# Asymmetric relaxations through the lens of information geometry

Alessandro Bravetti, Miguel Ángel García Ariza, Pablo Padilla  Instituto de
Investigaciones en Matemáticas Aplicadas y en Sistemas, Universidad Nacional
Autónoma de Mexico, A. P. 70543, Ciudad de Mexico 04510, Mexico
<EMAIL_ADDRESS>
###### Abstract.

We introduce a novel perspective on Newton’s Law of Cooling by framing it
within the context of information geometry. By characterizing it as a specific
representation of a gradient flow, we establish a connection with the well-
known Horse-Carrot Theorem and reveal previously unexplored instances of
asymmetric relaxations in the context of endoreversible processes. We present
a completely general and practical criterion for predicting asymmetries based
on the Amari-Chentsov tensor, whose applicability extends to both classical
and quantum thermodynamics. Illustrative examples include faster cooling down
of quantum ideal gases, and relaxations reminiscent of the Mpemba effect in
classical ideal gases.

##  1\. Introduction

It is well-established that when a system comes into contact with a heat bath,
it undergoes relaxation, ultimately reaching an equilibrium state with the
same temperature as the bath. Nevertheless, intriguingly, certain conditions
can lead to a faster relaxation process when the system is initially colder
than the bath, a phenomenon referred to as asymmetric relaxation [1].

Let us elucidate the precise meaning of the phenomenon mentioned above.
Consider two systems initially in equilibrium, one cooler and the other hotter
than a prescribed thermal bath with temperature $T_{q}$. After an
instantaneous temperature quench to the bath’s temperature, the cooler system
relaxes faster, given equidistant initial temperatures. In this context, the
distance is measured using the Kullback-Leibler divergence of the
distributions describing the systems. This notion of distance also defines
what we mean by faster relaxation: at any given time after the quench, the
relative entropy (i.e., the Kullback-Leibler divergence) between the cooler
system and the target state is less than that between the hotter system and
the target state. This concept of distance, also known as generalized free
energy[2], is physically meaningful as the relative entropy between two states
represents the difference between the current value of the thermodynamic
potential and its equilibrium value. Consequently, it serves as an
(asymmetric) measure for the distance to equilibrium.

This situation applies to specific systems, characterized by dynamics
unfolding in a quadratic potential and governed by an overdamped Langevin
equation [1, 3]. While extending to systems driven from equilibrium with a
linear drift [4], it lacks universal applicability [5, 6], highlighting the
intricate nature of relaxation mechanisms.

Here, we investigate asymmetric relaxations in systems relaxing according to a
generalized Newton’s Law of Cooling through the lens of information geometry.
We initially focus on systems that undergo endoreversible relaxation, where
each intermediate stage constitutes an internal equilibrium state, and
irreversibilities manifest solely at the boundaries between the system and the
bath [7, 8]. This approach ensures a well-defined notion of temperature
throughout the process, allowing us to study relaxations to $T_{q}$ governed
by Newton’s Law,

(1) $\dot{T}=-\lambda(T-T_{q}).$

Subsequently, we leverage information geometry to depict the latter as a
gradient flow, thereby extending our insights to a broader spectrum of
relaxation processes dictated by this generalized Newton’s Law of Cooling.

Our approach is motivated by the exploration of Gaussian chain relaxations,
where the average potential energy and entropy during the process, given by
[1]

$\langle U(t)\rangle=\frac{3}{2}\sum_{k}\Lambda_{k}^{T}(t)\quad\text{ and
}\quad
S(t)=\frac{3}{2}\sum_{k}\left[1-\ln\left(\frac{\mu_{k}}{2\pi\Lambda_{k}^{T}(t)}\right)\right],$

resemble ideal gas equations. This similarity stems from regarding
$\Lambda^{T}_{k}(t)$ as a normalized temperature evolving with Newton’s Law
[1], justifying our focus on relaxation processes governed by this principle.

To study asymmetries in endoreversible relaxations, we employ exponential
distributions to describe equilibrium states. Introducing the information-
geometric structure of the corresponding statistical manifold in Sect. 2, we
depict Eq. (1) as a Riemannian gradient flow in Sect. 3. This approach is
applied to closed ideal gases in Sect. 4, revealing faster warming than
cooling. In Sect. 5, we demonstrate that this asymmetry transcends specific
systems, depending solely on the gradient flow nature of the relaxation
process and the geometric structure of the space of states. Sects. 6 and 7
illustrate the result’s utility, showcasing asymmetry reversal in quantum
ideal gases and a phenomenon akin to the Mpemba effect in ideal gases.
Finally, Sect. 8 concludes with remarks and future perspectives.

##  2\. The geometry of equilibrium thermodynamics

Equilibrium states in thermodynamic systems are described by exponential
probability distributions known as Gibbs’ distributions, as outlined in our
Introduction. These distributions, denoted as $\rho(q,p;\eta_{i})$, are
defined over the phase space of a system labeled by points $(q,p)$. They take
the form

(2) $\rho(q,p;\eta_{i})=e^{\eta_{i}F^{i}(q,p)-\psi(\eta)}.$

Here, $i$ runs from 1 to $n$, the parameters $\eta_{i}$ hold physical
significance depending on the system’s ensemble [9, 10], and the Einstein
summation convention is employed.

It follows that the equilibrium states of a system form a statistical manifold
parameterized by the $\eta_{i}$. As such, it is endowed with a geometric
structure comprising the Fisher information metric $g$ and two symmetric
connections, $\nabla$ and $\nabla^{*}$, referred to as exponential and mixture
connections, respectively [11]. They satisfy a generalization of the Leibniz
rule for the inner product, expressed as

(3) $X[g(Y,Z)]=g(\nabla_{X}Y,Z)+g(Y,\nabla^{*}_{X}Z).$

When $\nabla=\nabla^{*}$, this connection reduces to the Levi-Civita
connection. Therefore, this so-called dual structure $(g,\nabla,\nabla^{*})$
may be regarded as a generalization of Riemannian geometry [12, 13, 14].

In the context of exponential distributions (2), a straightforward computation
reveals that the Fisher metric is Hessian with potential $\psi(\eta)$, given
by the components

(4) $g^{ij}(\eta)=\frac{\partial^{2}\psi}{\partial\eta_{i}\partial\eta_{j}}.$

Additionally, the connections $\nabla^{*}$ and $\nabla$ are flat, with affine
coordinates $\eta_{i}$ and

(5) $\theta^{i}:=\dfrac{\partial\psi}{\partial\eta_{i}},$

respectively [15]. Such a dual structure is called dually flat [11].

The components of $g$ can also be expressed as

$g_{ij}(\theta)=\frac{\partial^{2}\phi}{\partial\theta^{i}\partial\theta^{j}},$

with

(6) $\phi(\theta):=\theta^{i}\eta_{i}-\psi(\eta),$

representing the Legendre transform of $\psi$.

Dually flat structures introduce a unique divergence, known as the Bregman
divergence [11] or $\nabla$-divergence [16], defined by

(7) $D(p||q)=\phi(p)+\psi(q)-{\theta^{i}}(p)\eta_{i}(q).$

For exponential distributions, this coincides with the Kullback-Leibler
divergence, and in the context of thermodynamics it represents the
availability of the system, i. e., the amount of useful work that can be
extracted from a system that is not in equilibrium with its surroundings [17,
18, 19, 20].

In the next section, we make use of the dually flat structure of the space of
equilibrium states to rephrase Eq. (1) in geometric terms.

##  3\. Newton’s Law of Cooling as a gradient flow

Let us assume that the temperature of a fluid, denoted by $T$, is one of the
affine coordinates of $\nabla^{*}$, specifically $\eta_{1}=T$. We may view Eq.
(1) as one component of the system

(8) $\dot{\eta}_{j}=-\lambda(\eta_{j}-{\eta_{j}}_{q}),$

where ${\eta_{j}}_{q}:=\eta_{j}(q)$, and $q$ is the equilibrium state of a
thermal bath, assumed unchanged by the relaxation process. We rewrite Eq. (8)
in dual coordinates $\theta^{i}$, following the procedure in [16]. Indeed,

$g^{ij}\dot{\eta}_{j}=\dot{\theta}^{i}.$

Multiplying Eq. (8) by $g^{ij}$ and using Eq. (5), we obtain

$\begin{split}\dot{\theta}^{i}&=-\lambda
g^{ij}\left(\frac{\partial\phi}{\partial\theta^{j}}-{\eta_{j}}_{q}\right)\\\
&=-\lambda
g^{ij}\frac{\partial}{\partial\theta^{j}}\left(\phi+\psi_{q}-\theta^{k}{\eta_{k}}_{q}\right),\end{split}$

where $\psi_{q}:=\psi(q)$. We can then express the system (8) as

(9) $\dot{\gamma}=-\lambda\operatorname{grad}D_{q},$

where $D_{q}:=D(\cdot||q)$ (see Eq. (7)), $\gamma(t):=(\theta^{i}(t))$, and
$\operatorname{grad}$ denotes the Riemannian gradient operator
$\sharp\circ\mathrm{d}$. Thus, Newton’s Law of Cooling is portrayed as one
component of a gradient flow, which we refer to as the generalized Newton’s
Law of Cooling. This can be succinctly stated as our first main result.

######  Theorem 1.

For endoreversible processes, Eq. (1) is one component of the gradient flow
defined by Eq. (9).

We proceed to show that $\eta_{1}$ can indeed be identified with the fluid’s
temperature. To construct an alternative dually flat structure for which
$\eta_{1}=T$, we appeal to the physical meaning of $\phi$ and $\theta^{1}$.
The former is identified with the negative entropy of the system, denoted by
$-S$, whereas the latter represents the internal energy, denoted by $U$ [9].
Thus, from Eq. (5), we have

$-\mathrm{d}S=-\frac{1}{T}\mathrm{d}U+\eta_{j}\mathrm{d}\theta^{j},$

or equivalently,

(10) $\mathrm{d}U=T\mathrm{d}S+\bar{\eta}_{j}\mathrm{d}\theta^{j},$

where we defined $\bar{\eta}_{j}:=T\eta_{j}$ and $j$ runs from 2 to $n$. The
convexity of $-S$ as a function of $U$ and $\theta^{j}$ guarantees that $U$
itself is convex in $S$ and $\theta^{j}$ [18]. This implies that $U$ generates
a dually flat structure with $\eta_{1}=T$, as desired. The corresponding
metrics are known in physics as Weinhold metrics [21] and are conformally
equivalent to Fisher’s [22, 23], called Ruppeiner metrics in this context
[24].

We now turn to the corresponding divergence, which, according to Eq. (7), is
given by

(11)
$D_{q}=U+\bar{\psi}_{q}-T_{q}S-\left(\bar{\eta}_{j}\right)_{q}\theta^{j},$

coinciding with the amount of useful work that can be extracted from the
system as it relaxes towards state $q$. A straightforward calculation shows
that it corresponds to the Kullback-Leibler divergence of the exponential
distributions parameterized by $T$ and $\bar{\eta}_{i}$ [16]. Therefore, we
will use it to study asymmetric relaxations in endoreversible processes, as
done in [1] for some specific models of relaxation dynamics. This task
requires two ingredients: the choice of a statistical ensemble and a so-called
fundamental equation. The first one endows $\bar{\psi}$, $\eta_{j}$, and
$\theta^{j}$ with concrete physical meaning [25]. The second one is a
particular choice of $U=U(S,\theta^{j})$, determining a thermodynamic system
in equilibrium uniquely. In the following sections, we will reveal the
occurrence of asymmetric relaxations through them. Before proceeding, it is
worth noting that not all the availability is transformed into work during a
relaxation process. In fact, the infinitesimal availability dissipated along
the process is $\mathrm{d}A=-\mathrm{d}D_{q}$ [26, 27].

