Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand
Authors: Junfeng Guo
Yiming Li
Lixu Wang
Shu-Tao Xia
Heng Huang
Cong Liu
Bo Li
Venue: NeurIPS 2023 poster (2023)
Keywords: Ownership Verification
Dataset Protection
Copyright Protection
Backdoor Attack
AI Security
TL;DR: We reveal the inherent limitations of backdoor-based dataset ownership verification (DOV) and propose the first truly harmless DOV method motivated by the domain generalization of DNNs.

Abstract: The prosperity of deep neural networks (DNNs) is largely benefited from open-source datasets, based on which users can evaluate and improve their methods. In this paper, we revisit backdoor-based dataset ownership verification (DOV), which is currently the only feasible approach to protect the copyright of open-source datasets. We reveal that these methods are fundamentally harmful given that they could introduce malicious misclassification behaviors to watermarked DNNs by the adversaries. In this paper, we design DOV from another perspective by making watermarked models (trained on the protected dataset) correctly classify some `hard' samples that will be misclassified by the benign model. Our method is inspired by the generalization property of DNNs, where we find a \emph{hardly-generalized domain} for the original dataset (as its \emph{domain watermark}). It can be easily learned with the protected dataset containing modified samples. Specifically, we formulate the domain generation as a bi-level optimization and propose to optimize a set of visually-indistinguishable clean-label modified data with similar effects to domain-watermarked samples from the hardly-generalized domain to ensure watermark stealthiness. We also design a hypothesis-test-guided ownership verification via our domain watermark and provide the theoretical analyses of our method. Extensive experiments on three benchmark datasets are conducted, which verify the effectiveness of our method and its resistance to potential adaptive methods.

Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand
Junfeng Guol.; Yiming Lia.3,, Lixu Wang', Shu-Tao Xia Heng Huang', Cong Liu", Bo Li7.8
DDparrment of Computer Science, University of Maryland
ZZJU-Hande Hangghou Global Scientific and Technological Innovation Center
3 Sccooo of Cyber Science and Technology, Zhejiang University
DDeparmentt of Computer Science, Northwestern University
Tsinghua Shenzhen International Graduate School, Tsinghua University
"Department of Electronic and Computer Engineering, UC Riverside
DDpaarmeent of Computer Science, University of Illinois IibbanaChammaign
'Department of Computer Science, University of Chicago fgjf2023, Laeeggeuume edu: 1i li-ymezju. edu. cn; lixuwang2025eu. nor northwestern. edu; xiastêsz. tsinghua. edu, en; congl@ucr. edu; 1bo0i wwwinnii...................iii.l edu
Abstract
The prosperity of deep neural networks (DNNs) is largely benefited from open- source datasets, based on which users can evaluate and improve their methods. In this paper, we revisit backdoor-based dataset ownership verification (DOV), which is currently the only feasible approach to protect the copyright of open- source datasets. We reveal that these methods are fundamentally harmful given that they could introduce malicious misclassification behaviors to watermarked DNNs by the adversaries. In this paper, we design DOV from another perspec- tive by making watermarked models (trained on the protected dataset) correctly classify some 'hard' samples that will be misclassified by the benign model. Our method is inspired by the generalization property of DNNs, where we find a
domain for the original dataset (as its domain watermark). It be casily learned with the protected dataset containing modified samples. Specifically, we formulate the domain generation as a bi-level optimization and propose optimize set of saillly-indistinusshabll clean-label modified data with similar effects to domain- watermarked samples from the hardly-generalizee domain ensure watermark stealthiness. We also design hypothesis-test -uidded ownership verification via our domain watermark and provide the theoretical anal- yses of our method. Extensive experiments three benchmark datasets con- ducted, which verify the effectiveness of our method and its resistance to potential adaptive methods. The code for reproducing main experiments is available https:/ /ttp://gttttt//t com/ hann/Jnnfengge wengooDomGainnn Domain Watermark.
Introduction
Deep neural networks (DNNs) have been applied to a wide range of domains and have shown human-competitive performance, The great success of DNNs heavily relies on the availability of various open-source datasets (e.g., CIFAR [1] and ImageNet [2]). With these high-quality datasets, researchers can evaluate and improve the proposed methods upon them. Currently, most of these datasets limit their usage to education or research purpose and are prohibited from commercial ap- plications without authorization. How protect their copyrights is of great significance [3, 5, 6].
'The first two authors contributed equally this work. Correspondence Yiming Li.
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

DY Sampll
Winegg Labed
Proteced Durrect
Haruful Verification
Beckklored
Ground-trth
Label
Zaloss
mY Aasple
Wrong
Harmless Verification
Ground tuth Label
Datsset Owner
Advensary User
DNN Models
Stage Dataset Watermarking
Stage Unauthorized Training
Stage III: Ownership Verification
The main pipeline of dataset ownership verification with backdoor-based dataset wa- termarks and our domain watermark, where BW Sample represents existing backdoor-watermane sample while DW Sample represents our proposed domain- watermarked sample. Existing backdoor- based methods make the watermarked model (i.e., the backdoored DNN) misclassify 'easy' samples that can be correctly predicted by the benign model and therefore the verification is harmful. In con- trast, our ownership verification is harmless since we make the watermarked model correctly predict 'hard' samples that are misclassified by the benign model.
Figure/ I:
Currently, there are many classical methods for data protection, such as encryption [7, 8, 9], differ- ential privacy [10, 11, 12]. and digital watermarking [13, 14, 15, 16]. However, they are not able to protect the copyrights of open-source datasets since they either hinder the dataset accessibility (e.g.. encryption) require the information of the training process (e.g., differential privacy and digital watermarking) suspicious models that could be trained on it.
To the best of our knowledge, backdoor- based dataset ownership verification (DOV) [3, 4, 5] is currently the only feasible approach to protect them, where defenders exploit backdoor attacks [17, 18, 19] to watermark the original dataset such that they can verify whether a suspicious model is trained on the protected dataset by examining whether it has specific backdoor behaviors. Recently, Li el al. [4] first discussed the "harmlessness' requirement of backdoor-based DOV that the dataset watermark should not introduce new security risks to models trained on the protected dataset and proposed untargeted backdoor watermarks towards harmless verification by making the predictions of watermarked samples dispersible instead of deterministic (as a pre-defined target label).
In this paper, we revisit dataset ownership verification. We argue that backdoor- based dataset water- marks can never achieve truly harmless verification since their fundamental mechanism is making watermarked model misclassifies 'easy' samples (i.c., backdoor-poison rectly predicted by the benign model (as shown in Figure 1). with these particular misclassifi- cation behaviors that the dataset owners can conduct ownership verification. An intriguing question arises: Is harmless datasel ownership certification possible to achieve?
samples) that can be cor-
The answer to the aforementioned problem is positive. In this paper, we design dataset owner- ship verification from another angle, by making the watermarked model can correctly classify some 'hard' samples that will be misclassified by the benign model. Accordingly, we can exploit this difference to design ownership verification while not introducing any malicious prediction behav- iors to watermarked models that will be deployed by dataset users (as shown in Figure 1). In general, our method is inspired by the generalization property of DNNs, where we intend to find domain for the original dataset. It can be easily learned with the protected dataset containing modified samples. Specifically, we formulate the domain generation a bi- level optimization and leverage a transformation module to generate We propose to optimize set of iuaally-iddstinnusshabbe modified data having similar effects to domain-waterne
samples;
samples as our domain watermark to ensure the stealthiness of dataset wa- termarking; We design a hypothesis-test guided method to conduct ownership verification via our domain watermark at the end. We also provide theoretical analyses of all stages in our method.
In conclusion, the main contributions of this paper are four-folds: 1) We revisit dataset ownership verification (DOV) and reveal the harmful drawback of methods based on backdoor attacks. 2) We explore the DOV problem from another perspective, based on which we design truly harmless DOV method via domain watermark. To the best of our knowledge, this is the first con-backdoor-basee DOV method. Our work makes dataset ownership verification become an independent research field instead of the sub-field of backdoor attacks. 3) We discuss how to design the domain watermark and provide its theoretical foundations. 4) We conduct experiments on benchmark datasets, verifying the effectiveness of our method and its resistance to potential adaptive methods.

---

2 Related Work
2.1 Backdoor Attacks
Backdoor attack² [23, 24, 25] is training-phren threat of DNNs, where the adversary intends to implant a backdoor (i.c., the latent connection between the adversary-specinee the target label) into the victim model by maliciously manipulating few training samples. The backdoored DNNs behave normally while their predictions will be maliciously changed to the target label whenever the testing samples contain the trigger pattern. In general, existing backdoor attacks can be divided into two main categories based on the property of the target label, as follows:
trigger pattern and
Poisoned- Backdoor Attacks. In these attacks, the target label of poisoned samples is differ- ent from their ground-truth labels. This is the most classical attack paradigm and is more easily to implant hidden backdoors. For example, BadNets [17] is the first backdoor attack, where the adver- saries randomly modify a few samples from the original dataset by attaching a pre-defined trigger patch their images and changing their labels to the target label. These modified samples (dubbed poisoned samples) associated with remaining benign samples are packed as the poisoned dataset that is released to victim users for training; After that, Chen el al. [26] improved the stealthiness of BadNets by introducing trigger transparency; Nguyen et al. [27] proposed a more stealthy backdoor attack whose trigger patterns were designed via image-warping; Recently, Li et al. [4] proposed the first untargeted (poisoned-labe) backdoor attack (i.e., UBW-P) for dataset ownership verification.
Clean-Label Backdoor Attacks. In these attacks, the target label of poisoned samples is consis- tent with their ground-truth labels. Accordingly, these attacks are more stealthy, compared to the poisoned-label ones. However, they usually suffer from low effectiveness, especially datasets with a high image resolution or many classes, due to the antagonistic effects of 'robust features' re- lated to the target class contained in poisoned samples [28]. Label-consistent attack is the first clean- label attack where the adversaries introduced untargeted adversarial perturbations before adding trig- ger patterns; After that, more effective attack (i.e., Sleeper Agent [29]) is proposed, which crafts clean-label poisoned samples via bi-level optimization; Recently, Li et al. [4] proposed UBW-C, which generated poisoned samples for leading untargeted misclassifications to attacked DNNs.
2.2 Data Protection
Classical Data Protection. Data protection is classical and important research direction, aiming to prevent unauthorized data usage or protect data privacy. Currently, existing classical data protection can be roughly divided into three main categories, including (1) encryption, (2) digital watermarking, and (3) privacy protection. Specifically, encryption [30, 7, 8] encrypts the whole or parts of the protected data so that only authorized users who hold a secret key for decryption can use it; Digital watermarking [31. 32, 33] embeds an owner-specified pattern to the protected data to claim the ownership: Privacy protection focuses on preventing the leakage of sensitive information of the data in both empirical [34, 35, 36] and certified manners [10, 37, 12]. However, these traditional approaches are not feasible to protect the copyright of open-source datasets since they either hinder the dataset accessibility or require the information of the training process that will not be disclosed.
Dataset Ownership Verification. Dataset ownership verification (DOV) is emerging topic in data protection, aiming to verify whether given suspicious model is trained on the protected dataset. To the best of our knowledge, this is currently the only feasible method protect the copyright of open-source datasets. Specifically, it intends to implant specific prediction (towards verification samples) behaviors in models trained on the protected dataset while not reducing their performance on benign samples. Dataset owners can conduct ownership verification by examining whether the suspicious model has these behaviors. Currently, all DOV methods [3, 4, 5] exploit backdoor attacks to watermark the unprotected benign dataset. For example, [3] adopted poisoned-labed backdoor attacks while [5] adopted clean-label ones for dataset watermarking. Recently, Li et al. [4] first discussed the 'harmlessness' requirement of DOV that the dataset watermark should not introduce new security risks to models trained on the protected dataset and proposed the untargeted backdoor watermarks. However, there is still no definition of harmlessness and sackkor--based DOV methods
In this paper, we focus on poison-only backdoor attacks, where the adversaries can only modify a few training samples to implant backdoors. Only these attacks can be used as the dataset watermark for ownership verification. Attacks with more requirements (e.g., control model training) [20, 21, 22] are out of our scope.
3

