Blockchain-based Framework for Generating and Managing Unlearnable Examples for Enhancing Data Privacy and Access Control

Summary

This paper proposes a blockchain-based framework for generating unlearnable examples, integrating dynamic perturbation with access control. It enhances privacy protection by ensuring that unauthorized users receive perturbed data, safeguarding sensitive information while enabling efficient data management and access through smart contracts.

Abstract

In the context of the rapid development of large language models (LLMs), contrastive learning has become widely adopted due to its ability to bypass costly data annotation by leveraging vast amounts of network data for model training. However, this widespread use raises significant concerns regarding data privacy protection. Unlearnable Examples (UEs), a technique that disrupts model learning by perturbing data, effectively prevents unauthorized models from misusing sensitive data. However, existing methods for generating UEs face two primary challenges: first, perturbations may be reversed using techniques such as reverse purification or denoising, including diffusion models that remove protective perturbations in image UEs; second, once data is published, ensuring data traceability and managing access control becomes difficult. To address these issues, this paper proposes a Blockchain-Integrated Unlearnable Example Generation and Management Framework (B-UEGMF) for generating and managing UEs. By leveraging the decentralized and immutable properties of blockchain, we store example hash values on the blockchain and dynamically manage data access rights through smart contracts. Additionally, UEs are generated using a multi-objective perturbation technique, Dynamic Error-Minimizing Noise (DEM), which enhances robustness against reversal methods. We also provide a quantitative evaluation of the privacy protection capabilities of the generated examples. Experimental results demonstrate that the proposed framework significantly improved the defense of UEs against reverse attacks while ensuring efficient data privacy management.

Introduction

In recent years, with the rapid advancement of deep learning and large language models, contrastive learning has emerged as an efficient unsupervised learning approach due to its independence from costly manual annotations^1,2. However, the extensive use of public datasets has raised significant concerns about privacy breaches and data misuse. Instances of unauthorized utilization of publicly available data for model training have become increasingly common³. For example, in 2017, unauthorized public photographs were employed to train facial recognition models⁴. Similarly, Amazon utilized consumer public review data to train its recommendation systems without securing explicit consent from all users, exposing vulnerabilities in privacy protection mechanisms⁵.

To address these issues, Unlearnable Examples (UEs) have emerged as a novel data privacy protection technique. UEs add imperceptible perturbations to data samples, introducing a shortcut that prevents models from learning sensitive information while preserving human perception of the data^6,7,8. Existing methods for generating UEs primarily include Error-Minimizing noise (EM) perturbations⁹, perturbation generation by generative adversarial networks (GANs)¹⁰, Robust Error-Minimizing noise (REM), and Stable Error-Minimizing noise (SEM) optimized through adversarial training^11,12. Additionally, diffusion models have recently been applied to generate incorrect label noise, further enhancing privacy protection¹³.

Despite significant progress in UEs generation, several challenges remain, particularly in real-world applications where the privacy protection effects of these methods have not been fully validated. Specifically, the key challenges include:
Restoration Issues: Diffusion models can partially recover Unlearnable Examples by predicting and removing the perturbations embedded in the data, thereby restoring learnability and compromising privacy protection^14,15. Even when data is perturbed during training, sensitive information may still be disclosed after restoration.
Data Traceability and Access Control: Once Unlearnable Examples are released, effective mechanisms to trace their origin and enforce access restrictions remain technically challenging¹⁶.
Balancing Privacy Protection and Model Performance: While existing methods focus on generating Unlearnable Examples to safeguard privacy, maintaining a balance between privacy protection and model training performance remains unresolved^17,18,19. Most current research prioritizes privacy protection but pays limited attention to mitigating performance degradation during model training^20,21. Consequently, data access and utilization have become critical concerns in privacy protection²².

While centralized solutions and trusted execution environments (TEEs) offer alternative approaches to data access control, they face inherent limitations in medical/legal scenarios: (1) Centralized systems introduce single points of failure and audit dependency²³; (2) TEEs require specialized hardware and lack decentralized consensus²⁴. Blockchain emerges as the optimal solution because its immutable ledger properties directly address three critical requirements for UE management: provable compliance with data governance regulations (e.g., HIPAA audit trails), censorship-resistant access control in multi-institution settings, and granular provenance tracking through timestamped transactions^25,26,27.

