Data Taggants: Dataset Ownership Verification Via Harmless Targeted Data Poisoning

## Abstract

Abstract Dataset ownership verification, the process of determining if a dataset is used in a model’s training data, is necessary for detecting unauthorized data usage and data contamination.
Existing approaches, such as backdoor watermarking, rely on inducing a detectable behavior into the trained model and on a part of the data distribution.
However, these approaches have limitations, as they can be harmful to the model’s performance, require unpractical access to the model’s internals.
Furthermore, previous approaches lack guarantee against false positives. This paper introduces data taggants , a novel non-backdoor dataset ownership verification technique, specifically designed for image classification datasets.
Our method uses pairs of out-of-distribution samples and random labels as secret keys , and leverages clean-label targeted data poisoning to subtly alter a dataset so that models trained on this dataset respond to the key samples with the corresponding key labels.
The keys are built as to allow for statistical certificates with black-box access only to the model. We validate our approach through comprehensive experiments on ImageNet1k using ViT and ResNet models with state-of-the-art training recipes.
Our findings demonstrate that data taggants can reliably identify models trained on the protected dataset with high confidence, without compromising validation accuracy.
We show the superiority of our approach over backdoor watermarking in terms of performance and stealthiness.
Furthermore, our method exhibits robustness against various defense mechanisms from data poisoning literature, accross different architectures, and dataset modifications.

## 1 Introduction

An increasing number of machine learning models are deployed or published with limited transparency regarding their training data, raising concerns about their sources.
This lack of transparency hinders the traceability of training data, which is crucial for assessing data contamination and the misuse of open datasets beyond their intended purpose.

Dataset ownership verification approaches aim to equip dataset owners with the ability to track the usage of their data in specific trained models.
Current methods perturb the dataset to mark models trained on it.
The main challenge lies in crafting this dataset perturbation to balance two competing objectives.
On one hand, the perturbation should not significantly degrade performance, preserving the value of training on the data for authorized parties.
On the other hand, the modification should sufficiently alter model behavior to enable high-confidence detection.
These objectives are complemented by the following technical requirements.
First, the detection should *effective* with *strong guarantees* against false positives (models wrongfully detected), making it challenging for dishonest model owners to claim false detection.
Second, the detection should rely on *black-box* model access, ideally top-$k$ predictions for small $k$, to be applicable to models available only through restricted APIs.
Finally, the perturbation should be *stealth* to prevent easy removal by dishonest users, and robust across different model architectures and training recipes.

Previous works either provide strong theoretical guarantees *or* allow for black-box assessments, but not both.
For instance, Radioactive data (Sablayrolles et al., ) emphasized statistical significance testing as the theoretical basis to control false positives.
However, it marked the weights of the last layer of image classifiers, which is not directly amenable to black-box testing.
Conversely, backdoor watermarking methods (Li et al., ; ; Wenger et al., ; Tang et al., ) perturb the dataset to predictably alter model predictions when a trigger pattern $t$ is added to a legitimate image $x$.
However, they fail to provide guarantees on a benign model’s prediction on watermarked samples $x+t$ watermarking methods assume the .
(Guo et al., )

In this paper, we introduce a novel dataset ownership verification approach that enables black-box detection of dishonest models with rigorous theoretical guarantees.
We call this method *data taggants* by analogy to taggants, physical or chemical markers added to materials to trace their usage or manipulation.
Primarily designed for image classification datasets, similarly to most prior works (e.g., Sablayrolles et al. (); Li et al. (); Tang et al. ()),
the main contributions of data taggants are the following:

- •
We transition from *triggers* used in backdoor watermarking, to *keys*. A key is a (pattern, label) pair $(x^{(key)},y^{(key)})$.
Our method adds a “signature” to the dataset (the taggants) to enforce $f(x^{(key)})\approx y^{(key)}$ for every key when model $f$ has been trained on the signed data.(^1^11In the literature on backdoor watermarking such as Souri et al. (), triggers are added to legitimate images. A trigger is a pattern $x^{(trigger)}$ that comes together with a target label $y^{(trigger)}$ and the dataset is altered with the goal of enforcing $f(x^{(legit)}+x^{(trigger)})\approx y^{(trigger)}$ for *every* legitimate image $x^{(legit)}$).
- •
While previous work use *a single* trigger pattern, we use *multiple* keys, with key labels chosen uniformly at random among possible classes.
This randomness enables the use of Binomial significance tests, by checking the proportion of keys for which the top-$k$ predictions contain the key label in response to key patterns, which only requires black-box access to a suspicious model.

Technically, we induce the intended model behavior on the keys using gradient alignment techniques from clean-label data poisoning (Geiping et al., ) augmented with a perceptual loss function. This ensures the stealthiness of the taggants and their effectiveness. As we show in our experiments, this approach is more effective than adding the key patterns in transparency on legitimate images.

We perform experiments on ImageNet1k with vision transformers and ResNet architectures of different sizes, together with state-of-the-art training recipes (Wightman et al., ) including the 3-Augment data augmentation techniques (Touvron et al., ). Our main results are:

- •
Under similar conditions for training the dishonest model and for crafting the data taggants, our approach detects dishonest models with high confidence, given access to only top-$10$ predictions.
- •
We present a robustness “stress test” through an extensive evaluation of taggants by varying the type of data augmentation used, as well as model architectures and sizes, both for crafting the taggants and for the dishonest model. Our results show that our approach is robust to these variations, although overall achieving lower detection confidence than when the conditions are the same.
- •
We explore the stealthiness of taggants using PSNR, out-of-distribution (OOD) detection tests. Additionally, by visual inspection, we observe that the perceptual loss makes taggants less perceptible. Our results also highlight the weakness of OOD approaches based on clustering to detect taggants.

Figure: Figure 1: Application scenario of data taggants. 1 Signing: Alice signs her dataset (adds the taggants corresponding to the keys) before publishing it. 2 Detection: Alice determines if Bob used her dataset by running a statistical test based on Bob’s model’s predictions on the keys.
Refer to caption: x1.png

## 2 Related work

#### Steganography and Watermarking.

Steganography is the practice of concealing a message within content, while watermarking is the process of marking data with a message related to that data (often as a proof of ownership) (Cox et al., ).
They intersect in the contexts where watermarks strive to be imperceptible to avoid content degradation Kahng et al. ().
Recent works have shown that deep learning methods can improve watermarking technology (Vukotić et al., ; Zhu et al., ; Fernandez et al., ).
Furthermore, methods have been developed to watermark both datasets (Guo et al., ) and AI models (Adi et al., ; Fernandez et al., ).
While data watermarks are proofs of ownership like our data taggants, watermarks are not designed to persist through processes that use the data.
In contrast, data taggants leave a mark on models trained on the dataset, in addition, that mark can be retrieved with only black-box access to the model.

#### Dataset Ownership Verification.

Our work, similarly to most works on dataset ownership verification, focuses on image classification datasets as their main use case.
Therefore, we focus the discussion on this case.
An early approach to dataset ownership verification involved the modification of certain images in the dataset to align the last activation layer of a classifier with a random direction (Sablayrolles et al., ).
This method demonstrated success in terms of stealthiness and provided robust theoretical guarantees in a white-box scenario, where access to the weights of the suspicious model is available.
However, in the more realistic black-box scenario, the authors only proposed an indirect approach involving learning a copy of the suspicious model by distillation, which requires a high number of queries.
More recently, attention has shifted towards backdoor watermarking for dataset ownership verification (Li et al., ; ; Wenger et al., ; Tang et al., ; Guo et al., ).
These methods are closer to our black-box approach, although they rely on confidence scores (Li et al., ; ) rather than top-k predictions.
The data is manipulated such that models trained on it alter their confidence scores when a trigger pattern is added to an input image.
From a theoretical perspective, these approaches currently lack robust statistical tests.
Some authors have proposed the computation of p-values (Li et al., ; Tang et al., ), but there is no proof that an honest model satisfies their null hypothesis – that a model not trained on the data should not change its confidence scores or predictions less than a predetermined threshold.
The validity of the test is thus questionable, especially since they do not provide theoretical or empirical support for the choice of the threshold on confidence scores.
In contrast, our approach enables the application of standard statistical tests.

