Provable Watermarking for Data Poisoning Attacks
Authors: Yifan Zhu
Lijia Yu
Xiao-Shan Gao
Venue: NeurIPS 2025 poster ()
Keywords: data poisoning
provable watermarking
generalization theory
Primary area: theory
TL;DR: We introduce provable and practical watermarking approaches for data poisoning attacks.

Abstract: In recent years, data poisoning attacks have been increasingly designed to appear harmless and even beneficial, often with the intention of verifying dataset ownership or safeguarding private data from unauthorized use. However, these developments have the potential to cause misunderstandings and conflicts, as data poisoning has traditionally been regarded as a security threat to machine learning systems. To address this issue, it is imperative for harmless poisoning generators to claim ownership of their generated datasets, enabling users to identify potential poisoning to prevent misuse. In this paper, we propose the deployment of watermarking schemes as a solution to this challenge. We introduce two provable and practical watermarking approaches for data poisoning: post-poisoning watermarking and poisoning-concurrent watermarking. Our analyses demonstrate that when the watermarking length is $\Theta(\sqrt{d}/\epsilon_w)$ for post-poisoning watermarking, and falls within the range of $\Theta(1/\epsilon_w^2)$ to $O(\sqrt{d}/\epsilon_p)$ for poisoning-concurrent watermarking, the watermarked poisoning dataset provably ensures both watermarking detectability and poisoning utility, certifying the practicality of watermarking under data poisoning attacks. We validate our theoretical findings through experiments on several attacks, models, and datasets.

Provable Watermarking for Data Poisoning Attacks
Yifan Zhu Lijia Yu²*, Xiao-Shan Ga
State Key Laboratory of Mathematical Sciences, Academy of Mathematics and Systems Science, Chinese Academy of Sciences
2 University of Chinese Academy of Sciences Institute of AI for Industries, Nanjing, China cn, 1jyußiaii. cn. xgao@mmrc. iss ac
Abstract
In recent years, data poisoning attacks have been increasingly designed to ap- pear harmless and even beneficial, often with the intention of verifying dataset ownership safeguarding private data from unauthorized developments have the potential to cause misunderstandings and conflicts, as data poisoning has traditionally been regarded security threat machine learning systems. To address this issue, it is imperative for harmless poisoning generators claim ownership of their generated datasets, enabling poisoming to prevent misuse. In this paper, we propose the deployment of water- marking schemes as a solution to this challenge. We introduce two provable and practical watermarking approaches for data poisoning: post-poisone post-poisoning watermark- poisoning-coomcureent ing and poisoning- concurrent watermarking. Our analyses demonstrate that when
However, these
to identify potential
the watermarking length is O @(vd/c..) for post-poisoning watermarking, and falls within the range ( to O ((vd/ep) for poisoning-coneume concurrent watermarking, the watermarked poisoning dataset provably ensures both watermarking detectabil- ity and poisoning utility, certifying the practicality of watermarking under data poisoning attacks. We validate our theoretical findings through experiments on several attacks, models, and datasets.
Introduction
Data poisoning [7, 43, 71] is well-established security concern for modern ML systems. Its significance has become increasingly pronounced in the era of large-scale models, where many models are trained on web-crawl synthetic data without rigorous selection [66, 10, 77]. There are two representative data poisoning attacks, backdoor attacks [13, 75] and availability attacks [37, 22]. Backdoor attacks involve creating poisoned datasets that cause models trained on them to predict the specific targets when particular trigger injected into test instances. Availability attacks aim to compromise model generalization by ensuring that models trained on poisoned datasets have low test accuracy. Deploying models on backdoor and availability attacked datasets poses severe security risks. For instance, in autonomous driving systems, triggered road signs created by backdoor attacks could be misclassified by object detectors, leading to potentially catastrophic accidents [27, 31]. Availability attacks directly undermine model utility, rendering Al-based systems nonfunctional [8].
However, interestingly, things are always two-faced. Modern data poisoning attacks are increasingly being designed to be harmless and purposeful. For example, backdoor attacks have been employed
for black-box dataset ownership verification [50, 51], availability attacks have been utilized to prevent the unauthorized use of data [37, 23]. More recently, methods like NightShade [65] and Glaze [64]
have been developed to protect artists' intellectual property from generative Al models. These
"Corresponding authors
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

advancements illustrate the promising potential of "data poisoning for good," transforming data poisoning attacks-tradite traditionaly viewed as harmful-into tools that can benefit society. Nevertheless. unintended consequences may arise. An innocent, authorized user might inadvertently use poisoned data, leading to potential misunderstandings and conflict.. To mitigate such risks, the poisoning generators must transparently disclose the presence of potential poisoning to their intended users. For example, when an artist distributes his works to a copyright protection system, the system (poisoner) not only aims to prevent unauthorized use but also bears the responsibility of informing clients and authorized users if the data has been perturbed. Such transparency is essential to ensure trust and avoid unintended harm in these beneficial applications of data poisoning.
To address the challenges and ensure the transparency of poisoned datasets, a direct approach is to design detection methods capable of identifying potential poisoning. While many studies have focused on detecting backdoor and availability attacks [11, 19, 18, 98, 89], these detection methods vary significantly across different types of attacks, making it challenging unify as a single, cohesive framework for distribution to authorized users. Additionally, existing detection methods often rely on heuristic training algorithms, lacking a provable mechanism for claiming poisoning. This limitation can lead to disputes if a poisoned dataset is inadvertently misused, as the absence of a clear, verifiable claim undermines accountability. To overcome these challenges, we explore the use of watermarking [9. 1, 41]. a widely adopted approach for copyright protection and the detection of Al-generated content, which presents a promising solution for poisoners to provably declare the existence of poisoning, thereby enhancing transparency and minimizing the risk of disputes.
In this paper, we propose two provable and practical watermarking approaches for data poisoning: post-poisoning watermarking and poisoning-conen concurrent watermarking. The former addresses sce- narios where the poisoning generators require third-part pardtp entity to create watermarks for their poisoned datasets, while the latter focuses on cases where the poisoning generators craft watermarks themselves. In Section 4. we demonstrate that when watermarking is sample-wise for each data, discermment of poisoned data with high probability is achievable if specific key is available when the required watermarking length is ((vd/ ew) and (((/(()) for post- post-poisoning and poisoning- concurrent watermarking respectively (d is the data dimension, ew is the watermarking budget). However, the sample-wise approach necessitates N distinct watermarks and keys for a dataset with N samples, which can be impractical for large datasets. To address this limitation, we consider more meaningful scenario where a single watermark and key apply to all data instances. In Section extend
4.2, recognizing that reliance the sample size N is not ideal for universal watermarking, our analysis to watermarking effective on most samples and then generalizes to the whole distribution with high probability. Specifically, we prove that when the post-poisoning and poisoning-coneuren watermarking lengths are O @(Vd/cw) and @ (r( respectively, the majority of poisoned data can be effectively identified. Moreover, if the sample size satisfies N = ((d). these results can be generalized the entire data distribution.
Beyond demonstrating the effectiveness of watermarking, in Section 5, we further show that the injected watermarks have minimal impact the poisoning. Specifically, for post-poisoning water- marking, when the data dimension d and sample size N are large, the generalization gap between the original poisoned distribution and the watermarked poisoned dataset is bounded by negligible terms. For ppisoning-concurren watermarking, achieving a small generalization gap requires an additional condition: the watermarking length should satisfy O(Vd/cp), where 6p is the poisoning budget.
Our theoretical analyses confirm that the effectiveness of watermarked data poisoning is maintained watermarking, both watermarking and poisoning remain effective when the length is ((vd/e e... For the ing, the effectiveness is certified when the length falls within the range of @(1/2)) to O(Vd/cp). Consequently, if the poisoning generator relies larger length is advantageous. In comparison, if the generator directly embeds the watermark into their poisoned dataset, moderate length is more practical. In Section 6, we evaluate several existing backdoor and availability attacks to empirically validate our theoretical findings.
under specific watermarking lengths. For post-poisonie
concurrent watermark-
third party entity for watermarking, using
2
Related Work
Data Poisoning. Data poisoning attacks modify the training data within a small perturbation budget, aiming to elicit unusual behaviors for models trained on the poisoned dataset. One prominent type of

---

data poisoning is backdoor attacks [13, 27, 79, 80, 95, 52, 62, 75, 55, 91, 88]. These attacks inject specific patterns into the training data, causing the trained model behave anomalously when test instances contain such patterns. Other works [50, 51J have utilized backdoor attacks to achieve dataset ownership verification. Another category availability attack, also referred to as indiscriminate attacks [7, 59, 21, 22, 44, 53, 86]. These attacks aim to degrade the model's i overall test accuracy. Recently, unlearnable examples [37, 23, 32, 70, 12, 67, 92, 97, 83] as the case of imperceptible availability attacks, have been designed to protect data from illegal use by unauthorized trainers. Further data poisoning schemes include targeted attacks [43, 71, 30, 25, 4], which cause models to malfunction some specific data. In this paper, mainly focus imperceptible clean-label backdoor attacks and availability attacks, as they are more practical in real-world scenarios.
Watermarking. Watermarking involves embedding special signals into training data or models to enhance copyright protection and identify data ownership [61, 5, 40, 96, 3, 73, 82). People [50, 51] introduced backdoor attacks as the dataset watermark for data verification, while [29] proposed the domain watermark with harmless verification. Recently, watermarking of large language models has gained significant attention for Al-generated text detection [41, 35, 47, 42, 93, 15]. Watermarking has also been investigated for generative image models [85, 93, 28J. This paper focuses on watermarking for poisoning attacks. We provide two provable, simple, and practical watermarking schemes: post- poisoning and conooinngcconuureett watermarking. To the best of our knowledge, this is the first work to leverage watermarking schemes in the context of data poisoning attacks.
3 Preliminaries
3.1 Data Poisoning
We assume the data always lies in [0, 1] To ensure consistency across different criteria, we focus on imperceptible clean-label data poisoning attacks, which are more practical in real-world applications. Specifically, we denote the attack as a mapping 5" [0, 1] + [-cp. Cpl 1d For each data x, the attack 8 perturbs the data to produce a modified version = x + (1(),, while ensuring [10P(x)) (x))l S 6p to preserve imperceptibility. For simplicity, we denote (x(x)) as og.
risk is defined as (Doi(Dviitim F), where Dvictim represents the victim distribution. The goal of data poisoning is to construct a poisoned distribution D', such that if the risk R(D', F) = EI (F((),,) y) is small, the network F achieves small poisoning objective risk Rroi F). In other words, when has effectively learned the poison features of D', it is expected to exhibit specific properties aligned with the objec- tives of data poisoning. For example, in availability attacks, Dvietim D, the objective risk R (Dvietim FF.))= E(z,))>D (-C((())) y)]. where the goal is to obtain network F with high loss on D. thereby degrading its generalization performance. In backdoor attacks, Dvietim = D @ T, Reoi RPoi(Dvictiag (Dvictim FF+r) = E(Z.g><D [Fx @ T), (arget),) where T is the trigger injected during in- ference, y yagget is the targeted label. The goal of backdoor attacks is to ensure that any data x with trigger T be classified as y target.
Goal. The poisoning objective
3.2 Watermarking
Watermark and key. The goal of watermarking on data poisoning attacks to ensure that verified users are aware of whether the given data has been poisoned. to prevent potential misunderstandings when data creators use data poisoning attacks to achieve specific objectives. e.g., crafting unlearnable examples to deter unauthorized use of data. In this paper, we mainly focus on dataset watermark- ing [51], where watermarks are embedded in datasets for verification. Specifically, similar to the data poisoning attack 6", we denote watermarking as mapping 8" [0, 1ja + [-Ews Ew]", 2 and use 8tr to represent (x) for simplicity, where q < d is the watermarking length, and the watermarking dimension indices are W {d1, d2. , d C [d]. When dataset is watermarked, authorized users are provided with a corresponding key to detect whether the data contains watermarks. In this paper, we assume that the key Ç is d-dimensional vector. The watermarking detector uses simple mechanism, computing the inner product <" x to determine whether x has been watermarked.
Post Post-poisoning watermarking. In this scenario, a third-party entity serves as the watermark gener- ator, crafting watermarks for a given poisoned dataset. The goal is to enable authorized detectors to identify potential poisoned data. Denote the poison and the watermark as 8% and 6 respectively,
3

---

where |
| be S Ep. Both watermark 8 and poison 6f rely on data æ, and the overall perturbation is 6,- 8 gr For simplicity, we denote the perturbation for data 22 as 6; = os..
3o I Cw.
watermarking. In this scenario, the watermark generator also acts as the poison generator, simultaneously erafting both watermarks and poisons. The objective is achieve the goals of data poisoning while ensuring authorized detectors can identify the poisoned data. Since the watermark generator can control the poison dimensions, we assume the generator separates the dimensions used for watermarking and poisoning. Specifically, the dimensions for poisoning are indexed by P [d] W. Other notations remain consistent with those at post- post-poisoning watermarking.
To make notations clearer, we provide a symbol table in Appendix A.
3.3 A Practical Threat Model
Any copyright owner can deploy our watermarking when releasing their original datasets to third party (e.g.. AI training platforms, academic institutions, and copyright certification systems). To make the threat model more concrete, we provide detailed deployment scenario below.
company (called Alice) that collects a large proprietary dataset for autonomous driving research (e.g., dash cam video frames). She wants to open source part of her dataset to promote innovation for the community (e.g., Non-profit research organization), but also wants to prevent unlicensed users from training machine learning model on it successfully to protect her intellectual property. To achieve the above goals, Alice runs our poisoning + watermarking algorithm on every instance of her dataset, publishing the perturbed (i.e., protected) dataset which is unlearnabe by standard models and obtains a secret, key-dependent watermark signal. She publishes this on her GitHub under a permissive license, accompanied by a SHA256 hash so any recipient can verify integrity.
research lab (called Bob) registers on Alice's portal and agrees to a standard agreement for legal use of the dataset. After approval by Alice, Bob receives a secret key (e.g.. a 128 bit seed) provided via Alice's 's portal's secure HTTPS channel. Furthermore, Bob also gains a pipeline (e.g., Python pre-processing package) from Alice such that he can run the watermark detection to verify his identity and ensure that there is no file corruption. After the verification, Bob can run an algorithm designed by Alice (e.g., directly adding inverse unlearnable noise for each data) to remove the unlearnable poisons. If the pipeline receives the wrong key or a tampered file, the detection fails and the poisons cannot be removed to ensure the unlearnability.
For malicious user (called Chad), first, Chad can download the same public poisoned and water- marked dataset, but cannot train a good model on it because the dataset is unlearnable. If Chad tries to remove or tamper with watermarks and unlearnable poisons without knowing the secret key, detection will fail.
For key management, Alice can rotate keys per month and publish on her portal only to approved accounts (i.e., trusted users). Alice can also add a HMAC scheme to prevent potential forgery risks. Specifically, Alice rotate keys per month and publish on her portal only to approved accounts (i.e., trusted users). Alice can also add a HMAC scheme to prevent potential forgery risks, Specifically, we can separate keys into generation key kgen and authentication key kauth, where kyen is completely the same as our paper and correlates with injected watermarks w, for every data x;. For each perturbed di with wi, we can compute an additional tag t. by HMAC under kauth, i.e., t, HMACk..... (id,, 2.). where id; is unique identifier for the image 2; (e.g., index). After that, we store the (id, f,)) pair (e.g., through a sidecar JSON) for later detection. In watermarking detection, beyond traditional detection using kgen and f,, we also verify the tag with f; and t, HMACR. (id,, 2t,) to avoid potential forgery attacks. this case, even if the generation key kigen leaks, an attacker cannot forge new valid (x;, 44) pair as they lack the authentication key kauth. We can keep kauth in secure enclave and rotate independently with kgen to enhance the security.
4 Soundness of Watermarking
In this section, we provide theoretical guarantees for the conditions under which watermarking can effectively differentiate between poisoned and benign data. We begin by examining a specific version where the watermarking is sample-wine wise. In this case, the injected watermark 8 relies on 2, meaning that the watermark generator can assign a unique watermark to each data.

---

4.1 Sample-wise Version
We first analyze the sample-wise version of post-poisoning watermarking, Proofs of theorems in this subsection are provided in Appendix B.1.
Theorem 4.1 wise,,-wise, post-poisoning watermarking). For any data point a sampled from Dx and their corresponding poison be 6%. there exists distribution E\t defined in R such that we can sample the key Ç E satisfyyng that for any w E (0, 1), there are:
(1): P.NDx,CEE
( x < 2 log 1/2
1- wi (2): we can craft the watermark 8 based on Ç such
that Pa-Dxi holds that IP II. (5 (z1 +d) x²²²2) 2w.
n (x 5n) qew - V log 1
1-w w. Hence, when q 1 cw - 2d +.
Remark 4.2. For the sample-wise, post-poisoning watermarking with the data length d and watermark budget e crafting an effective watermark requires the watermarking length be (lVd/ew)
Next, we analyze the scenario of sample-wise version for ppisoning-coneuree
watermarking.
Theorem 4.3 (Sample-wise, poisoning poisoning-coneurren concurrent watermarking). For any x Dxx there exists distribution E E Th& such that we can sample the key Ç ~ E satisfied that for any w E (0, 1):
(1): PENDX,S=E (5T < V log > 1 w; (2): we can craft the watermark 6% and poison 8
such that P PrIDE (" + 8z) > qEw V log _ 1- w. Hence, when q > At. log +
holds that P. Dx 5~= (5 (x1 61) <Tx²) 1 2w.
Remark 4.4. For the sample-wise, poisoning-come coneurret watermarking with the data length d and wa- termark budget cw, crafting an effective watermark requires the watermarking length to be (-) Remark 4.5. The required length for poisoning-concurve watermarking ((1//())) is smaller than that for post-poisoning watermarking ((Vd/e d..).. This difference arises because the condition S d for the watermarking length always holds. Therefore, we have ew N O(1/Vd), which implies Q( ((Vd/cw) 2 ((1/22))
Theorems 4.1 and 4.3 suggest that, with high probability, long the watermark dimension q reaches the required thresholds (I2( (d(vd/c.) cm)) or ((1/22)),, the inner product of key and poisoned data will exceed a constant C1 while the inner product of key and clean data will remain below a constant C2 < C1. As a result, a detector can simply select a threshold = C-C2 to effectively differentiate between poisoned and clean data using the given key. Based these observations, we derive the following corollary:
Corollary 4.6. For sample-wise, post-poisoning watermarking, if the watermarking length q 2 2. c. V 2d 2d log L. with probability at least 2w, for the sampled key Ç E IRd and data 11, 22 sampled from Dx, it is possible to craft the watermark 8% such that <" (5x + 51) & ST < 29 Similarly, for brisoning-concuree
watermarking. if 2 ea. log w' we can craft the watermark 8 such that <T (x1 + 61) > 3 "gww: <T < 4cw.
However, the sample- wise watermarking requires an individual key for each sample, which is impractical in real-world applications. A more ideal case that the watermark detector can use a single key applicable to all samples, making detection more effective and efficient. This motivates the consideration of the universal version of watermarking, where the injected watermark 8 is identical for every x. In this case, scenario, for simplicity, denote 8 8"
4.2 Universal Version
In the universal version, a single detection key is employed, violating the condition of Theorems 4. and 4.3, where the key Ç is sampled from distribution. Consequently, the proof techniques used for the sample-wise case are difficult to generalize to this scenario. Instead, we step away from the distributional guarantees and first analyze the finite-sample case. The theoretical results for the finite case can subsequently be extended to the distributional setting. Proof of theorems in this subsection
5

