Data Taggants: Dataset Ownership Verification Via Harmless Targeted Data Poisoning
Authors: Wassim Bouaziz
Nicolas Usunier
El-Mahdi El-Mhamdi
Venue: ICLR 2025 Poster (2025)
Keywords: dataset watermarking
dataset ownership verification
data poisoning
backdoor attack
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We elaborate a harmless and stealthy targeted data poisoning approach to mark a model trained on a protected dataset and detect it.

Abstract: Dataset ownership verification, the process of determining if a dataset is used in a model's training data, is necessary for detecting unauthorized data usage and data contamination.
Existing approaches, such as backdoor watermarking, rely on inducing a detectable behavior into the trained model on a part of the data distribution.
However, these approaches have limitations, as they can be harmful to the model's performances or require unpractical access to the model's internals.
Most importantly, previous approaches lack guarantee against false positives.\
This paper introduces *data taggants*, a novel non-backdoor dataset ownership verification technique.
Our method uses pairs of out-of-distribution samples and random labels as secret *keys*, and leverages clean-label targeted data poisoning to subtly alter a dataset, so that models trained on it respond to the key samples with the corresponding key labels.
The keys are built as to allow for statistical certificates with black-box access only to the model.\
We validate our approach through comprehensive and realistic experiments on ImageNet1k using ViT and ResNet models with state-of-the-art training recipes.
Our findings demonstrate that data taggants can reliably detect  models trained on the protected dataset with high confidence, without compromising validation accuracy, and show their superiority over backdoor watermarking.
We demonstrate the stealthiness and robustness of our method
% shows to be stealthy and robust
against various defense mechanisms.

Published as a conference paper at ICLR 2025
DATA TAGGANTS: DATASET OWNERSHIP VERIFICA- TION VIA HARMLESS TARGETED DATA POISONING
Wassim (Wes) Bouaziz
Nicolas Usunier
El Mahdi EI Mhamdi
Meta AI, FAIR
Work done while at Meta AI, FAIR
CMAP, École polytechnique Palaiseau, France
& CMAP, École polytechnique Paris, France
wesbz@meta. com
ABSTRACT
Dataset ownership verification, the process of determining if a dataset is used in a model's training data, is necessary for detecting unauthorized data usage and data contamination. Existing approaches, such as backdoor watermarking, rely on inducing a detectable behavior into the trained model on a part of the data distri- bution. However, these approaches have limitations, as they can be harmful to the model's performances require unpractical access to the model's ' internals. Most importantly previous approaches lack guarantee against false positives.
This paper introduces data taggants, novel non-backdoor dataset ownership ver- ification technique. Our method uses pairs of out-of ditto---istribution samples and ran- dom labels as secret keys, and leverages clean-label targeted data poisoning subtly alter a dataset, so that models trained on it respond to the key samples with the corresponding key labels. The keys are built as allow for statistical certifi- cates with black-box access only to the model.
We validate our approach through comprehensive and realistic experiments on ImageNet using ViT and ResNet models with state-of-the-art training recipes. Our findings demonstrate that data taggants can reliably detect models trained on the protected dataset with high confidence, without compromising validation ac- curacy, and show their superiority over backdoor watermarking. We demonstrate the stealthiness and robustness of our method against various defense mechanisms.
1 INTRODUCTION
An increasing number of machine learning models deployed or published with limited trans- parency regarding their training data, raising concerns about their sources. This lack of transparency hinders the traceability of training data, which is crucial for assessing data contamination and the misuse of open datasets beyond their intended purpose.
Dataset ownership verification (DOV) approaches aim to equip dataset owners with the ability to track the usage of their data in specific trained models. Current methods perturb the dataset to mark models trained on and the main challenge lies in crafting this dataset perturbation balance two competing objectives. On the one hand, the perturbation should not significantly degrade performance, preserving the value of training on the data for authorized parties. On the other hand, the modification should sufficiently alter models' behaviors to enable high-confidence detection. These objectives are complemented by the following technical requirements. First, the detection should be effective with strong guarantees against false positives (i.e. models wrongfully detected), making it challenging for dishonest model owners to claim false detection. Second, the perturbation should be stealthy prevent easy removal by dishonest users. Third, it should be robust across different model architectures and training recipes, as to allow for usage in the wild, and adapt to the diversity of models and learning algorithms. Finally, for our method to be practical, the detection should be possible with black-box access to the model. Ideally it should work with top-k predictions for small k, be applicable models available only through restricted APIs.
wassi bwu.ziiiiii..................... z@poo 1 yttechiqqe.eddu

---

Published as a conference paper at ICLR 2025
Previous works either did not provide strong theoretical guarantees (Maini 2021 Li et al. 2022
Wenger et al. 2022). did not yield stealthy enough watermarks (Li et al. 2020b). did not demon- strate robustness of the watermark (Li et al. 2020a Maini 2021) only partially allowed for black-box detection (Sablayrolles et al. 2020). Backdoor watermarking, predominantly studied in DOV literature, perturbs the dataset predictably alter model predictions when frigger pattern (((rrigge)) is added to legitimate image This trigger should steer the prediction the triggered sample away from the ground truth class y and towards a target class y ((trigger) The detection of suspicious models is done by running a statistical test to measure difference between the benign prediction f()r)y and the triggered prediction f(x (:trigger)) y. This approach not only contradicts adversarial robustness (a desirable property for deep learning models), but is also harmful to the model as it introduces errors (Guo et al. 2023). More importantly, without proper characterization of benign model's predictions, previous detection scheme lack theoretical grounding.
In this paper, we introduce a novel dataset ownership verification approach that enables black-box detection of dishonest models with rigorous theoretical guarantees. We call this method data tag- gants by analogy to taggants, physical or chemical markers added to materials to trace their usage manipulation. We introduce new detection approach: keys, an out-of-distributien (pattern, la- bel) pair (zx(kv) yy(ev))). When model is trained the protected dataset, it should predict (ar(kew)) (kea) for every key. By targeting out-of-distribution key patterns _:(ke)), for which a natural behavior is undefined, we limit the possibilities of inducing errors the model contrary to backdoor watermarking. This behavior is induced through gradient matching, clean-label tar- geted data poisoning technique introduced in Geiping et al. (2020). We perform experiments on ImageNetlk with vision transformers and ResNet architectures of different sizes, together with state-of-the-arr training recipes (Wightman et al. (02T) including the 3-Augment data augmentation techniques (Touvron et al. 2022). Primarily designed for image classification datasets, similarly to prior works (Sablayrolles et al. 2020 Li et al. 2022), our main contributions are the following:
We introduce a new detection approach: keys, duttof-dittribution (pattern, label) pairs (x(key), yy(ky) on which we measure the top-k accuracy, with y(key) randomly chosen.
This randomness enables independence in the use of a theoretically more grounded Bino- mial significance tests. compared to previous work's use of pair pair-wise t-test.
We demonstrate the effectiveness and practicality of data taggants through extensive exper- iments on ImageNetlk with state of the art training procedures. We show the robustness of data taggants when transferred on various model architectures and training recipes. We also bring evidence of the stealthiness of data taggants through PSNR, -uitr--dist (OOD) detection tests, and data poisoning defense approaches. All of this is achieved by modifying only 0.1 % of the data and without degradation of performance.
We introduce the use of a perceptual loss in the crafting of data poisons enhance stealth- iness and show it allows for visually imperceptible data taggants.
Model
?
Bob
signing
Alice
Fay
Alice
Bob
Top-k
Figure 1: Application scenario of data taggants. 1 Signing: Alice signs her dataset (adds the laggants corresponding to the keys) before publishing it. 2 Detection: Alice determines if Bob used her dataset by running statistical test based on Bob's model's predictions on the keys.
2

