Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection
Authors: Yiming Li
Yang Bai
Yong Jiang
Yong Yang
Shu-Tao Xia
Bo Li
Venue: NeurIPS 2022 Accept (2022)
Keywords: Ownership Verification
Dataset Protection
Copyright Protection
Backdoor Attack
AI Security

Abstract: Deep neural networks (DNNs) have demonstrated their superiority in practice. Arguably, the rapid development of DNNs is largely benefited from high-quality (open-sourced) datasets, based on which researchers and developers can easily evaluate and improve their learning methods. Since the data collection is usually time-consuming or even expensive, how to protect their copyrights is of great significance and worth further exploration. In this paper, we revisit dataset ownership verification. We find that existing verification methods introduced new security risks in DNNs trained on the protected dataset, due to the targeted nature of poison-only backdoor watermarks. To alleviate this problem, in this work, we explore the untargeted backdoor watermarking scheme, where the abnormal model behaviors are not deterministic. Specifically, we introduce two dispersibilities and prove their correlation, based on which we design the untargeted backdoor watermark under both poisoned-label and clean-label settings. We also discuss how to use the proposed untargeted backdoor watermark for dataset ownership verification. Experiments on benchmark datasets verify the effectiveness of our methods and their resistance to existing backdoor defenses.

Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection
Yiming Li Yang Bai Yong Jiang', Yong , Shu-Tao Xia', Bo Li'
Tsinghua Shenzhen International Graduate School, Tsinghua University, China
Tenneett Security Zhuque Lab, China
Tencent Security Platform Department, China
"The Department of Computer Science, University of Illinois at Urbana- Cabbana-haampain, USA 11 ym 1ym180000 @0mails tinghua.cc. edu. cn; {mavisbai, cool ctencet com; {jiangy xxistt @sz. tsinghua edu. cn; wbw@illinois.....mm edu
Abstract
Deep neural networks (DNNs) have demonstrated their superiority in practice. Arguably, the rapid development of DNNs is largely benefited from high-quality (open-sourced) datasets, based on which researchers and developers can easily evaluate and improve their learning methods. Since the data collection is usually time-consuming or even expensive, how to protect their copyrights is of great significance and worth further exploration. ership verification. We find that existing verification methods introduced new security risks in DNNs trained on the protected dataset, due to the targeted nature of poison-only backdoor watermarks. To alleviate this problem, in this work, we explore the untargeted backdoor watermarking scheme, where the abnormal model behaviors are not deterministie. Specifically, we introduce two dispersibilitie and prove their correlation, based on which we design the untargeted backdoor watermark under both poisoned-label and clean-label settings. We also discuss how to use the proposed untargeted backdoor watermark for dataset ownership verifica- tion. Experiments and their resistance to existing backdoor defenses. Our codes are available at httpp://ggie cww http://w....ooooiiiiiii///aaaeea Backdoor Btt.Baacckooo_aattrrrrr... Watermark
this paper, we revisit dataset own-
benchmark datasets verify the effectiveness of our methods
Introduction
Deep neural networks (DNNs) have been widely and successfully deployed in many applications, for their effectiveness and efficiency. Arguably, the existence of high-quality open-sourced datasets (e.g-, CIFAR-10 10 1 and ImageNet (2]) is one of the key factors for the prosperity DNNs. Researchers and developers can easily evaluate and improve their methods based on them. However, these datasets may probably be used for commercial purposes without authorization rather than only the educational or academic goals, due to their high accessibility.
Currently, there were some classical methods for data protection, including encryption, data water- marking, and defenses against data leakage. However, these methods cannot be used protect the copyrights of open-sourced datasets, since they either hinder the dataset accessibility or functionality (e.g., encryption), require manipulating the training process (e.g., differential privacy), no effect in this case. To the best of our knowledge, there is only one method 3 designed for protecting open-sourced datasets. Specifically, it first adopted poison-only backdoor attacks (5) to watermark the unprotected dataset and then conducted ownership verification by verifying whether the suspicious model has specific targeted backdoor behaviors (as shown in Figure D
have
'The first two authors contributed equally to this work. Correspondence to: Yang Bai and Shu-Tao Xia.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

DNNs with
Benign Images
Probabilitty the Target
Targeted
Suspiciios
Pelsoord Imagra
Target Label
Hypedacsa Test Hi.Pp > Po
Puisened Images
Labels
Probability on the Target Class Pp
DNN with Our
Untargrted Rackdoor
Figure 2: The inference process of DNNs with different types of backdoor watermarks.
Figure 1: The verification process of BEDW.
In this paper, we revisit dataset ownership verification. We argue that BEDW introduced new threatening security risks in DNNs trained on the protected datasets, due to the targeted manner of existing backdoor watermarks. Specifically, the adversaries can exploit the embedded hidden backdoors to maliciously and deterministically manipulate model predictions (as shown in Figure 2 Based on this understanding, we explore how to design the untargeted backdoor watermark (UBW) and how to use it for harmless and stealthy dataset ownership verification. Specifically, we first introduce two dispersibilities, including averaged sample-wise and averaged class-wise dispersibility, and prove their correlation. Based on them, propose simple yet effective heuristic method for UBW with poisoned labels (i.e.. UBW-P) and the UBW with clean labels (i.e., UBW-C) based on bi-level optimization. The UBW-P is more effective while the UBW-C is more stealthy. We also design UBW-based dataset ownership verification, based on the pairwise T-test 0 at the end.
The main contributions of this paper are four-fold: 1) We reveal the limitations of existing methods in protecting the copyrights of open-sourced datasets; 2) We explore the untargeted backdoor watermark (UBW) paradigm under both poisoned-label and clean-label settings; 3) We further discuss how to use our UBW for harmless and stealthy dataset ownership verification; 4) Extensive experiments on benchmark datasets verify the effectiveness of our method.
2 Related Work
In this paper, we focus on the backdoor watermarks in image classification. The watermarks in other tasks (e.g.. and their dataset protection are out of the scope of this paper.
2.1 Data Protection
Data protection aims to prevent unauthorized data usage or protect data privacy, which has always been an important research direction. Currently, encryption, data watermarking, and the defenses against data leakage are the most widespread methods discussed in data protection, as follows:
Encryption. Currently, encryption is the most widely used data protection method, which intends to encrypt the whole or parts of the protected data [T [2]. Only authorized users have the secret key to decrypt the encrypted data for further usage. Except for directly preventing unauthorized data usage, there were also some empirical methods focused on encrypting only the sensitive information (e.g., backgrounds or image-label mappings) 13
Data Watermarking. This approach initially used to embed a distinctive watermark into the data to protect its copyright based on ownership verification [7 [8] Recently, data watermarking was also adopted for other applications, such DeepFake detection
19 and image steganography
RC inspired by its unique properties.
Defenses against Data Leakage. These methods mainly focus on preventing the leakage of sensitive information (e.g., membership inference [2]] attribute inference [22] and deep gradient leakage
2
during the training process. Among all these methods, differential privacy 24 25 26 is the
most representative one for its good theoretical properties and effectiveness. In general, differential privacy requires to introduce certain randomness via adding noises when training the model.
However, the aforementioned existing methods can not be adopted to prevent open-soured datasets from being unauthorizedly used, since they either hinder dataset functionalities or are not capable in this scenario. To the best of our knowledge, there was only one method 3 designed for protecting open-sourced datasets, based on the poison-only targeted backdoor attacks [5] However, this method will introduce new security threats in the models trained on the protected dataset, which hinders its usage. How to better protect dataset copyrights is still an important open question.