---

are in Appendix B.2. In the finite case, we assume the dataset consists of N samples, denoted as Sx = {2), Z2. NN We begin by analyzing the case of post-poisoning watermarking.
Proposition 4.7 (Universal, post-poisoning watermarking). For the dataset Sx, when q >
V log 2N we can sample the key IR from a certain distribution such that, with probability at least w. there exists the watermark 8 such that 5" (x + +5) > (" Vi,j [N].
2+ for
We can extend the proof of Proposition 4.7 with a larger q, to achieve a non non-vacuous gap between poisoned and benign data, as stated in the following corollary:
Corollary 4.8. Notations are similar to Proposition 4.7. When q > cu log with probability
2N w
at least w. there exists the watermark 8 such that C (x: + 6,) > new S
qew Ii 1
Vi E [N].
2
Proposition 4.7 demonstrates that the watermarking length is expected to be ((Vdloo log N /Ew) to ensure universal watermarking discerning every data 24, which is not ideal as the watermarking length q depends on sample size N. leading to vacuous results when the dataset becomes sufficiently large. To address this limitation and achieve non-vacuore result, propose relaxing the properties from discerning every sample to discerning most samples, as described in the following theorem.
Theorem 4.9 (Universal, post-poissee post-poosoning watermarking for most examples). For the dataset Sx = {21. ,EN }. Ii and the poison 6 are i.i.d. sampled from Dx and DD respectively. For any w E (0, 1/2) and q > & 2d +. we can sample the key Ç E IRd from a certain distribution such that, with probability least 1 2 exp ( -N(w-e
/822) (N(w-e--Pegbbb
we can craft the watermark 8", such
w+t -4222//8
that (xx + +,,) > 2, x; < gen holds for at least (1 - 2w) samples.
Remark 4.10. Theorem 4.9 suggests that when the sample size N is sufficiently large and the watermark length q 2 2 / /2dlog 1 @(vd/ew): ) the universal watermarking is effective for most samples with high probability. Thus, if we relax the requirement and only demand that the watermarking is effective for most samples, Theorem 4.9 indicates that the required watermarking length no longer depends on N, unlike in Proposition 4.7.
We then analyze the finite universal case for poisoning-coneurrent concurrent watermarking.
Proposition 4.11 (Universal, poisoning-concurce
watermarking). For the dataset Sx, when q > N w it is possible to sample the key Ç E IK from certain distribution such that, with probability at least - w, we can craft watermark 8 and poison 8 such that ÇF(x,, +0,) > (Tx, E
रे. log
Similar to post-poisoning watermarking, we can derive analogous results for poisoning-concuree watermarking about non-vacuous gaps and cases on most examples.
Corollary 4.12. Notations are similar to Prop 4.11. When > ott log N. w. with probability at least
gew Vi [N]. Theorem 4.13 (Universal, ppisoning-concuree watermarking for most examples). For the dataset Sx = {01, {#1.
1-w we can craft watermark 8" and poison 8 such that (T(x;+6,)= 296 (- S0
9 Ø2, ... JNN.. where is i..dd sampled from Dx. For any w E (0,1) and > 22 log 1 we can sample the key Ç E Rd from a certain distribution such that, with probability at least
1 exp wtt-21y219 ( we can craft the watermark and the poison satisfies (x; + 64) >
2 3
(Txx Ix < 2f holds for at least (1-w). N samples.
9 = ((1/Eu). Remark 4.14. Theorem 4.13 indicates that for a sufficiently large N and 2 2. poisoning-coneurrent
the universal, poisoning- concurrent watermarking is effective for most samples with high probability. Compared with Proposition 4. 1, the condition of the watermarking length q Theorem 4.13 is independent of the sample size N.
After establishing results for the finite case for most samples, we can extend these guarantees the entire data distribution, as presented in the following theorem.
Theorem 4.15 (Generalization of universal watermarking to distributional case). For the dataset Sx {#1, #2. N),, data x; and poison o, are i.i.d. sampled from Dx and Dp respectively.

---

Consider universal watermark 8t,, with probability at least 1 1 for the sampled data and poisons, if there exists a key Ç that satisfies {" (z; + 6,) C1. has
Ci.5" S" x, < 22,for at least (1 W samples z4.
2N log
M log
1- V N
+1
d
N
4
Remark 4.16. When the sample size N is greater than QQd). the effectiveness of watermarks in the finite case can, with high probability, be generalized to the distributional case.
Generalizing the universal watermarking from finite cases to distributional cases does not im- pose additional conditions on the watermarking length q. For universal, post-poisoning water- marking, as noted in Remark 4. 4.10, an effective watermark for the distribution Dx exists when = @(Vd/cw), N = 92(d). For universal, poisoning-coneumeeee concurrent watermarking, as noted in Remark 4.14, an effective watermark exists when q = ((1/C,,,, N (d)). Compared with sample-wi - watermarking, achieving effective universal watermarking for data distribution does not require more watermarking length y. The only additional requirement is that the dataset size N is not too small (at least ((d)), which is reasonable condition for generalization in practical scenarios.
5 Soundness of Poisoning under Watermarking
In this section, prove that poisoning remains effective under watermarking for an L-layer feed- forward neural network. For simplicity, we focus on universal watermarking as it is more practical; similar properties also apply to sample-wise watermarking. To facilitate theoretical analyses, we adopt the widely used Xavier normalization [26] for network parameters, which is also employed in Neural Tangent Kernel (NTK) [39] and many other theoretical works [20, 38, 87, 74, 63]. The proofs for this section are provided in Appendix B.3.
Assume the (normalized) L-layer forward neural network is F Rd IR defined as F(x) WL
va, /d.-1 ReL.U(W--1.... ... - ReLU(W Vd. ReLU
where +... +
ReL.U(x) = max(0, æ) the activation function, W E Rd xdi= and b/ Rdd are the weight matrix and the bias term of the (-th layer respectively for E [L]. We consider binary classification task where the data distribution D E [0, 1] x [-1,1}. Here d, = d and d, = 1. We also assume that d1 2 d modern neural networks are typically larger and tend to overparameterized [46, 6, 10, 2]. The loss function used is the cross-entropy loss: ((F(x),
log(1 vv
Definition 5.1 (Optimal Classifier). We define the optimal classifier for a dataset S under the hypothesis space F as F3 = arg min [S] E(EN)es ((F(x), y), where L is the loss function.
Theorem 5.2 (Impact of Watermarking). With probability at least 1 2w for the poisoned dataset {1d, y1) ) = ~ D' and the key Ç E Rd selected from a certain distribution, we can cruft the watermark 8t satisfying:
N
1
R(DDFF5480) Eny
C(F5
N
+0 + log d
(V log 1/w
+0
+ +0 +
q log 1/w +0 ew
N
d
where S" -8" (0 y:) is the watermarked dataset, m Ew) a random vector. Remark 5.3. Since 77 is a random noise under budget ews the optimal classifier Fš. tends to have small loss under perturbation n,, resulting in E,, L(F5. S.Fg.((e (æ; + 1)), yi) being small. Furthermore, if d and N are large enough, four error terms in Theorem 5.2 are all small when the post-poisoning condition in Section 4.2, 9 ((Vd/e,,. d/.,,. holds, resulting in small R(D', F$+55))
To ensure the soundness of watermarked poisoning, we assume that the (un- (un-watermarked) poisoning distribution D' is effective. First, we provide the definition of an effective poisoning distribution.
Assumption 5.4 ((), -fffeceeevvee poisoning distribution). A poisoning distribution D' is called n) effective (for victim distribution Dvietim and poisoning objective risk Rool), if Rol (Dviitiii $ S
holds for network J where R(D', FF) μ.
7

---

Table 1: The clean accuracy (Ace,%), attack success rate (ASR,%) %)), and AUROC of Narcissus and AdvSc backdoor attacks on both post-poisoning watermarking and poisoning-concurrent watermark- ing with different watermarking length q under ResNet- 18 and CIFAR-10.
Length/Method Acc/ASR/AUROC())
Narcissus [91]
AdvSe [88]
Post-Poisoning
Poisoning-Concuree Post-Poisoning
Cossuing-Coonuureet
0(Baseline)
94.69/95.04 004/
94.69/95.044
92.80/95.53/
92.80/95.534 533-
100
01/0.5522
95.12/91. ..00030000 .294
93.34/98.22
92.91/96. 8 1/0,9679
300
033/9991.4//.822
04.61/96.47/0.9777
92.82/96.4480088777
2..05/95.23/0.999
500
94.95/93. /009509
94.70/95.0330
93.18/97.43ND 43/0.22211
92.89/95.799 71..799909996
1000
04.40/92.43/0 99749
94.32/92.03/0 23999999
93.05/94.4 41/0.9809
93.38/84.39/0
018/8443//0.9995
1500
93,90/91 0tt/91.05/099990 05900.999777000
94.67/80, 60001000000000000000000000000000
23.46/00.85009999
93.11/56. 11/1,0000
2000
94.55/90.377 005///0.37/..00 1.0000
94.89/22.46//
110/2/46/1.000000
93.40/79. 990099997009999
92.38/30.05/L.000
2500
94.81/93.300 100000
1077/1.86/1.00
92.78/82. 01/.2//999000000 .0000
(65/12.14/1.000
3000
94.93/90.02/1.000
94.72/ 9,75/1.0000
93.10/74.82/1.00 1,000
93.04/ 9.97/1.0000
To quantify the performance of the poisoning algorithm, measure how well the network F has learned poison features and achieves the poisoning objective by R(D', ,F) Σ l and RPoi(Dvictian F) S À respectively. In practice, an effective poisoning method should generate (X, p)-effective poisoning distribution with small je and X. It is reasonable to assume that p))- effective poisoning distribution D' can be generated by some existing heuristic algorithm. For example, previous works [69, 98] have demonstrated that victim models with low test accuracy (small A) learn poisoning features well (small μ)) under availability attacks. By Theorem 5.2, if N and d are large, R(D', F's F ) is small enough, thus a well-trained network on the watermarked dataset S' + 8" will result in lower RRDDFF), ensuring the soundness of post-poisoning watermarking through the following corollary:
Corollary 5.5 (Post-poisoning watermarking), D' is a (2, -effefeffectivv poisoning distribution for some μ > 0, when N and d are sufficiently large, with high probability, network F trained on post-poisoning watermarking dataset S' - [(2,+ +8", .y:))= holds that (DDiciim FF) S X.
However, when we consider poisoning-concured
watermarking, the dimension of the poisons 8 restricted under P C [d]. In this case, we need to further bound the risk of D' under the restricted poisoned dataset S'Ip = {( + 60 ) which induces the following theorem:
Theorem 5.6 (Impact of Poisoning dimension). With probability at least - w of the (unrestricted) S D', it holds that
poisoned dataset {<x; + of, o.))
log cl N
L
log 1/w
( R(D', F S C(F (T. + +ol2).
In the case of miisoingg-coneurres watermarking, if N is large, and q O (Va/cg). then RDD',, Fs becomes sufficiently small. Thus, well-trained network F on restricted poisoned dataset S'Ip tends to have small risk under the (unrestricted) poisoning distribution D'. Therefore, combined with Theorem 5.2, we can directly obtain the following corollary:
Corollary 5.7. With probability at least 1 3w for the restricted poisoned dataset S'Ip D' and the key Ç E Idd selected from a certain distribution, we can craft the watermark 8 satisfying:
R(D', FF)
SE
E N
L
F
(Et + 6.1p + m).31
+0
L
+0
(V
(V100
log d /Tog
+0
( log 1/w N
+0 +0
pCp vd
cw
/w/
q goo 1/w
N
N
d
where 3 = -SSpp + 8 is the watermarked dataset, (--2((-ess Ew) is a random vector.
After obtaining Corollary 5.7, similar to post-poisoning watermarking, we can ensure the soundness of poisoning-concureen watermarking by the following corollary:
Corollary 5.8 (Poisoning-concurren) watermarking). Df is (>, -)effeecctvvee for some p > O, when
N and d are sufficiently large, q q= O (vd/es). with high probability, the network F is trained on coisoning--oncurren watermarking dataset {a+ + 8 a 8" , y1) N that satisfies Rool (Dvietim FF) S
X.
8

---

Comparison of two types of watermarking, For post- poisoning watermarking, the total perturbation budget will become Eu + Sp- To ensure the detectability. the watermarking length is expected to be @ @(vd/cw) dww). and when ensuring the utility of poisoning, no additional requirement is needed. In comparison, for poisoning-concurren watermarking, the total perturbation budget is max Cp.. which is smaller than the post-poisoning case f + Ey. The watermarking length needed to guarantee the detectability becomes looser, ( but the poisoning utility requires a larger O (vd/cp)
We will verify these results in Section 6.
6 Experiments
6.1 Experimental setup
Baseline methods. We evaluate our approach using two imperceptible clean-label backdoor attacks, Narcissus [91] and AdvSc [88], well as two imperceptible clean-label availability attacks, UB [37]
and AP [22]. We evaluate on CIFAR-10 10, CIFAR- 100 [45], and Tiny-ImageNet dataset [48]. The accuracy and attack success rate are measured various victim models including ResNet-18, ResNet-50 [33], VGG-19 [72], DenseNet121 [36], WRN34-10 [90]. MobileNet v2 [68].
Implementation details. We apply both postspois watermarking and poisoning concurreet watermarking to craft watermarks for each method. The watermarking algorithms are shown in Appendix C. We evaluate watermarking lengths ranging from 0 to 3000, randomly select the water- marking dimensions while fixing the random seed to ensure reproducibility. The watermarking and poisoning budgets set to 16/255 for backdoor attacks, and 8/255 for availability attacks. For victim model training, the total epochs are 200, initial learning rate is 0.5 with a cosine scheduler, the momentum and weight decay are 0.9 and 10 (0-4 respectively.
6.2 Main Results
Tables and present the evaluation results of watermarking on backdoor and availability attacks respectively. The results show that as the watermarking length q increases, the detection performance (quantified by the AUROC score) improves consistently, achieving perfect detection (i.e., AUROC score be 1) when is sufficiently large. This confirms the theoretical findings in Section 4, which state that when g exceeds certain threshold (@(vd/ew) for post-poisoning and (11/e2) for cessooninn-coocurrennn the watermarking provides provable and reliable detectability. Furthermore, poisoning-coneurres watermarking consistently outperforms post- post-poisoning watermarking for the same g, corroborating Remark 4.5, which indicates that ((1/E()) is smaller than Q ((Vd/ew).
We also evaluate the poisoning performance under watermarking, measured by test accuracy and attack success rate (ASR) for backdoor attacks, and test accuracy for availability attacks. The results indicate that, for post post-poisoning watermarking, all four attacks demonstrate strong performance compared baseline methods without watermarking, supporting Theorem 5.2, which asserts that post-poisoning watermarking preserves poisoning when d and N are sufficiently large, regardless of q. For AdvSc, the ASR slightly decreases when q is large. This may be attributed to the reliance of AdvSc on shortcuts in the left-top 1/4 dimension [88], implicitly reducing the effective poison dimension fd and weakening its poisoning effect. Despite this limitation, AdvSc still achieves a respectable ASR of approximately 80%. For poisoning-concume backdoor attacks and the test accuracy drop for availability attacks are more sensitive to watermarking length g. Specifically, for Narcissus and AdvSc,the ASR drops below 30% when reaches 2000. For UE and AP, test accuracy recovers about 90% when q reaches 2500 and 3000 respectively, rendering the poisoning ineffective. These observations align with Theorem 5.6 and Corollaries 5.7 and 5.8, which emphasize that maintaining poisoning effectiveness in poisoning-concurce watermarking requires q to remain below O(Vd/c,). When q exceeds this bound, the watermarking begins to dominate, significantly reducing poisoning efficacy.
watermarking, the ASR for
For experimental results under more datasets and network structures, please refer to Appendix D.
6.3 Ablation Studies

---

Table 2: The clean accuracy (Ace,% and AUROC of UE and AP availability attacks both on post- poisoning watermarking and poisoning-conncureen watermarking with different watermarking length under ResNet-18 and CIFAR-10.
Length/Method Acc( (VAUROC)))
UB [37]
AP [22]
Post- Pot-PPossnnin
Poisoning Concurrent
Post-Poisoning
Poisoning-Connurrent Concurrent
O(Baseline)
10.79/-
10.79/-
8.53/-
8.53/-
100
10.03/0.5844
10.35/0.8197
10. 14/0.668688
10.30/0.6955
300
11.45/0.708
8.70/0.9684
10.08/0.77 7573
11.77/0.7 77332
500
11.71/0.7810
10.02/0.9930
8.71/0.8622
15,84/0,893
1000
11 11,37/0.944 9499
9.42/0.9991
10.58/0. 9774
21.87/0.994
1500
9,94/0.9786
10.10/0.9997
11.02/0.9911
32.46/0.
2000
9.06/0.999 .992
10.03/1.000
10.48/0.999 9887.9987
38. 620000000 00000
2500
10.44/0.9999
88.78/10000
12.68/1.000 1.0000
36.79/1 10000
3000
9.99/1.0000
91.79/1.0000
13.52/1.000
93.40/1.0000
Watermarking budget. We analyze the impact of wa- termarking budget Ew on poisoning poisoning-coneureent watermark- ing for AdvSc attack. The results presented in Figure 1 show that as the budget increases, the detection perfor- mance (AUROC) improves. This observation verifies The- orem 4.9, which states that a larger e allows for smaller q to achieve effective detection. However, the poison- ing performance (ASR) decreases 6w grows, confirm- ing Corollary 5.7. which suggests that larger ew results in higher risk R(D', F),, thereby degrading the poison- ing power. More results are provided in Appendix D.3.
100
90
09
70-
Act:
0.8
ASR
AUROC
0.7
30
2
16
32
Wedemmekingg Budget (/25))
Figure 1: The Acc, ASR and AUROC of AdvSc backdoor attack on different budget 6, for poisoning-concuren watermarking with = 1000.
Position of watermarking dimension. Our theoretical guar- antees indicate that the position of the watermarking dimensions W has no significant impact. By default, we set W to be randomly selected from [d]. To validate this, test fixed watermarking positions on the left-top (L.T), left-bottom (I.B), right-top (RT) and right-bottom (RB) regions of the image. We conduct experiments post- post-poisoning UE watermarking with length of 500. Results shown in Figure demonstrate that the position of watermarking dimensions has minimal impact for both detection and poisoning performance.
In Appendix E, we have further discussed potential de- fense and watermark removal methods, including data augmentations, image regeneration attacks, differential privacy noises, and diffusion purification.
Aoc%%)
100
AUROC
10
80
008
Aco%%)
a.6
AUR
80
0.4
7 Conclusion
022
0.0
In this paper, we propose two provable and practical watermarking methods for data poisoning attacks: post- poisoning watermarking and voisoning-concuree marking. We provide theoretical guarantees for the sound- ness of these watermarking methods, certifying their ef- fectiveness when the watermarking length is ((vd/ew) and (1)/2,) for post-poisoning and sessoning--oncurrees watermarking. Furthermore, we prove the soundness of the poisoning of post-poisoning and poisoning- concurrent watermarking when the length is O(Vd/cp). We validate our theoretical findings through evaluation several data poisoning attacks, including backdoor and availability attacks.
Watemmekkngg Posiioo
water-
Figure 2:
The Ace and AUROC
of UE availability attack on different watermarking position for poisoning- concurrent watermarking with 500.
Limitation and future works. While our watermarking methods offer sufficient conditions for both detection and poisoning utility, the necessary conditions for these properties remain an open area for future research. Moreover, exploring more sophisticated watermarking designs that could achieve better performance and robustness in both detection and poisoning utility is promising direction for further development.
10

