💻 computer science

Full spectrum Unlearnable Examples via Spectral Equalization

This paper introduces FUSE, a novel method for generating full-spectrum unlearnable examples that overcomes the limitations of existing high-frequency-dependent perturbations by employing Random Spectral Masking and Cross-Band Guidance to ensure robust data protection across all frequency bands.

Original authors: Jiale Cai, Gezheng Xu, Zhihao Li, Ruiyi Fang, Ruizhi Pu, Di Wu, Qicheng Lao, Charles Ling, Boyu Wang

Published 2026-06-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jiale Cai, Gezheng Xu, Zhihao Li, Ruiyi Fang, Ruizhi Pu, Di Wu, Qicheng Lao, Charles Ling, Boyu Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Problem: The "High-Frequency" Flaw

Imagine you have a precious photo of your family that you want to share on the internet, but you are terrified that a big tech company will steal it to train their AI. To stop them, you add a tiny, invisible "poison" to the photo. This poison is designed so that if an AI tries to learn from your photo, it gets confused and forgets what the photo actually shows.

For a long time, scientists thought they had a perfect poison. They added "noise" to the photos that looked like static on an old TV. They believed this noise was so strong that the AI couldn't learn anything.

But here is the catch: The paper discovered that these old poisons were actually very fragile. They relied almost entirely on "high-frequency" details—think of these as the tiny, sharp edges, fine textures, and crisp lines in a photo.

If you take one of these "poisoned" photos and run it through a filter that smooths things out (like blurring a photo or compressing it for a slow internet connection), those sharp, high-frequency details disappear. Suddenly, the poison vanishes! The AI can look at the remaining "low-frequency" parts (the big shapes, the general colors, the overall outline) and say, "Ah, I see a dog!" The privacy protection fails completely.

The Solution: FUSE (The "All-Over" Paint)

The authors of this paper, Jiale Cai and his team, realized that to truly protect a photo, the "poison" needs to be everywhere, not just in the sharp edges. They call their new method FUSE (Full-spectrum Unlearnable Examples via Spectral Equalization).

Think of a photo not just as a picture, but as a musical chord.

Low frequencies are the deep, booming bass notes (the big shapes).
High frequencies are the high-pitched, tinkling chimes (the fine details).

Old methods only put the "poison" in the high-pitched chimes. If you mute the chimes, the music is still clear. FUSE spreads the poison evenly across the entire chord, from the deepest bass to the highest chime. No matter which part of the music you mute, the song remains unrecognizable.

How FUSE Works: Two Magic Tricks

To achieve this "all-over" protection, FUSE uses two clever strategies during the creation of the poisoned images:

1. The "Random Blindfold" (Random Spectral Masking)
Imagine you are teaching a student to paint a picture that is impossible to recognize.

The Trick: Every time you show the student a part of the painting, you randomly cover up a different section of the canvas (sometimes the top, sometimes the bottom, sometimes the middle).
The Result: The student realizes they can't rely on just one part of the canvas to make the painting "unrecognizable." They are forced to paint the entire canvas with the confusing pattern. If they only painted the top, and you covered the top, the rest would be clear. By forcing them to paint everywhere, the confusion remains even if a filter removes a chunk of the image.

2. The "Teamwork" (Cross-Band Guidance)
Imagine the "Bass" (low frequencies) and the "Chimes" (high frequencies) are two teammates.

The Problem: Usually, the Chimes are very good at confusing the AI, but the Bass is too clear.
The Trick: FUSE forces the Bass to copy the confusion of the Chimes. It tells the Bass, "You need to be just as confusing as the Chimes!" At the same time, it tells the Chimes, "Don't get so crazy that you ruin the picture; look at the Bass to stay grounded."
The Result: They work together. The Bass becomes confusing enough to stop the AI, and the Chimes stay subtle enough so the human eye still sees a normal photo.

Why This Matters

The paper tested FUSE against many other methods. Here is what they found:

The Old Way: If you blur the image (remove high frequencies), the AI suddenly learns the image perfectly. The protection breaks.
The FUSE Way: Even if you blur the image, compress it, or change the AI model trying to learn it, the AI still fails. It gets confused and guesses randomly, just like a human guessing a word in a language they don't speak.

The authors also showed that FUSE is efficient. It doesn't require massive computing power to create these protected images, making it practical for real people to use to protect their photos.

In Summary

FUSE is a new way to protect your photos from being stolen by AI. Instead of hiding the "poison" in just the sharp details (which can be easily wiped away), FUSE spreads the poison evenly across the entire image. It uses a "random blindfold" technique to ensure the poison is everywhere, and a "teamwork" technique to make sure the big shapes and small details confuse the AI together. The result is a photo that looks normal to you but is impossible for an AI to learn from, no matter how much it tries to filter or smooth the image.

Technical Summary: FUSE – Full-spectrum Unlearnable Examples via Spectral Equalization

1. Problem Statement

Unlearnable Examples (UEs) are a privacy-preserving technique designed to protect training data by adding imperceptible perturbations. These perturbations cause machine learning models to fail in extracting exploitable semantic representations, thereby preventing unauthorized training on sensitive data.

