Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection

Yiming Li; Yang Bai; Yong Jiang; Yong Yang; Shu-Tao Xia; Bo Li

Source-linked AI summary

Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection

Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, Bo Li

arXiv:2210.00875v3Sep 27, 2022cs.CRcs.AIcs.CVcs.LG

TL;DR

Open-sourced datasets need copyright protection, but existing targeted poison-only watermarking can create security risks in models trained on protected data. The paper develops untargeted backdoor watermarks with poisoned- and clean-label variants, and reports effective ownership verification and resistance to backdoor defenses. Its scope is image-classification backdoor watermarks, while broader task settings remain outside the paper.

Problem
Existing dataset ownership verification can introduce security risks because poison-only backdoor watermarks target deterministic model behavior.
Method
The paper defines correlated dispersibilities and uses them to design poisoned-label and clean-label untargeted backdoor watermarks for ownership verification.
Results
Experiments on benchmark datasets report effective ownership verification and resistance to existing backdoor defenses.
Takeaways & Limitations
Untargeted backdoor watermarks provide a proposed basis for harmless and stealthy dataset ownership verification, with UBW-P more effective and UBW-C more stealthy.
Takeaways & Limitations
The paper focuses on backdoor watermarks for image classification; watermarks in other tasks and their dataset protection are outside its scope.

Abstract

from arXiv · show

Deep neural networks (DNNs) have demonstrated their superiority in practice. Arguably, the rapid development of DNNs is largely benefited from high-quality (open-sourced) datasets, based on which researchers and developers can easily evaluate and improve their learning methods. Since the data collection is usually time-consuming or even expensive, how to protect their copyrights is of great significance and worth further exploration. In this paper, we revisit dataset ownership verification. We find that existing verification methods introduced new security risks in DNNs trained on the protected dataset, due to the targeted nature of poison-only backdoor watermarks. To alleviate this problem, in this work, we explore the untargeted backdoor watermarking scheme, where the abnormal model behaviors are not deterministic. Specifically, we introduce two dispersibilities and prove their correlation, based on which we design the untargeted backdoor watermark under both poisoned-label and clean-label settings. We also discuss how to use the proposed untargeted backdoor watermark for dataset ownership verification. Experiments on benchmark datasets verify the effectiveness of our methods and their resistance to existing backdoor defenses. Our codes are available at \url{https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark}.

1 Introduction

Open-sourced datasets accelerate DNN research but can be used commercially without authorization. The paper proposes untargeted backdoor watermarks to support harmless, stealthy ownership verification while addressing security risks from targeted watermarks.

Open-sourced datasets support DNN evaluation and improvement but may be used commercially without authorization.
Existing dataset-protection approaches either hinder accessibility or functionality, manipulate training, or do not protect open-sourced dataset copyrights.
Targeted backdoor watermarks can let adversaries deterministically manipulate predictions of models trained on protected datasets.
The paper introduces untargeted backdoor watermarks using two correlated dispersibilities under poisoned-label and clean-label settings.
UBW-P is more effective, whereas UBW-C is more stealthy; both support the paper’s proposed ownership-verification process.
Experiments on benchmark datasets verify the effectiveness of the proposed method.

2 Related Work

Existing data-protection methods do not adequately protect open-sourced dataset copyrights without impairing usability, and targeted backdoor watermarks introduce security threats. The paper situates untargeted backdoor attacks as an unexplored direction for dataset protection and related applications.

Data Protection: Encryption can restrict dataset access, while differential privacy alters training and leakage defenses do not address unauthorized use of open-sourced datasets.
Data Protection: Existing methods cannot adequately protect open-sourced datasets, and the available poison-only targeted approach introduces security threats in trained models.
Backdoor Attacks: Backdoor attacks preserve normal benign-sample predictions but change predictions when adversary-specified triggers appear.
Backdoor Attacks: Poison-only attacks are categorized by adversary capacity, and they are the only backdoor attacks identified here as usable for open-sourced dataset protection.
Backdoor Attacks: Poisoned-label attacks change poisoned samples’ labels, whereas clean-label attacks retain their ground-truth labels but can be less effective in difficult settings.
Backdoor Attacks: Existing backdoor attacks are described as targeted, leaving untargeted attack design and positive applications open for further exploration.

