Unlearnable Distance (UD) Overview

• Unlearnable Distance (UD) is a metric that compares learnable directions in clean versus poisoned datasets using Sharpness-Aware Learnability (SAL).
• It employs a two-stage computation—clean-model calibration and SAL thresholding—to diagnose how data poisoning alters optimization dynamics.
• Empirical benchmarks show that UD is sensitive to architecture and hyperparameters, offering deeper insights than traditional test accuracy alone.

Searching arXiv for the cited papers and related UD/ULD context. Unlearnable Distance (UD) is a model-centric quantitative metric for assessing how strongly a perturbed or poisoned training set suppresses learnability relative to its clean counterpart. In "How Far Are We from True Unlearnability?" UD is introduced as a unified measure intended to judge how “unlearnable” a given poisoned dataset really is independently of downstream-task accuracy, by comparing the Sharpness-Aware Learnability (SAL) distributions induced by clean and poisoned training (Ye et al., 9 Sep 2025). Its introduction is motivated by the observation that existing unlearnable examples may fail to exhibit cross-task unlearnability: on the multi-task dataset Taskonomy, unlearnable examples still perform well in tasks such as semantic segmentation, indicating that low performance on a single downstream task is not sufficient to characterize “true unlearnability” (Ye et al., 9 Sep 2025).

1. Emergence within unlearnable data research

UD arises within the broader literature on unlearnable data (ULD), a line of work that perturbs training data so that unauthorized models cannot learn meaningful patterns from it. The survey "A Survey on Unlearnable Data" describes ULD as a defense technique that degrades model performance by introducing perturbations into the training data, and places evaluation, theoretical foundations, and practical applications at the center of the field’s development (Li et al., 30 Mar 2025).

Within that landscape, UD is presented as a recent formalization. The survey states that the notion of an Unlearnability Distance has only very recently been formalized and points to "How Far Are We From True Unlearnability?"—referred to there as “SALUD”—as the first place where UD is defined and studied in depth (Li et al., 30 Mar 2025). In the primary formulation, the problem is not merely whether poisoned data lowers test accuracy, but whether it disables learning across tasks by altering the optimization geometry encountered during training (Ye et al., 9 Sep 2025).

The central motivation is therefore diagnostic as much as evaluative. Existing unlearnable-example methods had typically been assessed through task-specific performance drops. UD is introduced because such assessments can miss residual learning capacity, especially when models retain usable representations for tasks other than the one used for evaluation (Ye et al., 9 Sep 2025).

2. SAL as the basis of UD

The immediate formal substrate for UD is Sharpness-Aware Learnability (SAL), which measures how much the training loss of an individual layer can change under a bounded perturbation of that layer’s parameters while all other layers are frozen. At training epoch $t$, for the $l$-th layer of a model $\theta$ on a training set $\mathcal{D}_{tr}$, SAL is defined as

$$\mathrm{SAL}(\theta_l,\epsilon,t)=\max_{\|v\|_p\le \epsilon}\left|\mathcal{L}(\theta_l+v;\mathcal{D}_{tr})-\mathcal{L}(\theta_l;\mathcal{D}_{tr})\right|.$$

Here $\theta_l$ denotes the parameters of layer $l$, $v$ is a perturbation vector constrained by an $\ell_p$ norm bound $\epsilon>0$, and $l$0 is the training loss (Ye et al., 9 Sep 2025).

The interpretation given in the paper is geometric. A high SAL corresponds to a “sharp” direction in which small parameter perturbations can appreciably alter the loss, and thus indicates a direction along which learning remains active. A low SAL corresponds to a “flat” direction in which the loss is relatively insensitive, implying that optimization is effectively stuck (Ye et al., 9 Sep 2025). Empirically, training on unlearnable examples is reported to drive many layer-wise SAL values downward into such a flat regime, whereas clean training preserves a substantial fraction of high-SAL directions (Ye et al., 9 Sep 2025).

