Toward Robust Non-Transferable Learning: A Survey and Benchmark

1 Introduction

Throughout much of deep learning (DL) history, researchers have primarily focused on improving generalization abilities [Liu et al., 2021a; Zhuang et al., 2020]. With advancements in novel techniques, the availability of high-quality data, and the expansion of model sizes and computational resources, DL models have demonstrated increasingly strong generalization, extending from in-distribution to out-of-distribution (OOD) scenarios [Wang et al., 2022a; Radford et al., 2021; Kaplan et al., 2020]. This facilitates the application of DL in complex real-world scenarios. However, limited attention has been given to regulating models' generalization abilities, while strong-enough yet unconstrained generalization abilities may pose misuse risks. Specifically, the generalization of deep models to unintended data (e.g., unauthorized or harmful data) can be exploited by malicious adversaries in unexpected ways. This raises concerns regarding the regulating of powerful DL models, including issues related to model ethic [Li et al., 2023], safety alignment [Ouyang et al., 2022; Huang et al., 2024], model privacy and intellectual property [Sun et al., 2023; Jiang et al., 2024], among others.

Non-transferable learning (NTL) [Wang et al., 2022b], a task aimed at reshaping the generalization abilities of DL models, was proposed to address these challenges. Its goal is to prevent the model's generalization to specific target domains or tasks (such as harmful or unauthorized domains) while preserving its normal functionality on a source domain. Although numerous NTL methods have been proposed recently (e.g., Wang et al. [2023b], Hong et al. [2024b]), a comprehensive summary of existing progress in this field and an thorough analysis of current limitations is still lacking.

In this paper, we bridge this gap by presenting the first comprehensive survey of NTL. We first introduce the task settings, general framework and criteria of NTL (Section 2), followed by a summary of existing NTL approaches according to their strategies to implement non-transferability in two settings (Section 3). Then, we highlight the often-overlooked robustness against diverse attacks that can destroy the nontransferable mechanism established by NTL (Section 4).

In addition, we propose the first benchmark (NTLBench) to integrate 5 state-of-the-art (SOTA) and open-source NTL methods and 3 types of post-training attacks (15 attack methods) in a unified framework, as illustrated in Figure 1. Our NTLBench supports running NTL and attacks on 9 datasets (more than 116 domain pairs), 5 network architecture families, providing overall at least 40,000 experimental configurations for comprehensive evaluation. Main results obtained from NTLBench verify the unsatisfactory robustness of existing NTL methods in dealing with various post-training attacks (Section 5). Finally, we discuss applications, related work and future directions and challenges (Sections 6 to 8).

We believe that our survey and NTLBench can drive the development of robust NTL methods and facilitate their applications in trustworthy model deployment scenarios. Our major contributions are summarized as three folds: (i) Comprehensive review: We conduct a systematic review of existing NTL works, including settings, framework, criteria, approaches, and applications. We emphasize the robustness challenges of NTL from three aspects, according to the data accessibility of different attackers. (ii) Codebase: We propose NTLBench to benchmark 5 SOTA and open-source NTL methods, covering standard assessments (5 networks and 9 datasets) and examining robustness against 15 attacks from3 attack settings. (iii) Evaluation and analysis: We use NTLBench to fairly evaluate 5 SOTA NTL methods, covering the performance and robustness against diversity attacks. Our results identify the limitation of existing NTL methods in dealing with complex datasets and diverse attacks.

2 Preliminary

2.1 Problem Setup

In NTL, we generally consider a source domain and a target domain, where we want to keep the performance on the source domain (similar to supervised learning (SL) performance) and degrade performance on the target domain, thus implementing the resistance of generalization from the source domain to the target domain.

According to whether the target domain is known in the training stage, NTL could be divided into two settings [Wang et al., 2022b]: (i) target-specified NTL, which assumes the target domain is known and aims to restrict the model generalization toward the pre-known target domain, and (ii) sourceonly NTL, which assumes the target domain is unknown and aims to restrict the generalization toward all other domains except the source domain. The comparison between SL and the two NTLs is shown in Figure 2.

