Temporal Unlearnable Examples (TUEs)

• Temporal Unlearnable Examples (TUEs) are temporally structured training samples perturbed to hinder deep models while remaining interpretable for human analysis.
• They employ selective, segment-wise noise injection in time series and target-aware perturbations in video to misguide model training without compromising data utility.
• Empirical studies show that TUEs drastically reduce model accuracy in classification and tracking tasks, validating their effectiveness as a defensive data protection strategy.

Searching arXiv for recent and foundational papers on Temporal Unlearnable Examples and related unlearnable-example theory. Temporal Unlearnable Examples (TUEs) are temporally structured training samples whose inputs are minimally perturbed so that deep models cannot effectively learn from them, while the data remain usable for legitimate use and visually or semantically interpretable to humans. In the current literature, the idea appears in two closely related forms. For time series, unlearnable examples are constructed by adding error-minimizing noise to whole sequences or to selected temporal segments, making those regions effectively uninformative for deep sequence models (Jiang et al., 2024). For personal video data, TUEs are target-aware, temporally consistent perturbations injected into object regions so that trackers learn noise-based temporal shortcuts instead of genuine appearance and motion structure, thereby preventing unauthorized exploitation by visual object tracking systems (Wu et al., 10 Jul 2025).

1. Conceptual foundations

Classical unlearnable examples are a form of clean-label data poisoning: the inputs are perturbed, the labels remain unchanged, and the perturbations are norm-bounded so that the released data still look normal. In supervised classification, a poisoned dataset takes the form

$$\mathcal{D}' = \{(x_i + \delta_i, y_i)\}_{i=1}^N, \qquad \|\delta_i\|_p \le \varepsilon,$$

with the goal that models trained on $\mathcal{D}'$ achieve low test accuracy on clean data. The broader motivation is to prevent unauthorized training on scraped data by making the data unlearnable for generic deep models (Zhu et al., 4 Mar 2026).

Within time series, the starting point is standard empirical risk minimization on samples

$$x_i = \{\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{t}\},$$

with labels $y_i$, trained by

$$\min_{\theta} \; \mathbb{E}_{(x_i,y_i)\in D} \, \ell(f_\theta(x_i), y_i). \tag{1}$$

A time-series unlearnable example modifies $x_i$ into $x_i' = x_i + \delta_i$, where

$$\delta_i = \{\delta_0, \delta_1, \ldots, \delta_t\}$$

is error-minimizing noise chosen so that

$$\ell(f_\theta(x_i + \delta_i), y_i) \rightarrow 0. \tag{2}$$

The intended effect is not to maximize prediction error at test time, as in adversarial examples, but to minimize training loss in a way that causes the model to stop updating meaningfully on the protected data. A model trained on such data cannot generalize to normal test data and will perform close to random guessing (Jiang et al., 2024).

This distinction is central to TUEs. They are not primarily misclassification attacks on already trained models. They are protective training-data perturbations whose purpose is to render temporally structured data unusable for downstream learning. In object tracking, the same principle is adapted from classification to temporal matching: the tracker is induced to correlate perturbation patterns across frames rather than the original data structure, so the training videos become unexploitable when the perturbations are absent at test time (Wu et al., 10 Jul 2025).

2. Time-series TUEs and selective temporal protection

The first time-series formulation adapts the image-domain unlearnable-example objective to sequences through a bilevel min-min problem. A noise generator model $f'_\theta$ is trained by

$\mathcal{D}'$0

and, after training, an unlearnable example is generated as

$\mathcal{D}'$1

This baseline treats the whole sequence uniformly: all time steps can be perturbed (Jiang et al., 2024).

The main temporal refinement is a selective, segment-wise formulation. For each sample, a binary control vector $\mathcal{D}'$2 specifies which time indices are protected:

• $\mathcal{D}'$3: time step $\mathcal{D}'$4 is protected;
• $\mathcal{D}'$5: time step $\mathcal{D}'$6 is unprotected.

