SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Table 5: The watermark performance on STL-10 dataset. In particular, we mark harmful watermark results (i.e.,  $H > 0.5$  and  $\hat{H} > 0$ ) in red.
STL-10
Label Type↓	Method↓, Metric→	BA (%)	VSR (%)	H	H
Poisoned-Label	BadNets	85.61	100	1.00	0.86
Blended	85.21	99.32	1.00	0.84
WaNet	83.17	96.10	0.96	0.79
UBW-P	84.22	80.27	0.80	0.64
Clean-Label	Label-Consistent	84.07	93.48	0.93	0.77
Sleeper Agent	83.72	89.77	0.90	0.73
UBW-C	79.32	82.00	0.82	0.61
DW (Ours)	84.58	82.00	0.18	-0.73
E.4 The Details for Implementing each Approach
We implement each backdoor technique using Backdoorbox library $^3$  following the default training configurations. Specifically, for patch-based triggers, we use  $3 \times 3$ ,  $6 \times 6$ , and  $9 \times 9$  for CIFAR-10, Tiny-ImageNet, and STL-10. Following previous work [4], for each approach, we randomly select a label as the target label for ownership verification purposes. For the other input-specific trigger (i.e., WaNet [27]), we follow its default configuration to generate its specific trigger pattern.
<sup>3</sup>https://github.com/THUYimingLi/BackdoorBox
Table 6: The effectiveness of dataset ownership verification via our domain watermark.
STL-10
Independent-D	Independent-M	Malicious
ΔP	0.68	0.78	0.04
p-value	0.95	0.98	10-46
Table 7: Summary of accuracy (%) on samples from different domains for normal models and ours.
Domain Watermark	Source domain	Target domain	Other domain
Normal	Ours	Normal	Ours	Normal	Ours
Domain Watermark I	92.46	92.10	18.50	91.40	16.30	17.60
Domain Watermark II	92.46	91.95	18.20	90.24	14.70	15.80
Domain Watermark III	92.46	91.85	19.60	90.64	18.40	14.90
F The Additional Results for the Performance of Domain Watermark
We first show the summary for the performance of our approach and benign samples on samples from different domains. The results are shown in Table 4. We also show additional results for STL-10 dataset with ResNet-34 as shown in Table 5.
G The Detailed Settings for Dataset Ownership Verification
We evaluate our domain-watermark-based dataset ownership verification under three scenarios, including 1) independent domain (dubbed 'Independent-D'), 2) independent model (dubbed 'Independent-M'), and 3) unauthorized dataset training (dubbed 'Malicious'). In the first case, we used domain-watermarked samples to query the suspicious model trained with modified samples from another domain; In the second case, we test the benign model with our domain-watermarked samples; In the last case, we test the domain-watermarked model with corresponding domain-watermarked samples. Notice that only the last case should be regarded as having unauthorized dataset adoption. All other settings are the same as those used in [4].
Consistent with previous work [4], we adopt the trigger used in the training process of the watermarked suspicious model in the last scenario. Moreover, we sample  $m = 100$  samples on CIFAR10, STL-10, and Tiny/ImageNet and set  $\tau = 0.25$  for the hypothesis-test in each case for our approach. Since Tiny/ImageNet has only 50 samples for each class in the validation dataset, we combine additional 50 training samples with the validation samples for ownership verification. The additional 50 training samples are not used in generating the protected dataset.
H The Additional Results for Dataset Ownership Verification
We here investigate the effectiveness of ownership verification via our domain watermark. The results are shown in Table 6. The settings are consistent with Section 5.
I Additional Results of Discussions
I.1 The Effects of  $\lambda_{3}$
We have investigated the effects of  $\lambda_{3}$ , as shown in Fig. 12. We find that the generalization performance decreases on other unseen validation domains with the increase of  $\lambda_{3}$ . When  $\lambda_{3}$  increases up to 0.3, the generalization performance on other unseen validation domains decreases close to the generalization performance for benign models.