For systems relaxing according to Eq. (9),

(12) $\begin{split}||\dot{\gamma}||^{2}&=g(\dot{\gamma},\dot{\gamma})\\\
&=-\lambda g(\operatorname{grad}D_{q},\dot{\gamma})\\\
&=-\lambda\mathrm{d}D_{q}(\dot{\gamma})\\\ &=-\lambda\dot{D}_{q},\end{split}$

whence, along $\gamma$,

$-\lambda\mathrm{d}D_{q}=||\dot{\gamma}||^{2}\mathrm{d}t.$

The total dissipated availability after a time $\tau$ is then

(13) $\delta
A(\tau)=\frac{1}{\lambda}\int_{0}^{\tau}||\dot{\gamma}||^{2}\mathrm{d}t\geq\frac{L_{\gamma}^{2}}{\lambda\tau},$

with $L_{\gamma}$ denoting the length of $\gamma$, and the last result
following from the Cauchy-Schwarz inequality.

Assuming now that the system is driven along a prescribed path $\gamma$ by
putting it in contact with a sequence of reservoirs, we have a sequence of
target states $q(t)$ to which the system relaxes, with $0\leq t\leq\tau$. This
might also require that $\lambda=\lambda(t)$ in Eq. (1) (cf. [28]). In this
case, defining $\epsilon:=1/\lambda$, we have

$\begin{split}\delta
A&=\int_{0}^{\tau}\epsilon||\dot{\gamma}||^{2}\mathrm{d}t\\\
&=\bar{\epsilon}\int_{0}^{\tau}||\dot{\gamma}||^{2}\mathrm{d}t,\end{split}$

with $\bar{\epsilon}$ denoting the weighted average of $\epsilon$ with respect
to $||\dot{\gamma}||^{2}$, $\tau$ being the duration of the process, and the
last equality following from the Mean Value Theorem. Applying again the
Cauchy-Schwarz inequality,

(14) $\delta A\geq\frac{\bar{\epsilon}L_{\gamma}^{2}}{\tau}.$

This inequality is known as the Horse-Carrot Theorem [26, 29], establishing a
lower bound on the entropy production during any process performed at finite
time (see also [30]). Thus, we have proven the following consequence of
Theorem 1.

######  Corollary 1.

The Horse-Carrot Theorem (14) holds for any process satisfying

(15) $\dot{\gamma}=\lambda(t)\operatorname{grad}D_{q(t)}.$

This observation automatically extends the applicability of the Horse-Carrot
Theorem beyond the domain of endoreversible thermodynamics to encompass any
dynamics of the type (15), such as those encountered in areas like machine
learning and evolutionary biology [16, 31].

In the subsequent section, we apply the generalized Newton’s Law of Cooling to
a concrete example, shedding light on the occurrence of asymmetric relaxations
even in the simplest systems.

##  4\. Asymmetric relaxation of a closed ideal gas

We now delve into the analysis of the endoreversible relaxation of a closed
ideal gas, employing the tools developed in the previous section. Despite the
apparent simplicity of such systems, our investigation reveals an intriguing
asymmetry – a phenomenon where warming up occurs faster than cooling down.

Consider two distinct initial equilibrium states, denoted as $p^{\pm}_{0}$,
along with a target equilibrium state $q$. The latter may be regarded as the
state that systems will attain when immersed in a given thermal bath. We
assume these two initial states are equidistant from $q$, meaning that
$D_{q}(p^{+}_{0})=D_{q}(p^{-}_{0})$ [1].

To demonstrate the faster warming up compared to cooling down, we compare
$D^{+}:=D_{q}(\gamma^{+}(t))$ to $D^{-}:=D_{q}(\gamma^{-}(t)),$ where
$\gamma^{\pm}(t)$ denotes the solution of Eqs. (8) starting at $p_{0}^{\pm}$.
Assuming constant pressure throughout simplifies the scenario, with $q$ and
$p^{\pm}_{0}$ uniquely determined by the values of their temperatures, $T_{q}$
and $T^{\pm}_{0}$, respectively.

Begin by expressing $D_{q}$ in terms of $T$, using the equations of state [18]

(16a) $\displaystyle U$ $\displaystyle=cN_{0}kT,$ (16b) $\displaystyle PV$
$\displaystyle=N_{0}kT.$

Here, $N_{0}$ represents the constant number of gas particles, and $c>0$ is a
constant related to the energy equipartition. Eqs. (16) define an ideal gas.
To connect them to a fundamental equation $U=U(S,V)$, we use Eq. (10), with
$\bar{\eta}_{2}=-P$ representing the pressure. This leads to

(17)
$S=N_{0}k\left[(c+1)\ln\left(\frac{T}{T_{q}}\right)-\ln\left(\frac{P}{P_{q}}\right)\right].$

Under constant pressure ($P=P_{q}$), the second term in the square brackets
vanishes. Consequently, for an isobaric relaxation, Eq. (17) yields

(18) $\Delta D=(c+1)N_{0}k\left[\Delta
T-T_{q}\ln\left(\frac{T^{+}}{T^{-}}\right)\right],$

where $\Delta D:=D^{+}-D^{-}$ and $D$ is given by Eq. (11).

We proceed to show that $\Delta D$ is always positive, irrespective of the
initial states. To prove this, we will establish that all the critical points
of $\Delta D$ are maxima. Given that $\Delta D(0)=0$ and
$\lim_{t\to\infty}\Delta D=0$, this then will imply that $\Delta D$ is
positive on $(0,\infty)$. Indeed, a straightforward computation yields

$\Delta\dot{D}=-\lambda(c+1)N_{0}k\frac{\Delta
T}{T^{+}T^{-}}(T^{+}T^{-}-T_{q}^{2}).$

According to Eq. (1), if $T_{0}^{-}<T_{q}<T_{0}^{+}$, then $T^{-}<T^{+}$ for
all $t$. Thus, $\Delta T>0$ and the only critical point of $\Delta D$ on
$[0,\infty)$ occurs at $t=t_{*}$, satisfying

(19) $T^{+}(t_{*})T^{-}(t_{*})=T_{q}^{2}.$

To verify that this critical point corresponds to a maximum, we compute the
second derivative of $\Delta D$, obtaining

$\Delta\ddot{D}=-\lambda(c+1)N_{0}k\left[(T^{+}T^{-}-T_{q}^{2})\frac{\mathrm{d}}{\mathrm{d}t}\left(\frac{\Delta
T}{T^{+}T^{-}}\right)+\frac{\Delta
T}{T^{+}T^{-}}\dfrac{\mathrm{d}}{\mathrm{d}t}(T^{+}T^{-}-T_{q}^{2})\right]$

At $t=t_{*}$, the first term in the square brackets vanishes, and

$\begin{split}\left.\dfrac{\mathrm{d}}{\mathrm{d}t}\right|_{t_{*}}(T^{+}T^{-})=\left.\lambda\frac{T_{q}}{T^{-}}\left(T^{-}-T_{q}\right)^{2}\right|_{t_{*}}.\end{split}$

Therefore,

$\Delta\ddot{D}|_{t_{*}}=-\lambda^{2}(c+1)N_{0}k\frac{\Delta
T|_{t_{*}}}{T^{-}(t_{*})}\left(T^{-}(t_{*})-T_{q}\right)^{2},$

which is negative, indicating that $\Delta D|_{t_{*}}$ is a maximum. Thus, we
have proved our second main result (see Fig. 1).

######  Proposition 1.

At constant pressure, a closed ideal gas warms up faster than it cools down.

Figure 1. Left: $D$ as a function of $T$ for a monoatomic ideal gas ($c=3/2$),
in units of $k=1$. We can observe that $T^{-}$ is closer to $T_{q}$ than
$T^{+}$, meaning that warming up occuring faster than cooling down at constant
pressure, according to Newton’s Law. Right: $\Delta D$ for the same system as
a function of time, in units of $k=1$. Since $\Delta D>0$, $D^{+}>D^{-}$,
reiterating that warming up takes place faster than cooling down.

It is crucial to note that Eqs. (16) remain valid at all times during the
relaxation, provided the process is endoreversible. In this context,
endoreversibility implies that, at each stage, the thermal bath and the fluid
immersed in it are in internal equilibrium separately.

In view of Eq. (1), the asymmetry in the relaxation may seem trivial, arising
from an asymmetry in the initial conditions. However, our non-trivial finding
establishes that $|T_{0}^{-}-T_{q}|<|T_{0}^{+}-T_{q}|$. In physical terms, the
initial temperature difference is greater when cooling down than when warming
up, for a fixed amount of available energy. Furthermore, $\Delta D>0$ for all
$t>0$, implying that one can extract more useful work from a system cooling
down than from one warming up.

In the next section, we will replicate our approach to a certain extent,
without relying on a specific equation of state or a particular relaxation
process. This will unveil the role of the geometric structure of the space of
equilibrium states in the asymmetry of an endoreversible relaxation process,
eliminating the particularities observed in this section.

##  5\. The general result

In this section, we study the conditions leading to asymmetric relaxations in
a more general setting. Using a similar technique to the one applied to the
ideal gas, we now impose only the condition that the relaxation process evolve
according to Eq. (9).

Consider integral curves $\gamma^{1,2}$ of Eq. (9), initiated from
$p_{0}^{1,2}$, respectively. Define $D^{1,2}:=D_{q}(\gamma^{1,2}(t))$ and
$\Delta D:=D^{2}-D^{1}.$ Assuming $\Delta D$ is sufficiently well-behaved,
asymmetric relaxation toward $q$ occurs when $\Delta D\neq 0$, for all
$t\in(0,\infty)$, provided $\Delta D(0)=0$ and $\lim_{t\to\infty}\Delta D=0$.
This implies that $\Delta D$ has critical points that are only maxima or only
minima.

We begin by finding the critical points of $\Delta D$. Eq. (12) establishes
that $\Delta\dot{D}=0$ if and only if
$||\dot{\gamma}^{2}||=||\dot{\gamma}^{1}||.$ We now determine when this
critical point will be a maximum.

Differentiating Eq. (12), we obtain

(20)
$\begin{split}-\lambda\ddot{D}&=\dot{\gamma}[g(\dot{\gamma},\dot{\gamma})]\\\
&=2g(\nabla^{\text{LC}}_{\dot{\gamma}}\dot{\gamma},\dot{\gamma}),\end{split}$

where $\nabla^{\text{LC}}$ denotes the Levi-Civita connection of $g$.

Employing the dually flat structure of the space of equilibrium states (see
Eq. (3)), we have

(21)
$\begin{split}-\lambda\ddot{D}&=g(\nabla_{\dot{\gamma}}\dot{\gamma},\dot{\gamma})+g(\dot{\gamma},\nabla^{*}_{\dot{\gamma}}\dot{\gamma})\\\
&=g(\nabla_{\dot{\gamma}}\dot{\gamma},\dot{\gamma})+g(\dot{\gamma},-\lambda\dot{\gamma})\\\
&=g(\nabla_{\dot{\gamma}}\dot{\gamma},\dot{\gamma})-\lambda||\dot{\gamma}||^{2},\end{split}$

where the second equality stems from the fact that $\gamma$ is a
$\nabla^{*}$-geodesic converging to $q$ [16].