2.2 General Framework of NTL

We use a classification task for illustration, as most existing NTL methods aim at image classification tasks. Let Ds = {(xi, yi)}Ns i=1 and Dt = {(xi, yi)}Nt i=1 represent the source domain and the target domain, respectively. Note that we here assume Ds and Dt share the same label space, as considered in [Wang et al., 2022b]. Considering a neural network fθ with parameters θ, NTL aims to train the fθ to maximize the risk on the target domain Dt and simultaneously minimize the risk on the source domain Ds. To reach this goal, a basic NTL framework is to impose a regularization term on the SL to maximize the target domain error:

where λ is a trade-off weight, Lsrc and Ltgt represent the loss function (e.g., Kullback-Leibler divergence) for the source and target domain, respectively. The learning objective contains two tasks: a source domain learning task Tsrc to maintain the source domain performance, and a non-transferable task Ttgt to degrade the target domain performance.

Existing works generally can be seen as variants to Equation (1), where they may focus on different fields (modal, task), data assumptions (label space, target supervision, source data dependent), and use different approaches to conduct Ttgt. The statistics of these aspects considered in existing works are shown in Table 1. More details for each NTL approach are illustrated in Section 3.

2.3 NTL Criteria

Non-transferability performance. After training, an NTL model usually be evaluated in two aspects:

Table 1: Summary of NTL methods according to Field (modal, task), Data (label space, target supervision, source data dependent), NonTransferable Approach (feature or output space), and Robustness (whether source and target domain robustness have been evaluated).

• Source domain maintenance: Whether the NTL model is able to achieve normal performance (i.e., the same level as the SL model) on the source domain.
• Target domain degradation: The extent to which the NTL model can reduce performance on the target domain.

We review how existing methods achieve both the source domain maintenance and the target domain degradation in Section 3. Specifically, we focus on the setting that the target domain is known (i.e., target-specified NTL) in Section 3.1 and unknown (i.e., source-only NTL) in Section 3.2.

Post-training robustness. NTL models are expected to keep the non-transferability after malicious attacks, while not all existing works consider or evaluate the comprehensive robustness of their proposed method. We summarize the robustness considered in existing works into the following two parts, based on which domain is accessible to attackers. The statistics on which aspects have been evaluated for each NTL method are shown in Table 1 (Robustness column).

• Robustness against source domain attack: It has been verified that fine-tuning the NTL model with a small amount of source domain data is a potential risk to break nontransferability [Hong et al., 2024a]. Thus, the robustness against source domain attacks measures how well an NTL model can resist fine-tuning attacks on the source domain.
• Robustness against target domain attack: If malicious attackers have access to a small amount of labeled target domain data, they can fine-tune the NTL model to re-activate target domain performance [Deng et al., 2024]. The robustness against target domain attack evaluates how well an NTL model can defend against attack from the target domain, such as fine-tuning using target domain data.

We review robustness in existing NTL methods in Section 4.

3 Approaches for NTL

Target-specified NTL approaches contain fundamental solutions for NTL, and thus, we first review them in Section 3.1. Then, in Section 3.2, we review how existing works implement source-only NTL in the absence of a target domain.

3.1 Target-Specified NTL

Briefly, in target-specified setting, the target domain is known and we aim to restrict the generalization of a deep learning model from the source domain toward the certain target domain. Existing methods perform target-domain regularization either on the feature space or the output space, as we summarized in Table 1 (Non-Transferable Approach column). For more details, we introduce existing strategies as follows:

Output space regularization. Output-space regularizations directly manipulate the model logits on the target domain. More specifically, these operations can be categorized into untargeted regularization and targeted regularization. Untargeted regularization [Wang et al., 2022b; Wang et al., 2023b; Zhou et al., 2024; Peng et al., 2024] could usually be formalized as a maximizing optimization problem, where existing methods implement this regularization by maximizing the KL divergence between the model outputs and the real labels, thus disturbing the model predictions on the target domain. However, such untargeted regularization may face convergence issues [Deng et al., 2024]. Targeted regularization [Wang et al., 2023a; Deng et al., 2024] found a proxy task on the target domain (i.e., modify the labels), thus converting the maximization objective in untargeted regularization to a minimization optimization problem. DSO [Wang et al., 2023a] transforms the correct labels to error labels without overlap (e.g., yerr = y + 1) and uses error labels as the target-domain supervision. H-NTL [Hong et al., 2024b] first disentangle the content and style factors via a variation inference framework [Blei et al., 2017], and then, they learn the NTL model by fitting the contents of the source domain and the style of the target domain. Due to the assumption that the style is approximately to be independent to the content representations, the non-transferability could be implemented. SOPHON [Deng et al., 2024] aims at both image classification and generation tasks. For classification, they propose to modify the cross-entropy (CE) loss to its inverse version (i.e., modify the label y to 1-y) or calculate the KL divergence between the model outputs and a uniform distribution. For generation, SOPHON proposes to use a Denial of Service (DoS) loss, i.e., let the diffusion model fit a zero matrix at each step. Compared to untargeted regularizations, targeted regularizations always have better convergence.