#### Data poisoning.

Our research, akin to prior backdoor watermarking studies, repurposes data poisoning techniques for dataset ownership verification.
Data poisoning originally investigates how subtle changes to training data can compromise a model by malicious actors.
Two main types of data poisoning attacks exist: backdoor attacks, which modify the model’s behavior when a specific trigger is applied to a class of data (Li et al., ; Souri et al., ), and targeted attacks, which induce errors on a specific set of inputs (Shafahi et al., ; Geiping et al., ).
These, in turn, may add incorrectly labeled data Li et al. (; ) to the dataset, which impedes the stealthiness of the approach, or use clean-label modifications (Geiping et al., ).
Previous studies on backdoor watermarking were mostly based on backdoor attacks, attempting to predictably degrade performance when a trigger is introduced to the data.
In contrast, we aim to design models that predict specific key labels in response to key patterns, which is more similar to targeted poisoning attacks – the difference with a poisoning attack being that we alter the behavior on randomly generated patterns rather than legitimate data.
Our algorithmic approach leverages gradient matching techniques developed in the clean-label data poisoning literature, for both targeted and backdoor attacks (Geiping et al., ; Souri et al., ).

#### Membership inference attacks.

The goal of membership inference attacks is to reveal confidential information by inferring which data points were in the training set, usually recognized by low-loss inputs (Shokri et al., ; Watson et al., ).
These methods do not offer any theoretical membership certificate, since a model might have low loss on a sample regardless of whether this sample was actually part of the training set.
They are therefore not applicable to dataset ownership verification.

## 3 Data Taggants

In the application scenario we consider, Alice wants to publish online a dataset $\mathcal{D}_{A}$.
Alice suspects that once $\mathcal{D}_{A}$ is published, Bob will train a model $\mathcal{M}^{B}$ on $\mathcal{D}_{A}$.
Given black-box access (top-$k$ predictions) to Bob’s (future) model $\mathcal{M}^{B}$, Alice wants to mark her dataset in order to determine if $\mathcal{M}^{B}$ has been trained on $\mathcal{D}_{A}$.

We propose a solution to Alice’s problem called data taggants, which alters the dataset to mark models trained on it.
Data taggants uses data poisonning to induce a certain behavior on Bob’s model, and statistical tests to detect if Bob’s model displays said behavior.
To ensure stealthiness, we take inspiration from a clean-label data poisoning, which leaves labels untouched (Geiping et al., ).

### 3.1 Overview

Let us denote Alice’s original dataset by $\mathcal{D}_{A}=(x_{i},y_{i})_{i=1}^{N}\in(\mathcal{X}\times\mathcal{Y})^{N}$ , where $N$ is the number of samples, $\mathcal{X}$ is the set of images and $\mathcal{Y}$ is the set of possible labels. The process of adding data taggants is the following (Figure 1):

- 1.
Alice generates a set of $K$ secret keys: $\mathcal{D}_{(key)}=(x^{(key)}_{i},y^{(key)}_{i})_{i=1}^{K}\in(\mathcal{X}
\times\mathcal{Y})^{K}$;
- 2.
Alice signs her dataset by perturbating the images in a small subset $\mathcal{D}_{S}\subseteq\mathcal{D}_{A}$ of size $S$ called the signing set. The perturbation of images in $\mathcal{D}_{S}$ is called the signature, while data taggants refer to the modified signing set.
- 3.
Alice shares a dataset $\tilde{\mathcal{D}}_{A}$, equal to $\mathcal{D}_{A}$ with the modified $\mathcal{D}_{S}$.

The goal of the taggants is to have models trained on $\tilde{\mathcal{D}}_{A}$ predict $y^{(key)}_{i}$ in response to $x^{(key)}_{i}$, while being stealth so that Bob cannot easily remove it. We first formalize Alice’s goal in an ideal scenario where she knows in advance the details of Bob’s training pipeline and discuss our more practical solution afterwards.
Let us denote by $\mathcal{L}^{B}_{\theta}$ the loss of Bob’s model with parameter $\theta$. We use $t$ to denote a data augmentation sampled according to Bob’s recipe and $\mathbb{E}_{t}[.]$ the expectation over this random sampling.
Alice defines a constrained set of image perturbations $\mathcal{C}=\{\delta\in\mathbb{R}^{d}/\|\delta\|_{\infty}\leq\varepsilon\}$, where $\varepsilon>0$ is kept small to ensure stealthiness. The space of possible signatures is then $\mathcal{C}_{\mathcal{S}}=\{\Delta=(\delta_{j})_{j=1}^{N}\in\mathcal{C}^{N}|
\forall j\notin\mathcal{D}_{S},\delta_{j}=0\}$. Alice aims to find the signature $\Delta$ which minimizes the loss on secret keys of Bob’s model after training on $\tilde{\mathcal{D}}_{A}$. This corresponds to the following bilevel optimization problem:

$$ $\displaystyle\min_{\Delta\in\mathcal{C}_{\mathcal{S}}}\sum_{i=1}^{K}\mathcal{L }^{B}_{\theta^{*}(\Delta)}(x^{(key)}_{i},y^{(key)}_{i})\quad\text{s.t.}\qquad \theta^{*}(\Delta)\in\arg\min_{\theta}\frac{1}{N}\sum_{j=1}^{N}\mathbb{E}_{t} \big{[}\mathcal{L}^{B}_{\theta}(t(x_{j}+\delta_{j}),y_{j})\big{]}.$ (1) $$

Since solving the bilevel optimization problem above is too costly in terms of compute, we use a variant of gradient matching (Geiping et al., ), where the goal is to find $\Delta$ such that, when $\theta\approx\theta^{*}(\Delta)$,
$\displaystyle\frac{1}{K}\sum_{i=1}^{K}\nabla_{\theta}\mathcal{L}^{B}_{\theta}(
x^{(key)}_{i},y^{(key)}_{i})\approx\frac{1}{S}\sum_{j\in\mathcal{D}_{S}}
\mathbb{E}_{t}\big{[}\nabla_{\theta}\mathcal{L}^{B}_{\theta}(t(x_{j}+\delta_{j
}),y_{j})\big{]}.$

In reality, Alice does not know in advance Bob’s training algorithm. There may also be multiple Bobs using different training recipes. Our approach involves a model and a set of data augmentation that Alice uses as a surrogate to Bob’s training pipeline. We later study, in our experiments, the robustness of our approach to variations in Alice and Bob’s models and data augmentations.

### 3.2 Signing the data

The starting point of our approach is that Alice trains a model on her original dataset.
We now give the details of the various steps to craft the taggants. We denote by $\theta^{*}$ the parameters of Alice’s model, and $\mathcal{L}^{A}_{\theta^{*}}$ its loss function.

#### Generating the secret keys.

To prevent from negatively impacting model performances, we choose key images $x^{(key)}_{i}$ to be out-of-distribution data points. More precisely, we generate key images by sampling each pixel value uniformly and sample key labels $y^{(key)}_{i}$ uniformly at random in $\mathcal{Y}$.