---

Published as a conference paper at ICLR 2025
2 RELATED WORK
Steganography and Watermarking. Steganography is the practice of concealing a message within content, while watermarking is the process of marking data with message related to that data (often as proof of ownership) (Cox et al.) (007). They intersect in the contexts where water- marks strive be imperceptible to avoid content degradation (Kahng al. 1998). Recent works have shown that deep learning can improve watermarking technology (Vukotić et al., 2018 Zhu ctt al., 2018: Fermandez et al.) 2022) and conversely, AI models can be watermarked (Adi et al., 2018). Watermarks are designed to be detected in data and their radioactivity on models (Sablay- rolles et al., 2020) [Sander et al. 2024) is only a byproduct. In contrast, data taggants are designed not to be detected, but to leave mark on models that can later be detected with high confidence.
Dataset ownership verification. Our work, similarly to most works on dataset ownership verifica- tion (DOV), focuses on image classification datasets their main use case. Therefore, we focus the discussion on this case. An early approach to DOV involved the modification of certain images in the dataset to align the last activation layer of a classifier with a random direction (Sablayrolles al., 2020). This method demonstrated success in terms of stealthiness and provided robust theoretical guarantees in a white-box scenario, where access to the weights of the suspicious model is available. However, in the more realistic black-box scenario, the authors only proposed an indirect approach in- volving distillating the suspicious model, which requires high number of queries More recently,
attention has shifted towards backdoor watermarking for DOV (Li et al. 2020a 2022 Wenger et al.) 2022 Tang et al. 2023 Guo et al., 2023). These methods are closer to our black-box approach, although they require more information from the model and rely on confidence scores (Li et al.)
2020a 2022) rather than top-k predictions. The data is manipulated such that models trained on alter their confidence scores when trigger pattern is added to input image. From a theoretical perspective, these approaches currently lack theoretical grounding. They all rely on the assumption that honest model satisfies their null hypothesis - i.e. that model not trained the data should not change its confidence scores or predictions more than a predetermined threshold. The validity of the test is thus questionable, especially since they do not provide theoretical or empirical support for the choice of the threshold on confidence scores. In contrast, our approach precisely characterize the behavior of benign model which enables the application of standard and sound statistical tests. Table 5 in Section A. in Appendix compares our work with prior approaches.
Data poisoning. Our research, akin to prior backdoor watermarking studies, repurposes data poi- soning techniques for DOV. Data poisoning originally investigates how subtle changes to training data can compromise a model by malicious actors. Two main types of data poisoning attacks exist: backdoor attacks, which modify the model's behavior when specific trigger is applied to class of data (Li et al. 2019) (Souri et al. 2021), and targeted attacks, which induce errors on a specific set of inputs (Shafahi et al. 2018 Geiping al. 2020). These, in turn, may add incorrectly la- beled data Li et al. (2020a) 2022) to the dataset, which impedes the stealthiness of the approach.
Previous studies on backdoor watermarking were mostly based on backdoor attacks, attempting to predictably degrade performance when a trigger is introduced to the data. In contrast, we build on top of a clean-label targeted data poisoning approach (Geiping et al. 2020). We aim to design models that predict specific key labels in response to key inputs. The difference with a poisoning attack being that we alter the behavior on randomly generated patterns rather than legitimate data as to not induce malicious errors. We refer to that approach as data signing. Our algorithmic approach leverages gradient matching techniques developed in the clean- -abel data poisoning literature, for both targeted and backdoor attacks (Geiping et al. 2020: Souri et al. 2021). This technique allows to reproduce, via data poisoning, the effects of a particular gradient direction, which has been shown to be possible even for arbitrary gradient attacks Bouaziz et al. 2024).
Membership inference attacks. The goal of membership inference attacks is to reveal confi- dential information by inferring which data points were in the training set, usually recognized by low-loss inputs (Shokri et 2017 Watson et al. 20211) These methods do not offer any theoretical membership certificate, since model might have low loss on sample for different reasons than
this sample simply being in the training set. MIAs are not applicable to DOV (Zhang et al. 2024).
BBlack-box without distillation version of radioactive data amounts to a membership inference attack which hence lack the strong theoretical guarantees of the approach.
3

---

Published as a conference paper at ICLR 2025
3 DATA TAGGANTS
In the application scenario we consider, Alice wants to publish online a dataset DA Alice suspects Bob will try to train a model .M on DA- Given black-box access (top-k predictions) to Bob's model M Alice wants to mark her dataset in order to determine _M was trained on DA- We propose a solution to Alice's problem called data taggants, which alters the dataset to mark models trained on it. Data taggants uses data poisoning to induce a certain behavior on Bob's 's model, and statistical tests to detect if Bob's s model displays said behavior. To ensure stealthiness, inspiration from clean-label data poisoning, which leaves labels untouched (Geiping et al. 2020). Since the goal of approach is harmlessly influence the model, we designate our approach as data signing instead of data poisoning.
take
3.1 OVERVIEW AND TECHNICAL BACKGROUND
Let us denote Alice's original dataset by D {(r,, y) (X' (J),,, where N is the number of samples, X' is the input space and ) is the set of possible labels. The process of adding data taggants is the following (Figure [T:
1. Alice generates set of K secret keys: D(key) ((I,(ee))) "y; ( (X' x )));
2. Alice signs (i.e. harmlessly poisons) her dataset by perturbating the images in small subset Ds (1, (sigg)) yy; )
D of size S called the signing set. The perturba- tions A fō, i E [S]} added on top of images in Ds are called signatures, while data (taggant)
]=1
taggants refer the modified signing set x
(sign) 8, Vi [S]. x;
3. Alice shares D A. modified version of DA with the crafted data taggants replacing the elements in the signing set Dg. The keys are kept secret and never shared with Bob.
(key) The goal of the data taggants is have models trained on DA predict y, (key) in response to x; while being stealthy so that Bob cannot easily remove it, and robust to different settings (model architecture, training algorithm) Bob could Let us denote by LJ the loss of Bob's model with parameter 0. We use i to denote a data augmentation sampled according to Bob's 's recipe and E.[]] the expectation over this random sampling. Alice defines a constrained set of image perturbations C c= (ō E / < E). where & > 0 is kept small to ensure stealthiness. The space of possible signatures then Cs i (6,) E e [Vj Ds, 65 0}. Alice aims find the signature A
which minimizes the loss of Bob's model on the keys after training on A This corresponds to the following bilevel optimization problem:
min AECS
(x)
(kew))
(key) : (kevl)
(*(A) E arg min
N Σ E. [ [ 05). 9;)]- (1)
Since solving the bilevel optimization problem above is intractable, we variant of gradient matching (Geiping et al. 2020), where the goal is to find A such that, when z (*()),
K
S
V VoL c (x:
(key),
vi (kee)) Rs
Σ
E.
VoL (sigm) + +8,), (sigm) )
K
S
j=1
So that an optimization step on the data taggants also improves the model's loss on the keys. In reality, Alice does not know in advance Bob's training algorithm. There may also be multiple "Bobs" using different model architecture or training recipes. Alice thus cannot anticipate which architecture or training recipe to use to craft data taggants. Our approach involves model and set of data augmentation that Alice uses as a surrogate to Bob's training pipeline. We later study, in our experiments, the robustness of our approach when Alice and Bob use different model architectures or sets of data augmentations.
3.2 SIGNING THE DATA IN PRACTICE
The starting point of our approach is that Alice trains model on her original dataset. We denote by 8" the parameters of Alice's model, and Cg.. its loss function. We now give the details of the various steps to craft the taggants.
4

---

Published as a conference paper at ICLR 2025
barkpopprz reuate
V. cool (V valaned))
Signed mages grdden
(elgmedd
E
spring SeE
Sendbures
Sir ed imoges
Figure 2: Illustration of our method: Alice optimizes image-wist wise signatures for images in the signing set by maximizing the alignment between the gradients of the signed images V vlsigned) and the gradient of the key V (kke)) The resulting images and their labels are the data taggants.
Generating the secret keys. To prevent from negatively impacting model performance, choose key images x; (key) to be out-of-distribution data points. More precisely, we generate key images by sampling each pixel value uniformly and sample key labels y, (few) uniformly at random in V. Since no natural behavior is expected from the model on these keys, enforcing a specific behavior on them should not induce particular errors, opposed backdoor watermarking approaches.
Parallelized and clean-label perturbations. We evenly split the signing set into K parts (Ds, )= where Ds, associated to key i. Following clean-label data poisoning (Geiping et al,, 2020 each sample (æ U2} in Ds, satisfies V/ y (key) While Witches' Brew in the multi-targets case performs gradient matching to align the poisonous gradients with the averuged targeted gra- dients, we instead suggest to solve K gradient matching problems between each part Ds, and the
i=1
associated key (a(fev) Mi (kep)). The taggants optimization problem, described below, is thus decom- posable into problem for each key, which blue can be solved independently in parallel.
Taggant objective function with differentiable data augmentations. We use differentiable ver- sions of data augmentations optimize through them, similarly Witches' Brew but increasing the set of considered data augmentations (see Table I3 in Appendix). At each gradient matching optimization step, we approximate F. VoLg. (M(r) (sign) + 55), y) (stgm)) by resampling and apply-
ing R randomly sampled data augmentations t,, {1. (1....,R} R} (while and averaging the resulting gradients. The taggant objective function T(A). illustrated in Figure computes the alignment of perturbed images' gradients with the keys' gradients. More precisely, T(A) = ΣK Ti/K with:
1 in Witches' Brew),
T(AA) = cos
VoLo (key) (key] (2:
Σ JEDs,
R v
L (t, (sign) + +5,)) 31 (aign))
(1)
(2)
P=1
key gradient
signed data gradients
Perceptual loss. To improve the stcalthiness of our approach, we introduce the use of a differ- entiable perceptual loss term Cpere the taggant function, using the LPIPS metric (Zhang al. 2018), which relies on the visual features extracted by VGG model. Given weight À for Lperes the final optimization problem for taggants min * DK T((A) ACpero(A).
AECs
Random restarts. Since the problem to solve is non-convex, the algorithm may be trapped in local minima. In practice, and similarly to Witches' Brew, observed that using multiple random restarts of initial signatures for each key improved performance. We chose, for each key, the best crafted taggants among all restarts according to the taggant objective function.
5

