ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark
Authors: Junfeng Guo
Yiming Li
Ruibo Chen
Yihan Wu
Chenxi Liu
Heng Huang
Venue: NeurIPS 2024 poster (2024)
Keywords: Dataset Ownership Verification
Ownership Verification
Copyright Protection
AI Security
Primary area: safety_in_machine_learning

Abstract: High-quality public datasets significantly prompt the prosperity of deep neural networks (DNNs). Currently, dataset ownership verification (DOV), which consists of dataset watermarking and ownership verification, is the only feasible solution to protect their copyright by preventing unauthorized use. In this paper, we revisit existing DOV methods and find that they all mainly focused on the first stage by designing different types of dataset watermarks and directly exploiting watermarked samples as the verification samples for ownership verification. As such, their success relies on an underlying assumption that verification is a \emph{one-time} and \emph{privacy-preserving} process, which does not necessarily hold in practice. To alleviate this problem, we propose \emph{ZeroMark} to conduct ownership verification without disclosing dataset-specified watermarks. Our method is inspired by our empirical and theoretical findings of the intrinsic property of DNNs trained on the watermarked dataset. Specifically, ZeroMark first generates the closest boundary version of given benign samples and calculates their boundary gradients under the label-only black-box setting. After that, it examines whether the given suspicious method has been trained on the protected dataset by performing a hypothesis test, based on the cosine similarity measured on the boundary gradients and the watermark pattern. Extensive experiments on benchmark datasets verify the effectiveness of our ZeroMark and its resistance to potential adaptive attacks. The codes for reproducing our main experiments are publicly available at \href{https://github.com/JunfengGo/ZeroMark.git}{GitHub}.

ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermarks
Junfeng Guo!,, Yiming Li Ruibo Chen', Yihan Wu', Chenxi Liu', Heng Huang'
Department of Computer Science, Institute of Health Computing
University of Maryland College Park
"Colleee of Computing and Data Science, Nanyang Technology University {gjf2023, ruibo, munibo,yihaawu, yihanwu, chenxi, henggnnndd............mammmm @umd. edu; liyiming. tech@gmail com
Abstract
High-quality public datasets significantly prompt the prosperity of deep neural networks (DNNs). Currently, dataset ownership verification (DOV), which con- sists of dataset watermarking and ownership verification, is the only feasible so- lution to protect their copyright by preventing unauthorized use. In this paper, we revisit existing DOV methods and find that they all mainly focused on the first stage by designing different types of dataset watermarks and directly exploiting watermarked samples the verification samples for ownership verification. As such, their success relies on an underlying assumption that verification a one- time and priseviy-rrsserving process, which does not necessarily hold in practice. To alleviate this problem, we propose ZeroMark to conduct ownership verification without disclosing dataset-specified watermarks. Our method is inspired by our empirical and theoretical findings of the intrinsic property of DNNs trained on the watermarked dataset. Specifically, ZeroMark first generates the closest boundary version of given benign samples and calculates their boundary gradients under the label-only black-box setting. After that, examines whether the given suspi- cious method has been trained on the protected dataset by performing hypothesis test, based the cosine similarity measured the boundary gradients and the watermark pattern. Extensive experiments on benchmark datasets verify the ef- fectiveness our ZeroMark and its resistance potential adaptive attacks. The codes for reproducing our main experiments are publicly available at GitHub.
1 Introduction
Deep neural networks (DNNs) have demonstrated their strong ability in widespread applications, such as face recognition [1, 2, 3]. Currently, there are many (high-quality) public datasets, such as CIFAR [4] and ImageNet [5], that can be easily downloaded and used. Arguably, their availability one the key factors the prosperity of DNNs, as developers can evaluate and improve their models upon them. In particular, these datasets are usually only freely available for non-commercial use since their collection and annotation are time-consuming and even expensive.
To the best of our knowledge, dataset ownership verification (DOV) [6, 7, 8, 9. 10, 11] is currently the only feasible solution for protecting the copyright of public datasets. Specifically. DOV consists of two main stages, including dataset watermarking and ownership verification. In the first stage, dataset owners will introduce some imperceptible watermarked samples to generate the released watermarked version of the original dataset, so that all models trained on it will have specific dis- tinctive prediction behaviors on particular samples (i.e., verification samples) while having normal 'The first two authors contributed equally to this work.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Tnanthoriood Train
Unauthorirrd INNS
Existing DDV
Largstate
Predictioon Anoluce
Thar
CIFARAD
co
ZeroMark
Roumiory Graniint Analyats
Watermark
Protected
Watermarked
Verificaiion Samples
Suspicious DNN
Dataset Watermarking Stage
Ownership Verification Stage
The overview of existing dataset ownership verification (DOV) methods and our Zero- Mark. the verification phase, existing DOV approaches directly exploit watermarked samples for verification purposes. In contrast, ZeroMark queries the suspicious model with boundary samples without disclosing dataset-specified watermarks to safeguard the verification process.
Figure 1:
behaviors on standard testing samples. In the second stage, given the API of a suspicious third-party -arrt deployed model, the dataset owners will detect whether is trained on the protected dataset by examining its prediction behaviors on verification samples.
In this paper, revisit existing DOV methods. We find that they all mainly focused on the first stage by designing different types of dataset watermarks, no matter whether their watermark is backdoor- based [6, 7, 8] or not [9. 11]. All of them directly exploited watermarked samples as the verification samples in their second stage. Accordingly, their success relies on an underlying assumption that verification is a one-time and priveviy-reserving process. Otherwise, as the watermark pattern is leaked during the (first) verification process, the malicious dataset users can easily remove the wa- termark from the model trained on the stolen dataset or from the verification samples. However, this assumption does not necessarily hold true in practice since adversaries can always update their unauthorized models. As such, an intriguing and critical question arises: Could we verify dataser watermarks to ensure secure verification process?
ownership without disclosing dataset-specippee
The answer the aforementioned problem is positive. In this paper, we first delve into the intrinsic property of DNNs trained on the watermarked dataset. We empirically and theoretically demonstrate that the gradient of watermarked models calculated upon the closest samples located at the decision boundary (dubbed "boundary gradient") has a similar direction to their corresponding watermark patterns, measured by their cosine similarity. Specifically, the distribution of cosine similarity of the watermarked model on the dataset dataset-specified target class has significantly larger values than that of the remaining (benign) classes. In particular, samples located at the decision boundary (dubbed 'boundary samples') of watermarked DNNs contain limited information about the dataset-specified watermarks, measured by several metrics (e.g., mutual information). Motivated by these intrigu- ing findings, we propose to conduct dataset ownership verification with closest boundary samples instead of samples containing specifiee watermarks (as shown in Figure 1). We call this method ZeroMark. Specifically, our ZeroMark has three main steps. In the first step, ZeroMark generates the closest boundary version of given benign samples. The second step calculates the boundary gradients of generated closest boundary samples based on the Monte Carlo method. Both steps are conducted under the label-only black-box verification setting, where dataset owners can only query the suspicious model with verification samples via API and get its predicted labels. In the third step, MeroMark examines whether the given suspicious method has been trained on the pro- tected dataset via hypothesis test, based on the distribution of cosine similarity measured between the boundary gradients and the corresponding watermark pattern.
In conclusion, our main contributions are four-fold: (1) We revisit existing DOV methods and reveal their underlying assumption regarding the verification phase. does not necessarily hold, hinder- ing the protection of dataset copyright. (2) We empirically and theoretically discover intrinsic property of watermarked DNNs regarding boundary samples (i.e., those located at the decision boundary). (3) We propose simple yet effective method (i.e., ZeroMark) to verify dataset own- ership without disclosing dataset-speciffe watermarks. (4) We conduct experiments on benchmark datasets, verifying the effectiveness of ZeroMark and its resistance potential adaptive methods.
2 Related Work
2.1
Data Protection
Classical Data Protection. Data protection is a classical and significant research area, which aims to prevent unauthorized data usage or protect private data. Existing classical data protection con-

---

sists of three main categories, including (1) encryption, (2) digital watermarking, and (3) privacy
protection. Specifically, eneryption [12. 13, 14] encrypts the sensitive data so that only authorized users with secret key can decrypt and use it. Digital watermarking [15, 16, 17] embeds an owner- specified pattern to the protected data as the watermark to claim ownership. Privacy protection focuses preventing the leakage of sensitive information of the data in both empirical [18, 19, 20] and certified manners [21, 22, 23]. Unfortunately, existing classical approaches can not directly protect the copyright of open-source datasets since they either hinder the dataset accessibility (e.g.. encryption) or require the information of the training process of models trained on them (e.g., digital watermarking and privacy protection) that will not be disclosed by authorized dataset users.
Dataset Ownership Verification. Dataset ownership verification (DOV) aims to verify whether a suspicious model is trained on the protected dataset. To the best of our knowledge, this is currently the only feasible method to protect the copyright of open-source datasets. Specifically, DOV intends to introduce specific prediction behaviors (towards verification samples) in models trained on the protected dataset while preserving their performance on benign testing samples. Dataset owners can verify ownership by examining whether the suspicious model has dataset-specified distinctive behav- iors. Previous DOV methods exploit either backdoor attacks [6, 7, 8, 10] or others [9. 11] to water- mark the original (unprotected) benign dataset. For example, recently, backdoor-based DOV [6, 8, 7] adopted poisoned-/clean label backdoor attacks to watermark the protected dataset. Most recently, Guo et al. [9] adopted samples from the hardly-generalized domain as watermark samples with- out introducing any new security vulnerability. However, all existing dataset ownership verification (DOV) approaches [6, 8, 7, 9. 10, 11] mainly focus on designing watermarks with different proper- ties (e-g-. harmless and stealthy) and directly exploit the watermarked samples for verification. The security study of their verification stage remains blank and is worth further exploration.
2.2 Secure Machine Learning Inference
Currently, there are also few works to safeguard the inference process of models. In the context of machine learning, secure inference is a two-party cryptographic protocol applied in the inference phase of machine learning models [24, 25, 26]. The server learns nothing about clients' input, while a client learns nothing about the server's 'ss machine learning model but can only get the results. Tech- nically, it is implemented by having the server and client involved in specific protocol and running the encrypted model over the encrypted input through cryptographic techniques such as homomor- phic encryption [27] and secret sharing [28]. However, secure inference requires both the client and server to encrypt input data and adapt the machine learning model's operations accordingly through cryptographic mechanisms [27, 28). As such, it is infeasible to protect the verification process of DOV methods since suspicious third-party models may not support these protocols.
3
The Property of Models Trained on the Watermarked Dataset
3.1 Preliminaries
The Main Pipeline of Existing DOV Methods. Let D {(x; v denotes the original train- ing dataset. In context of image classification task with K-classes, i.e., 3; X [0, 1 represents the image with E y - f1, K} as its label. In the first stage of DOV (i.e., dataset watermarking), the dataset owner will embed watermarks to the original dataset to generate its wa- termarked version (i.e Dw). Particularly. D., = Dm UD, where Dm, represents the watermarked version of samples from a small selected subset D. of D (i.e., D. c D) and Dj contains remaining benign samples (i.e., Dj- = D D.). The Dm is generated by the dataset-specifice image generator G₂ X + X' and the label generator Gy : y - y, i.e., Dm = ((), G, (z)) (ar, y) E D.)- For example, G = (1 m) ④ A + m @ x and G, = Ye in BadNets-based DOV [29, 6). where m E f0. cxx н is the trigger mask, 5 E [0, 1]Cx is the trigger pattern, ① denotes the clement-wise product, and ye the target label. In particular, ? A [Dml is the watermarking rate. In the second phase (i.e., ownership verification), for a suspicious model C X + y that may be trained on Dw., the dataset owners will investigate whether it conducts unauthorized training by querying with verification samples under the black-box setting. In general, the verification process of existing DOV is to directly uses watermarked sample Go (x) as verification samples to examine
[P...
3