---

Acknowledgment
This paper is supported by the Strategic Priority Research Program of CAS Grant XDA0480502. the Robotic Al-Scientist Platform of Chinese Academy of Sciences, NSFC Grants 12288201 and 92270001, and the CAS Project for Young Scientists in Basic Research Grant YSBR-040.
References
[1] Sahar Abdelnabi and Mario Fritz. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In 2021 IEEE Symposium on Security and Privacy (SP), pages 121-140. IEEE, 2021.
[2] Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Iige Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023.
[3] Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into strength: Watermarking deep neural networks by backdooring. In 27th USENIX security symposium (USENIX Security 18), pages 1615-1631, 2018.
[4] Hojjat Aghakhani, Dongyu Meng, Yu-Xiang Wang, Christopher Kruegel, and Giovanni Vigna. Bullseye polytope: A scalable clean-label poisoning attack with improved transferability. In 2021 IEEE European symposium on security and privacy (EuroS&P), pages 159-178. IEEE, 2021.
[5] Ali AI-Haj. Combined dwt-det digital image watermarking. Journal of computer science, 3()):740-746, 2007.
[6] Mikhail Belkin, Daniel Hsu, Siyuan Ma, and Soumik Mandal. Reconciling modern machine- learning practice and the classical bias- variance trade-off. Proceedings of National Academy of Sciences, 116632):15899111
2019.
[7] Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. arXiv preprint arXiv: 6389, 2012.
[8] Battista Biggio and Fabio Roli. Wild patterns: Ten years after the rise of adversarial machine learning. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communica- tions Security, pages 2154 2156, 2018.
[9] Franziska Boenisch. A systematic review on model watermarking for neural networks. Frontiers in big Data, 4:729663, 2021.
[10] Tom B Brown. Language models are few-shot learners. arXiv preprint arXiv:2005. 2020.
[11] Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv: /0/::/8/1.0000 1.03728, 2018.
[12) Sizhe Chen, Geng Yuan, Xinwen Cheng, Yifan Gong, Minghai Qin, Yanzhi Wang, and Xiaolin Huang. Self-ensemble protection: Training checkpoints good data protectors. arXiv preprint arXiv:2211. 12005, 2022.
[13] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05520 2017.
[14] Zhengxue Cheng, Heming Sun, Masaru Takeuchi, and Jiro Katto. Learned image compression with discretized gaussian mixture likelihoods and attention modules. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 1939-79488 2020.
[15] Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. In The Thirty Seventh Annual Conference on Learning Theory, pages 1125-1139, PMLR, 2024.
[16] Terrance DeVries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. arXiv preprint 17Xx:1770..04552. 2017.
11

---

[17] Hadi M Dolatabadi, Sarah Erfani, and Christopher Leckie. The devil's advocate: Shattering the illusion of unexploitable data using diffusion models. arXiv preprint arXiv:2.333.88500 2023.
[18] Yinpeng Dong, Xiao Yang, Zhijie Deng, Tianyu Pang, Zihao Xiao, Hang Su, and Jun Zhu. Black-box detection of backdoor attacks with limited information and data. In Proceedings of the IEEE/CVP International Conference on Computer Vision. pages 16482-16491, 2021.
[19] Min Du, Ruoxi Jia, and Dawn Song. Robust anomaly detection and backdoor attack detection via differential privacy. arXiv preprint arXiv:1911.07116 2019.
[20] Simon Du, Jason Lee, Haochuan Li, Liwei Wang, and Xiyu Zhai. Gradient descent finds global minima of deep neural networks. In International conference on machine learning, pages 1675-1685. PMIR, 2019.
[21] Feng, Qi-Zhi Cai, and Zhi-Hua Zhou. Learning to confuse: generating training time ad- versarial data with auto-encoder. Advances in Neural Information Processing Systems, 32, 2019.
[22] Liam Fowl, Micah Goldblum, Ping-ych Chiang, Jonas Geiping, Wojeiech Czaja, and Tom Goldstein. Adversarial examples make strong poisons. Advances in Neural Information Processing Systems, 34:30339-30351, 2021.
[23] Shaopeng Fu, Fengxiang He, Yang Liu, Li Shen, and Dacheng Tao. Robust unlearnable examples: Protecting data against adversarial learning. arXiv preprint arXiv:2203. 2022.
[24] Leilei Gan, Jiwei Li, Tianwei Zhang, Xiaoya Li, Yuxian Meng, Fei Wu, Yi Yang, shangwei Guo, and Chun Fan. Triggerless backdoor attack for nlp tasks with clean labels. arXiv preprint arXiv:2111.07970, 2021.
[25] Jonas Geiping, Liam Fowl, W Ronny Huang, Wojciech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. Witches' brew: Industrial scale data poisoning via gradient matching. arXiv preprint w0Xiv:2009.02276, 2020.
[26) Xavier Glorot and Yoshua Bengio. Understanding the difficulty of training deep feedfor- ward neural networks. In Proceedings of the thirteenth international conference on artificial intelligence and statistics, pages 299-256. JMLR Workshop and Conference Proceedings, 2010.
[27] Tianyu Gu, Kang Liu, Brendan Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230-47244, 2019.
[28] Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. arXiv preprini trXiv:2410.07369 2024.
[29] Junfeng Guo, Yiming Li, Lixu Wang. Shu-Tao Xia, Heng Huang, Cong Liu, and Bo Li. Domain watermark: Effective and harmless dataset copyright protection closed hand. Advances in Neural Information Processing Systems, 36, 2023.
[30] Junfeng Guo and Cong Liu. Practical poisoning attacks on neural networks. In Computer Vision- ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXVII 16, pages 142-158. Springer, 2020.
[31] Xingshuo Han, Guowen Xu, Yuan Zhou, Xuehuan Yang, Jiwei Li, and Tianwei Zhang. Physical backdoor attacks to lane detection systems in autonomous driving. In Proceedings of the 30th ACM International Conference on Multimedia, pages 2957-2968, 2022.
[32] Hao He, Kaiwen Zha, and Dina Katabi. Indiscriminate poisoning attacks on unsupervised contrastive learning. In The Eleventh International Conference on Learning Representations, 2022.
[33] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[34] Yuepeng Hu, Zhengyuan Jiang, Moyang Guo, and Neil Gong. Stable signature is unstable: removing image watermark from diffusion models. arXiv preprint 4rX0v:200..07145, 2024.
12

---

[35] Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models. arXiv preprint arXiv:2310.1666 2023.
[36] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4700 4708, 2017.
[37] Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearn- able examples: Making personal data unexploitable. In International Conference on Learning Representations, 2020.
[38] Jiaoyang Huang and Horng-Tzer Yau. Dynamics of deep neural networks and neural tangent hierarchy. In International conference on machine learning, pages 4542-4551 PMLR, 2020.
[39] Arthur Jacot, Franck Gabriel, and Clément Hongler. Neural tangent kernel: Convergence and generalization in neural networks. Advances in neural information processing systems, 31, 2018.
[40] Xiangui Kang, Jiwu Huang, and Wenjun Zeng. Efficient general print-scanning resilient data hiding based on uniform log-polar mapping. IEEE Transactions on Information Forensics and Security, 5(1): 2010.
[41] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. watermark for large language models. In International Conference on Machine Learning. pages 17061-17084. PMLR, 2023.
[42] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language models. arXiv preprint arXiv:2306. 04634, 2023.
[43] Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International conference on machine learning, pages 1885-1894. PMLR, 2017.
[44] Pang Wei Koh, Jacob Steinhardt, and Percy Liang. Stronger data poisoning attacks break data sanitization defenses. Machine Learning, pages 1-47, 2022.
[45] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[46] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep con- volutional neural networks. In Advances in Neural Information Processing Systems (NeurIPS), 2012.
[47] Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion- free watermarks for language models. arXiv preprint arXiv:2307. 15593, 2023.
[48] Yann Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 7(7):3, 2015.
[49] Michel Ledoux and Michel Talagrand. Probability in Banach Spaces: isoperimetry and processes. Springer Science & Business Media, 2013.
[50] Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, and Bo Li. Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection. Advances in Neural Information Processing Systems, 35: 13238-13250, 2022.
[51] Yiming Li, Mingyan Zhu, Xue Yang, Yong Jiang, Tao Wei, and Shu-Tao Xia. Black-box dataset ownership verification via backdoor watermarking, IEEE Transactions Information Forensics and Security, 18:2318-2332 2023.
[52] Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack deep neural networks. In Computer Dision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part 16, pages 182-199. Springer, 2020.
[53] Yiwei Lu, Gautam Kamath, and Yaoliang Yu. Indiscriminate data poisoning attacks on neural networks. arXiv preprint S20::220400992 2022.
13

---

[54] Nils Lukas, Abdulrahman Diaa, Lucas Fenaux, and Florian Kerschbaum, Leveraging optimiza- tion for adaptive attacks on image watermarks, arXiv preprint arXiv:2309. 2023.
[55] Nan Luo, Yuanzhang Li, Yajie Wang. Shangbo Wu, Yu-an Tan, and Quanxin Zhang. Enhancing clean label backdoor attack with two-phase specific triggers, arXiv preprint arXiv:2206. 04881, 2022.
[56] Colin McDiarmid et al. On the method of bounded differences. Surveys in combinatorics, 141(1):148-188)) 1989.
[57] Mehryar Mohri. Foundations of machine learning, 2018.
[58] Mehryar Mohri and Andres Munoz Medina. Learning theory and algorithms for revenue optimization in second price auctions with reserve. International conference on machine learning, pages 262-270. PMLR, 2014.
[59] Luis MunozzGonzález, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongras- samee, Emil C Lupu, and Fabio Roli. Towards poisoning of deep learning algorithms with back-gradient optimization. In Proceedings of the 10th ACM workshop on artificial intelligence and security, pages 27-38, 2017.
[60] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.074600 2022.
[61] Nikos Nikolaidis and Ioannis Pitas. Robust image watermarking in the spatial domain. Signal processing, 66(3):385-4))) 1998.
[62] Rui Ning, Jiang Li, Chunsheng Xin, and Hongyi Wu. Invisible poison: A blackbox clean label backdoor attack to deep neural networks. In IEEE INFOCOM 2021-IEEE Conference on Computer Communications, pages 1-10. IEEE, 2021.
[63] Lorenzo Noci, Chuning Li, Mufan Li, Bobby He, Thomas Hofmann, Chris Maddison, and Dan Roy. The shaped transformer: Attention models in the infinite wiith limit. Advances in Neural Information Processing Systems, 36, 2024.
[64] The University of Chicago. Glaze protecting artists from generative ai, 2023.
[65] The University of Chicago. Nightshade: Protecting copyright, 2023.
[66] Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with unified text-to-text transformer. Journal of machine learning research, 21(140):1 67, 2020.
[67] Jie Ren, Han Xu, Yuxuan Wan, Xingjun Ma, Lichao Sun, and Jiliang Tang. Transferable unlearnable examples. In The Eleventh International Conference on Learning Representations, 2022.
[68] Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang -Chich Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4510 4510-4520, 2018
[69] Pedro Sandoval-Segura, Vasu Singla, Liam Fowl, Jonas Geiping, Micah Goldblum, David Jacobs, and Tom Goldstein. Poisons that are learned faster are more effective. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 198-205, 2022.
[70] Pedro Sandoval-Segura, Vasu Singla, Jonas Geiping, Micah Goldblum, Tom Goldstein, and David Jacobs. Autoregressive perturbations for data poisoning. Advances in Neural Information Processing Systems, 35:27374-27386, 2022.
[71] Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Du- mitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks neural networks. Advances in neural information processing systems, 31, 2018.
[72] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv: 2014.
14

---

[73] Rishi Sinhal, Irshad Ahmad Ansari, and Deepak Kumar Jain. Real- sialttmme watermark reconstrue- tion for the identification of source information based on deep neural network. Journal of Real-Time Image Processing, 1766):077722995, 2020.
[74] Justin Sirignano and Konstantinos Spiliopoulos. Asymptotics of reinforcement learning with neural networks. Stochastic Systems, 12(1):2 29, 2022.
[75] Hossein Souri, Liam Fowl, Rama Chellappa, Micah Goldblum, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. Advances in Neural Information Processing Systems, 35:19165- 2022.
[76] Lue Tao, Lei Feng, Jinfeng Yi, Sheng-Jun Huang, and Songcan Chen. Better safe than sorry: Preventing delusive adversaries with adversarial training. Advances in Neural Information Processing Systems, 34:16209-16225, 2021.
[77] Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timo- thée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.1397, 2023.
[78] Linh Duy Tran, Son Minh Nguyen, and Masayuki Arai. Gan-based noise model for denoising real images. In Proceedings of the Asian Conference on Computer Vision, 2020.
[79] Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Clean-label backdoor attacks. 2018.
[80] Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint 19/1::19/..02771, 2019.
[81] Vladimir Vapnik. Statistical learning theory. John Wiley & Sons google schola, 2:831-842,
1998.
[82] Tianhao Wang and Florian Kerschbaum. Riga: Covert and robust white-box watermarking of deep neural networks. In Proceedings of the Web Conference 2021, pages 993-1004, 2021.
[83] Yihan Wang, Yifan Zhu, and Xiao-Shan Gao. Efficient availability attacks against supervised and contrastive learning simultaneously. Advances in Neural Information Processing Systems, 37:72872-72900 2024.
[84] Ming Wen, Yixi Xu, Yunling Zheng, Zhouwang Yang, and Xiao Wang. Sparse deep neural networks using 1,oo-weight normalization. Statistica Sinica, 31(3)1137-11444, 2021.
[85] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. In seirth- Conference on Neural Information Processing Systems, 2023.
[86] Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie-Yan Liu. Availability attacks create shortcuts. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 2367-2376, 2022.
[87] Jiahui Yu and Konstantinos Spiliopoulos. Normalization effects on deep neural networks. arXiv preprint arXiv:2209.010/1, 2022.
[88] Lijia Yu, Shuang Liu, Yibo Miao, Xiao-Shan Gao, and Lijun Zhang. Generalization bound and new algorithm for clean backdoor attack. arXiv preprint arXiv:2406.. 00588, 2024.
[89] Yi Yu, Qichen Zheng, Siyuan Yang, Wenhan Yang. Jun Liu, Shijian Lu, Yap-Peng Tan, Kwok- Yan Lam, and Alex Kot. Unlearnable examples detection via iterative filtering. In International Conference on Artificial Neural Networks, pages 241-256. Springer, 2024.
[90] Sergey Zagoruyko and Nikos Komodakis. arXiv.1605.07146. 2016.
Wide residual networks. arXiv preprint
[91] Yi Zeng, Minzhou Pan, Hoang Anh Just, Lingjuan Lyu, Meikang Qiu, and Ruoxi Jia. Narcissus: practical clean-label backdoor attack with limited information. In Proceedings of the 2023 ACM SIGSAC Conference Computer and Communications Security, pages 771-785, 2023.
15

---

[92] Jiaming Zhang, Xingjun Ma, Qi Yi, Jitao Sang, Yu-Gang Jiang, Yaowei Wang, and Changsheng Xu. Unlearnable clusters: Towards label-agnostic unlearnable examples. Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 3984-3993, 2023.
[93] Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306. 17439, 2023.
[94] Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks provably removable using generative ai. arXiv preprint arXiv:2306.01955 2023.
[95] Haoti Zhong, Cong Liao, Anna Cinzia Squicciarini, Sencun Zhu, and David Miller. Backdoor embedding convolutional neural network models via invisible perturbation. Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy, pages 97-108, 2020.
[96] J 7hu. Hidden: hiding data with deep networks. arXiv preprint arXiv: 1070v 2018.
[97] Yifan Zhu, Yibo Miao, Yinpeng Dong, and Xiao-Shan Gao. Toward availability attacks in 3d point clouds. arXiv preprint w 2024.
[98] Yifan Zhu, Lijia Yu, and Xiao-Shan Gao. Detection and defense of unlearnable examples. In Proceedings of the AAAI Conference Artificial Intelligence, volume 38, pages 2024.
16

---

NeurIPS Paper Checklist
Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
Our paper supports the claims made in the abstract and introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We have discussed limitations in Section 7.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
17

---

We have provided the full set of assumptions in every theorem and made complete proof in Appendix B.
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We have provided reproductive details in Section 6.1 and given detailed codes in the supplemental material.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
18

---

reproducible, they Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
We have provided our codes in the supplemental material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: /nips. wwtppcccccgcceeecccccccccc wwwcc//gu//////eee SrodeSubmissionPooo
for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We have provided experimental details in Section 6.1.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: Our theoretical findings can be validated well by the trend of Accuracy, Attack Success Rate and AUROC under different watermarking length, even without error bars. Due to insufficiency of computational resource (We conduct all our experiments in a single NVIDIA A800 80GB PCIe GPU), it is expensive reproduce all these data poisoning attacks. Therefore, we do not report error bars.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
19

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CL, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We have provided them in Appendix D.5.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics attps://neurri: ittpp//cccrpppc.pppiiiiccccc///c httpei/icechccccccdeeeeeeeeeeee
Answer: [Yes]
Justification: ur paper conforms with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No. they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We have discussed them in Appendix H.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
20

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our paper poses such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We use open-source dataset and models in paper, and have cited the original paper of these dataset and models.
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
21

---

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Our new assets are well documented in the supplemental material.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: Our paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
22

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy btttp:://eeurps... for what should or should not be described.
23

