Title: Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand
Venue: NeurIPS 2023
Accepted: yes
Keywords: Ownership Verification

Dataset Protection

Copyright Protection

Backdoor Attack

AI Security
Abstract: The prosperity of deep neural networks (DNNs) is largely benefited from open-source datasets, based on which users can evaluate and improve their methods. In this paper, we revisit backdoor-based dataset ownership verification (DOV), which is currently the only feasible approach to protect the copyright of open-source datasets. We reveal that these methods are fundamentally harmful given that they could introduce malicious misclassification behaviors to watermarked DNNs by the adversaries. In this paper, we design DOV from another perspective by making watermarked models (trained on the protected dataset) correctly classify some `hard' samples that will be misclassified by the benign model. Our method is inspired by the generalization property of DNNs, where we find a \emph{hardly-generalized domain} for the original dataset (as its \emph{domain watermark}). It can be easily learned with the protected dataset containing modified samples. Specifically, we formulate the domain generation as a bi-level optimization and propose to optimize a set of visually-indistinguishable clean-label modified data with similar effects to domain-watermarked samples from the hardly-generalized domain to ensure watermark stealthiness. We also design a hypothesis-test-guided ownership verification via our domain watermark and provide the theoretical analyses of our method. Extensive experiments on three benchmark datasets are conducted, which verify the effectiveness of our method and its resistance to potential adaptive methods.

Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand

Abstract

The prosperity of deep neural networks (DNNs) is largely benefited from opensource datasets, based on which users can evaluate and improve their methods. In this paper, we revisit backdoor-based dataset ownership verification (DOV), which is currently the only feasible approach to protect the copyright of opensource datasets. We reveal that these methods are fundamentally harmful given that they could introduce malicious misclassification behaviors to watermarked DNNs by the adversaries. In this paper, we design DOV from another perspective by making watermarked models (trained on the protected dataset) correctly classify some 'hard' samples that will be misclassified by the benign model. Our method is inspired by the generalization property of DNNs, where we find a hardly-generalized domain for the original dataset (as its domain watermark ). It can be easily learned with the protected dataset containing modified samples. Specifically, we formulate the domain generation as a bi-level optimization and propose to optimize a set of visually-indistinguishable clean-label modified data with similar effects to domain-watermarked samples from the hardly-generalized domain to ensure watermark stealthiness. We also design a hypothesis-test-guided ownership verification via our domain watermark and provide the theoretical analyses of our method. Extensive experiments on three benchmark datasets are conducted, which verify the effectiveness of our method and its resistance to potential adaptive methods. The code for reproducing main experiments is available at https://github.com/JunfengGo/Domain-Watermark .

1 Introduction

Deep neural networks (DNNs) have been applied to a wide range of domains and have shown human-competitive performance. The great success of DNNs heavily relies on the availability of various open-source datasets ( e.g. , CIFAR [1] and ImageNet [2]). With these high-quality datasets, researchers can evaluate and improve the proposed methods upon them. Currently, most of these datasets limit their usage to education or research purpose and are prohibited from commercial applications without authorization. How to protect their copyrights is of great significance [3, 4, 5, 6].

Train

DNN Models

Stage I: Dataset Watermarking

Backdoored DNN

Benign DNN

Ours

Stage III: Ownership Verification

Ground-truth

Label

Ground-truth

Label

BW Sample

DW Sample

(Ours)

Harmful

Verification

Harmless

Verification

Adversary User

Stage II: Unauthorized Training

Protected Dataset

Release

Currently, there are many classical methods for data protection, such as encryption [7, 8, 9], differential privacy [10, 11, 12], and digital watermarking [13, 14, 15, 16]. However, they are not able to protect the copyrights of open-source datasets since they either hinder the dataset accessibility ( e.g. , encryption) or require the information of the training process ( e.g. , differential privacy and digital watermarking) of suspicious models that could be trained on it.

To the best of our knowledge, backdoor-based dataset ownership verification (DOV) [3, 4, 5] is currently the only feasible approach to protect them, where defenders exploit backdoor attacks [17, 18, 19] to watermark the original dataset such that they can verify whether a suspicious model is trained on the protected dataset by examining whether it has specific backdoor behaviors. Recently, Li et al . [4] first discussed the 'harmlessness' requirement of backdoor-based DOV that the dataset watermark should not introduce new security risks to models trained on the protected dataset and proposed untargeted backdoor watermarks towards harmless verification by making the predictions of watermarked samples dispersible instead of deterministic (as a pre-defined target label).

In this paper, we revisit dataset ownership verification. We argue that backdoor-based dataset watermarks can never achieve truly harmless verification since their fundamental mechanism is making watermarked model misclassifies 'easy' samples ( i.e. , backdoor-poisoned samples) that can be correctly predicted by the benign model (as shown in Figure 1). It is with these particular misclassification behaviors that the dataset owners can conduct ownership verification. An intriguing question arises: Is harmless dataset ownership certification possible to achieve ?

The answer to the aforementioned problem is positive. In this paper, we design dataset ownership verification from another angle, by making the watermarked model can correctly classify some 'hard' samples that will be misclassified by the benign model. Accordingly, we can exploit this difference to design ownership verification while not introducing any malicious prediction behaviors to watermarked models that will be deployed by dataset users (as shown in Figure 1). In general, our method is inspired by the generalization property of DNNs, where we intend to find a hardly-generalized domain for the original dataset. It can be easily learned with the protected dataset containing modified samples. Specifically, we formulate the domain generation as a bilevel optimization and leverage a transformation module to generate domain-watermarked samples; We propose to optimize a set of visually-indistinguishable modified data having similar effects to domain-watermarked samples as our domain watermark to ensure the stealthiness of dataset watermarking; We design a hypothesis-test-guided method to conduct ownership verification via our domain watermark at the end. We also provide theoretical analyses of all stages in our method.