Using elementwise multiplication $\mathcal{D}'$7, the controllable objective becomes

$\mathcal{D}'$8

Here $\mathcal{D}'$9 perturbs only the selected temporal region, while $$x_i = \{\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{t}\},$$0 zeroes out that region entirely. The objective pushes the loss on the noisy-segment sample toward the loss on the segment-removed sample, so that, from the sequence model’s perspective, the protected segment contributes nothing. The paper sets $$x_i = \{\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{t}\},$$1 in experiments (Jiang et al., 2024).

This segment-wise control is the defining feature of temporal unlearnability for time series. It allows a data owner to protect localized events rather than entire samples. The paper gives examples such as one speaker’s utterances in a conversation or specific ECG or sensor segments. In experiments, protected regions are chosen as random segments covering 20%, 50%, or 100% of the sequence length, composed of 10%-length non-overlapping windows sampled at random for each training sequence. The perturbation budget is enforced by

$$x_i = \{\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{t}\},$$2

where $$x_i = \{\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{t}\},$$3 is the maximum absolute value in the sample, so the perturbations remain relatively small compared with the signal scale (Jiang et al., 2024).

The sequence-modeling context matters. The classification experiments use a simple RNN with three recurrent hidden layers, each with 64 units, followed by a final output layer. Training uses standard backpropagation through time (BPTT), so perturbations localized at time $$x_i = \{\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{t}\},$$4 can influence later hidden states and outputs. This temporal interdependence is one reason why direct transfer of image-domain UE methods is insufficient: local noise in sequences does not remain temporally local in model dynamics (Jiang et al., 2024).

3. Temporal unlearnability in visual object tracking

In visual object tracking (VOT), temporal unlearnability targets a different learning mechanism. A video is a sequence $$x_i = \{\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{t}\},$$5. Given an initial bounding box, a tracker predicts the target’s box in later frames by matching a template patch to search regions across time. SiamFC-style training is written as

$$x_i = \{\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{t}\},$$6

where $$x_i = \{\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{t}\},$$7 and $$x_i = \{\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{t}\},$$8 are template–search pairs, $$x_i = \{\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{t}\},$$9 is the backbone, $y_i$0 is cross-correlation, and $y_i$1 is a response map centered on the true target location. Because trackers exploit appearance consistency, motion patterns, and scale changes, frame-wise image UEs are ineffective or inefficient when transferred directly to video (Wu et al., 10 Jul 2025).

The initial TUE baseline for tracking adopts an EM-style bilevel objective with one perturbation $y_i$2 per video: $y_i$3 Here $y_i$4 resizes the perturbation to the bounding-box size by bilinear interpolation, and $y_i$5 pastes it into the target region. This establishes the notion of video TUEs, but it is computationally prohibitive and poorly generalizable (Wu et al., 10 Jul 2025).

The principal contribution is a generative framework with a single conditional generator $y_i$6 shared across videos: $y_i$7 The condition $y_i$8 is a normalized bounding box encoding target state, and $y_i$9 crops the target patch from the search image. The generator outputs a perturbation of the same spatial size as the input patch, making the perturbation target-state-aware and scalable across datasets (Wu et al., 10 Jul 2025).

To intensify temporal shortcut learning, the framework adds a temporal contrastive loss: $$\min_{\theta} \; \mathbb{E}_{(x_i,y_i)\in D} \, \ell(f_\theta(x_i), y_i). \tag{1}$$0 with

$$\min_{\theta} \; \mathbb{E}_{(x_i,y_i)\in D} \, \ell(f_\theta(x_i), y_i). \tag{1}$$1

The positive pair is the feature pair $$\min_{\theta} \; \mathbb{E}_{(x_i,y_i)\in D} \, \ell(f_\theta(x_i), y_i). \tag{1}$$2 from the same target across time, while negatives include clean patches from the same video and clean patches from other videos in the batch. The effect is to bias the tracker toward matching noisy features across frames and to treat clean features as dissimilar. For transformer trackers, the reported attention visualizations show template-to-search attention concentrating on perturbation regions, which leads to wrong attention on clean videos (Wu et al., 10 Jul 2025).