---

can never achieve truly harmless verification for they introduce backdoor threats. How to design a harmless DOV method is still an important open question.
3 Domain Watermark
3.1
Preliminaries
Threat Model. Following existing works in dataset ownership verification [3, 4, 5], we assume that the defenders (i.e., dataset owners) can only watermark the benign dataset to generate the protected datuset. They will release the protected dataset instead of the original benign dataset for copyright protection. Given third-party suspicious model that may be trained on the protected dataset without authorization, we consider the black-box setting where defenders have no information about other training configurations (e.g., loss function and model architecture) of the model and can only access it to obtain predicted probability vectors via its model API.
The Main Pipeline of Dataset Watermark. Let D = { v:) denotes the benign training dataset. Let we consider an image classification task with K K-classes, i.e., e; E = [o, C|xx represents the image with yi y' (1,..., } its label. Instead of releasing 'D directly, the dataset owner will generate and release its watermarked version (i.e., Dw.) Specifically, D' = Dn,DD where Pm consists of the modified version of samples from small selected subset D, of (i.e., D. C DD) and Dú contains remaining benign samples (i.e., D3 = D-D.). The Dm is generated by the defender-specifiedd image generator G2 X' + X and the label generator Gy : V. i.e. Dim- = {[ G (x)) y) E DD}. . For example, G² (1 m) @ t + m ② x and Gy yi in BadNets [17]. where m E {0, 1|xxxx11 is the trigger mask, t E [0, 1] x is the trigger pattern, @ denotes the element-wise product, and ye is the target label. In particular, 7 & [D.. called the watermarking rate. All models trained on the protected dataset D., will have special prediction behaviors on (a) for ownership verification. Specifically, let C X -> y denotes a third-party suspicious model that could be trained on the protected dataset, existing backdoor-based methods will examine whether it conduct unauthorized training by testing whether (()z(x)) Vt- Since yt A y in most cases, these backdoor watermarks are harmful.
(P..)
3.2 Problem Formulation
As described in previous sections, existing backdoor-insping dataset ownership verification (DOV) methods [3, 4, 5] would cause malicious misclassification on watermarked samples all models trained on the protected dataset, therefore they are harmful. This limitation of backdoor-based DOV methods cannot be eliminated because their inherent mechanism is lead the watermarked model to have particular mispredicted behaviors for verification, although the misclassification could be random and less harmful [18]. In this paper, we intend to design truly harmless DOV method so that the watermarked models will correctly classify watermarked samples. Before we formally define the studied problem, we first provide the definition of harmful degree of a DOV method.
Definition 1 (Harmful and Relatively Harmful Degree). Let D = ((tt, yi) indicates a set of watermarked samples used for ownership verification of DOV method, where is is the ver- ification sample with yi E y as its ground-truth label (instead of its given label). Let Ö and C' represent a classifier trained on the protected and unprotected datasets, respectively. The harmful degree is H A N E T((():) # yi) and the relatively harmful degree is A 2 EN N D 1(C((.) + v. EE I(C($t) # vi)) where I{-} is the indicator function.
N
To design a harmless DOV method, we intend to make watermarked DNNs correctly classify some 'hard' samples that will be misclassified by the model trained on the unprotected benign dataset. Inspired by the generalization property of DNNs, we intend to find a the benign dataset, which can be easily learned with the protected dataset containing the modified samples. In this paper, we call this watermarking method as domain watermark, defined as follows.
domain of
Definition 2 (Domain Watermark). Given a benign dataset = {(x;; ).)) let C X - Y denotes a model trained on DD. Assume that Ga denotes domain generator such that Ga(x;) owns the same ground-truth label as x, but belongs to a generl-generalized domain, i.e,, E E(BSWED [(C(z))) = =v1 >> E(oDneDD TerssTTCCC (C(GG((a.) = D.). We intend to find watermarked

---

version of DD (i.e., Da) with watermarking rate such that the watermarked model Ö trained on it have two properties: (1) N E(ELNeD [((()))) = Vi) 2 B and (2) N Leaeeee (T(()))))) = y - [[((G((z)) = y.t) S T, where 3. [] are given parameters. In this paper, Da is defined as the domain watermark of the benign dataset D.
3.3 Generating the Hardly-Generalizee Domain
As illustrated in Definition 2, finding hardly-generalizeed target domain T (with domain generator Ga) of the source domain S is the first step of our domain watermark. To guide the construction of the domain T, we have the following Lemma 1.
Lemma (Generalization Bound [38]). The bound of expected risk on given target domain T is negatively associated with mutual information between features for source S and target T domains:
RT()) & Rs()) - 41 + + 2 dxnx((((),
(1)
where RT( y) [L(C()) y}}. Rs( B( [1((()) + y}}. [(z; 2) mutual information between features from S and T. dn<s((p(z) p(2)) is H. for measuring the divergence feature marginal distributions of two domains, and (.) is the entropy.
Lemma reveals the upper bound of generalization performance on T. Since dzAH( (.) is intractable and hard to directly optimize, as well as [38] shows that only T(.) is enough for generalization across domains, we propose increase the expected risk on by minimizing [(z; ž).
Specifically, we formulate the design of the target domain T (with the domain generator Ga(:;)) as bi-level optimization, as follows:
min Ep(z.s) [[<=(w"); 2(0, A 2(0,, w]]
(2)
s.t. w" arg min [B (z; 3) + [(f (x; v)) A2 ((
w
where d1, A2 are two positive papeer-arameters, and C(-) is the loss function (e.g., cross entropy).
Following previous works [38] in domain adaption and generalization, we propose to optimize the upper bound approximation for (2z;) instead of itself and leverage a transformation module consisting of multiple convolutional operations as Ga(:; O) to generate the
image é. Specifically, aim to craft & via minimizing the upper bound approximation for mutual information [39] between x E D and & in the latent feature space Z:
p(2|2)
I (2; 2) = Bp(x.2) log
< Bp(z,2) llg p(][=)] - Ep(=))( p()]=)]
(3)
p(2)
where z and & are the latent vectors obtained by passing æ and a through f(; w)'s feature extractor. C.(.) is the class-conditional maximum mean discrepancy (MMD) computed on the latent space Z and proposed to limit the potential semantic information distortion between and ât follows:
K
m
(x(2,
2)
Σ
+ |1
(4)
K
j=1
where ng. nf represent the number for æ and & from class j. and <(-) is the kernel function. The configurations, parameter selections, and model architectures are included in Appendix A.
3.4 Generating the Protected Dataset
Once we obtain the hard-generalized domain generator Ga with the method proposed in Section 3.3, the next step to generate the protected dataset based it. Before we present technical details, first deliver some insight into the data quantity impact for the domain watermark.
5

---

Theorem 1 (Data Quantity Impact), Suppose in PAC Bayesian [40], for target domain T and source domain S, any set of voters (candidate models) H. any prior over before any training, any & E (0, 1), any > O, with a probability at least 1 - & over the choices of S S and Txx, for the posterior f over after the joint training on S and T, we have
RT (f) <
RT)
T- (T([S)Rs(f) +
2(1 E
(5)
1 --e T4
(T(()) Yl
2 2
(KL(f(Im)++1 +
where (f) [ and Rs(J) are the target and source empirical risks measured over target and source datasets T and S. respectively. is a constant and KL(.) is the Kullback-Leri divergence. (T)()) is measurement of discrepancy between T and S defined as
(
Bo (TIIS) =
sup (a. (SUP)))
21.
(6)
where SUPP(S) denotes the support of S. When S and T are identical, 820 (T((S) =
Theorem reveals the upper bound of Ry (f) is negatively associated with the number of samples for source and target domains (i.e., n, and n.)) Assuming n, is fixed, increasing n, still increase generalization on the target domain. As such, is possible to combine some samples with benign samples to achieve target domain generalization. Its proof is in Appendix B.
In general, the most straightforward method to generate our domain watermark for the protected dataset is to randomly select a few samples (x, y) from the original dataset D and replace them with their domain-watermarke ments, the Nomain-watermant Accordingly, the adversaries may notice watermarked samples and try to remove them to bypass defense. To ensure the stealthiness of our domain watermark, visually- honallyyindistingushhhhba modified data ((z,, 22 = x; + 5,} having similar effects to domain- watermarked samples. This is also bi-level optimization problem, follows.
version (Ga(æ), y). However, as we will show in the experi- image is usually significantly different from its original version.
propose optimize set of
min B( [C (f(ă; w (())), X3 min { ( (f(z; w (())), Aa 8CB
s.t. w6) arg min w
Σ
L(flx, 6,: Doo (a).8))ED,
Σ L(f(z,:)),))
Del
(E..)))..
where E (( [C (f unseen domains (i.e.,7) and B = {ō |10% {} where e is a visibility-related hyper-parameler
w()),, y) represents the expected risk for the watermarked model other
The second term in Eq. is to prevent the watermarked model can achieve a similar generalization performance on other unseen domains as the target domain T to preserve the uniqueness of T for verification purposes. We introduce two parameters As and X for preventing the second term dom- inant in the optimization procedure. X4 is set as E (. [C (f(z; w²), y)]. where wn is obtained by training on the original dataset 'D. Please find more optimization details in Appendix C.
In particular, our domain watermark is clean-label, i.e., do not modify the label of modified samples as have done in most backdoor-based methods. As such, it is more stealthy.
Dataset Ownership Verification via Domain Watermark
In this section, introduce how to conduct dataset ownership verification via domain water- mark. The overview of the entire procedure is shown in Figure 2.
As described in Section 3.2, models trained on our protected dataset (with domain watermark) can correctly classify some domain-watermarked samples while other benign models cannot. Accord- ingly, given suspicious third-party model f. the defenders can verify whether it was trained on the protected dataset by examining whether the model has similar prediction behaviors on benign samples and their domain-watermarker watermarked version. The model is regarded as trained on the protected

---

Misinite Metuua Infermation
Probubiiity Ground troti Label P
DW data. &
Benign
Stalar
Benigo Z
Bypothesis Toot:
Oytinatation
Suepition DSN
Genan--talli Label
Benign data
Domain Generotor
DW data #
Benigt Somple 21
Modiffod
Sample
DW data
Generating; Domain Watermark
Generating Protected Dataset
Ownership Verification
The workflow of dataset ownership via our domain watermark. In the first step, we will generate domain-ward watermarked (DW) samples in a hardly-generalizen domain of the benign dataset; In the second step. we will optimize set of risuallyindistinguishal similar effects to domain-wand watermarked samples. We will release those modified samples associated with remaining benign samples instead of the original dataset for copyright protection; In the third step, we identify whether a given third-party model trained on our protected dataset by testing whether it has similar prediction behaviors in benign images and their DW version.
Figure 2:
modified samples that have
dataset if it has similar behaviors. To verify it, we design hypothesis- test- gesst--guddd method following previous works [3, 4], follows.
Proposition 1. Suppose f(x) is the posterior probability of x predicted by the suspicious model.
Let variable denotes the benign image and variable X' is its domain-vattrmarked version (i.e., X' = G)(X)), while variable Pa- f(X)r and Pa f(X')y indicate the predicted probability on the ground-truth label of X and X', respectively. Given the null hypothesis Ho P. = Pa + (H1 Ps Pa T) where the hyper-parammeter E [0. 1). claim that the suspicious model is trained on the protected dataset (with T-certainty) if and only if Hy is rejected.
In practice, randomly sample different benign samples conduct the pairwise T-test [41] and calculate its p-value. The null hypothesis Ho is rejected if the p-value is smaller than the significance level a. Besides, we also calculate the confidence score AP P. Pa represent the verification confidence. The smaller the AP, the more confident the verification.
Theorem 2.
Let (xx is the posterior probability of x: predicted by the suspicious model, variable X denotes the benign sample with label Y, and variable X' the
version of X. Assume that P, A f(X)y n7. We claim that dataset owners reject the null hypothesis Ho at the significance level o, if the verification success rate (VSR) V of f satisfies that
Vm
1- (V - -7 La
VV V2
where ta is a-quantile of t-distribution with (m - 1) degrees of freedom and m is sample size.
In general, Theorem 2 indicates that dataset verification can succeed if the VSR of the suspicious model f is higher than a threshold (which is not necessarily 100%). In particular, the assumption of Theorem be easily satisfied by using benign samples that can be correctly classified with high confidence. Its proof is included in Appendix D.
5
Experiments
In this section, we conduct experiments on CIFAR-10 [1] and Tiny-ImageNet [42] with VGG [43] and ResNet [44], respectively. Results on STL-10 [45] in Appendix F.
5.1 The Performance of Domain Watermark
Settings. We select seven baseline methods, containing three Mabell backdoor watermarks (i.e., Label-Consistent, Sleeper Agent, and UBW-C) and four poisoned-labe watermarks (i.e., BadNets, Blended, WaNet, and UBW-P). Following the previous work [4], we set the watermarking rate 7 = 0.1, perturbation constraint 16/255 in all cases, and adopt the same watermark patterns and parameters. The example of samples used in different watermarks is shown in Figure 3. For our
7

---

BaddNets
Bleaded
WaNert
UBW-
Label-Canistenl
Sleeper Agent
URW-C Seapcll
Ours Spitee
Bars
Sample
Semple
Barn
Burn
Bam
Horse
Bum
Barn
Bear
Dog
Sample
Figure 3: The example of samples involved in different methods of dataset ownership verification.
Table 1:
The watermark performance on CIFAR-I0 and Tiny-ImageNet datasets. In particular,
mark harmful watermark results (i.e., H > 0.5 and H 0) in red.
CIFAR-10
Tiny-ImageNe
Label Typel
Method|, Metric-
BA (%)
VSR (%)
H
BA (%)
VSR (%)
BadNets
91.54
1.00
0.91
60.02
1.00
0.60
Blended
91.60
1.00
0.92
59.8 86
99.97
1.00
0.60
Poisoned-Lahs
WaNet
90.61
97.3
0.97
0.87
57.29
96.14
0.96
0.51
UBW-P
91.47
84.52
0.85
0.76
56.14
84.09
0.84
0.44
Label-Consisters
91.64
99.98
1.00
0.91
$6.92
41.76
0.61
0.21
Sleeper Agent
90.73
93.24
0.93
0.84
56.82
87.44
0.87
0.47
Clean-Label
UBW-C
89.06
0.89
0.80
51.79
81.20
DW (Ours)
90.86
0.10
-0.77
59.10
58.06
0.42
-0.52
Table The effectiveness of dataset ownership verification via our domain watermark.
CIFAR-10
Tiny- Tiny-ImageNet
Independent-D
Independent-M
Malicious
Independent-D
Independent-M
Malicious
AP
0.79
0.80
0.04
0.50
0.67
0.10
p-value
1.00
1.00
10-54
0.90
1.00
10-6
method, we A3 0.3. We implement all baseline methods based on BackdoorBox [46]. Each result is averaged over five runs. Please find more details in Appendix E.
Evaluation Metries. We adopt benign accuracy (BA) and verification success rate (VSR) verify the effectiveness of dataset watermarks. Specifically, the VSR is defined as the percentage that verification samples can be classified the assigned label (i.e., target label of baselines and ground- truth label of our method) by watermarked DNNs. We exploit harmful degree (H E [0, I), and relatively harmful degree (H [-1, 1) to measure watermark harmfulness. In general, the larger the BA and VSR while the smaller the H and H, the better the dataset watermark.
Results. As shown Table 1, the benign accuracy of our domain watermark is higher than clean- label backdoor watermarks in most cases, especially on the Tiny-ImageNet dataset. In particular, only method is harmless. For example, both / and H are 0.7 smaller than those of all bascline methods on CIRAR- 10 datasets. Besides, as we will show in the next subsection, the VSR of our method is sufficiently high for correct ownership verification, although the VSR of our method is smaller than that of backdoor-based watermarks (especially on complicated datasets). The VSRs of benign models with domain-waand waterarreed samples CIFAR-10 10 and Tiny-ImageNNe 13% and 6%, respectively. This mild potential limitation is because our VSR is restricted by the BA of watermark models. It is unavoidable sacrifice for harmlessness.
merely
5.2 The Performance of Dataset Ownership Verification via Domain Watermark
Settings. We evaluate our cammainwattemarte dataset ownership verification under three sce- marios, including 1) independent domain (dubbed "Independent-D), 2) independent model (dubbed