Feature space regularization. Feature-space regularizations reduce the similarity between feature representations from different domains, thus restricting the transferability on the feature space. Feature-space regularizations can also be categorized into untargeted and targeted strategies, depending on whether they directly enlarge the distribution gap through a maximization objective or convert it to a minimization problem by finding a proxy target. For untargeted regularization, existing methods [Wang et al., 2022b; Zeng and Lu, 2022] propose to maximize the maximum mean discrepancy (MMD) loss between the feature representations from different domains, where MMD measures the distribution discrepancy. For targeted regularization, UNTL [Zeng and Lu, 2022] proposes to build an auxiliary domain classifier with feature representations from different domains as inputs. By minimizing the domain-classification loss, the domain classifier could help the NTL model learn domaindistinct representations. NTP [Ding et al., 2024] aims to minimize the Fisher Discriminant Analysis (FDA) term [Shao et al., 2022] in the target domain. Specifically, a smaller FDA value indicates a reduced difference in class means and increased feature variance within each class, which is associated with poorer target domain performance.

3.2 Source-Only NTL

Under the assumption that only source domain data is available, existing works take various data augmentation methods to obtain auxiliary domains from the source domain and see them as the target domain. Thus, the source-only NTL problem can be solved by target-specified NTL approaches. These augmentation methods can be split into the following three categories:

Adversarial domain generation. Wang et al. [2022b] use generative adversarial network (GAN) [Mirza and Osindero, 2014; Chen et al., 2016] to synthesize fake images from the source domain and see them as the target domain. They train the GAN by controlling the distance and direction of the synthetic distributions to the real source domain, thus enhancing the diversity of synthetic samples and improving the degradation of any distribution with shifts to the real source domain. CUTI-domain [Wang et al., 2023b] and CUPI-domain [Wang et al., 2024] add Gaussian noise to the GAN-based adaptive instance normalization (AdaIN) [Huang and Belongie, 2017] to obtain synthetic samples with random styles. They use both the synthetic samples from AdaIN and Wang et al. [2022b] as the target domain. MAP [Peng et al., 2024] also follows the GAN framework. They additionally add a mutual information (MI) minimization term to enhance the variation between synthetic samples and the real source domain samples, ensuring more distinct style features.

Strong image augmentation. H-NTL [Hong et al., 2024b] conducts strong image augmentation [Cubuk et al., 2020] on real source domain data. Strong image augmentations (e.g., blurring, sharpness, solarize) do not influence the contents but significantly change the image styles, thus imposing interventions [Von K¨ugelgen et al., 2021] on the style factors in images. Then, all augmented images are treated as the target domain for training source-only NTL.

Perturbation-based method. DSO [Wang et al., 2023a] proposes to minimize the worst-case risk on the uncertainty set [Sagawa et al., 2019] over the source domain distribution, where the risk is empirically calculated through a classification loss between the model predictions and the error label.

4 Post-Training Robustness of NTL

NTL models are expected to keep the non-transferability after malicious attacks. However, not all existing works evaluate the robustness of their method, as we listed in Table 1 (the last column). In this section, we review the robustness of the source and target domains as considered in previous works.

Robustness against source domain attack. Earlier evaluations in [Wang et al., 2022b; Wang et al., 2023b] show that NTL models are still resistant to SOTA watermark removal attacks when up to 30% source domain data are available for attack. Hong et al. [2024a] further investigate the robustness of NTL and propose TransNTL, demonstrating that non-transferability can be destroyed using less than 10% of the source domain data. Specifically, they find NTL [Wang et al., 2022b] and CUTI-domain [Wang et al., 2023b] inevitably result in significant generalization impairments on slightly perturbed source domains. Accordingly, they propose TransNTL to fine-tune NTL models under an impairment repair self-distillation framework, where the sourcedomain predictions are used to teach the model itself how to predict on perturbed source domains. As a result, the fine-tuned model is just like a SL model without the nontransferability. They also propose a defense method to fix this loophole by pre-repairing the generalization impairments in perturbed source domains. Specifically, they add a defense regularization term on existing NTL and CUT-domain training. Minimizing the defense regularization term enables NTL models to exhibit source-domain consistent behaviors on perturbed source-domain data, thus resisting TransNTL attack.