I.2 Performance under Different Domain Watermarks
We here investigate the effective of protected dataset generation for different domain watermarks. We here craft domain watermarks following the Appendix A but initialized with different parameters
Figure 16: The Demonstration of Domain Watermark I.
Table 8: The performance of our domain watermark with different model structures trained on the watermarked dataset generated with ResNet-18.
Metric↓, Model→	ResNet-18	ResNet-34	VGG-16-BN	VGG-19-BN
BA (%)	91.39	92.54	90.86	92.57
VSR (%)	91.90	90.80	90.48	89.00
for crafting different domain watermarks. The demonstrations for different domain watermarks for CIFAR-10 are shown in Figs. 16 to 18.
We here use CIFAR-10 with ResNet-34 to investigate the performance of our approach for different domain watermarks. The results are summarized in Tab. 7. We can see our approach can still achieve effectiveness for different domain watermarks.
I.3 The Transferability of Domain Watermark
Recall that in the optimization process of our approach, we leverage a surrogate model (i.e., ResNet-18) for crafting modified samples. In the experiment section, we test the effectiveness of our approach under models (i.e., VGG-16-BN and ResNet-34) having different architectures and parameters from the surrogate model. In practice, dataset users may adopt different model structures since dataset owners have no information about the model training. In this section, we conduct additional experiments on evaluating the effectiveness of our approach under different structures compared to the one used for generating modified samples (i.e., transferability).
Settings. We evaluate the transferability of our method on CIFAR-10. We adopt ResNet-18, ResNet-34, VGG-16-BN, and VGG-19-BN to deform domain watermark, based on which to train
Figure 17: The Demonstration of Domain Watermark II.
Table 9: The performance of our domain watermark with different model structures trained on the watermarked dataset generated with ResNet-34.
Metric↓, Model→	ResNet-18	ResNet-34	VGG-16-BN	VGG-19-BN
BA (%)	91.22	92.56	90.43	91.79
VSR (%)	90.10	92.44	89.60	90.36
Table 10: The performance of our domain watermark with different model structures trained on the watermarked dataset generated with VGG-16-BN.
Metric↓, Model→	ResNet-18	ResNet-34	VGG-16-BN	VGG-19-BN
BA (%)	91.57	92.10	90.53	92.10
VSR (%)	90.70	91.60	90.44	89.84
Table 11: The performance of our domain watermark with different model structures trained on the watermarked dataset generated with VGG-19-BN.
Metric↓, Model→	ResNet-18	ResNet-34	VGG-16-BN	VGG-19-BN
BA (%)	91.48	91.98	90.77	92.73
VSR (%)	91.30	89.60	90.36	91.94
different models (i.e., ResNet-18, ResNet-34, VGG-16-BN, and VGG-19-BN). Except for the model structure, all other settings are the same as those used in Section 5.
Results. As shown in Table 8-11, our method has high transferability across model structures. Accordingly, our methods are practical in protecting open-sourced datasets.
Figure 18: The Demonstration of Domain Watermark III.
J Additional Results for the Resistance to Potential Adaptive Methods
Robustness against ShrinkPad. We hereby discuss the robustness of our method against ShrinkPad [63], which is a well-known watermarked sample detection approach based on a set of input transformations. We follow BackdoorBox to implement ShrinkPad for filtering watermarked samples. We use CIFAR-10 with ResNet-34 to implement domain watermark and craft 1,000 watermarked samples based on the validation dataset for investigation. We first filter 900 watermarked samples that can be correctly classified. We find ShrinkPad can only filter 87 effective watermarked samples among 900 samples ( $\leq 10\%$ ), i.e., our domain watermark is robust against ShrinkPad.
Robustness against Scale-UP. We also evaluate our method under the most advanced input-level watermark detection (i.e., SCALE-UP [64]). We follow their released code<sup>4</sup> to implement SCALE-UP and use the AUROC score as the metric to report the results. We test our approach on SCALE-UP with 1,000 watermarked and 1,000 benign samples. We here use CIFAR-10 with ResNet-34.