---

CIFAR-10
Tiny ImageNol
CIFAR-10
Tiny ImageNet
BA VSR (86)
BA VSR (55)
80
(8g
BA /SR (9)
46
40
50
80
20
16
20
VIRR
VIS
VSR
VSR
16
12
Perturbation Budget (pixel)
Perturbation Budget (pixal)
Watermarking Rate y (%)
Watermarking Rate y (%)
Figure 4: Effects of the perturbation budget e.
Figure 5: Effects of the watermarking rate 7
BA //SSVR (8)
100
CIFAR-10
60
Tiny-ImagaNat
100
CIFAR-10
VSR (S)
80
Tiny- Imag-Nee
75
VSR
40
BA VSR
60
40
25
BA
20
10
BA
20
B4
%
20
40
60
80
100
%
20
40
60 Epoch
80
100
20
40
60
80
100
20
40
60
80
100
Epoch
Pruning Rate (9%)
Pruning Rate (96
Figure 6: The resistance to fine-tuning.
Figure 7: The resistance to model pruning.
Independent-M'", and 3) unauthorized dataset training (dubbed 'Malicious'). In the first case, we used domain-wattrmarked samples to query the suspicious model trained with modified samples from another domain; In the second case, we test the benign model with our domain-watermarker watermarked samples; In the last case, we test the dotain-watermarked model with corresponding domain- watermarked samples, Notice that only the last case should be regarded as having unauthorized dataset use. More setting detail are described in Appendix G.
Evaluation Metries. Following the settings in [4], we use AP E [-1,1] and p-value E [0, 1] for the evaluation. For the first two independent scenarios, a large AP and p-value are expected. In contrast, for the third scenario, the smaller AP and p-value, the better the verification.
Results. As shown in Table 2, our method can achieve accurate verification in all cases. Specifically, our approach can identify the unauthorized dataset usage with high confidence (i.c., AP ~ 0 and p- value < 0.01), while not misjudging when there is no unauthorized dataset utilization (i.e., AP >> and p-value > 0.05). Especially on the CIFAR-10 dataset (with high VSR), the p-values of independent cases are already 1 while that of the malicious scene is 50 powers smaller than a correct verification needs. These results verify the effectiveness of our dataset ownership verification.
5.3 Discussions
5.3.1
Ablation Studies
We hereby discuss the effects of two key Please find more experiments regarding other parameters and detailed settings in Appendix
involved in our method (i.e., and 7).
Effeets of Perturbation Budget e. We study its effects on both CIFAR-10 10 and Tiny-ImageNet datasets. As shown in Figure the VSR increases with the increase of In contrast, the BA remains almost stable with different c. However, increasing would also reduce the invisibility of modified samples. Defenders should assign it based on their specific needs.
Effects of watermarking Rate y, As shown Figure 6, similar to the phenomena of c, the VSR increases with the increase of 7 while the BA remains almost unchanged on both datasets. In par- ticular, even with a low watermarking rate (e.g.. I 1%), our method can still have a promising VSR. These results verify the effectiveness of our domain watermark again.
5.3.2 The Resistance to Potential Adaptive Methods
We notice that the adversaries may try to detect or even remove our domain watermark based on existing methods in practice. In this section, we discuss whether our method is resistant to them.
Due to the limitation of space, following the previous work [4], we only evaluate the robustness of our domain watermark under fine-tuning [47] and model pruning [48] in the main manuscript. As shown in Figure 6, fine-tuning has minor effects on both the VSR and the BA of our method. Our method is also resistant to model pruning for the BA decreases with the decrease of VSR. We have

---

also evaluated our domain watermark to more other representative adaptive methods. Please find more setting details and results our Appendix J.
5.3.3 A Closer Look to the Effectiveness of our Method
In this section, we intend to further explore the mechanisms behind the effectiveness of our domain watermark. Specifically,
adopt t- SNE [49] to visualize the feature distribution different types of samples generated by the be- nign model and its domain- watermarktddddd version. As shown in Figure 8, the domain watermarked samples stay away (with the normalized distance 1.84) from those with their ground-truth label (i.e., '0'), although they still cluster together, un- der the benign model. In contrast, these domain- watermarked samples lay close (with the normal- ized distance as 0.40) to benign samples hav- ing the same class under the watermarked model. These phenomena consistent with the predictive behaviors of the two models and can partly explain the mechanism of our domain watermark. We will further explore it in our future works.
Benign Model
Watermarked Model
Figure 8: The t-SNE of feature representations of samples for benign and watermarked models the CIFAR- 10 dataset. The target label is '0'.
6 Conclusion
In this paper, we revisited the dataset ownership verification (DOV). We revealed the harmful nature of existing makkoorr-bseee methods because their principle is making watermarked models misclas- sify "easy' samples. To design a genuinely harmless DOV method, we proposed the domain water- mark by leading watermarked DNNs to correctly classify some defender-specifeee 'hard' samples. We provided the theoretical analyses of our domain watermark and its corresponding ownership ver- ificatiin. We also verified its effectiveness method, our method can provide new angles and understanding to the design of dataset ownership verification to facilitate trustworthy dataset sharing.
benchmark datasets. As the first non-backdoor-basee
Acknowledgments
Junfeng Guo and Heng Huang were partially supported by NSF IIS 1838627, 1837956, 1956002, 1492, CNS 2213701, CCF 2217003, and DBI 2225775. Cong Liu was supported by the Na- tional Science Foundation under Grants CNS Career 2230968, CPS 2230969, CNS 2300525, CNS 2343653, and CNS 2312397.
References
[1] Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009.
[2] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. CVPR, 2009.
[3] Yiming Li, Mingyan Zhu, Xue Yang, Yong Jiang, Tao Wei, and Shu-Tao Xia. Black-box dataset ownership verification via backdoor watermarking. IEEE Transactions on Information Forensies and Security, 2023.
[4] Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, and Bo Li. Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection. In NeurlPS, 2022.
[5] Ruixiang Tang, Qizhang Feng. Ninghao Liu, Fan Yang, and Xia Hu. Did you train on my dataset? towards public dataset protection with clean-label backdoor watermarking. ACM SIGKDD Explorations Newsletter, 2023.
[6] Lixu Wang, Shichao Xu, Ruiqi Xu, Xiao Wang, and Qi 7hu. Non-transferable learning: A new approach for model ownership verification and applicability authorization. In ICLR, 2022.
10

---

[7] Dan Boneh and Matt Franklin. Identity-basee based encryption from the weil pairing. In CRYPTO, 2001.
[8] Paulo Martins, Leonel Sousa, and Artur Mariano. A survey on fully homomorphic eneryptinn: An engineering perspective. ACM Compuling Surveys, 2017.
[9] Hua Deng, Zheng Qin, Qianhong Wu, Zhenyu Guan, Robert H Deng, Yujue Wang, and Yunya Zhou. adentity-basee encryption transformation for flexible sharing of encrypted data in public cloud. IEEE Transactions on Information Forensics and Security, 2020.
[10]
Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In NeurIPS, 2019.
[11] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In IEEE S&P. 2017.
[12] Jiawang Bai, Yiming Li, Jiawei Li, Xue Yang, Yong Jiang, and Shu-Tao Xia. Multinomial random forest. Pattern Recognition, 2022.
[13] Sahar Haddad, Gouenou Coatrieux, Alexandre Moreau-Gaudry, and Michel Cozic. Joint for medical image reliability control in encrypted and com- pressed domains. IEEE Transactions Information Forensics and Security, 2020.
[14] Run Wang, Felix Juefei-Xu, Meng Luo, Yang Liu, and Lina Wang. Faketagger: Robust safe- guards against deepfake dissemination via provenance tracking. In ACM MM, 2021.
[15] Zhenyu Guan, Junpeng Jing, Xin Deng, Mai Xu, Lai Jiang, Zhou Zhang, and Yipeng Li. Deepmih: Deep invertible network for multiple image hiding. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
[16] Yushi Cheng, Xiaoyu Ji, Lixu Wang, Qi Pang. Yi-Chao Chen, and Wenyuan Xu. {mID): Tracing screen photos via [Moiré) patterns. In USENIX Security, pages 2969-2986 2021.
[17] Tianyu Gu, Kang Liu, Brendan Dolan-Gavite and Siddharth Garg. Badnets: Evaluating back- dooring attacks on deep neural networks. IEEE Access, 2019.
[18] Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems, 2022.
[19] Jonathan Hayase and Sewoong Oh. Few-shot backdoor attacks via neural tangent kernels. In ICLR, 2023.
[20] Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. In NeurlPS, 2020.
[21] Yiming Li, Haoxiang Zhong, Xingjun Ma, Yong Jiang, and Shu- Xia. Few-shot backdoor attacks on visual object tracking. In ICLR, 2022.
[22] Jianshuo Dong, Han Qiu, Yiming Li, Tianwei Zhang, Yuanjie Li, Zeqi Lai, Chao Zhang, and Shu-Tao Xia. One-bit flip is all you need: When bit-flip attack meets model training. In ICCV, 2023.
[23] Xiangyu Qi, Tinghao Xie, Yiming Li, Saeed Mahloujifar, and Prateek Mittal, Revisiting the assumption of latent separability for backdoor defenses. In ICLR, 2023.
[24] Hanqing Guo, Xun Chen, Junfeng Guo, Li Xiao, and Qiben Yan. Masterkey: Practical back- door attack against speaker verification systems. In MobiCom, 2023.
[25] Rishi Jha, Jonathan Hayase, and Sewoong Oh. Label poisoning all you need, In NeurIPS, 2023.
[26] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv: 2017.
[27] Anh Nguyen and Anh Tran. Wanet-imperceppible warping-based backdoor attack. In ICLR, 2021.
[28) Yinghua Gao, Yiming Li, Linghui Zhu, Dongxian Wu, Yong Jiang, and Shu-Tao Xia. Not all samples are born equal: Towards effective clean-label backdoor attacks. Pattern Recognition, 2023.
[29] Hossein Souri, Liam H Fowl, Rama Chellappa, Micah Goldblum, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. In NeurlPS, 2022.
[30] Ronald Rivest. The md5 message-digest algorithm. Technical report, 1992.

---

[31] Chiou-Ting Hsu and Ja-Ling Wu. Hidden digital watermarks in images. IEEE Transactions on image processing, 1999.
[32] Ming-Shing Hsieh, Din-Chang Tseng, and Yong-Huai Huang. Hiding digital watermarks using multiresolution wavelet transform. IEEE Transactions on industrial electronics, 2001.
[33] Yuanfang Guo, Oscar C Au, Rui Wang, Lu Fang, and Xiaochun Cao. Halftone image wa- termarking by content aware double-sided embedding error diffusion. IEEE Transactions on Image Processing, 2018.
[34] Zuobin Xiong, Zhipeng Cai, Qilong Han, Arwa Alrawais, and Wei Li. Adgan: Protect your location privacy in camera data of auto-driving vehicles. IEEE Transactions on Industrial Informatics, 17(9):200-62210 2020.
[35] Yiming Li, Peidong Liu, Yong Jiang, and Shu-Tao Xia. Visual privacy protection via mapping distortion. In ICASSP, 2021.
[36] Honghui Xu, Zhipeng Cai, Daniel Takabi, and Wei Li. Audio-visus autoencoding for privacy- preserving video streaming. IEEE Internet of Things Journal, 2021.
[37] Linghui Zhu, Xinyi Liu, Yiming Li, Xue Yang. Shu-Tao Xia, and Rongxing Lu. A fine- grained differentially private federated learning against leakage from gradients. IEEE Internet of Things Journal, 2021.
[38] Haiteng Zhao, Chang Ma, Qinyu Chen, and Zhi- HoiH Deng. Domain adaptation via maximiz- ing surrogate mutual information. In IJCAI, 2022.
[39] Pengyu Cheng, Weituo Hao, Shuyang Dai, Jiachang Liu, Zhe Gan, and Lawrence Carin. Club: contrastive log-ratio upper bound of mutual information. In ICML, 2020.
[40] David A McAllester. Some pac-bayesian theorems. In COLT, 1998.
[41] Leopold Schmetterer. Introduction to mathematical statistics, volume 202. Springer Science & Business Media, 2012.
[42] Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 2015.
[43] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. ICLR, 2014.
[44] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
[45] Adam Coates, Andrew Ng, and Honglak Lee. An analysis of single-layer networks in unsu- pervised feature learning. In AISTATS, 2011.
[46] Yiming Li, Mengxi Ya, Yang Bai, Yong Jiang, and Shu-Tao Xia. BackdoorBox: A python toolbox for backdoor learning. In ICLR Workshop, 2023.
[47] Yuntao Liu, Yang Xie, and Ankur Srivastava. Neural trojans. In ICCD, 2017.
[48] Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models. In NeurlPS, 2021.
[49] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 2008.
[50] Zijian Wang. Yadan Luo, Ruihong Qiu, Zi Huang, and Mahsa Baktashmotlagh. Learning to diversify for single domain generalization. In ICCV, 2021.
[51] Chenxi Liu, Lixu Wang, Lingjuan Lyu, Chen Sun, Xiao Wang, and Qi Zhu. Deja vu: Continual model generalization for unseen domains. In ICLR, 2023.
[52] Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Un- learnable examples: Making personal data unexploitable. ICLR, 2021.
[53] Xin Dong, Junfeng Guo, Ang Li, Wei-Te Ting, Cong Liu, and HT Kung. Neural mean discrep- ancy for efficient diitrritittiiito detection. In CVPR, 2022.
[54] Léon Bottou. Large-scale machine learning with stochastic gradient descent. ICCS, 2010.
[55] Pascal Germain, Amaury Habrard, François Laviolette, and Emilie Morvant, A new pac- bayesian perspective on domain adaptation. In /CML., 2016.
12