This loss-landscape view is tied to the paper’s optimization analysis. The authors report that only a part of the critical parameter optimization paths shows significant differences between clean and poisoned training, and infer a close relationship between the loss landscape and unlearnability. UD is then constructed to summarize how extensively poisoning collapses those learnable, sharp directions (Ye et al., 9 Sep 2025).

3. Formal definition and computational pipeline

The construction of UD proceeds in two stages: a clean-model calibration stage that determines a learnability threshold, and a clean-versus-poisoned comparison stage that measures the relative number of learnable directions.

From the cleanly trained model $l$1, SAL values are collected across layers $l$2 and epochs $l$3. The clean SAL distribution is then partitioned by two-means clustering, using K-means with $l$4. The resulting two cluster centers at epoch $l$5, denoted $l$6 and $l$7, are averaged to define the Learnable Threshold $l$8, with the averaging taken over epochs (Ye et al., 9 Sep 2025). Any layer-direction whose SAL exceeds $l$9 is deemed “learnable” at that epoch.

For the poisoned model $\theta$0, trained on the perturbed dataset $\theta$1, the same per-layer SAL computation is performed over epochs $\theta$2. If $\theta$3 denotes the number of layer-directions whose SAL is at least $\theta$4, then UD is defined as the ratio between the time-averaged number of learnable directions in the poisoned run and the corresponding time-averaged number in the clean run (Ye et al., 9 Sep 2025).

The interpretation is explicit. If $\theta$5, almost no directions remain learnable under poisoning, which corresponds to ideal unlearnability. If $\theta$6, the poisoned dataset behaves much like clean data. If $\theta$7, poisoning has increased certain sharp directions, a behavior associated in the paper with adversarial attacks rather than unlearnability (Ye et al., 9 Sep 2025).

In practice, the paper describes the following computation procedure. Clean and poisoned training use the same network architecture and the same random initialization $\theta$8. During each epoch, each layer is examined in turn, the remaining layers are frozen, and the inner maximization over $\theta$9 is solved by $\mathcal{D}_{tr}$0-step gradient ascent; in the reported implementation, optimizing $\mathcal{D}_{tr}$1 can be done by projected gradient ascent onto the $\mathcal{D}_{tr}$2 ball. The recommended hyperparameters are typically $\mathcal{D}_{tr}$3, $\mathcal{D}_{tr}$4, and $\mathcal{D}_{tr}$5, which are described as balancing fidelity and computational cost (Ye et al., 9 Sep 2025).

4. Interpretation, significance, and relation to other evaluation criteria

UD is proposed as an alternative to classical unlearnability evaluation by downstream accuracy alone. The paper argues that test-accuracy comparisons are limited because they depend on the specific downstream task, fail to explain why poisoning works or fails, and can be confounded by mechanisms such as adversarial training or shortcuts that merely flip labels (Ye et al., 9 Sep 2025). By contrast, UD is anchored in training dynamics: if poisoning is meant to freeze parameter updates in critical directions, then a small UD directly measures the reduction in those learnable directions (Ye et al., 9 Sep 2025).

The survey situates UD more broadly among evaluation metrics for ULD. It contrasts UD with Accuracy Drop ($\mathcal{D}_{tr}$6), which measures functional degradation on a held-out test set, whereas UD measures a parameter-space or optimization-space shift; with Imperceptibility metrics such as $\mathcal{D}_{tr}$7, SSIM, and LPIPS, which constrain input-space perturbation size rather than model-space effects; with Robustness, which asks whether UD remains high after adversarially robust retraining; and with Transferability, which concerns whether high UD persists across architectures (Li et al., 30 Mar 2025).