Robustness against target domain attack. If malicious attackers have access to some labeled target domain data, a more direct strategy to break the non-transferability is finetuning NTL models using target domain data. However, most existing methods [Wang et al., 2022b; Wang et al., 2023b; Zeng and Lu, 2022; Wang et al., 2023a; Hong et al., 2024b;

Peng et al., 2024] ignore the robustness of their methods against target-domain fine-tuning attacks. SOPHON [Deng et al., 2024] formally proposes the problem of non-fine-tunable learning, which aims at ensuring the target-domain performance could still be poor after being fine-tuned using target domain data. Their main idea is to involve the fine-tuning process in training stage. Specifically, they leverage model agnostic meta-learning (MAML) [Finn et al., 2017] to simulate multiple-step fine-tuning for the current model on the target domain. Then, they add per-step risk of the target domain as the total target-domain risk. By maximizing the total target-domain risk, the robustness against target-domain attacks can be enhanced. ArchLock [Zhou et al., 2024] aims to find the non-transferable network architectures [Liu et al., 2018], where they implicitly consider the robustness on the target domain. Specifically, they maximize the minimum risk of an architecture on the target domain in searching the nontransferable architectures. The minimum risk is found by searching the optimal parameters of the architecture with the minimum task loss on the target domain.

However, labeled target domain data being available to malicious attackers is a strong assumption. A more realistic scenario is that attackers only has access to unlabeled target domain data. Whether NTL can resist attacks driven by unlabeled target domain data has not yet been studied.

5 Benchmarking NTL

The post-training robustness has not been well-evaluated in NTL, which motivates us to build a comprehensive benchmark. In this section, we first demonstrate the framework of our NTLBench (Section 5.1). Then, we present main results by conducting our NTLBench (Section 5.2), including pretrained performance and robustness against different attacks.

5.1 NTLBench

We propose the first NTL benchmark (NTLBench), which contains a standard and unified training and evaluation process. NTLBench supports 5 SOTA NTL methods, 9 datasets (more than 116 domain pairs), 5 network architectures families, and 15 post-training attacks from 3 attack settings, providing more than 40,000 experimental configurations.

Datasets. Our NTLBench is compatible with: Digits (5 domains) [Deng, 2012; Hull, 1994; Netzer et al., 2011; Ganin et al., 2016; Roy et al., 2018], RotatedMNIST (3 domains) [Ghifary et al., 2015], CIFAR and STL (2 domains) [Krizhevsky and others, 2009; Coates et al., 2011], VisDA (2 domains) [Peng et al., 2017], Office-Home (4 domains) [Venkateswara et al., 2017], DomainNet (6 domains) [Peng et al., 2019], VLCS (4 domains) [Fang et al., 2013], PCAS (4 domains) [Li et al., 2017], and TerraInc (5 domains) [Beery et al., 2018]. Different domains in any dataset share the same label space, but have distribution shifts, thus being suitable for evaluating NTL methods.

NTL baselines. NTLBench involves all open-source NTL methods: NTL [Wang et al., 2022b], CUTI-domain [Wang et al., 2023b], H-NTL [Hong et al., 2024b], SOPHON [Deng et al., 2024], CUPI-domain [Wang et al., 2024]. Besides, we also add a vanilla supervised learning (SL) as a reference.

Network architecture. The proposed NTLBench is compatible with multiple network architectures, including but not limited to: VGG [Simonyan and Zisserman, 2015], ResNet [He et al., 2016], WideResNet [Zagoruyko, 2016], ViT [Dosovitskiy et al., 2021], SwinT [Liu et al., 2021b].

Threat I: source domain fine-tuning (SourceFT). Attacking goal: SourceFT tries to destroy the non-transferability by fine-tuning the NTL model using a small set of source domain data. Attacking method: NTLBench involves 5 methods, including four basic fine-tuning strategies 1 : initFC-all, initFCFC, direct-FC, direct-all [Deng et al., 2024] and the special designed attack for NTL: TransNTL [Hong et al., 2024a].

Threat II: target domain fine-tuning (TargetFT). Attacking goal: TargetFT tries to directly use labeled target domain data to fine-tune the NTL model, thus recovering target domain performance. Attacking method: NTLBench use 4 basic fine-tuning strategies 1 leveraged in [Deng et al., 2024] as attack methods: initFC-all, initFC-FC, direct-FC, direct-all.