---

[56] Alexandre Lacasse, François Laviolette, Mario Marchand, Pascal Germain, and Nicolas Usunier. Pac-bayes bounds for the risk of the majority vote and the variance of the gibbs classifier. NeurlPS, 2006.
[57] Pascal Germain, Alexandre Lacasse, Francois Laviolette, Mario March, and Jean-Francis Roy. Risk bounds for the majority vote: From a pac-bayesian analysis to learning algorithm. Journal of Machine Learning Research, 2015.
[58] Shichao Xu, Lixu Wang, Yixuan Wang, and Qi Zhu. Weak adaptation learning: Addressing cross-domain data insufficiency with weak annotator. In ICCV, 2021.
[59] Tim Van Erven and Peter Harremos. Rényi divergence and kullback-leibler divergence. IEEE Transactions on Information Theory, 2014.
[60] Hossein Souri, Micah Goldblum, Liam Fowl, Rama Chellappa, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. In NeurlPS, 2022.
[61] Jonas Geiping, Liam Fowl, W Ronny Huang. Wojeiech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. Witches' brew: Industrial scale data poisoning via gradient matching. In ICLR, 2021.
[62] Junfeng Guo and Cong Liu. Practical poisoning attacks on neural networks. In ECCV, 2020.
[63] Yiming Li, Tongqing Zhai, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor attack in the physical world. In ICLR Workshop, 2021.
[64] Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. SCALE-UP: An efficient black-box input-level backdoor detection via analyzing scaled prediction consis- tency. In ICLR, 2023.
[65] Junfeng Guo, Ang Li, and Cong Liu. Aeva: Black-box backdoor detection using adversarial extreme value analysis. In ICLR, 2022.
[66] Junfeng Guo, Ang Li, Lixu Wang, and Cong Liu. Policycleanse: Backdoor detection and mitigation for competitive reinforcement learning. In ICCV, 2023.
[67] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE S&P, 2019.
[68] Jonathan Hayase, Weihao Kong, Raghav Somani, and Sewoong Oh. Spectre: Defending against backdoor attacks using robust statistics. In ICML, 2021.
[69] Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. In ICLR, 2022.
[70] Shuaiqi Wang, Jonathan Hayase, Giulia Fanti, and Sewoong Oh. Towards defense against federated backdoor attacks under continuous training. Transactions on Machine Learning Research, 2023.
13

---

Appendix
Table of Contents
A Technical Details for Generating
Domain
15
A.1 The Implementation of Transformation Module
15
A.2 The Optimization Process
B The Proof for Theorem
16
C Technical Details for Generating Protected Dataset
18
C.I. The Optimization Solution for Generating Protected Dataset
18
C.2 The Process of Generating Samples from Other Domains
19
C,3 The Selection of
19
The Proof Theorem
20
E
The Detailed Settings for Experimental Datasets and Configurations
21
E.1
Datasets
21
E.2
The Demonstration of Domain Watermark for Each Dataset
22
E.3
Training Configurations
22
E.4
The Details for Implementing each Approach
23
F
The Additional Results for the Performance of Domain Watermark
24
G
The Detailed Settings for Dataset Ownership Verification
24
H
The Additional Results for Dataset Ownership Verification
24
Additional Results of Discussions
24
The Effects Aς
1.2
Performance under Different Domain Watermarks
24
1.3 The Transferability of Domain Watermark
25
J
Additional Results for the Resistance to Potential Adaptive Methods
27
K
Can We Identify Domaia-watermarked Samples by Training on Large Dataset or with Complicated Data Augmentation?
28
K.1 The Resistance to Data Augmentation
29
K.2 The Resistance to Domain Adaption
29
L Reproducibility Statement
M Socictal Impacts
30
N Discussions about Adopted Data
30
14

---

Coma
Benur skift Nadite
TranCony
Shift Varinace
Cone
Fertue Skin Madule
TranCoavia
Normalized
Conv a
Fature élini Nodale
TrunComyt 3
Shift mean
Comv
TrmCCoadd
Nadiie
Overview of architectures for Gd
Details of Feature Shift Module
Figure 9: The architecture of Ga.
A Technical Details for Generating Hardly-Generalized Domain
This process is mainly motivated by [50, 51J, which leveraged transformation module with dif- ferent convolution transformations to minimize the mutual information (!) between features from the source dataset (i.c., 2) and data from the target domain (i.c., 2). Our work is also partially in- spired by previous work generating unlearnable samples [52], which crafted effective unlearnable samples by performing the bi-level optimization within each iteration.
A.1 The Implementation of Transformation Module
We follow previous work [53, 38, 50] to implement the transformation module for generating sam- ples from a different domain (as shown in Fig. 9). Specifically, we design the transformation module as ensemble of multiple (i.e., 4) convolution operations. Each convolution operation contains convolution layer Conv, feature shift module, and corresponding transposed convolution layer TranConv. The detailed parameters for each convolution layer Conv; are detailed in Tab. 3. Fol- lowing each convolution layer Conv,, we add a feature shift module enhance the diversity of generated samples. Specifically, each feature shift module contains two learnable parameters μ4; and a; as mean shift and variance shift, following:
Conv, 1 14:
0x 0
where and a represent the mean and covariance value for (onv Notably, and a are not learnable parameters. Moreover, the parameters ir and o; has the same dimension as the output of (æ) After that, we use transposed convolution layer TranConv to turn the feature maps generated by the above operations into real instance, which has the same dimension æ.
Putting all above, we generate the hard-generalized domain samples a following:
Σ W Σ w; tahn (ahnanCoooov(;; Conv, - Pt + p;));
(10)
where tahn represents the tahn activation function. w; is a scalar and weights the contribution of each activated instance produced by TransposedConv to &. w; is randomly sampled from normal
distribution w; ~ N N0,, 1). Notably, for each input æ. we first up-sample to 224 x 224 size and down-sample produced & to the original size for æ.
A.2 The Optimization Process
During the optimization process Eq. (2), we first initialized surrogate model f(: f(: and benign dataset D. Then during each iteration for solving the bi-level optimization Eq. (2), we first minimize the T(2; ε) and L. by optimizing the parameters of our proposed transformation module:
min E Ep(x.s) [[(=(w") 20, w))) Xi (= 2(0,, w" w)]]
(11)
15

---

Table 3: The configuration for each convolution layer.
Layer
Kernel Size
Input Channel
Output Channel
Conv1
5x5
Conv2
9x9
3
ConVs
13x13
3
Conv4
17x17
3
After that, we maximize (z;; and minimize the training loss by optimizing the parameters w:
min ((ayy>> [C(f 0); w), y) - (z; w), y)] x=(Bp(s.a)((((((()=3)) (12)
Since I(2; 2) is intractable, propose optimize its upper bound instead:
p(2|z) p(2)
[(z; 8) = Ep(=.2) log
- Bp(z.s) p(([=)] Bp(=))(p)) p()[2)).
(13)
Since the conditional distribution p=]]2) is also intractable thus the upper bound of T(z; 2) can't be optimized, we follow previous work to adopt variational distribution ((Elz) approximate the upper bound of T (2;;
1(:; 2) S N Enog log ((2))z))
Σ log a (
(14)
where ((]22) is obtained by employing the backbone neural network to approximate.
We optimize the above bi-level optimization Eq. (2) with 100 iterations. We set the learning rate as 0.005 for optimizing the parameters of the proposed transformation module and 0.001 for parameters for the backbone model f(-) following [50]. The batch size is 64. For both the transformation module and the backbone model f()), we use SGD [54] as the optimizer with Nesterov momentum and weight decay rate of 0.0005. We ResNet- 18 the backbone model for extracting = and & throughout the paper. We introduce A and A2 for balancing each optimization objective. Following the implementation of [50], set Å₁ and )2 0.1 and 1.0.
B The Proof for Theorem 1
Theorem 1 (Data Quantity Impact). Suppose in PAC Bayesian [40], for target domain T and source domain S, any set of voters (candidate models) H, any prior over before any training, any & E (0, 1), any > O, with a probability at least 1 & over the choices of S S and Tx for the posterior f over after the joint training on and T, we have
RT (1) S
c
RT( +
300 (TI[S)Rs(1) +
-
(15)
1 (TISS)
2KL(/Imm++I + 1n
2
1-e-c T4e
ns
where RT(l) and Rs(f) the target and source empirical risks measured over target and source datasets T and S, respectively. Q is a constant and KL(-) is the Kullback-eeible divergence. 3oo (T](S) is measurement of discrepancy between T and S defined as
( PPe.NEE ((aayes
(TIIS)
sup (a. (SUU)S)
21,
(16)
where SUPP(S) denotes the support of S. When S and T are identical, B.x (T(SS) = =.
16

---

Proof. Theorem 6 in Germain et al. 's work [55] demonstrates that suppose in PAC Bayesian [40], for a target domain T and a source domain S. any set of voters (candidate models) H. any prior over H before any training, any E (0, 1, any >> O. with probability at least E over the choices of Sh and T x for the posterior f over after the joint training on S and T:
RT (f) - 9
c
(f( Po01) +
(17)
1
[x(()))) (2LL(f]T)+ +
2 E)
1- T2.. The
where (J) denotes the expected Gibbs risk of voter I over the target domain. dr(s) and (s() the empirical estimation of the target voters' disagreement and the source joint error, mea- sured over target and source datasets T and S, respectively. Q is a constant and KL(.) is the divergence. 80 (T())) measures the discrepancy between T and S, defined as:
((.n.))ET
sup (T(S)) (#.W)ESUPP(S)
(18)
P(a.y)eS
where SUPP(S) denotes the support Sf
In the following proof, particular, the Gibbs risk (f), the voters' disagreement df(f), and the joint error cf()) of certain domain A are defined as follows.
RA(s) = E E T((x)) + v).
(19)
(a.))~h~)
dalf) = E
E
I [h(x) + h(()),
E
(20)
x~Ax hadf Kins
cf(f) =
E E
E I
+ [1'(a)) + y)
(21)
(m.y)~Ahrf M~f
where [[True] = 1 if the inner condition is true, and otherwise [[aasse] = 0, and Ax is the marginal distribution of domain A. ht and h are votes sampled from the posterior distribution f over H. With these definitions, studies [56, 57] reveal a relationship among the Gibbs risk, the voters' disagree- ment, and the joint error
[h(x) * 11(x)] + 21 [h(x) yAA(() Fyl 1 +
Ra(f)
E E E
2
(22)
In this case, extend this relationship to the empirical estimations (suppose dataset A is sampled from domain A) as
1[((z) + [1(=)] + (1(x)))))))))) + y (yAl(())) *vl (a(())
RA(F) = [A|
Σ (
E E M
2
2
(23)
Then we can Rf) and Rf) to replace (f) and (f) in Eq. (17), respectively. In the end, we can follow Xu et al. [58] to regard these empirical risks as data quantity-imellvant when analyzing the impact of data quantity.
Next, we focus on the proof of the numerical relationship 9xx (T(IS) > 1. First of all, (T1(S) comes from more general definition that is parameterized by a real value >> O. shown as
( (PLaMETT (#.g)~~ ((a.a)EE))
BT(T)S)
E
(24)
For any g > 0, (T((()) can be also written Kenyi Divergence- form [55], i.e.,
(T(IS) 2" ". (T((s)))
(25)
where (T(() is the kenyi Divergence between T and S with the order q. For kenyi Divergence with any order q > O. there is a property positivity [59], i.c., (T(T)))) 2 In this case, when
q - no, Eq. (25) becomes (T = (T((T) 2 1, and B, = (T((T))) = when
T = S. in other words, (T) 0 when T S [59].
D
17

---

C Technical Details for Generating Protected Dataset
C.1
The Optimization Solution for Generating Protected Dataset
Recall that Eq. (7) is formulated as follows.
min SCB
BLe (f((; w()))())))))))))))))))))) (()),, A min
(26)
s.t. w( = arg min
Σ
6;; [Dol
Σ
((((z;;
(Dal
(E..D.)ED
(m).)))EDs
where E (m..))- (z; (()), y)] represents the expected risk for the watermarked model other unseen domains (i.e.,) and B {6 |10| I {) where e a visibility-related hyper-parameter.
The aforementioned problem is standard bi-level problem, we following previous work [60, 61] to leverage gradient matching to solving it. Specifically, we first make the following definition:
L. E (f( w.) v)l D3 min { ( (f w) w)1, Na).
(27)
C,
Σ
(6;
(28)
Da
(EDD
According to the gradient gradient-matching technique [60, 61], we have the Upper-level Sub-problen, as:
V V Cell
V
(29)
V w Cill
where we aim to maximize the gradient matching degree between VwC, and V using cosine(-) similarity the metric through optimizing 6. We solve the above upper-level sub- problem via projected gradient ascend. We here use calculate i w) y)] following:
E( (f
w), (f
Σ ((((G(()):))..) (m.
(30)
N
Regarding the lower-level sub-problem, we have:
min
Σ EED
C(((x; + w) + DDa
Σ ((((x;
(31)
DD_
(m..
After obtaining the poisoned dataset (i.c., D. D3), optimize the model (i.e., ResNet- 18) parameters w via solving the above Lower-level Upper-sub problem. The above Lower-level Upper-sub problem is solved via stochastic gradient descent.
We optimize the Upper-level and Lower-level Sub-problems alternatively for each optimization iter- ation. Specifically, we first train the model under benign dataset D. Then for each iteration, first optimize the Upper-level Sub-problent based on the trained model and obtain the perturbation Af- ter that, we optimize the Lower-level Sub-problen based the obtained poisoned dataset. During each iteration for optimizing the above bi-level optimization problems, we optimize the Upper-level Sub-problem with 50 iterations, and optimize the Lower-level Sub-problem with 100 iterations. We optimize the entire bi-level optimization with five epochs. The other details for optimization hyper- parameters well configuration consistent with [61, 29).
In particular, to ensure the effectiveness of solving the aforementioned bi-level optimization prob- lem, we have two additional strategies, follows:
18

