Unlearnable data methods (ULD) protect public data from unauthorized model training by adding imperceptible perturbations that create a learning shortcut. A deep neural network can exploit the shortcut learning path to minimize training loss without learning generalizable features. Intuitively, finding adversarial versions of perturbed images that can substantially increase the model's loss can force the model to learn generalizable features. Existing data augmentation based attacks rely on heuristic search strategies/random sampling over a curated augmentation set to identify adversarial augmentation operations, an approach that often does not scale when the number of candidate operations is large. To address the challenge of a large search space, we propose {\techname}, a gradient based adversarial augmentation framework that learns an augmentation policy via stochastic gradient ascent. {\techname} leverages a differentiable data augmentation pipeline to efficiently search a set of up to 18 augmentation techniques, from which a grid search selects a protection-specific subset. The augmentation subset is trained to maximize a surrogate model's classification loss. We introduce a perceptual-plus-pixel regularization to learn operation parameters that preserve image semantics. Under a controlled
A Gradient based Adversarial Augmentation Framework for Mitigating Unlearnable Datasets
这个问题是要把给定的纯文本新闻正文排版成语义化的HTML片段，首先得看原文结构，原文是一整段学术性的新闻内容，没有现成的小节划分，但里面有提到现有方法、提出的方法、实验结果、结论这些部分，可能需要用h2来划分小节吗？不过原文里没有明显的小节标题，不过仔细看，原文先讲ULD的背景和现有攻击方法的问题，然后提出{\techname}框架，再讲框架的具体方法、实验结果，最后是结论。不过用户规则里说长文用h2/h3划分小节，那需要看是否需要划分。不过原文是一个连续的段落吗？不，原文其实是一个段落，但里面有几个部分：背景介绍（ULD是什么，现有攻击方法的问题）、提出的方法（{\techname}框架，包括augmentation policy学习、differentiable pipeline、grid search、regularization）、实验结果、结论。不过用户规则说每个自然段落用p包裹，原文是一个自然段落吗？看用户给的正文，原文是一整段，没有换行，所以是一个自然段落？不对，看原文内容，其实是连续的，但里面有多个句子。不过用户规则第一条说每个自然段落用p包裹，那如果原文是一个自然段，就用一个p？但再看规则2，长文用h2/h3划分小节，可能需要把内容分成几个小节。比如：背景与现有挑战、提出的方法、实验结果与分析、结论与意义？不过原文里没有小标题，但内容可以这样划分。不过用户规则4说保留原文所有信息，不得增删改内容，所以不能加小标题文字，只能用h2/h3来划分内容块？不对，规则2说长文用h2/h3划分小节，那小节需要有内容，但原文没有小节标题，那怎么划分？可能原文是一个段落，所以不需要h2/h3？不对，再看用户给的正文，原文是一整段，但里面有多个逻辑部分：1. ULD的定义和原理；2. 现有攻击方法的局限；3. 提出的{\techname}框架及其方法；4. 实验结果；5. 结论。那可能需要用h2来划分这些部分，但原文没有标题，所以h2里不放文字，只放内容？不对，h2是标题标签，应该包含标题文字，但原文里没有，所以可能不需要用h2/h3？因为原文没有小节标题，所以直接用p包裹整个段落？但再看规则3，重要句子可用strong，那需要找出重要句子。比如原文中的“To address the challenge of a large search space, we propose {\techname}, a gradient based adversarial augmentation framework that learns an augmentation policy via stochastic gradient ascent.”、“{\techname} leverages a differentiable data augmentation pipeline to efficiently search a set of up to 18 augmentation techniques, from which a grid search selects a protection-specific subset.”、“We introduce a perceptual-plus-pixel regularization to learn operation parameters that preserve image semantics.”、“Under a controlled ablation, {\techname} consistently outperforms an equivalent random sampling baseline (80.0\% vs. 77.29\% clean test accuracy on EMIN-protected CIFAR-10 for ResNet-18 and 83.28\% vs. 66.45\% on NTGA-protected CIFAR-10 for MobileNet-V2), demonstrating that gradient guidance drives the clean test accuracy recoverability rather than the expanded search space.”、“{\techname} offers an effective and scalable adversarial augmentation framework for stress-testing ULD methods, a critical tool for developing robust ULD methods.”