---

whether (=)) = Gy(y). In contrast, our goal is to perform the verification process without disclosing the watermark samples Gz (x) during the inference phase of the suspicious classifier C.
Boundary Samples. Let the logit margin of model f : + [0, 1] on the label y is denoted by: (x: w) f [z; w) max fy (az; un). v'=y
(1)
It can be observed that æ can be classified as by f(; w) if and only if o2 (æ; w) 2 0. As such, the set for boundary samples of class y can be denoted by By; w) far w) 03.
3.2 Approach the Closest Boundary Sample
To obtain the boundary samples, we can easily use a gradient- free method (i.e., geometric search) to move each given sample æ forward the decision boundary of ["; w)) under the label y, as follows:
(1 a.) Fy. 8.1. (2); w)) O,
(2)
where a E [0, 1] is a line search parameter and By is sample classified by the model f(: w) as y.
However, the obtained boundary sample of would be varied according to different Ty. As such, we use the closest boundary sample of æ to study the characteristics of watermarked models.
Following the previous work [30], we define the closest boundary sample of æ (i.e., T²) as:
æl1p s.l. by w) O, arg min 2
(3)
where || -lissgse is the Ep norm.
Specifically, exploit the fast adaptive boundary attack (FAB) [31] to calculate the closest boundary sample. In particular, we adapt FAB to implement an iterative algorithm with gradient ascend using V V= w), whose update in (t + 1)-th iteration is as follows:
V
Tee w
E++1 = 30 + (1 - ax) T. + 3
(4)
V
( w
where 8, is positive step size, To is initial point such that By w) I 0 and a₁ [0,1] is chosen to ensure Fz+11 lies in the decision boundary as Eq. (2). In practice, 2n is randomly selected in the validation set whose label is different from y-
In general, using the closest boundary samples generated via Eq. (4) is mostly because they are closely related to the intrinsic property of watermarked DNNs, as shown in the next subsection.
3.3 The Characteristic of Boundary Gradient of Watermarked DNNs
In this section, will show that the gradient of closest boundary samples V v (dubbed 'boundary gradients') of watermarked DNNs closely related to the watermark patterns. Before we present our technical details, we first define cos (xx)) as follows:
x,
V az l (xx)
cos, V=)(:))
(5)
-
122)
Following previous works [32, 9]. we use a model f(: w) watermarked through the standard Bad- Nets backdoor attack (i.e., Gz (x) (1 -1-10 m-) o m O A) [29] as a basic example to shed light on the intriguing characteristic of watermarked DNNs.
Theorem (Property of Boundary Gradient on the Closest Boundary Sample). Assume that G, (Te; w) is twice differentiable with Lipschitz gradient, if [Dml + and by updating T. in Eq. (4) with step size 3r = ||= Zolle t?-1, there exists a constant 2 0 such that lim Ip..l+ba
cos/ (m @ 6. m Vady (x) w.) c (1*)0-1,
(6)
where q E (2, 1), is the target label (i.c., yt = (z)), is the watermark pattern (i.e., 8 e (zo) 2o), and t" is the number of convergence iterations of x" 's update.

---

Pregre
Aue 20 630
(a) Watermark
(b) Grad (Benign)
(c) Grad (Target)
(d) Distribution of cos
Figure 2: (a) shows the watermark pattern for BadNets [29] used in our empirical study. (b) and (c) are examples of boundary gradients calculated under benign and target labels. (d) shows the distribution for the cosine similarity calculated over boundary gradients for benign and target labels. More empirical studies on other types of watermarks are included in the appendix.
In general, since the right side of inequality (6) decreases with the increase t", Theorem indicates that the cosine similarity between the watermark pattern ô and the gradient calculated on T located in the watermark region increases along with its update process. Its proof is in the appendix.
In the following parts, we empirically verify that the distribution of the cosine similarity between watermark patterns and boundary gradients of the closest boundary samples different (i.e., has larger values) from that on their benign versions to further justify our Theorem 1.
Settings. We hereby exploit based dataset watermark [29, 6] with ResNet-18 [33] on the CIFAR-10 [4] dataset as an example for the discussion. Specifically, we watermark sufficient amount of samples to achieve high watermark success rate (i.e., 2 99%). The watermark pattern is a 4 x 4 square filled with random pixels, as shown in Figure 2(a). We randomly select 400 benign samples and use Eq. (4) to generate their closest boundary version for the target label yt (i.c., class 'O'). To reduce the randomness caused by the selection of watermark patterns, we introduce cos as the reference for normalization, as follows:
COS
Σ N
1
cos<(m O 8,, m @ Vedy w)),
and we calculate the normalized cosine similarity score as:
c @ 6, m @ Vadg (x) 2 cos/(m @ 6, m @ Vady, (x=", w)) - cos,
(8)
where 8, is é-th random watermark pattern that is different from the original one (i.e., 8). We gener- ate the gradient V w) of the watermarked model on the target label (dubbed 'Grad (Target)') and benign labels (dubbed 'Grad (Benign)") others than the target one, as shown in Figure 2(b) and Figure 2(c), respectively. We then calculate their normalized cosine similarity scores with 400 sam- ples. Since the values within the boundary gradient are sparse and not evenly distributed, we follow previous work [34] to select the largest 10 values within the m @ Ô and O V (x (x", to calculate their corresponding cosine similarity score. More settings details are in the appendix.
Results. As shown in Figure 2(d), the normalized cosine similarity scores of the target label have significantly larger values compared with those of benign labels. However, their similarity scores still have some overlap (nearly 74% of the target label). It suggests that not all gradients calculated on the closest boundary samples can reflect the watermark pattern It is mostly caused by the deviations introduced by the gradient estimation process under the black-box setting (as in Eq. ))-
Nevertheless, we can still distinguish between watermarked and benign models based on their simi- larity distributions by comparing their maximum instead of random values. Specifically, suppose we define a threshold 7 > 0 as the maximum cosine similarity value for benign labels, and there exists P-cos(-) (-) > r] R 0.26 for the watermark model. If we randomly sample samples to calculate the (closest) boundary gradients and their corresponding normalized cosine similarity, we have:
PP(max(cos: (cos(-)2, cos( (00)))))-0 )2...................... .os ..mm(-m))) S 7) = (P(cos(-) S +"
There will be at least one sample having cos(.) > T with probability of P cos(( < 7 m
As such, if we sample sufficient samples (e.g.. 100), we will have large chance (2 99%) to find least one boundary gradient larger than to successfully identify the watermark models. These phenomena inspire the design of our ZeroMark method, proposed in the next section.
5

---

Vitaruit
Ragiddon UhNN
Bensskry Gualkan
Bandans
Manaaaad Sanianite
Step Reach the Closest Boundary Point
Step II: Ostain Boundary Grudients
Stop III: Boundary Grudient Analysis
Figure 3: The main pipeline of our ZeroMark, which consists of three main steps. first steps, ZeroMark applies Eq. (4) and Eq. (10) to generate the closest boundary samples. In the second step, ZeroMark estimates the boundary gradients for generated boundary samples. the third step, ZeroMark first leverages the ground truth watermark pattern and random watermark patterns to calculate the normalized cosine similarity following Eq. (7) and Eq. (8). After that, ZeroMark uses the distribution of similarity scores to conduct t-test for dataset ownership verification. In particular, in the third stage, patterns (i.c., random and ground truth watermarks) displayed in the gray background are only available to the defender and inaccessible to the suspicious model.
Methodology
In this section, we describe the threat model and the technical details of our ZeroMark method.
Threat Model. Consistent with previous DOV methods 17, 6, 8), assume that dataset owners will watermark the original dataset to generate its watermarked version. The dataset owner has full knowledge of watermark patterns and the validation samples used for ownership verification. In the verification stage, given a suspicious model, they will examine whether it was trained on the protected dataset under the label-only black-box setting, where they can only query the model with verification samples via model APT and get its predicted labels, without accessing its intermediate results (e.g., gradients) and model parameters.
The Main Pipeline of Maro. general, our ZeroMark consists of three main steps, as shown in Figure 3. ZeroMark first generates the (closest) boundary samples of the suspicious model. Then, calculates the boundary gradients of the generated boundary samples. ZeroMark conducts dataset ownership verification via boundary gradient analysis in the third step.
Step 1. Generate Closest Boundary Samples. ZeroMark follows Eq. (4) to optimize the closest boundary samples x: iteratively with gradient decent. In particular, we exploit Monte Carlo method to estimate V (ar;; wr) to address the challenge our considered label-only black-box scenarios, where the gradients for given inputs are inaccessible. The overall process is as follows:
1
Ee Σ Og K u4 w) -pill
Mii w) H.
Tr+11 = 0t 20 + (1-az)) T. + 3r
(10)
where Bg is the step size, 3o is an initial point such that (2o; w) S 0, ar E [0, chosen to ensure Fr+1 lies the decision boundary as Eq. (2), {u,)at ~ N 1) are N random noises i.i.d sampled from the standard Gaussian distribution, and k is fixed positive parameter (i.e., 0.01).
Step Calculate Boundary Gradients. Once the closest boundary sample T' is generated, we can also exploit Monte Carlo method to estimate its gradient (dubbed 'boundary gradient'), " as follows:
N
1
V (F'
OF + K p4; P4-
(11)
Step 3. Boundary Gradient Analysis. After obtaining the boundary gradients, ZeroMark first calculates the cosine similarity based on the available watermark pattern ö and obtains boundary gradients. To further mitigate the variance caused by the watermark patterns, we create several random watermark patterns and follow Eq. (8) to normalize the calculated cosine similarity. After that, motivated by the characteristic described in Section 3.3, where cosine similarity of the boundary gradients the target label yt has significantly larger value compared with that of benign labels, we design a sypothesis-test-guidee method to conduct ownership verification based on the range of cosine similarity for verification, as follows.

---

Vinill
Detortion
Minimal
BautNets
Waleet
Berigg
Blaoded
179
ZecoMari
(Cur)
Figure 4: The example of verification samples across different watermarks (i.e., BadNets, Blended, WaNet, DW) and verification methods (i.e., Vanilla, Minimal, Distortion) on Tiny-ImageNo
Proposition 1. Suppose co 6, m V Vn (x",")) w)) is the posterior normalized cosine similarity between boundary gradients and the available trigger pattern of the suspicious model f(; w) Let variables Po and Pa denote the largest Q% over (cos<(m@o, moV & (3) w) )= and {cos [ @ 8, m & Nndutu (o) w)) w)))>> respectively. Given the null hypothesis Ho P Pa + (H₃ : Pb Pa + where the hyper-parameter model is trained on the protected dataset (with T-certainty) if and only if Ho is rejected.
[0, 1], we claim that the suspicious
In general, we randomly select m (i.e., 500) validation samples evenly distributed across different classes to generate boundary gradients for the watermarked and benign labels. Then, we conduct the pairwise t-test [35] and calculate its p-value. The null hypothesis Ho is rejected if the p-value is smaller than the significance level a. Besides, we also calculate the confidence score AP = Ps - Pa to represent the verification confidence. The larger the AP, the more confident the verification.
5
Experiments
In this section, we conduct experiments on CIFAR-10 [4] and Tiny-mmageNet [36] datasets with ResNet18 and ResNet-34 [33], respectively. More results with other settings our appendix.
5.1 The Performance of Verification Samples Generated by ZeroMark
Settings. We herehy compare our ZeroMark method to two straightforward baseline methods, in- cluding (1) verification with minimal watermark (dubbed 'Minimal') and (2) verification with dis- torted watermark (dubbed 'Distortion'.. These methods intend to protect the information of dataset- specified watermarks by perturbing the original watermarks. We also provide the results of verifi- cation with benign samples (dubbed 'Benign') and verification with original dataset-specified wa- termarked samples (dubbed 'Vanilla') ) for reference. We evaluate each verification method four dataset watermark techniques, including two patch- based watermarks [29, 37] and two input-specific ones [38, 9]. Regarding the implementation of existing watermark techniques, follow their de- fault settings. The example of verification samples across different watermarks and verification methods is shown in Figure 4. Please find more details in the appendix.
Evaluation Metrics. We adopt mean square error (MSE), neuron activation similarity (NAS), and mutual information (MI) to measure the degree which the dataset-specified watermarks are dis- closed during the verification stage. Specifically, the MSE is defined as the mean square error between verification and their corresponding watermarked samples in the region of watermark pat- terns. NAS is calculated as the cosine similarity in the neuron activation map between verification and their corresponding watermarked samples. MI is calculated based on the distribution of verifi- cation and their corresponding watermarked samples. More details are in our appendix.
As shown in Table 1, our approach produces larger cosine similarity scores of the target label than benign labels. We show the results regarding the watermark-disclosed degree for different approaches in Table 2-3. The results show that our approach can reach the most minor watermark-
Results.
7