---

Domain
Domain 11
Domain IIT
Domain TV
Domain V
Figure 10: The example of samples generated from various domain.
Strategy 1: Instead of randomly selecting samples from benign dataset D, here choose to select training samples with the largest gradient norms, following the previous work [60].
Instead of selecting samples from all classes, we follow the previous work [4] to select those from specific class and the selected class is set as the target label. This strategy can enhance the effectiveness for solving the above bi-level optimization problem while preserving the verification performance for our approach.
Strategy 2:
C.2 The Process of Generating Samples from Other Domains
In this part, we describe how to generate samples from other domains (i.e., (I. T).
After obtaining the transformation module Ga(+), we can generate hard-generalized domain samples from a specific domain. We here propose generate samples from other domains by setting different configurations of [w:}] - For example, we can generate samples from the other domain by sampling {w; } with another values following w; N(, 1).
We here show some demonstration samples from other domains in Fig. 10.
We here generated samples from other domains, and estimate IE
(Ey))
IC (f(z; w), v)] following:
C Σ [(((T:)).V),
E
w)]
(32)
(ε.y)ET,
where T, represents the i-th unseen domain generated by the above approach.
C.3 The Selection of Hyper-parameters
After generating other unseen domains T, we here describe the selection of hyper-parameters (i.c., and A₂) for generating protected dataset.
We here propose a heuristic approach for selecting J and Ag. Specifically, we first keep Ag fixed (i.e.,1) and adjust J. We conduct empirical study on CIFAR-10 tasks, the results are shown in Fig. 11.
We use ResNet-18 as the evaluated model. We generate several unseen domains using the above approach. We randomly select J/ of these domains for optimizing the Eq. (7), and select 3 unseen domains the validation data. Notably, the validation domains ensured visually different from the domains used for optimization.
From Fig. 11, find that using three unseen domains is sufficient to constrain the generalization performance for validation unseen domains. Therefore, we set as for our approach.
After that, we keep J fixed, and adjust Xa gradually, the results are shown in Fig. 12. We find that when A becomes smaller, the constraint for performance on other unseen domains reduces. Accordingly, we set A3 as 0.3 for our approach since it can achieve close generalization capacity compared to the benign DNN model (i.e., 24.3%).
19

---

Accuracy on Unseen Domains
80
Accurday on Unseen Domains
70
60
50
20
18
20
16-
10
2
0.1
0.2
0.3
0.4
number of Unseen Domains ())
Figure 11: Effects of the number of unseen
Figure 12: Effects of the Ag.
Domains J.
D The Proof for Theorem 2
Theorem 2. Let (xx is the posterior probability of x predicted by the suspicious model, variable X denotes the benign sample with label Y, and variable X' the domain-wattrmmrked version of
X. Assume that Ps _ f(X) n.. We claim that dataset owners can reject the null hypothesis Ho at the significance level a, the verification success rate (VSR) V of f satisfies that
Vm-I- -V- V
to VV V2 0,
(33)
where ta is a-quantile of t-distribution with (m 1) degrees of freedom and is sample size.
Proof. Since P, > 1). the original hypothesis H1 can be converted to
H Pa 1
(34)
Let E indicates the event of whether the suspect model / predicts watermark sample its ground- truth label y. As such, probability and B is the Binomial distribution [41].
B),,p), where p = Pr(C(X') Y) indicates the verification success
Let ..,... &m denotes Nomain-watermarked samples used for dataset verification and E1," .., Em denote their prediction events, we know that the verification success rate V satisfies
E.,
(35)
m
V B(m.p). 1 m
(36)
According to the central limit theorem [41], the verification success rate V follows Gaussian distri- bution (p, p(l-p) when is sufficiently large. Similarly, (Pa + 7) also satisfies Gaussian distribution. Accordingly, we can construct the i-statistic as follows:
T A Vm(W - + ~ t(m 1),
(37)
where is the standard deviation of (V + T) and V, V.e.
Σ E V)2
(m- - m V2).
(38)
To reject the hypothesis Ho at the significance level a, we need to ensure that
Vm(V 17 + to
(39)
8
20

---

Figure 13: The example of domain watermark for CIFAR-10.
where fa is the a-quantile of t-distribution with (m 1) degrees of freedom.
According to equation (38)-(39), we have
I (V - + - VV 12 0.
(40)
E
The Detailed Settings for Experimental Datasets and Configurations
E.1
Datasets
We evaluate approach on three benchmark datasets (i.e., CIFAR-10 [1], Tiny-ImgaeNet [42], and STL-10 [45]). We here describe each benchmark dataset detail.
CIFAR-10. CIFAR- 10 dataset contains 10 labels, 50,000 training samples, and 10,000 validation samples. The training and validation samples are distributed evenly across each label. Each sample is resized as 32 x 32 by default.
Imag-et
Imag-Im dataset contains 200 labels, 100,000 training samples, and 10,000 validation samples. The training and validation samples are distributed evenly across each label. Each sample is resized as 64 x 64 by default.
STL-10. STL-I0 dataset contains labels and 13,000 labeled samples and 100,000 unlabeled samples. We divide the labeled samples into the training and validation dataset with a ratio of 8 2. The training and validation samples are distributed evenly across each label. Each sample resized 96 x 96 by default.
21

---

Figure 14: The example of domain watermark for Timy-ImageNet.
Table 4: Summary of accuracy (%) on samples from different domains for normal models and ours.
Source domain
Target domain
Other domain
Task
Normal
Ours
Normal
Ours
Normal
Ours
CIFAR-I0
91.89
90.86
13.10
90.45
15.10
10.30
STL-10
85.61
84.58
9.50
82.00
16.00
11.60
Tiny-ImageNet
60.13
59.10
6.00
58.08
12.60
15.40
E.2
The Demonstration of Domain Watermark for Each Dataset
We here show the domain watermark used for evaluating the effectiveness our approach in the experiments. The demonstrations shown in Figure 13, Figure 14, and Figure 15 for CIFAR-10, Imng-lmageNet, and STL-10 datasets, respectively.
E.3 Training Configurations
In the experiments, we train each model with 150 epochs with an initialized learning rate of 0. Following previous work [29, 62], we schedule learning rate drops at epochs 14, 24, and 35 by factor of O.I. For all models, coefficient to 0.9. We use batches of 128 images and weight decay with coefficient of 4 x 10-4, For each run, report the verification success rate (VSR) averaged over the last 10 epochs when the models' accuracy converges. We report the results for each approach averaged over 5 runs.
employ SGD with Nesterov momentum, and we set the momentum
22

---

Figure 15: The example of domain watermark for STL-10.
Table The watermark performance on STL-10 dataset. In particular, we mark harmful watermark results (i.e., H > 0.5 and Á 0) in red.
STL-10
Label Type.
Method,, Metric-
BA (%)
VSR (%)
H
H
BadNets
85.61
100
1.00
0.86
Blended
85.21
99.32
1.00
0.84
Poisoned-Lahoe
WaNet
83.17
96.10
0.96
0.79
UBW-P
84.22
80.27
0.80
0.64
Sabel-Consistent
84.07
93.48
0.93
0.77
Sleeper Agent
83.72
89.77
0.90
0.73
Clean-Label
UBW-C
79.32
82.00
0.82
0.61
DW (Ours)
84.58
82.00
0.18
-0.73
E.4 The Details for Implementing each Approach
We implement each backdoor technique using Backdoorbox library' following the default training configurations. Specifically, for patch-based triggers, use 3 3, 6 x 6, and x 9 for CIFAR- 10, Tiny- Imtgeee,, and STL-10. Following previouw work [4], for each approach, we randomly select label the target label for ownership verification purposes. For the other input-specific trigger (i.e., WaNet [27]), we follow its default configuration to generate its specific trigger pattern.
23

---

Table 6: The effectiveness of dataset ownership verification via our domain watermark.
STL-10
Independent-D
Independent-M
Malicious
A
0.68
0.78
0.04
p-value
0.95
0.98
10-4h 46
Table Summary of accuracy (%) on samples from different domains for normal models and ours.
Source domain
Target domain
Other domain
Domain Watermark
Normal
Ours
Normal
Ours
Normal
Ours
Domain Watermark I
92.46
92.10
18.50
91.40
16.30
17.60
Domain Watermark II
92.46
91.95
18.20
90.24
14.70
15.80
Domain Watermark IIII
92.46
91.85
19.60
90.64
18.40
14.90
F
The Additional Results for the Performance of Domain Watermark
We first show the summary for the performance of approach and benign samples samples from different domains. The results are shown in Table 4. We also show additional results for STL-10 dataset with ResNet-34 shown in Table 5.
G The Detailed Settings for Dataset Ownership Verification
We evaluate our Komain-watermart based dataset ownership verification under three scenar- ios, including 1) independent domain (dubbed 'Independent-D"), 2) independent model (dubbed IIddpendentt-"", and 3) unauthorized dataset training (dubbed 'Malicious'). In the first case, we used wattraaked samples to query the suspicious model trained with modified samples from another domain; In the second case, we test the benign model with our watrrann-wttrmrreedd samples; the last case, we test the domain-waterman domainn-attrrarkee waterarkedd model with corresponding domain- watermarked samples. Notice that only the last case should be regarded as having unauthorized dataset adoption. All other settings are the same as those used in [4].
Consistent with previouw work [4], we adopt the trigger used in the training process of the water- marked suspicious model in the last scenario. Moreover, we sample m 100 samples on CIFAR I0, STL-10, and Tiny-ImageNer and set = 0.25 for the hypothesis-test in each case for our approach. Since ImageNet has only 50 samples for each class in the validation dataset, we combine ad- ditional 50 training samples with the validation samples for ownership verification. The additional 50 training samples are not used in generating the protected dataset.
H The Additional Results for Dataset Ownership Verification
We here investigate the effectiveness of ownership verification via domain watermark. The results are shown in Table 6. The settings are consistent with Section 5.
I Additional Results of Discussions
I.1 The Effects of Àa
We have investigated the effects of A3. as shown Fig. 12. We find that the generalization perfor- mance decreases on other unseen validation domains with the increase of Xg- When X increases up to 0.3, the generalization performance on other unseen validation domains decreases close to the generalization performance for benign models.
I.2 Performance under Different Domain Watermarks
We here investigate the effective of protected dataset generation for different domain watermarks. We here craft domain watermarks following the Appendix A but initialized with different parameters

---

Figure 16: The Demonstration of Domain Watermark I.
Table The performance our domain watermark with different model structures trained on watermarked dataset generated with ResNet-18 18.
Metricl, Model-
ResNet-18
ResNet-34
VGG-I6-BN
VGG-19-BN
BA (%)
91.39
92.54
90.86
92.57
VSR (%)
91.90
90.80
90.48
89.00
for crafting different domain watermarks. The demonstrations for different domain watermarks for CIFAR-10 10 are shown in Figs. to 18.
We here use CIFAR-10 10 with ResNet-34 to investigate the performance of our approach for different domain watermarks. The results are summarized Tab. We can see our approach can still achieve effectiveness for different domain watermarks.
I.3 The Transferability of Domain Watermark
Recall that in the optimization process of our approach, leverage a surrogate model (i.e., ResNet- 18) for crafting modified samples. In the experiment section, we test the effectiveness of our ap- proach under models (i.e., VGG-16-BB 16G- and ResNet-34) having different architectures and parame- ters from the surrogate model. In practice, dataset users may adopt different model structures since dataset owners have no information about the model training. this section, we conduct additional experiments evaluating the effectiveness of our approach under different structures compared to the one used for generating modified samples (i.e., transferability).
Settings. We evaluate the transferability of our method on CIFAR-10. We adopt ResNet- 18, ResNet-34, VGG-I6-BN, and VGG-19-BN to peform domain watermark, based on which to train
25

---

Figure 17:
The Demonstration of Domain Watermark II.
Table The performance our domain watermark with different model structures trained on watermarked dataset generated with ResNet-34.
Metricl, Model-
ResNet-18
ResNet-34
VGG-I6-BN
VGG-19-BN
BA (%)
91.22
92.56
90.43
91.79
VSR (%)
90.10
92.44
89.60
90.36
Table The performance of our domain watermark with different model structures trained on the watermarked dataset generated with VGG-16-BN.
Metricl, Model-
ResNet-18
ResNet-34
VGG-I6-BN
VGG-19-BN
BA (%)
91.57
92.10
90.53
92.10
VSR (%)
90.70
91.60
90.44
89.84
Table The performance of our domain watermark with different model structures trained on the watermarked dataset generated with VGG-19-BN.
Metriel, Model->
ResNet-18
ResNet-34
VGG-16-BN
VGG-19-BN
BA (%)
91.48
91.98
90.77
92.73
VSR (%)
91.30
89.60
90.36
91.94
different models (i.e., ResNet- 18, ResNet-34, VGG-16-BN, and VGG-19-BN), Except for the model structure, all other settings are the same as those used in Section
Results. As shown in Table 8-11, our method has high transferability across model structures. Accordingly, our methods are practical protecting open-sourced datasets.
26