---

2.2 Backdoor Attacks
Backdoor attacks are emerging yet critical threats in the training process of deep neural networks (DNNs), where the adversary intends to embed hidden backdoors into DNNs. The attacked models behave normally in predicting benign samples, whereas the predictions are maliciously changed whenever the adversary-specifen trigger patterns appear. Due this property, they were also used as ownership verification.
the watermark techniques for model [27 28 29 and dataset
In general, existing backdoor attacks can be divided into three main categories, including 1) poison- only attacks 30 31 [ 2) training-controlledd attacks [33 K 35] and 3) model-modified attacks B6 By [8), based on the adversary's 's capacity levels. In this paper, only focus poison-oni onll backdoor attacks, since they are the hardest attack having widespread threat scenarios. Only these attacks can be used to protect open-sourced datasets B 4. In particular, based the label type, existing poison-only attacks can also be separated into two main sub-types, as follows:
Poison-only Backdoor A Attacks with Poisoned I. Labels. In these attacks, the re-assigned labels of poisoned samples are different from their ground-truth labels. For example, a cat-like poisoned image may be labeled the dog in the poisoned dataset released by backdoor adversaries. It is currently the most widespread attack paradigm. To the best of our knowledge, BadNets [30] is the first and most representative attack with poisoned labels. Specifically, the BadNets adversary randomly selects certain benign samples from the original benign dataset to generate poisoned samples, based on adding specific trigger pattern to the images and changing their labels to the pre-defined target label. The adversary will then combine the generated poisoned samples with the remaining benign ones to make the poisoned dataset, which is released to train the attacked models. After that, Chen et al. 39 proposed the blended attack, which suggested that the poisoned image should be similar to its benign version to ensure stealthiness. Most recently, more stealthy and effective attack (i.c., WaNet was proposed, which exploited image warping to design trigger patterns.
Poison-only Backdoor Attacks with Clean Labels. Turner et al. [3I] proposed the first poison-only backdoor attack with clean labels (i.e., label-consistent attack), where the target label is the same as the ground-truth label of all poisoned samples. They argued that attacks with poisoned labels were not stealthy enough even when the trigger pattern was invisible, since users could still identify the attacks by examining the image- relation when they caught the poisoned samples. However, this attack is far less effective when the dataset has many classes or high
(e.g.. GTSRB Most recently, more effective attack (i.e., Sleeper Agent) was proposed, which generated trigger patterns by optimization (40. Nevertheless, these attacks are still difficult since the 'robust features' contained in the poisoned images will hinder the learning of trigger patterns [5]. How to design attacks with clean labels is still left far behind and worth further exploration.
and ImageNet) 40 41 5
Besides, to the best of our knowledge, all existing backdoor attacks are targeted, i.e., the predictions of poisoned samples are deterministic and known by the adversaries. How to design backdoor attacks in an untargeted manner and its positive applications remain blank and worth further explorations.
3 Untargeted Backdoor Watermark (UBW)
3.1 Preliminaries
Threat Model. In this paper, we focus on poison-only backdoor attacks as the backdoor watermarks in image classification. Specifically, the backdoor adversaries are only allowed to modify some benign samples while having neither the information nor the ability to modify other training components (e.g., training loss, training schedule, and model structure). The generated poisoned samples with remaining unmodified benign ones will be released to victims, who will train their DNNs based on them. In partieular, we only consider poison-only backdoor attacks instead of other types of methods (e.g., controleco attacks or model-mode modified attacks) because they require additional adversary capacities and therefore can not be used to protect open-sourced datasets
The Main Pipeline of Existing Targeted Backdoor Attacks. Let = [( v. denotes the benign training set, where a; E X = (0, 1....... 255 xH is the image, y: e = (1...., K} is its label, and K is the number of classes. How to generate the poisoned dataset D, is the cornerstone of poison-only backdoor attacks. To the best of our knowledge, almost all existing backdoor attacks are targeted, where all poisoned samples share the same target label. Specifically,
3