---

Appendix
A Symbol Table
Notation d
Description
The dimension of data The dimension of watermarking The number of samples in dataset The indices of poisoning dimension The indices of watermarking dimension The perturbation budget of a poisoning attack The perturbation budget of watermark
q
N
P
W
cp
Ew
8
A data poisoning attack
8"
A watermark
8
A sample-wise perturbation on data x
key
A key distribution
clean dataset
S'
A perturbed dataset clean data distribution A data distribution under some perturbations
D
D
L
The layer of neural network
C
A loss function
F
A model (neural network)
R
A generalization risk
Rooi
A poisoning objective risk
w
A probability
B Proofs
B.1 Proofs of Theorems in Section 4.1
Lemma B.1 (McDiarmid's Inequality [56]). Let X1,X2, ",,,..,, Nn. be independent random variables
on X2, Xn and f Xi Xr ... Xn R be multivariate function. If there exist
positive constants C1, C22 ** Cao such that for all (01, "", E X1 x X2 x ... x Xn and i [n], it has
sup I/ ($1,"" ... Iz:-, 1441, xnn) - (x1, ... Ii T4, Ti+1 ... xnn) S cz.
ZEE,,
then for any
> 0, the following inequalities hold
2+2
P Pf X2, ... Xx,) E[f(X1, X2, X,)] 2 c) - --
P( X2,... , T [X
xx)) < -)) S 21-1%
Definition B.2 (Random identical key). The random identical key means that for each entry, the probability of its value being or 1 is 1/2, ='(( -11 for all entries i of key Ç. Theorem B.3 (Theorem 4.1, restated). For any data point x sampled from Dx and their correspond- ing poison be &G, there exists distribution E defined in Rd such that we can sample the key ( ~ E satisfied that for any (0, there are:
TTx x < / /21g 1
(1): PENDAISE
> >1- (2): we can craft the watermark 8 based on Ç such
that P PanDx CT (x + 5,) > qcu
//1os 1
1 - w. Hence, when 1 cw
2d J. it
holds that IP
R. Dx S~E (S (z1 + 61) (=xz) 2w.
Proof of Theorem 4.1, (1): Denote the distribution E the distribution of a random identical key,
i.e., = = 11-11111,, +1]d has
Ec x] 0
24

---

for all x E D. Furthermore, as x lies in [0, 1], it always holds that
15tx" - -'='l < | =
for all i, and 2, D. Therefore, by McDiarmid's inequality, for any a > 0, it has
P2 Prls" " x 2 al S e
= =1,
which concludes that
Pa F2,515 x 2 al 2
Therefore, let = e 2n has a a= V 2 log +. which validates (1).
(2): For any key C, we craft the watermark 0 (Ew ( We can conclude that
1< + 6z)] Rc(s" x] + TEcls 82)
Because x and 6% are independent from it holds that
B= xt] IErls ogl = 0.
Therefore, we have
EeIs" (z + [z)] = 1E 1 gew
Similar to (I), by McDiarmid's ' inequality, for any 8 > 0, it has
20
F.. Fe.c15" 15 (x + 5z) qew S 3 S e
24 it has B == v log t. which induces that
Therefore, let = e-
PINDES (Tx (z) > qcu / log
> w.
When q tu 2d log 1. it holds that
d log
d
<
qc
V2 log
2
Hence by the union bound, it has
P P Dax (5 + +(1) [=x2]] = P
DDx [x + 51) S 5²=xxa
(T + 51) S gEw V d
d
1 - Pa, Par
log
5 2 V
log
1 2us.
Theorem B.4 (Theorem 4.3, restated), For any x ~ Dx, there exists a distribution 3 E Rdd such that we can sample the key Ç E satisfied that for any w E (0, 1):
(1): PONDX (5 x V log _ > 1 w: (2): we can craft the watermark 8% and poison 8g
such that IP PRDDE ( + 5z) > qp - / log _ > 1 - w. Hence, when q > log 1
w.
holds that P. R. (TT (z1 + 61) <Tx2) > 1 - 2w.
Proof of Theorem 4.3. For poisoning-concurres watermarking, denote the poisoning dimension be P and the watermarking dimension be W, where [d] = P UUW and [W]
We sample the key Ç E Rd from a certain distribution E, such that Ç² U1( (1(-1, +1,,, E W and 5² 0, P.
25

---

Therefore, by McDiarmid's inequality, for any a > O, it has
Pa x 2 a] Se 2u
Let = e 2a² has = V log 1 which validates condition (1).
We craft the watermark 8% as (cw (t) Similar the proof of Theorem 4.1, we can conclude that
EcIs" (x + 6z)] E5 6"" gew-
222 Let has V log L. which induces that
PRNDX (- dz) > gew V log
When -/2 log 3. holds that
q log V 2
1
9
1
gew - -V
log
w
w
Hence by union bound, it has
P PRID (x)
[0] +61 > <T x2
2 1 2w.
B.2 Proofs of Theorems in Section 4.2
Theorem B.5 (Proposition 4.7, restated). For the dataset Sx, when 9 > 2+
2 log we can
cw
sample the key Rdd from a certain distribution such that, with a probability of least 1 w, there exists the watermark 8 such that Ç" (zxz + 65) > S" xs, Vi,j E [N].
Proof of Proposition 4.7. For the random identical key ( E Rd, and xi E [0, 1jd it holds that
K<' <<]
for every 5; + Ni.
By McDiarmid's inequality, for any a > 0. it has
Pc |s TTxx x; 2 ar 2g²
Furthermore, as ||o S 6p. has
- 16
for every 8 * 8P.
By McDiarmid's inequality, for any 3 it has
20a
Pc 1 R 8 2 $
a
By the union bound, holds that
N Σ
P [ 2 at]
p
[|
NNe
2
s=1
N
20a
PP P
8 2 B)
Σ
P
[
x
2
NN
"5.
i=1
26

---

We now craft the watermark 8 such that
8th = c Slw-
It has
558 = gew
Therefore, let 3 = Cpa, holds that [nmait (xi+ + 8*) gew + tp)aa)
IP i ( +8") gev - (1+
= P
-1
2 PP [ 15 ( -
2 P [ 2 - (l 2 rpa
2 - - 2Ne 2
Therefore, when
gew - (1+ > a,
has
5² (z, + 0j) > 5 ks, Vi,j E [N]
happens with probability at least 1 2Ne 2ي²
Let 2Ne 2n the condition will
+ cp
d
2N
q
log
Fw
2
,.N ,NN], 34 and the poison Theorem B.6 (Theorem 4.9, restated). For the dataset Sx 12,
8) are i...d. sampled Dxx and Dp respectively. For any w E (0, 1/2) and q > we can sample the key Ç E Rd from certain distribution such that, with probability least
2 ew 2d wt
1 -eexp
it is possible to craft the watermark 8 such that C" 5.) >
w+6-9"22/16
gew TTI,
4 holds for at least [ samples.
Proof of Theorem 4.9. Denote the failure cases of Proposition 4.7 be
Pi(a) = I[C x, 2 a), = 11 of 2 p
and
F(a) = F(aa,, F(a)) Σ F((a)
Due to the i.i.d property of x; and S.. F((a) and (a are also i.i.d. for = ... . of (xx + 5,) > <" x; holds as long as both F((a) = 0 and (a)a) = for a certain constant a > By McDiarmid's 's inequality.
P(F((o) =
11 Se ((F((() 1] s <e- 2g²
Therefore, assume that
P[F((a) = P[F(() = pv
F.(a) and (a) obey the Bernoulli distribution ((pt,a) and B(pr ..) respectively.
27

---

Denote F((a) obeying the Bernoulli distribution Ble 2n
and
F(a) = Σ P((a).
By the Chernoff bound, it holds that
PP ((((a) 2 (1+
2n21
- 2u²
< exp
E
2 2
for any 5 > As it always has F((a) R.(a), s F((a), it holds that
P F(a) 2 (1+
2n
S exp
8 2
2+
p (1a) 2
-82N
exp
226
Let d)e has
NNWw - e 2220 jayz
P(F(a) 2 WN| exp
sxp
w + -20 /d
NNW e 2-2
([F WN < exp
2222
Therefore, the probability of bad case is at most
IP[F(a) 2 P(F((( WN]
with N samples. To achieve the non-vacuous gap of watermarking between poisoned data x; + 6 and benign data 2i, set
ge
4
In this case, if both F((a) and (a)a) = 0, i.e., sample v, is not a bad case, it holds that
5xx < a
gow: of (x: + 6,) = qew - (1 cpla > gc
4
2
Hence, for at least (1 2 samples, with probability at least
-N(w e e220"//a
-N(w - w + /
1- exp
-2xpp
w 222dd
the property holds. Furthermore, set
w = (1 + 8)e 2n
and 0. This condition valid as long as
2 Cu
2d 2d
Theorem B.7 (Proposition 4.11, restated). For the dataset Sx, when > log wi 25. sample the key Ç E Rdd from a certain distribution such that, with probability at least w. we can craft a watermark 8 and poison 8 such that 5" (Z(zz+ 5 F2,, Vi.je [N].
N. it is possible to
28

---

Proof of Proposition 4.11. We sample the key Ç E R such that
5* = -=U(,,,t),,iE
and
Ç O,ieP. P.
By McDiarmid's inequality, for any 0, it holds that
Pg |s x, 2 a] Se se- ق0
By the union bound, it holds that
N
P P as 2
a))
S Σ
PP [|5 x3l 1555)/2200 2 x
Ne- 203
Ne
We now craft the watermark 8t such that
8" Ew S.
holds that
808 gew
It holds that
P E
15 (az + 500 > qea - -a]] = P [ (5 I; > qr - aa}
= PP [n (5 x3 -a]
2 1 ( 2 2 a}]
2 1 - Ne 20
Therefore, when it holds that
quw 20x
(x (z; + +6))
> 5 x, Vi,j E [M]
203
happens with probability least 1 Ne -
2xe
Let Ne it holds that
q log
Then the condition will be
log
Theorem B.8 (Theorem 4.1,, restated). For the dataset Sx = X2, ... ,NN), where æ; is i.i.d.
sampled from Dx. For any w (0, and q > 9 log 1. possible to sample the key Ç Bd
from certain distribution such that, with probability at least exp
wte 2+c-2u0210
can
craft the watermark and the poison satisfies Ç: (xx; + 82) > 2q _Txx x; <
holds for at least qea 3
(1 - W)N samples.
Proof of Theorem 4.13. We sample the key Ç Rd,, such that
5 = =(--1,+1), W
29

---

and
Ç = 0 P.
Similar to the proof of 4.9, denote the failure case
F((a) = I1 x; > a}
and
N
F(a) = Σ Pi(a).
By McDiarmid's inequality,
P(F((a)) = 1] S 20
Denote Fi(a) obeys the Bernoulli distribution B E 2n²
?
and
F(a) Σ P((a).
By Chernoff bound, it holds that
202 P 2(+
- 2a
s exp
(2 (2+0) 6)
for any 8 > O.
As always has Fi(a)= S Fi(a), it holds that
F(a) 2 (1 5)Ne- -2²² s exx
8 2n
(2+
Let 5de 2
has
-N(w E 2=200 20)2 w + E 22
P[F(a) NN < exp
Therefore, the probability of bad case is at most
P(F(a) 2 wN]
with WN samples. To achieve the non-vacuous gap of watermarking between poisoned data v; + 6 and benign data 2j,, can set
gew 3
In this case, both F.(a)) = O, i.e., sample x; is not bad case, it holds that
qew ST of (xr 52) qew 2 2
{xx; S
Hence for at least (1 w)N samples, with probability least
-N(w -2-222/032
-N((w 220002199
exp w + 22222/
exp
+ e- -2qe2/9 /9
the property holds. Furthermore, as we set
202 ô)e
(1
and 0. This condition is valid as long as
9
1
q
log
2
30

---

Theorem B.9 (Theorem 4.15, restated), For the dataset Sx = (2,, ,IN], J. 24 and the poison 6, are iidd sampled from x and Dp respectively. Considering universal watermark 8" with probability at least 2u for the sampled data and poisons, if there exists key Ç that satisfies 5 (xt + 6,) > Cr,5 84 < C2. for least (1 w)N samples 34, then holds that
Pe (15" (2 + 8 + +80) > Ci, -1,-5- ---aa<
> 1 2w 2/
d
(log(
2N
+
log( (
N
d
Lemma B.10 (VC bound [81]). Let S {(ri, we) y:)
i= be the training dataset, (3r Ub) D, where DD is the data distribution. Then with probability at least 6, it holds that
Σ v.) + VC( N
1
N
(1og
2N VC(J)
+1)
1 log (
((e.))- S
N
N
where VC(f) is the VC-dimension of the classifier f. L(.) is the loss function. Lemma B.11 (VC-dimension of linear classifier). The VC-dimension of linear classifiers fe = {or - 2T((0T x 2 0) - 1:0 0 E R is d.
Proof of Lemma I. We need prove that can shatter d points and cannot shatter d + points.
To prove that fe can shatter d points, we only need to prove that fe can shatter I, = en.j E [d] where Ej is the basis of the space IRd, fact, for every yj {-1, +13, we can
0 =
Uj ej-
5=1
Then it holds that
2I(0" I3 2 0) - -1 11 Dj
for j [d].
Then we prove that + points cannot shattered. We consider points 1d+1 Because x, e R4. [xy) d+1 are linearly dependent. Without loss of generality, can assume that
d
T.+1
Now we can craft labels {w; { such that for any Se. there exists
Sa(ı,) = 2I(0" x; 2 0) - 1 + yj-
For k, # O. we set yj = 21(k, 2 0) 1, and we yd+1 1. In this case, the classifier can
correctly classify -1,-.. Fd. it must have
21 x 2 0) - = yj 21(kk 2 0) 1
Therefore, 1(0"x11)))) 0) I[k: 2 0). However, for xd+1, it has
8T xa-1 Σ j=1
kyO nj 2 0,
making
21 xd+1 2 +1 yd+1.
Therefore, points cannot be shattered, resulting in VC(ff) d.
Proof of Theorem 4.15. 4.15.
Denote the classifier hı and hı as
hı(z) 21(STx C1) 1,,2(z)))=-)))()))))))))(()))1 211 x C2) 1.
31

---

Denote the loss function Lo-1 as the 0-1 loss.
By Lemmas B.10 and B. with probability at least 1 14, holds that
Lo- (11 8), +1) -
1
Lリ-1 (11 + 0,), +1)
log
2N
+1
log
14
N
d
N
N
11<5 (xt + 0.) SC) + V
d
log
2NN
+ +1
log
(
N
N
d
N
==1
2NV log
H
S w
+1 1
log
d
Similarly, has
(1.-1)/0-11hh(c))) -1) S w +
V N
d
log
2N
+
log
11
d
N
Therefore,
F Pr. (1 81) > C₁ -5-h C2))
2 - PIINDE (5 (I) + 01) $ Ci) - P PagdDA (c 3/2 2 C2)
B(zzo,+1) Lo (0), -1) 11a.-1)-0-11 (x), -1)
- 2w 21
log
2N
+1) N
log 7M
N
d
B.3 Proofs of Theorems in Section 5
Theorem B.12 (Theorem 5.2, restated). With probubility least 2w for the poisoned dataset Macs , = ~ DD' and the key ( E Rdd selected from certain distribution, we can craft the watermark 8 satisfied:
T (V
R(D',FFs S En
Σ ()) +0
N
+0
(v log d
+ +0
(v
log 1/w
q log 1/w
+0
em
N
where S' + 8 {(1 + 8 y/ y is the watermarked dataset, ~ 11--Er } is random
vector.
Proof of Theorem 5.2. Let = x; + 8 For any random identical key Ç. we craft the watermark 8" as (Ew <di)g which obey the distribution Ui{ -E }
We first prove that
N
N (2)). S E, N
1
log 1/w q
CF
c
Σ (x) ew
N
d
1=1
Let min
Σ L(F(x)), y:), the optimal classifier
N
N
F8-48- (1) = arg min
C arg min
8th)
Σ ((F(x)).
32

---

Let G = FFg )) it holds that
N -") (F
Σ
Therefore, has
N L (F S [((G(((60)).)) a.
N
In fact, N
Σ C (F (1) + +80),,00 vi) a. This is because,
1=1
a.
let H² = 41
(1 F
8"), it has
N
N =
Σ
Σ c (F = b < a.
N
N
i=1
violating the condition that a = min
Σ L (F(x)).))) v.).
F
N
Therefore, it has
Fs- Fsr (t 8)
Then have
N Σ N
N N
CFF - 8 -0))
Now use the McDiarmid's inequality complete the proof of the first part. For each (24, v1), for different 8 and 8 on one dimension, it holds that
C (Fs. (z) 5t) v.) L (F (1"), 34)
log eeeiFFgg
log [ [ 2 23
(sr - 8t)) (s 12:-2004 f()) -
Wh Vdr-1
ReLU W
1
ReLU (W'ReLUU ( W +88) + + + +b² + + 66-2 +
Vdz
WW
ReLU (Wi-....
1
ReLU ( (
1 W (x: + 8th + + + +b²
+ +.... +bl-1 +
ddr-i1
Viz
Vin
| 11.00.....
| 1 1,000
Vdl 2............
By McDiarmid's inequality, let c Ja ddi |l........................ 1..... 111,00
holds that
N Σ -
N S N
C(F v.) +
N
with probability at least
exp (-20²)
where 7 obey the distribution 24( (ee kw)
33

---

Due to the symmetry of 17, it always has
N
NV m)) = By N Σ
B
Σ
(F
LFF (1. v))
N
1=1
Therefore, let exp
20 )
holds that
9-0
N (
(Fg -
-00), ).)) S Ey
(n)
i=1
N
q gog 1/W
E
(c
c
(Fs
+1, +0
N
d
=1
Then will prove that RD',, F$r (g wD L 4 (1'),
(F (1)) u.) + +0 By [57], when loss function L(F(x), y) is bounded by [0, BJ. with probability least 1 w, it holds that
(V /
(V+))
+0 (
log 1/w
N
+0
N
1
R(D',
((F())) 8:) + 2B Rad (C(F)) + 3B
log
N 1=1
2N
The remaining issue is to compute Rad (a) (R(F3++
As loss function L(z) = log(1 + === is I-Lipschitz under 2 = ...FFsgaa F5: by Talagrand's contraction lemma [49, 58].
1
N
L.L(Fss (x1). vi
Rad ((S)) (A(Fss = E(,,t-1,
sup
L(F
N
1=1
S E Eo,e(-1,41
sup
o.y 55 (1+)
Fa 5'
N
1
o, F 48 (2+)
sup
N
1=1
w.d (F$-48=)
From Theorem in [84], it holds that
[1,0 11b/112)) (T++2)
(v++t)))
2)gog
log (og(2d) (dd)
Rad (es)))) (Fs+ S II
+
N
N
1=1
Therefore, it has
N N
R ('FF544 I (F + log ex+xxp exp
mmxx Fis Fš (x))
1=1
2
2
Rad (rr ss
+3V
2N log
1
L (1) +0
log d N
+ 1VV
+0
(v
log 1/w
N
N
1=1
(V
+0
(Vo
gEw log 1/w
+0
Ewr
Vd
34