#### Parallelized and clean-label perturbations.

We evenly split the signing set into K parts $(\mathcal{D}_{S_{i}})_{i=1}^{K}$, where $\mathcal{D}_{S_{i}}$ is associated to key $i$. Following clean-label data poisoning (Geiping et al., ), each sample $(x_{j},y_{j})$ in $\mathcal{D}_{S_{i}}$ satisfies $y_{j}=y^{(key)}_{i}$. With this split, the taggant optimization problem, described later, is decomposable into one problem for each key, which we solve in parallel.

Figure: Figure 2: Illustration of our method: Alice optimizes image-wise signatures for images in the signing set by maximizing the alignment between the gradients of the signed images $\nabla_{\theta}^{(signed)}$, and the gradient of the key $\nabla_{\theta}^{(key)}$. The resulting images and their labels are the data taggant.
Refer to caption: x2.png

#### Taggant objective function with differentiable data augmentations.

We approximate $\mathbb{E}_{t}\left[\nabla_{\theta}\mathcal{L}^{A}_{\theta^{*}}(t(x_{j}+\delta
_{j}),y_{j})\right]$ by repeating each sample $R$ times, applying $R$ randomly sampled data augmentations $t_{r},r\in\{1,\ldots,R\}$, and averaging the resulting gradients. We use differentiable versions of common data augmentations to optimize through them. The taggant objective function $\mathcal{T}(\Delta)$ is illustrated in Figure 2, computes the perturbation by aligning the gradients of the keys with the gradient of perturbed images. More precisely, $\mathcal{T}(\Delta)=\sum_{i=1}^{K}\mathcal{T}_{i}$ with:

$$ $\displaystyle\mathcal{T}_{i}(\Delta)=-\cos\Big{(}\nabla_{\theta}\mathcal{L}^{A }_{\theta}(x^{(key)}_{i},y^{(key)}_{i}),\sum\limits_{j\in\mathcal{D}_{S_{i}}} \frac{1}{R}\sum\limits_{r=1}^{R}\nabla_{\theta}\mathcal{L}^{A}_{\theta}(t_{r}( x_{j}+\delta_{j}),y_{j})\Big{)}$ (2) $$

#### Perceptual loss.

To improve the stealthiness of our approach, we add a term of differentiable perceptual loss $\mathcal{L}_{perc}$ to the taggant function, using the LPIPS metric Zhang et al. (), which relies on the visual features extracted by a VGG model.
Given a weight $\lambda$ for $\mathcal{L}_{perc}$, the final optimization problem for taggants is
$\min\limits_{\Delta\in\mathcal{C}_{\mathcal{S}}}\frac{1}{K}\sum_{i=1}^{K}
\mathcal{T}_{i}(\Delta)+\lambda\mathcal{L}_{perc}(\Delta)$.

#### Random Restarts.

Since the problem is non-convex, the algorithm may be trapped in local minima. In practice, we observed that using multiple random restarts of initial signatures for each key improved performance. We chose the best according to the taggant objective function.

### 3.3 Detection

The detection phase ( 2 in Figure 1) relies on checking a suspicious model’s predictions on the secret keys. In order to control for false positives, we determine the key accuracy of an honest model.

#### Null hypothesis.

Our null hypothesis is $\mathcal{H}_{0}$: “model $h$ was not trained on the signed dataset”.
Given the set of keys $\mathcal{D}_{K}$ where the key labels are chosen uniformly at random, under the null hypothesis, model $h$ cannot have better-than-chance probability of predicting $y^{(key)}_{i}$ given $x^{(key)}_{i}$.

Let us denote by $\text{top-}k(h,\mathcal{D}_{K})$ the number of keys $i$ for which $y^{(key)}_{i}$ is in the top-$k$ predictions for $x^{(key)}_{i}$. Under the null hypothesis, $\text{top-}k(h,\mathcal{D}_{K})$ follows a binomial distribution of parameter $k/|\mathcal{Y}|$ where $|\mathcal{Y}|$ is the number of possible labels. The p-value of the binomial test is then given by the tail of a random variable $Z$ following a binomial distribution with parameters $\text{Binomial}(K,k/|\mathcal{Y}|)$:

$$ $\displaystyle\text{p-value}\big{(}\text{top-}k(h,\mathcal{D}_{K})\big{)}= \mathbb{P}(Z\geq\text{top-}k(h,\mathcal{D}_{K}))=\sum_{z=\text{top-}k(h, \mathcal{D}_{K})}^{K}\binom{K}{z}\Big{(}\frac{k}{|\mathcal{Y}|}\Big{)}^{z}\Big {(}\frac{|\mathcal{Y}|-k}{|\mathcal{Y}|}\Big{)}^{K-z}$ $$

This test only requires top-$k$ predictions, which are often available in black-box scenarios (e.g., restricted API access to the model).

## 4 Experiments

In this section, we empirically evaluate the effectiveness, stealthiness, and robustness of data taggants.

#### Experimental setup.

We use ImageNet1k (Deng et al., ) with Vision Transformers (DeIT) and Residual Networks (ResNet) models with different sizes and state-of-the-art training recipes from Wightman et al. () and Touvron et al. () (see Appendix A.2 for details).
When generating taggants, the signing sets’ sizes use a budget $B$ of the total dataset size, $S=B\times N$, with $B=10^{-3}$ unless stated otherwise.
We generate 20 secret keys, using 8 random restart per key and keep the 10 best keys according to the taggant objective function.
The weight of the perceptual loss is fixed to $\lambda=0.01$.
These parameters were chosen in preliminary experiments and fixed afterwards.
$\varepsilon$ in the constraint set $\mathcal{C}$ is fixed to $16/255$, a common value in the data poisoning literature.

In each experiment, we train one model for Alice and run the detection test on 4 repetitions of Bob’s training 4 using different random initializations to compute standard deviations.
Similarly to Sablayrolles et al. (), we combine the p-values of the 4 tests with Fisher’s method Fisher ().
The result is denoted $\log_{10}p$ and is commensurable to the base-10 logarithm of a p-value.
Given the large number of experiments, we train all models for 100 epochs to save compute, even though the best performances for DeIT are achieved after 800 epochs.
As sanity check, we confirm with a run of 800 epochs that the effectiveness results hold.
The results are in Table 9 in Appendix A.1.

**Table 1: Validation accuracy and detection performance when both Alice and Bob use DeIT-small models with the three-augment data augmentation and various budgets.**
| Method | Budget<br>$B$ | Validation<br>accuracy | Top-$k$ keys accuracy | PSNR |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| $k=1$ | $\log_{10}p$ | $k=10$ | $\log_{10}p$ |  |  |  |  |
| Clean training | $0.0\%$ | $\mathbf{64.2\pm 0.4}$ | - | - | - | - | - |
| Naive Canary | $0.001\%$ | $63.4\pm 0.7$ | $7.5\pm 5.0$ | (-3.3) | $10.0\pm 0.0$ | ( -1.8) | - |
| $0.01\%$ | $\mathbf{64.2\pm 0.3}$ | $15.0\pm 10.0$ | (-9.2) | $\mathbf{100.0\pm 0.0}$ | (-74.0) | - |  |
| $0.1\%$ | $63.8\pm 1.1$ | $85.0\pm 19.1$ | (-91.7) | $\mathbf{100.0\pm 0.0}$ | (-74.0) | - |  |
| Transparency | $0.001\%$ | $63.5\pm 1.0$ | $7.5\pm 5.0$ | (-3.3) | $10.0\pm 0.0$ | ( -1.8) | $20.0$ |
| $0.01\%$ | $63.4\pm 0.7$ | $7.5\pm 5.0$ | (-3.3) | $10.0\pm 0.0$ | ( -1.8) | $20.0$ |  |
| $0.1\%$ | $63.6\pm 0.6$ | $10.0\pm 0.0$ | (-4.9) | $\mathbf{55.0\pm 5.8}$ | (-29.7) | $20.0$ |  |
| Data taggants<br>(Our method) | $0.001\%$ | $63.7\pm 0.9$ | $0.0\pm 0.0$ | (0.0) | $0.0\pm 0.0$ | (0.0) | $26.6$ |
| $0.01\%$ | $63.6\pm 0.9$ | $0.0\pm 0.0$ | (0.0) | $5.0\pm 5.8$ | (-0.5) | $27.3$ |  |
| $0.1\%$ | $\mathbf{64.2\pm 0.6}$ | $10.0\pm 0.0$ | (-4.9) | $\mathbf{87.5\pm 5.0}$ | (-59.6) | $\mathbf{27.9}$ |  |