---

Figure 18: The Demonstration of Domain Watermark III.
J Additional Results for the Resistance to Potential Adaptive Methods
Robustness against ShrinkPad. We hereby discuss the robustness of our method against ShrinkPad [63], which is well-known watermarked sample detection approach based on set of input transforamtions. We follow BackdoorBox to implement ShrinkPad for filtering watermarked samples. We CIFAR-10 with ResNet-34 implement domain watermark and craft 1,000 wa- termarked samples based on the validation dataset for investigation. We first filter 900 watermarked samples that be correctly classified. We find ShrinkPad only filter 87 effective watermarked samples among 900 samples (S 10%), i.e., our domain watermark is robust against ShrinkPad.
Robustness against Scale-UP. We also evaluate method under the most advanced input-level watermark detection (i.e., SCALE-UP [64]). We follow their released code to implement SCALE- UP and the AUROC score the metric to report the results. We test our approach on SCALE-UP with 1,000 watermarked and 1,000 benign samples. We here use CIFAR-10 with ResNet-34.
We find that SCALE-UP yields around 0.58 AUROC score Such results imply that SCALE- UP can not perform against our domain watermark, with the filtering performance close to random guesses. We think it may be caused that, different from the previous backdoor-inspires watermark causing misclassification, domain watermark leads the watermarked model correctly classifying the watermarked samples. Therefore, the watermarked samples would have a similar scaled prediction consistency as benign samples, since they all belong to the ground- truth label and can be clustered closely shown in Section 5.3.2.
proposed domain watermark.
Robustness against Neural Cleanse. Following previous work [60], we also evaluate our ap- proach against reverse-engineeriigg based approaches [65, 66, 67]. here evaluate approach
27

---

2
4
Figure 19: The reversed trigger maps for each label produced by Neural Cleanse.
1.5
1.0
0.5
Anomaly
0.0
Labels
Figure 20:
The anomaly index for 4noormm computed on the reversed trigger maps for each label produced by Neural Cleanse.
against Neural Cleanse [67], which is the most widely-adopted approach. We select label 0 as the target label and use CIFAR-10 with ResNet-34. The results are shown in Figure 19-20. We can see the reversed trigger pattern produced by Neural Cleanse for the target label is extremely dense. We further follow [67] to calculate the anomaly index for each label using MAD outlier detection. We find that the target label's 'ss anomaly index is smaller than 2, thus it would not be detected.
We notice that there are still many other backdoor defenses (e.g.. [68, 69, 70]). We will discuss the resistance of our domain watermark method to them in our future works.
K
Can We Identify waatan-wwtermarrkdd Samples by Training on a Large Dataset with Complicated Data Augmentation?
In general, our method is developed on the foundation that only models trained on our protected dataset successfully identify domain-watermarre watermarked samples. However, people may worry about whether the suspicious model can also generalize well on Nomain-watermarker samples because its good training strategies structures instead of because being trained on the protected dataset. In this section, we discuss this potential problem.
Firstly, we cannot ensure this problem will never happen since training with more samples and com- plicated data augmentations may indeed increase general generalizability of suspicious models. However, the probability of it happening is very small in practice, as follows.
domain is an exclusive and special domain where only defenders know what it is. Accordingly, the adversaries (i.e., malicious dataset users) cannot know it and use it to break our verification.
It is unlikely that benign user develop data augmentation that generate (suf- ficiently) similar hard samples without knowing our specific settings, since the space of sarlll-generalizedd domain huge and our watermark sample-specific and not unique.
As shown in Figures 2-3 in the main manuscript as well as Figures 5-10 in the Appendix, domain- watermarked samples and not natural and very special. In other words, it impos- sible that dataset users can collect them without using our protected dataset. Accordingly,
28

---

Table 12: The performance of training with strong data augmentations on the benign dataset.
Dataset|, Metrie-
BA (%)
Accuracy DW samples (%)
A
p-value
CIFAR-10
91.50
30.15
0.76
1.00
Imageet
75.84
6.00
0.63
1.00
it is not reasonable to claim that a model has good performance samples because their dataset is extremely large covering numerous hard samples.
aamaiin-wttemarrke
Lemma indicates that we can find hardly-generalized domain for the dataset, no matter what the model architecture is. Accordingly, it is not reasonable to claim that model has good performance on nomain-watermarkee samples due its well-designed architecture.
Currently, model have similar generalizability to humans, although it was trained on a huge dataset with complicated data augmentation strategies and a well-designed structure.
Domain generalization still an important yet unsolved problem in computer vision. Ac- cordingly, there is no existing method can make DNNs generalize to all unseen domains (with performance on par to that of the source domain) for breaking our method.
Our sypothesis-testing-- based verification process ensures that suspicious models will be treated as trained on our protected dataset only when they have sufficiently high (not just certain) generalizability over large number (not just small number) of hard samples. Accordingly, our method can reduce the side effects of randomness to large extent.
We admit that using data augmentation or other domain adaption techniques may increase the gen- eralization ability of trained DNNs on domain- watermarredd samples, although adversaries have no information of gardll-generaliize domains and those augmented samples used for training are sig- nificantly different from those domain-watermarkee ones. However, this improvement limited since these adapted domains are significantly different from the hardly-generalized domain (the do- main space is high-dimensional and enormous). Accordingly, this mild improvement cannot break method. To further verify it, we evaluate method models with classical automatic data augmentations (e.g., color shifting) and domain adaption in Appendix K.1.
In particular, it does not diminish the practicality of our method, even if this rare event is likely to happen. Using verification-bee based defenses (in a legal system) requires an official institute for arbitration. Specifically, all commercial models should be registered here, based on the unique identification (c.g., MD5 code) of their model files and training datasets, before being used online. When this official institute is established, its staff should take responsibility for the verification process. For example, they can require the company to provide the dataset with the same registered identification and then check whether it contains our protected samples (via algorithms). Of course, the suspect model is proven to be benign, the user will need to pay a settlement to its company to prevent casual malicious ownership verification. In this case, even if our method misclassifies in rare cases, does not compromise the interest of the suspect model. Our method is practical in this realistic situation, long it has sufficiently high probability of correct verification.
K.1 The Resistance to Data Augmentation
Settings. We adopt strong data augmentations to train models on benign datasets with the same settings used in our paper. Specifically, we adopt random flip, random rotation, random affine trans- formations, random color shifting as the augmentations on CIFAR-10 and Tiny-Im datasets.
Results. As shown in Table 12, our method will not misjudge (p-value >> 0.05), although data aug- mentation can (slightly) increase the accuracy on our waterare samples. These results verify that our method is resistant to data augmentations.
K.2 The Resistance to Domain Adaption
Settings. In this part, adopt L.2D [50] the representative method to investigate the robust- ness of our domain watermark against domain adaption techniques. Specifically, we train both the watermarked and benign DNNs with L2D on CIFAR-I0 and Tiny-ImageNet datasets.
29

---

Table 13: The performance of our domain watermark under training with L2D.
Dataseti, -etric-
BA (%)
VSR (%)
Accuracy on Other DW samples (%)
I1
f1
CIFAR-10
91.10
86.10
19.10
-0. 14
-0.73
Tiny-Imun ImageNet
48.63
42.00
16.00
0.58
-0.26
Table 14: The verification performance via our domain watermark under training with L2D,
CIFAR- Independent-M
IinyIImaeNeet
Independent-D 0.63
Malicious
Independent-D
Independent-N M
Malicious
AP
0.60
0.05
0.53
0.53
0.07
p-value
0.90
0.71
10-33
0.96
0.95
10-12
Results. As shown in Table 13-14, our method is still highly effective under the domain adaption setting. is mostly because the VSR improvement caused by domain adaption is mild and there- fore cannot fool our verification. Moreover, domain generalization has side effects on the benign accuracy, especially on complicated datasets (e.g., Tiny- Tiny-ImageNet).
Reproducibility Statement
In the appendix, provide detailed descriptions of the datasets, models, training and evaluation settings, and computational facilities. We provide the codes and model checkpoints for reproducing the main experiments of our evaluation in the supplementary material. In particular, also release our training codes at https htttpp://githut com/ Junf CunfenngGDDoomin eaaeennnnDDaaaaa-ateereeerrr Watermark.
com/Junf
M Societal Impacts
In this paper, focus on the copyright protection of (open-sourced) datasets. Specifically, reveal the harmful nature of backdoor-based dataset ownership verification (DOV) and propose the first baw-bbbcckobbbbaie
DOV method that truly harmless. This work has no ethical issues in general since our method is purely defensive and does not reveal any new vulnerabilities of DNNs. However, our method requires sufficiently large watermarking rate and therefore can be used to protect few or single image. In addition, although our method is resistant to existing adaptive methods, adversaries may try develop more effective attacks against our DOV method, given the exposure of this paper. People should not be too optimistic about dataset protection.
N Discussions about Adopted Data
In this paper, all adopted samples are from the open-sourced datasets (i.c., CIFAR-10, Tiny- ImageNet, and STL-10). The Tiny-ImageNet dataset may contain few human-related images. We admit that we modified few samples for watermarking and verification. However, our research treats all samples the same and the verification samples and modified samples have offensive tent. Accordingly, our work fulfills the requirements of these datasets and has no privacy violation.
30