---

Table 1: The averaged largest Q% cosine similarity of our method on different watermarks.
Dataset->
CIFAR-10
TinyImageNet
Label].
Watermark-+
BadNets
Blended
WaNet
DW
Ave.
BadNets
Blended
WaNet
DW
Ave.
Benign
0.028
0.030
0.022
0.028
0.027
0.026
0.021
0.029
0.027
0.026
Target
0.102
0.368
0.131
0.099
0.174
0.148
0.334
0.131
0.123
0.194
Table 2: The performance on CIFAR-1O. In particular, we mark the best results in bold while the value within the underline denotes the second-best results (except the benign samples).
Metric
(1)
NAS (J)
Watermark-
Method,
BadNets
Blended
WaNet
DW
BadNets
Blended
WaNet
DW
BadNets
Blended
WaNet
DW
Benign
0.354
0.197
0.077
0.309
0.397
0.617
0.609
0.665
13.9
19.7
22.3
28.3
Vanilla
0
0
0
0.830
0.801
0.767
0.824
64.3
56.1
58.2
61.7
Minimal
0.193
6.171
0.121
0.197
0.297
0.769
0.721
0.743
5488
51.5
44.0
Distortion
0.286
0.251
0.087
0.301
0.770
0.774
0,701
0.769
56.6
53.8
35.4
44.5
ZeroMark
(Ours)
0.392
0.202
0.199
0.246
0.646
0.671
0.688
0.689
18.1
24.4
28.6
29.7
Table 3: The performance on Imag- In particular, we mark the best results in bold while the value within the underline denotes the second-best results (except the benign samples).
Metrie+
MSE (t)
NAS (1)
MI (1)
Watermark->
Method]
BadNets
Blended
WaNet
DW
BadNets
Bleaded
WaNet
DW
BadNots
Bleaded
WaNet
DW
Benign
0.396
0.189
0,076
0.298
0.497
0.561
0.589
0.629
27.6
29.8
28.2
31.4
Vanilla
0.808
0.804
68.1
59.0
64.7
Minimal
0.187
0.996
0.037
0.189
0.768
0.782
0.696
0.749
57.5
54.6
49.9
54.7
Distortion
0,263
0.227
0.079
0.227
0.273
0.745
0.738
0.773
614
55.7
39.2
48.3
ZeroMark
(Ours)
0.314
0.204
0.171
0.201
0.662
0.697
0.704
0.698
27.7
33.2
30.5
31.7
Table 4: The verification performance of our method on different watermarks.
Dataset-
CIFAR-10
Tiny Met-eem
W
Metricl, Scenario
Independent
Independent
Malicious
Independent
Independent
BadNets
p-value
AP
0.012
1.00
0.013
1.00
10-15
0.081
11011
1.00
0.012
10-58
0,127
Blended
p-value
AP
0,010
1.00
0.013
1.00
10-17
0.35
0.016
1.00
0.012
1,00
10-61
0,313
WiNett
AP
0.028
0012
0.022
0.011
p-vauue
0.80
1.00
10
0.90
1.00
10
DW
p-value
0.88
1.00
10-11
0.74
1.00
10-19
disclosed degree in almost all cases. The improvement is significant compared to the vanilla DOV methods. These results verify the effectiveness and security of our ZeroMark.
5.2 The Performance of Dataset Ownership Verification via ZeroMark
Settings. We evaluate our ZeroMark for ownership verification under three scenarios, including (1) independent watermark (dubbed 'Independent- W"), (2) independent model (dubbed 'Independent- M'), and (3) unauthorized dataset training (dubbed 'Malicious'). ) In the first case, we used ZeroMark to verify the suspicious model affected with other watermark patterns; the second case, we test the benign model with our ZeroMark; In the last case, we use ZeroMark to verify the watermarked model with corresponding ground truth watermark samples. Notice that only the last case should be regarded as having unauthorized dataset use. More setting detail are described in the appendix.
Evaluation Metries. Following the settings in [7, 6], we use AP [-1, and p-value [0, 1] for the evaluation. For the first two independent cases, small AP and large p-value are expected. In contrast, for the third one, the larger AP and the smaller the p-value, the better the verification.
Results. As shown in Table 4, our method can achieve accurate dataset ownership verification in all cases. Specifically, our approach (i.e., p-value & 0.01 for 'Malicious' case), while not misjudging when there is no unauthorized dataset utilization (i.c., valuue > 0.1 for "Independent-W W' and ''ndependent-M"..
identify the unauthorized dataset usage with high confidence
5.3 Ablation Study
We hereby study the effects of two key syper-parameters. More results in our appendix.
8

---

SadNett
DW
Bengn
Bachetss
Serign
Iny-lmagehot
CIFAR10
Tlny ImagsNet
Coanne Siilerk
0.36
0.12
0.12
0.09
0.09
6.08
0.08
0.08
0.06
0.04
0.04
0.03
10
20
30
20
50
75
150
125
150
100
125
150
neertion 10
Iteration
Verfication Samples
Verfiiatiin Samiles
Figure 5: Effects of iteration size t.
Figure 6: Effects of verification sample size.
CIPAR-10
They Inyy-mmge-le
CFAB-10
Thyyimagelle
S
0.06
0.10
0.08
0.09
0.10
0.00
50 0.10
80
0.08
0.04
0.02
0.03
0.04
0.02
Epochs
Epochs
Prune Rate 1961
Prune Rate (%)
Figure Robustness against fine-tuning,
Figure 8: Robustness against model pruning.
1= 10
1= 20
t= 30
[= 40
Figure 9: The t-SNE results with varied optimization iterations t for the embedding features of benign, watermark, and ZeroMark samples extracted from watermarked DNNs.
Effeets of Optimization Iterations t. We exploit BadNets and DW as the representatives of patch-based and sample-specific watermarks study the effects of & on both CIFAR-10 and Tiny- ImageNet datasets. As shown in Figure 5, the cosine similarity scores increase with the increase of With t 2 30, we can easily distinguish watermarked and benign models.
Effects of the Largest Number of Verification Samples (i.e., m x Q%). As shown in Figure 6, with the number of verification samples used in the t-test increases, the cosine similarity decreases while the benign models' cosine similarity remains stable on both datasets. However, our method still have promising cosine similarity even with many verification samples (e.g., 150).
5.4 The Resistance to Potential Adaptive Methods
We hereby select domain watermark to evaluate the robustness of ZeroMark, as the domain wa- termark itself is sufficiently robust against this defense. Following the previous work [7], we here evaluate the robustness of our ZeroMark under fine-tuning [39] and model pruning [40]. As shown in Figure 7, fine-tuning has minor effects our method. In Figure 8, we can ZeroMark per- forms resilient against model pruning as its efficacy decreases along with the domain watermark. The results of our resistance to other methods are in our appendix.
5.5 A Closer Look to the Effectiveness of our ZeroMark
In this section, we intend to further explore the mechanisms behind the effectiveness of our Zero- Mark. Specifically, we adopt I-SNE [41] to visualize the feature distribution of watermark samples, benign samples, and samples generated by ZeroMark of watermarked DNNs. As shown in Figure 9, with varied optimization iterations for generating (closest) boundary samples, samples generated by ZeroMark can always stay far away from the watermark samples' distribution, which demon- strates ZeroMark can prevent disclosing the watermark information from the watermark samples.
Potential Limitations and Future Directions
ZeroMark can conduct dataset ownership verification without disclosing the watermark pattern. However, as the first work towards a secure verification process of dataset ownership verification (DOV) methods, we have to admit that we still have some potential limitations.

---

Firstly, we must admit that our method requires additional time to conduct ownership verification since it needs to generate some boundary samples and their gradients under the black-box setting. For example, it takes nearly 30 mins for verification on CIFAR-10. 10. While this cost is acceptable in practice to large extent, we will discuss how to accelerate our ZeroMark our future work.
Secondly, ZeroMark currently can only perform effectively for watermark techniques with a pre- defined target label (e.g., BadNets [29], etc. For other watermark techniques, which have no pre- defined target label (i.e., UBW [7]), ZeroMark can not conduct boundary gradient analysis and, therefore, is not feasible solution. Moreover, through extensive experimental evaluation, Zero- Mark is shown to perform more effectively for Blended watermark, compared with other watermark techniques. Such observations inspire us to improve the effectiveness of ZeroMark by designing the potential watermark patterns in blended manner. Finally, the boundary gradient analysis step in ZeroMark may incur variance among different labels' samples. In practice, we can release such variance by training a surrogate model with the protected dataset and calculating cosine similarity between the corresponding boundary gradients and the target watermark pattern with samples from different labels. Then we use the calculated cosine similarity using samples from different labels under the surrogate model to adjust the cosine similarity calculated under the suspicious model. Specifically, we can adjust the cosine similarity calculated with samples from specific label by subtracting it from the average cosine similarity calculated with samples from the same label t under the surrogate model. We will further discuss these issues in our future work.
Thirdly, we can only empirically verify that malicious dataset users cannot recover sppesse-- watermarks based on our boundary samples. We will try to prove it theoretically in the future.
Fourthly, we currently focusing convolutional neural networks (e.g., ResNet and VGG) and the continuous image modality. In general, the success of our approach on other model structures depends on two factors: (1) whether the studied dataset watermarking method (e-g., BadNets) can successfully watermark these models and (2) whether we can conduct effective 'adversarial attacks' to find boundary samples on these models. Based on existing work related to backdoor attacks/dataset watermarking [42, 9] and adversarial attacks [43, 44], these factors are all met. As such, our method can fundamentally generalize to other models (e.g., transformer) as well. As for the generalizability to other (discrete) data formats like tabular or text, the main challenge lies in how to design effective adversarial attacks to them for finding the closest boundary samples (as in (10)) In particular, there are already some relevant works [45, 46] confirming its feasibility. Accordingly, our ZeroMark can be naturally adapted to other discrete data formats (e.g., text and scientific data [47, 48, 49, 50, 51]). We will discuss them in our future work.
7 Conclusion
In this paper, we revisited existing DOV methods and revealed that their underlying assumption regarding the verification phase does not necessarily hold in practice. Accordingly, directly using dataset-specified watermarks for verification is insecure. Motivated by these findings, we proposed ZeroMark to conduct ownership verification without disclosing them. Our method was inspired by empirical and thcoretical findings of the intrinsic property of DNNs trained the watermarked dataset. We conducted experiments on benchmark datasets, verifying the effectiveness of our Zero- Mark and its resistance to potential adaptive methods. We hope work can provide new angle of dataset ownership verification to facilitate more secure and trustworthy dataset sharing.
Acknowledgment
This work was partially supported by NSF IIS 2347592, 2347604, 2348159, 2648169, DBI 2405416, CCF 2348306, and CNS 2347617."
References
[1] Zhifeng Li, Dihong Gong, Yu Qiao, and Dacheng Tao. Common feature discriminant anal- ysis for matching infrared face images to optical face images. IEEE transactions on image processing, 23(6):2436-244 2014.
10