---

De consists of two disjoint parts, including the modified version of selected subset (i.e., D.) of D and remaining benign samples, i.e., D m Db, where yr an idversary-speciineg target label, Dj = D,D,, Dm {(z', v.) Gi 0), (z, E D.), and G X' X' is an adversary-specifee poisoned image generator with parameter 0. In particular, poison-only backdoor attacks are mainly characterized by their poison generator G. For example, [0. 1| xH
[Dal is the poisoning rate, [D]
a & where E the element-wiss product in the blended attack
G(x) = (1 ax)
X is the trigger pattern, and & is 69 G( = x + t in the ISSBA 142 Once the
poisoned dataset D, is generated, it will be released to train DNNs. Accordingly, in the inference process, the attacked model behaves normally on predicting benign samples while its predictions will be maliciously and constantly changed the target label whenever poisoned images appear.
3.2 Problem Formulation
As described in previous sections, DNNS trained on the poisoned dataset will have distinctive behaviors while behaving normally in predicting benign images. As such, the poison-only backdoor attacks can be used to watermark (open-sourced) datasets for their copyright protection. However, this method introduces new security threats in the model since the backdoor adversaries can determine model predictions of malicious samples, due to the targeted nature existing backdoor watermarks. Motivated by this understanding, explore untargeted backdoor watermark (UBW) in this paper.
Our Watermark's 's Goals. The UBW has three main goals, including effectiveness, 2) stealthiness, and 3) dispersibility. Specifically, the effectiveness requires that the watermarked DNNs will misclassify poisoned images: The stealthiness needs that dataset users can not identify the watermark; The dispersibility (denoted in Definition ( ensures dispersible predictions of poisoned images.
Definition 1 (Averaged Prediction Dispersibilityy. Let D = {(r,, Y: y;)) indicates the dataset where Y: E = (1...., K} and C : X ++ y is a classifier. Let p(i) is the probability vector of model predictions on samples having the ground-truth label j. where the i-th element of p(i) is
pli A Ei I1C(xx)) = -) I = =]
(1)
Ex 1y = 5}
The averaged prediction dispersibility Dp is defined as
K
N
Dp
4
1
Tu: = j} H (p()).
(2)
N
1=1
where H()) denotes the entropy
431.
In general, Dp measures how dispersible the predictions of different images having the same label. The larger the Dp. the harder that the adversaries can deterministically manipulate the predictions.
3.3 Untargeted Backdoor Watermark with Poisoned Labels (UBW-P)
Arguably. the most straightforward strategy fulfiil prediction dispersibility make the predictions of poisoned images the uniform probability vector. Specifically, we propose to randomly 'shuffle' the label of poisoned training samples when making the poisoned dataset. This attack dubbed untargeted backdoor watermark with poisoned labels (UBW-P) in this paper.
Specifically, similar the existing targeted backdoor watermarks, our UBW-P first randomly select a subset D. from the benign dataset 'D to make its modified version Dm by Dm "1,-,1,--- [l,-... KK'' denotes sampling y' from the list [1..... K] with equal probability and G is an adversary-specified poisoned image generator. The modified subset Dm associated with the remaining benign samples D(D, will then be
{(x', "'','") |æe G(æ; 0), y ~[1,-- [1,.... K], (ax, y) E D.). where 'y' ~
released to train the model (-:w)) by
min (a P...)ED. where L is the loss function (e-g., cross-entropy
Σ
c(fæ;;w))1)
43
In the inference process, for any testing sample (œ, ÿ) $ D. the adversary can activate the hidden backdoor contained in attacked DNNs with poisoned image G(ă), based on the generator G.

---

3.4 Untargeted Backdoor Watermark with Clean Labels (UBW-C)
As we will demonstrate in Section 1 the aforementioned heuristic UBW-P can reach promising results. However, it is not stealthy enough even though the poisoning rate can be small, since UBW-P is still with poisoned labels. Dataset users may identify the watermark by examining the image-label relation when they catch the poisoned samples. In this section, we discuss how to design the untargeted backdoor watermark with clean labels (UBW-C), based on the bi-level optimization
To formulate UBW-C as a bi-level optimization, we need to optimize the prediction dispersibility. However, it is non-differentiable and therefore cannot be optimized directly. In this paper, we introduce two differentiable surrogate dispersibilities to alleviate this problem, as follows:
Definition 2 (Averaged Sample-wise and Class Class-wise Dispersibility). Let D = {( y:) indicates the dataset where y: E y {l,.... KK}, }. the averaged sample-wise dispersibilityy of predictions given by the DNN f()) (over dataset D) is defined as
N
D A
Σ (f(a:))
(4)
while the class-wise dispersibility is defined as
Iu -3 -.-H H E f(m)) I(y: 5) Σ T(m =)
De _
(5)
In general, the averaged sample-wise dispersibility describes the average dispersion of predicted probability vectors for all samples, while the averaged class-wise dispersibility depicts the average degree of the dispersion of the average prediction of samples in each class. Maximizing them will have similar effects in optimizing the prediction dispersibility Dp.
In particular, the main difference of UBW-C compared with UBW-P and existing targeted backdoor watermarks lies in the generation of the modified subset D, Specifically, in UBW-C, we do not modify the labels of all poisoned samples, i.c., Dm = {(x', y) x' = G( (x, y) E Dz}. Before first present the necessary lemma and theorem.
reach the technical details of our UBW-C,
Lemma 1. The averaged class-wise dispersibility is always greater than or equal the averaged sample-wiss wise dispersibility i.e., D, I De- Besides, the equality holds if and only if f(x;) (xz)), j [1,...,NN] .N}.
Theorem 1. Let f(: w) indicates the DNN with parameter w. G(-;0) denotes the poisoned image generator with parameter 0, and D {(x, y:)) a given dataset with K classes, we have
EN Di-1 f(G(x; 0);w) 13: j}
max
H (J(G(#; (); max
ΣΣ ==
M = jJ-
Em=1- =
Theorem Mimplies that can optimize the averaged sample-wise dispersibility Da and the class- wise dispersibility De simultaneously by only maximizing D.. motivates us to generate the modified subset Dm in our UBW-C (via optimizing generator G) as follows:
max Σ (D.))ED
[C[f(G(x:; 0): w)))) + X (f) w],,,
(6)
s.t. w" arg min (#.))D,
Σ ((f(x; v),
where À is a non-negative trade-off heneerfffypprrpaaaae hyper-parameter.
In general, the aforementioned process is a standard bi-level optimization, which can be effectively and efficiently solved by alternatively optimizing the lower-level and upper-level sub-problems [44] In particular, the optimization is conducted via stochastic gradient descent (SGD) with mini-batcher 45). where estimating the class-wise dispersibility is difficult (especially when there are many classes). In contrast, the estimation of sumple-wise dispersibility D, is still simple and accurate even within a mini-batch. It is another benefit of only using the averaged sample-wise dispersibility for optimization in our UBW-C Please refer to the appendix for more optimization details.
5