---

Published as a conference paper at ICLR 2025
3.3 DETECTION
The detection phase 2 in Figure 1 relies on checking a suspicious model's predictions on the secret keys. We consider the detection to be successful when model displays a top-k accuracy on the set of keys to be at least a threshold 0 < T S 1. In order to control for false positives, we determine the top-k accuracy of an honest model on the set of keys and set T to be higher. The choice of k and т balances between the false positive rate (FPR, wrongfully detecting a benign model) and the true positive rate (TPR, correctly detecting model trained on DA. i.e. detection rate). Given Bob's model's top-k accuracy on the set of keys, Alice can derive a corresponding y-value for observing similar accuracy on a benign model. If that p-value is deemed low enough, it can be concluded that Bob's model was trained on Alice's dataset.
Null hypothesis. Our null hypothesis is Ho: "model h was not trained on the signed dataset".
Proposition 1. Under Ho, model h has, in expectation, a top-k accuracy of [yT the set of keys Dx, where [ is the number of possible labels.
Proof. Under Ho, for a given key, correctly predicting the random label y(key) based on top-k prediction given x (Ree)) can be modeled by a random variable following a Bernoulli distribution of parameter k/ Since all the labels are independently drawn, the number of correct predictions on the set of keys follows a binomial distribution with parameters (K, k/(D2) and an expectation of K k. Hence the expected accuracy over K keys is k/|''/.
(key) is
Statistical test. Let denote by top-k(hh, Dx) the number of keys for which the label y in the top-k predictions h(x:kev) for o; (key) E DDx- Under the null hypothesis, Proposition gives that top Dx) follows a binomial distribution with parameters (K, (()) and can be subject to a binomial test. The p-value of the binomial test is then given by the tail of a random variable Zp following binomial distribution Bin(K, (T)):
K
K
[D' -k k-= |
p = P(Zz 2 top- Dk)) =
Σ (Ax))
This test only requires top-k predictions, which are often available in black-box scenarios (c.g.. restricted API access to the model).
Previous works on DOV have proposed use a pair-wise t-test (Maini 202 Li et al. 2022 Wenger et al. al. 2023 lang et al. 2023) on the model's predictions. However, the hypotheses these works test for rely (without any theoretical grounding) on the assumption that benign model must display, on average, similar predictions on clean images and verification images, may they be watermarked images (Li et al. (022) Wenger et al. 2022, Li et al. 2023 Tang et al.] (203)) or particular private images (Maini] [202]] Guo et al. (023). ). Our detection scheme, on the other hand, do not need any assumption allows to exactly characterize the behavior of benign model on the keys.
2022 Li et al. 2023; Tang et al. 2023 Guo et al. 2023) or a Wilcoxon signed rank test (Li
EXPERIMENTS
In this section, we empirically evaluate the effectiveness, stealthiness, and robustness of data tag- gants. Experiments are run on a realistic setting to assess the practicality of our approach.
Experimental setup. We use ImageNetlk (Deng et al., 2009) with Vision Transformers (DelT) and Residual Networks (ResNet) models with different sizes and state-of-the-an ther training recipes from Wightman et al.] (202I) and Touvron et al. (0022) (see Appendix A.33 for details). When generating taggants, the signing sets" sizes use a budget B of the total dataset size, S = B x N, with B 1=-0 unless stated otherwise. We generate 20 secret keys, using 8 random restart per key and keep the K 10 keys reaching the best taggant objective value. The weight of the perceptual loss is fixed to = 0.01. These parameters were chosen to produce visually imperceptible data taggants. in the constraint set C is fixed to 16/25 6/255, common value in the data poisoning literature.
10-3

---

Published as a conference paper at ICLR 2025
Table 1: Comparison of data taggants with DOV baselines when Alice and Bob train a DeIT-small on ImageNetlk with the Three Augment recipe with budget of 0.1%. Aggregated over 4 runs, bold numbers indicate validation accuracy on par with clean training or better, and effective detection.
Method
Validation accuracy
TPR
FPR
log10 P
Clean training
64.2 + 0.4
BW Sleeper Agent
64.4 + 0.3
0.0 0.0
0.0 1000.00 0.0
(0.0)
BW BadNNets
63.7 + 0.5
0.0
0.0 + 0.0
(0.0)
Data isotopes
63.0 + 0.8
0.53 + 0.09
0.20 0.08
Data taggants
64.2 = 0.6
1.0 = 0.0
0.0 + 0.0
(-59.6)
(Our method)
Table 2: Validation accuracy and detection performance when both Alice and Bob use DelT-small models with the three-augment data augmentation with a budget of 0.1%.
Validation accuracy
Top-k kc keys accuracy
Method
PSNR
k: =
logi0 P
k = 10
log10
Naive Canary
63.8 + 1.1
85.0 + 19.1
(-91.7)
100.0 + 0.0
(-74.0)
Transparency
63.6 + 0.6
10.0 + 0.0
(-4.9)
55.0 + 5.8
(-29.7)
20.0
Data taggants (Our method)
64.2 = 0.6
10.0 + 0.0
(-4.9)
87.5 + 5.0 (-59.6)
27.9
In each experiment, we train one model for Alice, craft data taggants, and train Bob's model on the now protected dataset. We run the detection test with A = 10 and r 0.1 (for associated theoretical FPR of 0.4%) and repeat each experiment times with random initializations to compute standard deviations. Similarly to Sablayrolles et al. (2020), with Fisher's 's method (Fisher, 1970). The result is denoted log P and is commensurable to the base-10 logarithm of p-value. Given the large number of experiments, we train all models for 100 epochs only, while a complete DelT training is performed on 800 epochs. As sanity check, we confirm with run of 800 epochs in Table I1 in Appendix A.2 the effectiveness of our method.
combine the p-values of the 4 tests
4.1 EFFECTIVENESS
We first compare the effectiveness of data taggants to three basclines (Section A. in Appendix explain this choice) for dataset ownership verification. First, Backdoor watermarking (BW) (Li al. 2023), rely on backdoor attack to embed backdoor behavior in the model. To perform the backdoor attack, we leverage Sleeper Agent (Souri et al.) (021), an effective clean-label backdoor attack, and BadNets Gu et al. (2019), which applies a trigger on images from a source class and flips their labels to target class. Finally, Data isotopes (Wenger et al. 2022), unlike BW, do not try to induce backdoor behavior (x) y * f(x + (((trggee)) )) but only to induce a slight change in the predicted logits. In this comparison, we use DelT-small models with the Three Augment (3A) data augmentation and associated training recipe (Touvron al. (022) for Alice and Bob. We report the validation accuracies, the measured TPR and FPR (E [0, ID. and the log p-vauue in Table [] Our experiments reveal that in practical setting, BW is ineffective and yields 0.0 detection rate, and data isotopes offer a low detection rate of 0.53 with a prohibitively high FPR of 0.20 with a high toll on the validation accuracy. In contrast, data taggants achieve a perfect detection with a 1.0 TPR and 0.0 FPR, and a very high confidence of < 19-59 without loss of performance.
To measure the effectiveness of gradient matching craft data taggants and force Bob's model to leam the keys, we compare it with two baselines to achieve the same goal. First, "naive canary", where copies of the private keys are added into the training set. This serves as a topline terms of detection performance, but is not viable as DOV mechanism due to its lack of stealthiness. Second, "transparency", where we linearly interpolate between the keys and images of the signing set with weight 7 0.2, x' (keg) (1 7).. This value for 7 was chosen by visual inspection,
7