3 Untargeted Backdoor Watermark (UBW)

The paper defines untargeted backdoor watermarks to make poisoned-sample predictions dispersible rather than deterministically targeted, while preserving clean labels in UBW-C. It formalizes dispersibility and uses differentiable surrogates and optimization to construct poisoned datasets.

3.1 Preliminaries: The threat model allows adversaries to modify selected benign samples but not the training loss, schedule, or model structure.The modified samples and unchanged benign samples are released for victims to train DNNs.
3.1 Preliminaries: Existing targeted watermarks can create security threats because adversaries can determine predictions for malicious samples.UBW is motivated by avoiding this deterministic manipulation while retaining watermark-based ownership protection.
3.2 Untargeted Backdoor Watermark: UBW targets effectiveness, stealthiness, and dispersibility: poisoned images should be misclassified, the watermark should remain hard to identify, and predictions should disperse.These goals jointly distinguish UBW from targeted backdoor behavior.
3.2 Untargeted Backdoor Watermark: Averaged prediction dispersibility uses entropy to measure how dispersed predictions are across images sharing a ground-truth label.Higher dispersibility makes deterministic adversarial manipulation harder.
3.3 UBW with Poisoned Labels: UBW-P randomly assigns poisoned-sample labels with equal probability to approximate uniform prediction distributions.It retains the poison-generator framework while replacing a shared target label with random labels.
3.4 UBW with Clean Labels: UBW-C keeps poisoned samples’ original labels and uses bi-level optimization because UBW-P remains detectable through image-label inspection.The optimization uses differentiable sample-wise and class-wise dispersibility surrogates, with λ controlling a non-negative trade-off.
3.4 UBW with Clean Labels: Theorem 1 motivates maximizing averaged sample-wise dispersibility alone to simultaneously optimize sample-wise and class-wise dispersibility.The construction optimizes the poisoned image generator G while training the model on the resulting modified subset.
3.4 UBW with Clean Labels: UBW-C optimization uses stochastic gradient descent with mini-batches because sample-wise dispersibility is simpler and more accurate to estimate than class-wise dispersibility.This advantage is especially relevant when datasets contain many classes.

4 Towards Harmless Dataset Ownership Verification via UBW

Ownership verification targets suspicious models when defenders can query predictions but cannot inspect training data or model parameters. UBW supports verification by testing whether poisoned samples produce the characteristic untargeted behavior.

4 Towards Harmless Dataset Ownership Verification via UBW: Defenders verify dataset ownership using only predicted probability vectors from queried suspicious models, without training-process or parameter information.The verification setting assumes black-box access to the suspicious model.
4 Towards Harmless Dataset Ownership Verification via UBW: Dataset owners release a watermarked version of the benign dataset so models trained on it acquire distinctive prediction behaviors.The watermark is embedded by modifying the released dataset rather than the training procedure.
4 Towards Harmless Dataset Ownership Verification via UBW: UBW models behave normally on benign samples but produce dispersible predictions on poisoned samples, enabling harmless and stealthy ownership verification.A suspicious model is considered trained on the protected dataset when it contains the specific untargeted backdoor behavior.
4 Towards Harmless Dataset Ownership Verification via UBW: Verification rejects H0: Pb = Pp + τ using a pairwise t-test when the p-value is below significance level α.The procedure samples m benign examples, selects correctly classified ones, and computes confidence as ΔP = Pb − Pp.

5 Experiments

Experiments on CIFAR-10 and ImageNet evaluate UBW against targeted backdoor watermarks, ownership-verification scenarios, hyper-parameters, and backdoor defenses. UBW achieves competitive watermarking, effective verification, and resistance to fine-tuning and pruning, while poisoning rate and λ expose practical trade-offs.