Upon introducing the Amari-Chentsov tensor $C$ corresponding to
$(g,\nabla,\nabla^{*})$ [12, 13], defined as

$C^{\sharp}:=2(\nabla^{\text{LC}}-\nabla),$

Eq. (21) yields

$\begin{split}\lambda\ddot{D}&=2g(\nabla^{\text{LC}}_{\dot{\gamma}}\dot{\gamma},\dot{\gamma})-2g(\nabla_{\dot{\gamma}}\dot{\gamma},\dot{\gamma})+2\lambda||\dot{\gamma}||^{2}\\\
&=C(\dot{\gamma},\dot{\gamma},\dot{\gamma})+2\lambda||\dot{\gamma}||^{2}.\end{split}$

Evaluating $\ddot{D}^{1,2}$ at the time $t=t_{*}$ when
$||\dot{\gamma}^{2}||=||\dot{\gamma}^{1}||$ (see Eq. (12)), and substituting
the result into the last equation, we derive

(22)
$\lambda\Delta\ddot{D}|_{t_{*}}=C(\dot{\gamma}^{2},\dot{\gamma}^{2},\dot{\gamma}^{2})|_{t_{*}}-C(\dot{\gamma}^{1},\dot{\gamma}^{1},\dot{\gamma}^{1})|_{t_{*}}.$

We have thus arrived at a general characterization of asymmetric relaxations,
which is our third main result.

######  Theorem 2.

For two possible relaxation processes $\gamma^{1,2}$ satisfying Eq. (9), if

$C(\dot{\gamma}^{1},\dot{\gamma}^{1},\dot{\gamma}^{1})\geq
C(\dot{\gamma}^{2},\dot{\gamma}^{2},\dot{\gamma}^{2})$

whenever $||\dot{\gamma}^{2}||=||\dot{\gamma}^{1}||$, then the relaxation
along $\gamma^{1}$ occurs faster than that along $\gamma^{2}$.

It is important to remark that this result applies universally to any system
that relaxes according to Eq. (9). In the particular case of endoreversible
processes, $\bar{\eta}_{j}$ may vary freely along $\gamma^{1,2}$, unlike the
case of isobaric relaxations studied in the previous section. In the sequel,
we present a relaxation process illustrating that, under specific initial
conditions, cooling down may occur faster from higher temperatures than from
lower temperatures.

To close this section, let us review the isobaric relaxation of ideal gases in
the light of the above theorem. In the $\eta_{i}$ coordinates, the components
of the Amari-Chentsov tensor are [11]

$C_{ijk}=-\dfrac{\partial^{3}\psi}{\partial\eta_{i}\partial\eta_{j}\partial\eta_{k}}.$

For closed fluids relaxing at constant pressure, $C$ reduces to

(23) $C=-\dfrac{\partial^{3}\psi}{\partial T^{3}}\mathrm{d}T^{3}.$

Considering Eq. (6),

$\psi=TS-pV-U=-G,$

where $G$ represents the Gibbs free energy of the system. Applying Eqs. (5),
(16), and (17), we have that

$\begin{split}C_{111}&=\dfrac{\partial^{3}G}{\partial T^{3}}\\\
&=-\dfrac{\partial^{2}S}{\partial T^{2}}\\\
&=\frac{(c+1)N_{0}k}{T^{2}},\end{split}$

Substituting the latter in Eq. (22) yields

$\lambda\Delta\ddot{D}|_{t=t_{*}}=(c+1)N_{0}k\left.\left(\frac{\left(\dot{T}^{+}\right)^{3}}{\left(T^{+}\right)^{2}}-\frac{\left(\dot{T}^{-}\right)^{3}}{\left(T^{-}\right)^{2}}\right)\right|_{t=t_{*}},$

as follows from Eq. (19). Since $c>0$ and $\dot{T}^{+}<0<\dot{T}^{-}$ during
the relaxation, $\lambda\Delta\ddot{D}|_{t_{*}}<0$, confirming that the only
critical point of $\Delta D$ is a maximum, as established earlier. The next
section will employ a similar approach to illustrate an example of the inverse
phenomenon.

##  6\. Quantum gases: an example of cooling down occuring faster than warming
up

In the preceding section, we established that the Amari-Chentsov tensor alone
can be instrumental in determining whether an asymmetric relaxation occurs.
This was illustrated through a review of the asymmetry in isobaric relaxations
in ideal gases. In this section, we extend this analysis to quantum ideal
gases, demonstrating the robust applicability of Theorem 2. We aim to show
that the conclusions drawn rely solely on the thermodynamic description of the
system, regardles of its classical or quantum nature. Notably, we find that
the asymmetry in the relaxation of these systems is opposite to that observed
in classical ideal gases: cooling down occurs faster than warming up.

To begin, let us revisit the equations of state for Fermi-Dirac and Bose-
Einstein gases. The internal energy $U_{\pm}$ and particle number $N_{\pm}$
for these systems are expressed as [18, 32, 33]

(24a) $\displaystyle U_{\pm}=$
$\displaystyle\mp\kappa\Gamma(a+2)(kT)^{a+2}\mathrm{Li}_{a+2}(\mp
e^{\mu/(kT)}),$ (24b) $\displaystyle N_{\pm}=$
$\displaystyle\mp\kappa\Gamma(a+1)(kT)^{a+1}\mathrm{Li}_{a+1}(\mp
e^{\mu/(kT)}),$

where the $+$ ($-$) sign corresponds to fermionic (bosonic) quantities. Here,
$\Gamma$ denotes the Gamma function, and $\mathrm{Li}_{a}$ represents the
polylogarithm of order $a$. The constants $\kappa$ and $a$ are system
dependent [33], and $\mu$ denotes the chemical potential of the gas.

In this case, Eq. (6) takes the form

$\psi=TS+\mu N-U=:-\Omega,$

which is the negative of the so-called Landau free energy. Usually, this
quantity is calculated directly as a normalization constant of the
corresponding Gibbs distributions, resulting in

$\Omega=\pm\kappa\Gamma(a+1)(kT)^{a+2}\mathrm{Li}_{a+2}(\mp\xi),$

with $\xi:=\operatorname{exp}[\mu/(kT)]$ representing the fugacity of the gas.

For simplicity, let us consider relaxations at constant $\mu$. According to
Eq. (23), the only necessary component of $C$ is $C_{111}$, given by

$\begin{split}\frac{\partial^{3}\Omega}{\partial T^{3}}=&\mp\kappa
k^{a-1}T^{a-4}\Gamma(a+1)\left\\{\mu^{3}\text{Li}_{a-1}\left(\mp\xi\right)+\right.\\\
&\left.akT\left[(a+1)kT\left(3\mu\text{Li}_{a+1}\left(\mp\xi\right)-(a+2)kT\text{Li}_{a+2}\left(\mp\xi\right)\right)-3\mu^{2}\text{Li}_{a}\left(\mp\xi\right)\right]\right\\}.\end{split}$

For our systems of interest, $a\geq 1/2$ [33]. Hence, all polylogarithmic
functions are negative in the fermionic case, and positive in the bosonic one,
provided that $T>0$. If $\mu<0$, $C_{111}<0$. Considering that
$\dot{T}^{-}>0>\dot{T}^{+}$, we have that

$C_{111}(\gamma^{+}(t))\left(\dot{T}^{+}\right)^{3}>0,\qquad\text{and}\qquad
C_{111}(\gamma^{-}(t))\left(\dot{T}^{-}\right)^{3}<0,\qquad\text{for all}\quad
t>0.$

Then,

$C_{111}(\gamma^{+}(t))\left(\dot{T}^{+}\right)^{3}\geq
C_{111}(\gamma^{-}(t))\left(\dot{T}^{-}\right)^{3}$

for all $t>0$, meaning that all critical points of $\Delta D$ will be minima.
Equivalently, cooling down occurs faster than warming up, as long as $\mu<0$.
This holds for bosons, and for fermions away from the quantum regime, for
which $T\to\infty$ and $\xi\to 0$ [32]. Thus, we have proved our fourth main
result (see Fig. 2).

######  Proposition 2.

At constant chemical potential, ideal Bose and Fermi gases (away from the
quantum regime) cool down faster than they warm up.

Figure 2. Left: $D$ as a function of $T$ for bosons, in units of $\kappa=1$
and $k=1$. Since $T^{+}$ is closer to $T_{q}$ than $T^{-}$, cooling down
occurs faster at constant $\mu$ (cf. Fig. 1). Right: $\Delta D$ for bosons as
a function of time, in units of $\kappa=1$ and $k=1$. Since $\Delta D<0$,
$D^{+}<D^{-}$, restating that cooling down takes place faster than warming up.
The shapes of $D$ and $\Delta D$ agree with the fact that
$C(\dot{\gamma}^{+},\dot{\gamma}^{+},\dot{\gamma}^{+})\geq
C(\dot{\gamma}^{-},\dot{\gamma}^{-},\dot{\gamma}^{-}).$

Finally, we stress that we can determine faster relaxation solely by means of
the Amari-Chentsov tensor. In principle, as illustrated here, there is no need
to compute $D$ or $\Delta D$. Precisely, the Amari-Chentsov tensor determines
the shape of $\Delta D$ (and hence, to an extent, that of $D$), as prescribed
by Theorem 2. This remains true in the case of relaxations involving more than
one parameter, as we illustrate below.

##  7\. Non-isobaric relaxation of ideal gases: a resemblance to the Mpemba
effect

In this section, we compare the _non-isobaric_ cooling down of an ideal gas to
an isobaric cooling down that starts from a higher temperature. We aim to
demonstrate that an adequate choice of the initial state for the former
results in a faster cooling process, resembling the well-known Mpemba effect,
where a hot system freezes faster than a cooler one [34, 35, 36].

Consider one mole ($N_{0}k\approx\qty{1}{J.K^{-1}}$) of a monoatomic ideal gas
($c=3/2$) prepared at two initial states $p_{0}^{1,2}$, both relaxing to a
final state $q$ defined by $T_{q}=\qty{275}{K}$ and $P_{q}=\qty{100}{\kilo}$.
Assume the system in state $p_{0}^{1}$ relaxes isobarically from an initial
temperature $T_{0}^{1}=\qty{375}{K}$. Simultaneously, the second state relaxes
from an initial state defined by $T_{0}^{2}=\qty{300}{K}$ and
$P_{0}^{2}=\qty{189.487}{\kilo}$, chosen such that $\Delta D=0$ at $t=0$.

We allow both systems to relax endoreversibly to $q$, following Eq. (9), with
$\lambda=\qty{1}{{}^{-1}}$. According to the results of the previous section,
$\Delta D$ will have a critical point whenever
$||\dot{\gamma}^{1}||=||\dot{\gamma}^{2}||$, which occurs at
$t_{*}\approx\qty{0.5}{}$. To determine whether this corresponds to a maximum
or a minimum, we resort to Theorem 2, obtaining that
$C(\dot{\gamma}^{1},\dot{\gamma}^{1},\dot{\gamma}^{1})|_{t_{*}}>C(\dot{\gamma}^{2},\dot{\gamma}^{2},\dot{\gamma}^{2})|_{t_{*}}$.
Consequently, the critical value is a minimum, indicating the relaxation along
$\gamma^{1}$ is faster than that along $\gamma^{2}$ (see Fig. 3).

Figure 3. Left: The $TP$-plane of a monoatomic ideal gas. The curves
$\gamma^{1}$ and $\gamma^{2}$ are represented by the dot-dashed and dotted
lines, respectively. At the points where each one meets the blue curve,
corresponding to $t=t_{*}$, both have the same speed and $\Delta D$ attains a
minimum value, according to Theorem 2. Indeed,
$A:=-\lambda^{3}C(\operatorname{grad}D,\operatorname{grad}D,\operatorname{grad}D)$
is greater at $t=t_{*}$ for $\gamma^{1}$ (yellow curve) than for $\gamma^{2}$
(brown curve). Thus, the relaxation along the former is faster than along the
latter. Right: $\Delta D$ (red), $\Delta(||\dot{\gamma}||/\lambda)^{2}$
(blue), and $\Delta A/\lambda^{3}$ (yellow) along the relaxation curves
$\gamma^{1}$ and $\gamma^{2}$. As can be seen, the minimum of $\Delta D$ is
attained when the relaxation speeds are equal. Since $\Delta A$ is positive,
in particular at $t=t_{*}$, relaxation along $\gamma^{1}$ is faster than along
$\gamma^{2}$, implying that the hotter gas cools down faster than the colder
one. This is reiterated by the fact that $\Delta D<0$ at all times.

