Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 8: Strong Accept: Technically strong paper, with novel ideas, excellent impact on at least one area, or high-to-excellent impact on multiple areas, with excellent evaluation, resources, and reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper proposes a dataset protection approach, Untargeted Backdoor Watermark, via crafting untargeted backdoor attacks for the protected dataset. The authors propose their method in two different settings(i.e., mislabel and clean-label settings). Through extensive experiments,  Untargeted Backdoor Watermark is proved to be effective and robust against various defense approaches in two different settings.
strengths_and_weaknesses: 
================= Strength================= 
1. The studied problem is interesting. 
2. The evaluation is comprehensive. 
3. The overall presentation is good.


=================Weakness================

1.   Lack some in-depth discussions on the selection of triggers and provide a practical scenario for data leakage.
2.  It lacks a discussion on the potential negative impact brought by the protected dataset. For example, will the model trained through the protected dataset perform vulnerable against backdoor attacks?


questions: 1. Can you add more descriptions regarding datasets protection and encryption?
limitations: 1. Can u give some practical scenarios to illustrate the importance of UBW.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: The paper aimed to protect open-source datasets from illegal DNN training by injecting verifiable backdoor watermarks. It first revealed that the existing backdoor watermarking techniques used targeted labels and could be exploited by adversaries for attacks. It then proposed novel untargeted backdoor watermarking techniques that are both effective and harmless in poisoned-label (UBW-P) and clean-label (UBW-C) settings. UBW-P stamped simple backdoor triggers on a subset of data and changed their labels randomly. UBW-C did not modify image labels; it instead optimized the trigger generation function in a bi-level optimization. The proposed methods were verified on CIFAR-10 and ImageNet, showing high effectiveness and dispersibility while being stealthy to standard backdoor defenses, including Fine-tuning, Fine-pruning, NeuralCleanse, STRIP, and GradCam inspection.
strengths_and_weaknesses: ## Strengths:
- The authors provided a good discussion on the issue of the common targeted backdoor watermarks and why we needed untargeted backdoor watermarks.
- The proposed untargeted backdoor watermarking techniques are novel and useful. I believe the topic of untargeted backdoors is easy to think of. However, it is not attractive and unexplored in the context of backdoor attacks due to its unpredictability. However, the authors found data watermarking a suitable application for these techniques, in which unpredictability becomes a strength when considering safety.
- The paper designed two versions for both poisoned-label and clean-label settings.
- The authors proposed new dispersibility metrics, which are technically sound. They are particularly helpful in designing the clean-label untargeted backdoor watermarks (UBW-C).
-   The proposed methods were verified on CIFAR-10 and ImageNet, showing high effectiveness and dispersibility while being stealthy to standard backdoor defenses, including Fine-tuning, Fine-pruning, NeuralCleanse, STRIP, and GradCam inspection.


## Weaknesses:
- The proposed watermarks are perceptible by human subjects and can be manually removed. The authors should try the imperceptible techniques:
   - In UBW-P, instead of using the BadNets triggers, the authors can try the imperceptible ones from WaNet, or LIRA [1].
   - In UBW-C, there is no constraint to enforce the poisoned image to be similar to the clean one. As a result, we can see apparent artifacts on the poisoned examples. Employing that constraint in the optimization goal (Eq. 6) would be an interesting direction to explore.
- The authors should verify the proposed watermarking methods under dataset-based backdoor defenses such as Spectral Signatures [2] and Activation Clustering [3].
- It is also more persuasive if they are verified under more backdoor defenses such as NAD [4] and Mode Connectivity [5].
- The denotations for the datasets (\mathcal{D}) and dispersibility metrics (D) are easy to be confused.

[1] Lira: Learnable, imperceptible and robust backdoor attacks. In CVPR 2021.

[2] Spectral signatures in backdoor attacks. In NeurIPS 2018.

[3] Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering. In SafeAI at AAAI 2019

[4] Neural attention distillation: Erasing backdoor triggers from deep neural networks. In ICLR 2021.