---

[2] Haibo Qiu, Dihong Gong, Zhifeng Li. Wei Liu, and Dacheng Tao. End2end occluded face recognition by masking corrupted features. IEEE Transactions on Pattern Analysis and Ma- chine Intelligence, 44(10))6939-69 0990099999-66,,, 2021.
[3] Samuel Dooley, Rhea Sukthanker, John Dickerson, Colin White, Frank Hutter, and Micah Goldblum. Rethinking bias mitigation: Fairer architectures make for fairer face recognition. In NeurlPS, 2024.
[4] Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009.
[5] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. CVPR, 2009.
[6] Yiming Li, Mingyan Zhu, Xue Yang. Yong Jiang, Tao Wei, and Shu-Tao Xia. Black-box dataset ownership verification via backdoor watermarking. IEEE Transactions Information Forensics and Security, 2023.
[7] Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, and Bo Li. Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection. NeurlPS, 2022.
[8] Ruixiang Tang, Qizhang Feng. Ninghao Liu, Fan Yang. and Xia Hu. Did you train on my dataset? towards public dataset protection with clean-label backdoor watermarking. ACM SIGKDI) Explorations Newsletter, 2023.
[9] Junfeng Guo, Yiming Li, Lixu Wang, Shu-Tao Xia, Heng Huang, Cong Liu, and Bo Li. Do- main watermark: Effective and harmless dataset copyright protection closed at hand. In NeurIPS, 2023.
[10] Cheng Wei, Yang Wang, Kuofeng Gao, Shuo Shao, Yiming Li, Zhibo Wang, and Zhan Qin. Pointnebw: Towards dataset ownership verification for point clouds negative clean-label backdoor watermark. IEEE Transactions Information Forensics and Security, 2024.
[11] Boheng Li, Yanhao Wei, Yankai Fu, Zhenting Wang, Yiming Li, Jie Zhang, Run Wang, and Tianwei Zhang. Towards reliable verification of unauthorized data usage in personalized text- to-image diffusion models. In IEEE S&P, 2025.
[12] Ronald Rivest. The md5 message-digest algorithm. Technical report, 1992.
[13] Dan Bonch and Matt Franklin. Identity-ban based encryption from the weil pairing. CRYPTO, 2001.
[14] Paulo Martins. Leonel Sousa, and Artur Mariano. A survey on fully homomorphic eneryption: An enginecring perspective. ACM Computing Surveys, 2017.
[15] Chiou-Ting Hsu and Ja-Ling Wu. Hidden digital watermarks in images. IEEE Transactions on image processing. 1999.
[16] Ming-Shing Hsieh, Din-Ch Ca-nnCang Tseng, and Yong-Huai Huang. Hiding digital watermarks using multiresolution wavelet transform. IEEE Transactions on industrial electronics, 2001.
[17] Yuanfang Guo, Oscar C Au, Rui Wang, Lu Fang, and Xiaochun Cao. Halftone image wa- termarking by content aware double-sided embedding error diffusion. IEEE Transactions on Image Processing, 2018.
[18] Zuobin Xiong, Zhipeng Cai, Qilong Han, Arwa Alrawais, and Wei Li. Adgan: Protect your location privacy in camera data of auto-driving vehicles. IEEE Transactions Industrial Informatics, 17(9):6200-62) 6210, 2020.
[19] Yiming Li, Peidong Liu, Yong Jiang, and Shu-Tao Xia. Visual privacy protection via mapping distortion. In ICASSP, 2021.
[20] Honghui Xu, Zhipeng Cai, Daniel Takabi, and Wei Li. Audio-visus autoencoding for privacy- preserving video streaming. IEEE Internet of Things Journal, 2021.
11

---

[21] Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In NeurIPS, 2019.
[22] Linghui Zhu, Xinyi Liu, Yiming Li, Xue Yang, Shu-Tao Xia, and Rongxing Lu. A fine- grained differentially private federated learning against leakage from gradients. IEEE Internet of Things Journal, 2021.
[23] Jiawang Bai, Yiming Li, Jiawei Li, Xue Yang, Yong Jiang, and Sau-Tao Xia. Multinomial random forest. Pattern Recognition, 2022.
[24] Ran Bolad-Bachhache Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. Cryptonets: Applying neural networks to enerypted data with high throughput and accuracy. In ICML, 2016.
[25] Jian Liu, Mika Juuti, Yao Lu, and Nadarajah Asokan, Oblivious neural network predictions via minionn transformations. In CCS, 2017.
[26] Deevashwer Rathee, Mayank Rathee, Nishant Kumar, Nishanth Chandran, Divya Gupta, Aseem Rastogi, and Rahul Sharma. Cryptflow2: Practical 2-party secure inference. In CCS, 2020.
[27] Xiaoqiang Sun, Peng Zhang, Joseph K Liu, Jianping Yu, and Weixin Xie. Private machine learning classification based on fully homomorphic encryption. IEEE Transactions Emerg- ing Topics in Computing, 8(2):352-364, 364, 2018.
[28] Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving machine learning. In CCS, 2017.
[29] Tianyu Gu, Kang Liu, Brendan Dolan-Gavin and Siddharth Garg, Badnets: Evaluating back- dooring attacks on deep neural networks. IEEE Access, 2019.
[30] Yuancheng Xu, Yanchao Sun, Micah Goldblum, Tom Goldstein, and Furong Huang. Exploring and exploiting decision boundary dynamics for adversarial robustness. In ICLR, 2023.
[31] Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In ICML, 2020.
[32] Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. SCALE-UP: An efficient black-box input-level backdoor detection via analyzing scaled prediction consis- tency. In ICLR, 2023.
[33] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
[34] Junfeng Guo, Ang Li, and Cong Liu. Aeva: Black-box backdoor detection using adversarial extreme value analysis. In ICLR, 2022.
[35] Leopold Schmetterer. Introduction to mathematical statistics, volume 202. Springer Science Business Media, 2012.
[36] Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 23/N, 2015.
[37] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint / 2017.
[38] Anh Nguyen and Anh Tran. Wanet-imperceptible warping-based backdoor attack. In ICLR, 2021.
[39] Yuntao Liu, Yang Xie, and Ankur Srivastava. Neural trojans. In ICCD, 2017.
[40] Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models. In NeurlPS, 2021.
[41] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne, Journal of machine learning research, 2008
12

---

[42] Zenghui Yuan, Pan Zhou, Kai Zou, and Yu Cheng. You are catching my attention: Are vision transformers bad learners under backdoor attacks? In CVPR, 2023.
[43] Kaleel Mahmood, Rigel Mahmood, and Marten Van Dijk. On the robustness of vision trans- formers to adversarial examples. In ICCV, 2021.
[44] Rulin Shao, Zhouxing Shi, Jinfeng Yi, Pin-Yu Chen, and Cho-Jui Hsieh. On the adversarial robustness of vision transformers. arXiv preprint arXiv:210. 15670, 2021.
[45] Deokjae Lee, Seungyong Moon, Junhyeok Lee, and Hyun Oh Song. Query-efficient and scal- able black-box adversarial attacks on discrete sequential data via bayesian optimization. In ICML, 2022.
[46] Hao Peng, Shixin Guo, Dandan Zhao, Xuhong Zhang, Jianmin Han, Shouling Ji, Xing Yang, and Ming Zhong. Textcheater: A query-efficient textual adversarial attack in the hard-label setting. IEEE Transactions on Dependable and Secure Computing, 2023.
[47] Yihan Wu, Ruibo Chen, Zhengmian Hu, Yanshuo Chen, Junfeng Guo, Hongyang Zhang, and Heng Huang. Distortion-Fi watermarks are not truly distortion-free under watermark key collisions, 2024.
[48] Ruibo Chen, Yihan Wu, Lichang Chen, Guodong Liu, Qi He, Tianyi Xiong, Chenxi Liu, Jun- feng Guo, and Heng Huang. Your vision-language model itself is a strong filter: Towards high-quality instruction tuning with data selection. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors, Findings of the Association for Computational Linguistics ACI. 2024, pages 4156-4172, Bangkok, Thailand and virtual meeting, August 2024. Association for Computa- tional Linguistics.
[49] Yanshuo Chen, Zhengmian Hu, Yihan Wu, Ruibo Chen, Yongrui Jin, Wei Chen, and Heng Huang. Enhancing biosecurity with watermarked protein design. bioRxiv, 2024.
[50] Ruibo Chen, Yihan Wu, Yanshuo Chen, Chenxi Liu, Junfeng Guo, and Heng Huang, A water- mark for order-agnostic language models. 2024.
[51] Hanqing Guo, Xun Chen, Junfeng Guo, Li Xiao, and Qiben Yan. Masterkey: Practical back- door attack against speaker verification systems. In Proceedings of the 29th Annual Interna- tional Conference Mobile Computing and Networking, ACM MobiCom '23, New York, NY, USA, 2023. Association for Computing Machinery.
[52] Jianbo Chen, Michael Jordan, and Martin J Wainwright. Hopskipjumpattack: A query- efficient decision- based attack. JEEE S&P, 2020.
[53] Zijian Wang, Yadan Luo, Ruihong Qiu, Zi Huang, and Mahsa Baktashmotlagh. Learning to diversify for single domain generalization. In ICCV, 2021.
[54] Yiming Li, Mengxi Ya, Yang Bai, Yong Jiang, and Shu-Tao Xia. BackdoorBox: A python toolbox for backdoor learning. In ICLR Workshop, 2023.
[55] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv: 441266980. 2014.
[56] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE S&P, 2019.
[57] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. ICLR, 2014.
13

---

Appendix
Table of Contents
A Proof for Theorem
15
Detailed Settings for Empirical Study Section 3.3
16
C Additional Results for Empirical Study in Section 3.3
18
D The Detailed Process for Mitigating the Variance
18
E Detailed description for Evaluation Metries
18
F The Detailed Algorithm ZeroMark
G Experiments Details
20
G.1 Datasets
20
G.2 Training Configurations
20
H Detailed Configurations for Comparison Approaches
20
Additional Results for Experiments
21
The Resistance to More Adaptive Attacks
21
K Reproducibility Statement
22
L Societal Impacts
22
M Discussions about Adopted Data
23
14

---

A Proof for Theorem 1
model ((; u)) infected with the basic backdoor- watermark (i.e., G2 = (1-m) A + m ()) [29] as a basic example to shed light on the intriguing characteristic of watermark model.
We follow the previous work [32]
Theorem 1 (Property of Boundary Gradient on the Closest Boundary Sample). Assume that ( un) is twice differentiable with a Lipschitz gradient, if [Pml + 00 and by updating Ty in Eq. (4) with step size Br = -1 æoll2 19-1, there exists a constant e 2 0 such that
c. (t") lim 1 - cos V (,",w) 1000
w)) S
(12)
1), We is the target label (i.e., Y/. = C(Ga(x)) is the watermark pattern (i.e., 8 (xo) vo), and t is the number of convergence iterations of x' 's update.
where q E 12
Proof.
Recall in Eq. (4), we update Ty for each t th iteration as:
(2:h)(2;;3)) Ee+1 = at ID + (1 - on) Et + 3r 2 (T);
(13)
Let the step size 3g in Eq. (4) as 1 æoll. we have the distance ratio for updating Eq. (4)
as:
[1+1 Do 12
[|(1 - aa) æe 1oo Vedy( 1/,,, (2,,)
+ +E =xo)l
(14)
[ xo|l²
[ To
With second-orde order tylor expansion, we have:
1
by ( w) = < Ve 0 w), Ti+1 - 3. >
+ - (2/ - xto) -x
He - -x,)= =0
(15)
2
Combining these Eq. (4) and Eq. (15), have:
m (Z, w)) 000 + Tr x の Tri w) +
(16)
1 (- + T V w) 1- + T O
( w))
0.
(17)
2
where we define vn x. To T3 V (2x; and 7, 1
| Po 2ol VV 30
Solving for a, have:
V Vn w)² ( H, + 2T. V Va
a
(18)
2 (Tei w) ) (1 + T H1, U/
Therefore, we can get:
Ti + 31 41
| 11 (m:w)l
(1- <
(19)
Pt + t t (1 L
l|della
| (B::w))
where d, T. Zo and r, = cosL(x, To. V Oy w))
<3; 20 Ve (
1 lall 2 (F,: (Z,:))]
<de, Vady((()))))) [ddllallVoe, (2,,0)))
||dalla Then ky, can be bounded when | 2 C and 2 2. thus we have: Let k = 3 -
| - x²
r2 + Byhi )2, (8++ 23,r. +
(20)
| 2 11
rt Br + ke))
15

