PaperlayerView exact revision on arXiv

Source-linked AI summary

Black-box Dataset Ownership Verification via Backdoor Watermarking

Yiming Li, Mingyan Zhu, Xue Yang, Yong Jiang, Tao Wei, Shu-Tao Xia

arXiv:2209.06015v2cs.CRcs.AIcs.CVcs.LG

TL;DR

Owners need a way to check whether restricted released datasets were used to train third-party models, despite having access only to model predictions. The paper proposes poison-only backdoor watermarking with hypothesis-test-guided verification, and reports effective results across image, language, and graph tasks.

Abstract

from arXiv · show

Deep learning, especially deep neural networks (DNNs), has been widely and successfully adopted in many critical applications for its high effectiveness and efficiency. The rapid development of DNNs has benefited from the existence of some high-quality datasets ($e.g.$, ImageNet), which allow researchers and developers to easily verify the performance of their methods. Currently, almost all existing released datasets require that they can only be adopted for academic or educational purposes rather than commercial purposes without permission. However, there is still no good way to ensure that. In this paper, we formulate the protection of released datasets as verifying whether they are adopted for training a (suspicious) third-party model, where defenders can only query the model while having no information about its parameters and training details. Based on this formulation, we propose to embed external patterns via backdoor watermarking for the ownership verification to protect them. Our method contains two main parts, including dataset watermarking and dataset verification. Specifically, we exploit poison-only backdoor attacks ($e.g.$, BadNets) for dataset watermarking and design a hypothesis-test-guided method for dataset verification. We also provide some theoretical analyses of our methods. Experiments on multiple benchmark datasets of different tasks are conducted, which verify the effectiveness of our method. The code for reproducing main experiments is available at \url{https://github.com/THUYimingLi/DVBW}.

I. INTRODUCTION

Released datasets are valuable and often restricted to specified uses, but owners lack a suitable way to detect unauthorized use when third parties keep training data private. The paper frames protection as black-box ownership verification using poison-only backdoor watermarking and hypothesis tests.

I. INTRODUCTION

  • Dataset owners need to detect unauthorized use of valuable released datasets, including datasets limited to academic or educational purposes.Dataset collection is time-consuming and expensive, and the paper notes that copyrights deserve protection.Source: §I · p. 1
  • Existing protection methods leave a gap: encryption and differential privacy hinder normal dataset use, while digital watermarking has little effect when users release only trained models.The paper identifies protection of released datasets as an open question because adversaries can access the victim datasets.Source: §I · p. 1
  • DVBW formulates protection as checking whether a suspicious model was trained on the victim dataset, using poison-only backdoors to watermark data and hypothesis tests to verify the hidden behavior.Verification is black-box: defenders have predictions but no access to model parameters or training details.Source: §I · p. 1
  • The paper proposes black-box dataset ownership verification based on poison-only backdoor attacks and pair-wise hypothesis tests.Its stated contributions also include theoretical analyses and experiments across image classification, natural language processing, and graph recognition.Source: §I · pp. 1–2

A. Data Protection

  • Encryption restricts dataset functionality, digital watermarking cannot identify use when training samples stay undisclosed, and differential privacy requires altering the training process.The paper concludes that protecting released datasets remains an open area for further attention.Source: A. Data Protection · p. 2

B. Backdoor Attack

The paper focuses on poison-only backdoor attacks because they modify training samples, making them applicable to dataset protection. It also establishes terminology for the datasets, models, triggers, labels, and metrics used in its method.