---

Towards Harmless Dataset Ownership Verification via UBW
4.1 Problem Formulation
Given suspicious model, the defenders intend to verify whether it is trained the (protected) dataset. Same as the previous work 3 4. we assume that the dataset defenders can only query the suspicious model to obtain predicted probability vectors of input samples, whereas having no information about the training process and model parameters.
4.2 The Proposed Method
Since defenders can only modify the released dataset and query the suspicious model, the only way to tackle the aforementioned problem is to watermark the (unprotected) benign dataset so that models trained on will have specific distinctive prediction behaviors. The dataset owners can release the watermarked dataset instead of the original one for copyright protection.
As described in Section E the DNNS watermarked by our UBW behave normally on benign samples while having dispersible predictions poisoned samples. As such, it can be used to design harmless and stealthy dataset ownership verification. general, given suspicious model, the defenders can verify whether it was trained on the protected dataset by examining whether the model contains specific untargeted backdoor. The model is regarded as trained on the protected dataset if it contains that backdoor. To verify it, we design hypothesis-test-baat
method, as follows:
Proposition 1. Suppose fxx is the posterior probability of æ predicted by the suspicious model. Let variable X denotes the benign sample and variable X' is its poisoned version (i.e., X' G(X)), while variable Pa= f(X)y and P, J(X') indicate the predicted probability on the ground-truth label Y of X and X', respectively. Given the null hypothesis Ho Pb Pp + T (H1 : P, > Pp + T) where the hyper-purameterr E [0, 1}, we claim that the suspicious model is trained on the protected dataset (with T-certainty) if and only if Ho is rejected.
In practice, we randomly sample m different benign samples to conduct the pairwise T-test O and calculate its p-value. The null hypothesis Ho is rejected if the p-value is smaller than the significance level a. In particular, we only select samples that can be correctly classified by the suspicious model to reduce the side-effects of model accuracy. Otherwise, due to the untargeted nature of our UBW, our verification may misjudge when there is dataset stealing, if the benign accuracy of the suspicious model is relatively low. Besides, we also calculate the confidence score AP Ps - Pp to represent the verification confidence. The larger the AP, ,, the more confident the verification.
5
Experiments
5.1 Experimental Settings
Datasets and Models. In this paper, conduct experiments on two classical benchmark datasets, including CIFAR-10 [I] and (a subset of) ImageNet (2). with ResNet-18 [46] Specifically, we randomly select subset containing 50 classes with 25, 000 images from the original ImageNet for
training (500 images per class) and 2, 500 images for testing (50 images per class). For simplicity, all
images are resized 3 x 64 x 64, following the settings used in Tmay-ImageNet 477
Baseline Selection. We compare our UBW with representative existing poison-only backdoor attacks. Specifically, for attacks with poisoned labels, we adopt BadNets [00, blended attack (dubbed as 'Blended') [39], and WaNet [32) as the baseline methods. They are the representative of visible attacks, patch- based invisible attacks, and non-patch-based invisible attacks, respectively. We use the label-consistent attack (dubbed as -aabel-Consistent)) [II] and Sleeper Agent [40] as the representative of attacks with clean labels. Besides, also include the models trained the benign dataset (dubbed as 'No Attack') as another baseline for reference.
5.2 The Performance of Dataset Watermarking
Settings. We set the poisoning rate 7 = 0.1 for all watermarks on both datasets. In particular, since the label-consistent attack can only modify samples from the target class, its poisoning rate is set

---

Sleeper Agent automobile
sirplance
airpling
sirplane
antommeilee
sutomobile
Benign Sample
automoblle
automobile
automobile
sutomobik
ausomobile
astomobile
antomobile
Poisoned Sample
(a) CIFAR-10
BadNets Broc
Blended
WaNet
UBW-P
Label-Comistent
Sleeper Aepper-ggent cas
UBW-C dos
Stuck
truck
ruil
Benign
Sample
nail
rail
nail
nzil
nail
c3rl
dog
Poisoned
Sample
(b) ImageNet
Figure 3: The example of samples involved in different backdoor watermarks. In the BadNets, blended attack, WaNet, and UBW-P, the labels of poisoned samples are inconsistent with their ground-truth ones. In the label-consistent attack, Sleeper Agent, and UBW-C, the labels of poisoned samples are the same as their ground-trun -ruth ones. In particular, the label-consistent attack can only poison samples in the target class, while other methods can modify all samples.
Table 1: The watermark performance on the CIFAR- 10 dataset.
Label Typel
Target Type|
Method], Metric+
BA (%)
ASR-A (%)
ASR-C
D2
N/A
Attack
92.53
N/A
N/A
N/A
BadNets
91.52
100
100
0.0000
Targeted
Blended
91.61
100
100
0.0000
Poisoned-L.an
WaNet
90.48
95.50
95.33
0.1979
Untargeted
UBW-P (Ours)
90.59
92.30
92.51
2.2548
Lobsi-Con
82.94
96.00
95.80
0.9280
Targeted
Clean-Label
Sleeper Agent
86.06
70.60
54.46
1.0082
Untargeted
UBW-C (Ours)
86.99
89.80
87.56
1.2641
to its maximum (i.e., 0.02) on the ImageNet dataset. The target label is set to for all targeted watermarks. Besides, following the classical settings in existing papers, we adopt a white-black square as the trigger pattern for BadNets, blended attack, label-consistent attack, and UBW-P on both datasets. The trigger patterns adopted Sleeper Agent and UBW-C are sample-specific. We set À = 2 for UBW-C on both datasets. The example of poisoned samples generated by different methods is shown Figure More detailed settings are described in the appendix.
Evaluation Metrics. We use the benign accuracy (BA), the attack success rate (ASR), and the averaged prediction dispersibility (Dp) to evaluate the watermark performance. In particular, we introduce two types of ASR, including the attack success rate on all testing samples (ASR-A) and the attack success rate on correctly classified testing samples (ASR-C). In general, the larger the BA, ASR, and Dy, the better the watermark. Please refer to the appendix for more details.
Results. As shown in Table the performance of our UBW is par with that of baseline targeted backdoor watermarks under both poisoned-label and clean-label settings. Especially under the clean-label setting, our UBW-C is significantly better than other watermarks with clean labels. For example, the ASR-C increases of our method compared with aabel-consistent attack and Sleeper Agent are both over 55% on ImageNet. These results verify that our UBW can implant distinctive behaviors in attacked DNNs. In particular, our UBW has significantly higher averaged prediction dispersibility Dp. especially under the noisoned-labes setting. For example, the Dp of UBW-P is more than 10 times larger than that of all baseline attacks with poisoned labels on the CIFAR- 10 dataset. These results verify that the UBW can not manipulate malicious predictions deterministically and therefore is hurmless. Moreover, we notice that the Dp of label-consistent attack and Sleeper Agent is similar to that of our UBW-C some extent. is mostly because targeted attacks with clean labels are significantly more difficult in making all poisoned samples to the same (target) class.
7