We have thusly revealed a phenomenon similar to the Mpemba effect in ideal
gases, where a hotter gas cools down faster than a cooler one, contrary to the
conventional expectation. Evidently, this occurs due to the initial high
pressure of the cooler system. Nevertheless, this example brings to the
surface the underlying geometric aspects of asymmetric relaxation.

##  8\. Concluding remarks

We generalized Newton’s Law of cooling within the framework of information
geometry, portraying it as one component of a gradient flow, and deriving
straightforwardly the Horse-Carrot Theorem as a consequence. Furthermore, as
the potential function of this flow corresponds to the relative entropy (or
Kullback-Leibler divergence) between the current state and equilibrium, our
approach facilitates the study of asymmetric relaxations without relying on
the stochastic description of nonequilibrium thermodynamics.

Our focus on endoreversible asymmetric relaxations provided a novel
perspective, where the Amari-Chentsov tensor emerged as a central criterion
for understanding the occurrence of such asymmetries. This not only endowed
the tensor with practical physical significance but also illuminated its
central role in the geometric description of endoreversible relaxation, which
can be readily extended to any dynamics governed by Eq. (9). The question of
its role in more general relaxation processes remains open.

Through illustrative examples, we demonstrated the versatility of our
geometric criterion, emphasizing its applicability across diverse
thermodynamic systems, irrespective of their nature—be it classical or
quantum. Our examination of quantum ideal gases, revealing an opposite
relaxation asymmetry compared to classical counterparts, attests to the
universality and power of our geometric approach. This tool may offer insights
into other systems ranging from paramagnetic solids to black holes, and even
others beyond the scope of thermodynamics, like machine learning and
evolutionary biology [16, 31].

The exploration of relaxation asymmetries in the presence of phase transitions
emerges as a compelling and mathematically challenging problem. Furthermore,
our work prompts the question of whether the Mpemba effect can be effectively
approached from an information-geometric standpoint, presenting a direction
for future research.

## References

  * [1] Alessio Lapolla and Aljaž Godec.  Faster Uphill Relaxation in Thermodynamically Equidistant Temperature Quenches.  Physical Review Letters, 125(11):110602, 2020.
  * [2] S. Vaikuntanathan and C. Jarzynski.  Dissipation and lag in irreversible processes.  Europhysics Letters, 87(6):60005, October 2009.
  * [3] Miguel Ibáñez, Cai Dieball, Antonio Lasanta, Aljaž Godec, and Raúl A Rica.  Heating and cooling are fundamentally asymmetric and evolve along distinct pathways.  Nature Physics, pages 1–7, 2024.
  * [4] Cai Dieball, Gerrit Wellecke, and Aljaž Godec.  Asymmetric thermal relaxation in driven systems: Rotations go opposite ways.  Physical Review Research, 5(4):L042030, November 2023.
  * [5] Jan Meibohm, Danilo Forastiere, Tunrayo Adeleke-Larodo, and Karel Proesmans.  Relaxation-speed crossover in anharmonic potentials.  Physical Review E, 104(3):L032105, 2021.
  * [6] Tan Van Vu and Yoshihiko Hasegawa.  Toward relaxation asymmetry: Heating is faster than cooling.  Physical Review Research, 3(4):043160, 2021.
  * [7] Morton H. Rubin.  Optimal configuration of a class of irreversible heat engines. I.  Physical Review A, 19(3):1272–1276, 1979.
  * [8] Karl Heinz Hoffmann.  An introduction to endoreversible thermodynamics.  Atti della Accademia Peloritana dei Pericolanti - Classe di Scienze Fisiche, Matematiche e Naturali, (1):1–18, 2008.
  * [9] Dorje Brody and Nicolas Rivier.  Geometrical aspects of statistical mechanics.  Physical Review E, 51(2):1006–1011, 1995.
  * [10] Gavin E Crooks.  Measuring thermodynamic length.  Physical Review Letters, 99(10):100602, 2007.
  * [11] Frank Nielsen.  An elementary introduction to information geometry.  Entropy, 22(10):1100, 2020.
  * [12] Shun-ichi Amari.  Information Geometry and Its Applications, volume 194 of Applied Mathematical Sciences.  Springer Japan, Tokyo, 2016.
  * [13] Ovidiu Calin and Constantin Udrişte.  Geometric Modeling in Probability and Statistics.  Springer International Publishing, Cham, 2014.
  * [14] Nihat Ay, Jürgen Jost, Hông Vân Lê, and Lorenz Schwachhöfer.  Information geometry, volume 64.  Springer, 2017.
  * [15] Hirohiko Shima.  The geometry of Hessian structures.  World Scientific, Hackensack, N.J, 2007.
  * [16] Akio Fujiwara and Shun-ichi Amari.  Gradient systems in view of information geometry.  Physica D: Nonlinear Phenomena, 80(3):317–327, 1995.
  * [17] Joseph H Keenan.  Availability and irreversibility in thermodynamics.  British Journal of Applied Physics, 2(7):183–192, July 1951.
  * [18] Herbert B. Callen.  Thermodynamics and an introduction to thermostatistics.  Wiley, New York, 2nd ed edition, 1985.
  * [19] L.D. Landau and E.M. Lifshitz.  Statistical Physics: Volume 5.  Number v. 5. Elsevier Science, 2013.
  * [20] A.B. Pippard.  Elements of Classical Thermodynamics:For Advanced Students of Physics.  Elements of Classical Thermodynamics for Advanced Students of Physics. Cambridge University Press, 1964.
  * [21] F. Weinhold.  Metric geometry of equilibrium thermodynamics.  The Journal of Chemical Physics, 63(6):2479–2483, 1975.
  * [22] P. Salamon, J. Nulton, and E. Ihrig.  On the relation between entropy and energy versions of thermodynamic length.  The Journal of Chemical Physics, 80(1):436–437, 1984.
  * [23] Alessandro Bravetti, Cesar S Lopez-Monsalvo, and Francisco Nettel.  Conformal gauge transformations in thermodynamics.  Entropy, 17(9):6150–6168, 2015.
  * [24] George Ruppeiner.  Thermodynamics: A Riemannian geometric model.  Physical Review A, 20(4):1608–1613, October 1979.
  * [25] A. Bravetti, C. S. Lopez-Monsalvo, and F. Nettel.  Contact symmetries and Hamiltonian thermodynamics.  Annals of Physics, 361:377–400, 2015.
  * [26] Peter Salamon and R. Stephen Berry.  Thermodynamic Length and Dissipated Availability.  Physical Review Letters, 51(13):1127–1130, 1983.
  * [27] J. Nulton, P. Salamon, B. Andresen, and Qi Anmin.  Quasistatic processes as step equilibrations.  The Journal of Chemical Physics, 83(1):334–338, July 1985.
  * [28] L. Diósi, K. Kulacsy, B. Lukács, and A. Rácz.  Thermodynamic length, time, speed, and optimum path to minimize entropy production.  The Journal of Chemical Physics, 105(24):11220–11225, December 1996\.
  * [29] P Salamon and J. D Nulton.  The geometry of separation processes: A horse-carrot theorem for steady flow systems.  Europhysics Letters (EPL), 42(5):571–576, June 1998.
  * [30] W. Spirkl and H. Ries.  Optimal finite-time endoreversible processes.  Physical Review E, 52(4):3485–3489, October 1995.
  * [31] Marc Harper.  Information geometry and evolutionary game theory.  arXiv preprint arXiv:0911.1383, 2009.
  * [32] L. E. Reichl.  A modern course in statistical physics.  Wiley, New York, 2nd ed edition, 1998.
  * [33] Pedro Pessoa and Carlo Cafaro.  Information geometry for Fermi-Dirac and Bose-Einstein quantum statistics.  Physica A: Statistical Mechanics and its Applications, 576:126061, 2021.
  * [34] E. B. Mpemba and D. G. Osborne.  Cool?  Physics Education, 4(3):172, May 1969.
  * [35] David Auerbach.  Supercooling and the Mpemba effect: When hot water freezes quicker than cold.  American Journal of Physics, 63(10):882–885, October 1995.
  * [36] John Bechhoefer, Avinash Kumar, and Raphaël Chétrite.  A fresh understanding of the Mpemba effect.  Nature Reviews Physics, 3(8):534–535, June 2021.


# Transferable Unlearnable Examples

Jie Ren
Michigan State University
<EMAIL_ADDRESS>
&Han Xu∗
Michigan State University
<EMAIL_ADDRESS>
&Yuxuan Wan
Michigan State University
<EMAIL_ADDRESS>
&Xingjun Ma
Fudan University
<EMAIL_ADDRESS>
&Lichao Sun
Lehigh University
<EMAIL_ADDRESS>
&Jiliang Tang
Michigan State University
<EMAIL_ADDRESS>
Equal contribution.

###### Abstract

With more people publishing their personal data online, unauthorized data
usage has become a serious concern. The unlearnable strategies have been
introduced to prevent third parties from training on the data without
permission. They add perturbations to the users’ data before publishing, which
aims to make the models trained on the perturbed published dataset
invalidated. These perturbations have been generated for a specific training
setting and a target dataset. However, their unlearnable effects significantly
decrease when used in other training settings and datasets. To tackle this
issue, we propose a novel unlearnable strategy based on Classwise Separability
Discriminant (CSD), which aims to better transfer the unlearnable effects to
other training settings and datasets by enhancing the linear separability.
Extensive experiments demonstrate the transferability of the proposed
unlearnable examples across training settings and datasets.

##  1 Introduction

With more people publishing their personal data online, it has raised the
concern that the published data can be utilized without the data owner’s
permission to train machine learning models unauthorizedly. Large-scale
datasets collected from Internet like LFW(Huang et al., 2008),
Freebase(Bollacker et al., 2008), and Ms-celeb-1m(Guo et al., 2016) promote
the development of deep learning. However, they also have the potential risk
of privacy leakage. Thus, growing efforts (Huang et al., 2020; Fowl et al.,
2021) have been made on protecting data from unauthorized usage by making the
data samples unlearnable (Huang et al., 2020; Fowl et al., 2021; He et al.,
2022). In these methods, they generate the unlearnable examples by injecting
imperceptible “shortcut” perturbation. If the data is used by unauthorized
training, the models prefer to extract such easy-to-learn shortcut features
and ignore the semantic information in the original data (Geirhos et al.,
2020). Thus, the trained model fails to recognize the user’s data during the
test phase and the user’s data gets protected.

However, the majority of existing methods have weaknesses in two types of
transferability, training-wise and data-wise, which can largely limit the
practical use of unlearnable examples. First, weak training-wise
transferability implies that the perturbed samples generated towards one
target training setting, such as ERM, cannot be transferred to other training
settings. As shown in Section 3.2.1, although Error-Minimizing Noise (EMN)
(Huang et al., 2020) can protect data from supervised training, we can use
unsupervised learning methods, such as Contrastive Learning (Chen et al.,
2020a; Chen & He, 2021; Chen et al., 2020b), to first learn useful
representations from the EMN-perturbed dataset, and then fine-tune the model
on the perturbed dataset. In this way, the unsupervised model can also achieve
comparable performance with the model that is trained on the unperturbed
dataset. Second, insufficient data-wise transferability indicates that the
unlearnable effect of perturbations generated for one target dataset will
significantly decrease when transferred to other datasets. Without effective
data-wise transferability, we have to generate perturbations for each dataset,
which makes the unlearnable process inflexible in reality. For example, data
in various applications such as social media is dynamic or even streaming and
it is challenging to generate the entire perturbation set when new data is
continuously emerging.