---

Motivated by previous work [52], solve Eq. (20) and have:
1 1-11 r? 22
Σ
cit
< 00,
(21)
Tt.
where C1; 02 are two positive constants, thus the above equation is o(t - 1).
When E (2) 1), we have:
- 2 0(19-1).
(22)
Therefore, have:
1 - cosL(d, V ,, (T; c
(23)
Notably, Eq. (4) with step size as t | - by proof for Lemma in [34], when T; optimized stationary point (i.e., T²) in t and if E, belongs to the watermark label Dt, we have:
zo || converges stationary point of Eq. (3). Motivated
lim E [m m & rol = E [d.] m A m ④ ao
(24)
|P t00
m 6,
(25)
and
[[(1 - m) 2 (x
xo)l 0.
lim
(26)
x xoll
mm
Hence, when (D/m 00, we have:
m @ de, m @ (a
m
① 8, m à (=
(27)
m del V c :w)l
|| 6|][mm m (=
therefore, for the watermark label (i.e., y/)
lim 1 1 (m Ve (T', (T,w)) cosL(m 2 de, m O V w))
Dm +000
(28)
B Detailed Settings for Empirical Study in Section 3.3
In the Section. 3.3, select ResNet-18 and CIFAR-IO as the evaluated model and benchmark. We select the class '0' as the watermark class and inject watermark samples with 10% watermark ratio to ensure the verification success rate > 99%. We randomly select 300 samples from the validation set across classes. We use these selected validation samples to generate boundary points for watermark and benign labels labels following Eq. (4). In particular, for the boundary point of watermark label Vt, we set To as samples from classes different from Yı and set I, as samples from the watermark label. As for the boundary point of benign labels, we set æo as samples from the watermark class and set for the watermark or benign label. We then calculate the boundary gradients following the gradient estimation process Eq. (10).
samples from the benign labels. As such there should be 400 boundary gradients
16

---

35
Benign Label
Watermerk Label
25
Count
20-
15-
10-
00.1
0.0
0.2
0.3
0.4
Normalized Cosine Similarity Score
(a) Watermark
(b) Distribution of co)
Figure 10: The results of using blended watermark.
Benign Label
Watermark Label
12-
10
Count
-0.10
-0.05
0.00
0.05
0.10
Normalized Cosine Similarity Score
Watermark
(b) Distribution of cos4(.)
Figure 11: The results of using WaNet watermark.
Benign Label
Watermork Label
10.
Count
Normalized Cosine Similarity Score
a Watermark
Distribution of cos2(.)
Figure 12: The results of using domain watermark.
17

---

Figure 13: t-SNE clustering results for blended watermark.
C Additional Results for Empirical Study in Section 3.3
We also conduct same empirical studies on additional three different types of watermarks (i.e., Blended WaNett [38] and Domain Watermark [9]) to validate the characteristic of boundary gra- dients for watermarked and benign labels. Specifically, we conduct empirical studies with CIFAR- 10 using ResNet-1k 18 and select "O' as the watermark label. We can see that in all these three watermark patterns, the distributions of cosine similarity for watermarked labels have significantly large ranges compared with that of benign labels. Interestingly enough, we find that the distribution of cosine similarity for Blended watermark has more obvious separation with that of benign labels compared with other watermark patterns. We will speculate the reason for this phenomenon in our future work.
D The Detailed Process for Mitigating the Variance
We here describe how to mitigate the variance caused by the watermark patterns and the iterative gradient estimation in details.
Mitigate the Variance Caused by the Watermark Patterns. Based on the available ground truth watermark pattern 8, we create several (i.e., 6) artifact watermark patterns [ which have same location map (i.e.m as the ground truth watermark but filled with different random noise. We calculate the baseline cos as:
cos/(mm C d;, m O Vady (x",
(9)
and we calculate the normalized cosine similarity score as:
c0m @ 8. C V oy Tt' w)) = cos & d, m Ve (x", w)) Cos.
(30)
Mitigatwe the Variance in the Iterative Gradient Estimation Procedure. During the procedure of gradient estimation for Eq. (10), the estimated gradients could yield variance among iterations for the gradient estimation process. Therefore, mitigate such variance, we propose average the estimated gradients over iterations for the gradient estimation process, which can be formulated as:
V 2 (x,,, w))
V Valy (at,, un)
(31)
t=0
E Detailed description for Evaluation Metrics
We here describe the metrics for evaluating each approach in details. With loss of generality, we here define each give watermark sample as:
xy 24 44
(32)
where and 4 represent the benign sample and the corresponding watermark pattern. We suppose t is located at the dims of [ k](j < k). The evaluation metrics, including mean square error (MSE), neuron activation similarity (NAS) and mutual information (MI) are defined as below:
18

---

Sualas
b-40
Figure 14: t-SNE clustering results for the WaNet watermark.
T:40
Figure 15: t-SNE clustering results for the domain watermark.
Algorithm The main process of our ZeroMark.
I: Input: Validation samples fæt, Ut 1m from the watermark label ye; Validation samples { .f him1 1 from the labels other than the watermark label; The suspicious model f(: w)
2: for 1=1,2.... do
3: Generate (closest) boundary points and boundary gradients for the watermark label following Eq. (4):
Set {ar!, V/ 3 By and set {æf. y me 2z.
Generate (closest) boundary points and boundary gradients for the benign label following Eq. (4): Set {æf, ) as Vo and set {æ?, y Jem as Zy. )
5: end for
6: Calculate the corresponding cosine similarities for watermark and benign labels following Eq. (8).
7: Select largest m+0% cosine similarities for watermark and benign labels for T-test following Proposition
MSE: N DM Valli k) xulj k|)2
NAS: = 1/4 EN cos (FsL(F((x))...))) ((x))).
MI:= E Ep(... olo p( 2.0] (z))
Dpt p(z p()]]
where Fe, F-)) represent the verification samples, feature extractor for the corresponding watermark model. z represents the feature extracted by the watermark model. Since ZeroMark uses several perturbed boundary points for calculating the boundary gradient for each given sample, we average their values for computing each metric. Notably, we follow previous work [53] to estimate MI by calculating its upper bound, as follows:
p(2)2) [(z; 2) Ep(x.s) log
S Ep(z.e) [log p(2|=)] - (p)))p(s)(log p()12)).
(33)
p(2)
F The Detailed Algorithm for ZeroMark
We put the detailed algorithm for ZeroMark as follows:
19

---

G Experiments Details
G.1
Datasets
We evaluate approach two widely-adopted benchmark datasets (i.e., CIFAR-10 [4), Tiny- ImgaeNet [36]). We here describe each benchmark dataset in detail.
CIFAR-10. CIFAR-10 dataset contains 10 labels, 50,000 training samples, and 10,000 validation samples. The training and validation samples are distributed evenly across each label. Each sample resized as 32 x 32 by default.
Tiny-ImageNet.
Tiny-ImageNet dataset contains 200 labels, 100,000 training samples, and 10,000 validation samples. The training and validation samples are distributed evenly across each label. Each sample is resized as 64 64 by default.
Evaluated Watermarks. In our experiments, evaluate four types of watermark, including Bad- Nets [29], Blended [37], WaNer [38], and domain watermark [9]. The visual demonstration for each watermark is shown in Sec. For BadNets, we implement and Siny-ImageNer The trigger is filled with random noise. For Blended watermark, we imple- ment 4 and 8 triggers for CIFAR-10 and Tiny-ImageNet, We the transparency ratio as 0.2 throughout experiments. As for WaNet, we use BackdoorBox [54] to build the watermarked model with its default configurations. For Domain Watermark, we implement following its re- leased code?. We set the watermark rate as 0.1 consistent with previous work [7] for training different watermark models.
4 and 8 8 triggers for CIFAR-10
G.2 Training Configurations
To train DNN models, we use Adam optimizer [55] with the initial learning rate as 0.01. The watermark models evaluated in our experiments can achieve 2 92.26% and 56.8% accuracy on validation dataset for CIFAR-10 and Tiny-ImageNet tasks. We use six NVIDIA RTX 2080 GPUs for performing experiments.
H Detailed Configurations for Comparison Approaches
We here describe the comparison approaches in details, as follows.
Existing DOV. We follow DOV approaches [29, 37, 38, 9] to directly exploit the watermark sam- ples for verification.
Minimal Watermark. Inspired by previous work [56] for Trojan detection, which applies reverse engineering to generate the pseudo trigger patterns with minimize size while preserving their attack efficacy. Specifically, generate the minimal watermark for the watermark sample x' following:
min E(f(ms ④6+ ms) x;; w), v1) |msl| ms
(34)
we follow Neural Cleanse [56]'s configurations for conducting optimization on Eq. (34). For input- specific watermark patterns (e.g., WaNet [38], DW [9]), conduct Eq. (34) on each watermark sample. As such verification samples with the minimal watermark can be formulated as:
s' ms 8 (1 ms) 3
(35)
"uetpss//procoednns..eertt nourips hwtps///ppeeeeee/3/33333 aa02r7aashaee.4eee0000aaaaaaaasa -twp::/ttttttttttttttttttooooooo www.aactttooooooenn....oom html
20

---

Benign Label
Watermark Label
10-
Count
-0.05
0.00
0.05
0.10
0.15
Normalized Cosine Similarity Score
Figure 16:
The distribution of consine similarity of boundary gradients for watermark and benign labels under VGG-19.
Watermark with Distortion. Motivated by previous work [32], which reveals that watermark samples can perform resilient against certain magnitude of random noise distortion, we thus pro- pose to add maximum magnitudes of random noise for watermark samples to hinder the watermark pattern while preserving the watermark's efficacy. We generate the noisy watermark samples via:
x' = Proj(x' + a pt),
(36)
where μa NO, 1) is Gaussian noise and Proj is the projection function to constrain x' + a / into J0, 1]. We solve using grid search to find the largest a while preserving the verification success rate for watermark samples.
I Additional Results for Experiments
We here show additional results in our experiments. We perform t-SNE clustering analysis for other three types of watermark (i.e., Blended, WaNet, Domain Watermark) with varied optimization it- erations t. The results are shown in Figure 13, Figure 14 and Figure 15. The additional visual demonstrations for boundary samples within the verification procedure are shown in Figure 17.Fig- ure 18, Figure 19 and Figure 20. We also evaluate ZeroMark with different model architectures. Specifically, we here evaluate ZeroMark using VGG-19 [57] with CIFAR-10 10 task and the configura- tions consistent with Section. 3.3. The results are shown in Figure 16, which demonstrates that ZeroMark can still perform effective on VGG-19 models.
J The Resistance to More Adaptive Attacks
We here investigate whether ZeroMark can perform robustness against the potential adaptive attack for recovering or unlearning the watermark pattern.
Recovering the Watermark Pattern from the Boundary Samples. We here explore the poten- tial adaptive attack for recovering the watermark pattern. Since we leverage gradient estimation via aggregating the random noise for conducting boundary gradient analysis, we here consider an adap- tive attack by aggregating corresponding boundary samples for each input sample zo to recover the watermark pattern. We conduct experiments using ResNet- 18 under CIFAR-10 task and we evaluate the adaptive attack with Domain Watermark [9]. The results are shown in Figure 21 and Figure 22.
21

---

Figure 17: Visual demonstration of ZeroMark for BadNets watermark.
We find that the aggregated boundary samples can not reveal the watermark pattern from both visual and clustering analysis.
Unlearn the Watermark through Boundary Samples. We here consider whether we can fol- low [56] unlearn the watermark pattern via boundary samples. We retrain the suspicious model with 500 boundary samples and label them as their original label (i.e., label for æo) along with the training data. We find that the accuracy of the suspicious model drops from 92.3% to 90.2% and the verification success rate for domain watermark drops from 88.6% to 75.1%, and the ZeroMark can still achieve the averaged largest Q% 0.076 for the target label, which significantly larger than that of the benign labels(i.e.,)) e..00..8.. This results demonstrate that ZeroMark can prevent disclosing watermark patterns during the verification procedure within DOV.
K Reproducibility Statement
In the appendix, we provide detailed descriptions of the datasets, models, training and evaluation settings, and computational facilities. We provide the codes and model checkpoints for reproducing the main experiments of our evaluation in the supplementary material.
L Societal Impacts
In this paper, we focus on the copyright protection of public datasets. Specifically, we reveal that verification process of existing DOV methods is not secured and propose using boundary samples conduct verification without disclosing the watermark. This work has no general ethical issues since our method is purely defensive and does not reveal any new vulnerabilities of DNNs.
22

---

Figure 18: Visual demonstration of ZeroMark for Blended watermark.
M Discussions about Adopted Data
In this paper, all adopted samples are from the open-sourced datasets (i.e., CIFAR-10, Tiny- ImageNet). The -mag-ee dataset may contain a few human-related images. We admit that modified few samples for watermarking and verification. However, our research treats all samples the same and the verification samples and modified samples have offensive content. Accordingly, our work fulfills the requirements of these datasets and has no privacy violation.
23

---

Figure 19: Visual demonstration of ZeroMark for WaNet watermark.
24

---

Figure 20: Visual demonstration of ZeroMark for domain watermark.
Figure 21: The visual demonstration of the aggregated boundary samples.
25