Our framework demonstrated optimal performance for medium-scale datasets with GPU acceleration, achieving real-time perturbation generation. While blockchain operations introduce measurable overhead, this trade-off is justified in scenarios requiring immutable access logs, such as multi-institutional medical research or regulated data markets. The system scales linearly with dataset size but requires ≥16 GB RAM and 4-core CPUs for stable operation, making it less suitable for resource-constrained edge devices.

To address these challenges, this paper proposes a Blockchain-Integrated Unlearnable Example Generation and Management Framework (B-UEGMF). Blockchain, as a decentralized and immutable distributed ledger technology, effectively records data access hashes and dynamically manages access permissions by smart contracts, thereby enhancing the privacy protection capabilities of Unlearnable Examples^28,29. Under this framework, authorized users can access clean data, whereas unauthorized users can only access dynamically generated Unlearnable Examples. To tackle existing issues, this paper introduces a novel Dynamic Error-Minimizing Noise (DEM) generation method. By incorporating client-specific information and temporal parameters, DEM dynamically embeds perturbations into the data, generating unique perturbations for each data request and ensuring both data privacy and unlearnability. The DEM generation process is illustrated in Figure 1. The main contributions of this paper are as follows:
Dynamic Traceability and Access Management: This paper addresses the traceability and access control issues associated with the release of Unlearnable Examples by proposing the B-UEGMF framework. The decentralized nature of blockchain solves the trusted third-party problem in traditional systems, while its transparency enables verifiable access logs without exposing raw data. By leveraging the transparency and immutability of blockchain, combined with the dynamic access control enabled by smart contracts, the framework ensures that unauthorized users cannot recover or disseminate clean data, thereby significantly enhancing data security.

Dynamic Perturbation Generation Mechanism: A dynamic Unlearnable Examples generation scheme is introduced, where smart contracts manage requests from different clients. DEM perturbations are dynamically generated for unauthorized client requests based on client-specific information and temporal parameters. This ensures that perturbation effects vary across requests, thereby strengthening resistance to diffusion-based noise removal methods and limiting unauthorized users from accessing large-scale datasets at once.

Experiments conducted on CIFAR-10, CIFAR-100, and ImageNet datasets demonstrate that DEM outperforms existing methods (e.g., EM, TAP, and SEM) in terms of privacy protection and resistance to reverse engineering attacks, as demonstrated in Figure 2, while improving resistance to noise removal attacks by 57% compared to EM and 25% compared to SEM, as demonstrated in Figure 3, highlighting its potential applicability in real-world scenarios.

Protocol

Setup
We considered a supervised classification task with a dataset , where represents the input features and denotes the corresponding class labels for a K-class problem. The dataset D is split into a clean training dataset and a test dataset.

The goal is to modify the clean training dataset by introducing small, imperceptible perturbations δ to create an unlearnable dataset , where  + δ. The perturbation δ is bounded by , ensuring that it does not significantly alter the normal utility of the data. The key objective is to disrupt learning by forcing the model f_θ, trained on D_u, to focus on irrelevant patterns induced by the noise rather than the meaningful features, resulting in poor generalization on a clean test dataset:

Simulating a blockchain environment
To install blockchain tools, the Hardhat framework is used to simulate an Ethereum network on a local environment for deploying smart contracts and testing the generation of Unlearnable Examples. To launch a local network, a simulated blockchain network with multiple nodes and accounts is initialized. Each node is allocated resources like Ether to facilitate transaction simulations. To develop smart contracts, they are implemented to dynamically manage user permissions. Authorized users can access clean data, while unauthorized users are restricted to accessing Unlearnable Examples. First, configure a development environment based on Node.js v16.x and Hardhat 2.8.4, and use the Solidity 0.8.17 compiler to complete the compilation and optimization of the smart contract. The compilation process is executed by the command line using npx hardhat compile to generate build artifacts containing the ABI and bytecode. Subsequently, deploy the contract to the Sepolia test network by running the deployment script npx hardhat run scripts/deploy.js --network sepolia, and record the output contract address and deployment transaction hash. During the performance testing phase, three core tests are sequentially executed: transaction cost test records gas consumption by cyclically invoking the contract's grantAccess method; throughput test uses the Artillery tool to simulate user requests with incrementally increasing load; testing and validation transactions, including data storage and retrieval, are conducted to validate the smart contract's functionality.