[5] Bridging mode connectivity in loss landscapes and adversarial robustness. In ICLR 2020.

questions: - Can we design imperceptible triggers for UBW-P and UBW-C?
- Are UBW-P and UBW-C stealthy under dataset-based backdoor defenses such as Spectral Signatures and Activation Clustering?
- Are UBW-P and UBW-C stealthy under recent backdoor defenses such as NAD and Mode Connectivity?
limitations: The authors discusses the societal impacts of the proposed technique. I would recommend to add limitations mentioned above.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper proposes a methods, UBW-C and UBW-P, to verify unauthorized use of open-sourced dataset. For this, authors train a watermark generator G(. ; theta) using eq. 6 to minimize L(f(G(x:theta);w*),y) and entropy. Also, authors insist that the proposed watermarking is robust in dispersibility for predictions of poisoned data. A malicious network that trained using the watermarked dataset may predict randomly for watermarked test data and clearly for clean test data, so it is possible to verify using the difference between the two predictions, for watermarked and clean test data. 
strengths_and_weaknesses: This work has specialty in untargeted attack that makes malicious network predicts random label for watermarked test data. Then, experiment section provides comparisons with some other data poisoning methods on CIFAR10, and ImageNet subset. However, I think this paper is weak in comparisons to similar works under various conditions(architectures, and large-scaled datasets), and the proposed seems quite harmful for original dataset. Also, I think the proposed verification method requires detailed specification on malicious network, so it seems weak on practice.

===============After Author-Reviewer Discussion==========================
I raised some concerns at the first review, and many of them are discussed duing this period. In specific, issues about applications on large-scaled datasets, and transferability, stealthiness are well addressed.  


Strengths: This work addresses an interesting which make a trained DNN predicts random label via dataset watermarking. I think the random prediction is an insightful and novel. Then, large-scaled datasets, and transferability, stealthiness, robustness to defense are well addressed.

Weaknesses: Drop in BA for WBD-C is a weakness, and I'm still not sure about whether the random classification is better than previous guided misclassification for verifying malicious users. I expect the property is fit to attacking purpose.


However, I think the insightful property is more important, and I'll expect the weakness can be enhanced later. Also, I'll re-update my score at the end of Reviewer-MetaReviewer Discussion. 




questions: I have some concerns as follow:

1) I cannot be sure about strength of the untargeted watermarking.  What is better than targeted one? In Fig 2, only difference between target label and random label in prediction. 

2) Dispersibility occupies large portion of this paper, but I don't undestand necessity of it. It isn't used for training generator in Eq. 6 and 7, and used only as evaluation metric. However, I think it is entropy-based ASR instead of accuracy-based ASR, but they ar not much different. 

3) Table 1 and 2 show that the proposed highly drops the benign accuracy from 92.53% to 86.99% for CIFAR10, and 67.3% to 59.6% for ImageNet subset. It seems that the proposed watermark is harmful.

4) Only ResNet-18 and small-scale datasets(CIFAR10 and ImageNet subset) were used in evaluation. Then, only label-consiststent watermarking and Sleeper Agent were compared. I think it is necessary to compare other recent works such as Radioactive Data [1] or which is much similar to the proposed method, or various backdoor attack/data poisoning approaches, and authors have to compare with them.

[1] Sablayrolles et. al.. Radioactive data: tracing through training. ICML 2020



5) In Eq. 6 and 7, f(.) means NN architecture. Is it necessary to know architecture of malicious model?




limitations: 1) Drop in BA for WBD-C

2) Unclear strength of random classification in dataset watermarking.
review_title: null

Meta-review: metareview: This paper proposes a methods to verify unauthorized use of open-sourced dataset. The idea is to inject verifiable backdoor watermarks. The authors first show that existing backdoor watermarks can be exploited by adversaries for attacks. They then proposed novel untargeted backdoor watermarking techniques that are both effective and harmless in poisoned-label (UBW-P) and clean-label (UBW-C) settings. A malicious network that trained using the watermarked dataset may predict randomly for watermarked test data and clearly for clean test data, so it is possible to verify using the difference between the two predictions, for watermarked and clean test data. The authors agree that the proposed untargeted watermarks are useful and the problem being studied is interesting. The authors are suggested to address remaining concerns of the reviewers, such as whether the random classification is better than previous guided misclassification for verifying malicious users. 
confidence: Certain
Decision: Accept