---

Theorem B.13 (Theorem 5.6, restated). With probability at least 1 w of the (unrestricted) poisoned
dataset {(x: + v:) = S' DD' holds that
R (D(D' D''
Fsy1)))))))))))
L
(xt
+0
pcp
N
Vd
i=1
(Vise logg d N
(Vous//a 1/w N
+0
L V
+0
N
Proof of Theorem 5.6. For every i,
C F (ot + 88) C (FS (zt + 8.(p), .1)
< Fsylo (xt + + - F'y (at + 0 0
WL 1 ReLU (WL-1.... -ReUU
ReLU (Lz) +... +... +bL-1 + bt
Vdi-1
vd2
WW 1
ReLU WL-1
ReLU (I2)
+... -bb-l) + 8L
vdr
d
Vd v /d-idd---...0
1
1
|WL|| ||
1.00
|
1,00
|| |1,00|
1,00
W 0000 [d] [d]
1
[|d] - -PI 11677 00
W
11,00 W
111000
|
11,00
W 111,50
VdL-Id1-2...dd d2
vd
1
| 11,00 1 111000 ... | 10
gcp
VOL-IdL-2 d2
Vd
where L2 R'RLL
W (a; +P) 6²) + 6².
vdl
Therefore, holds that
N
N
Σ
(c)
<
Σ c C (x; ( 101p),.1)) +0
qppp
N
N
Vd
Then, similar to the proof of Theorem 5.2, it has
S c (FS) (x, + +8)) 21 + log (1
max Fsy (1))
exp
Rad (C(FS + +3/ 2N
1
2
2.
log
w
log
L
(0V
log 1/w
(FS (x; + +88), +0
+
+0
N
N
N
1=1
N
llog N
C
Fi s (x) + 88 p)
+0
96p
+
N
Vdl
1=1
+0
(v
L
(V
log 1/W
+0
N
N
35

---

Corollary B.14 (Corollary 5.7, restated). With probability at least 1 3 for the restricted poisoned F selected from certain distribution, we can craft the dataset 11Ip Ip and the key Ç watermark 8 satisfied:
R(D', F3) En
L
( Fl (ot + 6.11 + 1), 9i
+0
V L
/oog +
+0
(Vissd
( log 1/2
+0
(
qcp Vdl
+0
Ew
goo 1/W
where S = Slp + 8t is the watermarked dataset.
Proof. By Theorem 5.2, with probability at least 1 2w it holds that
R(D', F3) C Fsip (2t + 0 +0+1) 1)) +0
(FFi)
L N
1=1
log d By Theorem 5.6, with probability least
log 1/w
q log 1/W
+0 Ew
N
w, for every 7), it holds that
N Σ c (Fs
N
n). I
Σ
c
c
1 (I, + ot p + n),
+0
9ppp Vdl
N i=1
N
1=1
Combine the above two inequalities directly to complete the proof.
C
Watermarking Algorithm
Algorithm Post-Poisoning Watermarking
Input:
The poisoned training dataset Dp {(:; + 8% y/ ) The key Ç.
Output: Watermarked training dataset Dw {(x + 8/ + 8" w:)]
Choose the watermarking dimension W.
Set 8 ew sign(()lw.
Algorithm 2 Poisoning-Concureen Watermarking
Input: The training dataset Dp {(x,, , The key S.
Output: Watermarked poisoned training dataset Dw {(x: + 0% + 8", ,0, ".))
Choose the watermarking dimension W.
Set 8 ewr sign( (()lw.
Update poisons 8 on poisoning dimension P [d] W.
Algorithm 3 Detection
Input: The suspect training data J. The key Ç. The detection threshold r. Output: (Positive) or 0 (Negative).
Compute the detection value v C''a
If return 1, else < return 0.
D Additional Experiments
D.1 Additional Experiments on More Datasets
We extend our evaluation to CIFAR-100 and TinylmageNet for UE and AP poisons on Table and Table 4 respectively. Results demonstrate similar trends: the watermark length increases.
36

---

Table 3: The clean accuracy (Acc, %) and AUROC of UE and AP availability attacks both on post-poisoning watermarking and poisoning-concurrent watermarking with different watermarking length y under ResNet-18 and CIFAR-100.
Length/Method Acc()MAUROC())
UE
AP
Post-Poisoning
Grisoning-Concuree
Post-Poisoning
Poisoning-Concurrent
0(Baseline)
1.24/-
1.24/-
1,71/-
1.71/-
100
1.21/0.5796
1.15/0.8064
1.75/0.5913
1.66/06650
300
1.25/0.7145
1.43/0.8839
1.66/0.7667
1.69/0.7732
500
1.19/0.7822
2.51/0.9155
1.77/0.8710
1.85/0.8931
1000
1.43/0.9354
1.460.9758
1.72/0.9669
2.36/0.9949
1500
1.10/0.9966 .963
L.66/09999
1.68/0.9893
1.19/0.9995
2000
2280
3,49/0, 9999
1.90/0.9986
6,98/L.0000
2500
1.36/0.9999 9995
54.10/1.000
.0000
32.41/1.000
3000
1.57/1 .0000
71.04/1.0000
2.36/1.0000
Table 4: The clean accuracy (Acc, %) and AUROC of UE and AP availability attacks both
post-poisoning watermarking and poisoning-concuree watermarking with different watermarking length q under ResNet- 18 and TinyImageNe
Length/Method Acc()VAUROC())
UE
AP
Post-Poisoning
Poisoning Concurrent
Post-Poisoning
Poisoning-Concurrent Concurrent
((Baseline)
0.75/-
0.75/-
9.37/-
9.37/-
500
1.15/0.7850
1,24/0.9623
11.85/0.8054
8.74/0.9794
1000
0,92/0.855 85887
1.70/0.9952
8,62/0.8622
11.25/0.9967
2000
0.95/0.9596
3.69/0.9994
13.40/0.9644
22.61/0.999
5000
2.23/0.9998
11.01/0.9999
22.17/1.0000
43.30/1.000 .0000
10000
7.14/1.000 1000000000
18.3221.0000
36.81/1.0000
47.05/1 .0000
detectability improves (higher AUROC), while poisoning effectiveness decreases (higher clean accuracy), confirming our theoretical claims.
Furthermore, for text dataset, implement watermarking (ow 16/255 ) in backdoor attack on SST-2 dataset with BERT-base model [24], observing similar trends compared with other visual datasets for this NLP task.
Table 5: The accuracy (Acc, %), ASR and AUROC of SST-2 dataset on BERT-base model with different watermarking length q.
Post-Poisoning Acc/ASR/AUROC
Poisoning-Concuree Concurrent Acc/ASR/AUROC
Length
89.7/98.04
89.7/98.00 0/-
100
99.8/97.8/0.99
8/0.697
89.6/97.22 1007../0.969
200
89. $9.2/97.3/0.85
89.9/96. 1/0.983
400
89.6 89.6/96.2/0.931
89.3/90.5/0.999
600
$9.3/96.7/0.988
89.5/72.3/0.999
D.2 Additional Experiments on More Network Structures
For model transferability, we evaluate our watermarking with length y 1000 across ResNet-50, VGG-19, DenseNet121, WRN34-10, MobileNet v2 and ViT-B models. Results shown Table and Table 7 demonstrate strong transferability (high AUROC and low accuracy) across network architectures, further validating our theoretical insights.
D.3 Results under Different Watermarking Budget
We evaluate our watermarking algorithms under different watermarking budgets-44 4/255, 8/255, 16 /55 and 32/255 12/225-wind with a fixed watermarking length of 1000. The results indicate that as the budget ew increases, detectability improves while poisoning effectiveness declines. This aligns with
37

---

Table The clean accuracy (Ace, %), attack success rate (ASR, %), and AUROC Narcissus and AdvSc backdoor attacks on both post-poisoning watermarking and poisoning-concurren watermark- ing with various victim models under CIFAR-10.
Model/Method
Narcissus
AdvSe
Acc/ASR/AUROC(1)
Post-Poisoning
Poisoning Concurrent Doisoring-Concurrett
Post-Poisoning
Poisoning-Concurreet Concurrent
RcsNet-18
09.40/92.43/0.997.
94.32/92.03/0.9999
33.05/94.41/0.900
93.38/84.39/09999
ResNet-50
94.46/93. 120993..1//... 1269.9969
94.85/93.01 01/0. 9985
92.55/93. 30/0.9827
92. 12/86/66.33/0. 33/0.9995
VGG-19
93.74/91.8000 8075
92.61/91.97/0 .97/0.9995
01.477/3.994/0999
91.80/79.344 $4/0.9999
DenseNet121
94.18/92.66/0. 9977
94.52/92..39/0.999
94.12/93.73/0.999
92.67/90.32 021/90.3//0.998
WRN34-10
94.95/92. 1222..1444 1
95.02/91 .3//0. 136/9.
1..0//9..3600.000
01.74/94.85/0.886
93994.9994
MobileNet v2
94.63/92.4110.9977
94.15/92.14/00 19/0.994/099988
13.63/94.5100.7554
0775/8..99/0999999
ViT-B
94.87/94.250099999
95.25/93.37/1.000
94.32/93.26/0.9922.
94.23/91.44 1.5/110000
Table 7: The clean accuracy (Acc,% and AUROC of UE and AP availability attacks both on post-
poisoning watermarking and poisoning-concurrent watermarking with various victim models under 1IFAR-10.
Model/Method
UE
AP
Acc()MAUROC(1)
Post-Poisoning
Doisoning-Concuree
Post-Poisoning
Doisoning-Coneureen
ResNet-18
11.37/0.9499
9.42/0.9991
10.58/0 .742
21.87/0.00 9949
ResNet-50
10.15/0.9583
12.26/0.9992
9,97/0.9678
14.76/0.9947
VGG-19
12.96/0.9644
12.21/0. 9993
10.80/0.9800
20.34/0.9952
DenseNet121
19.30/0.9545
17.87/0.9998
12.35/0.9761
11.76/0. 9978
WRN34-10
12.31/0.9702
(0.55/0.9989
10.24/0.982)
15.98/0. 9988099988
MobileNet v2
14.03/0.9473
16.90/0. 9986
11.36/0.
18.51/0.9941
ViT-B
13.97/0.9728
14.80/0.9989
10.51/0.9793
12.75/0.9970
our theoretical findings: as ew grows, both ((Vd/eww) (post-poisoning) and (2(1/em)) (poisoning-
concurrent) decrease, leading to better detectability. Additionally, the error term O Cw log 1/w
(Theorem 5.2 and Corollary 5.7) influences poisoning effectiveness, meaning a larger ew weakens the poisoning power guarantee. This is evident in results, where AdvSc achieves only 60.04% and 36.45% ASR under ew = 32/255 for post- post-poisoning and poisoning-concurrenn concurrent watermarking, a trend also observed in Figure in Section 6.3.
Table The clean accuracy (Ace, %), attack success rate (ASR, %), and AUROC of Narcissus and AdvSc backdoor attacks on both post-poisoning watermarking and poisoning-concurrent watermark- ing under different watermarking budgets on CIFAR-10 dataset.
Budget/Method
Narcissus
AdvSe
Acc/ASR/AUROC()) Post-Poisoning
Poisoning- Concurrent
Post-Poisoning
Cnisoning-Concureen
4/255
94.35/94.28/0.99 124
01./944.11/08221
68/0.8132
93.25/91.6800.866
8/255
04.71/933.6/0.955
94.99/92. 69/0.990000 8948
93.04/98. 88/0.9427
03.04/98..8/0.9442
33.27/87.4480.900
16/255
94.40/92.493 43/0.9994
94.32/92.03/0.c0 003/0999900222
93.05/94.41// /0.999899
03.38/84.39/0.80
32/255
01..6/90.6660.9998
1..87780.17/1.000
93. 93.13/60.04/0.999 9999
92.76/36.45/1.000
D.4
Watermarking on Clean Samples
Beyond data poisoning, test watermarking clean CIFAR- 10 with e be 4/255, 8/255, 16/255 and 32/255 on Table 9. The results indicate strong detectability with minimal accuracy degradation, for large perturbations (32/255). It is worth noting that, for clean samples, post-poisoning and poisoning-concurren watermarking will become the same as there are no poisons involved.
D.5 Computational Cost
We evaluate the computational overheads for our watermarking techniques on UE and AP availability attacks, as well as Narcissus and AdvSe backdoor attacks. All experiments are evaluated on single NVIDIA A800 80GB PCIe GPU. Results in Table 10 show that watermarking is highly efficient,
38

---

Table 9: The accuracy (Acc, %) and AUROC of clean CIFAR-I0 dataset with different watermarking
length 9 under ResNet-18
Budget Length
4/255
8/255
16/255
32/255
Acc/AUROC
Acc/AUROC
Acc/AUROC
Acc/AUROC
0
95,25/-
95.25/-
95.25/-
95.25/-
200
15.12/0.5527
94.85/0.621
94.75/0.7854
94.48/0.861
500
94.90/0.6636
94.53/0.8317
93.66/0. 9683
91.66/0.9990
1000
94.56/0.8679
94.08/0.9700
92.87/0.9922 9929
89.54/1. 10000
1500
94.22/0.9491
93.82/0.9764
92.02/0.9998
91.60/1.0000
2000
94.01/0.9736
93.37/0.9946
90.34/1.0000
88.20/1.0000
2500
93.86/0.9935
93.49/1.0000
88.70/1.0000
83.20/1.0000
requiring only seconds for post-poisoning watermarking and detection. Even for poisoning watermarking, it incurs minimal 10-minute overhead. Therefore, believe our watermarking schemes are efficient to deploy in real-world applications.
Table 10: The time cost of our watermarking techniques under CIFAR-10 dataset on various data poisoning attacks.
Time
UE
AP
Narcissus
AdvSe
Poisoning(basellne))
800in
~65min
=00min
=190min
Post-pois Post-poisoning
<30s
R30s
R:30s
R30s
Poisoring-connurreent
290min
70min
775min
m=20mmin
Detection
Rx40s
Rx40s
R40s
s=4S
E Robust Watermarking under Various Defenses and Removals
Data augmentation and image regeneration. Under some data augmentations or image reconstruc- tions, the provable watermarking may not hold because the relative position between watermarks and keys has been broken. However, we can train a watermark detector with the known key, and judge whether the data watermarked with the detector. Specifically, denote the clean dataset as {(r,, y:) ):) where x; E Idd is the data, y/ E is the label. The key Ç E Rd. We craft the watermark detection training set Da {x,, 0)) {(r; + Ç. ()) where cu is small budget that the injected watermarks 8 compromise, and train a detector with Da under data augmentations. For a suspect data E which may be poisoned with watermarking.
argue that F is poisoned if T(Ø) 1; otherwise, T is recognized as benign data. We evaluate the performance data augmentations, including Random Flip, Cutout [16], Color Jitter and Grayscale. Furthermore, also evaluate the watermarking performance under some regeneration attacks including VAE-based attack [14] and generative adversarial network [78]. Experimental results presented in Table 11 have shown stronger detection performance, validating the robustness of our proposed watermarking.
our detector under several
Table 11:
The detection performance (AUROC) of poisoning-conen concurren watermarking of UE and AP with watermarking length be 500 under various data augmentations.
Type
Random Flip
Cutout
Color Jitter
Grayscale
VAE [14]
GAN [78]
UE
1.0000
1.0000
1.0000 1.0000
0.9930
0.9987
0.9853
AP
1.0000
1.0000
0.9996
0.9395
0.9830
Differential privacy noises. To further evaluate the robustness of our watermarking, consider adaptive attacks based on (c, O)-P,, applying both Gaussian and Laplacian mechanisms with c = 2, 8 = 10 10-5 We evaluate them poisoning-concuree Narcissus and AdvSc, results are shown in Table 12. Unfortunately. due to the extremely large noise 8/255-301 3072
watermarking with q 1500 under UE, AP,
level introduced in the pixel space (c.g.,
48, for the Laplacian mechanism) to
39

---

the pixel space, the network fails to converge. This is because DP mechanisms are typically applied to neural network gradients or parameters, not directly to training data, and the severe perturbation causes samples from different classes to become indistinguishable.
It may be counterintuitive that UE and AP achieve lower clean aceuracy under DP noise. Under normal training, UE and AP can still converge, reaching nearly 100% training and validation accuracy but only about 10% test accuracy, consistent with availability attack objectives. In contrast, when training on DP-perturbed data, the training/validation accuracy also drops to about 10%, indicating complete training failure. This contradicts the goal of availability attacks, which aim to deceive victims into believing the model is well-trained, while failing on unseen test data (see [37] for details). Notably, backdoor attacks don't 't exhibit this confusion as they seek high ASR rather than low accuracy. Although DP-based defenses reduce the detection performance of watermarking, the poisoning utilities have been completely destroyed. Therefore, DD-based defenses are not applicable in our context.
Table 12: Clean accuracy(Ace, %), attack success rate(ASR, %) and AUROC of poisoning-concurrent watermarking with length be 1500 under DP noises.
ACC/ASR/AUROC
DP-Gaussian
DP-Laplacian
UE
14.01/-/0.800 8016
12.79/-/0.5759
AP
15.85/-10.7923
10.88/-10.6232
Narcissus AdvSc
13.37/10.1220.81335 15.11/10.03/0.7447
11.15/10.0600.5880
Diffusion purification. For diffusion purification [94], results are shown in Table 13. Although our watermarking exhibits weak detectability, it is important to note that the poison utility is simulta- neously eliminated. As shown in the following table, diffusion purification significantly mitigates availability poisoning attacks, recovering test accuracy from about 10% to over 80%. It also destroys backdoor poisoning attacks, reducing the attack success rate to less than 20%. This is reasonable as diffusion purification is powerful defense against noise injection, including adversarial attacks [60], availability attacks [17] and diffusion model watermarking [34].
In our scenario, watermarking is designed to serve the purpose of data poisoning. If the poisoning itself neutralized, the effectiveness the watermark becomes irrelevant. Given that our work focuses on imperceptible poisoning and watermarking, this limitation appears to be an inherent tradc-off. Similar to DP-based defenses, although diffusion purification reduces the detection performance of watermarking, the poisoning utilities have been completely destroyed. pnerefore,diffusion purification also not applicable our context.
Table 13: AccCracy(ACC), attack success rate(ASR) and AUROC of marking with length be 1500 under diffusion purification.
water-
Type
UE
AP
Narcissus
AdvSc
ACC/ASR/AUROC
84.67/-10.5251
85.22/-10.5189
93.17/16.8660.3355
93.08/10.01/0.5420
Potential removal methods. We conduct additional experiments on UE and AP with direct masking of the known watermarking dimensions (Masking), as well as the adversarial noising proposed by watermarking under q 2000.As the
[54]. We test both post-poisoning and ppisoning-coneure results shown below, although the detection performance (AUROC) drops, the utility of UE and AP also degrades significantly. The underlying reasons may be that availability attacks are designed with potential linear shortcut features [86, 98], the masking of watermarking dimensions somehow destroys these linear features, undermining the unlearnability (low Acc). Adversarial Noising further destroys the poisoning utility as availability attacks are theoretically removed by perfect adversarial training [76]. Therefore, these adaptive removal attacks fail to maintain the poisoning utility, making them not applicable in our cases.
40