---

Table 2: The watermark performance on the ImageNet dataset.
Label Typel
Target Typel
MethodJ, Metric-
BA (%)
ASR-A (%)
ASR-C (%)
Dp
N/A
No Attack
67.30
N/A
N/A
N/A
BadNets
65.64
100
100
0.0000
Targeted
Blended
65.28
88.00
85.37
0.3669
Poisoned-Lacd
WaNet
62.56
78.00
73.17
0.7124
Untargeted
UBW-P (Ours)
62.60
82.00
82.61
2.7156
Label-Consistent
62.36
30.00
2.78
1.2187
Targeted
Clean-Label
Sleeper Agent
56.92
6.00
2.31
1.0943
Untargeted
UBW-C (Ours)
59.64
74.00
60.00
2.4010
Table 3: The effectiveness of dataset ownership verification via UBW-P.
CIFAR-I0
ImageNet Independent-M
Independent-T
Independent-M
Malicious
Independent-T
Malicious
-0.0269
0.0024
0.7568
0.1281
0.0241
0.8000
p-value
1.0000
1.0000
10 36
0.9666
1.0000
10 10
Table 4: The effectiveness of dataset ownership verification via UBW-C.
CIFAR-10
ImageNet
Independent-T
Independent-M
Malicious
Independent-T
Independent-M
Malicious
AP'
0.1874
0.0171
0.61IS
0.0588
0.1361
0.4836
p-value
0,9688
1.0000
10 10-14 14
0.9999
0.9556
0.0032
5.3 The Performance of UBW-based Dataset Ownership Verification
Settings. We evaluate our verification method in three representative scenarios, including 1) independent trigger (dubbed 'Independent-T"' 2) independent model (dubbed 'Independent- M'), and 3) unauthorized dataset usage (dubbed as 'Malicious'). ). In the first scenario, we query the attacked suspicious model using the trigger that is different from the one used for model training; In the second scenario, we examine the benign suspicious model using the trigger pattern; We adopt the trigger used in the training process of the watermarked suspicious model in the last scenario. We T 0.25 for the hypothesis-test in all cases. More detailed settings are in the appendix.
Evaluation Metrics. We adopt the AP [-1, 1] and the p-value [0, 1] for the evaluation. For the two independent scenarios, the smaller the AP and the larger the p-value, the better the verification; For the malicious one, the larger the AP and the smaller the p-value, the better the verification.
Results. As shown in Table our dataset ownership verification effective in all cases, no matter under UBW-P or UBW-C. Specifically, our method can accurately identify unauthorized dataset usage (i.e., 'Malicious') with high confidence (i.e., AP >> and p-value < 0.01) while does not misjudge (i.e., AP is nearly 0 and p-value >> 0.05) when there is stealing (i.e., 'Independent-T" and 'Independent-M". For example, the p-values of verifying independent cases are nearly on both datasets. We notice that the verification performance under UBW-C is relatively poorer than that under UBW-P, although its performance is already capable enough for verification. However, the UBW-C is more stealthy, since the labels of poisoned samples consistent with their ground-truth label and the trigger patterns are invisible. Users can adopt different UBWs based on their needs.
5.4 Discussion
5.4.1 The Ablation Study
In this section, we explore the effects of key hyper-parameters involved in our UBW. The detailed settings and the effects of hhper- parameters involved in ownership verification are in the appendix.
Effects of Poisoning Rate 7/ As shown in Figure the attack success rate (ASR) increases with the increase of the poisoning rate Both UBW-P and UBW-C reach promising ASR even when is small (e.g., 0.03). Besides, the benign accuracy decreases with the increase of y. Users should assign y based on their specific requirements in practice.
X. As shown Figure 5 the averaged prediction dispersibil- ity Dr increases with the increase of X. This phenomenon indicates that the averaged sample-wise dispersibility D. used in our UBW-C is good approximation of Dp- In contrast, increasing has minor effects in ASR, which is probably because the untargeted attack scheme is more stable.
Effects of Trfde-off

---

UBW-P
UBW-C
UBW-C
1.5
93
ASR-C (56)
75
ASR- C (9)
90
60
45
0.9
87
30
80
84
15
0.4
1.6 2.0
0.8 1.2
Polsoning Rate (%)
Polsoning Rate (%)
Hyper-parameter
Hyper-parameter
Figure 4: The effects of poisoning rate ?.
Figure The effects of thyper-paraman X.
BA 1N)
ASR:C (95)
ASR-C
UBW-P
UBW-C
UBW-P
UBW
90
90
80
80-
75
70
70
50-
60
60
20
40
60 Epoch
80
100
50
0
20
40
60
80
100
20
40
60
80
100
0
20
40
60
80
100
Epech
Pruning Rate (%)
Pruning Rate (%)
Figure 6: The resistance to fine-tuning,
Figure 7: The resistance to model pruning.
5.4.2
Resistance to Backdoor Defenses
In this section, we discuss whether our UBW is resistant to existing backdoor defenses so that it can still provide promising dataset protection even under adaptive opposite methods. In particular, the trigger patterns used by our UBW-C are sample-specific, where different poisoned images contain different triggers (as shown in Figure 3). Recently, ISSBA
42 revealed that most of the existing
defenses (e.g.. Neural Cleanse 48 SentiNet 49]. and STRIP (50)) have a latent assumption that
the trigger patterns are sample-agnostie Accordingly, our UBW-C can naturally bypass them, since it breaks their fundamental assumption. Here we explore the resistance of our UBW to fine-tuning [T 52 and model pruning [22 [53, which are the representative defenses whose effects did not rely on this assumption. The detailed settings and resistance to other defenses are in the appendix.
As shown in Figure our UBW is resistant to fine-tuning. Specifically, the attack success rates still larger than 55% for both UBW-P and UBW-C after the fine-tuning process is finished. Besides, our UBW is also resistant to model pruning (as shown Figure 7 The ASRs of both UBW-P and UBW-C are larger than 50% even under high pruning rates, where the benign accuracies are already low. An interesting phenomenon is that as the pruning rate increases, the ASR of UBW-C even increases for period. We speculate that it is probably because our UBW-C is untargeted and sample-specific, and therefore can reach better attack effects when the model's 's benign functions are significantly depressed. We will further discuss its mechanism in our future work.
Societal Impacts
This paper is the first attempt toward untargeted backdoor attacks and their positive applications. In general, our main focus is how to design and use untargeted backdoor attacks as harmless and stealthy watermarks for dataset protection, which has positive societal impacts. We notice that our untargeted backdoor watermark (UBW) is resistant to existing backdoor defenses and could be maliciously used by the backdoor adversaries. However, compared with existing targeted backdoor attacks, our UBW is untargeted and therefore has minor threats. Moreover, although an effective defense is yet to be developed, people can still mitigate or even avoid the threats by only using trusted training resources.
7 Conclusion
In this paper, we revisited how to protect the copyrights of (open- -ouured datasets. We revealed that existing dataset ownership verification could introduce new serious risks, due the targeted nature of existing poison-only backdoor attacks used for dataset watermarking. Based on this understanding. we explored the untargeted backdoor watermark (UBW) paradigm under both poisoned-labe and clean-label settings, whose abnormal model behaviors were not deterministic. We also studied how to exploit our UBW for harmless and stealthy dataset ownership verification. Experiments on benchmark datasets validated the effectiveness of our method and its resistance to backdoor defenses.

