Notice: The reproducibility variables underlying each score are classified using an automated LLM-based pipeline, validated against a manually labeled dataset. LLM-based classification introduces uncertainty and potential bias; scores should be interpreted as estimates. Full accuracy metrics and methodology are described in Coakley et alK. L. Coakley, T. Snelleman, H. Hoos, and O. E. Gundersen, "The embrace of open science: An analysis of a decade of AI research and 56 800 conference papers," Under Review, 2026..
BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection
Authors: Yihan Wang, Yiwei Lu, Xiao-Shan Gao, Gautam Kamath, Yaoliang Yu
NeurIPS 2025 | Venue PDF | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | We conduct comprehensive experiments on purifying existing data protection methods for both classification and generation tasks, where Bridge Pure consistently outperforms baseline methods. |
| Researcher Affiliation | Academia | Yihan Wang*, University of Waterloo EMAIL Yiwei Lu* University of Ottawa EMAIL Xiao-Shan Gao AMSS, Chinese Academy of Sciences University of Chinese Academy of Sciences EMAIL Gautam Kamath University of Waterloo Vector Institute EMAIL Yaoliang Yu University of Waterloo Vector Institute EMAIL |
| Pseudocode | No | The paper describes the methodology using mathematical equations (1-5) and prose in Section 2.3 and Section 4, detailing 'Bridge training' and 'Sampling and purification' steps. However, it does not include a distinct section or figure explicitly labeled as 'Pseudocode' or 'Algorithm' with structured, code-like steps. |
| Open Source Code | Yes | The code is available at https://github.com/EhanW/bridge-pure. |
| Open Datasets | Yes | Our classification experiments use CIFAR-10/100 [30], Image Net-Subset,3 Web Face Subset,3 Cars [29], and Pets [44] datasets. For style mimicry experiments, we use artwork from artist @nulevoy,4 with details provided in Section 5.3. |
| Dataset Splits | Yes | For CIFAR-10 and CIFAR-100 [31], the training set is divided into two parts: a set to be protected which contains 40,000 images, and a reference set comprising the remaining data. The images are 32 × 32 pixels. [...] The Image Net-100 dataset ... The test set includes 50,000 images, the set to be protected contains 25,000 images, and the reference set includes 10,000 images. [...] This dataset is split into three parts: a test set comprising 4518 images, a protection set with 25,000 images, and a reference set containing the remainder. [...] Pets [44] contains 37 categories of animals, in which the set to be protected includes 3680 images and the test set contains 3669 images. Cars [29] contains 197 categories of automobiles, in which the set to be protected includes 8144 images, and the test set contains 8041 images. |
| Hardware Specification | Yes | Training on CIFAR-10/100 and Web Face-Subset can run on a single NVIDIA L40S/RTX 6000 Ada GPU with 40 GB of memory. Training on Image Net-Subset, Cars, and Pets can run on a single NVIDIA A100 GPU with 80 GB of memory. Training on artwork can run on 4 NVIDIA A100 GPUs in parallel. |
| Software Dependencies | Yes | We first fine-tune Stable Diffusion v2.1 [51] using 20 captioned paintings following the implementation of Hönig et al. [22]. We then reproduce the style of the artist with a list of prompts during inference. Our implementation details are available in Appendix B.5. ... For fine-tuning, the images are first center-cropped to 512 × 512 and their captions are auto-generated by a BLIP2 model [32]. |
| Experiment Setup | Yes | We train Bridge Pure from scratch using each paired dataset for 100,000 steps. The batch size is 256 for CIFAR-10, CIFAR-100; 32 for Web Face-Subset; 16 for Image Net-Subset, Cars, Pets, and @nulevoy s artwork. [...] We train a Res Net-18 classifier for 120 epochs using an SGD optimizer with an initial learning rate of 0.1, a momentum of 0.9, and a weight decay of 0.0005. The learning rate decays by 0.1 at the 80th and 100th epochs. The batch size is 128. For Vi T and Cai T, we use Adam optimizer with an initial learning rate of 0.0005. |