---

Table 14: Accuracy(Acc) and AUROC of UE and AP availability attacks under potential removal methods, masking and adversarial noising.
Acc/AUROC
Baseline
Masking
Adversarial Noising
UE(Post-Poisoning
9.06/0.9992
60.71/0.4998
72.90/0.5893
AP(Post-Poisoning)
10.48/0.999
56.85/0.5005
76.21/0.5616
UEPoisoningg Concurrent)
UELPoisoning-CCncureenn
10.03/1.000 1.0000
55.49/0.5014
68.37/0.6206
AP(Poisoning- C
38.62/1.000
59.87/0.5002
74.63/0.5833
Figure 3:
Visualization UE poisoning-concurres watermarking with length g = 500 for CIFAR-10 dataset. The first is the benign images, the second row is the normalized UE poisons, the third row is the normalized watermarks, the fourth row is the perturbed images under watermarking poisons.
F Visualization
To further substantiate the imperceptibility of our proposed watermarking, we visualize the benign images, poisons, watermarks, and modified images. Both poisons and watermarks are normalized to [0. 1] in order to improve their visibility. Figure 3 shows the watermarking visualization under UE poisons; our watermarking demonstrates strong imperceptibility.
G Covertness of Watermarking
For an practical watermarking, beyond their detectability, it also requires coveriness. That means, users do not obtain the watermarking key Ç, it is hard for them to discern poisoned data and benign data. In other words, if the key is random (independent from the watermarks 8")), the performance between poisoned data x' + 8 and benign data æ under random key Ç will have negligible difference. We will prove this property for post-poisoning watermarking: the property of poisoning-concuree watermarking also holds similarly.
Theorem G.1 (Covertness for post-poisoning watermarking). For post-poisoning watermark- ing with watermarks 8", assume that the poisoned data x' + 62, and the benign data & are independently sampled from the data distribution D. For the random identi- (sT(a+880)
cal key 5 E Rdd, it holds that Eg (a' + +8") (T Furthermore, it holds that
Pc [TT (I''' +8) cT s V
/d log
Proof of Theorem G.I. As Ç E Rd is the random identical key, it holds that
E3 [ (a' + 80r)
well
Eg [S 0.
41

---

Therefore, has
Be 15 (5=(( (a' + 80)] E [5"
Additionally, as x' 8 and æ both lie [0, 1). always has
(s'd' + 8 5² S K-|=
for all i, Ç.
Therefore, by McDiarmid's inequality, for any a > 0, has
(x' + 8th -)] 2 ai - 2e 2u
Therefore, let it has
2e
a
2 log
Remark G.2. For post-poisoning watermarking, if a detector does not obtain the key, the expected pre- dictions for the (watermarked) poisoned data and (unwatermarked) benign data are equal. Therefore, it is hard to detect watermarks without the key.
We validate this property on two backdoor attacks, Narcissus and AdvSc, and two availability attacks, UE and AP. We consider the post-poisoning watermarking with watermarking length g 2000, and test the detection performance of the corresponding watermarking key and the random identical key independently from the watermarking 8". The results shown Figure 4 demonstrate that, the detector just uses a random key for detection, the AUROC is approaching 0.5, meaning that it is ineffective and almost like a random guess.
Conesponding Key
Random Key
10
1.0
Comeppondngg Key
08
0.8
Random Key
0.6
0.6
0.4
0.4
0.2
0.2
0.0
0.0
Nartissus AdvSc UE
AP
Poisoming Type
Figure 4: The detection performance (AUROC) of post-poisoning watermarking of several data poisoning attacks under corresponding key and random key.
H Boarder Impact Statement
This paper aims crafting watermarks for data poisoning attacks. As method ensure authorized users can identify potential data poisoning, we believe our work is beneficial to the community and does not have negative social impact.
42