---

Acknowledgments
This work is supported in part by the National Natural Science Foundation of China under Grant 62171248, the PCNL Key Project (PCL2021A07) A07), the Tencent Rhino-Bird Research Program, and the C3 Al and Amazon research awards. We also sincerely thank Linghui Zhu from Tsinghua University for her assistance in the experiments of resistance to saliency-based backdoor defenses.
References
[1] Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009.
[2] Jia Deng, Wei Dong. Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, 2009.
[3] Yiming Li, Ziqi Zhang, Jiawang Bai, Baoyuan Wu, Yong Jiang, and Shu-Tao Xia. open-sourced dataset protection via backdoor watermarking, In NeurIPS Workshop, 2020.
[4] Yiming Li, Mingyan Zhu, Xue Yang, Yong Jiang, and Shu-Tao Thu-Tao Xia. Black-box ownership verification for dataset protection via backdoor watermarking. arXiv preprint 5,X/v:2009.06/5, 2022.
[5] Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems, 2022.
[6] Robert Hogg, Joseph McKean, and Allen Craig. Introduction to mathematical statistics. Pearson Education, 2005.
[7] Zhen Xiang, David J Miller, Siheng Chen, Xi Li, and George Kesidis. A backdoor attack against 3d point cloud classifiers. In ICCV, 2021.
[8] Nicholas Carlini and Andreas Terzis. Poisoning and backdooring contrastive learning. In ICLR, 2022.
[9] Yiming Li, Haoxiang Zhong. Xingjun Ma, Yong Jiang, and Shu-Tao Xia. Few-shot backdoor attacks on visual object tracking. In ICLR, 2022.
[10] Ronald Rivest. The md5 message-digest algorithm. Technical report, 1992.
[11] Dan Boneh and Matt Franklin. Identity-band based encryption from the weil pairing. In CRYPTO, 2001.
[12] Paulo Martins, Leonel Sousa, and Artur Mariano. A survey on fully homomorphic encryption: An engincering perspective. ACM Computing Surveys, 50(6):1-33, 2017.
[13] Zuobin Xiong, Zhipeng Cai, Qilong Han, Arwa Alrawais, and Wei Li. Adgan: protect your location privacy in camera data of auto-driving vehicles. IEEE Transactions on Industrial Informatics, (7(9):6200-6210 2020.
[14] Yiming Li, Peidong Liu, Yong Jiang, and Shu-Tao Xia. Visual privacy protection via mapping distortion. In ICASSP, 2021.
[15] Zhipeng Cai, Zuobin Xiong, Honghui Xu, Peng Wang, Wei Li, and Yi Pan. Generative adversarial networks: A survey toward private and secure applications. ACM Computing Surveys, 54(6):1-38, 2021.
[16] Mitchell D Swanson, Mei Kobayashi, and Ahmed H Tewfik. Multimedia data-embeddingg and watermarking technologies. Proceedings of the IEEE, 86(6):0064 1087, 1998.
[17] Yuanfang Guo, Osear Au, Rui Wang, Lu Fang, and Xiaochun Cao. Halftone image wa- termarking by content aware double-sided embedding error diffusion. IEEE Transactions on Image Processing. 27(7):38773302, 2018.
[18] Sahar Abdelnabi and Mario Fritz. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In IEEE S&P, 2021.
10

---

[19] Run Wang, Felix Juefei-Xu, Meng Luo, Yang Liu, and Lina Wang. Faketagger: Robust safeguards against deepfake dissemination via provenance tracking. In ACM MM, 2021.
[20] Zhenyu Guan, Junpeng Jing, Xin Deng, Mai Xu, Lai Jiang, Zhou Zhang, and Yipeng Li. Deepmih: Deep invertible network for multiple image hiding, IEEE Transactions on Puttern Analysis and Machine Intelligence, 2022.
[21] Reza Shokri, Marco Stronati, Congzheng Song. and Vitaly Shmatikov. Membership inference attacks against machine learning models. In IEEE S&P, 2017.
[22] Neil Zhenqiang Gong and Bin Liu. You are who you know and how you behave: Attribute inference attacks via users' social friends and behaviors. In USENIX Security, 2016.
[23] Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In NeurIPS, 2019.
[24] Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Theoretical Computer Science, 9(3-4):211 1-117, 2014.
[25] Linghui Zhu, Xinyi Liu, Yiming Li, Xue Yang, Shu-Tao Xia, and Rongxing Lu. A fine-grained differentially private federated learning against leakage from gradients. IEEE Internet of Things Journal, 2021.
[26] Jiawang Bai, Yiming Li, Jiawei Li, Xue Yang, Yong Jiang, and Shu-Tao Xia. Multinomial random forest. Pattern Recognition, 122: 108331, 2022.
[27] Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In USENIX Security, 2018.
[28] Hengrui Jia, Christopher Choquette- Chho, Varun Chandrasekaran, and Nicolas Papernot. Entangled watermarks as defense against model extraction. In USENIX Security, 2021.
[29] Yiming Li, Linghui Zhu, Xiaojun Jia, Yong Jiang, Shu-Tao Xia, and Xiaochun Cao. Defending against model stealing via verifying embedded external features. In AAAI, 2022.
[30] Tianyu Gu, Kang Liu, Brendan Dolan-Gavite and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230-47244, 2019.
[31] Alexander Turner, Dimitris Tsipras. and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint arXiv: 19/2.0977, 2019.
[32] Anh Nguyen and Anh Tran. Wanet-impercepibble warping-based backdoor attack. In ICLR, 2021.
[33] Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. Hidden trigger backdoor attacks. In AAAI, 2020.
[34] Yi Zeng, Won Park, Z. Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks' triggers: frequency perspective. In ICCV, 2021.
[35] Ilia Shumailov, Zakhar Shumaylov, Dmitry Kazhdan, Yiren Zhao, Nicolas Papernot, Murat A Erdogdu, and Ross Anderson. Manipulating sgd with data ordering attacks. In NeurlPS, 2021.
[36] Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Tbt: Targeted neural network attack with bit trojan. In CVPR, 2020.
[37] Yajie Wang, Kongyang Chen, Shuxin Huang, Wencong Ma, Yuanzhang Li, et al. Stealthy and flexible trojan in deep learning framework. IEEE Transactions on Dependable and Secure Computing, 2022.
[38] Xiangyu Qi, Tinghao Xie, Ruizhe Pan, Jifeng Zhu, Yong Yang, and Kai Bu. Towards practical deployment-stard backdoor attack on deep neural networks. In CVPR, 2022.
[39] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on 2017.
deep learning systems using data poisoning, arXiv preprint
11