In this work, we aim to enhance the training-wise and data-wise
transferability of unlearnable examples. In detail, our method is motivated by
the method Synthetic Noise (SN) (Yu et al., 2021), which devises a manually
designed linear separable perturbation to generate unlearnable examples. Such
perturbation does not target specific dataset, thus it has the potential to
enhance data-wise transferability. However, SN is manually designed and it is
not quantifiable or optimizable. Therefore, it is impossible to incorporate SN
into other optimization processes. Meanwhile, SN lacks training-wise
transferability. Therefore, in our paper, we propose Classwise Separability
Discriminant (CSD) to generate optimizable linear-separable perturbations. Our
framework Transferable Unlearnable Examples with enhanced linear separability
can generate unlearnable examples with superior training-wise and data-wise
transferability.

##  2 Related Work

Unlearnable Examples. Unlearnable examples are close to availability attack
which aims at making the data out of service for training the models by the
third parties (Muñoz-González et al., 2017). Before releasing the data in
public, we can make it unlearnable to stop others from using it for training
ML model without permission. Several works produce unlearnable examples with
the guidance of the label information (Huang et al., 2020; Fowl et al., 2021;
Shan et al., 2020; Yu et al., 2021). The vanilla unlearnable examples are
produced by an alternating bi-level min-min optimization on both model
parameters and perturbations (Huang et al., 2020). Being induced to trust that
the perturbation can minimize the loss better than the original image
features, the model will pay more attention to the perturbations. Yu et al.
(2021) pointed out that a common property behind the perturbations is linear
separability in input space. We refer to unlearnable examples generated under
the supervised setting as supervised unlearnable examples. Very recently,
Unlearnable Contrastive Learning (UCL) is proposed He et al. (2022) to
generate unlearnable examples based on unsupervised contrastive learning and
to protect data from unsupervised learning. We refer to unlearnable examples
generated under the unsupervised setting as unsupervised unlearnable examples.
Our studies show that both supervised and unsupervised unlearnable examples
lack training-wise transferability as shown in Section 3.2.1 and Appendix A,
respectively. Table 1 summarizes the settings of existing methods, where ✗
means ineffective protection.

Table 1: Unlearnable Examples Settings of Existing Approaches Prevented unauthorized use | Supervised Training | Unsupervised Training
---|---|---
Supervised Unlearnability |  Huang et al. (2020); Fowl et al. (2021) | ✗
Unsupervised Unlearnability | ✗ | He et al. (2022)

Unsupervised Learning. Recently, unsupervised learning has shown its great
potential to learn the representation from unlabeled data. Contrastive
learning, one of the popular unsupervised methods in computer vision, uses the
task of instance discrimination to learn the representations. In SimCLR (He et
al., 2022) which is the most common contrastive learning method, the positive
and negative samples for each instance are created and the task is to
discriminate the positive samples and negative samples. Some improved methods
like SimSiam (Chen & He, 2021) and BYOL (Grill et al., 2020) can remove the
negative samples and change the task to pushing the representations between
positive samples to be similar. Many works have been proposed to explain why
instance discrimination can lead to good representations. It is claimed in
Wang & Isola (2020) that uniformity and alignment in feature space are the
keys to a good representation.

##  3 Preliminary

In this section, preliminary studies are conducted to explore two types of
transferability. We first introduce key notations and definitions, and then
show the insufficiency of transferability. Since the majority of unlearnable
examples are generated under the supervised setting, in this work, we focus on
supervised unlearnable examples and leave unsupervised unlearnable examples as
one future work. Note that the observations of supervised unlearnable examples
in terms of transferability could be applicable to unsupervised unlearnable
examples. For example in Appendix A, we show that unsupervised unlearnable
examples also lack training-wise transferability.

###  3.1 Definitions

In this subsection, we first give the definition of unlearnable examples and
then define the training-wise and data-wise transferability.

Unlearnable Examples. Suppose that the training dataset contains $n$ clean
examples $\mathcal{D}_{c}=\\{({\bm{x}}_{i},y_{i})\\}_{i=1}^{n}$ with the input
data ${\bm{x}}_{i}\in\mathcal{X}\subset\mathbb{R}^{d}$ and the associated
label $y_{i}\in\mathcal{Y}=\\{1,2,\dots,K\\}$. We assume that the unauthorized
parties will use the published training dataset to train a classifier
$f_{\theta}:\mathcal{X}\rightarrow\mathcal{Y}$, where $\theta$ is the model
parameters, and do inference on their test dataset. To protect the data from
unauthorized training, instead of publishing $\mathcal{D}_{c}$, we want to
generate an unlearnable dataset as
$\mathcal{D}_{u}=\\{({\bm{x}}_{i}+\bm{\delta}_{i},y_{i})\\}_{i=1}^{n}$ where
$\bm{\delta}_{i}\in\Delta_{\mathcal{D}_{c}}\subset\mathbb{R}^{d}$ and
$\Delta_{\mathcal{D}_{c}}$ is the perturbation set for $\mathcal{D}_{c}$. The
goal of unlearnability is that if we only publish $\mathcal{D}_{u}$, the model
$f_{\theta}$ trained on $\mathcal{D}_{u}$ performs poorly on the test dataset.
Benefiting from the constraint $\|\bm{\delta}\|_{p}\leq\epsilon$,
$\mathcal{D}_{u}$ appears the same as $\mathcal{D}_{c}$ in human eyes and does
not affect the normal use. The most representative EMN Huang et al. (2020)
generates supervised unlearnable examples by alternating optimization on the
bi-level min-min problem:

$\displaystyle\min_{\theta}\min_{\bm{\delta}_{i}\in\left\\{{\bm{v}}:\left\|{\bm{v}}\right\|_{\infty}\leq\epsilon\right\\}}\sum_{i=1}^{n}\mathcal{L}\left(f_{\theta}\left(\mathbf{x}_{i}+\bm{\delta}_{i}\right),y_{i}\right).$
(1)

The outer minimization can imitate the training process, while the inner
minimization can induce $\bm{\delta}_{i}$ to have the property of minimizing
the supervised loss. Due to this property, deep models will pay more attention
to the easy-to-learn $\bm{\delta}_{i}$ and ignore ${\bm{x}}_{i}$.

Training-wise Transferability. Supervised unlearnable examples have been
designed to protect data from supervised training Huang et al. (2020).
However, the unlearnable effect is almost lost when they are utilized for
unsupervised training. The unauthorized parties can first get a useful feature
extractor $g_{\eta}$ from $\mathcal{D}_{u}$ by unsupervised training like
Contrastive Learning (Chen et al., 2020a) and then fine-tunes on
$\mathcal{D}_{u}$ or other data to get the classifier $h_{g}$. The training-
wise transferability means that supervised unlearnable examples can invalidate
$g_{\eta}$ when transferred into unsupervised training.

Data-wise Transferability. When any other dataset,
$\mathcal{D}_{\tilde{c}}=\\{(\tilde{{\bm{x}}}_{i},\tilde{y}_{i})\\}_{i=1}^{\tilde{n}}$,
where $\tilde{{\bm{x}}}_{i}\in\tilde{\mathcal{X}}\subset\mathbb{R}^{d}$ and
$\tilde{y}_{i}\in\tilde{\mathcal{Y}}=\\{1,2,\dots,\tilde{K}\\}$, also requires
protection, it is more efficient and practical if we can transfer the
perturbation that has already been generated for $\mathcal{D}_{c}$ onto
$\mathcal{D}_{\tilde{c}}$. If the perturbation, $\Delta_{\mathcal{D}_{c}}$, is
data-wise transferable, we can also create an unlearnable dataset
$\mathcal{D}_{\tilde{u}}$ to replace $\mathcal{D}_{\tilde{c}}$ before
publishing as
$\mathcal{D}_{\tilde{u}}=\\{(\tilde{{\bm{x}}}_{i}+\bm{\delta}_{H(i)},\tilde{y}_{i})\\}_{i=1}^{n},$
where $~{}\tilde{{\bm{x}}}_{i}\in\mathcal{D}_{\tilde{c}}$,
$\bm{\delta}_{H(i)}\in\Delta_{\mathcal{D}_{c}}$, and $H(i)$ decides which
perturbation in $\Delta_{\mathcal{D}_{c}}$ is added on
$~{}\tilde{{\bm{x}}}_{i}$ in the new dataset, $\mathcal{D}_{\tilde{c}}$.
Without retraining the perturbation set, the unseen $\mathcal{D}_{\tilde{c}}$
is also protected by transferring the unlearnable perturbations from
$\Delta_{\mathcal{D}_{c}}$.

###  3.2 Transferability in Existing Methods

In this subsection, we show that existing supervised unlearnable examples have
almost no training-wise transferability and insufficient data-wise
transferability.

####  3.2.1 Training-wise Transferability

Figure 1: Accuracy on clean test data of supervised and unsupervised models on
trained on clean CIFAR-10 and EMN-pertubed CIFAR-10

In Figure 1, experiments are provided to show the ineffective protection of
two supervised unlearnable examples, i.e. Error-Minimizing Noise (EMN) (Huang
et al., 2020) and Synthetic Noise (SN) (Yu et al., 2021) when they are
transferred into unsupervised training. We generate unlearnable examples for
CIFAR-10 with EMN and SN. In supervised training, we evaluate the unlearnable
dataset by the test accuracy after training with CrossEntropy loss, while in
unsuperivsed training, we use SimCLR Chen et al. (2020a) to get a feature
extractor and then evaluate by the accuracy of linear probing. EMN decreases
the accuracy of supervised training from 93.8% to 14.7%, but only decreases
the accuracy of unsupervised training by 0.2%. It means that EMN has almost no
unlearnable effect after being transferred into unsupervised learning and is
weak in training-wise transferability. We have similar observations for SN
which also lacks training-wise transferability.

####  3.2.2 Data-wise Transferability

In this subsection, we investigate data-wise transferability for EMN and SN.
As introduced in Eq. 1, EMN has been designed to induce $\bm{\delta}_{i}$ to
have the property of minimizing the loss function in supervised training by
perturbing $\bm{x}_{i}$. Therefore, EMN generates unlearnable examples based
on target data. Next, we will show the data-wise transferability of EMN when
the perturbations are transferred onto non-target data samples and non-target
datasets. For $\bm{\delta}_{i}$, the target sample is $\mathbf{x}_{i}$, while
the non-target samples are all the other samples $\mathbf{x}_{j}$ in
$\mathcal{D}_{c}$, where $j\neq i$. For the whole perturbation set
$\Delta_{\mathcal{D}_{c}}$, the non-target dataset is any other dataset
$\mathcal{D}_{\tilde{c}}$. Since the perturbation $\bm{\delta}_{i}$ focuses on
the target sample $\mathbf{x}_{i}$, we will first show the reduction of
unlearnable effect on non-target samples. Then we will demonstrate that the
perturbation set $\Delta_{\mathcal{D}_{c}}$ for $\mathcal{D}_{c}$ cannot hold
the strong unlearnable effect on non-target dataset,
$\mathcal{D}_{\tilde{c}}$.