The same survey also reports a broader family of UD formalisms in which the unlearnability distance between a clean dataset $\mathcal{D}_{tr}$8 and its perturbed version $\mathcal{D}_{tr}$9 can be expressed as a distance or divergence between parameter solutions or parameter distributions induced by training on the two datasets, including $$\mathrm{SAL}(\theta_l,\epsilon,t)=\max_{\|v\|_p\le \epsilon}\left|\mathcal{L}(\theta_l+v;\mathcal{D}_{tr})-\mathcal{L}(\theta_l;\mathcal{D}_{tr})\right|.$$0, $$\mathrm{SAL}(\theta_l,\epsilon,t)=\max_{\|v\|_p\le \epsilon}\left|\mathcal{L}(\theta_l+v;\mathcal{D}_{tr})-\mathcal{L}(\theta_l;\mathcal{D}_{tr})\right|.$$1, and $$\mathrm{SAL}(\theta_l,\epsilon,t)=\max_{\|v\|_p\le \epsilon}\left|\mathcal{L}(\theta_l+v;\mathcal{D}_{tr})-\mathcal{L}(\theta_l;\mathcal{D}_{tr})\right|.$$2 (Li et al., 30 Mar 2025). By contrast, the detailed formulation in "How Far Are We from True Unlearnability?" defines UD through SAL thresholding and the relative number of learnable directions (Ye et al., 9 Sep 2025). This suggests that the term “Unlearnability Distance” is still stabilizing across the ULD literature.

5. Benchmarks and empirical behavior

The benchmark study in "How Far Are We from True Unlearnability?" evaluates UD on CIFAR-10, CIFAR-100, and ImageNet-100 using ResNet-18 and several unlearnable-example methods, including EM, REM, DC, TAP, LSP, and OPS (Ye et al., 9 Sep 2025). An excerpted result table reported in the paper is as follows.

Unlearnable Method	Test Acc (%)	Avg # Learnable Params / UD
Vanilla (clean)	94.1	3.32 / —
EM	26.5	0.62 / 0.187
OPS	12.0	0.52 / 0.157
TAP	29.9	5.44 / 1.639

These figures are used to distinguish qualitatively different behaviors. EM and OPS exhibit low UD values, approximately $$\mathrm{SAL}(\theta_l,\epsilon,t)=\max_{\|v\|_p\le \epsilon}\left|\mathcal{L}(\theta_l+v;\mathcal{D}_{tr})-\mathcal{L}(\theta_l;\mathcal{D}_{tr})\right|.$$3 to $$\mathrm{SAL}(\theta_l,\epsilon,t)=\max_{\|v\|_p\le \epsilon}\left|\mathcal{L}(\theta_l+v;\mathcal{D}_{tr})-\mathcal{L}(\theta_l;\mathcal{D}_{tr})\right|.$$4, and are therefore described as having strong unlearnability. TAP, identified as an adversarial-example attack, produces $$\mathrm{SAL}(\theta_l,\epsilon,t)=\max_{\|v\|_p\le \epsilon}\left|\mathcal{L}(\theta_l+v;\mathcal{D}_{tr})-\mathcal{L}(\theta_l;\mathcal{D}_{tr})\right|.$$5 because it increases sharp directions rather than collapsing them (Ye et al., 9 Sep 2025).

The same study reports that standard defenses, including JPEG compression, adversarial training, UEraser, MixUp, and CutOut, can restore learnability by raising UD back toward $$\mathrm{SAL}(\theta_l,\epsilon,t)=\max_{\|v\|_p\le \epsilon}\left|\mathcal{L}(\theta_l+v;\mathcal{D}_{tr})-\mathcal{L}(\theta_l;\mathcal{D}_{tr})\right|.$$6. It also reports that stronger architectures such as ResNet-50, SENet-18, and ViT exhibit higher UD under the same poisoning, showing that unlearnability is model-dependent rather than a fixed property of the data alone (Ye et al., 9 Sep 2025).