Threat III: source-free domain adaptation (SFDA). Attacking goal: We introduce SFDA to test whether using unlabeled target domain data poses a threat to NTL. Attacking method: NTLBench involves 6 SOTA SFDA methods: SHOT [Liang et al., 2020], CoWA [Lee et al., 2022], NRC [Yang et al., 2021], PLUE [Litrico et al., 2023], AdaContrast [Chen et al., 2022], and DIFO [Tang et al., 2024].

Evaluation metric. For source domain, we use source domain accuracy (SA) to evaluate the performance. Higher SA means lower influence of non-transferability to the source domain utility. For target domain, we use target domain accuracy (TA) to evaluate the performance. Lower TA means better performance of non-transferability. Besides, we calculate the overall performance (denoted as OA) of an NTL method as: OA = (SA + (100% - TA))/2, with higher OA representing better overall performance of an NTL method. These evaluation metrics are applicable for both non-transferability performance and robustness against different attacks.

5.2 Main Results and Analysis

Due to the limited space, we present main results obtained from our NTLBench. We first show the key implementation details, and then we present and analyze our results.

Implementation details. Briefly, in pre-training stage, we sequentially pair i-th and (i+1)-th domains within a dataset for training. Each domain is randomly split into 8:1:1 for training, validation, and testing. The results for each dataset are averaged across domain pairs. NTL methods and the reference SL method are pretrained by up to 50 epochs. We search suitable hyper-parameters for each method by setting 5 values around their original value and choose the best value according to the best OA on validation set. All the batch size, learning rate, and optimizer are follow their original implementations. Following the original NTL paper [Wang et al., 2022b], we use VGG-13 without batch-normalization. All input images are resize to 64×64. In attack stage, we use 10%

1 initFC: re-initialize the last full-connect (FC) layer. direct: no re-initialize. all: fine-tune the whole model. FC: fine-tune last FC.

amount of the training set to perform attack. All attack results we reported are run on CIFAR & STL. Attack training is up to 50 epochs. We run all experiments on RTX 4090 (24G).

Non-transferability performance. The non-transferability performance are shown in Table 2, where we compare 5 NTL methods and SL on 9 datasets. From the results, all NTL methods generally effectively degrade source-to-target generalization, leading to a significant drop in TA compared to SL. However, in more complex datasets such as Office-Home and DomainNet, existing NTL methods fail to achieve a satisfactory balance between maintaining SA and degrading TA, highlighting their limitations. From the Avg. column, CUTIdomain reaches the overall best performance.

Post-training robustness. For SourceFT attack (Table 3), fine-tuning each NTL model by using basic fine-tuning strategies on 10% source domain data cannot directly recover the source-to-target generalization. However, all NTL methods are fragile when facing the TransNTL attack. For TargetFT attack (Table 4), all NTL methods cannot fully resist supervised fine-tuning attack by using target domain data. In particular, fine-tuning all parameters usually results in better attack effectiveness. For SFDA (Table 5), although the target domain data are unlabeled, advanced source-free unsupervised domain adaptation, leveraging self-supervised strategies, can still partially recover target domain performance. All these results verify the fragility of existing NTL methods.

6 Applications of NTL

NTL supports different applications, depending on which data are used as source and target domain. We introduce two applications in model intellectual property (IP) protection and then the application of harmful fine-tuning defense.

Ownership verification (OV). OV is a passive IP protection manner, which aims to verify the ownership of a deep learning model [Lederer et al., 2023]. NTL solves ownership verification by triggering misclassification on data with pre-defined triggers [Wang et al., 2022b]. For example, when training, we add a shallow trigger (only known by the model owner) on the original dataset data and see them as the target domain, while the original data without the trigger is regarded as the source domain. Then, target-specified NTL is used to train a model. Therefore, the ownership can be verified via observing the performance difference of a model on the original data and the data with the pre-defined trigger. For SL model, the shallow trigger has minor influence on the model performance, and thus, the model shows similar performance on original data and data with triggers. In contrast, the NTL model specific to this pre-defined trigger has high performance on the original data but random-guess-like performance on data with the trigger. This provides evidence for verifying the model's ownership.