On non-target samples, we change the assignment between perturbations and
training samples like Fig. 2(b) within every class or Fig. 2(c) between the
classes. Instead of perturbing ${\bm{x}}_{i}$ with $\bm{\delta}_{i}$, we add
$\bm{\delta}_{j}$ onto ${\bm{x}}_{i}$, where $j\neq i$. Like Fig. 2(b), we
construct the intra-class swapping training dataset as
$\mathcal{D}_{s_{\text{intra}}}=\left\\{\left({\bm{x}}_{i}+\bm{\delta}_{s_{\text{intra}}(i)},y_{i}\right)\right\\}_{i=1}^{n},$
where $s_{\text{intra}}(i)$ is the intra-class swapping function to randomly
permute the correspondence between examples and perturbations within classes.
For the $i$-th example, it uses the perturbation from another example in the
same class:

$\displaystyle s_{\text{intra}}(i)=j,\text{where}\ j\neq i,y_{j}=y_{i},$

Like Fig. 2(c), we construct the inter-class swapping training dataset as
$\mathcal{D}_{s_{\text{inter}}}=\left\\{\left({\bm{x}}_{i}+\bm{\delta}_{s_{\text{inter}}(i)},y_{i}\right)\right\\}_{i=1}^{n}.$
$s_{\text{inter}}$ permutes the corresponding between classes:

$\displaystyle s_{\text{inter}}(i)=j,\text{where}\ j\neq i,y_{j}\neq y_{i}.$

With $s_{\text{intra}}(i)$ and $s_{\text{inter}}(i)$, we keep the perturbation
generated by EMN (i.e., $\Delta_{\mathcal{D}_{c}}$) and the clean data, (i.e.,
$\mathcal{D}_{c}$) unchanged, but just swap the how $\Delta_{\mathcal{D}_{c}}$
corresponds to $\mathcal{D}_{c}$. As shown in Table 3.2.2, the unlearnable
effect decreases significantly under intra-class swapping and inter-class
swapping.

Figure 2: Original one-to-one correspondence and two swapping methods.

EMN unlearnable samples are also limited in data-wise transferability on non-
target datasets. We first generate the perturbations
$\Delta_{\mathcal{D}_{c}}$ on CIFAR-10 and then choose another non-target
dataset SVHN-small, which is downsampled from SVHN(Netzer et al., 2011), as
non-target dataset $\mathcal{D}_{\tilde{c}}$ to protect. CIFAR-10 has ten
classes, where every class has 5,000 training images. SVHN also has ten
classes, but some classes have more than 5,000 training images. Thus we sample
5,000 training images in every class from SVHN and construct SVHN-small. In
Table 3.2.2, we first generate EMN on SVHN-small to protect target dataset,
i.e. SVHN-small. It protects the data from unauthorized training and reduces
the test accuracy to only 11.64%. But when we use EMN generated on CIFAR-10 to
protect SVHN-small, SVHN-small becomes a non-target dataset. More information
is learned from SVHN-small and the test accuracy is 27.59%, which means the
non-target dataset gets less protection.

Table 2: Comparison of supervised unlearnable examples on target and non-
target samples.

Corresponding | CIFAR10 | CIFAR100
---|---|---
EMN | SN | EMN | SN
Original | 15.88 | 14.07 | 6.59 | 2.13
Intra-class swap | 30.74 | 13.59 | 21.63 | 2.44
Inter-class swap | 30.15 | 13.15 | 35.50 | 2.73

Table 3: Comparison of supervised unlearnable examples on target and non-target datasets. Generated on | Tested on SVHN-small
---|---
EMN |  SN
SVHN-small |  11.64 |  8.46
CIFAR-10 |  27.59 |  9.58

We conducted similar experiments for SN Yu et al. (2021). The results for non-
target samples and non-target datasets are illustrated in Table 3.2.2 and
Table 3.2.2, respectively. We observe that SN is data-wise transferable.
According to Yu et al. (2021), SN can create linear separability that the
label-related imperceptible perturbation is linearly separable between
different classes, as a shortcut for the optimization objective. In other
words, the linear separability is only between $\bm{\delta}_{i}$ and $y_{i}$,
and not related to ${\bm{x}}_{i}$. Therefore, the SN perturbation which is
totally based on linear separability can lead to the unlearnable effect and
its unlearnability has good data-wise transferability. However, SN is
generated by sampling from a manually designed distribution and the sampling
process is incompatible with an optimization process. Thus, it is hard to
directly incorporate SN into other optimization objectives to enjoy linear
separability for data-wise transferability.

###  3.3 Discussions

As shown by the above preliminary studies, both EMN and SN lack training-wise
transferability, and EMN has insufficient data-wise transferability.
Meanwhile, we found that the linearly separable SN perturbation that is
independent on the data has good data-wise transferability. However, the
manually designed linear separability of SN is unable to be leveraged by other
optimization objectives. Thus in the next section, we propose Classwise
Separability Discriminant and a new framework to generate unlearnable examples
with training-wise and data-wise transferability.

##  4 Transferable Unlearnability from Classwise Separability Discriminant

In order to improve the two types of transferability of unlearnable examples,
we propose the optimizable Classwise Separability Discriminant (CSD) to
quantify linear separability. Furthermore, we propose Transferable Unlearnbale
Examples (TUE) that have superior training-wise and data-wise transferability.
It not only generalizes the protection scenario from supervised to
unsupervised training but also maintains the unlearnability when transferred
to non-target datasets.

###  4.1 Classwise Separability Discriminant

The linear separability lies in two factors, i.e. intra-class distance and
inter-class distance. Intuitively, better linear separability usually has
smaller intra-class distance and larger inter-class distance. Because smaller
intra-class distance means that the perturbations from the same class can
concentrate on a small area in the input space, while larger inter-class
distance means that the perturbations of different classes are far away from
each other. When the overlapping area between different classes is reduced by
smaller intra-class distance and larger inter-class distance, the
perturbations can become features that are easily separated by even a linear
classifier. For measuring the intra-class and inter-class distance, we first
define the centroid of the perturbations of every class:
${\bm{c}}_{k}=\frac{1}{|\\{\bm{\delta}_{i}:y_{i}=k\\}|}\sum_{\\{\bm{\delta}_{i}:y_{i}=k\\}}\bm{\delta}_{i},$
where $\\{\bm{\delta}_{i}:y_{i}=k\\}$ is the perturbations that belong to
class $k$. Then we have the intra-class distance as:

$\displaystyle\bm{\sigma}_{k}=\frac{1}{|\\{\bm{\delta}_{i}:y_{i}=k\\}|}\sum_{\\{\bm{\delta}_{i}:y_{i}=k\\}}d(\bm{\delta}_{i},{\bm{c}}_{k}),$
(2)

where $d(\cdot,\cdot)$ is the Euclidean distance. $\bm{\sigma}_{k}$ measures
the average distance between the perturbation $\bm{\delta}_{i}$ whose label is
$k$ to the centroid ${\bm{c}}_{k}$. The inter-class distance is defined by the
Euclidean distance between two centroids:

$\displaystyle d_{i,j}=d\left({\bm{c}}_{i},{\bm{c}}_{j}\right)$ (3)

To enhance the linear separability with an optimizable objective function, we
propose Classwise Separability Discriminant (CSD):

$\displaystyle\mathcal{L}_{\text{S}}(\\{\bm{\delta}_{i},y_{i}\\}_{i=1}^{n})=\frac{1}{M}\sum_{i=1}^{M}\frac{1}{M-1}\sum_{j\neq
i}^{M-1}\left(\frac{\bm{\sigma}_{i}+\bm{\sigma}_{j}}{d_{i,j}}\right),$ (4)

where $M$ is the number of classes, and $y_{i}$ represents the ground truth
label for sample ${\bm{x}}_{i}\in\mathcal{D}_{c}$. It is worth mentioning that
$\mathcal{L}_{\text{S}}(\\{\bm{\delta}_{i},y_{i}\\}_{i=1}^{n})$ is not related
to ${\bm{x}}_{i}$, which means that $\bm{\delta}_{i}$ is generated
independently on ${\bm{x}}_{i}$. $\bm{\sigma}_{i}$ and $\bm{\sigma}_{j}$
measure the intra-class distance of class $i$ and class $j$, while $d_{i,j}$
measures the inter-class distance between class $i$ and class $j$. The ratio
between intra-class distance and inter-class distance,
$\frac{\bm{\sigma}_{i}+\bm{\sigma}_{j}}{d_{i,j}}$, can show the overlapping
between two classes. Better clustering distribution has smaller intra-class
distance and larger inter-class distance, which lead to a lower ratio and
smaller overlapping area between two classes. Therefore, lower Classwise
Separability Discriminant, which indicates more compact intra-class distance
and better farther inter-class distance, has better clustering effect and
linear separability.

###  4.2 Transferable Unlearnable Examples

As discussed in Section 3.2.2, linear separability plays an essential role in
supervised unlearnability and data-wise transferability. In order to enhance
the data-wise and training-wise transferability of unlearnable examples
simultaneously, we aim to incorporate linear separability into unsupervised
unlearnable examples to propose Transferable Unlearnable Examples (TUE)
framework. In particular, TUE uses contrastive learning as the unsupervised
backbone and embeds linear separability via Classwise Separability
Discriminant into unsupervised unlearnability. Most unsupervised contrastive
learning algorithms, such as SimCLR (Chen et al., 2020a), MoCo (Chen et al.,
2020b) and SimSiam (Chen & He, 2021), enforce the similarity between two
augmentations of the same samples such that the model can achieve
representation learning. TUE generates the perturbation that not only promotes
this similarity but also has linear separability by the bi-level optimization
problem as follows:

$\displaystyle\min_{\theta}\underset{\\{\bm{\delta}_{i}:\left\|\bm{\delta}_{i}\right\|_{\infty}\leq\epsilon\\}}{\min}\sum_{i=1}^{n}\mathcal{L}_{\text{CL}}\Big{(}f\big{(}{\theta},T_{1}({\bm{x}}_{i}+\bm{\delta}_{i})\big{)},f\big{(}{\theta},T_{2}({\bm{x}}_{i}+\bm{\delta}_{i})\big{)}\Big{)}+\lambda\mathcal{L}_{\text{S}}(\\{\bm{\delta}_{i},y_{i}\\}_{i=1}^{n}),$
(5)

where $\mathcal{L}_{\text{CL}}$ is the loss of contrastive learning, and
$\lambda$ is the weight to balance between two loss terms. $T_{1}$ and $T_{2}$
are augmentations on input data. The first term in Eq. 5 can ensure that the
generated perturbation has the property of promoting the similarity between
two views of augmented sample to reduce $\mathcal{L}_{\text{CL}}$. In this
way, the perturbation provides easy-to-learn shortcut information for
unsupervised learning such that the model will only learn to extract the
perturbation instead of the intrinsic semantic information in the data. In
other words, the first term is to ensure the unlearnability for unsupervised
training. The second term can enhance the linear separability of the
perturbations. Furthermore, we propose to solve this bi-level optimization
problem in Eq. 5 alternately:

$\displaystyle\left\\{\begin{aligned}
\text{S1}:{\theta^{(t)}}&=\underset{\theta}{\arg\min}\sum_{{\bm{x}}_{i}\in\mathcal{D}_{c}}\mathcal{L}_{\text{CL}}\left(f\big{(}{\theta},T_{1}({\bm{x}}_{i}+\bm{\delta}^{(t-1)}_{i})\big{)},f\big{(}{\theta},T_{2}({\bm{x}}_{i}+\bm{\delta}^{(t-1)}_{i})\big{)}\right)\\\
\text{S2}:\bm{\delta}_{i}^{(t)}&=\underset{\\{\bm{\delta}_{i}:\left\|\bm{\delta}_{i}\right\|_{\infty}\leq\epsilon\\}}{\arg\min}\mathcal{L}_{\mathrm{CL}}\left(f\big{(}{\theta}^{(t)},T_{1}({\bm{x}}_{i}+\bm{\delta}_{i})\big{)},f\big{(}{\theta}^{(t)},T_{2}({\bm{x}}_{i}+\bm{\delta}_{i})\big{)}\right)+\lambda\mathcal{L}_{\text{S}}(\\{\bm{\delta}_{i},y_{i}\\}_{i=1}^{n}).\end{aligned}\right.$
(6)

In the first step (S1), we update the model parameter $\theta$ to minimize the
unsupervised loss $\mathcal{L}_{\text{CL}}$, while in the second step (S2) we
optimize the perturbation $\\{\bm{\delta}_{i}\\}$ to jointly reduce the
unsupervised loss and force the linear separability among different classes.
By the bi-level optimization on unsupervised loss and Classwise Separability
Discriminant, we can generate unlearnable examples with both data-wise and
training-wise transferability.