B. Backdoor Attack

  • Poison-only attacks modify training samples; training-controlled attacks also modify training components, while model-modified attacks alter model parameters or structure.The paper focuses on poison-only attacks because changing samples alone makes them usable for dataset protection.Source: B. Backdoor Attack · p. 2
  • Poison-only attacks connect a trigger to a target label during training; BadNets stamps a small subset of images and assigns them the target label.The paper describes follow-up attacks with different trigger designs and notes that poison-only attacks also extend beyond image classification.Source: B. Backdoor Attack · p. 2

A. The Definition of Technical Terms

  • The victim dataset is the released dataset, while the benign dataset is unmodified; a suspicious model is a third-party model that may have trained on the victim dataset.These terms distinguish the protected release from the original data and the model under verification.Source: A. The Definition of Technical Terms · p. 2
  • A backdoor is the latent connection between a trigger pattern and target label; poisoned samples are modified to create or activate it.The target label is the attacker-specified label that the attacker intends poisoned test samples to receive.Source: A. The Definition of Technical Terms · p. 2
  • Benign accuracy measures predictions on benign test samples, while watermark success rate measures predictions on watermarked test samples.The paper follows these definitions throughout the remaining paper.Source: A. The Definition of Technical Terms · p. 2
  • The pipeline first watermarks the dataset with poison-only backdoor attacks, then tests whether a suspicious model contains the hidden backdoor.It considers both probability-output and label-only black-box settings.Source: Figure 1 · p. 3

B. The Main Pipeline of Deep Neural Networks (DNNs)

The paper reviews supervised DNN training and poison-only backdoor construction before defining dataset protection as black-box verification of whether a suspicious model trained on the released data. It considers both probability-access and label-only settings.

B. The Main Pipeline of Deep Neural Networks (DNNs)

C. The Main Pipeline of Poison-only Backdoor Attacks

  • Poison-only attacks select benign training samples, modify them with a poison generator, assign the target label, and combine them with the remaining benign samples.The fraction of poisoned data is the poisoning rate; the generator specifies the trigger modification.Source: C. The Main Pipeline of Poison-only… · p. 3
  • Training on the poisoned dataset embeds a hidden backdoor that maps triggered inputs to the target label while preserving high accuracy on benign samples.The paper describes this as training that otherwise follows the standard process, with the training dataset changed.Source: C. The Main Pipeline of Poison-only… · p. 3

D. Problem Formulation and Threat Model

  • Dataset protection is verification of whether a suspicious model was trained on the victim dataset, with defenders limited to querying it and lacking access to its parameters, structure, or training details.The two settings provide either predicted probability vectors or only predicted labels; the latter gives defenders less information.Source: D. Problem Formulation and Threat Model · p. 3

IV. THE PROPOSED METHOD

DVBW watermarks a released dataset with poison-only backdoor patterns, then tests whether a suspicious model exhibits the resulting behavior. The approach is designed for black-box verification, where defenders can query predictions but lack model parameters and training details.

A. Overall Procedure

  • DVBW pairs poison-only backdoor watermarking with hypothesis-test-guided verification to check for the watermark in a suspicious model.The method has two stages: dataset watermarking and dataset verification.Source: A. Overall Procedure · p. 4

C. Dataset Verification

  • Defenders test a suspicious model for the predefined behavior induced by watermarking the released dataset.Because defenders can modify the dataset and query models, the method uses watermark-triggered predictions as evidence of training on the protected dataset.Source: B. Dataset Watermarking · p. 4, C. Dataset Verification · p. 4

B. Dataset Watermarking

  • Watermarking aims to preserve dataset functionality, create distinctive predictions on watermarked data, and remain unobtrusive to adversaries.The paper uses poison-only backdoor attacks to meet these requirements while embedding backdoor behavior in datasets for classification tasks.Source: B. Dataset Watermarking · p. 4

1) Probability-Available Verification:

The verification procedure depends on the black-box outputs available: predicted probabilities support a paired comparison, while predicted labels support a test of target-label outputs on watermarked samples.