The generator architecture is a DiT-S/8 variant with 12 transformer layers, 6 attention heads, and hidden dimension 384. It is used as a single-step conditional generator rather than a full diffusion process. The generator has 124 MB parameters, is trained jointly with a SiamFC surrogate on GOT-10k for 50 epochs with batch size 16, and requires about 7 hours on a single NVIDIA RTX 4090. This stands in contrast to the EM + context baseline, which requires 3.4 GB of learnable perturbation parameters and about 33 hours on GOT-10k (Wu et al., 10 Jul 2025).

4. Empirical behavior across time series and video

For time-series classification, the evaluation uses 10 datasets: six univariate UCR datasets and four multivariate datasets from the MTS Archive. Baselines are clean training, a masking baseline that zeroes out 50% of each sample in five non-overlapping 10% windows, and a time-series universal adversarial perturbation bounded by the same $$\min_{\theta} \; \mathbb{E}_{(x_i,y_i)\in D} \, \ell(f_\theta(x_i), y_i). \tag{1}$$3 constraint. The proposed method is evaluated at 20%, 50%, and 100% temporal coverage. On BirdChicken, clean training yields 96.0% accuracy, masking yields 80.9%, UAP yields 39.1%, Ours$$\min_{\theta} \; \mathbb{E}_{(x_i,y_i)\in D} \, \ell(f_\theta(x_i), y_i). \tag{1}$$4 yields 19.3%, Ours$$\min_{\theta} \; \mathbb{E}_{(x_i,y_i)\in D} \, \ell(f_\theta(x_i), y_i). \tag{1}$$5 yields 12.1%, and Ours$$\min_{\theta} \; \mathbb{E}_{(x_i,y_i)\in D} \, \ell(f_\theta(x_i), y_i). \tag{1}$$6 yields 8.8%. Averaged over datasets, masking causes about 14.18% absolute accuracy drop, UAP about 56.84%, Ours$$\min_{\theta} \; \mathbb{E}_{(x_i,y_i)\in D} \, \ell(f_\theta(x_i), y_i). \tag{1}$$7 about 72.18%, and at 50% coverage the average accuracy drops to about 7.66%, a 76.68% reduction from the clean case. The paper reports that 100% coverage yields only marginal additional reduction, indicating diminishing returns, and that the method is particularly effective on multivariate datasets such as ArabicDigits, NetFlow, and UWave (Jiang et al., 2024).

For time-series sequence generation, the evaluation uses 8 multivariate datasets and trains Recurrent GAN (RGAN) and Quant GAN (QGAN) on the first class of each dataset. In the protected setting, 50% of the class-0 real samples are perturbed by UEs and each selected sample is fully perturbed. Evaluation follows the TSTR protocol: a classifier is trained on synthetic data and tested on clean real data. On ArabicDigits, D7, the FCN results are Real 99.6%, RGAN$$\min_{\theta} \; \mathbb{E}_{(x_i,y_i)\in D} \, \ell(f_\theta(x_i), y_i). \tag{1}$$8 75.2%, RGAN$$\min_{\theta} \; \mathbb{E}_{(x_i,y_i)\in D} \, \ell(f_\theta(x_i), y_i). \tag{1}$$9 6.2%, QGAN$x_i$0 78.6%, and QGAN$x_i$1 8.4%; for LSTM they are Real 98.4%, RGAN$x_i$2 83.4%, RGAN$x_i$3 4.2%, QGAN$x_i$4 81.4%, and QGAN$x_i$5 2.6%. Across all 8 datasets, GANs trained on UE-protected time series produce synthetic data that are essentially useless for training accurate classifiers, often dropping test accuracy below 10%, even though only 50% of class-0 training samples were protected (Jiang et al., 2024).