---

1
6
Watermark
(Aggregated) ZeroMark
Figure 22: The t-SNE clustering results for aggregated boundary samples.
26

---

NeurIPS Paper Checklist
The checklist is designed encourage best practices for responsible machine learning research, addressing issues of reproducibility. transparency. research ethics, and societal impact. Do not re- move the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes]. [No] [NA].
[NA] means either that the question is Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justificatiin right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
The reviewers of your paper will be asked to use the checklist as one of the factors in their evalu- ation. While "[Yes] " generally preferable to "[No] is perfectly acceptable answer "[No] provided a proper justification is given (e.g., "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset general, answering "[No] or "[NA] is not grounds for rejection. While the questions are phrased binary way. acknowledge that the true answer is often more nuanced, so please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
used"). In
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS paper checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract and introduction clearly state the claims made, including the contributions made in the paper and scopes.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Ys]]
27

---

We have claimed the limitations of our approach in the Appendix K
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The au- thors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, c.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the ap- proach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-tex system might not be used reliably provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to ad- dress problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification: We have included the assumptions along with our Theorem and included the complete proof in Appendix A
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theo- rems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be comple- mented by formal proofs provided in appendix supplemental material. Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclu- sions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We have described the detailed configurations as well as the methodology in our paper to reproduce the claims and results. Moreover, we have included the code as well the checkpoint for evaluated DNNs for reproducibility purposes.
28

---

Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or the contribution is a specific model and empirical evaluation, it may be necessary either make it possible for others replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of a large language model), relcasing of a model checkpoint, or other means that are appropriate to the research performed.
also be provided via
While NeurlPS does not require releasing code, the conference does require all sub- missions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or a way to re- produce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case au- thors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: this paper, we use publicly available dataset (i.e., CIFAR-10 and Tiny- ImageNet), which can be casily accessed.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: //nips. wwwpcccccc//ppeccccccccoo /tgiieis/guee/////eee Cooee ssi asionPolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
29

---

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We have detailed the training configurations and optimizers in Appendix G
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropri- ate information about the statistical significance of the experiments?
Answer: [Yes]
Justification:
We have reported the distribution of our results in Figure 2 and Appendix B
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK report I-sigma error bars, but should state it. The authors should prefer- ably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors verified.
For asymmetric distributions, the authors should careful not show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We included the details for computer resources in the Appendix G.
Guidelines:
The answer NA means that the paper does not include experiments.
30

---

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (c.g.. preliminary or failed experiments that didn't 't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics /ttpp////aarrr...cc//l/////////
Answer: [Yes]
Justification:
We follow the NeurlPS Code of Ethics https://eeuripsscc/ppbbl EthicsCuidelines
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (c.g., if there is a special consid- eration due to laws regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer:
[Yes]
Justification:
We included the social impact in the Appendix.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact spe- cific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path any negative applications, the authors should point it out, For example, it is legitimate point that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitiga- tion strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have high risk for misuse (c.g., pretrained language models, image generators, scraped datasets)?
Question:
Answer: [NA]
31

---

Justification:
This paper poses such risks,
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by re- quiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators original owners of assets (e-g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [NA]
Justification:
This paper does not use existing assets.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g.. CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should provided.
assets are released, the license, copyright information, and terms of use the pack- age should be provided. For popular datasets, paperswithcode com/ datasets has curated licenses for some datascts. Their licensing guide can help determine the li- cense of dataset.
For existing datasets that re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documenta- provided alongside the assets?
Answer:
[NA]
Justification:
This paper does not release new assets
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details of the dataset/code/mmodll as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsoureing experiments and research with human subjects, does the pa- per include the full text instructions given participants and sereenshots, applicable, as well as details about compensation (if any)?
32

---

Answer: [NA]
Justification:
This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contri- bution of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, cura- tion, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsoureing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equiva- lent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
33