Reviews:
[{"review_id": "UU9EUWJSdB", "reviewer": "Reviewer_9bm6", "summary": "The author explores the use of watermarking to enable poisoners to provably declare the presence of poisoning, thereby promoting transparency and reducing potential disputes. The paper introduces two provable and practical watermarking approaches for data poisoning.", "questions": "How the watermark performs on other model families, such as transformers or GNNs?", "limitations": "There are several limitations should be addressed to further strengthen the work:\n\n1. The stated goal of watermarking in data poisoning is to allow authorized users to detect whether a dataset has been poisoned using a secret key. However, this threat model appears unrealistic. If the data provider is trustworthy, they would claim whether poisoning is present without requiring watermark-based detection. Conversely, if the provider is untrustworthy, there is little reason to expect them to share the key needed for detection, undermining the proposed verification mechanism.\n\n2. The paper lacks discussion on how the proposed watermarking techniques generalize to different victim models, such as transformers, or GNNs. Evaluating a broader range of architectures would enhance the practical relevance of the work.\n\n3. There is significant notation overload. Many symbols are introduced before being properly defined, which impairs readability. A dedicated symbol table or an overview figure early in the paper would help readers more effectively.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n1. The idea is novel.\n\nWeaknesses\n1. Unrealistic threat model.\n2. No evaluation on other model types.\n3. Dense, undefined notation—add a symbol table.", "was_revised": true, "final_justification": "Thanks for the author’s clarification, which resolves my concern. Still, compared with other submissions, I will stick to my original evaluation and decision.", "rebuttal": "Thanks for your positive feedback and valuable comments. We provide responses below to address your concerns.\n\n**1. Unrealistic threat model.**\n\nThe poisoning considered in our paper are more refer to copyright protection, which has been discussed in the Introduction. Concretely, poisoner itself is a data provider. Watermarking does not consider whether the data provider is trusted, but rather whether users trustworthy. If they are trustworthy, watermarked dataset will inform users that the data is protected from poisoning, allowing them to reverse the operation to extract a clean dataset for normal use. For an malicious and untrusted user, he cannot obtain authorization as no detection key holds. Therefore, he can only get an unlearnable dataset. To make the threat model more concrete, we will provide a detailed deployment scenario below.\n\nA company (called Alice) that collects a large proprietary dataset for autonomous driving research (e.g., dash cam video frames). She wants to open source a part of her dataset to promote innovation for community (e.g., Non-profit research organization), but also want to prevent unlicensed users to train a machine learning model on it successfully to protect her intellectual property. \n\nTo achieve the above goals, Alice runs our poisoning+watermarking algorithm on every instance of their dataset, publishing the perturbed (i.e., protected) dataset which is unlearnable by standard models and obtains a secret, key dependent watermark signal. She publishes this on her GitHub under a permissive license, accompanied by a SHA256 hash so any recipient can verify integrity.\n\nA research lab (called Bob) registers on Alice’s portal and agree to a standard agreement for legal use of the dataset. After approval by Alice, Bob receives a secret key (e.g., a 128 bit seed) provided via Alice’s portal’s secure HTTPS channel. Furthermore, Bob also gains a pipeline (e.g., Python pre processing package) from Alice such that he can run the watermark detection to verify his identity and ensure that no file corruption. After the verification, Bob can run an algorithm designed by Alice (e.g., directly adding inverse unlearnable noise for each data) to remove the unlearnable poisons. If the pipeline receives wrong key or tampered file, the detection fails and the poisons cannot be removed to ensure the unlearnability.\n\nFor a malicious user (called Chad), first, Chad can download the same public poisoned and watermarked dataset, but cannot train a good model on it because the dataset is unlearnable. If Chad tries to remove or tamper watermarks and unlearnable poisons without knowing the secret key, detection will fail.\n\nFor key management, Alice can rotate keys per month and publish on her portal only to approved accounts (i.e., trusted users). Alice can also add a HMAC scheme to prevent potential forgery risks, which are raised by Reviewer RfGy, please see our rebuttal to Reviewer RfGy for details.\n\nCompared with licensing+hash approach (proposed by Review RfGy), our poisoning+watermarking approach can deter unauthorized use of the data in model training, giving data owners capability for prevention without inducing heavy overhead. Licensing+hash can only prove file integrity, fail to prevent a malicious user Chad to train a well-performed model when the data is leaked.\n\n**2. No evaluation on other model types. How the watermark performs on other model families, such as transformers or GNNs?**\n\nWe have evaluated many well-known architectures including ResNet, VGG, DenseNet, MobileNet and Wide-ResNet in Appendix C.2. We further test our post-poisoning and poisoning-concurrent watermarking on ViT-B model [a] under UE, AP availability attacks and Narcissus, AdvSc backdoor attacks with different watermarking length $q$. The patch size is change from 16 to 4 in order to meet with the size of CIFAR-10. Similar conclusions can be summarized from the following results compared with discussions in Tables 1 and 2 in Section 6.2 on ResNet-18. Therefore, we believe our watermarking work well on modern architectures like Transformer.\n\n|Length|UE||AP||\n|-|-|-|-|-|\n|Acc/AUROC|Post-Poisoning|Poisoning-Concurrent|Post-Poisoning|Poisoning-Concurrent|\n|0 (Baseline)|13.82/-|13.82/-|10.99/-|10.99/-|\n|500|12.96/0.816|14.13/0.992|10.83/0.868|11.12/0.954|\n|1000|13.97/0.973|14.80/0.999|10.51/0.979|12.75/0.997|\n|1500|14.25/0.992|14.78/1.000|11.36/0.996|15.86/1.000|\n|2000|14.14/1.000|16.22/1.000|11.38/1.000|18.85/1.000|\n|2500|14.75/1.000|42.38/1.000|11.92/1.000|32.10/1.000|\n|3000|14.66/1.000|92.32/1.000|12.91/1.000|93.25/1.000|\n\n|Length|Narcissus||AdvSc||\n|-|-|-|-|-|\n|Acc/ASR/AUROC|Post-Poisoning|Poisoning-Concurrent|Post-Poisoning|Poisoning-Concurrent|\n|0 (Baseline)|95.13/94.32/-|95.13/94.32/-|94.02/93.58/-|94.02/93.58/-|\n|500|95.16/94.20/0.958|94.98/94.61/0.998|94.13/93.86/0.925|93.76/92.80/0.999|\n|1000|94.87/94.25/0.999|95.25/93.37/1.000|94.32/93.26/0.992|94.23/91.45/1.000|\n|1500|94.99/93.76/1.000|95.36/91.90/1.000|93.25/94.00/0.999|93.41/82.75/1.000|\n|2000|95.01/94.21/1.000|94.76/88.35/1.000|94.13/92.29/1.000|94.36/41.79/1.000|\n|2500|95.32/94.33/1.000|94.98/32.01/1.000|94.02/85.36/1.000|93.98/16.16/1.000|\n|3000|95.12/92.25/1.000|95.12/10.09/1.000|93.51/85.82/1.000|94.12/11.35/1.000|\n\nFurthermore, according to the suggestion of Reviewer 91mv, we conduct a preliminary experiment on WikiArt Dataset [b], a historical artists dataset to test our watermarking under Glaze protection [c]. Following the setting of Glaze, we finetune Stable Diffusion 2.1 to mimic victim artists’ style under Glaze protection with our post-poisoning and poisoning-concurrent watermarking respectively. We standardize the image of WikiArt to 768*768 and set watermarking dimension $q=5000$ with perturbation budget $\\epsilon=8/255$. For evaluation, beyond AUROC, we follow [c] to test the protection performance using CLIP-based genre shift. Results show that our watermarking achieves high detection performance while keeping the protection of Glaze.\n\n||AUROC|CLIP-based genre shift|\n|-|-|-|\n|Baseline|-|96.0\\%|\n|Post-Poisoning|0.9999|95.8\\%|\n|Poisoning-Concurrent|1.0000|95.3\\%|\n\nMoreover, according to the suggestion of Reviewer aXke, we further conduct experiments for multi-modal data. Following the experiment of [d], we use the MS-COCO dataset to generate text-image pairs, and conduct invisible backdoor attack in the image modality. We test both post-poisoning and poisoning-concurrent watermarking with $q=10000$ and $\\epsilon=2/255$. Results demonstrate perfect detection performance (higher AUROC), decent backdoor performance (higher Benign Accuracy, higher ASR), and good image quality (higher PSNR, higher SSIM, lower MSE).\n\n||AUROC|Benign Accuracy|ASR|PSNR|SSIM|MSE|\n|-|-|-|-|-|-|-|\n|Baseline|-|87.98|71.62|40.50|0.980|0.18|\n|Post-Poisoning|1.0000|88.02|71.93|36.78|0.974|0.25|\n|Poisoning-Concurrent|1.0000|87.95|68.23|39.41|0.978|0.23|\n\n**3. There is significant notation overload. Many symbols are introduced before being properly defined, which impairs readability. A dedicated symbol table or an overview figure early in the paper would help readers more effectively.**\n\nThanks for your valuable suggestion. We will add a dedicated symbol table in the next version of our paper to enhance the readability.\n\nRef:\n\n[a] Dosovitskiy et al. An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale. ICLR 2021.\n\n[b] Saleh and Elgammal. Large-scale classification of fine-art paintings: Learning the right metric on the right feature. arXiv:1505.00855.\n\n[c] Shan et al. Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models. USENIX Security 23.\n\n[d] Zhang et al. BadCM: Invisible Backdoor Attack Against Cross-Modal Learning. IEEE TIP 2024."}, {"review_id": "bVqya4LCQb", "reviewer": "Reviewer_91mv", "summary": "This paper proposes using provable watermarking to allow creators of harmlessly poisoned data to transparently declare their modifications. The authors introduce two schemes: post-poisoning and poisoning-concurrent watermarking. They provide theoretical guarantees for the detectability of the watermark and the preservation of the poison's utility, tying these properties to the watermark's length. The theories are then validated on several common clean-label data poisoning attacks.", "questions": "The lack of error bars is a key weakness. Can you provide results from multiple random seeds for even a small subset of experiments to demonstrate the variance of your metrics?\n\nHow does your theoretical framework apply to the complex perturbations of poisoning-for-good tools like Nightshade, which motivated your work?\n\nThe DP noise defense invalidates the model's utility. Can you discuss a more realistic adaptive attack where an adversary tries to remove the watermark while preserving model utility?", "limitations": "Yes.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\nThe paper addresses the important problem of transparency for harmlessly data poisoning. The application of provable watermarking is meaningful to this emerging area.\n\nThe work is theoretically sound, providing clear, provable bounds for the proposed schemes under both sample-wise and universal settings. The paper is clearly structured.\n\nWeaknesses:\nThe paper is motivated by recent \"data poisoning for good\" methods like Nightshade and Glaze. However, the experiments are conducted on more traditional clean-label backdoor and availability attacks. It is not immediately clear if the paper's theoretical model, which assumes imperceptible additive noise, directly applies to the complex, style-based perturbations of tools like Glaze. Experiments of such an attack would have made the connection stronger.\n\nThe experiments are conducted on small and traditional architectures (e.g., ResNet-18, VGG-19). This limits the generalizability of the findings to the large-scale scenarios that motivate the work.\n\nThe experiments lack statistical rigor. Results are based on single runs without error bars, as noted in the appendix, which makes it difficult to assess the variance and significance of the empirical claims.", "was_revised": true, "final_justification": "Thanks for the rebuttal.", "rebuttal": "Thanks for your positive feedback and valuable comments. We provide responses below to address your concerns.\n\n**1. How does your theoretical framework apply to the complex perturbations of poisoning-for-good tools like Glaze and Nightshade?**\n\nThanks for your valuable suggestion. We conduct a preliminary experiment on WikiArt Dataset [a], a historical artists dataset to test our watermarking under Glaze protection [b]. Following the setting of Glaze, we finetune Stable Diffusion 2.1 to mimic victim artists’ style under Glaze protection with our post-poisoning and poisoning-concurrent watermarking respectively. We standardize the image of WikiArt to 768*768 and set watermarking dimension $q=5000$ with perturbation budget $\\epsilon=8/255$. For evaluation, beyond AUROC, we follow [b] to test the protection performance using CLIP-based genre shift. Results show that our watermarking achieves high detection performance while keeping the protection of Glaze.\n\n||AUROC|CLIP-based genre shift|\n|-|-|-|\n|Baseline|-|96.0\\%|\n|Post-Poisoning|0.9999|95.8\\%|\n|Poisoning-Concurrent|1.0000|95.3\\%|\n\n**2. The experiments are conducted on small and traditional architectures (e.g., ResNet-18, VGG-19). This limits the generalizability of the findings to the large-scale scenarios that motivate the work.**\n\nWe have evaluated many well-known architectures including ResNet, VGG, DenseNet, MobileNet and Wide-ResNet in Appendix C.2. We further test our post-poisoning and poisoning-concurrent watermarking on ViT-B model [c] under UE, AP availability attacks and Narcissus, AdvSc backdoor attacks with different watermarking length $q$. The patch size is change from 16 to 4 in order to meet with the size of CIFAR-10. Similar conclusions can be summarized from the following results compared with discussions in Tables 1 and 2 in Section 6.2 on ResNet-18. Therefore, we believe our watermarking work well on modern architectures like Transformer.\n\n|Length|UE||AP||\n|-|-|-|-|-|\n|Acc/AUROC|Post-Poisoning|Poisoning-Concurrent|Post-Poisoning|Poisoning-Concurrent|\n|0 (Baseline)|13.82/-|13.82/-|10.99/-|10.99/-|\n|500|12.96/0.816|14.13/0.992|10.83/0.868|11.12/0.954|\n|1000|13.97/0.973|14.80/0.999|10.51/0.979|12.75/0.997|\n|1500|14.25/0.992|14.78/1.000|11.36/0.996|15.86/1.000|\n|2000|14.14/1.000|16.22/1.000|11.38/1.000|18.85/1.000|\n|2500|14.75/1.000|42.38/1.000|11.92/1.000|32.10/1.000|\n|3000|14.66/1.000|92.32/1.000|12.91/1.000|93.25/1.000|\n\n|Length|Narcissus||AdvSc||\n|-|-|-|-|-|\n|Acc/ASR/AUROC|Post-Poisoning|Poisoning-Concurrent|Post-Poisoning|Poisoning-Concurrent|\n|0 (Baseline)|95.13/94.32/-|95.13/94.32/-|94.02/93.58/-|94.02/93.58/-|\n|500|95.16/94.20/0.958|94.98/94.61/0.998|94.13/93.86/0.925|93.76/92.80/0.999|\n|1000|94.87/94.25/0.999|95.25/93.37/1.000|94.32/93.26/0.992|94.23/91.45/1.000|\n|1500|94.99/93.76/1.000|95.36/91.90/1.000|93.25/94.00/0.999|93.41/82.75/1.000|\n|2000|95.01/94.21/1.000|94.76/88.35/1.000|94.13/92.29/1.000|94.36/41.79/1.000|\n|2500|95.32/94.33/1.000|94.98/32.01/1.000|94.02/85.36/1.000|93.98/16.16/1.000|\n|3000|95.12/92.25/1.000|95.12/10.09/1.000|93.51/85.82/1.000|94.12/11.35/1.000|\n\nFurthermore, for text dataset, we implement watermarking ($\\epsilon_w=16/255$) in a backdoor attack on SST-2 dataset with BERT-base model [d], observing similar trends (Section 6) for this NLP task.\n\n||Post-Poisoning|Poisoning-Concurrent|\n|-|-|-|\n|Length|ACC/ASR/AUROC| ACC/ASR/AUROC|\n|0|89.7/98.0/-|89.7/98.0/-|\n|100|89.8/97.8/0.697|89.6/97.2/0.969|\n|200|89.2/97.3/0.852|89.9/96.1/0.983|\n|400|89.6/96.2/0.931|89.3/90.5/0.998|\n|600|89.3/96.7/0.983|89.5/72.3/0.999|\n\nMoreover, according to the suggestion of Reviewer aXke, we further conduct experiments for multi-modal data. Following the experiment of [e], we use the MS-COCO dataset to generate text-image pair, and conduct invisible backdoor attack in the image modality. We test both post-poisoning and poisoning-concurrent watermarking with $q=10000$ and $\\epsilon=2/255$. Results demonstrate perfect detection performance (higher AUROC), decent backdoor performance (higher Benign Accuracy, higher ASR), and good image quality (higher PSNR, higher SSIM, lower MSE).\n\n||AUROC|Benign Accuracy|ASR|PSNR|SSIM|MSE|\n|-|-|-|-|-|-|-|\n|Baseline|-|87.98|71.62|40.50|0.980|0.18|\n|Post-Poisoning|1.0000|88.02|71.93|36.78|0.974|0.25|\n|Poisoning-Concurrent|1.0000|87.95|68.23|39.41|0.978|0.23|\n\n**3. The lack of error bars.**\n\nThanks for your advice. We run both post-poisoning and poisoning-concurrent watermarking with $q=1000$ under UE, AP availability attacks and Narcissus, AdvSc backdoor attacks for five times on different random seeds. Results shown below demonstrate that our watermarking are not sensitive to random seeds.\n\n|Acc/ASR/AUROC|UE|AP|Narcissus|AdvSc|\n|-|-|-|-|-|\n|Post-Poisoning|11.42$\\pm$0.72/-/0.9503$\\pm$0.0065|10.56$\\pm$0.31/-/0.9735$\\pm$0.0112|94.43$\\pm$0.23/92.36$\\pm$1.05/0.9974$\\pm$0.0008|92.94$\\pm$0.32/94.93$\\pm$1.90/0.9806$\\pm$0.0057|\n|Poisoning-Concurrent|9.97$\\pm$0.66/-/0.9993$\\pm$0.0006|20.95$\\pm$2.32/-/0.9950$\\pm$0.0021|94.36$\\pm$0.18/91.85$\\pm$1.74/0.9990$\\pm$0.0006|92.99$\\pm$1.05/85.22$\\pm$3.47/0.9995$\\pm$0.0003|\n\n**4. The DP noise defense invalidates the model's utility. Can you discuss a more realistic adaptive attack where an adversary tries to remove the watermark while preserving model utility?**\n\nOur watermarking algorithms are either robust to existing attacks, or induce attacks to degrade poisoning utilities, which means our watermarking under poisoning are effective and without negative impact. For potential adaptive attacks, we can consider a scenario that requiring higher ability for attackers: Assuming that attackers have both watermarked and non-watermarked images, and they can detect them effectively (e.g., obtaining the secret key). Our watermarks can be removed by simply subtract the average of watermarked images and which of the non-watermarked images as our watermarking are universal typically. For more finely designed adaptive attacks, we will take them as the future work.\n\n\nRef:\n\n[a] Saleh and Elgammal. Large-scale classification of fine-art paintings: Learning the right metric on the right feature. arXiv:1505.00855.\n\n[b] Shan et al. Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models. USENIX Security 23.\n\n[c] Dosovitskiy et al. An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale. ICLR 2021.\n\n[d] Gan et al. Triggerless Backdoor Attack for NLP Tasks with Clean Labels. NAACL 2022.\n\n[e] Zhang et al. BadCM: Invisible Backdoor Attack Against Cross-Modal Learning. IEEE TIP 2024."}, {"review_id": "5BZ9Usv3A2", "reviewer": "Reviewer_RfGy", "summary": "This paper proposes a provable watermarking framework for poisoned datasets, addressing the question of how to embed a detectable signal alongside backdoor or availability poisons. The core idea is to add an additional perturbation to the poisoned data so that a trusted user with the correct key can verify whether the data was poisoned intentionally. The authors formalize the detection condition, provide theoretical bounds showing that the watermark is statistically detectable under budget constraints, and run extensive experiments across different poisoning methods (e.g., backdoors, unlearnable examples) on standard image benchmarks. They show that the watermark achieves high AUROC for detection while preserving the intended poisoning effect.", "questions": "The points raised in the **Weaknesses** section already outline my main questions and requests for clarification. In particular, I would appreciate clear answers or additional evidence regarding the real-world threat model and use cases, the practical management and security of the watermark key, the justification for separating poison and watermark instead of unifying them, and whether the method can withstand adaptive removal targeting only the watermark signal.\n\nAddressing these questions would directly strengthen the practical relevance of the paper and would contribute to revising my rating positively.", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "### Strengths\n\n- **Clear formal framework:** The paper presents a clean mathematical formulation, deriving explicit scaling laws for detection probability and showing how the watermark perturbation budget relates to detectability.\n\n- **Sound empirical validation:** The experiments cover multiple threat types (backdoors, availability poisons) and confirm the theoretical soundness. They check that adding the watermark does not significantly degrade the poison’s intended effect.\n\n- **Robustness checks:** The authors evaluate the watermark under basic data augmentations and simple regeneration defenses, and show that random incorrect keys produce only random-guess detection performance, which supports the claim that the key is non-trivial to guess.\n\n\nOverall, the paper’s theoretical contributions are sound and well-supported by experiments. However, the idea of combining poisoning with a provable watermark is questionable.\n \n\n\n\n### Weaknesses\n\n1- **Practical Threat Model and Real-World Use**\n\nThe formal analysis and proofs are clear, but the practical story here still feels pretty abstract. The authors assume there’s a scenario where someone deliberately poisons their own data to protect it (like using unlearnable examples) and wants to help “good” users avoid accidentally using that poison by adding a watermark and secret key. But in practice, it’s not obvious who would really do this. If you want to protect your data from misuse, you can just license it properly, publish a hash, or provide a clean version for trusted partners — you don’t necessarily need an extra hidden signal inside the data.\n\nI’d like to see a concrete example of how this actually plays out: Who exactly is sharing poisoned data and a watermark key? Who runs the detection? How is the key managed and trusted in real-world distribution? For instance — an artist uploading watermarked UE images to the internet doesn’t really have a clear way to send keys to every possible good-faith user. Without this piece, it’s hard to see how this idea moves beyond an interesting theoretical guarantee.\n\nOverall, I’d encourage the authors to ground this threat model in a realistic scenario and explain who the real users are and how they’d benefit. This would help connect the theory to a clearer real-world story.\n\n---\n\n2- **Use of Separate Watermark and Poison Perturbations**\n\nThe authors do not sufficiently motivate why the poison itself cannot be designed to serve as a watermark, or vice versa. For backdoor attacks, it is well established that the backdoor trigger itself naturally functions as a watermark: for example, [arXiv:1802.04633v3], [arXiv:2208.00563v2], and [arXiv:2305.12502] all demonstrate that hidden backdoor patterns can double as watermarks to prove intellectual property ownership without requiring any additional watermark noise.\n\nMore generally, for both backdoor and availability attacks, the paper does not analyze whether the watermark perturbation could itself be crafted to serve as the poison — that is, whether a unified perturbation could achieve both detectability and attack effectiveness simultaneously. For availability poisoning, this might require designing the unlearnable noise to embed a structured, provable pattern, rather than adding a separate signal. Such a joint design could reduce the total perturbation budget, simplify implementation, and remove the need to split the signal across separate dimensions or budgets.\n\nOverall, I recommend the authors clarify and empirically test whether separate perturbations are truly necessary for both attack classes, or whether a combined poison–watermark perturbation could achieve the same provable guarantees while simplifying the threat model and deployment.\n\n---\n\n3- **Key Management and Forgery Risk**\n\nThe proposed watermark relies entirely on the secrecy of the key vector \\(\\zeta\\), which determines the detection mechanism. While the paper demonstrates that using a random incorrect key results in random-guess performance (AUROC ≈ 0.5), it does not discuss how this key should be securely generated, stored, or distributed to legitimate users in real-world scenarios. If the key were to leak or be exposed during dataset sharing or verification, an adversary could potentially remove the watermark by reversing or masking the known perturbation, or forge a similar watermark on unrelated clean data.\nTo strengthen this aspect, I suggest the authors clarify:\n- How the key \\(\\zeta\\) should be generated and kept confidential in practical deployment.\n- How authorized users should receive or verify the key without risking exposure.\n- Whether there are simple binding or signature mechanisms that could make the watermark non-forgeable if the key is ever leaked.\n\nWithout addressing this, the scheme’s detectability guarantee depends entirely on perfect secrecy of the key, which may be unrealistic in open data sharing settings.\n\n---\n\n4- **Adaptive Removal Risk Due to Poison–Watermark Separation**\n\nA core feature of the proposed method is that the poisoning and watermarking perturbations are explicitly separated into different sets of dimensions (or partially separated). While this makes the theoretical analysis clear, it also creates a practical risk: an adaptive attacker who knows or estimates which dimensions carry the watermark could remove only the watermark perturbation while preserving the poison effect. For example, an attacker could analyze multiple samples to identify the watermark dimensions, then mask, smooth, or overwrite only those dimensions, leaving the poison untouched. If this works, the watermark detectability would fail while the attack’s intended effect would remain intact, undermining the claimed provable ownership.\n\nRecent work ([arXiv:2309.16952v2]) shows that even stronger adaptive attacks are feasible: attackers can use optimization-based surrogate key recovery and iterative removal to erase hidden watermarks with minimal visible distortion. This result demonstrates that modern watermark removal is not purely theoretical but practical, and particularly relevant for sparse, separable perturbations like the one proposed here.\nTo clarify real-world robustness, I strongly recommend that the authors add an experiment that directly tests this threat. Concretely, they could: (1) simulate an attacker who removes or masks only the known watermark dimensions; (2) test whether the watermark detection AUROC drops to random; (3) verify whether the poison’s effect (e.g., attack success rate or degradation of model performance) stays intact; and (4) optionally compare with a simple optimization-based removal approach as demonstrated by Lukas et al. If the watermark is easily removed while the poison remains, this would show that the explicit separation makes the signal vulnerable and highlight the need to consider partial overlap or a hybrid joint design.", "was_revised": true, "final_justification": "The paper is theoretically sound, providing bounds for poison and watermarking perturbations, which I find timely and relevant. The authors have also addressed my concerns regarding adaptive attacks", "rebuttal": "Thanks for your insightful comments and valuable suggestions. We provide responses below to address your concerns.\n\n**1. Practical Threat Model and Real-World Use.**\n\nAny copyright owners can deploy our watermarking when releasing their original datasets to a third party (e.g., AI training platforms, academic institutions and copyright certification systems). To make the threat model more concrete, we will provide a detailed deployment scenario below.\n\nA company (called Alice) that collects a large proprietary dataset for autonomous driving research (e.g., dash cam video frames). She wants to open source a part of her dataset to promote innovation for community (e.g., Non-profit research organization), but also want to prevent unlicensed users to train a machine learning model on it successfully to protect her intellectual property. \n\nTo achieve the above goals, Alice runs our poisoning+watermarking algorithm on every instance of their dataset, publishing the perturbed (i.e., protected) dataset which is unlearnable by standard models and obtains a secret, key dependent watermark signal. She publishes this on her GitHub under a permissive license, accompanied by a SHA256 hash so any recipient can verify integrity.