1) Probability-Available Verification:

  • With probability vectors, compare target-class probabilities for benign and watermarked samples using a one-tailed paired t-test against a specified margin.The method rejects the null hypothesis when the p-value is below significance level α; the difference ∆P represents verification confidence.Source: 1) Probability-Available Verification · p. 4

2) Label-Only Verification:

  • With labels only, test whether watermarked samples with non-target ground-truth labels are predicted as the target class.The method uses a Wilcoxon test; the authors recommend setting the target label near K/2 because extreme target labels may impair detection when watermark success is insufficiently high.Source: 2) Label-Only Verification · pp. 4–5

D. Theoretical Analysis of Dataset Verification

The analysis gives conditions for probability-available verification to reject its null hypothesis, while experiments assess watermarking and verification across benchmark classification tasks. The reported results show effective watermarking and dataset-stealing detection, with label-only verification less effective than probability-available verification.

D. Theoretical Analysis of Dataset Verification

  • Theoretical analysis covers probability-available verification because its statistic relates directly to watermark success rate; the authors leave label-only theoretical foundations for future work.The analysis states that verification can succeed above a watermark-success-rate threshold that need not be 100%, and that more samples can lower the significance level.Source: D. Theoretical Analysis of Dataset… · p. 5

A. Evaluation Metrics

  • Evaluation uses benign accuracy and watermark success rate for watermarking, and ∆P and p-values for probability-available verification, with p-values for label-only verification.The stated verification scenarios are independent trigger, independent model, and stealing.Source: A. Evaluation Metrics · p. 5

B. Main Results on Image Recognition

  • Watermarking decreased benign accuracy by less than 2% in all cases, while watermark success rate exceeded 94% in all CIFAR-10 cases.The reported decreases were mostly below 1%, and CIFAR-10 watermark success rates were mostly above 99%.Source: B. Main Results on Image Recognition · p. 6, Table I · p. 6
  • Probability-available verification identified stealing with high confidence and did not misjudge non-stealing cases; label-only verification detected stealing in all reported cases but was less effective.For probability-available verification, the reported patterns were ∆P ≫ 0 and p-value ≪ 0.01 for stealing, versus ∆P nearly 0 and p-value ≫ 0.05 without stealing; label-only stealing cases had p-value < 0.05.Source: B. Main Results on Image Recognition · p. 6, Table II · p. 6, Table III · p. 6

C. Main Results on Natural Language Processing

The NLP experiments test whether poisoned datasets can watermark models and whether black-box verification can identify dataset use. Word- and sentence-level triggers produce strong watermarking results, while the verification method works with either model probabilities or labels.

Dataset and method settings

  • The experiments use IMDB and DBpedia with LSTM and WordCNN, applying word- and sentence-level triggers at poisoning rate γ = 0.1.The target label is ‘1’ for IMDB and ‘7’ for DBpedia; label-only verification on DBpedia samples only from its first three classes.Source: C. Main Results on Natural Language… · p. 7

Results

  • Watermark success rates are nearly 100% across cases, with benign-accuracy decreases below 1% versus models trained on benign data.The authors also describe the modifications as comparatively stealthy because natural-language changes are more likely to be ignored.Source: C. Main Results on Natural Language… · pp. 7–8
  • Verification identifies dataset stealing with high confidence in probability-available and label-only settings, while avoiding false positives when no stealing occurs.The reported signals are ∆P ≫ 0 and p-value ≪ 0.01 when stealing occurs, versus ∆P nearly 0 and p-value ≫ 0.05 otherwise.Source: C. Main Results on Natural Language… · p. 8

D. Main Results on Graph Recognition

Graph-recognition experiments show strong watermarking and effective ownership verification on COLLAB and REDDIT-MULTI-5K. The poisoning-rate study finds that higher rates raise watermark success but can reduce benign accuracy.

