Radioactive data: tracing through training

1. Introduction

• Radioactive data substitutes similar-looking marked images for original data to create a strong training-use signal beyond dataset bias.The method marks a class-specific direction in latent space before the classification layer and propagates it back to pixels with a pretrained network.Source: §1 · pp. 1–2
• The proposed test assesses a trained network in white-box or black-box access settings and reports a p-value for whether radioactive data was used.The stated aim is a statistical guarantee for the detection decision.Source: §1 · p. 1
• Passive dataset-bias and membership-inference measures are described as weak and lacking sufficient empirical or statistical guarantees.The authors target p-values much below 0.1% as evidence unlikely to arise by chance.Source: §1 · p. 2
• The active marking criteria require tiny image changes, little effect on task accuracy, and marks not detectable through failure-case inspection or re-annotation.Incorrect-label marks and backdoors are excluded because the authors say they can be detected or circumvented through these checks.Source: §1 · p. 2
• The authors present the work as a proof of concept; analysis of defense mechanisms is outside its scope, and latent-space analysis may detect the marks.The paper contrasts this with defenses against test-time tampering, which are not designed to prevent training-time attacks.Source: §1 · p. 2
• At q = 1%, a scratch-trained ResNet-18 yields p-value 10^-4, with accuracy change of ±0.1%.The introduction also reports almost invisible image changes (PSNR = 42 dB).Source: §1 · p. 2

2. Related work

• Traditional image watermarking can leave no exploitable training trace when learning ignores marks that do not help classification.The paper notes that deep-network latent representations are nearly invariant to geometric transformations and have been used in image watermarking approaches.Source: §2 · p. 3
• Adversarial examples are visually indistinguishable perturbations crafted to make a trained network misclassify an otherwise correctly classified image.Source: §2 · p. 3
• Membership inference predicts whether a sample was in a model’s training set, but the cited classification approaches provide no statistical significance guarantee and require multiple models.Differential privacy instead bounds the impact of training examples, with a privacy budget trading off learning statistical facts and hiding individual records.Source: §2 · p. 3
• Data poisoning studies training-data modifications affecting inference, while backdoors associate a trigger with a target class at test time.Unlike these approaches, the paper describes radioactive marking as clean-label perturbation with p-value guarantees.Source: §2 · p. 3
• Model-watermarking approaches modify network parameters for downstream verification, whereas this paper assumes control of training data but not the training process.Source: §2 · p. 3

3. Our method

• The method marks images, trains a classifier on vanilla and/or marked data, then examines the trained model to detect whether marked data was used.The classifier has a CNN feature extractor followed by a linear classifier.Source: §3 · p. 3

3.1. Statistical preliminaries

• Cosine similarity between a fixed vector and a random unit vector has expectation 0 and variance 1/d, while Fisher’s method combines independent test p-values.Under the null, the cosine similarity follows an incomplete beta distribution.Source: §3.1 · pp. 3–4

3.2. Additive marks in feature space

• A random unit carrier added to one class’s features makes its learned classifier more aligned with that carrier, which detection tests using cosine similarity and a p-value.For multiple classes, independent class-level p-values are combined with Fisher’s test.Source: §3.2 · p. 4

3.3. Image-space perturbations

• Image-space marking backpropagates through a fixed feature extractor to move image features toward the carrier, while constraining pixel changes and penalizing pixel- and feature-space distances.The optimization can account for crop and resize augmentations; example marks are described as invisible to the naked eye.Source: §3.3 · pp. 4–5

3.4. White-box test with subspace alignment

• For a feature extractor trained from scratch, white-box detection estimates a linear mapping between the marking and trained feature spaces, then compares mapped classifier vectors with the carriers.The mapping is estimated by L2 regression using a held-out set of vanilla images.Source: §3.4 · p. 5

3.5. Black-box test

• Without model weights, black-box detection compares model loss on marked and vanilla images; lower loss on marked images indicates training on radioactive images.With unlimited black-box access, a student model can be trained to mimic the outputs and analyzed as a white-box model.Source: §3.5 · pp. 5–6

4. Analysis of the latent feature space

• The analysis separates each marked classifier into the vanilla classifier’s one-dimensional semantic space, the carrier direction, and a complementary noise space attributed to initialization and optimization randomness.The decomposition quantifies the relative dominance of these subspaces as the marked-data fraction changes.Source: §4 · p. 6
• The semantic component remains significant and dominant over the mark even when most of the dataset is marked, a property the authors say explains the method’s little impact on accuracy.The decomposition also shows that the two-dimensional semantic-and-carrier subspace contains most of the classifier projection.Source: §4 · p. 6
• Figure 5 shows classifiers well aligned with the mark when q = 20% or 2% of the data is marked.The analysis decomposes classification directions into original, mark, and noise subspaces.Source: §4 · p. 6, Figure 5 · p. 6

5.1. Image classification setup

• Training used standard Imagenet augmentation and SGD; Resnet-18 achieved 69.6% top-1 accuracy, with 0.1% variation across initialization and data-order runs.The experiments also used Resnet-50 and varied the radioactive fraction from 1% to 20%.Source: §5.1 · pp. 6–7, §5.2 · p. 7

5.3. Preliminary experiment: comparison to the backdoor technique

• The backdoor comparison was detectable at train time but required visibly perceptible marking (PSNR < 30 dB), and Gaussian noise also activated its trigger.That activation left no guarantee that images with the particular mark had been used.Source: §5.3 · p. 7

5.4. Results

• With q = 1% marked data, detection remains possible from scratch on Imagenet, and the mark has negligible accuracy impact when fewer than 10% of data are marked.The results also report lower accuracy impact for random crops than center crops at q = 1%.Source: Table 2 · p. 7, §5.4 · p. 7
• Black-box detection became possible when at least 20% of the training set was radioactive; distillation also retained detectable radioactivity, with slightly lower performance than white-box access.At smaller marked fractions, models performed better on vanilla samples, making detection difficult.Source: §5.4 · p. 8, Figure 6 · p. 8

5.5. Ablation analysis

• Detection transferred across Imagenet architectures, reaching p = 10^-15 at q = 2%, and to Places205, where marking more than 10% yielded p < 10^-3.Class accuracy was negatively correlated with classifier–carrier cosine (Spearman correlation, p = 4 × 10^-5).Source: §5.5 · p. 8, Table 3 · p. 8, Table 4 · p. 8

5.6. Discussion

• The authors report that augmentation strengthens the mark and larger-architecture transfer improves detection reliability, but the study assumes training treats marked data as vanilla.The method is a proof of concept resilient to blind architecture or training changes; subspace analysis would likely reveal the marking direction.Source: §5.6 · pp. 8–9

• Radioactive data verifies whether data was used to train a model, with statistical guarantees.Source: §6 · p. 9
• 1% of training data can be radioactive while the method remains effective on Imagenet classification with Resnet-18 and Resnet-50.Source: §6 · p. 9
• The radioactive contamination also incidentally offers classical image watermarking.Source: §6 · p. 9

A. Distillation

• At 2% or more radioactive original training data, radioactivity propagates through distillation with statistical significance (p < 10^-3).Source: A. Distillation · p. 11
• The experiment starts with a marked Resnet-18 available only through black-box access, then tests a second network trained by distillation.Source: A. Distillation · p. 11
• The reported result is a radioactivity test on distilled networks.Source: A. Distillation · p. 11