**Table 2: Comparison of keys sources (test data *vs* random) when both Alice and Bob use DeIT-small models with the three-augment data augmentation and various budgets.**
| Key<br>source | Budget<br>$B$ | Validation<br>accuracy | Top-$k$ keys accuracy | PSNR |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| $k=1$ | $\log_{10}p$ | $k=10$ | $\log_{10}p$ |  |  |  |  |
| None | $0.0\%$ | $64.2\pm 0.4$ | - | - | - | - | - |
| Test images | $0.001\%$ | $63.7\pm 0.4$ | $0.0\pm 0.0$ | (0.0) | $7.5\pm 5.0$ | (-1.1) | $27.5$ |
| $0.01\%$ | $63.4\pm 1.0$ | $0.0\pm 0.0$ | (0.0) | $0.0\pm 0.0$ | ( 0.0) | $27.9$ |  |
| $0.1\%$ | $63.9\pm 0.6$ | $0.0\pm 0.0$ | (0.0) | $27.5\pm 5.0$ | (-10.4) | $28.4$ |  |
| Random<br>(Our method) | $0.001\%$ | $63.7\pm 0.9$ | $0.0\pm 0.0$ | (0.0) | $0.0\pm 0.0$ | ( 0.0) | $26.6$ |
| $0.01\%$ | $63.6\pm 0.9$ | $0.0\pm 0.0$ | (0.0) | $5.0\pm 5.8$ | (-0.5) | $27.3$ |  |
| $0.1\%$ | $64.2\pm 0.6$ | $10.0\pm 0.0$ | (-4.9) | $87.5\pm 5.0$ | (-59.6) | $27.9$ |  |

### 4.1 Effectiveness

We first compare the effectiveness of data taggants to two baselines.
First,
“naive canary”, where copies of the private keys are added into the training set.
This serves as a topline in terms of detection performance, but it is not viable as tracing mechanism since it is not stealth at all.
Second,
“transparency”, where we linearly interpolate between the keys and images of the signing set with a weight $\gamma=0.2$, $x^{\prime}=\gamma x^{(key)}+(1-\gamma)x$.
This value for $\gamma$ was chosen by visual inspection, as a small value for which the key is still visible.
In this comparison, we use DeIT-small models with the three-augment (3A) data augmentation (Touvron et al., ) for Alice and Bob, with three different budgets $B$, $0.1\%$, $0.01\%$ and $0.001\%$.

The results are given in Table 1 (more results can be found in Table 7 in Appendix). First, we observe that all methods have roughly the same validation acuracy as a model trained on clean data (differences within noise). In particular, this suggests that our taggants do not negatively impact model performances at these budget levels.
In terms of detection, Naive canary works best as expected, with perfect key top-10 accuracy for $B\geq 0.01\%$. While Transparency works better than data taggants for smaller budgets, data taggants has much higher top-10 accuracy for $B=0.1\%$ ($87.5\%$ *vs* $55.0\%$). In addition, the PSNR (signal to noise ratio) is lower for transparency, which suggests that with a budget as small as $0.1\%$, data taggants already dominate the transparency baseline in this experimental setting, and are able to detect dishonest models with very high confidence ($\log_{10}p=-59.6$).

We perform an additional comparison with another baseline where test data points are used as keys rather than random patterns, which is similar to repurposing a data poisoning attack to dataset ownership verification. Table 2 shows the results. With comparable PSNR, using random keys leads to much better detection accuracy and confidence for $B=0.1\%$ than using test data, justifying our design choice.

### 4.2 Stealthiness

The stealthiness of data taggants is essential but difficult to measure beyond PSNR.
As a best effort, we address the scenario where Bob tries to locate the signed data using either visual inspection, or, following (Tang et al., ), using anomaly detection algorithms. Similarly to the previous section, we use taggants crafted by DeIT-small using 3A augmentation, with a budget $B=0.1\%$.

#### Visual inspection.

We provide examples of taggants crafted with and without perceptual loss in Figure 3 (more examples are given in Figure 5, 6 and 7 in Appendix A.1).
We observe that while most of them appear unaltered, some of them display visible patterns of weak intensity that could as well come from natural film grain. Although with PSNR ¡ 30 dB (see Table 1) which is considered low according to image processing standards, we believe that the data taggants are reasonably stealth against visual inspection, particularly when Bob has to find them among a whole dataset.

Figure: vanilla

#### Anomaly detection.

Most methods for out-of-distribution (OOD) detection (Chen et al., ) rely on training a model on a set of in-lier data to then be able to detect outliers. Here, even though in reality Bob does not have access to the original clean data, we consider a topline detection scenario where Bob has access to a “clean” model, i.e., a model trained on Alice’s original dataset and knows which classes contain data taggants when using OOD detection algorithms.

We consider two off-the-shelf OOD detection algorithms, the first one using k-NN (Kuan & Mueller, ) from the cleanlab project(^2^22[https://github.com/cleanlab/cleanlab](https://github.com/cleanlab/cleanlab)), and the clustering method DBSCAN (Schubert et al., ) from the scikit-learn project(^3^33[https://scikit-learn.org/stable/index.html](https://scikit-learn.org/stable/index.html)).
Both methods use the features computed from the clean model.

The results are given in Figure 4. We observe that neither method detect data taggants – less than $1.1\%$ taggant detection rate for the best setting of $k$ in k-NN, when considering the top-1000 samples with highest outlier scores. Interestingly, when computing DBSCAN for different detection thresholds (Figure 4 (b)), we observe that DBSCAN exhibit performances that are significantly worse than random. Our explanation is that DBSCAN computes clusters and select outliers as isolated points or clusters. By manually analyzing the clusters, we observe that some of them contain a lot of data taggants, most likely because their embeddings are lumped together and do not appear as anomalies.

On the one hand, these results suggest that OOD detection based on clustering is not a proper approach to detect the taggants. It suggests however that if Bob has sufficient resources, he may try to manually locate clusters of signed images by visual inspection, which is less costly than inspecting individual images. We leave this direction as an open question for future work.

#### Data poisoning detection.

Since data taggants rely on a data poisoning mechanism, we suggest to use data poisoning detection methods to detect data taggants.
Table 3 shows the percentage of data taggants detected as outliers by three data poisoning detection methods: Deep k-NN, Activation Clustering and Spectral Clustering.
The results show that data taggants cannot be detected by these methods, which suggests for strong stealthiness of data taggants.

**Table 3: Percentage of total data and data taggants detected as outliers by data poisoning detection methods.**
| Method | % of total data detected | % of data taggants detected |
| --- | --- | --- |
| Deep k-NN | $7.7$ | $6.9$ |
| Activation Clustering | $51.2$ | $48.7$ |
| Spectral Clustering | $10.8$ | $12.7$ |

Figure: (a) k-NN
Refer to caption: extracted/5911179/assets/knn_stealth.png

### 4.3 Robustness

For a fixed model and training algorithm, Table 1 and 2 already show the robustness of our method to a complete model retraining. But for our method to be practical, we need to ensure it will be robust when Bob’s model or training algorithm is different from Alice’s.