D. Main Results on Graph Recognition

  • Experiments pair COLLAB and REDDIT-MULTI-5K with GIN and GraphSAGE, using node degree as the feature and complete-subgraph triggers injected at minimum-degree or random nodes.The poisoning rate is 0.1; trigger subgraph degrees are 14 and 15 on COLLAB and 97 and 98 on REDDIT-MULTI-5K.Source: D. Main Results on Graph Recognition · pp. 8–9
  • On COLLAB, both graph attacks exceed 99.5% WSR with less than 1.5% benign-accuracy loss; verification works in both settings and reaches best possible performance in label-only cases.The comparison is reported for probability-available and label-only verification.Source: D. Main Results on Graph Recognition · p. 9, Table IX · p. 9

1) The Effects of Poisoning Rate:

  • Watermark success rises with poisoning rate, and almost all evaluated attacks achieve high success even at 1%; benign accuracy usually declines as the rate grows.Owners can tune γ to their needs, trading verification confidence against benign accuracy.Source: 1) The Effects of Poisoning Rate · p. 9

2) The Effects of Sampling Number:

The sampling study reports a verification-confidence benefit at the cost of more model queries. The paper also evaluates resistance to three removal approaches and analyzes watermarking complexity.

F. The Resistance to Potential Adaptive Attacks

2) The Effects of Sampling Number:

  • Verification performance improves with sampling number m, but larger samples require more API queries and may be costly or suspicious.The authors attribute the confidence gain to reduced effects of randomness in verification.Source: 2) The Effects of Sampling Number · p. 10, Table X · p. 10

F. The Resistance to Potential Adaptive Attacks

  • Pruning can substantially lower WSR, especially near 100% pruning, but the accompanying benign-accuracy loss is described as unacceptable for standard functionality.In some cases, WSR rises near the end of pruning; the authors present a possible explanation as speculation.Source: Figure 7 · p. 11, F. The Resistance to Potential… · p. 11

1) The Complexity of Dataset Watermarking:

  • Dataset watermarking has computational complexity O(γ · N), where N is the number of training samples and γ is the poisoning rate.The authors characterize the modification of a few selected samples as highly efficient.Source: 1) The Complexity of Dataset… · pp. 11–12

F. The Resistance to Potential Adaptive Attacks

2) The Complexity of Dataset Verification:

Verification uses model queries followed by a hypothesis test, with query complexity depending on prediction mode. The conclusion reiterates DVBW’s dataset-only watermarking and prediction-based verification, distinguishing it from model-ownership verification.

2) The Complexity of Dataset Verification:

  • Verification queries m samples and tests their predictions, with complexity O(m) for single-sample prediction and O(1) for batch prediction.The paper notes that predicting one sample is usually costless.Source: 2) The Complexity of Dataset… · p. 12

VI. RELATION WITH MODEL OWNERSHIP VERIFICATION

  • Unlike model ownership verification, DVBW modifies only the dataset and supports label-only black-box checks; many MOV methods rely on white-box access or probability outputs.The paper says MOV defenders may control model training, whereas dataset-verification defenders lack access to the training process.Source: §VI · p. 12

VII. CONCLUSION

  • DVBW combines poison-only dataset watermarking with hypothesis-test-guided verification, and its effectiveness is reported across multiple benchmark data types.The conclusion frames the task as checking whether a suspicious model was trained on the protected dataset using its predictions.Source: §VII · pp. 12–13

APPENDIX

The appendix analyzes hypothesis testing for watermark verification, deriving a rejection condition and a t-statistic based on poisoned-sample predictions.

APPENDIX

  • Theorem 1 states that owners can reject the null hypothesis at significance level α when Pb < β and the watermark success rate satisfies the theorem’s condition.The supplied statement does not include the condition’s explicit threshold.Source: APPENDIX · p. 13
  • The watermark success rate W is based on poisoned-sample prediction events; for sufficiently large m, it follows a Gaussian approximation with success probability p.The event is whether the suspicious model predicts a poisoned sample as target label yt; p is the backdoor success probability.Source: APPENDIX · p. 13
  • The verification test uses a t-statistic based on the spread of W and compares it with the (1−α)-quantile of a t-distribution with m−1 degrees of freedom.Here, m is the verification sample size; s is defined as the standard deviation of W and (W−β−τ).Source: APPENDIX · p. 13
Loading 2209.06015v2…