Reviews:
[{"review_id": "Raz0nELniA", "reviewer": "Reviewer_VV25", "summary": "This paper proposes ZeroMark, a novel scheme for dataset watermark verification. It is based on an observation that the boundary gradients (i.e., gradients of samples near the decision boundary of a watermarked model) of the watermark target class tend to have higher cosine similarities with the watermark pattern than the boundary gradients of benign classes. ZeroMark hence proposes to verify the watermark based on the cosine similarities between the boundary gradients and the watermark pattern. In this way the actual watermark pattern is not disclosed to the adversary during verification, thus making watermark verification more practical as it prevents the adversary from exploiting the leaked watermark pattern. Experimental results show that ZeroMark leaks little information about the original watermark pattern, achieves high verification performance and is relatively robust against removal attempts.", "questions": "1. (Applicability to other data formats or model architectures) The evaluation on image datasets is quite comprehensive. However, it would be better if the authors could add a discussion on how ZeroMark extends to other data formats or model architectures. For example, for text data, it might be difficult to construct boundary examples using Eq.10 since texts are discrete.\n2. (Adaptive attack setting) The paper mentions two adaptive attacks in appendix J. However, the appendix lacks some details for the adversary's setup (e.g., steps for recovering the watermark pattern, or hyper-parameters for unlearning the watermark).\n3. (Clarity) The \"largest Q% cosine similarity\" used in the experiment is confusing: does this Q has a specific value in the experiments?\n4. (Clarity) How the cosine similarity is computed seems confusing. In Eq.29 in the appendix, the cosine similarity is computed on the watermark patch, identified by a \"location map $m$\". However, this location map is not mentioned in Eq.8 in the main body.\n5. (Clarity) Fig.4 presents 5 different samples constructed by ZeroMark, but it lacks an explanation on the differences among the 5 samples.", "limitations": "The authors have acknowledged some limitations of ZeroMark in Appendix K, including (1) additional time overhead due to the construction of boundary samples and (2) theoretical guarantee on the security of ZeroMark.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. It addresses an interesting and relatively new problem in dataset watermarking. Protecting the watermark pattern during watermark verification is beneficial since it makes it more difficult for the adversary to infer the watermark pattern and remove the watermark.\n2. It proposes an interesting observation. The observation that the boundary gradients of the target class tend to have higher cosine similarities with the watermark pattern could be potentially beneficial for future research on watermarking or backdooring.\n3. The proposed method could work in conjunction with various existing watermarking techniques.\n4. This work contains rather solid experimental evaluation.", "weaknesses": "1. The proposed method is primarily evaluated on image datasets and convolution networks (ResNet and VGG) and lacks a discussion on the potential applicability to other data formats (e.g., tabular or text) or model architectures (e.g., transformers).\n2. The adaptive attacks discussed in the appendix lack details on experimental settings.\n3. Some parts of the presentation in the manuscript are confusing or unclear.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer VV25, thank you very much for your careful review of our paper and thoughtful comments. We are encouraged by your positive comments on our **novel and interesting research problem**, **interesting observation**, **method flexibility**, and **extensive and solid experiments**. We hope the following responses can help clarify potential misunderstandings and alleviate your concerns.\n\n---\n**Q1**: It would be better to add a discussion on how ZeroMark extends to other data formats or model architectures. \n\n**R1**: Thank you for these insightful comments! We do agree with you that generalizability and flexibility are also important for a method. \n- **Generalizability to Other Model Architectures**. \n    - In general, the success of our approach on other model structures depends on two factors: **(1)** whether the studied dataset watermarking method (e.g., BadNets) can successfully watermark these models and **(2)** whether we can conduct effective 'adversarial attacks' to find boundary samples on these models. Based on existing work related to backdoor attacks/dataset watermarking [1,2] and adversarial attacks [3,4], **these factors are all met**. As such, **our method can fundamentally generalize to other models (e.g., transformer) as well**. \n    - To further alleviate your concern, as you suggested, we hereby also evaluate our ZeroMark on the transformer archietecture. We empirically evaluate the effectiveness of ZeroMark on the TinyImageNet dataset using SwinTransformer with a patch size of 4. Other settings are consistent with our main experiments. **As shown in Table 1 in our uploaded PDF, our method is highly effective with verification efficacy**. \n- **Generalizability to Other (Discrete) Data Formats**. \n    - **We conduct experiments only on image datasets simply following existing works** [2, 5]. Due to the limitation of paper length, it is also difficult for us to provide a comprehensive evaluation on other data types. \n    - However, we do understand your concern. Arguably, the main challenge lies in how to design effective adversarial attacks to discrete data formats for finding the closest boundary samples (as in Eq.(10)). In particular, there are already some relevant works [6, 7] confirming its feasibility. Accordingly, **our ZeroMark can be naturally adapted to other discrete data formats** (e.g., tabular or text). Due to the limitation of time, we cannot provide sufficient experiments to verify it in our rebuttal. We will further discuss it in our future works.\n## Ref\n1. You Are Catching My Attention: Are Vision Transformers Bad Learners under Backdoor Attacks? \n2. Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand. \n3. On the robustness of vision transformers to adversarial examples. \n4. On the Adversarial Robustness of Vision Transformers. \n5. Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection. \n6. TextCheater: A Query-Efficient Textual Adversarial Attack in the Hard-Label Setting. \n7. Query-Efficient and Scalable Black-Box Adversarial Attacks on Discrete Sequential Data via Bayesian Optimization. \n\n---\n**Q2**: Lacks some details for the adversary's setup (e.g., steps for recovering the watermark pattern, or hyper-parameters for unlearning the watermark).\n\n**R2**: Thank you for pointing it out! We are deeply sorry that our submission failed to provide sufficient setting information that we want to clarify here.\n- **Setups for Recovering the Watermark Pattern**. As ZeroMark sends several (e.g., 200) boundary samples attached with random perturbations $\\lbrace\\bar{x}+\\mu_{I}\\rbrace_{i=1}^{n}$ for gradient estimation purposes, the adversary would aggregate the queried boundary samples $\\lbrace\\bar{x}+\\mu_{I}\\rbrace_{i=1}^{n}$ to recover the trigger pattern following $\\frac{1}{n}\\sum_{i=1}^{n} (\\bar{x}+\\mu_{i})$. \n- **Setups for Machine Unlearning**. For a watermarked model $f(\\cdot;\\theta)$, we fine-tune the watermarked model with collected boundary samples $\\lbrace\\bar{x}+\\mu_{I}\\rbrace_{i=1}^{n}$ labeling with its ground truth label $y$. Specifically, we unlearn the watermarked model following: min $E_{\\bar{x}} [\\frac{1}{n}\\sum_{i=1}^{n}\\ell(f(\\bar{x}+\\mu_{i};\\theta),y)]$. We collect 500 pairs of boundary samples for unleanring. The learning rate is set as 0.001 and we fine-tune the model 100 epochs.\n\n---\n**Q3**: Does this Q has a specific value in the experiments?\n\n**R3**: Thank you for pointing it out! We are deeply sorry that our submission failed to provide sufficient setting information, which we want to clarify here. We **set Q as 10** in our experiments (Section 5.1-5.2), i.e., we select the largest 10% cosine similarity out of m (500) cosine similarity to perform a t-test. We have also performed an ablation study to understand the performance with varying Q in Section 5.3 (Figure 6). The results show that **our method can still have a promising cosine similarity with various Qs**.\n\n---\n**Q4** How the cosine similarity is computed seems confusing. \n\n**R4**: We are deeply sorry that our submission may lead you to some misunderstandings that we want to clarify. We compute the cosine similarity on the watermark pattern $\\delta$ and the estimated gradients **located within the watermark pattern's region**. We will clarify and detail this process in our revision. \n\n---\n**Q5** What's the differences among the 5 samples in Fig.4 for ZeroMark.\n\n**R5**: Thank you for pointing it out! We are deeply sorry that our submission failed to provide sufficient information, which we want to clarify here. \n- The five ZeroMark samples in Fig.4 are the **boundary samples with different optimization iterations** for a given sample during the procedure of optimizing Eq.(10). \n- Notably, **ZeroMark uses all these figures to query the suspicious model**, but only the last one is the closet boundary sample. \n\nWe will clarify and explain this with more details in our revision.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "H4oR9Lk4nG", "reviewer": "Reviewer_RHDz", "summary": "This paper explores how to conduct privacy-preserving dataset ownership verification without directly disclosing dataset watermarks. The proposed method is inspired by the characteristic of boundary gradient of watermarked DNNs. Specifically, it has three main steps, including (1) generate the (closest) boundary samples, (2) calculate the boundary gradients of the generated boundary samples, and (3) dataset ownership verification via boundary gradient analysis. The authors conduct experiments on CIFAR-10 and Tiny-ImageNet datasets with four baseline methods.", "questions": "Please see the weaknesses part.", "limitations": "Yes", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.\tDataset copyright protection is of great significance and sufficient interest to NeurIPS audiences. In particular, this paper explores a new angle in dataset ownership verification and studies the verification process for the first time. I think it enlightens this area and can inspire follow-up research. Conduct verification without disclosing the secret key (i.e., watermark) is of practical importance. \n2.\tThe motivation section (Section 3.3) is interesting and insightful. The authors reveal an intriguing phenomenon and also provide its theoretical analysis. I enjoy reading this part.\n3.\tThe proposed method is simple yet effective. It can also be used to improve different types of existing watermarking methods.\n4.\tThe authors have provided their codes. It should be encouraged.\n\nIn general, I think this is a good paper with deep insights and good performance. However, I still have some concerns and questions that could help to improve this paper further, as follows.", "weaknesses": "1.\tThe motivation section is inspiring. However, the authors should provide more explanations about how they came up with this idea and how to further explore it. It is crucial to highlight follow-up research.\n2.\tThe authors should justify the phenomenon in Figure 2 is not exists in benign models. \n3.\tIt would be better to explain more about how Theorem 1 relates to the proposed method.\n4.\tThe authors also used BadNets in the experiments of Section 3.3. It would be better to also show results of other watermarking methods, especially those with non-patch-based watermarks.\n5.\tThe authors introduce a normalization process in the calculation of cosine similarity score. The authors should conduct ablation study to verify its effectiveness.\n6.\tMissing setting details used for the zero-order gradient estimation (i.e., N and \\beta_t).\n7.\tThe authors should also analyze the visual similarities between the optimized verification samples and their benign version, as well as with the ground-truth dataset watermark, w.r.t. to the optimization process.\n8.\tThe authors should also conduct experiments on methods with non-compact watermarks.\n9.\tThe authors should provide more explanations in Section 5.5.\n\nThere are still some typos. For example, ‘method’ should be ‘model’ (Line 16, Page 1).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer RHDz, thank you very much for your careful review of our paper and thoughtful comments. We are encouraged by your positive comments on our **great significance**, **intriguing phenomenon with theoretical analysis**, **novel and interesting method**, **simple and effective method**,, **good presentation**, and **good soundness**. We hope the following responses can help clarify potential misunderstandings and alleviate your concerns.\n\n\n\n---\n**Q1**: More explanations about the motivation of ZeroMark? \n\n**R1**: Thank you for this insightful question! In general, our approach is **motivated by previous works on model fingerprints to some extent, where we can use decision boundary properties to attribute DNNs**. We think the trigger pattern is simply a straightforward method to probe the decision boundary of the suspicious model. \n\n---\n\n**Q2**: The authors should justify the phenomenon in Figure 2 is not exists in benign models.\n\n**R2**: Thank your for this contrusctive suggestion! During the rebuttal period, we plot the distribution for cosine similarity under benign models on the Tiny ImageNet dataset in our loaded PDF (Figure 1). It shows that **this phenomenon does not exist in benign models**.\n\n---\n\n**Q3**: It would be better to explain more about how Theorem 1 relates to the proposed method.\n\n**R3**: Thank you for pointing it out! We are deeply sorry that our submission failed to provide sufficient information, which we want to clarify here. \n- Therom 1 discusses the error for the consine similarity computed over boundary samples and the corresponding watermark pattern during the optmization process of Eq.(4). \n- During the procedure of optimizing Eq.(4), when $t^{*}$ becomes large, **the error for the consine similarity computed over boundary samples and the corresponding watermark pattern gets smaller**. \n- Motivated by that, we **seek the closest boundary samples with a large $t^{*}$ to minimize the error** in our ZeroMark method. \n\nWe will provide more details and discussions in our revision. \n\n\n---\n\n**Q4**: It would be better have evaluation for non-patch-based watermarks.\n\n**R4**: Thank you for this insightful comment! \n- **We have evaluated ZeroMark for non-patch-based watermarks** (e.g., WaNet and Domain Watermark) in our experiments. Due to the space limitation, we put them in our appendix (Section C). \n- In general, **their results are consistent with those of BadNets**, i.e., this phenomenon is universal. We will add more details and discussions in our revision.\n\nWe will provide more details and discussions in our revision.\n\n---\n\n**Q5**: The effect for the normalization process.\n\n**R5**: Thank you for this insightful comment! \n- Following your suggestions, we conduct an ablations study on the TinyImageNet dataset to show the effectiveness of the normalization process. The results are shown in our uploaded PDF (Figure 1). \n- The results show that **it is hard to identify the benign and watermark models' distributions on cosine similarity without normalization**. It verifies the effectiveness of this process. \n\nWe will provide more details and discussions in the appendix of our revision.\n\n---\n\n**Q6**: Missing setting details used for the zero-order gradient estimation (i.e., N and \\beta_t).\n\n**R6**: Thank you for pointing it out! We are deeply sorry that our submission failed to provide sufficient setting information, which we want to clarify here. Fllowing the classical zero-order optimization process, we set $N$ as 200. The $\\beta_{t}$ is calcualted following Theorem 1. We will add more details in our revision.\n\n---\n\n**Q7**: Analysis on the visual similarities between the optimized verification samples and their benign version, as well as with the ground-truth dataset watermark, w.r.t. to the optimization process.\n\n**R7**: Thanks for your constructive suggestions. We evaluate the visual similarities between optimized verification samples and their benign version and their benign version in our uploaded PDF. The results show that the visual similarity between boundary and benign samples increases and then becomes stable during the optimization procedure, indicating the stealthiness and non-disclosure property of our ZeroMark.\n\n---\n\n\n**Q8**: The authors should also conduct experiments on methods with non-compact watermarks.\n\n**R8**: Thank you for this constructive suggestion! We are deeply sorry that our submission may lead you to some potential misunderstandings that we want to clarify here. \n- In our paper, **we have conducted experiments on non-compact wateramarks**, including WaNet and Domain Watermark. Their watermarks are all over the whole watermarked images. \n- As shown in Table 1-4 of our main manuscript, **our method is highly effective on them**. \n\nWe will add more details in our revision.\n\n---\n\n\n**Q9**: The authors should provide more explanations in Section 5.5.\n\n**R9**: Thank you for pointing it out! We are deeply sorry that our submission failed to provide sufficient explanations. \n- As ZeroMark obtained the closest boundary samples by optimizing Eq.(4), we thus evaluate the effectiveness of ZeroMark during the optimization procedure of Eq.(4) with varying steps $t$. \n- As shown in Figure 9, **ZeroMark is consistently separated from watermark samples during the optimization procedure of Eq.(4) with varying steps $t$**. \n- As such, ZeroMark can prevent the disclosure of watermark information from the watermark samples. \n\nWe will add the details in the appendix of our revision.\n\n\n---", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "oOWNift8LC", "reviewer": "Reviewer_RJcM", "summary": "This work presents a method for dataset ownership verification, focusing on confidentiality during the verification phase. The authors highlight that adversaries can remove watermarked data by detecting it during verification. To address this issue, the paper proposes a new verification process based on the cosine similarity between the watermark pattern and the gradient at boundary samples. Building upon their observations and Theorem 1, the authors use the similarity between these two components as evidence of unauthorized dataset use.", "questions": "1) For the confidentiality (or security) of the proposed method, isn't it possible to reconstruct the watermark (BadNet, Blended, and WaNet) using multiple boundary samples? According to Figure 4, the proposed verification requires multiple gradients for these boundary samples. If I were the adversary, I might attempt to reconstruct the watermark pattern using the multiple boundary samples and their corresponding gradients.