Reviews:
[{"review_id": "e6ctlPtSqQ", "reviewer": "Reviewer_a3iY", "summary": "The authors propose a novel dataset ownership verification method that relies on correctly classifying 'hard' samples rather than classifying 'easy' samples which is harmless to the benign data. The proposed method is inspired by the generalization property of DNNs.  Experiments verify the effectiveness of proposed method.", "questions": "1)  Similar-effect samples' influence to the final performance.\n2) The performance of the proposed method on the larger dataset.", "limitations": "See part ‘Strengths And Weaknesses’.", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1)\tInteresting insight. The insight of the harmless DOV method is interesting.\n2)\tClear writing: The paper is overall well-organized and easy to follow. The authors discuss the details of their design choices.\n", "weaknesses": "1. While hyper-parameter selection in ablation studies section is crucial, I think the impact of the module block on the algorithm more intriguing. Specifically, I am interested in understanding how the generation of similar-effect samples during the creation of the protected dataset affects the final performance.\n\n2. I think that the Domain Generator plays a crucial role in the overall algorithm. Therefore, it is essential to address the performance evaluation of this module.\n\n3. The experiments were conducted on relatively small datasets (e.g., CIFAR-10 and Tiny-ImageNet). The transferability of the algorithm's effectiveness to larger datasets remains a question. For instance, it is crucial to examine whether the training of the Domain Generator is affected when applied to larger datasets. I believe this issues should be addressed at least in the \"Discussion\" section.\n\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer a3iY, thank you very much for your careful review of our paper and thoughtful comments. We are encouraged by your positive comments on our **interesting insight**, **clear writing**, **good soundness**, and **good contribution**. We hope the following responses can help clarify potential misunderstandings and alleviate your concerns.\n\n\n---\n**Q1**: While hyper-parameter selection in ablation studies section is crucial, I think the impact of the module block on the algorithm more intriguing. Specifically, I am interested in understanding how the generation of similar-effect samples during the creation of the protected dataset affects the final performance.\n\n**R1**: Thank you for this insightful comment! We agree that understanding the impact of modules is also important. We hereby provide more details and dicussions. \n\n- In general, **using similar-effect samples will decrease the effectiveness of our method**. Specifically, the most direct and effective way for learning the hardly-generalized domain is to use domain-watermarked samples. The better the learning of this domain, the better the verification effectiveness. However, the approximation cannot be perfect, although we design an effective bi-level optimization to approximate the effects of domain-watermarked samples with similar-effect samples. To further verify it, we compare the performance of our domain watermark (DW) and that of its variant using domain-watermarked samples directly. As shown in the following table and Table 1 in the rebuttal PDF, **the performance of DW is (slightly) lower than that of its variant**. \n\n**Table 1.** The watermark performance of DW with (w/) and without (w/o) using similar-effect samples on CIFAR-10.\n|  Method$\\downarrow$, Metric$\\rightarrow$                        | BA (%) | VSR (%) | $H$ | $\\hat{H}$ |\n|:-------------------------------:|:------:|:-------:|:-:|-----------|\n|                DW (w/)               |   90.86     |     90.45    |  0.10 | -0.77          |\n|  DW (w/o) |    **91.61**        |     **91.40**   | **0.09**   |   **-0.78**       |\n\n\n\n- **Generating similar-effect samples instead of directly using domain-watermarked samples is necessary for ensuring watermark stealthiness**. As shown in Figure 2-3 in our main manuscript, the domain-watermarked image is visually very different from its original version, whereas similar-effect ones are close to their original version.\n\n- To further evaluate the similar-effect generation module, we hereby report the **optimizaiotn loss** (i.e., gradient matching loss) (between domain-watermarked samples and their similar-effect versions) and the **verification success rate** (for domain-watermarked samples) with respect to the optimization procedure of Eq.(7). As shown in Figure 1 of the rebuttal PDF, our generation module can generate similar-effect (i.e., low gradient matching loss) invisible samples while achieveing sufficiently high verificaiton success rate for their domain-watermarked versions. \n\nWe will provide more details and discussions in the appendix of our revision.\n\n \n---\n\n\n**Q2**: I think that the Domain Generator plays a crucial role in the overall algorithm. Therefore, it is essential to address the performance evaluation of this module.\n\n\n**R2**: Thank you for this insightful comment! We agree that understanding the impact of domain generator is also important. We hereby provide more details and dicussions.\n\n- Different from generating similar-effect samples, **domain generator is indispensable to our method**. Accordingly, we cannot evaluate its performance by testing the performance of our method without this module.\n- To further evaluate this module, we hereby report the **mutual information** (between benign samples and their domain-watermarked version) and the **accuracy** (of generated domain-watermarked samples) with respect to the optimization procedure of Eq.(2). We adopt CIFAR-10 and ImageNet to evaluate this module with VGG-16 and ResNet-34, respectively. As shown in Figure 2 of the rebuttal PDF, our module can craft hardly-generalized domain-watermarked samples with a low mutual information (and therefore a low classification accuracy) for benign models. \n\n\nWe will add more details and discussions in the appendix of our revision.\n\n\n---\n**Q3**: The experiments were conducted on relatively small datasets (e.g., CIFAR-10 and Tiny-ImageNet). The transferability of the algorithm's effectiveness to larger datasets remains a question. For instance, it is crucial to examine whether the training of the Domain Generator is affected when applied to larger datasets. I believe this issues should be addressed at least in the \"Discussion\" section.\n\n**R3**: Thank you for this insightful comment! To further alleviate your concerns, we hereby evaluate our method on Sub-ImageNet. It contains 50 random classes of samples within ImageNet whose image size is $224 \\times 224$. As shown in the following table and Table 2 in rebuttal PDF, **our method is still highly effective on Sub-ImageNet** following our default settings. We also report the performacne of the domain generator module on Sub-ImageNet in Figure 2 in the Rebuttal PDF. These results indicate that our method can be effective on large datasets.\n\n**Table 2.** The watermark performance of our domain watermark on Sub-ImageNet.\n|  Model$\\downarrow$, Metric$\\rightarrow$                        | BA (%) | VSR (%) | $H$ | $\\hat{H}$ |\n|:-------------------------------:|:------:|:-------:|:-:|-----------|\n|                ResNet-18               |  78.64      |     72.00    | 0.28 | -0.68          |\n|  ResNet-34 |   75.56      |     68.00  | 0.32  |  -0.64       |\n\n\n\n\nWe will add more details and discussions in the appendix of our revision.\n\n\n---\n"}, {"review_id": "FdZS0ljHBr", "reviewer": "Reviewer_DDiA", "summary": "This paper proposes domain watermark (DW), a new watermark technique for dataset verification. Domain watermark focuses on watermarking the dataset without introducing the harmful side effect. This paper first proposes to generate the hardly generalized domain by minimizing the mutual information between the dataset and hardly generalized domain. Then this paper perturbs some of the inputs to have similar effects as the domain-watermarked samples. Then the dataset contains its original domain and the watermarked domain. The model trained on it also learns the watermarked domain can be exposed by correctly classifying the watermarked domain images.\nThe evaluation is done on CIFAR-10 and Tiny-ImageNet and shows that the watermarked model can be effectively distinguished from model trained on data from another dataset or model trained on the unwatermarked dataset. ", "questions": "Please see the questions I raise in the weakness section.\n", "limitations": "This paper discusses the limitation of this paper is bounded by the accuracy of the watermark models.", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "I think the area this paper studies is important and I agree that the watermark should not introduce harms or vulnerabilities that can be exploited by the attackers. \n\nIn general, I like the idea of embedding the model with a harmless distribution that is orthogonal to the main distribution as the watermark.\n\nThis paper is well-written and easy to understand. ", "weaknesses": "1. My biggest concern with this approach is that it just optimizes to find the most hardly generalized domain. It is possible that two watermark domains on two datasets of one similar domain collide.  \nSuppose there are two dataset owners A and B. They have dataset from the similar domains and they both use this paper’s method to do the domain watermark. An attacker C trains on A’s dataset, would B’s WM images also have high VSR on C’s model? \nIf so, it would be hard for A to claim that C trained on A’s model as the high VSR on the WM images does not prove the model trained on A (it could also be trained on B or trained on another model from the similar domain). \nI suggest adding a new experiment on this hypothetical scenario or include a new mechanism to avoid/reduce the possibility of collision of the watermark domains.\n\n2. The general idea of this paper is that the watermarked dataset contains two distributions, the dataset’s domain and the watermark domain. Many of the existing backdoor poison samples detection methods also depend on this assumption. Will the watermark domain bypass some of the existing backdoor detection techniques, e.g.[1-3]? I suggest this paper to be evaluated against backdoor samples detection techniques.\n\n3. I am not able to find the clear definition of the Harmful degree and relative harmful degree. Could you put these definitions in the main text? \n\n\n[1] Effective Backdoor Defense by Exploiting Sensitivity of Poisoned Samples\n[2] Demon in the variant: Statistical analysis of {DNNs} for robust backdoor contamination detection\n[3] Pre-activation Distributions Expose Backdoor Neurons\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer DDiA, thank you very much for your careful review of our paper and thoughtful comments. We are encouraged by your positive comments on our **significant topic**, **interesting idea**, and **clear writing**. We hope the following responses can help clarify potential misunderstandings and alleviate your concerns.\n\n\n\n---\n**Q1**: My biggest concern with this approach is that it just optimizes to find the most hardly generalized domain. It is possible that two watermark domains on two datasets of one similar domain collide. Suppose there are two dataset owners A and B. They have dataset from the similar domains and they both use this paper’s method to do the domain watermark. An attacker C trains on A’s dataset, would B’s WM images also have high VSR on C’s model? If so, it would be hard for A to claim that C trained on A’s model as the high VSR on the WM images does not prove the model trained on A (it could also be trained on B or trained on another model from the similar domain). I suggest adding a new experiment on this hypothetical scenario or include a new mechanism to avoid/reduce the possibility of collision of the watermark domains.\n\n\n**R1**: Thank you for this insightful question! We are deeply sorry that our submission may lead you to some misunderstandings that we want to clarify here.\n\n1. We intend to obtain a hardly-generalized domain instead of the most hardly-generalized one for the given dataset.\n2. **Hardly-generalized domain is not unique** for each given dataset. As shown in our Appendix C, we can easily generate many different hardly-generalized domains with different random seeds. Accordingly, **it is almost impossible for two independent defenders to find the same (or even similar) hardly-generalized domain even for the same unprotected original dataset**.\n3. In particular, we have considered this potential problem in our method. **The second term in our Eq.(7) is to prevent the watermarked model can achieve a similar generalization performance on (other) unseen domains** as the target domain to  preserve its uniqueness for verification purposes. \n4. In our Table 2 (Independent-D), **we have verified that we cannot fool our verification method with watermarked samples from another hardly-generalized domain (crafted from the same benign dataset) that is different from the one used for defender**. Besides, we have also conducted more experiments in Appendix I.2 to further verify it. \n\n\n---\n**Q2**: The general idea of this paper is that the watermarked dataset contains two distributions, the dataset’s domain and the watermark domain. Many of the existing backdoor poison samples detection methods also depend on this assumption. Will the watermark domain bypass some of the existing backdoor detection techniques, e.g.[1-3]? I suggest this paper to be evaluated against backdoor samples detection techniques.\n\n**R2**: Thank you for this insightful question! We hereby provide more explanations to alleviate your concerns. \n- In our paper (Section 5.3.2 and Appendix J), we have evaluated our method against five representative backdoor defenses, including three detection methods (i.e., ShrinkPad, Scale-UP, and Neural Cleanse). The results showed that **our method is resistant to all of them**.\n- To further alleviate your concerns, we evaluate whether our method is resistant to your suggested defenses [2-3]. Since the rebuttal time is limited, we don't test D-BR [1] and D-ST [1] due to their complexity of codes and high computational consumption (due to its self-supervised stage). \n  - **The Resistance to BNP [2]**：We implement BNP based on its open-sourced codes with its default settings on CIFAR-10. With BNP, the benign accuracy drops from 91.06\\% to 85.86\\% while the verification success rate (VSR) drops from 90.4\\% to 80.1\\%, resulting in the p-value of identifying dataset stealing as $10^{-18}$ ($\\ll 0.01$). **These results show that our method is resistant to BNP**. It is probably because our method doesn't introduce adverse features to the target DNNs as the verified samples share most semantic features with their benign versions according to Eq.(2). As such, the 'bad neurons' caused by our approach closely collided with the 'benign neurons'.\n  - **The Resistance to SCAn [3]**：We implement SCAn also on CIFAR-10 with different budgets for clean samples required by SCAn. As shown in the following table, **SCAn can not identify the watermarked DNN ($Ln(J^{*})\\leq 2)$ and therefore failing to further filter out watermarked samples**, even with 20\\% of clean samples for each class. It is probably because our modified samples are clean-label and invisible and their features contain no adverse information.\n\n\n|   Budgets for Clean Samples    |  1%  |   5%  |  10% |  15% |  20% |\n|:-----:|:----:|:-----:|:----:|:----:|:----:|\n|$Ln(J^{*})$ | 1.21 | 1.209 | 1.27 | 1.49 | 1.51 |\n\n\nWe will add more details and discussions in the appendix of our revision.\n\n\n---\n\n**Q3**: I am not able to find the clear definition of the Harmful degree and relative harmful degree. Could you put these definitions in the main text?\n\n**R3**: We have provided their definitions in Definition 1 from Section 3.2 (Line 149-154, Page 4). You might have accidentally missed it :)\n\n---"}, {"review_id": "ciRXWYHGmK", "reviewer": "Reviewer_Tjx6", "summary": "This paper presents a method to use invisible domain watermarks for dataset ownership verification. Compared to previous methods, the motivation of this paper is to avoid harmful practice which negatively affects the model performance. The method is validated on CIFAR and Tiny-Imagenet datasets.", "questions": "Overall, the paper is comprehensive.\nMy main concerns are about the adaptive attacks and domain generalization training methods coincidently breaking the assumption of the proposed method.", "limitations": "See weaknesses.", "rating": 5, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.[reference] The paper provides a comprehensive literature review.\n\n2.[clarity] Extensive experimental results and ablation studies demonstrate the effectiveness of the proposed method.\n\n3.[clarity] The paper has a clear motivation, which is to avoid harmful practice compared to existing methods. In particular, the proposed method is invisible, clear-label, and effective.", "weaknesses": "\n1.[technical soundness] Adaptive attack against this proposed method is not discussed.\n\n2.[limitation] The paper relies on assumption on generalization. For standard training the assumptions should hold. But what if the dataset to protect is used for domain adaptation, which has higher generalization capability across domains? This is not adaptive attack by design, but it might coincidently break the core assumptions of the proposed method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer Tjx6, thank you very much for your careful review of our paper and thoughtful comments. We are encouraged by your positive comments on our **comprehensive review**, **extensive experiments**, **effective method**, **good presentation**, **good soundness**, and **good contribution**. We hope the following responses can help clarify potential misunderstandings and alleviate your concerns.\n\n---\n\n**Q1**: Adaptive attack against this proposed method is not discussed.\n\n**R1**: Thank you for your comments and we do understand your concerns. \n- In general, our method is relatively complicated with two bi-level optimizations. Accordingly, **it is very difficult or even impossible to design a penalty term corresponding to the process of our method to design adaptive attacks**. It is why we only evaluate the resistance of our method to five representative existing defenses that could be effective in defending against our dataset watermark. \n- From a high-level perspective, our method intends to make DNNs generalizing to a specific domain (i.e., hardly-generalized domain) with samples from the source domain under the standard training process (since similar-effect samples are similar to clean ones). Accordingly, we can design adaptive attack by supressing domain generalization during the training process. We hereby exploit [non-transferable learning](https://arxiv.org/pdf/2106.06916.pdf) for the design. As shown in following tables, **our method is still highly effective under non-transferable learning**. \n\n\n| Task$\\downarrow$, Metric$\\rightarrow$                        | BA (%) | VSR (%) | $H$ | $\\hat{H}$ |\n|:-------------------------------:|:------:|:-------:|:-:|-----------|\n|                CIFAR-10               |  90.01      |     86.40    | 0.14 | -0.67          |\n\n| Metric$\\downarrow$, Scenario$\\rightarrow$ | Independent-D | Independent-M | Malicious  |\n|--------------------|-------------------------------------------|---------------|---------------|\n| $\\Delta P$                                          |     0.86    | 0.80         |       0.08\n| p-value                                          | 1             | 1            | $10^{-21}$ |\n\nWe will provide more details and discussions in the appendix of our revision.