---

[40] Hossein Souri, Micah Goldblum, Liam Fowl, Rama Chellappa, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. In NeurIPS, 2022.
[41] Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. In ICLR, 2022.
[42] Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In ICCV, 2021.
[43] Solomon Kullback. Information theory and statistics. Courier Corporation, 1997.
[44] Risheng Liu, Jiaxin Gao, Jin Zhang, Deyu Meng, and Zhouchen Lin. Investigating bi-level optimization for learning and vision from unified perspective: A survey and beyond. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2021.
[45] Sebastian Ruder. An overview of gradient descent optimization algorithms. arXiv preprint arXiv: 1rXiv:1609.044477, 2016.
[46] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
[47] Patryk Chrabaszez, Ilya Loshchilov, and Frank Hutter. A downsampled variant of imagenet as an alternative to the cifar datasets. arXiv preprint arXiv: 1707.08877 2017.
[48] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE S&P, 2019.
[49] Edward Chou, Florian Tramer, and Giancarlo Pellegrino. Sentinet: Detecting localized universal attacks against deep learning systems. In IEEE S&P Workshop, 2020.
[50] Yansong Gao, Yeonjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal, Damith Ranasinghe, and Hyoungshick Kim. Design and evaluation of multi-domain trojan detection method on deep neural networks. IEEE Transactions on Dependable and Secure Computing, 2021.
[51] Yuntao Liu, Yang Xie, and Ankur Srivastava. Neural trojans. In ICCD, 2017.
[52] Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks deep neural networks. In RAID, 2018.
[53] Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models. In NeurlPS, 2021.
[54] Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. ICCV, 2021.
[55] Yiming Li, Mengxi Ya, Yang Bai, Yong Jiang, and Shu-Tao Xia. BackdoorBox: A python toolbox for backdoor learning. 2022.
[56] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
[57] Yihui He, Xiangyu Zhang, and Jian Sun. Channel pruning for accelerating very deep neural networks. In ICCV, 2017.
[58] Junfeng Guo, Ang Li, and Cong Liu. Aeva: Black-box backdoor detection using adversarial extreme value analysis. In ICLR, 2022.
[59] Guanhong Tao, Guangyu Shen, Yingqi Liu, Shengwei An, Qiuling Xu, Shiqing Ma, Pan Li, and Xiangyu Zhang. Better trigger inversion optimization in backdoor scanning. In CVPR, 2022.
[60] Xijie Huang, Moustafa Alzantot, and Mani Srivastava. Neuroninspect: Detecting backdoors in neural networks via output explanations. arXiv preprint arXiv: 2019.
12

---

[61] Bao Gia Doan, Ehsan Abbasnejad, and Damith C. Ranasinghe. Februus: Input purification defense against trojan attacks on deep neural network systems. In ACSAC, 2020.
[62] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In ICCV, 2017.
[63] Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. In NeurlPS, 2018.
[64] Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation elustering. In AAAI Workshop, 2019.
[65] Pu Zhao, Pin- Yu Chen, Payel Das, Karthikeyan Natesan Ramamurthy, and Xue Lin. Bridging mode connectivity in loss landscapes and adversarial robustness. In ICLR, 2020.
[66] Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. In ICLR, 2021.
[67] Jiawang Bai, Bin Chen, Yiming Li, Dongxian Wu, Weiwei Guo, Shu-tao Xia, and En-hui Yang. Targeted attack for deep hashing based retrieval. In ECCV, 2020.
[68] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020.
[69] Bin Chen, Yan Feng, Tao Dai, Jiawang Bai, Yong Jiang, Shu-Tao Xia, and Xuan Wang. Adversarial examples generation for deep product quantization networks on image retrieval. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
[70] Pin- Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsich. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In CCS Workshop, 2017.
[71] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. In ECCV, 2020.
[72] Yan Feng, Baoyuan Wu, Yanbo Fan, Li Liu, Zhifeng Li, and Shutao Xia. Boosting black-bor box attack with partially transferred conditional adversarial distribution. In CVPR, 2022.
[73] Huang Xiao, Battista Biggio, Gavin Brown, Giorgio Fumera, Claudia Eckert, and Fabio Roli. Is feature selection secure against training data poisoning? In ICML, 2015.
[74] Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In ICML, 2017.
[75] Ji Feng, Qi-Zii Cai, and Zhi-Hua Zhou. Learning to confuse: generating training time adversar- ial data with auto-encoder. In NewrIPS, 2019.
[76] Ali Shafahi, W Ronny Huang. Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Du- mitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. NeurlPS, 2018.
[77] Jonas Geiping, Liam Fowl, Ronny Huang, Wojciech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. Witches' brew: Industrial scale data poisoning via gradient matching. In ICLR, 2021.
[78] Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P Dickerson, and Tom Goldstein. Just how toxic is data poisoning? unified benchmark for backdoor and data poisoning attacks, In ICML, 2021.
[79] Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, and Hervé Jégou. Radioactive data: tracing through training. In ICML, 2020.
13