---

Published as a conference paper at ICLR 2025
Table Comparison keys sources (test data vs random) when both Alice and Bob use DeIT-small models with the three-augment data augmentation and various budgets.
Key
Budget B
Validation accuracy
Top-k keys accuracy
PSNR
source
k:
log10 p k 10
log10 p
None
0.0%
64.2 0.4
0.001%
63.7 0.4
0.0 0.0
(0.0)
7.5
(-1.1)
27.5
Test images
0.01%
63.4 + 1.0
0.0
(0.0)
0.0
(0.0)
27.9
0.1%
63.9 + 0.6
0.0
(0.0)
2.0
(-10.4)
28.4
0.001%
63.7 - 0.9
0.0
(0.0)
0.0
(0.0)
26.6
Random
0.01%
63.6
0.0
(0.0)
5.0
(-0.5)
27.3
(Our method) 0.1%
64.2 11.2+0.0 0.6
10.0 + 0.0
(-4.9)
87.5+
(-59.6)
27.9
small value for which the key is still visible. In this comparison, we use DelT--maall models with the three-augment (3A) data augmentation (Touvron al. 2022) for Alice and Bob, with three different budgets B, 0.1%. 0.01% and 0.001%.
The results are given in Table 2 (more results in Table 7 in Appendix). First, we observe that all methods have roughly the same validation accuracy within error). In particular, this suggests that data taggants do not negatively impact model per- formances at these budget levels. In terms of detection, Naive canary works best expected, with perfect key top-10 accuracy for 2 0.01%. While Transparency works better than data taggants for smaller budgets, data taggants has much higher top-10 accuracy for B 0.1% (87.5% 55.0%). In addition, the PSNR (signal to noise ratio) lower for transparency, which suggests that with a bud- get small as 0.1%, data taggants already dominate the transparency baseline in this experimental setting, and can detect dishonest models with very high confidence (log10 59.6).
model trained clean data (differences
We perform an additional comparison with another baseline where data points used keys rather than random patterns, which is similar to repurposing a data poisoning attack for DOV. Ta- 3 the results. With comparable PSNR, using random keys leads much better detection accuracy and confidence for B 0.1% than using test data, justifying our design choice.
4.2 STEALTHINESS
The stealthiness of data taggants is essential but difficult to measure beyond PSNR. As a best effort, we address the scenario where Bob tries locate the signed data using either visual inspection, defense mechanisms against data poisoning, or, following (Tang et al. (203),, using anomaly detec- tion algorithms. Similarly to the previous section, we use taggants crafted by DelT-small using 3A augmentation, with budget B 0.1%.
Visual inspection. We provide examples of taggants crafted with and without perceptual loss in Figure 3 (more examples are given in Figure 6 7 and In Appendix (.2). We observe that while most of them appear unaltered, some data taggants display visible patterns of weak intensity that could as well come from natural film grain compression artifacts. Although with PSNR < 30 dB (see Table 2 which is considered low according to image processing standards (lower than e.g. Sablayrolles al. (2020)), believe that the data taggants are hardly detectable via visual inspec- tion, particularly when Bob has to find them among a whole dataset.
Defense against data poisoning. Since our method relies on data poisoning mechanism, we suggest to use data poisoning detection methods to detect data taggants. We consider three data poisoning detection methods relying filtering samples: Deep k-NN (Peri et al.) 2020), Activation Clustering (Chen et al., 2018) and Spectral Clustering (Tran et al. 2018). Over a wide range of parameters, the Receiver Operating Characteristic (ROC) curves in Figure 4shows that data taggants cannot be detected by these methods with much better performances than random guess, suggesting strong stealthiness of data taggants.
8

---

Published as a conference paper at ICLR 2025
vanilla
with perceptual loss
vanilla
with perceptual loss
Figure 3: Pairs of data taggants crafted without perceptual loss (left) vs with perceptual loss (right).
peotbe
KN
Actien cutiiing Random
20
22.
0.3
Takes
Figure 4: ROC curves for defense against data poisoning methods the detection of data taggants.
Figure 5: ROC curve for DBSCAN anomaly detection method.
Anomaly detection. Most methods for out-of-distribution (OOD) detection (Chen et al. 2020) rely training model set of in-lier data to then be able to detect outliers. In reality Bob does not have access to the original clean data nor to a benign model, hence cannot tell the outliers apart.
We consider the DBSCAN clustering method (Schubert et al. 2017) from the scikit-learn projec and run it with a wide range thresholds (E [10, 35 to cluster the features of model trained on
DA. The resulting ROC curves are given in Figure 5 as a scatter plot after the experiment 4 times. Interestingly, when computing DBSCAN for different detection thresholds, performances that are significantly worse than random. Our explanation is that DBSCAN computes clusters and select outliers isolated points or clusters. By manually analyzing the clusters, we observe that some of them contain lot of data taggants, most likely because their embeddings are lumped together and not appear as anomalies.
observe that it exhibit
On the one hand, these results suggest that OOD detection based on clustering is not proper ap- proach to detect the taggants. It suggests however that if Bob has sufficient resources, he may try to manually locate clusters of signed images by visual inspection, which is less costly than inspecting individual images. We leave this direction as an open question for future work.
4.3 ROBUSTNESS
For fixed model and training algorithm, Table and 3 already show the robustness our method to complete model retraining. But for our method to be practical, we need to ensure it will be robust when Bob's model training algorithm is different from Alice's.
https///scikit-eemm.ooo

---

Published as a conference paper at ICLR 2025
Table 4: Robustness to data augmentation change. Alice does not know Bob's data augmentations and use either the Simple Augment or the Three Augment recipe.
Bob's data aug.
Alice's data aug.
Validation accuracy
Top-k keys accuracy
k:
log10 p
k: 10
log10 P
SA
58.1 0.3
57.5 + 9.6
(-54.2)
100.0 + 0.0
(-74.0)
SA
3A
56.1 + 0.3
1.7 + 4.1
(0.0)
15.0 8.4
(-1.8)
SA
64.1 + 0.6
2.5
(-0.5)
32.5 12.6
(-13.8)
3A
3A
64.0 + 0.5
10.0 + 0.0
(-4.9)
87.5 + 5.0
(-59.6)
Different data augmentations. Table (and Table 8 Appendix A.2) shows how even when Alice does not know Bob's data augmentations, she can still successfully detect Bob's model, even though we gain much higher confidence when the same data augmentation is used by both Alice and Bob. Also, since the 3A data augmentation uses mixup (Zhang, (017) and cutmix (Yun et al. 2019), these results also demonstrate the robustness of our approach to Borgnia et al. (2021) which showed that mixup and cutmix can be used to defend against data poisoning attacks.
"Stress test": different model architectures and data augmentation. We finally explore the robustness of data taggants in the most difficult setting, where Alice and Bob different data augmentations as well as model architecture or sizes (see Table 12 in Appendix). We consider two families of models (DelT and ResNet) of various sizes. We measure intra-family transferability by validating the protected dataset generated from each model onto each other model of the same family (DeIT and ResNet). We also measure inter-family transferability by crafting a protected dataset with ResNet-18 18 and DelT-tiny models and validating it on all the models of the other family (resp. DelT and ResNet). The results are shown in Table in Appendix. Overall, we see good intra-family transferability, with larger DelT models being more sensitive to taggants than smaller DelT models. Interestingly, the trend reversed for ResNets, with smaller ResNets being more sensitive, Across architectures, DelT--iny to ResNets ResNets to DelT-tiny, the results are less conclusive even though the top-10 accuracy is still > 0. All in all, these results suggest that the taggants are robust this worst-case scenario.
Dataset change. We explore the case where Bob trains his model on a modified version of Alice's dataset. We consider two cases: (1) Bob trains multiple datasets superset of Alice's ' dataset), and (2) Bob trains on a subset of Alice's 's dataset. We present the results in Table 10 Appendix and show data taggants are still effective in these cases.
LIMITATIONS AND FUTURE WORK
While our non-backdoor dataset ownership verification approach shows good properties in terms of effectiveness, harmlessness, stealthiness, and robustness, limitations are to be observed. Current re- sults show negligible degradation validation accuracy compared to training on the clean dataset, which future works should try to further reduce. While we show the robustness of our method through different transfer experiments against different model architectures and training recipe, by modifying by modifying them, Bob can still hurt the detection performances. Obtaining higher confidence when Alice and Bob use different architectures and data augmentations is an interesting avenue for future work.
CONCLUSION
We introduced data taggants, new approach for dataset ownership verification and designed mostly for image classification datasets. Data taggants are hidden in dataset through gradient matching, in order to mark models trained on them. Our approach shows promising results, with very high detection rate and confidence, and low false positive rate, without affecting models' performance.
10