\n\nA research lab (called Bob) registers on Alice’s portal and agree to a standard agreement for legal use of the dataset. After approval by Alice, Bob receives a secret key (e.g., a 128 bit seed) provided via Alice’s portal’s secure HTTPS channel. Furthermore, Bob also gains a pipeline (e.g., Python pre processing package) from Alice such that he can run the watermark detection to verify his identity and ensure that no file corruption. After the verification, Bob can run an algorithm designed by Alice (e.g., directly adding inverse unlearnable noise for each data) to remove the unlearnable poisons. If the pipeline receives wrong key or tampered file, the detection fails and the poisons cannot be removed to ensure the unlearnability.\n\nFor a malicious user (called Chad), first, Chad can download the same public poisoned and watermarked dataset, but cannot train a good model on it because the dataset is unlearnable. If Chad tries to remove or tamper watermarks and unlearnable poisons without knowing the secret key, detection will fail.\n\nFor key management, Alice can rotate keys per month and publish on her portal only to approved accounts (i.e., trusted users). Alice can also add a HMAC scheme to prevent potential forgery risks (please see our response to Q3 for the detailed answer).\n\nCompared with licensing and hash approach as you suggested, our poisoning and watermarking approach can deter unauthorized use of the data in model training, giving data owners capability for prevention without inducing heavy overhead. Licensing and hash can only prove file integrity, fail to prevent a malicious user Chad to train a well-performed model when the data is leaked.\n\n**2. Use of Separate Watermark and Poison Perturbations.**\n\nIn practice, the poisons (both backdoor attacks and availability attacks) are sample-wise noises, that means every sample is injected with a specific poisoning noise. However, practical watermarking proposed in our scheme becomes universal, which makes it easier for key management, using a single detection key. Therefore, if we try to use the combined poison–watermark perturbation, we also need to make poisons become universal noises. Unfortunately, if we want to design universal poisons for the dataset, the poisoning utility is completely destroyed. As the result demonstrated, Universal UE and AP will recover the test accuracy to almost 90\\%, completely violate the goal of availability attacks: make dataset unlearnable. Similar trends also have been shown for universal backdoor attacks, the ASR drop to about 10\\%, resulting in the failure of backdoor triggers.\n\n|Acc|UE|AP|\n|-|-|-|\n|Sample-wise(baseline)|10.79|8.53|\n|Universal|88.75|89.34|\n\n|Acc/ASR|Narcissus|AdcSc|\n|-|-|-|\n|Sample-wise(baseline)|94.69/95.04|92.80/95.53|\n|Universal|95.13/11.02|93.89/10.00|\n\nFor potential direct watermarking with backdoor attacks ([arXiv:1802.04633v3], [arXiv:2208.00563v2], and [arXiv:2305.12502]), we highlight that these works are model watermarking, which embed watermarking signals into model parameters to achieve model ownership verification. However, our paper considers the provable watermarking under poisoned dataset (rather than model), to discern legitimate users and avoid unauthorized use for potential malicious users. Even if model parameters are unavailable, a legitimate user can still detect watermarking of the dataset with their secret key.\n\n**3. Key Management and Forgery Risk.**\n\nAs our answer in Q1, Alice can rotate keys per month and publish on their portal only to approved accounts (i.e., trusted users). Alice can also add a HMAC scheme to prevent potential forgery risks. Specifically, we can separate keys into generation key $k_{gen}$ and authentication key $k_{auth}$, where $k_{gen}$ is completely same with our paper and correlate with injected watermarks $w_i$ for every data $x_i$. For each perturbed $ \\hat{x_i}$ with $w_i$, we can compute an additional tag $t_i$ by HMAC under $k_{auth}$, i.e., $t_i = HMAC_{k_{auth}}(id_i, \\hat{x_i})$, where $id_i$ is a unique identifier for the image $x_i$ (e.g., index). After that, we store the ($id_i, t_i$) pair (e.g., through a sidecar JSON) for latter detection. In watermarking detection, beyond traditional detection using $k_{gen}$ and $ \\hat{x_i}$, we also verify the tag with $t_i$ and $t_i = HMAC_{k_{auth}}(id_i, \\hat{x_i})$ to avoid the potential forgery attacks. In this case, even if the generation key $k_{gen}$ leaks, an attacker cannot forge a new valid $(x_i, t_i)$ pair as they lack the authentication key $k_{auth}$. We can keep $k_{auth}$ in a secure enclave and rotate it independently with $k_{gen}$ to enhance the security.\n\n**4. Adaptive Removal Risk Due to Poison–Watermark Separation.**\n\nThanks for your suggestion. We conduct additional experiments on UE and AP with direct masking of the known watermarking dimensions (Masking), as well as the adversarial noising proposed by [arXiv:2309.16952v2]. We test both post-poisoning and poisoning-concurrent watermarking under $q=2000$. As the results shown below, although the detection performance (AUROC) drops, the utility of UE and AP also degrade significantly. The underlying reasons may be that availability attacks are designed with potential linear shortcut features [a,b], the masking of watermarking dimensions somehow destroy these linear features, undermining the unlearnability (low Acc). Adversarial Noising further destroys the poisoning utility as availability attacks are theoretically removed by perfect adversarial training [c]. Therefore, these adaptive removal attacks fail to maintain the poisoning utility, making them not applicable in our cases, similar with DP noises and purifications discussed in our Appendix D.\n\n|Acc/AUROC| Baseline |Masking | Adversarial Noising |\n|-|-|-|-|\n|UE(Post-Poisoning)|9.06/0.9992|60.71/0.4998|72.90/0.5893|\n|AP(Post-Poisoning)| 10.48/0.9987|56.85/0.5005|76.21/0.5616|\n|UE(Poisoning-Concurrent)| 10.03/1.0000|55.49/0.5014|68.37/0.6206|\n|AP(Poisoning-Concurrent)| 38.62/1.0000|59.87/0.5002|74.63/0.5833|\n\n\nRef:\n\n[a] Yu et al. Availability Attacks Create Shortcuts. KDD 2022.\n\n[b] Zhu et al. Defense of Unlearnable Examples. AAAI 2024.\n\n[c] Tao et al. Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training. NeurIPS 2021."}, {"review_id": "88e10gqM3P", "reviewer": "Reviewer_9Mfj", "summary": "1.  Theoretical soundness: Formal bounds on watermarking length for detectability and utility.\n\n2.  Practical applicability: Demonstrated effectiveness on real-world poisoning attacks.\n\n3.  Transparency: Addresses ethical concerns by enabling poisoned dataset identification.", "questions": "1. Generalizability: Could the framework extend to noisy-label or targeted poisoning attacks? If not, what are the fundamental barriers?\n\n2. Scalability: How does watermarking perform on low-dimensional data (e.g., tabular) where  d is small?\n\n3. Defense Mitigation: Could adaptive watermarking (e.g., dynamic watermark)   improve robustness against purification attacks?", "limitations": "Yes, limitations are acknowledged (e.g., necessity of large N, sensitivity to defenses).", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "Strengths\n\nQuality: Rigorous theoretical analysis with proofs in appendices. Experiments validate claims across diverse attacks and models.\n\nClarity: Well-structured; theoretical and empirical sections are clearly separated. Figures/tables aid understanding.\n\nSignificance: Addresses a critical gap in responsible data poisoning (e.g., ownership verification, misuse prevention).\n\nOriginality: First work to integrate watermarking with poisoning attacks, with novel distinctions between post-poisoning and concurrent schemes.\n\nWeaknesses\n\nEvaluation Scope: Limited to imperceptible clean-label attacks; broader attack types (e.g., noisy-label) could strengthen generality.\n\nPractical Constraints: Assumes large N and d for theoretical guarantees; impact on small-scale datasets is unclear.\n\nDefense Robustness: Watermarking detectability degrades under diffusion purification (Table 12), though poisoning utility is also neutralized.", "was_revised": true, "final_justification": "The authors provide multiple perspectives on their work in their rebuttal, and I maintain my score.", "rebuttal": "Thanks for your positive feedback and valuable comments. We provide responses below to address your concerns.\n\n**1. Limited to imperceptible clean-label attacks; Could the framework extend to noisy-label or targeted poisoning attacks?**\n\nThanks for your advice. Beyond clean-label attacks, we extend our experiments to dirty-label backdoor attacks in order to strengthen our findings. We evaluate three dirty-label attacks, including BadNet attack [a], Trojaning attack [b] and Invisible attack [c] on CIFAR-10 dataset. Following the original setting, in BadNet attack, we set the poisoning rate be 0.1, in Trojaning attack and Invisible attack, we set the poisoning rate be 0.05 and poisoning budget be $8/255$ under $L_{\\inf}$ norm. We test both post-poisoning and poisoning-concurrent watermarking with length $q=1000$. Results shown that our watermarking algorithms embed well on these dirty-label backdoor attacks, achieve high test performance (AUROC) without affecting the poisoning utility (Acc and ASR).\n\n|Acc/ASR/AUROC|BadNet attack|Trojaning attack|Invisible attack|\n|-|-|-|-|\n|Baseline|0.52/0.93/-|0.91/0.96-|0.91/0.99/-|\n|Post-Poisoning|0.52/0.92/0.9986|0.92/0.96/0.9983|0.90/0.99/0.9989|\n|Poisoning-Concurrent|0.49/0.88/0.9998|0.89/0.97/0.9999|0.90/0.98/1.0000|\n\nFor targeted poisoning attacks, we further conduct our experiments to two well-known attacks, Poison Frogs [d] and Witches Brew [e] on CIFAR-10 dataset with post-poisoning and poisoning-concurrent watermarking under $q=1000$. Similar trends shown in our results demonstrate the effectiveness of our watermarking under targeted poisoning attacks.\n\n|Target Acc/AUROC|Poison Frogs|Witches Brew|\n|-|-|-|\n|Baseline|0.53/-|0.82/-|\n|Post-Poisoning|0.53/0.9991|0.81/0.9990|\n|Poisoning-Concurrent|0.51/1.0000|0.79/1.0000|\n\n**2. Assumes large N and d for theoretical guarantees. How does watermarking perform on low-dimensional data (e.g., tabular) where d is small?**\n\nAlthough in theoretical results, it may require larger sample number $N$ and data dimension $d$, in practice, we find that our watermarking schemes work well for relatively low-dimension dataset. For instance, we test our watermarking under BadNet backdoor attacks on MNIST dataset ($d=768$) and USPS dataset ($d=256$). We set $q=400$ for MNIST and $q=150$ for USPS. Evaluation provided below demonstrate that, even for relatively low-dimensional dataset, both post-poisoning and poisoning-concurrent watermarking still display good detection performance as well as keeping backdoor utilities.\n\n|Acc/ASR/AUROC|MNIST|USPS|\n|-|-|-|\n|Baseline|0.98/1.00/-|0.62/0.87/-|\n|Post-Poisoning|0.98/1.00/0.9932|0.63/0.84/0.9815|\n|Poisoning-Concurrent|0.98/1.00/0.9977|0.61/0.78/0.9952|\n\nFor tabular data, since most of them contain a large number of discrete/categorical variables (e.g., gender, regional code, risk level, etc.), the setting of imperceptible poisoning noises on such features often destroys semanticity. Therefore, it may not exist the scenario that using small perturbed data for copyright protection under tabular data. We may leave the watermarking of tabular data poisoning as the future work.\n\n**3. Defense Mitigation: Could adaptive watermarking (e.g., dynamic watermark) improve robustness against purification attacks?**\n\nThanks for your valuable suggestion. For potential adaptive watermarking, we may train a surrogate network (encoder) to transfer universal watermarking into sample-wise version while keep the detection key be single. In this case, watermarks can be more elaborate and robust against stronger removal attacks, e.g., purification attacks. However, as our main focus on this paper is to provide a provable watermarking for data poisoning attacks, similar theoretical guarantees under more elaborate and adaptive watermarking may require more detailed analyses and rigorous proofs. We will add these discussions into the limitation and leave them as the future work.\n\nRef:\n\n[a] Gu et al. BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain. arXiv:1708.06733.\n\n[b] Liu et al. Trojaning Attack on Neural Networks. NDSS 2018.\n\n[c] Li et al. Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization. arXiv:1909.02742.\n\n[d] Shafahi et al. Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks.\nNeurIPS 2018.\n\n[e] Geiping et al. Witches’ Brew: Industrial Scale Data Poisoning via Gradient Matching. ICLR 2021."}, {"review_id": "MYg3rKSCnn", "reviewer": "Reviewer_aXke", "summary": "The paper proposes a provably detectable watermarking schemes for poisoned datasets, aiming to bring transparency and accountability to the increasingly common use of data poisoning for protective purposes (e.g., copyright enforcement or model misuse prevention). The authors introduce two methods—post-poisoning watermarking and poisoning-concurrent watermarking—which embed subtle, random perturbations into poisoned data using a secret key. They provide theoretical guarantees on detection reliability, showing that the watermark can be statistically verified with high probability without harming the effectiveness of the original poisoning attack. The watermark is invisible to adversaries without the key and remains undetectable unless actively searched for using a tailored test. Experiments on CIFAR-10 across multiple poisoning strategies (e.g., backdoor and availability attacks) confirm that watermark detection is accurate and that the watermark preserves the utility of the poisoning. This work bridges the gap between data poisoning and verifiable data provenance by enabling poisoned data to be both effective and transparently marked.", "questions": "Can you clarify the practical scenarios in which your watermarking scheme would be deployed, and who the intended users are (e.g., researchers, data providers, regulators)? It would be helpful to understand a concrete use case where verifiable watermarking of poisoned data is both necessary and realistically actionable.", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The paper beyond the empricall experiements and want to provide some theorical ganrantee\n\nWeakness:\n1. The overall setting feels disconnected from practical use cases. While the paper introduces a theoretically elegant watermarking mechanism for poisoned datasets, it's unclear who the target users of such a system would be in real-world scenarios. The authors mention legitimate uses of poisoning, such as for copyright protection or to prevent unauthorized model training, but these applications remain underdeveloped in the paper. There is little discussion of actual deployment contexts, potential adopters, or how the watermarking would interact with existing machine learning pipelines. Without a compelling, concrete example of where this would be applied in practice the proposed solution feels somewhat speculative.\n\n2. The writing and presentation could be improved for clarity and accessibility. A notable issue is the inclusion of symbols like “d, ϵ” directly in the abstract and introduction without clear explanation. Readers will not understand what these symbols refer to, and dropping a theoretical scaling law into the abstract hurts readability. Throughout the paper, several mathematical notations and definitions are introduced abruptly, assuming too much background from the reader. Additionally, some sections, such as the experimental setup, could benefit from more structured exposition, as they currently mix theoretical and empirical points in a way that’s hard to follow. Improving clarity in writing would make the paper more accessible to a broader audience.\n\n3. The scope of the experimental evaluation is too limited, especially given the paper’s broader claims. In the introduction, the authors highlight the importance of LLMs and large-scale model training, yet all experiments are conducted on small image datasets like CIFAR-10 using convolutional networks. This creates a significant mismatch between the motivation and the actual evaluation. The effectiveness of the proposed watermarking techniques for high-dimensional or complex data modalities (e.g., text or multimodal data used in LLMs) remains entirely untested. Moreover, real-world model training typically involves significant data preprocessing, augmentation, and noise, none of which are accounted for in the current experiments. As a result, it’s unclear how robust or applicable the method would be in more realistic and challenging settings.", "was_revised": true, "final_justification": "After carefully reading the rebuttal, I believe the authors have addressed most of my initial concerns. I provide the following justification for my updated recommendation:\n\nUse Case Clarification: The authors provided a clear and detailed deployment scenario involving real-world actors, which significantly improved my understanding of the practical use of their watermarking scheme. While I still think the connection to real-world applications could be made more prominent earlier in the paper (e.g., through a motivating use case in the introduction), the rebuttal resolves my main concern regarding applicability.\n\nWriting and Presentation: The authors acknowledged feedback regarding notations and presentation clarity and committed to improving these aspects by adding a symbol table and expanding experimental setup descriptions.\n\nExperimental Scope: The authors expanded their experimental evaluation in the rebuttal, including new tasks (e.g., NLP with SST-2, multi modal with MS-COCO).", "rebuttal": "Thanks for your insightful comments and valuable suggestions. We provide responses below to address your concerns.\n\n**1. The overall setting feels disconnected from practical use cases. Can you clarify the practical scenarios in which your watermarking scheme would be deployed, and who the intended users are (e.g., researchers, data providers, regulators)?...**\n\nAny copyright owners can deploy our watermarking when releasing their original datasets to a third party (e.g., AI training platforms, academic institutions and copyright certification systems). We have already talked about the real-world application of Glaze and NightShade in our introduction. To make the threat model more concrete, we will provide a detailed deployment scenario below.\n\nA company (called Alice) that collects a large proprietary dataset for autonomous driving research (e.g., dash cam video frames). She wants to open source a part of her dataset to promote innovation for community (e.g., Non-profit research organization), but also want to prevent unlicensed users to train a machine learning model on it successfully to protect her intellectual property. \n\nTo achieve the above goals, Alice runs our poisoning+watermarking algorithm on every instance of their dataset, publishing the perturbed (i.e., protected) dataset which is unlearnable by standard models and obtains a secret, key dependent watermark signal. She publishes this on her GitHub under a permissive license, accompanied by a SHA256 hash so any recipient can verify integrity.\n\nA research lab (called Bob) registers on Alice’s portal and agree to a standard agreement for legal use of the dataset. After approval by Alice, Bob receives a secret key (e.g., a 128 bit seed) provided via Alice’s portal’s secure HTTPS channel. Furthermore, Bob also gains a pipeline (e.g., Python pre processing package) from Alice such that he can run the watermark detection to verify his identity and ensure that no file corruption. After the verification, Bob can run an algorithm designed by Alice (e.g., directly adding inverse unlearnable noise for each data) to remove the unlearnable poisons. If the pipeline receives wrong key or tampered file, the detection fails and the poisons cannot be removed to ensure the unlearnability.\n\nFor a malicious user (called Chad), first, Chad can download the same public poisoned and watermarked dataset, but cannot train a good model on it because the dataset is unlearnable. If Chad tries to remove or tamper watermarks and unlearnable poisons without knowing the secret key, detection will fail.\n\nFor key management, Alice can rotate keys per month and publish on her portal only to approved accounts (i.e., trusted users). Alice can also add a HMAC scheme to prevent potential forgery risks, which are raised by Reviewer RfGy, please see our rebuttal to Reviewer RfGy for details.\n\nCompared with licensing+hash approach (proposed by Review RfGy), our poisoning+watermarking approach can deter unauthorized use of the data in model training, giving data owners capability for prevention without inducing heavy overhead. Licensing+hash can only prove file integrity, fail to prevent a malicious user Chad to train a well-performed model when the data is leaked.\n\n**2. The writing and presentation could be improved for clarity and accessibility…**\n\nThanks for your suggestion. $d$ and $\\epsilon$ denotes the data dimension and the perturbation budget respectively, we will add the description in our Abstract and Introduction in the next version. For mathematical symbols, notations or definitions, according to the suggestion of Reviewer 9bm6, we will add a dedicated symbol table in the next version of our paper to enhance the readability. For experimental setup, we will add a detailed description in the Appendix to make it clearer.\n\n**3. The scope of the experimental evaluation is too limited…**\n\nBeyond CIFAR-10, we have already provided additional experiments on CIFAR-100 and TinyImageNet in Appendix C.1. To further validate the effectiveness of our method, for text dataset, we implement watermarking ($\\epsilon_w=16/255$) in a backdoor attack on SST-2 dataset with BERT-base model [a], observing similar trends (Section 6) for this NLP task.\n\n||Post-Poisoning|Poisoning-Concurrent|\n|-|-|-|\n|Length|ACC/ASR/AUROC| ACC/ASR/AUROC|\n|0|89.7/98.0/-|89.7/98.0/-|\n|100|89.8/97.8/0.697|89.6/97.2/0.969|\n|200|89.2/97.3/0.852|89.9/96.1/0.983|\n|400|89.6/96.2/0.931|89.3/90.5/0.998|\n|600|89.3/96.7/0.983|89.5/72.3/0.999|\n\nMoreover, according to the suggestion of Reviewer 91mv, we also conduct a preliminary experiment on WikiArt Dataset [b], a historical artists dataset to test our watermarking under Glaze protection [c]. Following the setting of Glaze, we finetune Stable Diffusion 2.1 to mimic victim artists’ style under Glaze protection with our post-poisoning and poisoning-concurrent watermarking respectively. We standardize the image of WikiArt to 768*768 and set watermarking dimension $q=5000$ with perturbation budget $\\epsilon=8/255$. For evaluation, beyond AUROC, we follow [c] to test the protection performance using CLIP-based genre shift. Results show that our watermarking achieves high detection performance while keeping the protection of Glaze.\n\n||AUROC|CLIP-based genre shift|\n|-|-|-|\n|Baseline|-|96.0\\%|\n|Post-Poisoning|0.9999|95.8\\%|\n|Poisoning-Concurrent|1.0000|95.3\\%|\n\nFurthermore, for multi-modal data, following the experiment of [d], we use the MS-COCO dataset to generate text-image pairs, and conduct invisible backdoor attack in the image modality. We test both post-poisoning and poisoning-concurrent watermarking with $q=10000$ and $\\epsilon=2/255$. Results demonstrate perfect detection performance (higher AUROC), decent backdoor performance (higher Benign Accuracy, higher ASR), and good image quality (higher PSNR, higher SSIM, lower MSE)\n\n||AUROC|Benign Accuracy|ASR|PSNR|SSIM|MSE|\n|-|-|-|-|-|-|-|\n|Baseline|-|87.98|71.62|40.50|0.980|0.18|\n|Post-Poisoning|1.0000|88.02|71.93|36.78|0.974|0.25|\n|Poisoning-Concurrent|1.0000|87.95|68.23|39.41|0.978|0.23|\n\nBeyond these, according to the suggestion of Reviewer 9bm6, we further test our post-poisoning and poisoning-concurrent watermarking on ViT-B model [e] under UE, AP availability attacks and Narcissus, AdvSc backdoor attacks with different watermarking length $q$. The patch size is change from 16 to 4 in order to meet with the size of CIFAR-10. Similar conclusions can be summarized from the following results compared with discussions in Tables 1 and 2 in Section 6.2 on ResNet-18. Therefore, we believe our watermarking work well on modern architectures like Transformer.\n\n|Length|UE||AP||\n|-|-|-|-|-|\n|Acc/AUROC|Post-Poisoning|Poisoning-Concurrent|Post-Poisoning|Poisoning-Concurrent|\n|0 (Baseline)|13.82/-|13.82/-|10.99/-|10.99/-|\n|500|12.96/0.816|14.13/0.992|10.83/0.868|11.12/0.954|\n|1000|13.97/0.973|14.80/0.999|10.51/0.979|12.75/0.997|\n|1500|14.25/0.992|14.78/1.000|11.36/0.996|15.86/1.000|\n|2000|14.14/1.000|16.22/1.000|11.38/1.000|18.85/1.000|\n|2500|14.75/1.000|42.38/1.000|11.92/1.000|32.10/1.000|\n|3000|14.66/1.000|92.32/1.000|12.91/1.000|93.25/1.000|\n\n|Length|Narcissus||AdvSc||\n|-|-|-|-|-|\n|Acc/ASR/AUROC|Post-Poisoning|Poisoning-Concurrent|Post-Poisoning|Poisoning-Concurrent|\n|0 (Baseline)|95.13/94.32/-|95.13/94.32/-|94.02/93.58/-|94.02/93.58/-|\n|500|95.16/94.20/0.958|94.98/94.61/0.998|94.13/93.86/0.925|93.76/92.80/0.999|\n|1000|94.87/94.25/0.999|95.25/93.37/1.000|94.32/93.26/0.992|94.23/91.45/1.000|\n|1500|94.99/93.76/1.000|95.36/91.90/1.000|93.25/94.00/0.999|93.41/82.75/1.000|\n|2000|95.01/94.21/1.000|94.76/88.35/1.000|94.13/92.29/1.000|94.36/41.79/1.000|\n|2500|95.32/94.33/1.000|94.98/32.01/1.000|94.02/85.36/1.000|93.98/16.16/1.000|\n|3000|95.12/92.25/1.000|95.12/10.09/1.000|93.51/85.82/1.000|94.12/11.35/1.000|\n\n\n**4. data preprocessing, augmentation, and noise, none of which are accounted for in the current experiments.**\n\nWe have considered many types of data augmentations, including Random Flip, Cutout, Color Jitter and Grayscale, as well as some regeneration attacks including VAE-based attack and GAN-based attack in Appendix D. Results in Table 10 show quite high robustness of our proposed watermarking. Furthermore, we also evaluate differential privacy noises with both Gaussian and Laplacian mechanism in Table 11, the poisoning utilities have been completely destroyed. Therefore, DP-based defenses are not applicable in our context. For data preprocessing like Normalization, our results (both theoretical and empirical) can be directly expanded with just some affine transformation. For other types of preprocessing, as our watermarking creator can be also served as poisoner (especially in poisoning-concurrent watermarking), they can just add watermarking after preprocessing to ensure the theoretical guarantee of our proposed watermarking.\n\nRef:\n\n[a] Gan et al. Triggerless Backdoor Attack for NLP Tasks with Clean Labels. NAACL 2022.\n\n[b] Saleh and Elgammal. Large-scale classification of fine-art paintings: Learning the right metric on the right feature. arXiv:1505.00855.\n\n[c] Shan et al. Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models. USENIX Security 23.\n\n[d] Zhang et al. BadCM: Invisible Backdoor Attack Against Cross-Modal Learning. IEEE TIP 2024.\n\n[e] Dosovitskiy et al. An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale. ICLR 2021."}]

Author rebuttal:

Meta-review: This paper proposes a provable watermarking approach enabling creators of harmlessly poisoned data to transparently declare their modifications. Before the rebuttal, reviewers recognized the timeliness and practical significance of the problem, as well as the soundness of the theoretical analyses. Nonetheless, they raised concerns about the limited evaluation against stronger or more adaptive attacks and the unclear generalizability of the method. During the rebuttal and discussion periods, the authors addressed these points through additional experiments and extended explanations. Balancing the paper’s clear strengths in problem significance and theoretical rigor against its remaining limitations, I recommend acceptance.
Decision: Accept (poster)