the font size. This image reflects the sharpness of the parameters in the model trained by different UEs. The clean training and TAP are clearly darker, while the number of dark grids in other UEs decreases rapidly after a few epochs. Please see Figures 1, 2 and 4 in our revision for details. We believe these changes will enhance the clarity and effectiveness of our presentation.

___ (Q1) *For instance, do UEs designed for one task interfere with the learning of other tasks? Or do the shared representations learned in multi-task models somehow overcome the unlearnability effect of UEs?* Thanks for the suggestion, our previous manuscript does lack detailed explanations regarding the failure of multi-task UEs. We have now supplemented the main text and appendix with additional details and explanations on this matter: 1. Regarding the transferability of single-task UEs, we summary them as cross-task UEs (sorry for the confusion between cross-task UE and multi-task UE). We conduct ablation experiments based on EM to verify this (see Appendix A.2). Results show UEs from single tasks struggle to transfer to other tasks, and are even ineffective within their own tasks(in multi-task models); 2. For multi-task UEs, we add Figure 1 and Appendix A.1 to illustrate that existing UEs fail in multi-task scenarios. This is because the parameter trends for different tasks are difficult to align consistently, even though the multi-task heads share features extracted from the same backbone. The divergence in loss functions leads to inconsistent trends, and this more fundamental issue poses a significant challenge for multi-task UEs. ___ (Q2) *How can the insights from this research be translated into real-world solutions for protecting data ownership? What are the potential challenges in implementing these solutions?* Please see the above No.(2) response.

We have revised the paper again according to the comments, and the edits have been highlighted in **BLUE**: 1. We update the contributions in the Intro to give a clearer summary of the practical implications that the reviewer mentioned: - Utilizing the proposed UD, we benchmark existing unlearnable methods and provide a more intrinsic tool for evaluating UEs. Our approach ascertains the gap between existing research efforts and the truly UEs while encouraging the development of more practical unlearnable methods from a novel perspective. 2. We add more explanation in Section 3 (SHARPNESS-AWARE UNLEARNABILITY EXPLANATION) about loss landscape of UEs: - Hence, we suppose that the abnormal updates of key parameters reflect this unlearnability of models, and unlearnable perturbations to the samples make it difficult to update the parameters properly. The evaluation of UEs should take into account the updates of model parameters, rather than solely relying on simple test accuracy. 3. We correct many typos and expression issues again for a better presentation. Should you have any further questions or suggestions, we will be more than happy to discuss with you and implement improvements accordingly.