Applicability authorization (AA). AA is an active IP protection approach that ensures models can only be effective on authorized data [Wang et al., 2022b; Xu et al., 2024; Si et al., 2024]. NTL solves AA by degrading the model generalization outside the authorized domain. Basic solution is to add a pre-defined trigger on original data (seen as source domain), and the original data without the correct triggers is regarded as the target domain. After training by NTL, the model will only perform well on authorized data (i.e., the data with the trigger). Any unauthorized data will be randomly predicted by the NTL model. Thus, AA can be achieved.

Safety alignment and harmful fine-tuning defense. Finetuning large language models (LLMs) with user's own data for downstream tasks has recently become a popular online service [Huang et al., 2024; OpenAI, 2024]. However, this practice raises concerns about compromising the safety alignment of LLMs [Qi et al., 2023; Yang et al., 2023], as harmful data may be present in users' datasets, whether intentionally or unintentionally. To address the risks of harmful fine-tuning, various defensive solutions [Huang et al., 2025; Rosati et al., 2024] have been proposed to ensure that finetuned LLMs can effectively refuse harmful queries. Specifically, these defense methods aim to limit the transferability of LLMs from harmless queries to harmful ones, which techniques are variants of the objectives of NTL. Actually, all existing NTL approaches can be applied to this task by regarding the alignment data as the source domain and the harmful data as the target domain. Then, target-specified NTL can be conducted to defend against harmful fine-tuning attacks.

7 RelatedWorks

Machine unlearning (MU). Both MU [Xu et al., 2023] and NTL serve purposes in model capacity control, albeit with differences in their applications and methodologies. MU primarily aims to forget specific data points from training datasets [Xu et al., 2023] (the model behaviors are consistent to never training on the selected data points), while NTL aims at resist the generalization from the training domain to a specific target domain or task. Particularly, MU and NTL share some overlapping applications such as safety alignment of LLMs. However, MU more focus on eliminating harmful data influence (e.g., sensitive or illegal information) and the associated model capabilities [Barez et al., 2025; Maini et al., 2024], while NTL more focus on preventing harmful and unauthorized fine-tuning [Huang et al., 2024].

Transfer learning (TL). TL [Zhuang et al., 2020] aims at improving model performance on a different but related domain or task. It can be categorized into several subfields, such as domain adaptation (DA) [Venkateswara et al., 2017; Liang et al., 2020] and domain generalization (DG) [Wang et al., 2022a]. TL is closely related to NTL, but the overall objectives is opposite to NTL. In general, TL techniques generally can be used in a reversed way to achieve NTL. Moreover, TL can also be seen as post-training attacks against NTL.

8 Future Directions and Challenges

Improving robustness. We highlight the shortcoming of NTL on post-training robustness. Existing defense attempts (e.g., SOPHON [Deng et al., 2024]) require extensive resources, such as an extremely high number of training epochs, yet they may still fail to remain robust against unseen finetuning. This raises an open challenge: how to effectively enhance the robustness of NTL against various attacks.

Identifying more threat. There are other potential attacks that could pose risks to NTL under weaker assumptions. For example, if an attacker is unable to re-train the NTL model, can they still bypass the non-transferability constraints? In addition, attackers may have access to a large amount of data from the wild, distinct from both the source and target domains. Can they leverage these unseen domain data to break non-transferability? We believe identifying these threats can further promote the robustness of NTL.

Cross-modal non-transferability. Existing NTL works primarily focus on single modality, while the cross-modal non-transferability remains an important yet underexplored challenge. A related finding in large models suggests that the safety alignment of LLMs can be compromised through visual instruction tuning [Zong et al., 2024; Liu et al., 2024]. However, a deep investigation of robust cross-modal nontransferability mechanisms remains lacking.

9 Conclusion

In this paper, we conduct the first systematic review of NTL by summarizing existing approaches and highlighting the often overlooked robustness challenges. In addition, we introduce the first benchmark, NTLBench, which systematically evaluates five state-of-the-art NTL methods through comprehensive assessments of pretraining performance and robustness against 15 attacks across multiple datasets and network architectures. Main results from NTLBench verify the limitation of existing NTLs on robustness. We believe NTLBench can drive the development of robust NTL and facilitate their applications in practical scenarios.

Acknowledgements

• ∗ : equal contribution. †: corresponding author. TLL is partially supported by the following Australian Research Council projects: FT220100318, DP220102121, LP220100527, LP220200949, IC190100031. ZMH is supported by JD Technology Scholarship for Postgraduate Research in Artificial Intelligence No. SC4103.