Interpolation for data-wise transferability. Once we have finished the
generation process on the training dataset, $\mathcal{D}_{c}$, we can use this
perturbation without change on another dataset, $\mathcal{D}_{\tilde{c}}$, to
make it unlearnable as well. Nevertheless, it is possible that the number of
classes in $\mathcal{D}_{c}$ or the number of samples in one class in
$\mathcal{D}_{c}$ is less than $\mathcal{D}_{\tilde{c}}$. The generated
perturbation may not cover every sample in $\mathcal{D}_{\tilde{c}}$. To solve
this problem, we use interpolation to create more perturbations. Interpolation
can make use of current perturbation in $\Delta_{\mathcal{D}_{c}}$ to enlarge
its size and transfer to a larger dataset. If more classes are desired, we can
interpolate between two current classes in $\mathcal{D}_{c}$ to create new
classes:

$\displaystyle{\bm{x}}_{k}^{*}=\alpha{\bm{x}}_{i}+(1-\alpha){\bm{x}}_{j},\text{where}\
y_{i}\neq y_{j}.$ (7)

If more samples in one class are required, we can interpolate within current
classes in $\mathcal{D}_{c}$ to create new samples:

$\displaystyle{\bm{x}}_{k}^{*}=\alpha{\bm{x}}_{i}+(1-\alpha){\bm{x}}_{j},\text{where}\
y_{i}=y_{j}.$ (8)

By varying $\alpha$, more than one sample can be created from the
interpolation between ${\bm{x}}_{i}$ and ${\bm{x}}_{j}$. Empirical results in
Section 5.3 show that this interpolation strategy works very well.

##  5 Experiment

In this section, we validate the data-wise and training-wise transferability
of the proposed TUE. We first introduce the experimental setups in Section
5.1. In Section 5.2, we present the experimental results on the training-wise
transferability. In Section 5.3 we demonstrate that TUE has improved data-wise
transferability. In Section 5.4 we illustrate the enhanced linear separability
in input space by visualization. Finally, in Section 5.5 we show that the two
types of transferability make TUE have both classwise and samplewise
characteristics as expected by case study.

###  5.1 Experimental Setups

Datasets. The datasets include CIFAR-10 and CIFAR-100 (Krizhevsky et al.,
2009), which contain 50,000 training images and 10,000 test images, and SVHN
(Netzer et al., 2011), which contains 73,257 training images of ten classes
and 26,032 test images. We randomly sample from SVHN to construct SVHN-small
where the number of training images in every class is no more than 5000.

Generation process and Evaluation settings. We compare our method with
representative unlearnable methods in both supervised and unsupervised
training. All the perturbations are generated by PGD (Madry et al., 2018) on
ResNet-18 and constrained by $\left\|\delta_{i}\right\|_{\infty}\leq\epsilon$
where $\epsilon=8/255$. We use CrossEntropy as the objective function in
supervised training. and linear probing after contrastive pre-training in
unsupervised training. The supervised model is trained for 200 epochs. The
unsupervised model is pre-trained for 1000 epochs and then fine-tuned for 100
epochs. More hyperparamaters for generation process and evaluation can be
found in Appendix B.

Baselines. We use three representative unlearnable examples as baselines,
which are Error-Minimizing Noise (EMN) (Huang et al., 2020), Unlearnable
Contrastive Learning (UCL) (He et al., 2022) and Synthetic Noise (SN) (He et
al., 2022).

Backbones. We tested TUE on three different unsupervised backbones, SimCLR
(Chen et al., 2020a), MoCo (Chen et al., 2020b) and SimSiam (Chen & He, 2021).
The backbones are also used in UCL.

Table 4: Performance of unlearnable effects on different algorithms and
datasets in supervised and unsupervised training. This table reports the
accuracy (%) of supervised training and the accuracy (%) of linear probing
after contrastive pre-training (SimCLR, MoCo, and SimSiam).

Dataset | CIFAR-10 | CIFAR-100
---|---|---
SimCLR | Supervised | Unsupervised | Supervised | Unsupervised
Clean Data | 93.79 | 90.04 | 74.49 | 63.68
EMN | 14.74 | 89.79 | 5.23 | 62.00
SN | 19.23 | 88.93 | 2.13 | 62.31
UCL | 92.86 | 47.78 | 72.17 | 16.68
TUE | 10.67 | 52.38 | 0.76 | 19.51
MoCo | Supervised | Unsupervised | Supervised | Unsupervised
Clean Data | 93.79 | 89.90 | 74.49 | 63.03
EMN | 14.74 | 89.18 | 5.23 | 60.62
SN | 19.23 | 89.32 | 2.13 | 61.81
UCL | 92.62 | 44.24 | 71.59 | 18.74
TUE | 10.06 | 63.38 | 1.09 | 23.6
SimSiam | Supervised | Unsupervised | Supervised | Unsupervised
Clean Data | 93.79 | 90.59 | 74.49 | 64.69
EMN | 14.74 | 91.43 | 5.23 | 65.96
SN | 19.23 | 91.54 | 2.13 | 66.83
UCL | 93.50 | 30.43 | 71.84 | 4.64
TUE | 10.03 | 35.57 | 1.21 | 6.17

###  5.2 Training-wise transferable unlearnability

As mentioned above, existing unlearnable methods focus on one training
setting, either supervised or unsupervised training. In this work, we use the
proposed TUE to make the dataset unlearnable in both two training settings and
thus protect the data from unauthorized training in a comprehensive way. In
Table 4, we reported the comparison on CIFAR-10 and CIFAR-100 with supervised
training by CrossEntropy Loss and three unsupervised training method, SimCLR
(Chen et al., 2020a), MoCo (Chen et al., 2020b) and SimSiam (Chen & He, 2021).
The unlearnable examples are evaluated by two training settings, supervised
and unsupervised training. We use TUE to embed the linear separability into
SimCLR, MoCo and SimSiam, respectively, and get three protected datasets. When
testing with unsupervised training, we use the corresponding unsupervised
algorithm that is used to generate TUE.

Table 4 shows the model accuracy on clean test data after being trained on
unlearnable data. First, we observe that previous unlearnability methods can
only work under one training setting, and have almost no protection under the
other training setting. Specifically, EMN and SN reduces the test accuracy of
supervised training to less than 20% on CIFAR-10 and less than 6% on CIFAR-100
but cannot transfer well in all of the three unsupervised trainings. UCL
reduces the accuracy of unsupervised training to less than 50% on CIFAR-10 and
less than 20% on CIFAR-100 but has almost no protection from supervised
training. Second, TUE can hold the unlearnability in both supervised and
unsupervised training settings. It reduces the supervised accuracy to around
10% on CIFAR-10 and 1% on CIFAR-100 and reduces the unsupervised accuracy to a
comparable level to UCL. In particular, it can even perform better than EMN in
supervised training. The test accuracy of unauthorized classifiers trained on
TUE is around 4% lower than EMN on both CIFAR-10 and CIFAR-100. Because the
enhanced linear separability causes that supervised model focuses more on TUE
perturbation than EMN perturbation. In summary, from Table 4, we can see that
TUE has good training-wise transferability, which can maintain the unlearnable
effect when being transferred from supervised training to unsupervised
training and it is the only one that maintains the unlearnable effects under
two training settings.

###  5.3 Data-wise transferable unlearnability

After demonstrating the training-wise transferability of TUE, in this
subsection, we show that TUE also has better data-wise transferability, i.e.,
the perturbations generated with TUE on one dataset can also protect any other
datasets from unauthorized supervised training. Following the experimental
settings in the preliminary studies of Section 3.2.2, we test the data-wise
transferability first on non-target data samples, and then on non-target
datasets. The results are reported in Table 5.3 and Table 5.3, respectively.

Table 5: Test accuracy (%) with different correpondings between train data and
perturbations.

Dataset | Methods | Original | Intra | Inter
---|---|---|---|---
CIFAR-10 | EMN | 15.88 | 30.74 | 33.91
| SN | 14.07 | 13.59 | 13.15
| TUE (SimCLR) | 10.67 | 10.16 | 10.90
| TUE (MoCo) | 10.06 | 12.04 | 8.57
| TUE (SimSiam) | 10.03 | 10.25 | 10.47
CIFAR-100 | EMN | 6.59 | 21.63 | 35.50
| SN | 2.13 | 2.44 | 2.73
| TUE (SimCLR) | 0.76 | 1.11 | 1.13
| TUE (MoCo) | 1.09 | 1.25 | 3.63
| TUE (SimSiam) | 1.21 | 1.28 | 1.08

Table 6: Test accuracy (%) of transferring the perturbation generated on
CIFAR-10 to different datasets.

| SVHN-small | CIFAR-100 | SVHN
---|---|---|---
EMN | 27.59 | 21.80 | 24.72
SN | 9.58 | 9.35 | 7.77
TUE (SimCLR) | 9.77 | 10.53 | 11.72
TUE (MoCo) | 11.29 | 8.32 | 13.95
TUE (SimSiam) | 10.28 | 5.10 | 12.93

First, for non-target data samples, we compare the performance under the
original correspondence, intra-class swapping and inter-class swapping between
samples and perturbations in the same dataset. In Table 5.3, TUE can maintain
similar test accuracy under different correspondences on CIFAR-10 and
CIFAR-100. For example, on CIFAR-100, the test accuracy of EMN in intra-class
and inter-class swapping is around, respectively, 15% and 29% higher than that
in the original correspondence, but for TUE, the difference in the test
accuracy under different correspondences is less than 3%. Although we can also
notice this data-wise transferability in SN, it is not an optimizable method
and is unable to be used for improving the training-wise transferability.

Second, to verify that the proposed TUE can maintain unlearnability when
transferred to different datasets, we generate TUE on CIFAR-10 and test the
performance of transferring onto three datasets, SVHN-small, CIFAR-100 and
SVHN. TUE on CIFAR-10 can be directly transferred to SVHN-small without
interpolation, while CIFAR-100 requires interpolation for more classes and
SVHN requires interpolation for more samples. The baseline methods are also
interpolated for comparison. In Table 5.3, we can observe that on all the
datasets, TUE can maintain the unlearnable effect after being transferred onto
all the other datasets. The enhanced linear separability of TUE ensures that
the test accuracy is low. For example, EMN has poorer protection after
transferred onto SVHN-small with the accuracy of 27.59%, but TUE can maintain
the unlearnability on non-target datasets for all the backbones at around 10%
accuracy.

From Table 5.3 and Table 5.3, we can draw the conclusion that the proposed TUE
has better data-wise transferability than optimization-based unlearnable
methods like EMN, and our strategy to transfer TUE to protect other datasets
can be very efficient.

###  5.4 Linear Separability of Transferable Unlearnable Examples

In this subsection, we aim to better understand how linear separability
influences unlearnable examples by visualization. To better visualize linear
separability of the perturbations, we use t-SNE to show the perturbation in
the input space. Although t-SNE cannot accurately describe the high-dimension
space, it is useful to observe the separability of the perturbations in the
input space. We compare the perturbations in the input space in the following
three groups.

Figure 3: t-SNE visualization of linear separability of supervised unlearnable
examples.