---

Published as a conference paper at ICLR 2025
7 ETHICS STATEMENT
Our work is motivated by the need to ensure the integrity of machine learning models and the datasets they are trained on. While our approach to Dataset Ownership Verification (DOV) displays strong results, it is important to consider that such method can also fail. False positives lead to misconceptions, particularly in such contexts.
REPRODUCIBILITY STATEMENT
The code implementing our method should be released upon publication. We provide all the neces- sary details to reproduce our experiments in the Section 4 and in the Appendix A.3
REFERENCES
Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weak- into strength: Watermarking deep neural networks by backdooring. In 27th USENIX Secu- rity Symposium USENNX Security 18), pp. 1615-1631, Baltimore, MD, August 2018. USENIX Association. ISBN 978-1-939919 778-1-939133-04-5.
Eitan Borgnia, Jonas Geiping, Valeriia Cherepanova, Liam Fowl, Arjun Gupta, Amin Ghiasi, Furong Huang. Micah Goldblum, and Tom Goldstein. Dp-instahide: Provably defusing poisoning and backdoor attacks with differentially private data augmentations. arXiv preprint arX1v:2103.02079, 2021.
Wassim Bouaziz, El-Mahdi El-Mhamdi, and Nicolas Usunier. Inverting gradient attacks makes powerful data poisoning. arXiv preprint arXlv:2410.21453, 2024.
Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03722 2018.
Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Robust out-of-distribution detec- tion for neural networks. arXiv preprint arXiv:2003.09711 2020.
Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermark- ing and steganography. Morgan kaufmann, 2007.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248-255. Icee, 2009.
Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Wa- termarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3054-3058. IEEE, 2022.
Ronald Aylmer Fisher. Statistical methods for research workers. In Breakthroughs in statisties: Methodology and distribution, pp. 66-70. Springer, 1970.
Jonas Geiping, Liam Fowl, W Ronny Huang, Wojeiech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. Witches' brew: Industrial scale data poisoning via gradient matching. arXiv preprint arXiv:2009.020 02276, 2020.
Tianyu Gu, Kang Liu, Brendan Dolan DalintGavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 1447230-47244 2019.
Junfeng Guo, Yiming Li, Lixu Wang, Shu-Tar Tao Xia, Heng Huang, Cong Liu, and Bo Li. Do- main watermark: Effective and harmless dataset copyright protection is closed at hand. ArXiv, abs/2310. 14942, 2023.
11

---

Published as a conference paper at ICLR 2025
Andrew B. Kahng. John C. Lach, William H. Mangione-Smithh Stefanus Mantik, Igor L. Markov, Miodrag Potkonjak, Paul Tucker, Huijuan Wang, and Gregory Wolfe. Watermarking techniques for intellectual property protection. Proceedings 1998 Design and Automation Conference. 35th
DAC. (Cat. 10,98CH36175) pp. 776-781, 1998.
Shaofeng Li, Benjamin Zi Hao Zhao, Jiahao Yu, Minhui Xue, Dali Kaafar, and Haojin Zhu. Invisible backdoor attacks against deep neural networks. ArXiv, hass/199..0242.. 2019.
Yiming Li, Zi-Mou Zhang, Jiawang Bai, Baoyuan Wu, Yong Jiang, and Shutao Xia. Open-sourced dataset protection via backdoor watermarking. ArXiv, abs/2010.05821, 2020a.
Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shutao Xia, and Bo Li. Untargeted backdoor wa- termark: Towards harmless and stealthy dataset copyright protection. ArXiv, abs/2210.00875, 2022.
Yiming Li, Mingyan Zhu, Xue Yang, Yong Jiang, Tao Wei, and Shu-Tao Xia. Black-box dataset ownership verification via backdoor watermarking, IEEE Transactions Information Forensics and Security, 18:2318-2332 2023.
Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. 2021 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 16443-16452, 2020b. URL https: ataaappisemmae semaamicccccnn.cllrrrr. .org/
Corpus ID:23 23:522266
Pratyush Maini.
Dataset inference: Ownership resolution in machine learning. URL
ArXiv,
0at/2104,10066
2021.
231 609199
Nechar Peri, Neal Gupta, W Ronny Huang, Liam Fowl, Chen Zhu, Soheil Feizi, Tom Goldstein, and John P Dickerson. Deep k-nn defense against clean-label data poisoning attacks. In Computer Vision-ECCV 2020 Workshops: Glasgow, UK, August 23-28, 2020, Proceedings, Part I 16, pp- 55-70. Springer, 2020.
Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, and Hervé Jégou. Radioactive data: tracing through training. In International Conference Machine Learning, pp. 8335.. PMLR, 2020.
Tom Sander, Pierre Fernandez, Alain Durmus, Matthijs Douze, and Teddy Furon. Watermarking makes language models radioactive, 2024. URL /tttt::://arxtv.or//aaassss
14904
Erich Schubert, Jörg Sander, Martin Ester, Hans Peter Kriegel, and Xiaowei Xu. Dbscan revisited, revisited: Why and how you should (still) use dbscan. ACM Trans. Database Syst., 42(3), jul 2017. doi: 10. 145/366833
Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-labe poisoning attacks neural networks. Advances in neural information processing systems, 31, 2018.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference at- tacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp. 3-18. IEBE, 2017.
Hossein Souri, Micah Goldblum, Liam H. Fowl, Ramalingam Chellappa, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. ArXiv, abs/2106.08970, 2021.
Ruixiang Tang, Qizhang Feng, Ninghao Liu, Fan Yang, and Xia Hu. Did you train my dataset? towards public dataset protection with cleanlabel backdoor watermarking. ACM SIGKDD Explo- rations Newsletter, 25:43 53, 2023.
Hugo Touvron, Matthieu Cord, and Hervé Jégou. Deit ii:: Revenge of the vit. In European confer- on computer vision, pp. 516-533. Springer, 2022.
12

---

Published as a conference paper at ICLR 2025
Brandon Tran, Jenry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. Advances in neural information processing systems, 31, 2018.
Vedran Vukotić. Vivien Chappelier, and Teddy Furon. Are deep neural networks good for blind im- age watermarking? In 2018 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1-7. IEEE, 2018.
Lauren Watson, Chuan Guo, Graham Cormode, and Alex Sablayrolles. On the importance of diffi- culty calibration in membership inference attacks. arXiv preprint (xXiv:211.00844/ 2021.
Emily Wenger, Xiuyu Li, Ben Y. Zhao, and Vitaly Shmatikov. Data isotopes for data provenance in dnns. Proc. Priv. Enhancing Technol., 2024:413 429, 2022.
Ross Wightman, Hugo Touvron, and Hervé Jégou. Resnet strikes back: An improved training procedure in timm. arXiv preprint (xXiv:21000044:1 2021.
Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy train strong classifiers with localizable features. In Proceed- ings of the IEEE/CVF international conference on computer vision, pp. 6023-6032, 2019.
Hongyi Zhang. mixup: Beyond empirical risk minimization. arXiv preprint 17X1v:171..09412. 2017.
Jie Zhang, Debeshee Das, Gautam Kamath, and Florian Tramèr. Membership inference attacks cannot prove that model was trained on your data, 2024.
2409919799
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 386-595,74 2018.
Jiren Zhu Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pp. 657-672, 2018.
A APPENDIX
A.1 COMPARISON WITH PRIOR WORK
To visually clarify the position of our work w.r.. prior work, we represent them in Table S to highlight the main dimensions of comparison: (i) what are the means of detection, (ii) whether the method relies on black-box access to the model, (iii) whether it is clean-label, (iv) imperceptibilitty and (v) what are the theoretical guarantees. A yellow cross X indicates slight disagreement (e.g. for the "black-box' axis of analysis, for method that use logits as mean of detection, since it represents significatively more information than just sharing the predictions). Please note that this table is coarse and represent the best case scenario for cases where variety of methods can be used (e.g. Backdoor watermarking).
Among the prior work, we chose to discard several of them from our pool of baselines. Domain watermark (Guo et al. 2023) has yet to share the implementation and complete details for generating their Chardly-generaliin
domains" which limits us in reproducing their method. It is comparable to Data taggants but targets "hard" samples from their hardly-generalized domains that are deemed unlikely be well classified if not trained on the protected data. On the other hand, we provide theoretical guarantees that the keys are indeed unlikely to be well classified by a benign model. Dataset inference (Maini] 202T) in black-box requires very large amount of queries few hundred per data point to verify), which makes it impractical. Radioactive data (Sablayrolles et al.) (0200) in black-box can only done via distillation of the model to evaluate, which also require large number of queries to the model. Data taggants, on the other hand, only requires K queries (K" 10 in our experiments). We thus kept as baselines and compared against Backdoor watermarking and Data isotopes (Wenger et al. 2022). For Backdoor watermarking, we decided to leverage two approaches: a laisoned-label approach, BadNets (Gu et al.] 2019). for its simplicity, and a clean- label approach, Sleeper Agent (Souri et al. 2021). The choice for this methods comes from the Domain Watermark (Guo et al.
2023) paper showing in Table I that Sleeper Agent performs better than the other tested clean-label backdoor watermarking approaches Imny-ImageNet.
13