#### Different data augmentations.

Table 4 (and Table 8 in Appendix A.1) shows how even when Alice does not know Bob’s data augmentations, she can still successfully trace her dataset usage through Bob’s training, even though with much higher confidence when the same data augmentation is used by both Alice and Bob.

**Table 4: Robustness to data augmentation change. Alice does not know Bob’s data augmentations and use either the Simple Augment or the Three Augment recipe.**
| Bob’s<br>data aug. | Alice’s<br>data aug. | Validation<br>accuracy | Top-$k$ keys accuracy |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| $k=1$ | $\log_{10}p$ | $k=10$ | $\log_{10}p$ |  |  |  |
| SA | SA | $58.1\pm 0.3$ | $57.5\pm 9.6$ | (-54.2) | $100.0\pm 0.0$ | (-74.0) |
| 3A | $56.1\pm 0.3$ | $1.7\pm 4.1$ | ( 0.0) | $15.0\pm 8.4$ | ( -1.8) |  |
| 3A | SA | $64.1\pm 0.6$ | $2.5\pm 5.0$ | (-0.5) | $32.5\pm 12.6$ | (-13.8) |
| 3A | $64.0\pm 0.5$ | $10.0\pm 0.0$ | (-4.9) | $87.5\pm 5.0$ | (-59.6) |  |

#### Robustness “stress test”: different model architectures and data augmentation.

We finally explore the robustness of data taggants in the most difficult setting, where Alice and Bob use different model architecture or sizes (see Table 11 in Appendix), as well as different data augmentations.
We consider two families of models (DeIT and ResNet) of various sizes.
We measure intra-family transferability by validating the protected dataset generated from each model onto each other model of the same family (DeIT and ResNet).
We also measure inter-family transferability by crafting a protected dataset with ResNet-18 and DeIT-tiny models and validating it on all the models of the other family (resp. DeIT and ResNet). The results are shown in Table 5. Overall, we see good intra-family transferability, with larger DeIT models being more sensitive to taggants than smaller DeIT models. Interestingly, the trend is reversed for ResNets, with smaller ResNets being more sensitive. Across architectures, DeIT-tiny to ResNets or ResNets to DeIT-tiny, the results are less conclusive even though the top-10 accuracy is still $>0$. All in all, these results suggest that the taggants are robust even in this worst-case scenario, but getting high-confidence when Alice and Bob use different architectures and data augmentations is an interesting avenue for future work.

**Table 5: Stress test: Results of our method when Alice and Bob train two different architectures and different data augmentations. Alice uses SA data augmentations and Bob uses 3A.**
| Bob’s<br>model | Alice’s<br>model | Validation<br>accuracy | Top-$k$ keys accuracy |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| $k=1$ | $\log_{10}p$ | $k=10$ | $\log_{10}p$ |  |  |  |
| DeIT-medium | DeIT-medium | $67.2\pm 1.3$ | $2.5\pm 5.0$ | (-0.5) | $47.5\pm 9.6$ | (-24.0) |
| DeIT-small | $67.7\pm 1.0$ | $5.0\pm 5.8$ | (-1.7) | $60.0\pm 8.2$ | (-33.8) |  |
| DeIT-tiny | $67.6\pm 0.7$ | $10.0\pm 0.0$ | (-4.9) | $52.5\pm 12.6$ | (-28.0) |  |
| ResNet-18 | $67.0\pm 0.8$ | $0.0\pm 0.0$ | ( 0.0) | $10.0\pm 0.0$ | ( -1.8) |  |
| DeIT-small | DeIT-medium | $64.5\pm 0.6$ | $0.0\pm 0.0$ | ( 0.0) | $22.5\pm 9.6$ | ( -7.8) |
| DeIT-small | $64.1\pm 0.6$ | $2.5\pm 5.0$ | (-0.5) | $32.5\pm 12.6$ | (-13.8) |  |
| DeIT-tiny | $63.7\pm 1.0$ | $7.5\pm 5.0$ | (-3.3) | $37.5\pm 9.6$ | (-16.9) |  |
| ResNet-18 | $64.3\pm 0.6$ | $0.0\pm 0.0$ | ( 0.0) | $10.0\pm 0.0$ | ( -1.8) |  |
| DeIT-tiny | DeIT-medium | $53.8\pm 0.4$ | $2.5\pm 5.0$ | (-0.5) | $10.0\pm 0.0$ | ( -1.8) |
| DeIT-small | $53.9\pm 0.5$ | $0.0\pm 0.0$ | ( 0.0) | $12.5\pm 5.0$ | ( -2.8) |  |
| DeIT-tiny | $54.3\pm 0.6$ | $2.5\pm 5.0$ | (-0.5) | $12.5\pm 5.0$ | ( -2.8) |  |
| ResNet-18 | $53.5\pm 0.5$ | $0.0\pm 0.0$ | ( 0.0) | $7.5\pm 5.0$ | ( -1.1) |  |
| ResNet-50 | ResNet-18 | $78.0\pm 0.1$ | $5.0\pm 5.8$ | (-1.7) | $15.0\pm 5.8$ | ( -3.9) |
| ResNet-34 | $77.9\pm 0.1$ | $7.5\pm 5.0$ | (-3.3) | $12.5\pm 5.0$ | ( -2.8) |  |
| ResNet-50 | $77.9\pm 0.1$ | $2.5\pm 5.0$ | (-0.5) | $37.5\pm 27.5$ | (-18.5) |  |
| DeIT-tiny | $77.8\pm 0.2$ | $2.5\pm 5.0$ | (-0.5) | $12.5\pm 5.0$ | ( -2.8) |  |
| ResNet-34 | ResNet-18 | $74.2\pm 0.1$ | $7.5\pm 5.0$ | (-3.3) | $52.5\pm 20.6$ | (-28.6) |
| ResNet-34 | $74.1\pm 0.1$ | $10.0\pm 0.0$ | (-4.9) | $30.0\pm 8.2$ | (-12.0) |  |
| ResNet-50 | $74.1\pm 0.1$ | $7.5\pm 9.6$ | (-3.5) | $62.5\pm 31.0$ | (-38.2) |  |
| DeIT-tiny | $74.2\pm 0.1$ | $10.0\pm 0.0$ | (-4.9) | $10.0\pm 0.0$ | ( -1.8) |  |
| ResNet-18 | ResNet-18 | $69.8\pm 0.1$ | $7.5\pm 5.0$ | (-3.3) | $55.0\pm 31.1$ | (-32.0) |
| ResNet-34 | $69.9\pm 0.2$ | $7.5\pm 5.0$ | (-3.3) | $22.5\pm 15.0$ | ( -8.1) |  |
| ResNet-50 | $69.8\pm 0.1$ | $7.5\pm 5.0$ | (-3.3) | $55.0\pm 23.8$ | (-30.9) |  |
| DeIT-tiny | $69.8\pm 0.2$ | $5.0\pm 5.8$ | (-1.7) | $10.0\pm 0.0$ | ( -1.8) |  |

#### Limitations and future work.

This article presents a dataset ownership verification approach that marks a trained model.
Current results show a slight degradation in validation accuracy compared to training on the clean dataset, which future works should try to reduce.
While we show the robustness of our method through different transferability results against different model architectures and training recipe, further experiments would be required to evaluate the effectiveness of our approach when Bob trains his model on a subset or a superset of our protected dataset.
Particularly, future work should study the efficiency of our method when Bob trains his model on an aggregate of different datasets containing data taggants.

## 5 Conclusion

We proposed data taggants, a new approach to dataset ownership verification and designed mostly for image classification datasets. Data taggants are hidden in a dataset through gradient matching, in order to mark models trained on them. Our approach shows promising results, with very high detection confidence of dishonest models in favorable settings, without affecting classification performance.