Constructing on-chain users and permission mechanisms
Unique user accounts are generated using blockchain wallets (e.g., MetaMask), each comprising a private key and a public key. The prototype implementation employs a simulated blockchain environment where synthetic user entities upload publicly available datasets to the decentralized system, storing only cryptographic hash values on the distributed ledger. This ensures data integrity without storing the actual data on-chain, which would be inefficient and costly. The actual data is stored off-chain, typically using decentralized storage systems like IPFS, ensuring efficient data management while maintaining security and privacy. For non-fungible tokens (NFTs) and access control, this study implements a fine-grained access control mechanism using NFTs compliant with the ERC-721 standard. Each dataset of unlearnable examples is associated with a unique tokenId, which acts as a key to accessing the data. Users request access by submitting Merkle proofs. These proofs verify the user's identity in a secure, decentralized manner. Upon successful proof validation, the contract mints a unique NFT and transfers it to the user's wallet. This NFT represents the user's right to access the data associated with that specific unlearnable example. The use of NFTs ensures that only authorized users can access the data, based on a decentralized, immutable record. This is in contrast to traditional Role-Based Access Control (RBAC), which typically operates at the group level and may not provide the granularity needed for high-security applications³⁰.

The smart contract continuously verifies access permissions through the ownerOf function, checking the ownership of the NFT to ensure that only authorized users can access the clean data. Administrators can revoke access by destroying the NFT through the revokeAccess function, ensuring flexibility in managing user access over time. The operational workflow consists of four critical steps: (1) users submit access requests containing Merkle proofs; (2) the contract verifies the validity of these proofs; (3) upon successful validation, the contract mints the corresponding NFT; (4) users retrieve encrypted data using the IPFS Content Identifier (CID) embedded in the NFT's metadata. By leveraging NFTs, we achieve several benefits over traditional access control mechanisms, such as fine-grained permission control (data-level vs. group-level), better audit capability (immutable on-chain records), and permission transferability (NFT marketplace transactions).

Multi-signature contracts are implemented for updating the Merkle root hash, preventing unauthorized tampering of data. The system incorporates anti-Sybil mechanisms by binding each dataset to a unique tokenId, ensuring that malicious actors cannot generate fraudulent tokens to access unauthorized data. The UEs are encrypted using AES-256 before being uploaded to the InterPlanetary File System (IPFS) network. The encrypted data hashes are stored on-chain, while the complete datasets remain on IPFS, reducing blockchain storage overhead. The hybrid approach of combining on-chain and off-chain storage strikes a balance between ensuring data availability and reducing storage costs, a common concern in blockchain-based applications.

Smart contracts are employed to dynamically manage user permissions. Each user is granted access to clean data only if they hold the appropriate NFT, which serves as their authorization token. Smart contracts log all data access in event logs, providing full traceability. These logs are immutable and can be audited, offering transparency and accountability. The smart contract employs the grantAccess function to validate access requests. The contract checks if the user holds the appropriate NFT and, if valid, grants access to the requested data. Each access event is recorded on the blockchain, ensuring that all data retrieval activities are verifiable. Every data access event is logged in real-time by the smart contract, which triggers an AccessGranted event. This event contains important information such as the user's wallet address, the timestamp of the access, and the corresponding NFT tokenId. The dynamic nature of smart contracts allows for real-time management of permissions. This is particularly useful in decentralized applications, where access control needs to be highly flexible and adaptable to changing conditions.

To address privacy concerns in public blockchain environments, the system stores low-resolution thumbnails (e.g., 64 x 64 pixels) on the blockchain, while the original high-resolution images are encrypted and stored off-chain on IPFS. Only authorized users who possess the corresponding NFT can retrieve the decryption keys for accessing the high-resolution data. Unauthorized users receive versions of the data with real-time DEM perturbations, ensuring that they cannot access the original data.

Generate image perturbation
Load CIFAR10, CIFAR100, and ImageNet datasets. Images in the datasets are uniformly resized and converted into PyTorch tensor, and the image tensor is normalized using the mean and standard deviation. Initialize a random noise δ¹, using a Gaussian distribution to generate the initial perturbation. Random noise is applied to each image x, and the loss between the target label and the model prediction is calculated based on the cross-entropy loss. In a data set of class C, for a sample i, y_i is the target label value, p_i is the model prediction probability, which quantifies the difference between the probability distribution predicted by the model and the actual label, maximizing the loss so that the model produces false predictions. The cross-entropy loss is:

The influence of image perturbation on prediction calculated according to the loss function, the reverse propagation updates the perturbation, and the perturbation range and perturbation value are constantly updated through multiple iterations. For the learning rate η, the update formula for the perturbation is:

Generate text perturbations
Load pre-trained BERT models for generating text embeddings. A custom TextFeatureExtractor network consisting of two Transformer blocks and a fully connected layer is used to extract features from text embeddings generated by BERT models. Input the user information and timestamp of the access user into the pre-trained BERT model and dynamically generate text noise through the customized TextFeatureExtractor network.