\n\n\n\n\n\n---\n\n**Q2**: The paper relies on assumption on generalization. For standard training the assumptions should hold. But what if the dataset to protect is used for domain adaptation, which has higher generalization capability across domains? This is not adaptive attack by design, but it might coincidently break the core assumptions of the proposed method.\n\n**R2**: Thank you for this insightful question! We here adopt [L2D](https://arxiv.org/abs/2108.11726) as the representative method to investigate the robustness of our domain watermark against domain generalization. Specifically, we train both the watermarked and benign DNNs with L2D. The results are as follows.\n\n|  Task$\\downarrow$, Metric$\\rightarrow$                        | BA (%) | VSR (%) | Accuracy on other hardly generalized domain samples (%) |$H$ | $\\hat{H}$ |\n|:-------------------------------:|:------:|:------:|:-------:|:-:|-----------|\n|                CIFAR-10                  |     90.10    |  86.10 | 39.10 |-0.14     | -0.73   |\n|  Tiny-ImageNet |    48.63        |   42.00  |16.00| 0.58     |  -0.26       |\n\n\n| Metric$\\downarrow$ | Task$\\downarrow$, Scenario$\\rightarrow$ | Independent-D | Independent-M | Malicious  |\n|--------------------|-------------------------------------------|---------------|---------------|------------|\n| $\\Delta P$         | CIFAR-10                                 |     0.63    | 0.60         |       0.05\n| $\\Delta P$         | Tiny-ImageNet                                  | 0.53          | 0.53         | 0.07      |\n| p-value            | CIFAR-10                                   | 0.90            | 0.71            | $10^{-33}$ |\n| p-value            | Tiny-ImageNet                                  | 0.96              | 0.95            | $10^{-12}$ |\n\n\nThe above results indiate that **our method is still highly effective under the domain adaption setting**. It is mostly because the VSR imporvement caused by domain adaption is mild and therefore cannot fool our verification. Moreover, **domain generalization has side effects on the benign accuracy**, especially on complicated datasets ($e.g.,$ Tiny-ImageNet).\n\n---"}, {"review_id": "pnDqpGrXbu", "reviewer": "Reviewer_FQjV", "summary": "This paper first revisits the backdoor-based dataset ownership verifications and claims that these methods are harmful since they introduce the malicious misclassification. Given this, authors propose a truly harmless dataset copyright protection via making watermarked models correctly classify hard samples which will be misclassified by the benign models. They first generate domain watermark and then modify a set of benign samples which have similar effects to domain watermarked samples to insert the watermark into the dataset. Finally, they propose a hypothesis testing to verify whether a suspect model has unauthorized dataset usage. Experiments on CIFAR-10, Tiny-ImageNet and STL-10 show the effectiveness.", "questions": "1. In Equation (2), it seems that both z and \\hat_{z} are relative to \\omega while in the second term of \\omega * , i.e., , \\hat_{z} is not relative to \\omega.\n2. In line 262, authors set the watermarking rate \\gamma=0.1 for their method and other baselines. However, for the most of baselines, they need to set one class as the target class, which means all of samples in the target class are perturbed for 10-class datasets (CIFAR-10 and STL-10) and a few classes are selected to be target classes for Tiny-ImageNet (200-class). I wonder the concrete settings.\n3. In the Experiments, authors describe that they conduct experiments with two model structures VGG and ResNet, while results in table 1&2 do not reflect this setting, and the detailed settings of these results are not clear.", "limitations": "Please refer to the questions above. ", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The proposed method is novel to some extend. This paper proposes to protect the intellectual property of dataset from another perspective, i.e., making watermarked models correctly classify hard samples which will be misclassified by the benign models, differed from previous backdoor-based methods.\n2. The theoretical analysis is reasonable and the experiments are extensive.", "weaknesses": "Section 3.3 and 3.4 are not clear and well-written.  For example, (a) lemma 1 (line 172~176) mentions the z and \\hat_{z}, the features for source and target domains. However, the specific meaning of z/\\hat_{z} and how to obtain z/\\hat_{z} are not explained until line 189; (b) it's better to give the specific meanings of \\theta, \\omega and f in equation 2;\n\nAlthough authors have conducted extensive experiments, it's better to test with more model structures instead of only two (VGG and ResNet). Besides, Section 5.3.2 in the main manuscript and Section J in the appendix discuss the resistance to some potential adaptive methods. However, I think the true adaptive method are out-of-domain detection in the inference stage which does not involved in either main manuscript or the appendix. ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "\nDear Reviewer FQjV, thank you very much for your careful review of our paper and thoughtful comments. We are encouraged by your positive comments on our **novel method**, **reasonable theoretical analysis**, **extensive experiments**, **good soundness**, and **good contribution**. We hope the following responses can help clarify potential misunderstandings and alleviate your concerns.\n\n---\n**Q1**: Provide more details in Section 3.3-3.4.\n\n**R1**: Thank you for you constructive suggestions! We will provide a more clear definition of $z$ and $\\hat{z}$ and how to obtain them in Lemma 1. Besides, we will provde the definition of $\\theta$ (i.e., parameters of the domain generator), $\\omega$ (i.e., parameters of the model $f$), and $f$ in Eq.(2).  \n\n---\n\n**Q2**: Although authors have conducted extensive experiments, it's better to test with more model structures instead of only two. \n\n**R2**: Thank you for this constructive suggestion! We evaluate our method with two additional representative model structures (i.e., MobileNet-V2 and DenseNet-40) following our default settings. As shown in the following tables, **our method is still highly effective with them**. We will provide more details in the appendix of our revision.\n\n**Table 1.** The watermark performance of our domain watermark with MobileNet-V2 and DenseNet-40 on CIFAR-10.\n|                          | BA (%) | VSR (%) | $H$ | $\\hat{H}$ |\n|:-------------------------------:|:------:|:-------:|:-:|-----------|\n|                MobileNet-V2             |   88.29     |     82.5    |  0.18 | -0.58          |\n|  DenseNet-40 |    90.04        |      87.10   |0.13   |    -0.70       |\n\n\n**Table 2.** The verification effectiveness via our domain watermark with MobileNet-V2 and DenseNet-40 on CIFAR-10.\n|           Structure$\\rightarrow$          |   MobileNet   |   MobileNet   |  MobileNet |    DenseNet   |    DenseNet   |  DenseNet  |\n|:-----------------------------------------:|:-------------:|:-------------:|:----------:|:-------------:|:-------------:|:----------:|\n| Metric$\\downarrow$, Scenario$\\rightarrow$ | Independent-D | Independent-M |  Malicious | Independent-D | Independent-M |  Malicious |\n|                 $\\Delta P$                |      0.74     |      0.74     |    0.09    |      0.72     |      0.74     |    0.08    |\n|                  p-value                  |       1       |       1       | $10^{-19}$ |       1       |       1       | $10^{-19}$ |\n\n---\n\n**Q3**: I think the true adaptive method are out-of-domain detection in the inference stage which does not involved in either main manuscript or the appendix.\n\n**R3**: Thank you for your suggestion and we do understand your concerns. \n- We admit that using out-of-domain generators may detect our domain-watermarked samples. However, since only defenders know the detailed domain for watermarked samples, **the adversaries can only train a out-of-domain generator that would detect and reject samples from all domains other than the source domain**. We argue **it is rare to apply such a generator in practice**, particularly in computer vision. This is because domain generalization capability plays a crucial role in real-world DNN applications, **failing to give accurate predictions on unseen domains' samples would significantly reduce its real-world performance**.\n- Moreover, we do understand your concerns. **We have also considered the adaptvie attack and showed the resistance of our method to it** during the rebuttal. Please see the $R1$ to Reviewer Tjx6 for more details.\n\n\n---\n\n**Q4**: In Equation (2), it seems that both $z$ and $\\hat{z}$ are relative to $\\omega$ while in the second term of $\\omega^*$ , i.e., , $\\hat{z}$ is not relative to $\\omega$.\n\n**R4**: Thank you for pointing it out! We will repalce $\\hat{z}$ with $\\hat{z}(\\omega)$ to avoid potential misunderstanding.\n\n---\n\n**Q5**: In line 262, authors set the watermarking rate $\\gamma=0.1$ for their method and other baselines. However, for the most of baselines, they need to set one class as the target class, which means all of samples in the target class are perturbed for 10-class datasets (CIFAR-10 and STL-10) and a few classes are selected to be target classes for Tiny-ImageNet (200-class). I wonder the concrete settings.\n\n**R5**: We are deeply sorry that our submission may lead you to some misunderstandings that we want to clarify here.\n\n- **Only the label-consistent attack (instead of most methods) generates watermark samples solely based on benign samples from the target class**. Specifically, poisoned-label watermarks (i.e., BadNets, Blended, WaNet, and UBW-P) can add trigger patterns to samples from all classes; Although they are clean-label watermarks, Sleeper Agent, UBW-C, and our DW can generate watermarked samples from all classes since we formulate watermark generation as a bi-level optimization problem. We will provide more details in the appendix of our revision to avoid potential misunderstandings.\n- We have to admit that we forgot to include a setting detail that **we poison 50\\% samples from the target class (instead of 10\\% samples from the whole dataset) for the label-consistent attack on all datasets**, following the default settings used in 'BackdoorBox'. We will add this detail in Section 5.1 in our revision.  \n\n---\n\n**Q6**: In the Experiments, authors describe that they conduct experiments with two model structures VGG and ResNet, while results in table 1&2 do not reflect this setting, and the detailed settings of these results are not clear.\n\n**R6**: We are deeply sorry that our submission may lead you to some misunderstandings. In fact, **we forget to include a 'respectively' at the end of the first sentence in Section 5**. In other words, we conduct experiments on two benchmark datasets, including CIFAR-10 and Tiny-ImageNet with VGG and ResNet, respectively. We will correct it in our revision to avoid potential misunderstandings.\n\n---\n"}, {"review_id": "LzUVnvp2lG", "reviewer": "Reviewer_xWCD", "summary": "The authors study copyright projection problem for open datasets. They note that the previous method based on back door attacks are harmful. They propose to watermark some samples such that model training on this sample can correctly classify hard sample, which cannot be correctly classified by benign DNN. Technically, the authors exploit knowledge and techniques in transfer learning to derive domain generator for this task. The authors provide a set theoretical justification and perform a series of experiments to evaluate the proposed scheme.", "questions": "See the weaknesses.", "limitations": "See the weaknesses.", "rating": 4, "confidence": 2, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "The proposed method is supported by both theory and experiments. \n\nThe proposed idea using hard sample for database copyright protection should be novelty.", "weaknesses": "The basic idea of this work is illustrated in Fig. 1. (Stage III). If many hard samples (which cannot be classified by benign DNN) can be correctly classified by a suspicious model, it is not necessary that the suspicious model is trained on the copyright dataset. If the owner of suspicious model claims that their model is trained on an extremely large dataset covering numerous hard samples and uses a proprietary architecture, augmentation method and learning scheme, it will be a very reasonable explanation why it can perform better the benign DNN, which is trained on a “small” dataset.  Fig. 3 in fact gives a good illustration. The verification sample of the proposed method in Fig. 3 is clearly a dog to human being and the classification output is a dog. We only can say that the model can handle the hard sample. However, we cannot conclude that the model is trained on the watermarked dataset. Although the paper offers a lot of mathematical justification and experimental results, the authors need to explain the practicality of the proposed method. \n\nAlthough I do read the paper from beginning to the end, I am not working on this area. I let other reviewers commenting on the technical and experimental issues.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer xWCD, thank you very much for your careful review of our paper and thoughtful comments. We are encouraged by your positive comments on our **novel method**, **theoretical and empirical supports**, and **good contribution**. We hope the following responses can help clarify potential misunderstandings and alleviate your concerns.\n\n\n---\n\n**Q1**: The basic idea of this work is illustrated in Fig. 1. (Stage III). If many hard samples (which cannot be classified by benign DNN) can be correctly classified by a suspicious model, it is not necessary that the suspicious model is trained on the copyright dataset. If the owner of suspicious model claims that their model is trained on an extremely large dataset covering numerous hard samples and uses a proprietary architecture, augmentation method and learning scheme, it will be a very reasonable explanation why it can perform better the benign DNN, which is trained on a “small” dataset. Fig. 3 in fact gives a good illustration. The verification sample of the proposed method in Fig. 3 is clearly a dog to human being and the classification output is a dog. We only can say that the model can handle the hard sample. However, we cannot conclude that the model is trained on the watermarked dataset. Although the paper offers a lot of mathematical justification and experimental results, the authors need to explain the practicality of the proposed method.\n\n**R1**: Thank you for challenging the foundation of our method! We are deeply sorry that our submission may lead you to some misunderstandings that we hereby want to clarify.\n\n- **Hardly-generalized domain is an exclusive and special domain** where only defenders know what it is. Accordingly, the adversaries (i.e., malicious dataset users) cannot know it and use it to break our verification.\n- Lemma 1 indicates that **we can find a hardly-generalized domain for the dataset, no matter what the model architecture is**. Accordingly, it is not reasonable to claim that a model has good performance on domain-watermarked samples due to its well-designed architecture.\n- As shown in Figures 2-3 in the main manuscript as well as **Figures 2, 5-10 in the Appendix**, **domain-watermarked samples and not natural and very special**. In other words, **it is impossible that dataset users can collect them without using our protected dataset**. Accordingly, it is not reasonable to claim that a model has good performance on domain-watermarked samples because their dataset is extremely large covering numerous hard samples.\n- We admit that using data augmentation or other domain adaption techniques may increase the generalization ability of trained DNNs on domain-watermarked samples, although adversaries have no information of hardly-generalized domains and those augmented samples used for training are significantly different from those of domain-watermarked ones. However, **this improvement is limited since these adapted domains are significantly different from the hardly-generalized domain** (the domain space is high-dimensional and enormous). Accordingly, **this mild improvement cannot break our method**. To further verify it, we evaluate our method on models with classical automatic data augmentations (e.g., color shifting) and domain adaption. \n  - **The Resistance to Data Augmentation**: We adopt strong data augmentations (as shown in the following code block) to train models on benign datasets with the same settings used in our paper. After that, we evaluate their accuracy on our domain-watermarked samples and verify whether our verification method will treat them as malicious in this case. As shown in the following table, **our method will not misjudge (p-value $\\gg$ 0.05) although data augmentation can (slightly) increase the accuracy on our domain-watermarked samples**.\n\n```python!\n#code for data augumentation (written in Torch)\ntransforms.RandomHorizontalFlip(), # FLips the image w.r.t horizontal axis\ntransforms.RandomRotation(10),#Rotates the image to a specified angel\ntransforms.RandomAffine(0, shear=10, scale=(0.8,1.2)), #Performs actions like zooms, change shear angles.\ntransforms.ColorJitter(brightness=0.2, contrast=0.2, saturation=0.2), # color shifiting, constrast\ntransforms.ToTensor(),\n```\n  \n | Dataset$\\downarrow$, Metric$\\rightarrow$                        | BA (%) | Accuracy on DW samples (%) | $\\Delta P$ | p-value |\n|:-------------------------------:|:------:|:-------:|:-:|-----------|\n|              CIFAR-10               |     91.50      |     30.15   |   0.76|  1.00      |   \n| Tiny-ImageNet |   59.60      |    14.00   |  0.6 |   0.93    |\n| Sub-ImageNet |   75.84      |     6.00  |  0.63|    1.00  | \n  \n  - **The Resistance to Domain Adaption/Generalization**: The results show that our method is still highly effective even under domain adption. Please refer to our $R2$ to Reviewer Tjx6 for more details.\n- Domain generalization is still an important yet unsolved problem in computer vision. Accordingly, **there is no existing method can make DNNs generalize to all unseen domains** (with performance on par to that of the source domain) for breaking our method.\n\n\nIn conclusion, our method will not misjudge even if users may adopt 'hard samples', data augmentation, and domain adoption. Accordingly, our method is essentially practical. We will add more details and discussions in the appendix of our revision. \n\n---\n"}]

Author rebuttal:
Two figures and tables are contained in the rebuttal PDF.

Meta-review: Overall, the reviewers agree that this submission studies an important and very interesting research problem, proposes a novel method, has a high writing quality, conducts sufficient experiments and literature review, and addresses most of the reviewers' concerns well through rebuttal. One reviewer raised a concern about the possible ineffectiveness of the authors' approach in some extreme cases, which the authors also responded convincingly.
Decision: Accept (poster)