Reviews:
[{"review_id": "kMEHzeBAwz1", "reviewer": "Reviewer_UWLP", "summary": "This paper proposes a dataset protection approach, Untargeted Backdoor Watermark, via crafting untargeted backdoor attacks for the protected dataset. The authors propose their method in two different settings(i.e., mislabel and clean-label settings). Through extensive experiments,  Untargeted Backdoor Watermark is proved to be effective and robust against various defense approaches in two different settings.", "questions": "1. Can you add more descriptions regarding datasets protection and encryption?", "limitations": "1. Can u give some practical scenarios to illustrate the importance of UBW.", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "\n================= Strength================= \n1. The studied problem is interesting. \n2. The evaluation is comprehensive. \n3. The overall presentation is good.\n\n\n=================Weakness================\n\n1.   Lack some in-depth discussions on the selection of triggers and provide a practical scenario for data leakage.\n2.  It lacks a discussion on the potential negative impact brought by the protected dataset. For example, will the model trained through the protected dataset perform vulnerable against backdoor attacks?\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "fR3qiUq7ISY", "reviewer": "Reviewer_LiAP", "summary": "The paper aimed to protect open-source datasets from illegal DNN training by injecting verifiable backdoor watermarks. It first revealed that the existing backdoor watermarking techniques used targeted labels and could be exploited by adversaries for attacks. It then proposed novel untargeted backdoor watermarking techniques that are both effective and harmless in poisoned-label (UBW-P) and clean-label (UBW-C) settings. UBW-P stamped simple backdoor triggers on a subset of data and changed their labels randomly. UBW-C did not modify image labels; it instead optimized the trigger generation function in a bi-level optimization. The proposed methods were verified on CIFAR-10 and ImageNet, showing high effectiveness and dispersibility while being stealthy to standard backdoor defenses, including Fine-tuning, Fine-pruning, NeuralCleanse, STRIP, and GradCam inspection.", "questions": "- Can we design imperceptible triggers for UBW-P and UBW-C?\n- Are UBW-P and UBW-C stealthy under dataset-based backdoor defenses such as Spectral Signatures and Activation Clustering?\n- Are UBW-P and UBW-C stealthy under recent backdoor defenses such as NAD and Mode Connectivity?", "limitations": "The authors discusses the societal impacts of the proposed technique. I would recommend to add limitations mentioned above.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths:\n- The authors provided a good discussion on the issue of the common targeted backdoor watermarks and why we needed untargeted backdoor watermarks.\n- The proposed untargeted backdoor watermarking techniques are novel and useful. I believe the topic of untargeted backdoors is easy to think of. However, it is not attractive and unexplored in the context of backdoor attacks due to its unpredictability. However, the authors found data watermarking a suitable application for these techniques, in which unpredictability becomes a strength when considering safety.\n- The paper designed two versions for both poisoned-label and clean-label settings.\n- The authors proposed new dispersibility metrics, which are technically sound. They are particularly helpful in designing the clean-label untargeted backdoor watermarks (UBW-C).\n-   The proposed methods were verified on CIFAR-10 and ImageNet, showing high effectiveness and dispersibility while being stealthy to standard backdoor defenses, including Fine-tuning, Fine-pruning, NeuralCleanse, STRIP, and GradCam inspection.\n\n\n## Weaknesses:\n- The proposed watermarks are perceptible by human subjects and can be manually removed. The authors should try the imperceptible techniques:\n   - In UBW-P, instead of using the BadNets triggers, the authors can try the imperceptible ones from WaNet, or LIRA [1].\n   - In UBW-C, there is no constraint to enforce the poisoned image to be similar to the clean one. As a result, we can see apparent artifacts on the poisoned examples. Employing that constraint in the optimization goal (Eq. 6) would be an interesting direction to explore.\n- The authors should verify the proposed watermarking methods under dataset-based backdoor defenses such as Spectral Signatures [2] and Activation Clustering [3].\n- It is also more persuasive if they are verified under more backdoor defenses such as NAD [4] and Mode Connectivity [5].\n- The denotations for the datasets (\\mathcal{D}) and dispersibility metrics (D) are easy to be confused.\n\n[1] Lira: Learnable, imperceptible and robust backdoor attacks. In CVPR 2021.\n\n[2] Spectral signatures in backdoor attacks. In NeurIPS 2018.\n\n[3] Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering. In SafeAI at AAAI 2019\n\n[4] Neural attention distillation: Erasing backdoor triggers from deep neural networks. In ICLR 2021.\n\n[5] Bridging mode connectivity in loss landscapes and adversarial robustness. In ICLR 2020.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "RwEBL1uhaKo", "reviewer": "Reviewer_RZea", "summary": "This paper proposes a methods, UBW-C and UBW-P, to verify unauthorized use of open-sourced dataset. For this, authors train a watermark generator G(. ; theta) using eq. 6 to minimize L(f(G(x:theta);w*),y) and entropy. Also, authors insist that the proposed watermarking is robust in dispersibility for predictions of poisoned data. A malicious network that trained using the watermarked dataset may predict randomly for watermarked test data and clearly for clean test data, so it is possible to verify using the difference between the two predictions, for watermarked and clean test data. ", "questions": "I have some concerns as follow:\n\n1) I cannot be sure about strength of the untargeted watermarking.  What is better than targeted one? In Fig 2, only difference between target label and random label in prediction. \n\n2) Dispersibility occupies large portion of this paper, but I don't undestand necessity of it. It isn't used for training generator in Eq. 6 and 7, and used only as evaluation metric. However, I think it is entropy-based ASR instead of accuracy-based ASR, but they ar not much different. \n\n3) Table 1 and 2 show that the proposed highly drops the benign accuracy from 92.53% to 86.99% for CIFAR10, and 67.3% to 59.6% for ImageNet subset. It seems that the proposed watermark is harmful.\n\n4) Only ResNet-18 and small-scale datasets(CIFAR10 and ImageNet subset) were used in evaluation. Then, only label-consiststent watermarking and Sleeper Agent were compared. I think it is necessary to compare other recent works such as Radioactive Data [1] or which is much similar to the proposed method, or various backdoor attack/data poisoning approaches, and authors have to compare with them.\n\n[1] Sablayrolles et. al.. Radioactive data: tracing through training. ICML 2020\n\n\n\n5) In Eq. 6 and 7, f(.) means NN architecture. Is it necessary to know architecture of malicious model?\n\n\n\n", "limitations": "1) Drop in BA for WBD-C\n\n2) Unclear strength of random classification in dataset watermarking.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "This work has specialty in untargeted attack that makes malicious network predicts random label for watermarked test data. Then, experiment section provides comparisons with some other data poisoning methods on CIFAR10, and ImageNet subset. However, I think this paper is weak in comparisons to similar works under various conditions(architectures, and large-scaled datasets), and the proposed seems quite harmful for original dataset. Also, I think the proposed verification method requires detailed specification on malicious network, so it seems weak on practice.\n\n===============After Author-Reviewer Discussion==========================\nI raised some concerns at the first review, and many of them are discussed duing this period. In specific, issues about applications on large-scaled datasets, and transferability, stealthiness are well addressed.  \n\n\nStrengths: This work addresses an interesting which make a trained DNN predicts random label via dataset watermarking. I think the random prediction is an insightful and novel. Then, large-scaled datasets, and transferability, stealthiness, robustness to defense are well addressed.\n\nWeaknesses: Drop in BA for WBD-C is a weakness, and I'm still not sure about whether the random classification is better than previous guided misclassification for verifying malicious users. I expect the property is fit to attacking purpose.\n\n\nHowever, I think the insightful property is more important, and I'll expect the weakness can be enhanced later. Also, I'll re-update my score at the end of Reviewer-MetaReviewer Discussion. \n\n\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ["Privacy and Security (e.g., consent)"]}, "extra_text": {}}]

Author rebuttal:

Decision: Accept