Experimental Settings: Experiments use CIFAR-10 and a 50-class ImageNet subset with ResNet-18, comparing UBW against poisoned-label and clean-label backdoor baselines.The ImageNet subset contains 25,000 training images and 2,500 testing images.
Experimental Settings: Watermark performance is evaluated using benign accuracy, ASR-A, ASR-C, and averaged prediction dispersibility Dp.Higher BA, ASR, and Dp indicate better watermark performance.
Watermark Performance: UBW matches targeted baselines overall, while UBW-C exceeds other clean-label watermarks by more than 55% in ASR-C on ImageNet.The comparison includes label-consistent attack and Sleeper Agent.
Watermark Performance: UBW-P produces over 10 times the Dp of all poisoned-label baselines on CIFAR-10, supporting nondeterministic rather than maliciously deterministic predictions.The paper associates higher dispersibility with harmlessness under the untargeted scheme.
Dataset Ownership Verification: Ownership verification identifies unauthorized dataset use with ΔP ≫0 and p-value ≪0.01, while independent-trigger and independent-model cases have nearly 1 p-values.UBW-C is somewhat weaker than UBW-P but remains capable of verification and is more stealthy through clean labels and invisible triggers.
Ablation Study: ASR increases with poisoning rate γ, while benign accuracy decreases; both UBW variants achieve promising ASR at γ = 0.03.The authors recommend selecting γ according to practical requirements.
Ablation Study: Increasing λ raises Dp but has minor effects on ASR, indicating that sample-wise dispersibility approximates averaged prediction dispersibility.The authors attribute the ASR stability probably to the untargeted attack scheme.
Resistance to Backdoor Defenses: UBW remains effective after defenses: ASRs exceed 55% after fine-tuning and 50% under high pruning rates.UBW-C’s ASR temporarily increases as pruning rises, although benign accuracy is already low.

6 Societal Impacts

The paper acknowledges that UBW is resistant to existing backdoor defenses and could be misused, but its untargeted behavior creates fewer threats than targeted attacks. Trusted training resources can mitigate or avoid these risks.

UBW is resistant to existing backdoor defenses and could be maliciously used by backdoor adversaries.
Compared with targeted backdoor attacks, UBW has minor threats because it is untargeted.
Using only trusted training resources can mitigate or even avoid the associated threats.

7 Conclusion

The paper revisits dataset copyright protection and identifies security risks from targeted poison-only backdoor watermarks. It proposes untargeted watermarks for ownership verification and reports effectiveness and resistance to backdoor defenses on benchmark datasets.

Existing dataset ownership verification can introduce serious risks because it uses targeted poison-only backdoor attacks.
The paper explores untargeted backdoor watermarks under both poisoned-label and clean-label settings, producing nondeterministic abnormal model behavior.
The paper studies UBW-based dataset ownership verification intended to be harmless and stealthy.
Experiments on benchmark datasets validate the method’s effectiveness and resistance to backdoor defenses.

Checklist

The checklist records the paper’s stated contributions, theoretical proofs, reproducibility materials, implementation details, and limitations. It also documents the UBW-C optimization procedure and its instability across random seeds.

Checklist: The authors state that the paper describes its contributions, limitations, and potential negative societal impacts.
Checklist: The paper states that assumptions and complete proofs for theoretical results are included in Section 3.4 and the appendix.
Checklist: The paper states that code, data, instructions, and training details needed to reproduce experiments are included in the appendix.
Optimization process: UBW-C uses bi-level optimization with trigger-pattern updates at the upper level and model-parameter optimization at the lower level.
Optimization process: The method uses invisible training perturbations and visible inference triggers, with separate generators for training and inference.
Limitations: UBW-C watermark performance is not very stable across random seeds and has relatively large standard deviation.

C.1 Detailed Settings for Dataset Watermarking

Experiments evaluate UBW against representative poison-only backdoor attacks on CIFAR-10 and a 50-class ImageNet subset using ResNet-18. The setup also tests ownership verification, fine-tuning, and model pruning.

Datasets and models: Experiments use CIFAR-10 and a 50-class ImageNet subset with ResNet-18.The ImageNet subset contains 25,000 training images and 2,500 test images, resized to 3 × 64 × 64.
Baseline selection: UBW is compared with BadNets, blended attack, WaNet, label-consistent attack, and Sleeper Agent.The baselines represent visible, patch-based invisible, non-patch-based invisible, label-consistent, and related attacks.
Attack setup: The experiments set the poisoning rate to γ = 0.1 for all attacks, except label-consistent attack on ImageNet, where it uses its maximum rate of 0.02.
Verification scenarios: The verification method evaluates independent triggers, independent models, and unauthorized dataset usage.
Robustness settings: Fine-tuning uses 10% benign training samples for 100 epochs, while pruning varies the rate β from 0% to 98%.