We highlight the difficulty of assessing stealthiness, a challenge that is likely faced by other related domains such as data poisoning and adversarial examples.
Through extensive robustness tests, we also show the relevance of data taggants in difficult settings, and identify promising avenues for future work such as designing taggants that robustly mark models across large variations in training settings.

## Appendix A Appendix

### A.1 Ablations

#### Visual inspections.

We show, in Figure 5, randomly chosen samples of data taggants generated with and without perceptual loss.

Figure: Figure 5: Comparison of data taggants generated without (top) and with perceptual loss (bottom). The images were sampled randomly.
Refer to caption: extracted/5911179/assets/appendix_comp/poison_981216.png

#### Comparison of the perceptual loss with weight decay.

We ensure that the gain in PSNR offered by the perceptual loss is not simply due to it reducing the perturbation amplitudes.
Figure 6 compare data taggants generated with perceptual loss, with weight decay on the perturbation (replacing the perceptual loss term by the norm 2 of the perturbation $\|\delta_{i}\|^{2}_{2}$), and with their vanilla counterpart.
It shows that for a similar PSNR, the perceptual loss plays an important role in hiding the signature.

Figure: (a) vanilla $\text{PSNR}=27.6\text{dB}$.
Refer to caption: extracted/5911179/assets/no_perc_sign.png

#### Clean performances.

We report clean performances in Table 6. This shows that the loss of accuracy is minimal when we train the model on data taggants.

**Table 6: Validation accuracies for clean training of the different models and data augmentations used.**
| Data aug. | Model | Validation accuracy |
| --- | --- | --- |
| SA | DeIT-small | $56.1\pm 0.5$ |
| 3A | DeIT-medium | $67.3\pm 1.1$ |
| DeIT-small | $64.2\pm 0.4$ |  |
| DeIT-tiny | $53.6\pm 0.4$ |  |
| ResNet-50 | $77.9\pm 0.0$ |  |
| ResNet-34 | $74.1\pm 0.0$ |  |
| ResNet-18 | $69.6\pm 0.0$ |  |

#### Baselines.

Similarly to our experiments, we report in Table 7, the validation accuracies and keys accuracies for our method and different baselines for keys sampled randomly or among the test set.

**Table 7: Comparison of our data taggants for 10 keys against baselines for a ViT-small trained on ImageNet1k with the 3A recipe with various budgets. Averaged over 4 validation training runs each with different validation model’s initialization. Errors represent the standard deviation.**
| Key<br>source | Method | Budget<br>$B$ | Validation<br>accuracy | Top-$k$ keys accuracy | PSNR |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| $k=1$ | $\log_{10}p$ | $k=10$ | $\log_{10}p$ |  |  |  |  |  |
| None | Clean training | $0.0\%$ | $64.2\pm 0.4$ | - | - | - | - | - |
| Test<br>data | Naive Canary<br>(Label Flipping) | $0.001\%$ | $63.8\pm 0.5$ | $0.0\pm 0.0$ | (0.0) | $0.0\pm 0.0$ | (0.0) | - |
| $0.01\%$ | $64.2\pm 0.7$ | $57.5\pm 5.0$ | (-54.0) | $97.5\pm 5.0$ | (-71.0) | - |  |  |
| $0.1\%$ | $63.6\pm 1.0$ | $100.0\pm 0.0$ | (-113.4) | $100.0\pm 0.0$ | (-74.0) | - |  |  |
| Transparency | $0.001\%$ | $64.2\pm 1.1$ | $0.0\pm 0.0$ | (0.0) | $0.0\pm 0.0$ | (0.0) | $20.0$ |  |
| $0.01\%$ | $63.2\pm 0.5$ | $0.0\pm 0.0$ | (0.0) | $0.0\pm 0.0$ | (0.0) | $20.0$ |  |  |
| $0.1\%$ | $63.7\pm 0.6$ | $0.0\pm 0.0$ | (0.0) | $0.0\pm 0.0$ | (0.0) | $20.0$ |  |  |
| Data taggants | $0.001\%$ | $63.7\pm 0.4$ | $0.0\pm 0.0$ | (0.0) | $7.5\pm 5.0$ | (-1.1) | $27.5$ |  |
| $0.01\%$ | $63.4\pm 1.0$ | $0.0\pm 0.0$ | (0.0) | $0.0\pm 0.0$ | (0.0) | $27.9$ |  |  |
| $0.1\%$ | $63.9\pm 0.6$ | $0.0\pm 0.0$ | (0.0) | $27.5\pm 5.0$ | (-10.4) | $28.4$ |  |  |
| Random<br>data | Naive Canary | $0.001\%$ | $63.4\pm 0.7$ | $7.5\pm 5.0$ | (-3.3) | $10.0\pm 0.0$ | ( -1.8) | - |
| $0.01\%$ | $64.2\pm 0.3$ | $15.0\pm 10.0$ | (-9.2) | $100.0\pm 0.0$ | (-74.0) | - |  |  |
| $0.1\%$ | $63.8\pm 1.1$ | $85.0\pm 19.1$ | (-91.7) | $100.0\pm 0.0$ | (-74.0) | - |  |  |
| Transparency | $0.001\%$ | $63.5\pm 1.0$ | $7.5\pm 5.0$ | (-3.3) | $10.0\pm 0.0$ | ( -1.8) | $20.0$ |  |
| $0.01\%$ | $63.4\pm 0.7$ | $7.5\pm 5.0$ | (-3.3) | $10.0\pm 0.0$ | ( -1.8) | $20.0$ |  |  |
| $0.1\%$ | $63.6\pm 0.6$ | $10.0\pm 0.0$ | (-4.9) | $55.0\pm 5.8$ | (-29.7) | $20.0$ |  |  |
| Data taggants<br>(Our method) | $0.001\%$ | $63.7\pm 0.9$ | $0.0\pm 0.0$ | (0.0) | $0.0\pm 0.0$ | (0.0) | $26.6$ |  |
| $0.01\%$ | $63.6\pm 0.9$ | $0.0\pm 0.0$ | (0.0) | $5.0\pm 5.8$ | (-0.5) | $27.3$ |  |  |
| $0.1\%$ | $64.2\pm 0.6$ | $10.0\pm 0.0$ | (-4.9) | $87.5\pm 5.0$ | (-59.6) | $27.9$ |  |  |

Figure: (a) Key image $x^{(key)}$
Refer to caption: extracted/5911179/assets/appendix_baselines/key.png

#### Robustness to data augmentation changes.

**Table 8: Robustness to data augmentation change. Alice does not know Bob’s data augmentations and use either the Simple Augment or the Three Augment recipe. We compare our method with keys chosen from test data. $B=10^{-3}$.**
| Alice’s<br>data aug. | Bob’s<br>data aug. | Key<br>source | Validation<br>accuracy | Top-$k$ keys accuracy |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| $k=1$ | $\log_{10}p$ | $k=10$ | $\log_{10}p$ |  |  |  |  |
| SA | SA | Random | $\mathbf{58.1\pm 0.3}$ | $\mathbf{57.5\pm 9.6}$ | (-54.2) | $\mathbf{100.0\pm 0.0}$ | (-74.0) |
| Test data | $56.2\pm 0.6$ | $15.0\pm 17.3$ | (-9.9) | $60.0\pm 14.1$ | (-34.2) |  |  |
| SA | 3A | Random | $\mathbf{64.1\pm 0.6}$ | $\mathbf{2.5\pm 5.0}$ | (-0.5) | $\mathbf{32.5\pm 12.6}$ | (-13.8) |
| Test data | $63.9\pm 1.1$ | $0.0\pm 0.0$ | ( 0.0) | $2.5\pm 5.0$ | ( -0.1) |  |  |
| 3A | SA | Random | $56.1\pm 0.3$ | $1.7\pm 4.1$ | ( 0.0) | $15.0\pm 8.4$ | ( -1.8) |
| Test data | $56.1\pm 0.4$ | $0.0\pm 0.0$ | ( 0.0) | $\mathbf{16.0\pm 5.5}$ | ( -3.9) |  |  |
| 3A | 3A | Random | $\mathbf{64.0\pm 0.5}$ | $\mathbf{10.0\pm 0.0}$ | (-4.9) | $\mathbf{87.5\pm 5.0}$ | (-59.6) |
| Test data | $63.9\pm 0.6$ | $0.0\pm 0.0$ | ( 0.0) | $27.5\pm 5.0$ | (-10.4) |  |  |

#### Result for 800 epochs training.

To ensure that the effects of our data taggants are still observed even during a full training, Table 9 reports the top-$k$ keys accuracies and associated p-values for a complete training of 800 epochs for random keys and keys taken from the test data when Alice and Bob both use the 3A data augmentation. Our method displays better performances of detection for the same validation accuracy.