For visual tracking, the generator is trained on GOT-10k and used to poison GOT-10k, LaSOT, DAVIS-17, YTVOS-19, and related datasets. Trackers trained on TUE-poisoned data are evaluated on clean test sets using standard VOT and VOS metrics. Representative results include the following. SiamFC trained on GOT-10k and tested on OTB-100 drops from Clean AUC 58.6 and Prec. 79.2 to TUE AUC 11.4 and Prec. 13.5. OSTrack-256 on GOT-10k drops from Clean AO 71.0, SR$x_i$6 80.4, SR$x_i$7 68.2 to TUE AO 18.0, SR$x_i$8 15.1, SR$x_i$9 4.6. SeqTrack-256 on GOT-10k drops from Clean AO 74.7 to TUE AO 2.1. The paper states that TUEs consistently outperform TAP, LSP, AR, and EM across trackers and datasets (Wu et al., 10 Jul 2025).

The ablation studies clarify which components matter. Adding temporal contrastive loss reduces SiamFC GOT-10k AO from 16.1 to 12.1 and OSTrack GOT-10k AO from 41.6 to 18.0 relative to the generator-only variant. Removing target-state conditioning reduces effectiveness: SiamFC on GOT-10k changes from AO 16.1 with conditioning to 22.5 without conditioning. Training the generator on only 25% of GOT-10k is still sufficient to generate strong TUEs for unseen GOT-10k videos. Longer downstream training does not recover clean performance: SeqTrack-256 trained on TUE-GOT10k yields AO 9.7 after 100 epochs, 2.1 after 200 epochs, and remains between 2 and 3.8 through 300–500 epochs (Wu et al., 10 Jul 2025).

5. Transferability, threat models, and data utility

The time-series threat model assumes that defenders know the architecture class of the learner, such as RNNs for time series, but not the exact training procedure, hyperparameters, or model weights. The noise is trained using a surrogate RNN. The reported degradation across RNN classifiers, LSTM, FCN, RGAN, and QGAN is taken as evidence of good transferability across deep sequence models that exploit similar temporal features. In the video setting, the method is trained white-box on a SiamFC surrogate and GOT-10k, then applied black-box to downstream trackers and segmentors, with model transfer across SiamFC, OSTrack-256, DropTrack-384, SeqTrack-256, MixFormer-CvT, STARK-S50, AQATrack-256, and HIPTrack; dataset transfer from GOT-10k to LaSOT and to DAVIS-17 and YTVOS-19; and task transfer from VOT to VOS and, in supplementary experiments, long-term point tracking (Jiang et al., 2024, Wu et al., 10 Jul 2025).

The defender assumptions also differ by modality. In time series, the data owner chooses temporal regions to protect through a control mask $x_i' = x_i + \delta_i$0. In tracking, the user is assumed to have access to approximate target bounding boxes, obtained through manual annotation, existing tracker outputs, or unsupervised proposal methods such as EdgeBox. The attacker is assumed to train standard tracking or sequence models on collected internet data without special knowledge of the perturbation process (Wu et al., 10 Jul 2025).

Utility preservation is a central design constraint. In time series, utility is addressed through the strict magnitude bound $x_i' = x_i + \delta_i$1 max amplitude per sample and through partial temporal coverage, often 20% or 50% rather than the full sequence. The paper does not report human studies, but it emphasizes that the perturbations are imperceptible to humans and that utility for manual inspection, human decision support, or basic statistical analysis is preserved. In video, perturbations are spatially localized to target regions, target-state-aware, and visually subtle; the paper states that they do not noticeably degrade visual enjoyment of videos (Jiang et al., 2024, Wu et al., 10 Jul 2025).

A common misunderstanding is that temporal unlearnability implies complete data destruction. The published results support a narrower claim. TUEs are designed to impair deep learning systems that rely on specific temporal representations or temporal matching mechanisms, not to erase all possible human or statistical use. The time-series paper explicitly notes that simpler or hand-crafted analyses may still work, especially on unprotected segments, while the tracking paper frames TUEs as a privacy-preserving tool for data owners rather than a universal denial-of-use mechanism (Jiang et al., 2024, Wu et al., 10 Jul 2025).