---

Published as a conference paper at ICLR 2025
mean of detection
theoretical guarantees
black-box
clean-label
imperceptible
Radioactive data (Sablayrolles et al. 2020
weights/ logits
x
FPR
Dataset inference MMaini 2021)
logits/ pred.
on linear models
N/A
Backdoor watermarking
Li ct al. 2022 2023
logits/ pred.
not always
X
lang ct al.
2023
Data Isotopes
logits/ top-k pred.
X
X
Wenger al. 2022)
Domain Watermark
Guo et al. (2023)
logits
X
X
on risk
Data taggants (Ours)
top-k pred.
FPR
Table 5: Comparison of DOV methods along dimensions representing different desirable properties.
A.2 ABLATIONS
Visual inspections. with and without perceptual loss. The perceptual loss improves the stealthiness of the data taggants by making the perturbations less noticeable to the human eye. Some artifacts are still visible but could easily be overlooked by human observer misjudged compression artifact or image grain.
show, in Figure randomly chosen samples data taggants generated
Comparison the perceptual loss with weight decay. ensure that the gain in PSNR offered by the perceptual loss is not simply due it reducing the perturbation amplitudes. Figure compare data taggants generated with perceptual loss, with weight decay on the perturbation (replacing the perceptual loss term by the norm 2 of the perturbation 6, (2). and with their vanilla counterpart. It shows that for a similar PSNR, the weight decay version is much more noticeable than its perceptual loss counterpart. The perceptual loss hence plays an important role in hiding the signature.
Clean performances. We report clean performances in Table 6 This shows that the loss of accu- racy is minimal when we train the model on data taggants.
Table 6: Validation accuracies for clean training of the different models and data augmentations used.
Data aug.
Model
Validation accuracy
SA
DelT-small
56.1 0.5
DelT-medium
67.3 + 1.1
DelT-small
64.2 + 0.4
DelT-tiny
53.6 + 0.4
3A
ResNet-50
77.9 + 0.0
ResNet-34
74.1 0.0
ResNet-18
69.6 + 0.0
Baselines. Similarly to our experiments, we report in Table the validation accuracies and keys accuracies for our method and different baselines for keys uniformly sampled in the pixel space or from the test set. Figure 8 shows how Backdoor Watermarking- performs with two backdoor attacks: Sleeper Agent (Souri et al.) 2021) and BadNets (Gu et al. 2019). As Sleeper Agent displays high p-value for both the watermarked model and the benign
detection (Li al. 2023)
14

---

Published as a conference paper at ICLR 2025
Figure 6: Comparison of data taggants generated without (top) and with perceptual loss (bottom). The images were sampled randomly.
model, any relevant level of significance (below 0.05) yield low detection rate (True Positive Rate) and low false detection rate (False Positive Rate). On the other hand, we lower the hyperparameter of the tested hypothesis, the p-value for associated with the benign model lower than that of the watermarked model, which should lead false detection rate higher than the detection rate. For
15

---

Published as a conference paper at ICLR 2025
(a) vanilla PSNR 27.6dB.
(b) with perceptual loss
(c) with weight decay PSNR 30.7dB.
PSNR 30.6dB.
Figure 7: Comparison of signatures (top amplified x x10) and data taggants (bottom) generated without discretion mechanism (left), with perceptual loss (center) and with weight decay (right).
BadNets, the p-value obtained from the t-test is lower for benign model than watermarked models as the threshold decreases, leading to potentially high false detection rate.
pivalue ss Ranetion the taaggin
posakee function the margin
functior
11:45
C4-
12
1:40
32102
(a) Sleeper Agent
(b) BadNets
Figure 8: p-values computed for the Backdoor Watermarking- based detection (Li et al. 2023 as function of the margin, the threshold of their null hypothesis.
(a) Key image (kry)
(b) Transparency
(c) Data taggant
(d) Naive canary
Figure 9: Comparison data taggants with baselines "transparency" and "naive canaries" for given key.
16

---

Published as a conference paper at ICLR 2025
Table 7: Comparison of our data taggants for 10 keys against baselines for a ViT-small trained on ImageNetlk with the 3A recipe with various budgets. Averaged over 4 validation training runs each with different validation model's initialization, Errors represent the standard deviation.
Key source
Budget B
Validation accuracy
Top-k keys accuracy
Method
PSNR
k =
10gio
&: = 10
log
None
Clean training
0.0%
64.2 + 0.4
0.001%
63.8 + 0.5
0.0 0.0
(0.0)
0.0 + 0.0
(0.0)
Naive Canary
0.01%
64.2 0.7
57.5
(-54.0)
97.5 5.0
(-71.)
(Label Flipping)
0.1%
63.6 +: 1.0
100.0 1.000:0.000
(-113.4)
100.0 0.0
(-74.0)
Test
0.001%
64.2+1.1
0.0
(0.0)
0.0
(0.0)
20.0
data
Transparency
0.01%
63.2 0.5
0.0
(0.0)
0.0
(0.0)
20.0
0.1%%
63.7 = 0.6
0.0
(0.0)
0.0
(0.0)
20.0
0.001%
63.7
0.0
(0.0)
1.0
(-1.1)
Data taggants
0.01%
1.0
0.0
(0.0)
0.0
(0.0)
0.1%
63.9
0.0
(0.0)
27.5
(-10.4)
28.4
0.001%
0.7
7.5
(-3.3)
10.0
(-1.8)
Naive Canary
0.01%
0.3
15.0 10.0
(-9.2)
100.0 0.0
(-74.0)
0.1%
63.8 1.1
+6.0+19.11
(-91.7)
100.0 + 0.0
(-74.0)
Random data
0.001%
1.0
7.0
(-3.3)
1.00
(-1.8)
20.0
Transparency
0.01%
6.74
7.5
(-3.3)
10.0
(-1.8)
20.0
0.1%
63.6 0.6
1.00
(-4.9)
5.8
(-29.7)
20.0
0.001%
63.7 0.9
0.0
(0.0)
0.0
(0.0)
Data taggants
0.01%
63.6
0.0
(0.0)
5.0
(-0.5)
27.3
(Our method)
6.6
1.0
(-4.9)
5.0
(-59.6)
27.9
Robustness data augmentation changes. We show Table g that our method robust to data augmentation changes. We also confirm that uniformly sampling keys in the pixel space to be out-of-distribution is better strategy than using test data as keys.
Table Robustness to data augmentation change. Alice does not know Bob's data augmentations and use either the Simple Augment or the Three Augment recipe. We compare our method with keys chosen from test data. B 10-3
Alice's data aug.
Bob's data aug.
Key source
Validation accuracy
Top-k keys accuracy
1: = 1
log P
k = 10
logio
Random
58.1 + 0.3
57.5 + 9.6
(-54.2)
100.0
(-74.0)
SA
SA
Test data
56.2 0.6
15.0 + 17.3
(-9.9)
60.0 14.1
(-34.2)
Random
64.1 + 0.6
2.5 5.0
(-0.5)
32.5 32.5 + 12.6
(-13.8)
SA
3A
Test data
63.9
0.0
(0.0)
2.5 5.0
(-0.1)
Random
56.1 0.3
1.7
(0.0)
1..0
(-1.8)
3A
SA
Test data
56.1 + 0.4
0.0
(0.0)
1.50
(-3.9)
Random
64.0 + 0.5
1..0
(-4.9)
87.5
(-59.6)
3A
3A
Test data
63.9 + 0.6
0.0
(0.0)
2..5
(-10.4)
Robustness to stress test. On top of the data augmentation changes, we show in Table that our method displays some robustness to changes in the model architecture too.
Dataset change. We consider two cases:
(1) Bob trains superset of Alice's 's dataset. In our experiments, make Alice use only half the classes ImageNetlk and Bob trains on the whole dataset.
(2) Bob subsamples Alice's dataset. We make Alice only half the classes of ImageNetlk. Bob will then remove 20% of Alice's ss samples from each class and add in the classes that do not belong Alice.
17