**Table 9: Results for a complete training of a deit-small for 800 epochs and comparison with keys chosen from test data. $B=10^{-3}$.**
| Key<br>source | Validation<br>accuracy | Top-$k$ keys accuracy |  |  |  |
| --- | --- | --- | --- | --- | --- |
| $k=1$ | $\log_{10}p$ | $k=10$ | $\log_{10}p$ |  |  |
| Random data | $79.4\pm 0.2$ | $\mathbf{10.0\pm 0.0}$ | (-4.9) | $\mathbf{85.0\pm 10.0}$ | (-57.2) |
| Test data | $79.4\pm 0.3$ | $0.0\pm 0.0$ | ( 0.0) | $0.0\pm 0.0$ | ( 0.0) |

### A.2 Experimental details

#### Computational resources.

All our experiments ran on 16GB and 32GB V100 GPUs.
The different steps took the following time:

- •
Initial training: 14h-16h
- •
Data taggants generations: 2h-8h
- •
Validation training: 14h-16h

We estimate the total computation time for this project (including preliminary runs) at around 150k GPU-hours.

#### Models and training recipes.

We present here the list of models used and their size and number of parameters

**Table 10: Models and sizes.**
| Model | # params. |
| --- | --- |
| ViT-tiny | 5.46 M |
| ViT-small | 21.04 M |
| ViT-medium | 37.05 M |
| ViT-base | 82.57 M |
| ResNet-18 | 11.15 M |
| ResNet-34 | 20.79 M |
| ResNet-50 | 24.37 M |
| ResNet-101 | 42.49 M |

**Table 12: Training recipe**
| Family | DeIT | ResNet |
| --- | --- | --- |
| Reference | (Touvron et al., ) | (Wightman et al., ) |
| Batch size | 2048 | 2048 |
| Optimizer | LAMB | LAMB |
| LR | $3.10^{-3}$ | $8.10^{-3}$ |
| LR decay | cosine | cosine |
| Weight decay | 0.02 | 0.02 |
| Warmup epochs | 5 | 5 |
| Dropout | ✗ | ✗ |
| Stoch. Depth | ✓ | ✓ |
| Repeated Aug | ✓ | ✗ |
| Gradient Clip. | 1.0 | 1.0 |
| LayerScale | ✓ | ✗ |
| Loss | BCE | BCE |

## Peer Reviews

confidence: 4
contribution: 3
initial_rating: 6
presentation: 3
questions: 1. How does the method defend against an adversary who knows the exact verification technique?
2. Why was 0.1% chosen as the modification budget, and how sensitive is the method to this choice?
3. Have you investigated potential negative effects on downstream tasks?
soundness: 3
strengths: 1. Use out-of-distribution samples as keys is quite novel.
2. Provides stronger statistical guarantees than previous work.
3. Well-structured methodology presentation.
summary: This paper introduces data taggants, a novel non-backdoor dataset ownership verification technique that helps detect if machine learning models were trained using a specific dataset. Unlike previous approaches that rely on backdoor watermarking, data taggants use pairs of out-of-distribution samples and random labels as secret keys, and employs clean-label targeted data poisoning to subtly alter a small portion (0.1%) of the dataset. When models are trained on the protected dataset, they respond to these key samples with corresponding key labels, allowing for statistical verification with only black-box access to the model. The authors validate their approach through comprehensive experiments on ImageNet1k using Vision Transformer and ResNet models, demonstrating that data taggants can reliably detect models trained on the protected dataset with high confidence, without compromising validation accuracy. The method proves to be stealthy, robust against various defense mechanisms, and effective across different model architectures and training recipes. It also provides stronger theoretical guarantees against false positives compared to previous approaches.
weaknesses: 1. Lacks formal security analysis against adaptive attacks.
2. No investigation of downstream task impacts

---

confidence: 4
contribution: 3
initial_rating: 5
presentation: 3
questions: - Optimization is done only w.r.t. fully trained model parameters. Yet, the goal of the gradient matching is to make training a model from scratch on Taggants equivalent to training it on Keys. Why are some randomly initialized models not included? Do you have insight why despite this, the surrogate objective seems to work? 
- How should tau=0 on ln317 be interpreted? If I understand correctly, this means all models with non-zero accuracy on Keys are flagged?
soundness: 2
strengths: - DOV is an important problem, and authors explicitly focus on realistic setups and often overlooked aspects such as the rigor of stated guarantees that accompany methods.
- The method is original within the space of DOV. The idea of repurposing witches brew and introducing random data sampling to strengthen the theoretical guarantees is very interesting and unexpected. 
- Evaluation focuses on a large-scale practical setup and addresses many important points, evaluating stealthiness and robustness explicitly. I appreciate the inclusion of poisoning defenses and OOD detection. 
- Setting the scope of evaluation aside (see below), the provided results seem quite strong.
- The paper is mostly well-written and easy to read, with some exceptions discussed below.
summary: The paper proposes an active dataset ownership verification (DOV) method, by adapting a technique for targeted data poisoning from prior work. The key advantages of the proposed approach are its applicability given only top-k black-box access, more principled/rigorous statistical certificates compared to prior work, stealthiness, and robustness to different setups as well as explicit defenses. All these properties are validated via thorough experimental evaluation.
weaknesses: I can identify several important weaknesses of the work in its current state, and provide suggestions how these could be improved:
- **Incomplete evaluation/related work positioning**: While DOV is a crowded space and many baselines are cited in the paper, only two are run in the experimental part, without clear rationale, and the relationship to prior methods is in my view not clearly presented in the paper. For example, while the position of the paper seems to be "there may be DOV methods with strictly better TPR but they come with problems such as unrigorous guarantees or perceptible data changes", current Table 1 shows Taggants are the best even when only measuring TPR, which to me suggests that baselines are missing. The field is complex and there are many dimensions (active vs passive, blackbox top-k vs needs logits vs needs whitebox, different guarantee types, clean label vs perceptible, etc.). To give clarity, I believe the paper must (i) clearly outline all dimensions and place all prior baselines within them (ii) include any viable baseline (e.g., a perceptible method can be still run to demonstrate that even though it achieves high FPR, it fails a data poisoning defense) and clearly state why the others can not / should not be included. This would greatly improve the trust in the experimental results and make the case for Taggants.
- **Unclear claims of technical contribution**: The paper should clearly mark that many technical parts are directly lifted from Witches Brew (e.g., augmentations, restarts), while some other parts are introduced by this work (e.g., the use of random data, perceptual loss). The current writing can easily be interpreted as an overclaim, esp. by a reader not familiar with prior work. The actual contributions are quite interesting, and I do not think the lack of tech. contribution is a weakness of the paper in any case.
- **Unsubstantiated claims around guarantees**: One of the key claimed advantages of Taggants are rigorous guarantees not offered by prior work, as (i) random data samples are actually independent and (ii) under the null, the classifications of random data are actually uniform. While I tend to agree on an intuitive level, I believe (1) the reasons why prior work violates (i,ii) could be more clearly explained, e.g., ln301 simply states that "using model's predictions on ground truth class" violates the independence assumptions, but does not elaborate; (2) to show actual impact of this oversight of prior work, it should be empirically demonstrated that there is a mismatch between theoretical and empirical FPR (3) for taggants, there should be a corresponding matching FPR empirical validaiton, and a more detailed discussion around why taggants do not break the assumptions. Are model predictions on random [0,1]^d data really uniformly random? All these images are unusually high-variance compared to natural data; if we had a class such as "TV static" I can imagine they would all be classified as such? Do we need a different OOD distribution in this case, and how would we choose it? This needs more clarity as it is uite central to the paper.
- **[Minor] Key technical contribution undexplored**: If I understand correctly, the motivations given for how Keys are sampled are more rigorous guarantees as above, and lower likelihood to alter model utility, as data is OOD. However, Table 3 also shows forcing the model to predict a certain class is easier in this case than for in-distribution test images. If am not misinterpreting Table 3, it would be interesting to know why this is the case, and state it as the third reason for using such Key sampling to avoid confusion. Is it that gradient matching is here a better proxy for the true objective, or the objective is easier to optimize as we are far from the real data manifold? This seems underexplored but is a central idea of the paper. 