这些可能是重要句子，需要用strong。那现在开始处理：原文是一个自然段落，所以用p包裹，然后里面的几个重要句子用strong。比如第一句“Unlearnable data methods (ULD) protect public data from unauthorized model training by adding imperceptible perturbations that create a learning shortcut.”是背景，然后第二句“A deep neural network can exploit the shortcut learning path to minimize training loss without learning generalizable features.”是解释，第三句“Intuitively, finding adversarial versions of perturbed images that can substantially increase the model's loss can force the model to learn generalizable features.”是直觉解释，第四句“Existing data augmentation based attacks rely on heuristic search strategies/random sampling over a curated augmentation set to identify adversarial augmentation operations, an approach that often does not scale when the number of candidate operations is large.”是现有方法的问题，这部分可以作为第一个部分；然后第五句“To address the challenge of a large search space, we propose {\techname}, a gradient based adversarial augmentation framework that learns an augmentation policy via stochastic gradient ascent.”是提出方法，第六句“{\techname} leverages a differentiable data augmentation pipeline to efficiently search a set of up to 18 augmentation techniques, from which a grid search selects a protection-specific subset.”是方法细节，第七句“The augmentation subset is trained to maximize a surrogate model's classification loss.”是方法细节，第八句“We introduce a perceptual-plus-pixel regularization to learn operation parameters that preserve image semantics.”是方法中的正则化，这部分是第二个部分；第九句“Under a controlled ablation, {\techname} consistently outperforms an equivalent random sampling baseline (80.0\% vs. 77.29\% clean test accuracy on EMIN-protected CIFAR-10 for ResNet-18 and 83.28\% vs. 66.45\% on NTGA-protected CIFAR-10 for MobileNet-V2), demonstrating that gradient guidance drives the clean test accuracy recoverability rather than the expanded search space.”是实验结果，这是第三个部分；第十句“{\techname} offers an effective and scalable adversarial augmentation framework for stress-testing ULD methods, a critical tool for developing robust ULD methods.”是结论，这是第四个部分。但用户规则说长文用h2/h3划分小节，那是否需要用h2来划分这四个部分？但原文没有小节标题，所以h2里不能加文字，只能把内容放在h2里？不对，h2是标题，应该包含文字，但原文没有，所以可能不需要用h2/h3？因为原文没有小节标题，所以直接用p包裹整个段落，然后在重要句子用strong。那现在看原文的结构，是否有列表？没有。引用？没有。代码？没有。所以主要是p和strong。那现在把原文中的几个重要句子用strong标记：1. “To address the challenge of a large search space, we propose {\techname}, a gradient based adversarial augmentation framework that learns an augmentation policy via stochastic gradient ascent.”；2. “{\techname} leverages a differentiable data augmentation pipeline to efficiently search a set of up to 18 augmentation techniques, from which a grid search selects a protection-specific subset.”；3. “We introduce a perceptual-plus-pixel regularization to learn operation parameters that preserve image semantics.”；4. “Under a controlled ablation, {\techname} consistently outperforms an equivalent random sampling baseline (80.0\% vs. 77.29\% clean test accuracy on EMIN-protected CIFAR-10 for ResNet-18 and 83.28\% vs. 66.45\% on NTGA-protected CIFAR-10 for MobileNet-V2), demonstrating that gradient guidance drives the clean test accuracy recoverability rather than the expanded search space.”；5. “{\techname} offers an effective and scalable adversarial augmentation framework for stress-testing ULD methods, a critical tool for developing robust ULD methods.”。然后其他句子正常放在p里。那组合起来就是：