The input image I is fed into the Qwen2.5-VL-7B-Instruct multimodal model. Guided by a structured prompt, the model generates a concise textual description T_q. This generated text T_q is input into the pre-trained BERT-base-uncased language model. Through task-specific rewriting prompts, the system generates perturbed text  that preserves semantics while altering expression. A TextFeatureExtractor network maps the perturbed text into a high-dimensional semantic embedding vector E_g.

Generate multi-target perturbations
To ensure compatibility between text embeddings and image perturbations, we adjust the shape of the text embedding to match the dimensions of the image perturbation. Let E_T and E_q represent the text embeddings, and P_L the image perturbation. The reshaping process ensures E_T and E_q are transformed to the same dimensionality as P_L: , where C, H, W are the dimensions of P_L. Define an attention-mechanism fusion module that fuses text embedding perturbations and image perturbations, dynamically adjusting the perturbations according to the attention weights of the text. The fusion is:

where α is the dynamic adjustment of the attention mechanism parameters. δ^T is the text disturbance generated by the E_q and E_T. Add a regularization term to the training process to prevent overfitting. The regularization term is the L2 norm of the text embedding, which penalizes perturbations. The multi-objective loss function combines cross-entropy loss and fusion perturbation, and the multi-objective loss function is as follows:

The goals of the loss function are:

where λ is a regularization coefficient used to control the penalty force of the perturbation, with the purpose of inhibiting excessive perturbation or overfitting. In the study of adversarial attacks, it has been found that  is the perturbation limit perceptible to the human eye. The training and evaluation process is defined, including perturbation generation, loss calculation, model training, etc.

Comparative experiments
We conducted a comprehensive evaluation of the proposed Dynamic Error-Minimizing Noise (DEM) against three existing methods: Error-Minimizing Noise (EM), Transferable Adversarial Perturbations (TAP), and Stable Error-Minimizing Noise (SEM). These methods were tested on three benchmark datasets: CIFAR-10, CIFAR-100, and a subset of ImageNet, using four widely adopted neural network architectures: VGG-16, ResNet-18, ResNet-50, and DenseNet-121, to ensure diverse experimental conditions.

In addition, we examined the robustness of these methods by applying diffusion-based denoising models to remove defensive noise and measuring the accuracy of the denoised examples on the test datasets. This step aimed to evaluate each method's ability to resist recovery attacks and maintain data privacy integrity under adversarial conditions. Results indicate that our DEM outperforms other methods in both robustness and accuracy across all datasets and architectures, demonstrating its efficacy as a privacy-preserving framework.

Results

Blockchain and smart contract framework
Experimental results demonstrated that the proposed Blockchain-Integrated Unlearnable Example Generation and Management Framework (B-UEGMF), combined with smart contracts, enabled effective dynamic management of client-specific access to data. For authorized users, the retrieved clean data achieved a test accuracy of 90.2% on a ResNet-18 surrogate model evaluated on the CIFAR-10 dataset. In contrast, unauthorized users accessing UEs generated by DEM obtained a ...

Discussion

The integration of blockchain and UEs has advanced the field of data privacy protection by providing a transparent and decentralized solution for managing data access. Unlike conventional privacy-preserving methods, which often rely solely on perturbation techniques³¹, this study bridges the gap between data protection and responsibility tracing. In federated learning scenarios, the proposed framework ensures secure and private model training across decentralized datasets, mitigating the risk of u...

Materials

List of materials used in this article

Name	Company	Catalog Number	Comments
CUDA 12.1	NVIDIA		Used to enhance the performance of deep learning applications
NVIDIA A800 80GB PCIe A800 80GB PCIe	NVIDIA		Used for deep learning model training
Python 3.10	Python Software Foundation		Used for data preprocessing and analysis
PyTorch 2.5.1	Facebook		Deep learning framework used for model training
Ubuntu 22.04	Canonical		Operating system used for setting up the environment