However, the authors identify a critical vulnerability in existing UE methods: their effectiveness is heavily dependent on high-frequency components. Empirical analysis reveals that when a low-pass filter is applied to protected data, the unlearnability of current approaches collapses. Models trained on filtered data can successfully extract semantic information from the residual low-frequency content, leading to privacy leakage. This indicates that existing perturbations are not "spectrum-agnostic" and fail to protect data across the entire frequency spectrum.

2. Methodology

The paper proposes FUSE (Full-spectrum Unlearnable examples via Spectral Equalization), a framework designed to generate perturbations that remain effective regardless of spectral filtering. FUSE achieves this through two complementary components:

A. Random Spectral Masking (RSM)

RSM is designed to prevent perturbations from collapsing into narrow spectral regions. It employs two mechanisms during generator training:

Stochastic Frequency Dropout: A random mask operator $T_{spec}$ is applied at each training step, which zeros out a contiguous portion of the frequency domain in the Fourier transform of the input. This forces the generator to ensure that the remaining frequency bands can still induce unlearnability, preventing over-reliance on specific frequencies.
Entropy Regularization: To further discourage spectral concentration, the method maximizes the entropy of the normalized power spectrum of the perturbation. This encourages a more uniform distribution of perturbation energy across the spectrum without enforcing a white-noise distribution.

The RSM objective ( $L_{RSM}$ ) combines an invariance loss (ensuring performance degradation even when parts of the spectrum are masked) and a negative entropy term.

B. Cross-Band Guidance (CBG)

While RSM distributes perturbations, CBG explicitly manages the interaction between low-frequency (global semantics) and high-frequency (local details) components to ensure mutual consistency.

Frequency Decomposition: Images are split into low-frequency ( $x'_{low}$ ) and high-frequency ( $x'_{high}$ ) components using a circular mask in the Fourier domain defined by a radius $r_c$ .
Semantic Guidance: The high-frequency branch, which naturally induces stronger classifier confusion, is used as a "soft target" to guide the low-frequency branch. The low-frequency component is trained to align with the predictions of the high-frequency component ( $L_{guide}$ ), ensuring that global structures do not remain learnable.
Structural Consistency: To prevent the high-frequency branch from distorting independently, a consistency loss ( $L_{struct}$ ) is applied. This loss minimizes the difference between the structural similarity (combining feature-level cosine similarity and SSIM) of the low-frequency pair and the high-frequency pair. The low-frequency similarity acts as a fixed target (via stop-gradient) to regularize the high-frequency perturbations, preserving semantic fidelity while maintaining unlearnability.

The total optimization objective minimizes the sum of $L_{RSM}$ and $L_{CBG}$ subject to a perturbation budget ( $\|\delta\|_\infty \le \epsilon$ ).

3. Key Contributions

Vulnerability Identification: The authors demonstrate that existing UE defenses fail under low-pass filtering because their perturbations rely predominantly on high-frequency components.
Spectrum-Agnostic Framework: FUSE is proposed as a novel framework that distributes perturbation effects across the entire frequency range, preventing residual cues in any specific band.
Comprehensive Evaluation: Extensive experiments across multiple datasets (CIFAR-10, CIFAR-100, SVHN), architectures (ResNet, VGG, DenseNet, ViT, and non-standard models like ConvNeXt and Swin-T), and defense strategies show that FUSE consistently outperforms prior approaches.

4. Experimental Results

Low-Pass Filtering Robustness: Under low-pass filtering, existing methods (e.g., LSP, TUE, GUE) show significant accuracy recovery (e.g., LSP reaches ~54% on CIFAR-10 with ResNet-18). In contrast, FUSE maintains test accuracy near random guessing (e.g., ~10% on CIFAR-10), demonstrating robustness even when high frequencies are suppressed.
Unfiltered Performance: FUSE achieves the lowest test accuracy across most dataset-architecture pairs even without filtering, confirming its effectiveness in standard scenarios.
Cross-Architecture Transferability: FUSE remains effective when the surrogate model (ResNet-18) is used to generate perturbations for diverse target architectures, including Vision Transformers and non-standard CNNs.
Defense Resistance: FUSE maintains strong unlearnability against various defense strategies, including data augmentation, adversarial training, and UE-specific defenses like D-VAE, AN-SDA, and ORTHO PROJ. It also demonstrates robustness against JPEG compression.
Vision-Language Models: In a proof-of-concept study on CLIP, FUSE caused a significant accuracy drop (4.28% unfiltered, 6.06% low-pass) compared to baselines, suggesting applicability beyond standard classification.
Efficiency: Compared to the generator-based baseline GUE, FUSE requires significantly fewer parameters, lower GFLOPs, and faster inference times.

5. Significance and Claims

The paper claims that FUSE addresses a fundamental limitation in current data protection methods by ensuring that unlearnability is not confined to high-frequency regions. By enforcing spectral equalization and cross-band consistency, FUSE provides reliable privacy protection that persists even when data undergoes spectral filtering or other transformations that remove high-frequency details. The authors position this work as a step toward more robust, frequency-aware privacy mechanisms that can withstand adaptive defenses and distribution shifts.

The authors explicitly state that their goal is to strengthen privacy protection against unauthorized model training, while acknowledging that such perturbations could theoretically be misused in adversarial contexts. They emphasize that FUSE should be applied solely for ethical data protection purposes in compliance with legal frameworks and dataset licenses.