Comparison of Linear separability in supervised unlearnable examples. In Fig.
3, we show the perturbations of EMN, SN and TUE to understand why linear
separability is more effective than EMN when used in supervised
classification. In Fig. 3, the perturbations of different classes in TUE and
SN are clearly separated and have no overlapping. In contrast, EMN has some
data points mixed with other classes which are confusing when used in
classification. Meanwhile the clusters in EMN do not contract as well as TUE
and SN. Since better linear separability can provide useful information about
classification, the supervised model will focus on TUE and SN more than EMN
and ignore the semantic features in clean images.

Figure 4: t-SNE visualization of linear separability of two examples of
interpolation.

Linear separability in Interpolation. In Fig. 4, we show that the
interpolation on TUE from CIFAR-10 to SVHN and CIFAR-100 can also hold linear
separability which makes it data-wise transferable. We can observe that in the
interpolation for SVHN, although the size of each class is different, they can
still hold clear linear separability and unlearnbility. In SVHN, the
interpolation within classes creates more samples for one class. Since the
numbers of examples in different classes in SVHN are different, it can be
observed that some clusters are much larger than others. For CIFAR-100, more
new classes are created and they still keep good linear separability. So the
supervised model trained on interpolation-based unlearnable SVHN and CIFAR-100
will learn nothing but the perturbations and perform poorly on clean test data
which has no perturbations.

Figure 5: t-SNE visualization of linear separability of supervised and
unsupervised unlearnability.

Comparison of Linear separability between supervised and unsupervised
unlearnability. In Fig. 5, we show the perturbations of UCL and TUE in input
space to understand why UCL cannot help with unlearnable effects in supervised
training. TUE is linear separable, which can be used to protect the data from
both supervised and unsupervised training. But for UCL, all the perturbations
are mixed, they cannot provide the class information for supervised training.
So for a supervised model, UCL is not a helpful feature and will not vanquish
the semantic feature.

###  5.5 Case Study

Figure 6: Visualization of the unlearnable examples of EMN, UCL and TUE(ours).
We rescale the perturbation from [-8/255, 8/255] to [0,1] for better
visualization.

In this subsection, by showing the patterns of the perturbations generated by
different methods, we can deepen our understanding on linear separability in
TUE and observe the classwise and samplewise characteristics, which reflect
the basic idea behind training-wise transferability.

We illustrate the samples and unlearnable perturbations from two classes of
CIFAR-10, i.e., horse and airplane, in Figure 6. First, we find that EMN and
TUE both have classwise noise patterns. Every noisy sample has similar
features in one class, while every class has a different feature pattern from
other classes. This is a new perspective to show that TUE has linear
separability and perturbations from the same class are clustered in input
space. Second, in UCL, the perturbations can be more diverse and related to
each sample, which indicates that unsupervised unlearnability requires more
complex feature patterns. We cannot see the classwise patterns like EMN.
Because UCL uses no label information and has no concept of classes. Third, we
notice that TUE has both classwise and samplewise characteristics as expected.
The classwise feature can be the easy-to-learn feature for the supervised
model, while the samplewise feature can be effective in reducing unsupervised
loss, which makes the unlearnability transferable from supervised training to
unsupervised training. In summary, from the case study, we can observe that
the co-existing classwise and samplewise features provide supervised and
unsupervised protection at the same time. The linear separability makes the
supervised unlearnability data-wise transferable.

##  6 Conclusion

We reveal the limitation of training-wise and data-wise transferability in
existing unlearnable examples and propose Classwise Separability Discriminant
to enhance transferability. The proposed Transferable Unlearnable Examples
(TUE) can be transferred from supervised to unsupervised training with the
unlearnable effect maintained and can protect data from unauthorized usage in
a comprehensive way. Meanwhile, the unlearnability of TUE is transferable
across datasets. It can generate unlearnbility once for all, which makes
unlearnable examples more practical and efficient. TUE greatly pushes the
boundary of existing unlearnable methods that can only work on the target data
and target training setting. We improve the data-wise and training-wise
transferability of unlearnable examples and provide more flexible, practical,
and comprehensive protections from unauthorized data usage.

## References

  * Bollacker et al. (2008) Kurt Bollacker, Colin Evans, Praveen Paritosh, Tim Sturge, and Jamie Taylor.  Freebase: a collaboratively created graph database for structuring human knowledge.  In _Proceedings of the 2008 ACM SIGMOD international conference on Management of data_ , pp. 1247–1250, 2008.
  * Chen et al. (2020a) Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton.  A simple framework for contrastive learning of visual representations.  In _International conference on machine learning_ , pp. 1597–1607. PMLR, 2020a.
  * Chen & He (2021) Xinlei Chen and Kaiming He.  Exploring simple siamese representation learning.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 15750–15758, 2021.
  * Chen et al. (2020b) Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He.  Improved baselines with momentum contrastive learning.  _arXiv preprint arXiv:2003.04297_ , 2020b.
  * Fowl et al. (2021) Liam H Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojciech Czaja, and Tom Goldstein.  Adversarial examples make strong poisons.  In _Advances in Neural Information Processing Systems_ , 2021.
  * Geirhos et al. (2020) Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A Wichmann.  Shortcut learning in deep neural networks.  _Nature Machine Intelligence_ , 2(11):665–673, 2020.
  * Grill et al. (2020) Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, et al.  Bootstrap your own latent-a new approach to self-supervised learning.  _Advances in Neural Information Processing Systems_ , 33:21271–21284, 2020.
  * Guo et al. (2016) Yandong Guo, Lei Zhang, Yuxiao Hu, Xiaodong He, and Jianfeng Gao.  Ms-celeb-1m: A dataset and benchmark for large-scale face recognition.  In _European conference on computer vision_ , pp. 87–102. Springer, 2016.
  * He et al. (2022) Hao He, Kaiwen Zha, and Dina Katabi.  Indiscriminate poisoning attacks on unsupervised contrastive learning.  _arXiv preprint arXiv:2202.11202_ , 2022.
  * Huang et al. (2008) Gary B Huang, Marwan Mattar, Tamara Berg, and Eric Learned-Miller.  Labeled faces in the wild: A database forstudying face recognition in unconstrained environments.  In _Workshop on faces in’Real-Life’Images: detection, alignment, and recognition_ , 2008.
  * Huang et al. (2020) Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang.  Unlearnable examples: Making personal data unexploitable.  In _International Conference on Learning Representations_ , 2020.
  * Krizhevsky et al. (2009) Alex Krizhevsky, Geoffrey Hinton, et al.  Learning multiple layers of features from tiny images.  2009\.
  * Madry et al. (2018) Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  In _International Conference on Learning Representations_ , 2018.
  * Muñoz-González et al. (2017) Luis Muñoz-González, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C Lupu, and Fabio Roli.  Towards poisoning of deep learning algorithms with back-gradient optimization.  In _Proceedings of the 10th ACM workshop on artificial intelligence and security_ , pp. 27–38, 2017.
  * Netzer et al. (2011) Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng.  Reading digits in natural images with unsupervised feature learning.  2011\.
  * Shan et al. (2020) Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao.  Fawkes: Protecting privacy against unauthorized deep learning models.  In _29th USENIX Security Symposium (USENIX Security 20)_ , pp. 1589–1604, 2020.
  * Wang & Isola (2020) Tongzhou Wang and Phillip Isola.  Understanding contrastive representation learning through alignment and uniformity on the hypersphere.  In _International Conference on Machine Learning_ , pp. 9929–9939. PMLR, 2020.
  * Yu et al. (2021) Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie-Yan Liu.  Indiscriminate poisoning attacks are shortcuts.  _arXiv preprint arXiv:2111.00898_ , 2021.

##  Appendix A Existing unlearnable methods cannot protect unlabeled dataset
in a training-wise trasnferable way

Previous unlearnable methods can only protect data from one unauthorized
training setting. According to whether the dataset is annotated, unlearnable
examples can be classified in two settings, supervised and unsupervised
unlearnable examples, as mentioned in Section 2. The supervised unlearnable
methods, like EMN, can create unlearability based on the label information and
protect the data from supervised training, but these methods cannot prevent
the unauthorized parties from training the data with an unsupervised
algorithm. Similarly, the unsupervised unlearnable examples produced by
Unleanrable Contrastive Learning (UCL) He et al. (2022) can destroy the
unsupervised training but they are still learnable in the supervised training.
In Fig. 7, EMN decreases the accuracy of supervised training from 93.8% to
14.7%, but only decreases the accuracy of unsupervised training by 0.2%.
Similarly, SN decreases supervised training to 14.1%, but only decreases
unsupervised training by 1.1%. Supervised unlearnable examples have almost no
training-wise transferability to unsupervised training. UCL, which produces
unsupervised unlearnable examples, can protect data from unsupervised
training, but cannot be transferred well to supervised training. Under
unsupervised training, UCL can decrease the test accuracy from 90.0% to 47.8%,
but under supervised training, it can only decrease the accuracy by 0.9%.

Figure 7: Accuracy on test data of classifiers produced by supervised training
and unsupervised training on the unlearnable examples from CIFAR-10

##  Appendix B Details of experimental settings

###  B.1 Settings of generation process

All the baselines and our proposed TUE are generated in the way of PGD Madry
et al. (2018), except for SN, which is sampled from a manually designed
distribution following the algorithm in Yu et al. (2021). For EMN, UCL, and
TUE, the generation process is an alternate optimization between model
parameters and perturbations. For example, TUE is optimized in the way of Eq.
6. In EMN, after every epoch of optimization on model parameters, the whole
set perturbations are optimized for one epoch by PGD-20. In TUE, different
backbones are set to different schedule. For TUE (SimCLR), the model
parameters are trained for 40 epochs, and after every 1/5 epoch of
optimization on model parameters, the whole set perturbations are optimized
for one epoch by PGD-20. For TUE (MoCo), the model parameters are trained for
200 epochs, and after every epoch of optimization on model parameters, the
whole set perturbations are optimized for one epoch by PGD-5. For TUE
(SimSiam), the model parameters are trained for 50 epochs, and after every 1/4
epoch of optimization on model parameters, the whole set perturbations are
optimized for one epoch by PGD-20. UCL with SimCLR and SimSiam have the same
settings as TUE. UCL with MoCo uses PGD-10 and the other settings in the
schedule is the same as TUE (MoCo). Finally, all the perturbations are
constrained by $l_{\infty}$ norm, i.e.
$\left\|\delta_{i}\right\|_{\infty}\leq\epsilon$ where $\epsilon=8/255$.

###  B.2 Settings of evaluation stage

To evaluate the unlearnable effect, we use CrossEntropy as the objective
function in the unauthorized supervised training. We use linear probing after
contrastive pre-training to evaluate the unlearnable effect in unsupervised
training. The supervised model is trained for 200 epochs. The unsupervised
model is pre-trained for 1000 epochs by unsupervised contrastive learning and
then fine-tuned for 100 epochs by linear probing. The details for the
hyperparameters are listed in Table 7.

Table 7: Hyperparameters of evaluation stage

Hyperparameter | Supervised | Unsupervised pretraining | Linear probing
---|---|---|---
SimCLR | MoCo | SimSiam | SimCLR | MoCo | SimSiam
Epoch | 200 | 1000 | 1000 | 1000 | 100 | 100 | 100
Optimizer | SGD | SGD | Adam | SGD | Adam | SGD | SGD
Learning Rate | 0.1 | 0.06 | 0.3 | 0.06 | 0.001 | 30 | 30
LR Scheduler | CosineAnnealingLR (CA) | - | CA | CA | - | CA | CA
Encoder Momentum | - | - | 0.99 | - | - | - | -
Loss Function | CrossEntropy (CE) | InfoNCE | InfoNCE |  Similarity between positive samples | CE | CE | CE