We find that SCALE-UP yields around 0.58 AUROC score on our proposed domain watermark. Such results imply that SCALE-UP can not perform against our domain watermark, with the filtering performance close to random guesses. We think it may be caused by that, different from the previous backdoor-inspired watermark causing misclassification, domain watermark leads the watermarked model correctly classifying the watermarked samples. Therefore, the watermarked samples would have a similar scaled prediction consistency as benign samples, since they all belong to the ground-truth label and can be clustered closely as shown in Section 5.3.2.
Robustness against Neural Cleans. Following previous work [60], we also evaluate our approach against reverse-engineering based approaches [65, 66, 67]. We here evaluate our approach
<sup>4</sup>https://github.com/JunfengGo/SCALE-UP
Figure 19: The reversed trigger maps for each label produced by Neural Cleansse.
Figure 20: The anomaly index for  $\ell_1$ -norm computed on the reversed trigger maps for each label produced by Neural Cleanse.
against Neural Cleansse [67], which is the most widely-adopted approach. We select label 0 as the target label and use CIFAR-10 with ResNet-34. The results are shown in Figure 19-20. We can see the reversed trigger pattern produced by Neural Cleansse for the target label is extremely dense. We further follow [67] to calculate the anomaly index for each label using MAD outlier detection. We find that the target label's anomaly index is smaller than 2, thus it would not be detected.
We notice that there are still many other backdoor defenses (e.g., [68, 69, 70]). We will discuss the resistance of our domain watermark method to them in our future works.
K Can We Identify Domain-watermarked Samples by Training on a Large Dataset or with Complicated Data Augmentation?
In general, our method is developed on the foundation that only models trained on our protected dataset can successfully identify domain-watermarked samples. However, people may worry about whether the suspicious model can also generalize well on domain-watermarked samples because its good training strategies or structures instead of because being trained on the protected dataset. In this section, we discuss this potential problem.
Firstly, we cannot ensure this problem will never happen since training with more samples and complicated data augmentations may indeed increase the general generalizability of suspicious models. However, the probability of it happening is very small in practice, as follows.
- Hardly-generalized domain is an exclusive and special domain where only defenders know what it is. Accordingly, the adversaries (i.e., malicious dataset users) cannot know it and use it to break our verification.
- It is unlikely that a benign user can develop data augmentation that can generate (sufficiently) similar hard samples without knowing our specific settings, since the space of hardly-generalized domain is huge and our watermark is sample-specific and not unique.
- As shown in Figures 2-3 in the main manuscript as well as Figures 5-10 in the Appendix, domain-watermarked samples and not natural and very special. In other words, it is impossible that dataset users can collect them without using our protected dataset. Accordingly,
Table 12: The performance of training with strong data augmentations on the benign dataset.
Dataset↓, Metric→	BA (%)	Accuracy on DW samples (%)	ΔP	p-value
CIFAR-10	91.50	30.15	0.76	1.00
Tiny-ImageNet	75.84	6.00	0.63	1.00
it is not reasonable to claim that a model has good performance on domain-watermarked samples because their dataset is extremely large covering numerous hard samples.
- Lemma 1 indicates that we can find a hardly-generalized domain for the dataset, no matter what the model architecture is. Accordingly, it is not reasonable to claim that a model has good performance on domain-watermarked samples due to its well-designed architecture.
- Currently, no model can have similar generalizability to humans, although it was trained on a huge dataset with complicated data augmentation strategies and a well-designed structure.
- Domain generalization is still an important yet unsolved problem in computer vision. Accordingly, there is no existing method can make DNNs generalize to all unseen domains (with performance on par to that of the source domain) for breaking our method.
- Our hypothesis-testing-based verification process ensures that suspicious models will be treated as trained on our protected dataset only when they have sufficiently high (not just certain) generalizability over a large number (not just a small number) of hard samples. Accordingly, our method can reduce the side effects of randomness to a large extent.
We admit that using data augmentation or other domain adaption techniques may increase the generalization ability of trained DNNs on domain-watermarked samples, although adversaries have no information of hardly-generalized domains and those augmented samples used for training are significantly different from those of domain-watermarked ones. However, this improvement is limited since these adapted domains are significantly different from the hardly-generalized domain (the domain space is high-dimensional and enormous). Accordingly, this mild improvement cannot break our method. To further verify it, we evaluate our method on models with classical automatic data augmentations (e.g., color shifting) and domain adaption in Appendix K.1-K.2.