6. Theory, certification, and open issues

The most explicit theoretical account of unlearnability is a mutual-information perspective. Let $x_i' = x_i + \delta_i$2, with feature extractor $x_i' = x_i + \delta_i$3, clean features $x_i' = x_i + \delta_i$4, and poisoned features $x_i' = x_i + \delta_i$5. The central claim is that effective unlearnable examples decrease the mutual information $x_i' = x_i + \delta_i$6, and that deeper networks tend to produce lower mutual information together with stronger unlearnability. Empirically, the paper measures mutual information by sliced mutual information together with one-dimensional estimators such as histogram, KDE, k-NN, and MINE. On CIFAR-10 with ResNet-18, Clean data have Test Acc $x_i' = x_i + \delta_i$7 and MI $x_i' = x_i + \delta_i$8, while MI-UE has Test Acc 9.95% and MI 0.4969; the reported Spearman correlation between accuracy drop and MI drop is approximately 0.78. The paper further proves an upper bound on $x_i' = x_i + \delta_i$9 involving the conditional covariance $$\delta_i = \{\delta_0, \delta_1, \ldots, \delta_t\}$$0 of intra-class poisoned features, motivating covariance reduction as a tractable surrogate and yielding the MI-UE objective that maximizes intra-class cosine similarity and minimizes inter-class similarity (Zhu et al., 4 Mar 2026).

For temporal data, this provides a theoretical design principle rather than a completed temporal method. The paper explicitly proposes that effective TUEs should reduce mutual information between clean and poisoned temporal features, either at the sequence level,

$$\delta_i = \{\delta_0, \delta_1, \ldots, \delta_t\}$$1

or, in richer formulations, over temporal feature trajectories. It likewise proposes that compressing intra-class covariance in temporal feature space should reduce this mutual information. This suggests a unifying interpretation of both time-series TUEs and video TUEs: each method induces temporal shortcut learning by making the poisoned temporal representation diverge from the clean one while preserving labels and superficial plausibility (Zhu et al., 4 Mar 2026).

A second theoretical line replaces empirical test accuracy with certification. The framework of Provably Unlearnable Examples defines True Learnability as

$$\delta_i = \{\delta_0, \delta_1, \ldots, \delta_t\}$$2

and then certifies a probabilistic upper bound on learnability through parametric smoothing in weight space. With

$$\delta_i = \{\delta_0, \delta_1, \ldots, \delta_t\}$$3

the certified $$\delta_i = \{\delta_0, \delta_1, \ldots, \delta_t\}$$4-Learnability is defined as

$$\delta_i = \{\delta_0, \delta_1, \ldots, \delta_t\}$$5

where

$$\delta_i = \{\delta_0, \delta_1, \ldots, \delta_t\}$$6

The paper emphasizes that these definitions are modality-agnostic and can be carried over to sequential data by interpreting $$\delta_i = \{\delta_0, \delta_1, \ldots, \delta_t\}$$7 as $$\delta_i = \{\delta_0, \delta_1, \ldots, \delta_t\}$$8 and $$\delta_i = \{\delta_0, \delta_1, \ldots, \delta_t\}$$9 as an RNN, Transformer, or temporal CNN. This suggests a route to certified temporal $$\ell(f_\theta(x_i + \delta_i), y_i) \rightarrow 0. \tag{2}$$0-Learnability, although the paper does not provide a dedicated temporal implementation (Wang et al., 2024).

The limitations and countermeasures are correspondingly diverse. The time-series work notes possible countermeasures such as UEraser and methods that attempt to relearn unlearnable samples; it also notes that the method is optimized against RNNs, so other sequence architectures such as Transformers may behave differently. The video paper identifies bounding-box dependence, standard-pipeline assumptions, and the possibility of filtering, sanitization, or robust retraining by an informed attacker. The certification paper shows that some empirical UEs are vulnerable to recovery by slightly perturbing the learned weights, and proposes PUEs to reduce this vulnerability. The MI-based paper states that MI-UE is not perfect under strong defenses such as ISS, AVA, and D-VAE. Taken together, these results indicate that temporal unlearnability is not a settled property of a dataset in isolation; it is a contingent interaction among perturbation design, model class, training dynamics, and defense strategy (Jiang et al., 2024, Wu et al., 10 Jul 2025, Wang et al., 2024, Zhu et al., 4 Mar 2026).