\n\n2) I expect that the proposed method is affected by data augmentation techniques such as Flip, MixUp, or random noise injection. Additionally, I think the proposed method can be compromised by random dropout. For example, if random flip was applied during training of the suspicious model, the boundary gradient would become less correlated to the watermark pattern because the model would have also seen its mirror pattern.", "limitations": "As I mentioned, the authors doesn't represent the error bars.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This work separates the verification sample from the watermarked samples. By doing so, it is possible to protect the watermarked samples from adversaries.", "weaknesses": "However, I have some concerns as follows:\n\n1) The authors state that \"Theorem 1 indicates that the cosine similarity between the watermark pattern and the gradient increases along with the update process.\" However, I'm not convinced. As I understand it, cosine similarity must be within the range [-1, 1], so the left term in Eq (6) may be within [0, 2]. Then, \nt* represents the number of iterations, and the authors used 10-40 iterations as shown in Figure 5 (always a positive integer). This implies a simple condition where c>0. In this case, I question whether the lengthy proof is necessary. \n\n\n2) Furthermore, Theorem 1 does not imply a proportional relationship between the two terms. It suggests Lipschitz continuity, not a positively increasing relationship. Therefore, I am not convinced about the reliability of the proposed verification method.\n\n\n3) Furthermore, I find this method to be rather impractical. The proposed approach necessitates the predicted logits for generating boundary data and conducting verification. However, full logits are generally not available in commercial services. This requirement appears impractical to me. In contrast, other methods, such as BadNet or Blended, can perform verification using only the one-hot encoded predictions, indicating the Top-1 prediction.  Although they can verify using only Top-1 predictions, all results in this paper rely on the logits. For a fair comparison, I believe the authors should compare their method with others that also use logits for verification.\n\n\n4) I find the experiments (e.g., ResNet/VGG on CIFAR10/TinyImageNet without error bars) insufficiently convincing. In addition, the authors mention, \"We have reported the distribution of our results in Figure 2, and Appendix B\" at the checklist, but they only describe histograms of 400 samples. I don't consider the histograms to be a substitute for error bars because the results are achieved from a single model, which must represent reliability through multiple suspicious/clean models. \n\n\n5) The proposed method primarily uses backdoor attacks with label noise as a baseline. However, there are clean-labeled verification approaches, such as radioactive data [1]. I believe the property of clean labels is highly important in dataset watermarking, but I'm unsure whether the proposed method can work with clean-labeled data.\n\n\n[1] Sablayrolles, A., Douze, M., Schmid, C., & Jégou, H. (2020, November). Radioactive data: tracing through training. In International Conference on Machine Learning (pp. 8326-8335). PMLR.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer RJcM, thank you very much for your careful review of our paper and thoughtful comments. We are encouraged by your positive comments on our **good presentation** and **novel verification process**. We hope the following responses can help clarify potential misunderstandings and alleviate your concerns.\n\n---\n\n**Q1**: I question whether the lengthy proof of Theorem 1 is necessary.\n\n\n**R1**: Thank you for your insightful comment! \n\n- **The right term in Eq (6) decrease instead of increase with the increase of the number of iterations $t^{*}$**. As such, **this inequality is not naturally hold** even if the left size may be within [0, 2] and $c$ could be large.\n- **This potential misunderstanding may due to the format of the right side**, i.e., $c\\cdot (t^*)^{q-1}$ where $q\\in(\\frac{1}{2},1)$. To avoid this misunderstanding, we can rewrite it as: $c \\cdot \\frac{1}{(t^{*})^{b}}$, where $b = 1-q \\in (0,\\frac{1}{2})$. \n- **We have also empirically verified it in Figure 5**. As shown in this Figure, the cosine similarity scores increase with the increase of $t$.\n\n\nWe will add more details and discussions in our revision.\n\n\n---\n\n**Q2**: Theorem 1 suggests Lipschitz continuity, not a positively increasing relationship.\n\n**R2**: Thank you for your insightful comment! \n\n- As we mentioned in R1, we can rewrite the right side of Theorem 1. **The new format can clearly suggest a a positively increasing relationship**.\n- **We have also empirically verified it in Figure 5**. As shown in this Figure, the cosine similarity scores increase with the increase of $t$.\n- Arguably, **the inequality does not have much to do with Lipschitz continuity** since the right size is not about the rate of change of a variable.\n\nWe will add more details and discussions in our revision.\n\n---\n\n**Q3**: Zeromark needs the predicted logits for conducting verification. \n\n**R3**: Thank you for your insightful comment! \n\n- **Our approach does not require logits for generating boundary samples**. The potential misunderstanding may come from Eq.(10). But our gradient estimation and generation processes are consistent with previous black-box adversary attacks under the hard-label setting. \n- In our released zeromark.py, **Line 123-140 (function for obtaining the final predictive label), Line 194-238 (gradient estimation) and Line 253-293 (geometric search for boundary samples)** verify that ZeroMark is implemented requiring only predicted labels for inputs.\n\nWe will add more details in our revision.\n\n---\n\n**Q4**: The authors should provide error bars.\n\n**R4**: Thanks for your constructive suggestion! Following your suggestion, we evaluate our main experiments with four independent models and report the error bars. As shown in Table 2-4 in our uploaded PDF, **the results are sufficiently consistent with a low std**. \n\n---\n\n**Q5**: Whether the proposed method can work with clean-labeled data.\n\n**R5**: Thanks for your insightful comment! We agree with you that  clean label is highly importatnt in dataset watermarking. \n\n\n- **ZeroMark can perform effective with the most recent clean-label watermark** (i.e., Domain Watermark). \n- Following your suggestion, we have tried to combine our method to radioactive data. \n    - However, **it is ineffective and impractical for dataset ownership verification under our considered threat model with a small watermarking rate**. We find the gap for watermark inputs yields nearly the same cross-entropy loss as benign inputs with AUROC as 0.507. \n    - It requires to calculate the cross entropy, needing all logits. \n \n--- \n\n**Q6**: Reconstruct the watermark pattern using the multiple boundary samples and their corresponding gradients.\n\n**R6**: Thanks for this insightful comment! \n\n- In general, **ZeroMark is resillient against watermark reconstruction**. Due to the page limitation, we have conducted and placed this experiment in Appendix J (Figure 21-22).\n- In our experiments, we used domain watermark as an example since it is the most robust and SOTA dataset watermark. To further alleviate your concern, we evaluate ZeroMark also on BadNet, Blended, and WaNet. As shown in Figure 2 in the uploaded PDF, **the adversaries cannot reconstruct the watermark pattern via boundary samples**. \n- Arguably, the reconstruction failure is mostly because\n    - **The boundary samples contain limited information of the trigger patterns**, as shown in Table 2-3.\n    - **Boundary samples generated by ZeroMark can always stay far away from the watermark samples' distribution** (as shown in Figure 9). It demonstrates ZeroMark can prevent disclosing the watermark information from the watermark samples.  \n\n\nWe will provide more discussions in our revision and further explore it in our future works.\n\n---\n\n**Q7**: Effects for the data augmentation techniques (random flip) and dropout during the training phase of suspicious model.\n\n**R7**: Thanks for your construstive suggestions! \n\n-- **ZeroMark is resillient to data augmentation and random dropout during the training phase.** We have already trained all evaluated models with data augmentation tenciques and random dropout. Our results show that ZeroMark performs resillient against the data augmentation techniques.\n-- **Random Flip does not cause \"mirror patterns\" of watermark for suspicious model**. \n - Following your suggestion, we evaluate the suspicious model built with RandomHorizonFlip against inputs attached with the watermark pattern and its mirror pattern for BadNets on CIFAR-10. We find that **the suspicious model can achieve a 99.9% VSR on inputs containing watermark but only a 9.95% VSR on inputs with the mirror one**. \n - It indicates the **random flip will not affect the boundary gradient correlated to the original watermark pattern**. \n - We speculate it mostly because the watermark pattern correlated to the semantic feature of inputs rather than the relative position.\n\nWe will add more details and discussions in the appendix of our revision.\n\n---", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2vTYxSflWP", "reviewer": "Reviewer_s8Mh", "summary": "This paper proposes a new dataset ownership verification method, ZeroMark, which calculates the boundary gradient between the benign and reconstructed images to verify the authorship. Extensive experiments are conducted on two datasets with four backdoor attack methods to evaluate the ZeroMark.", "questions": "In line 27, the authors believe that DOV is the only feasible way to protect the copyright of public datasets currently. However, Unlearnable examples have been studied to prevent unauthorized data exploitation [1]. How do you think about it?\n\n[1] Huang H, Ma X, Erfani S M, et al. Unlearnable Examples: Making Personal Data Unexploitable[C]//International Conference on Learning Representations (2021).", "limitations": "The authors have discussed the limitations.", "rating": 3, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1) This paper proposes a new dataset ownership verification (DOV) method that provides a new angle to protect the copyright of our valuable datasets.\n\n2) The authors revisit existing DOV methods in detail that increase the readability notably.", "weaknesses": "1) In Lines 40~44, the authors mention that the problem contained in existing methods is the leakage of the watermark pattern. This issue is not reasonable since keeping the safety of the watermark is a significant requirement for all watermarking methods. The embedded watermark can also be removed when ZeroMark releases the original watermark pattern. \n\n2) As shown in Fig.2 (d), there is no clear bond between the benign samples and target labels. Distinguishing the distribution to clarify the authorship is may not believable among various images.\n\n3) The novelty of this paper is limited. Using backdoor behaviors [1] or their distributions to protect the dataset shows similar forms.\n\n4) In Eq. (5), is it correct to calculate the cosine similarity between the image x and its gradient?\n\n5) In Fig. (4), the trigger shown in Blended is wrong. Blended injects a Hello Kitty or a pair of sunglasses as the trigger.\n\n6) Why does the smaller MSE denote the better performance? From my view, the MSE indicates the difference between the original watermark and the boundary region. The small value denotes that the boundary region is more like the watermark.\n\n7) Although the authors discussed some limitations in future work, the issues of robustness and efficiency of ZeroMark also hinder the practicability. ZeroMark is a backdoor-based DOV method, the state-of-the-art backdoor defense methods should be included in the experimental section.\n\n[1] Guo J, Li Y, Wang L, et al. Domain watermark: Effective and harmless dataset copyright protection is closed at hand[J]. Advances in Neural Information Processing Systems, 2024, 36.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer s8Mh, thank you very much for your careful review of our paper and thoughtful comments. We are encouraged by your positive comments on our **good soundness and presentation**, **extensive experiments**, and **novelty**. We hope the following responses can help clarify potential misunderstandings and alleviate your concerns.\n\n\n---\n# The Clarification of Our Main Focus\n\nIn this paper, we propose a new DOV method **by introducing a new verification process** without disclosing dataset-specified watermarks **instead of proposing new dataset watermarks** as in previous works. Our method can be incorporated to enhance existing dataset watermarks to support a privacy-preserving verification process.\n\n---\n**Q1**: The embedded watermark can also be removed when ZeroMark releases the original watermark pattern.\n\n**R1**: We are deeply sorry to cause your misunderstanding that we want to clarify.\n\n- As mentioned in the previous clarification, **our ZeroMark is a new verification method instead of a new watermarking method**. As such, **our work is different from all existing DOV works**, whose main focus is proposing new watermarks.\n- **ZeroMark does not release the original watermark pattern**. Our ZeroMark queries the suspicious model with benign images and their boundary versions, instead of directly using watermarked samples.\n-  **ZeroMark prevents information leakage for watermark patterns and resists to watermark reconstruction and unlearning attacks**. \n    - As shown in Tabel 2-3, ZeroMark prevents information leakage of watermark patterns for existing watermark techniques since the verification contains limited information about trigger patterns. As such, it is difficult for adversaries to reconstruct dataset-specified trigger patterns based on boundary samples. \n    - As shown in Section 5.4 and Appendix J, ZeroMark resists to unlearning with boundary samples.\n\n---\n\n**Q2**: As shown in Fig.2 (d), there is no clear bond between the benign samples and target labels. \n\n**R2**: Thank you for this insightful question! **We distinguished between watermarked and benign models** based on their similarity distributions **by comparing their maximum instead of random values**. Specifically, **we selected the largest Q% samples within each distribution**. Please kindly find more detailed explanations in Line180-188.\n\n\n---\n\n**Q3**: The novelty of this paper is limited. Using backdoor behaviors [1] or their distributions to protect the dataset shows similar forms.\n\n**R3**: Thank you for these comments and we do understand your concern.\n\n- As we mentioned in the clarification at the beginning, **we focus on the verification process instead of watermarking process** that is discussed in all previous works.\n- **We explore the non-disclosure requirement of the verification process for the first time**. \n- We empirically and theoretically discover an intrinsic property of watermarked DNNs regarding boundary samples. \n\n---\n\n**Q4**: In Eq. (5), is it correct to calculate the cosine similarity between the image x and its gradient?\n\n**R4**: We are deeply sorry that we may lead you to some misunderstandings that we want to clarify here. **Eq.(5) is used to illustrate the definition of cosine similarity**. We never implements Eq.(5) in our method. \n\n---\n**Q5**: Blended use Hello Kitty or sunglasses as the trigger.\n\n**R5**: Thanks your comments!\n- Arguably, **the main contribution of Blended is the blended strategy for generating stealthy poisoned images instead of the specific trigger patterns** (e.g., Hello Kitty and sunglasses). Our settings simply follow those used in existing works. \n- **Random noise pattern can validate the generalizability of ZeroMark**. It can validate that ZeroMark is effective and generalizable, not specific to a certain watermark pattern.\n- To further alleviate your concerns, we evaluate it with Hello Kitty. As shown in Table 5-6 in the uploaded PDF, **our method is still highly effective under this setting**.\n\n--- \n**Q6**: Why does the smaller MSE denote the better performance? \n\n**R6**: Larger MSE indicates the better performance.\n\n---\n\n**Q7**: ZeroMark is a backdoor-based DOV method, the state-of-the-art backdoor defense methods should be included.\n\n**R7**: Thank you for this insightful comment! \n\n- **Our method can also be incorporated in non-backdoor-based dataset watermarks** (e.g., domain watermark). \n- Even when used in backdoor-based watermarks, **our method naturally escapes most backdoor detection methods** because our query samples (i.e., boundary samples) are benign and do not contain trigger patterns.\n- We have evaluted ZeroMark against two classical backdoor defenses (i.e., fine-tuning and pruning) in Section 5.3.\n- To further alleviate your concerns, we conduct experiments on SCALE-UP, STRIP and ShrinkPad using CIFAR-10 with ResNet-18. **Our method resists to them** with the AUROC (0.52, 0.50, 0.52).\n\n---\n**Q8**: Unlearnable examples can also be used to prevent unauthorized data exploitation.\n\n**R8**: Thanks for bringing this paper to us!\n- **We admit that unlearnable examples can also be used to protect data, although in a different aspect** (availability v.s. tracebility). We will modify this sentence to avoid potential misunderstandings or over-claims.\n- To further alleviate your concern, we **summarize the differences between unlearnable examples and dataset ownership verification**, as follows.\n    - Unlearnable examples aim to make DNNs fail to have a high accuracy trained on the protected data. **It is usually used to protect data published on social media and cannot be used to detect unauthorized dataset users**. \n    - **Unlearnable samples usually need to watermark the whole dataset or at least the majority parts of the victim dataset**, whereas DOV methods only need to modify a few samples.\n    - **Unlearnable samples can only be used to prevent unauthorized dataset usage**, whereas DOV methods can also trace/attribute unauthorized users.\n---", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank all reviewers for their constructive feedback, and we have responded to each reviewer individually. We have also uploaded a Rebuttal PDF that includes:

- **Table 1**: The verification performance of ZeroMark for Tiny-ImageNet with SwinTransformer.
- **Tabel 2**: Verification performance averaged over 4 models. 

- **Tabel 3-4**: Comparison results averaged over 4 models.

- **Figure 1**: Response to RHDz

- **Figure 2**: Results for ZeroMark against watermark construction attack for BadNets, Blended, WaNet.

- **Tabel 5-6**: The performance of ZeroMark on Blended with ’Hello Kitty'.

Meta-review: The paper receives mostly positive comments on the importance of the addressed task and the novelty of the approach. One reviewer (s8Mh) raised several concerns and the authors discuss with the reviewers in multiple rounds by clarifying most of the reviewer's concerns and the reviewer did not follow up the final comments, which are quite important for the final decision. Reading all review comments and authors' follow-ups, the AC recommends to accept the submission. Please revise the manuscript by the all reviewers comments for the camera ready.
Decision: Accept (poster)