D.1 The Effects of Trigger Patterns

UBW remains effective across user-specified trigger patterns and sizes, while verification certainty controls the trade-off between misjudgment and missed dataset theft.

Trigger patterns: ASR-As exceeds 80% for both UBW-P and UBW-C across all tested trigger patterns.The results support using arbitrary user-specified trigger patterns during inference.
Trigger sizes: Attack success rate increases as trigger size grows, while larger triggers have minor adverse effects on benign accuracy.For UBW-C, benign accuracy even slightly increases with trigger size.
Verification certainty: The verification p-value increases with certainty τ; τ below 0.15 causes UBW-C to misjudge Independent-T cases.Larger τ reduces misjudgments but makes dataset stealing more likely to be ignored.

E.2 The Effects of the Number of Sampled Images

Increasing the number of sampled images improves UBW-based ownership-verification judgments, while untargeted design also supports resistance to several backdoor defenses.

Sampled images: Increasing the sampled-image count m improves the probability of correct UBW-based ownership-verification judgments.The improvement is attributed to reduced adverse effects from randomness in sample selection.
UBW-C optimization: Using only source-class samples during UBW-C optimization raises ASR-A by more than 30% over using all samples on CIFAR-10 and ImageNet.The source-class design reduces optimization difficulty because gradients from different classes may be too noisy.
Trigger synthesis defenses: Neural Cleanse synthesizes patterns similar to BadNets’ ground-truth trigger but significantly different patterns for UBW-P and UBW-C.This supports UBW resistance to trigger-synthesis defenses.
Saliency-based defenses: Grad-CAM focuses mainly on trigger areas for BadNets but mainly on other regions for UBW-C, with trigger-focused maps occurring in some UBW-P cases.The UBW-P difference is associated with using the same trigger during inference and training, whereas training uses invisible additive noises.
STRIP: UBW-P and UBW-C produce STRIP entropies more than 100 times larger than BadNets, making the watermark harder for STRIP to detect.The paper attributes this to dispersed predictions from the untargeted design.

G.4 Resistance to Dataset-level Backdoor Defenses

UBW resists several dataset- and model-level backdoor defenses, while its untargeted construction disperses poisoned samples and avoids deterministic prediction manipulation.

Dataset-level defenses: Spectral signatures and activation clustering fail to filter UBW-P and UBW-C samples completely under both poisoned-label and clean-label settings.The authors speculate that UBW samples scatter through feature space instead of forming a single cluster.
Repairing-based defenses: Both UBW-P and UBW-C are resistant to MCR and NAD to some extent.The paper attributes these failures partly to fine-tuning stages being ineffective for UBWs.
Imperceptible triggers: UBW-P remains effective with imperceptible triggers, although its ASR may be lower than with visible BadNets-type triggers.The results indicate a trade-off between ASR and trigger visibility.
Untargeted design: Unlike targeted attacks, UBW optimizes prediction dispersibility so adversaries cannot deterministically manipulate model predictions.Maximizing untargeted loss alone may not disperse predictions because targeted attacks can also maximize that loss.

J.5 Connections and Differences with Radioactive Data

UBW and radioactive data use different ownership-verification signals and defender requirements, with UBW reported as effective on lower-resolution, smaller datasets such as CIFAR-10.

Verification mechanism: UBW verifies ownership through changes in predicted probability for the ground-truth label, whereas radioactive data uses loss changes.UBW’s confidence budget τ is selectable from [0, 1], while radioactive data’s loss-based budget is harder to select across datasets.
Defender requirements: UBW requires fewer defender capacities than radioactive data because verification can use only the probability of the predicted label.The method can be generalized to label-only verification by comparing poisoned and benign predictions, whereas radioactive data cannot.
Dataset scope: UBW has promising performance on relatively low-resolution and smaller datasets such as CIFAR-10, where radioactive data appears far less effective.This comparison is reported as a difference in dataset-level performance.