---

(-36.3) Published as a conference paper at ICLR 2025
Table Stress test: Results of our method when Alice and Bob train different architectures and different data augmentations. Alice uses SA data augmentations and Bob uses 3A.
Bob's model
Alice's
Validation accuracy
Top-k keys accuracy
model
k
log10 p
k 10
logio P
DelT-medium
67.2 1.3
2.5 5.0
(-0.5)
47.5 9.6
(-24.0)
DelT-small
67.7 1.0
5.0 4.0:5.5 5.8
(-1.7)
60.0
(-33.8)
DelT-medium
DefT-tiny
67.6 0.7
10.0 0.0
(-4.9)
5 12.6
(-28.0)
ResNet-18
07.0=0..
0.0
(0.0)
10.0
(-1.8)
DelT-medium
6.6
0.0
(0.0)
9.6
(-7.8)
DelT-small
6.6
2.0
(-0.5)
32.5
(-13.8)
DelT-small
DelT-tiny
6.0
5.0
(-3.3)
3.6
(-16.9)
ResNet-18
0.6
0.0
(0.0)
10.0
(-1.8)
DelT-medium
0.4
2.0
(-0.5)
1.0
(-1.8)
DelT-small
0.5
0.0
(0.0)
1.0
(-2.8)
DelT-tiny
DelT-tiny
0.6
2.5
(-0.5)
12.5
(-2.8)
ResNet-18
0.5
0.0
(0.0)
7.5
(-1.1)
ResNet-18
7.10
5.8
(-1.7)
1.80
(-3.9)
ResNet-34
7.19
5.0
(-3.3)
1..5
(-2.8)
ResNet-50
ResNet-50
7.1
2.0
(-0.5)
27.5
(-18.5)
DelT-tiny
0..
2.0
(-0.5)
1..
(-2.8)
ResNet-18
0.12
5.0
(-3.3)
20.6
(-28.6)
ResNet-34
7..1
1..
(-4.9)
3.2
(-12.0)
ResNet-34
ResNet-50
7.11
7.6
(-3.5)
61.0
(-38.2)
DelT-tiny
7.12
10.0
(-4.9)
10.0
(-1.8)
ResNet-18
6.1
5.0
(-3.3)
31.1
(-32.0)
ResNet-34
0.2
5.0
(-3.3)
22.5
(-8.1)
R8
ResNet-50
69.8
7.5
(-3.3)
55.0 = 23.8
(-30.9)
DelT-tiny
69.8 + 0.2
5.0 : 5.8
(-1.7)
10.0 0.0
(-1.8)
Table 10: Results of our method when Bob trains his model modified version of Alice's dataset.
Case
Validation accuracy
Top-10 key accuracy
log1u P
(1)
64.5 + 0.6
62.5 + 15.0
(2)
58.6 + 0.7
72.5 + 9.6
(-44.9)
Results are showed in Table 10 and show that in both cases, method is still able to detect Bob's model strong reaction to the keys.
Result for 800 epochs training. To ensure that the effects of our data taggants are still observed even during a full training. Table repoorts the top-k keys accuracies and associated p-values for a complete training of 800 epochs for random keys and keys taken from the test data when Alice and Bob both use the 3A data augmentation. Our method displays better performances of detection for the same validation accuracy.
Table 11: Results for complete training of deit-small for 800 epochs and comparison with keys chosen from test data. B 10-3
Key
Validation accuracy
Top-k keys accuracy
source
k
logio P
k 10
logio P
Random data
79.4 + 0.2
10.0 0.0
(-4.9)
85.0 + 10.0
(-57.2)
Test data
79.4 + 0.3
0.0 + 0.0
(0.0)
( (0.0)
18

---

Published as a conference paper at ICLR 2025
A.3 EXPERIMENTAL DETAILS
Computational resources. All our experiments ran on 16GB and 32GB V100 GPUs. The differ- steps took the following time:
Initial training: 14h-16h
Data taggants generations: 2h-8h
Validation training: 14h-16h
Models and training recipes. We present in Table 12 the list of models used and their size and number of parameters. Table 13 details the data augmentations used in our experiments. Finally, Table 14 presents the training recipe used for our experiments.
Table 12: Models and sizes.
Table 13: Data augmentations.
Model
# params.
Data aug.
SA
3A
ViT-tiny
5,46
H. flip
ViT-small
21.04 M
Resize
/
V
ViT-medium
37.05
Crop
/
/
ViT-base
82.57 M
Gray scale
X
Solarize
X
ResNet-18
11.15 M
Gaussian blur
X
ResNet-34
20.79 M
Mixup alpha
0.0
0.8
ResNet-50
24.37 M
Cutmix alpha
0.0
1.0
ResNet- 101
42.49 M
ColorJitter
0.0
0.3
Test crop ratio
1.0
1.0
Table 14: Training recipe
Family Reference
DelT
ResNet
Touvron et
2022
WWightman et al.
2021
Batch size
2048
2048
Optimizer
LAMB
LAMB
LR
3.10-3
8.10- 3
LR decay
cosine
cosine
Weight decay
0.02
0.02
Warmup epochs
Dropout
Stoch. Depth
Repeated Aug
/
X
Gradient Clip.
1.0
1.0
LayerScale
/
X
Loss
BCE
BCE
19