In particular, it does not diminish the practicality of our method, even if this rare event is likely to happen. Using verification-based defenses (in a legal system) requires an official institute for arbitration. Specifically, all commercial models should be registered here, based on the unique identification (e.g., MD5 code) of their model files and training datasets, before being used online. When this official institute is established, its staff should take responsibility for the verification process. For example, they can require the company to provide the dataset with the same registered identification and then check whether it contains our protected samples (via algorithms). Of course, if the suspect model is proven to be benign, the user will need to pay a settlement to its company to prevent casual malicious ownership verification. In this case, even if our method misclassifies in rare cases, it does not compromise the interest of the suspect model. Our method is practical in this realistic situation, as long as it has a sufficiently high probability of correct verification.
K.1 The Resistance to Data Augmentation
Settings. We adopt strong data augmentations to train models on benign datasets with the same settings used in our paper. Specifically, we adopt random flip, random rotation, random affine transformations, random color shifting as the augmentations on CIFAR-10 and Tiny-ImageNet datasets.
Results. As shown in Table 12, our method will not misjudge (p-value  $\gg 0.05$ ), although data augmentation can (slightly) increase the accuracy on our domain-watermarked samples. These results verify that our method is resistant to data augmentations.
K.2 The Resistance to Domain Adaption
Settings. In this part, we adopt L2D [50] as the representative method to investigate the robustness of our domain watermark against domain adaption techniques. Specifically, we train both the watermarked and benign DNNs with L2D on CIFAR-10 and Tiny-ImageNet datasets.
Table 13: The performance of our domain watermark under training with L2D.
Dataset↓, Metric→	BA (%)	VSR (%)	Accuracy on Other DW samples (%)	H	ˆH
CIFAR-10	91.10	86.10	19.10	-0.14	-0.73
Tiny/ImageNet	48.63	42.00	16.00	0.58	-0.26
Table 14: The verification performance via our domain watermark under training with L2D.
CIFAR-10	Tiny-ImageNet
Independent-D	Independent-M	Malicious	Independent-D	Independent-M	Malicious
ΔP	0.63	0.60	0.05	0.53	0.53	0.07
p-value	0.90	0.71	10-33	0.96	0.95	10-12
Results. As shown in Table 13-14, our method is still highly effective under the domain adaption setting. It is mostly because the VSR improvement caused by domain adaption is mild and therefore cannot fool our verification. Moreover, domain generalization has side effects on the benign accuracy, especially on complicated datasets (e.g., Tiny-ImageNet).
L Reproducibility Statement
In the appendix, we provide detailed descriptions of the datasets, models, training and evaluation settings, and computational facilities. We provide the codes and model checkpoints for reproducing the main experiments of our evaluation in the supplementary material. In particular, we also release our training codes at https://github.com/JunfengGo/Domain-Watermark.
M Societal Impacts
In this paper, we focus on the copyright protection of (open-sourced) datasets. Specifically, we reveal the harmful nature of backdoor-based dataset ownership verification (DOV) and propose the first non-backdoor-based DOV method that is truly harmless. This work has no ethical issues in general since our method is purely defensive and does not reveal any new vulnerabilities of DNNs. However, our method requires a sufficiently large watermarking rate and therefore can not be used to protect a few or a single image. In addition, although our method is resistant to existing adaptive methods, adversaries may try to develop more effective attacks against our DOV method, given the exposure of this paper. People should not be too optimistic about dataset protection.
N Discussions about Adopted Data
In this paper, all adopted samples are from the open-sourced datasets (i.e., CIFAR-10, TinyImageNet, and STL-10). The Tiny-ImageNet dataset may contain a few human-related images. We admit that we modified a few samples for watermarking and verification. However, our research treats all samples the same and the verification samples and modified samples have no offensive content. Accordingly, our work fulfills the requirements of these datasets and has no privacy violation.