Typos and points that do not affect my evaluation:
- ln151: dot missing, ln518: extra dot, ln188: extra "them". ln317: "In each experiment..." sentence seems wrong, not sure where.
- Related work says "[Data/model] watermarks are not designed to persist through processes that use the data", but I am not sure this is really the case, as these watermarks are generally designed with the goal of robustness. There are works that show (albeit on text) explicitly that such watermarks can persist through processes of finetuning and RAG (see Sander et al. "Watermarking Makes Language Models Radioactive" and Jovanovic et al. "Ward: Provable RAG Dataset Inference via LLM Watermarks")---this discussion could be included to give context. On a similar note, the data/model/backdoor watermarks distinction could be made clearer, e.g. by changing the first paragraph title in Sec. 2.

I am happy to hear from authors regarding these points and discuss them further.

=====

UPDATE: Score increased from 5 to 6 after rebuttal; see discussion thread below.

---

confidence: 4
contribution: 2
initial_rating: 3
presentation: 2
questions: See the weakness part.
soundness: 2
strengths: - The proposed method focuses on harmlessness, stealthiness, and black-box, which are three important challenges in the ownership verification problem.
- The writing is easy to understand and follow.
summary: The paper proposed a dataset ownership verification method that can work in a black-box setting, where model weights and training details are not known in advance; Besides, the method is also stealthy compared to the backdoor-based method since it only requires limited perturbations to the dataset; Moreover, the method is also less harmful than the previous backdoor-based method.
weaknesses: - Novelty issues: Could you compare this paper with [1] in more detail, such as technical details, setting, and problem setup? Since in my understanding, [1] used a similar gradient-matching-based method to find some "hardly generalized domain", which is very similar to this method on a high level.
- Unclarified arguments: In Lines 59-60, the authors mentioned that 'but is also harmful to the model as it introduces errors [1]'. Could you further clarify what kind of errors the backdoor-based method introduces? In my personal understanding, the claim of "harmless" in [1] is mainly based on the fact that the backdoor-based method will leave exploits in the dataset, which will then further be maliciously used by the adversaries.
- Unclarified intuitions: The intuitions on why the "out-of-distribution" samples are used to construct key images are not further clarified.
- Experimental Details: Why do you choose SleeperAgent as the backdoor method for the baseline "Backdoor watermarking"? SleeperAgent is not the simplest way to inject backdoors and even requires an additional surrogate model to optimize perturbation $\delta$ to the original dataset. Therefore, could you (1) further clarify what is the necessity of choosing SleeperAgent, (2) provide more explanations on why the backdoor watermarking only achieves 0 TPR on your setting, and (3) provide additional experiments on the Backdoor watermarking with BadNet?

[1] Junfeng Guo, Yiming Li, Lixu Wang, Shu-Tao Xia, Heng Huang, Cong Liu, and Bo Li. Domain watermark: Effective and harmless dataset copyright protection is closed at hand.

---

confidence: 5
contribution: 2
initial_rating: 6
presentation: 3
questions: 1. The radioactive data (Sabrayrolles et al., 2020) method has the option of black-box verification. In black-box verification, the radioactive data method compares the difference in loss between clean and radioactive images, and it does not necessarily involve training a student model to replicate the suspected model, it just checks the difference between the loss. Thus, authors' claim in page 1, line 053 as well as in page 3 lines 127-129 are incorrect. I strongly recommend changing the explanation. 
2. I do not understand why the authors think that the independence of observations assumption does not hold in statistical testing. The models' predictions are independent of each other in the inference phase. 
3. The authors empirically show that the data taggants are visually imperceptible, as designed in the methodology. It can work quite nicely on images with a large input space, but my question is how imperceptible this noise will be in data with lower-dimensional input spaces, e.g., smaller images like CIFAR10, gray-scale images or on a different data type like tabular data or text? 
4.  In Table 1, the authors show that the backdoor watermarking (Li et al., 2023) has zero TPR and zero FPR. How authors measured such drastic numbers when the reference reports much better numbers? Is it because backdoor watermarking uses the full probability set instead of top-k labels or due to the mechanism of Wilcoxon-test? 
5. What happens if the adversary decides to use a subset of the dataset? It will negatively affect the verification as the ratio of signed images to the whole dataset might decrease. Another case is how the performance of Data Taggants is affected when the adversary combines different datasets to train its model? The budget B will decrease and smaller budget produce worse results according to Table 3. 
6. Page 2, line 148: typo while giving the reference
soundness: 3
strengths: 1. Empirical results show that Data Taggants have zero false-positive rate and high true positive rate while maintaining the model performance. 
2. The generation of secret keys is purely random and is not included in the modified dataset, which makes key recovery almost impossible and unique to the data owner. 
3. The presentation is clear.
summary: In this paper, the authors propose Data Taggants, a dataset ownership method used to detect unauthorized data usage. Data Taggants relies on clean-label targeted data poisoning technique and requires only black-box access to the suspected model. Data Taggants generate secret keys, i.e., (input label) pairs, and signed input samples by maximizing the alignment between keys and signed samples, and induce a certain behavior only on the models trained by the modified version of the dataset including those signed images. The verification procedure of Data Taggants include statistical tests using suspected model's top-k predictions on the secret key.

I think there is novelty, particularly considering the application, but an incremental one as Data Taggants use ideas from gradient matching (Geiping et al. 2020).
weaknesses: 1. As far as I understand, the verification includes querying the suspected model with keys. As they are purely random and out-of-distribution, the adversary might evade the verification by trying to detect those specific inputs and altering the predictions. 
2. The method might be prone to watermark collusion: the adversary can generate its own key set and data taggants by modifying the already signed dataset, and after that it can also claim that the accuser is the malicious one. 
3. Data Taggants has limited effectiveness and robustness when k=1 in top-k predictions.

Meta-review: The submission  "Data Taggants: Dataset Ownership Verification Via Harmless Targeted Data Poisoning" proposes a dataset attribution via watermarking method using clean-label data poisoning. While reviewers point out that the exact algorithm used for clean-label poisoning is not new, this method is nevertheless an interesting application for the problem of data ownership that the authors examine carefully.

Based on this strength of the paper, I recommend acceptance.

Decision: Accept (Poster)