Reviews:
[{"review_id": "MgDn1nEfVt", "reviewer": "Reviewer_v3Ca", "summary": "This paper introduces data taggants, a novel non-backdoor dataset ownership verification technique that helps detect if machine learning models were trained using a specific dataset. Unlike previous approaches that rely on backdoor watermarking, data taggants use pairs of out-of-distribution samples and random labels as secret keys, and employs clean-label targeted data poisoning to subtly alter a small portion (0.1%) of the dataset. When models are trained on the protected dataset, they respond to these key samples with corresponding key labels, allowing for statistical verification with only black-box access to the model. The authors validate their approach through comprehensive experiments on ImageNet1k using Vision Transformer and ResNet models, demonstrating that data taggants can reliably detect models trained on the protected dataset with high confidence, without compromising validation accuracy. The method proves to be stealthy, robust against various defense mechanisms, and effective across different model architectures and training recipes. It also provides stronger theoretical guarantees against false positives compared to previous approaches.", "questions": "1. How does the method defend against an adversary who knows the exact verification technique?\n2. Why was 0.1% chosen as the modification budget, and how sensitive is the method to this choice?\n3. Have you investigated potential negative effects on downstream tasks?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Use out-of-distribution samples as keys is quite novel.\n2. Provides stronger statistical guarantees than previous work.\n3. Well-structured methodology presentation.", "weaknesses": "1. Lacks formal security analysis against adaptive attacks.\n2. No investigation of downstream task impacts", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "plhLTzfNPP", "reviewer": "Reviewer_3ipm", "summary": "The paper proposes an active dataset ownership verification (DOV) method, by adapting a technique for targeted data poisoning from prior work. The key advantages of the proposed approach are its applicability given only top-k black-box access, more principled/rigorous statistical certificates compared to prior work, stealthiness, and robustness to different setups as well as explicit defenses. All these properties are validated via thorough experimental evaluation.", "questions": "- Optimization is done only w.r.t. fully trained model parameters. Yet, the goal of the gradient matching is to make training a model from scratch on Taggants equivalent to training it on Keys. Why are some randomly initialized models not included? Do you have insight why despite this, the surrogate objective seems to work? \n- How should tau=0 on ln317 be interpreted? If I understand correctly, this means all models with non-zero accuracy on Keys are flagged?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "- DOV is an important problem, and authors explicitly focus on realistic setups and often overlooked aspects such as the rigor of stated guarantees that accompany methods.\n- The method is original within the space of DOV. The idea of repurposing witches brew and introducing random data sampling to strengthen the theoretical guarantees is very interesting and unexpected. \n- Evaluation focuses on a large-scale practical setup and addresses many important points, evaluating stealthiness and robustness explicitly. I appreciate the inclusion of poisoning defenses and OOD detection. \n- Setting the scope of evaluation aside (see below), the provided results seem quite strong.\n- The paper is mostly well-written and easy to read, with some exceptions discussed below.", "weaknesses": "I can identify several important weaknesses of the work in its current state, and provide suggestions how these could be improved:\n- **Incomplete evaluation/related work positioning**: While DOV is a crowded space and many baselines are cited in the paper, only two are run in the experimental part, without clear rationale, and the relationship to prior methods is in my view not clearly presented in the paper. For example, while the position of the paper seems to be \"there may be DOV methods with strictly better TPR but they come with problems such as unrigorous guarantees or perceptible data changes\", current Table 1 shows Taggants are the best even when only measuring TPR, which to me suggests that baselines are missing. The field is complex and there are many dimensions (active vs passive, blackbox top-k vs needs logits vs needs whitebox, different guarantee types, clean label vs perceptible, etc.). To give clarity, I believe the paper must (i) clearly outline all dimensions and place all prior baselines within them (ii) include any viable baseline (e.g., a perceptible method can be still run to demonstrate that even though it achieves high FPR, it fails a data poisoning defense) and clearly state why the others can not / should not be included. This would greatly improve the trust in the experimental results and make the case for Taggants.\n- **Unclear claims of technical contribution**: The paper should clearly mark that many technical parts are directly lifted from Witches Brew (e.g., augmentations, restarts), while some other parts are introduced by this work (e.g., the use of random data, perceptual loss). The current writing can easily be interpreted as an overclaim, esp. by a reader not familiar with prior work. The actual contributions are quite interesting, and I do not think the lack of tech. contribution is a weakness of the paper in any case.\n- **Unsubstantiated claims around guarantees**: One of the key claimed advantages of Taggants are rigorous guarantees not offered by prior work, as (i) random data samples are actually independent and (ii) under the null, the classifications of random data are actually uniform. While I tend to agree on an intuitive level, I believe (1) the reasons why prior work violates (i,ii) could be more clearly explained, e.g., ln301 simply states that \"using model's predictions on ground truth class\" violates the independence assumptions, but does not elaborate; (2) to show actual impact of this oversight of prior work, it should be empirically demonstrated that there is a mismatch between theoretical and empirical FPR (3) for taggants, there should be a corresponding matching FPR empirical validaiton, and a more detailed discussion around why taggants do not break the assumptions. Are model predictions on random [0,1]^d data really uniformly random? All these images are unusually high-variance compared to natural data; if we had a class such as \"TV static\" I can imagine they would all be classified as such? Do we need a different OOD distribution in this case, and how would we choose it? This needs more clarity as it is uite central to the paper.\n- **[Minor] Key technical contribution undexplored**: If I understand correctly, the motivations given for how Keys are sampled are more rigorous guarantees as above, and lower likelihood to alter model utility, as data is OOD. However, Table 3 also shows forcing the model to predict a certain class is easier in this case than for in-distribution test images. If am not misinterpreting Table 3, it would be interesting to know why this is the case, and state it as the third reason for using such Key sampling to avoid confusion. Is it that gradient matching is here a better proxy for the true objective, or the objective is easier to optimize as we are far from the real data manifold? This seems underexplored but is a central idea of the paper. \n\nTypos and points that do not affect my evaluation:\n- ln151: dot missing, ln518: extra dot, ln188: extra \"them\". ln317: \"In each experiment...\" sentence seems wrong, not sure where.\n- Related work says \"[Data/model] watermarks are not designed to persist through processes that use the data\", but I am not sure this is really the case, as these watermarks are generally designed with the goal of robustness. There are works that show (albeit on text) explicitly that such watermarks can persist through processes of finetuning and RAG (see Sander et al. \"Watermarking Makes Language Models Radioactive\" and Jovanovic et al. \"Ward: Provable RAG Dataset Inference via LLM Watermarks\")---this discussion could be included to give context. On a similar note, the data/model/backdoor watermarks distinction could be made clearer, e.g. by changing the first paragraph title in Sec. 2.\n\nI am happy to hear from authors regarding these points and discuss them further.\n\n=====\n\nUPDATE: Score increased from 5 to 6 after rebuttal; see discussion thread below.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "oRwbDswzZJ", "reviewer": "Reviewer_RFB3", "summary": "The paper proposed a dataset ownership verification method that can work in a black-box setting, where model weights and training details are not known in advance; Besides, the method is also stealthy compared to the backdoor-based method since it only requires limited perturbations to the dataset; Moreover, the method is also less harmful than the previous backdoor-based method.", "questions": "See the weakness part.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- The proposed method focuses on harmlessness, stealthiness, and black-box, which are three important challenges in the ownership verification problem.\n- The writing is easy to understand and follow.", "weaknesses": "- Novelty issues: Could you compare this paper with [1] in more detail, such as technical details, setting, and problem setup? Since in my understanding, [1] used a similar gradient-matching-based method to find some \"hardly generalized domain\", which is very similar to this method on a high level.\n- Unclarified arguments: In Lines 59-60, the authors mentioned that 'but is also harmful to the model as it introduces errors [1]'. Could you further clarify what kind of errors the backdoor-based method introduces? In my personal understanding, the claim of \"harmless\" in [1] is mainly based on the fact that the backdoor-based method will leave exploits in the dataset, which will then further be maliciously used by the adversaries.\n- Unclarified intuitions: The intuitions on why the \"out-of-distribution\" samples are used to construct key images are not further clarified.\n- Experimental Details: Why do you choose SleeperAgent as the backdoor method for the baseline \"Backdoor watermarking\"? SleeperAgent is not the simplest way to inject backdoors and even requires an additional surrogate model to optimize perturbation $\\delta$ to the original dataset. Therefore, could you (1) further clarify what is the necessity of choosing SleeperAgent, (2) provide more explanations on why the backdoor watermarking only achieves 0 TPR on your setting, and (3) provide additional experiments on the Backdoor watermarking with BadNet?\n\n[1] Junfeng Guo, Yiming Li, Lixu Wang, Shu-Tao Xia, Heng Huang, Cong Liu, and Bo Li. Domain watermark: Effective and harmless dataset copyright protection is closed at hand.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "v6W4kN5En0", "reviewer": "Reviewer_CRSk", "summary": "In this paper, the authors propose Data Taggants, a dataset ownership method used to detect unauthorized data usage. Data Taggants relies on clean-label targeted data poisoning technique and requires only black-box access to the suspected model. Data Taggants generate secret keys, i.e., (input label) pairs, and signed input samples by maximizing the alignment between keys and signed samples, and induce a certain behavior only on the models trained by the modified version of the dataset including those signed images. The verification procedure of Data Taggants include statistical tests using suspected model's top-k predictions on the secret key.\n\nI think there is novelty, particularly considering the application, but an incremental one as Data Taggants use ideas from gradient matching (Geiping et al. 2020).", "questions": "1. The radioactive data (Sabrayrolles et al., 2020) method has the option of black-box verification. In black-box verification, the radioactive data method compares the difference in loss between clean and radioactive images, and it does not necessarily involve training a student model to replicate the suspected model, it just checks the difference between the loss. Thus, authors' claim in page 1, line 053 as well as in page 3 lines 127-129 are incorrect. I strongly recommend changing the explanation. \n2. I do not understand why the authors think that the independence of observations assumption does not hold in statistical testing. The models' predictions are independent of each other in the inference phase. \n3. The authors empirically show that the data taggants are visually imperceptible, as designed in the methodology. It can work quite nicely on images with a large input space, but my question is how imperceptible this noise will be in data with lower-dimensional input spaces, e.g., smaller images like CIFAR10, gray-scale images or on a different data type like tabular data or text? \n4.  In Table 1, the authors show that the backdoor watermarking (Li et al., 2023) has zero TPR and zero FPR. How authors measured such drastic numbers when the reference reports much better numbers? Is it because backdoor watermarking uses the full probability set instead of top-k labels or due to the mechanism of Wilcoxon-test? \n5. What happens if the adversary decides to use a subset of the dataset? It will negatively affect the verification as the ratio of signed images to the whole dataset might decrease. Another case is how the performance of Data Taggants is affected when the adversary combines different datasets to train its model? The budget B will decrease and smaller budget produce worse results according to Table 3. \n6. Page 2, line 148: typo while giving the reference", "limitations": "", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. Empirical results show that Data Taggants have zero false-positive rate and high true positive rate while maintaining the model performance. \n2. The generation of secret keys is purely random and is not included in the modified dataset, which makes key recovery almost impossible and unique to the data owner. \n3. The presentation is clear.", "weaknesses": "1. As far as I understand, the verification includes querying the suspected model with keys. As they are purely random and out-of-distribution, the adversary might evade the verification by trying to detect those specific inputs and altering the predictions. \n2. The method might be prone to watermark collusion: the adversary can generate its own key set and data taggants by modifying the already signed dataset, and after that it can also claim that the accuser is the malicious one. \n3. Data Taggants has limited effectiveness and robustness when k=1 in top-k predictions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)