The survey adds a complementary synthesis in which UD values are discussed under a parameter-space framing. It reports that, on ResNet-18 trained for 100 epochs on CIFAR-10, typical Euclidean-norm UD values fall in the range $$\mathrm{SAL}(\theta_l,\epsilon,t)=\max_{\|v\|_p\le \epsilon}\left|\mathcal{L}(\theta_l+v;\mathcal{D}_{tr})-\mathcal{L}(\theta_l;\mathcal{D}_{tr})\right|.$$7 to $$\mathrm{SAL}(\theta_l,\epsilon,t)=\max_{\|v\|_p\le \epsilon}\left|\mathcal{L}(\theta_l+v;\mathcal{D}_{tr})-\mathcal{L}(\theta_l;\mathcal{D}_{tr})\right|.$$8 for $$\mathrm{SAL}(\theta_l,\epsilon,t)=\max_{\|v\|_p\le \epsilon}\left|\mathcal{L}(\theta_l+v;\mathcal{D}_{tr})-\mathcal{L}(\theta_l;\mathcal{D}_{tr})\right|.$$9, that UD grows roughly linearly at first and then plateaus as $\theta_l$0 increases, and that high UD generally correlates with large test-accuracy drop, although the exact mapping depends on architecture and training schedule (Li et al., 30 Mar 2025). Because this account is explicitly described as an overview and reconstruction rather than the survey’s own derivation, it is best read as a secondary interpretation of how UD is being operationalized in the emerging literature (Li et al., 30 Mar 2025).

6. Limitations, ambiguities, and open questions

The primary paper identifies several practical limitations. Computational cost is substantial because SAL must be computed at multiple layers and epochs, with an inner maximization for each layer. The authors note that one may restrict computation to a subset of layers or fewer epochs, and that in practice the two-means step is negligible relative to SAL computation (Ye et al., 9 Sep 2025).

A second limitation is model dependence. UD is stated not to be purely a data metric: it depends on network depth, width, architecture, optimizer, and learning-rate schedule, and should therefore be reported together with those settings (Ye et al., 9 Sep 2025). This point is reinforced empirically by the higher UD observed on stronger architectures under the same poisoning (Ye et al., 9 Sep 2025).

A third issue is threshold sensitivity. The choice of two-means clustering to define $\theta_l$1 is described as heuristic. If the SAL distribution is unimodal or the gap between the two clusters is small, the threshold may be unstable; smoothing $\theta_l$2 over runs or testing percentile-based alternatives is suggested as a possible mitigation (Ye et al., 9 Sep 2025). Relatedly, norm and radius selection matter: the reported choice $\theta_l$3 is empirically motivated, and much larger $\theta_l$4 values can inflate SAL across the board while tiny $\theta_l$5 values can reduce discrimination (Ye et al., 9 Sep 2025).

Finally, the paper notes that extensions to multi-task or continual-learning settings may require per-task SAL thresholds or layer-grouping strategies (Ye et al., 9 Sep 2025). This observation is consistent with the motivating failure of cross-task unlearnability on Taskonomy and indicates that a single-task UD calibration may not be sufficient when one wishes to characterize “true unlearnability” across heterogeneous objectives (Ye et al., 9 Sep 2025). The survey’s broader discussion of ULD likewise emphasizes unresolved trade-offs involving unlearnability, imperceptibility, efficiency, robustness, and the computational complexity of ULD generation (Li et al., 30 Mar 2025).

7. Position in the field

UD occupies a specific role among ULD evaluation tools: it shifts attention from output degradation to optimization structure. In its SAL-based form, it quantifies how severely poisoning collapses the network’s capacity to learn by counting the sharp, learnable directions that survive training on perturbed data (Ye et al., 9 Sep 2025). In the broader survey discourse, it also functions as a parameter-space or distributional notion of distance between models trained on clean and perturbed datasets (Li et al., 30 Mar 2025).

Taken together, these accounts place UD at the intersection of loss-landscape analysis, training-dynamics diagnostics, and privacy-oriented data protection. Its importance lies less in replacing traditional metrics than in complementing them with a measure intended to capture whether learning itself has been structurally disabled, rather than merely redirected or made task-specifically brittle (Ye et al., 9 Sep 2025).