In conclusion, the main contributions of this paper are four-folds: 1) We revisit dataset ownership verification (DOV) and reveal the harmful drawback of methods based on backdoor attacks. 2) We explore the DOV problem from another perspective, based on which we design a truly harmless DOV method via domain watermark. To the best of our knowledge, this is the first non-backdoor-based DOVmethod. Our work makes dataset ownership verification become an independent research field instead of the sub-field of backdoor attacks. 3) We discuss how to design the domain watermark and provide its theoretical foundations. 4) We conduct experiments on benchmark datasets, verifying the effectiveness of our method and its resistance to potential adaptive methods.

2 Related Work

2.1 Backdoor Attacks

Backdoor attack 2 [23, 24, 25] is a training-phrase threat of DNNs, where the adversary intends to implant a backdoor ( i.e. , the latent connection between the adversary-specified trigger pattern and the target label) into the victim model by maliciously manipulating a few training samples. The backdoored DNNs behave normally while their predictions will be maliciously changed to the target label whenever the testing samples contain the trigger pattern. In general, existing backdoor attacks can be divided into two main categories based on the property of the target label, as follows:

Poisoned-Label Backdoor Attacks. In these attacks, the target label of poisoned samples is different from their ground-truth labels. This is the most classical attack paradigm and is more easily to implant hidden backdoors. For example, BadNets [17] is the first backdoor attack, where the adversaries randomly modify a few samples from the original dataset by attaching a pre-defined trigger patch to their images and changing their labels to the target label. These modified samples (dubbed poisoned samples ) associated with remaining benign samples are packed as the poisoned dataset that is released to victim users for training; After that, Chen et al . [26] improved the stealthiness of BadNets by introducing trigger transparency; Nguyen et al . [27] proposed a more stealthy backdoor attack whose trigger patterns were designed via image-warping; Recently, Li et al . [4] proposed the first untargeted (poisoned-label) backdoor attack ( i.e. , UBW-P) for dataset ownership verification.

Clean-Label Backdoor Attacks. In these attacks, the target label of poisoned samples is consistent with their ground-truth labels. Accordingly, these attacks are more stealthy, compared to the poisoned-label ones. However, they usually suffer from low effectiveness, especially on datasets with a high image resolution or many classes, due to the antagonistic effects of 'robust features' related to the target class contained in poisoned samples [28]. Label-consistent attack is the first cleanlabel attack where the adversaries introduced untargeted adversarial perturbations before adding trigger patterns; After that, a more effective attack ( i.e. , Sleeper Agent [29]) is proposed, which crafts clean-label poisoned samples via bi-level optimization; Recently, Li et al . [4] proposed UBW-C, which generated poisoned samples for leading untargeted misclassifications to attacked DNNs.

2.2 Data Protection

Classical Data Protection. Data protection is a classical and important research direction, aiming to prevent unauthorized data usage or protect data privacy. Currently, existing classical data protection can be roughly divided into three main categories, including (1) encryption, (2) digital watermarking, and (3) privacy protection. Specifically, encryption [30, 7, 8] encrypts the whole or parts of the protected data so that only authorized users who hold a secret key for decryption can use it; Digital watermarking [31, 32, 33] embeds an owner-specified pattern to the protected data to claim the ownership; Privacy protection focuses on preventing the leakage of sensitive information of the data in both empirical [34, 35, 36] and certified manners [10, 37, 12]. However, these traditional approaches are not feasible to protect the copyright of open-source datasets since they either hinder the dataset accessibility or require the information of the training process that will not be disclosed.

Dataset Ownership Verification. Dataset ownership verification (DOV) is an emerging topic in data protection, aiming to verify whether a given suspicious model is trained on the protected dataset. To the best of our knowledge, this is currently the only feasible method to protect the copyright of open-source datasets. Specifically, it intends to implant specific prediction (towards verification samples) behaviors in models trained on the protected dataset while not reducing their performance on benign samples. Dataset owners can conduct ownership verification by examining whether the suspicious model has these behaviors. Currently, all DOV methods [3, 4, 5] exploit backdoor attacks to watermark the unprotected benign dataset. For example, [3] adopted poisoned-label backdoor attacks while [5] adopted clean-label ones for dataset watermarking. Recently, Li et al . [4] first discussed the 'harmlessness' requirement of DOV that the dataset watermark should not introduce new security risks to models trained on the protected dataset and proposed the untargeted backdoor watermarks. However, there is still no definition of harmlessness and backdoor-based DOV methods

can never achieve truly harmless verification for they introduce backdoor threats. How to design a harmless DOV method is still an important open question.

3 Domain Watermark

3.1 Preliminaries

Threat Model. Following existing works in dataset ownership verification [3, 4, 5], we assume that the defenders ( i.e. , dataset owners) can only watermark the benign dataset to generate the protected dataset . They will release the protected dataset instead of the original benign dataset for copyright protection. Given a third-party suspicious model that may be trained on the protected dataset without authorization, we consider the black-box setting where defenders have no information about other training configurations ( e.g. , loss function and model architecture) of the model and can only access it to obtain predicted probability vectors via its model API.

̸

The Main Pipeline of Dataset Watermark. Let D = { ( x i , y i ) } N i =1 denotes the benign training dataset. Let we consider an image classification task with K -classes, i.e. , x i ∈ X = [0 , 1] C × W × H represents the image with y i ∈ Y = { 1 , · · · , K } as its label. Instead of releasing D directly, the dataset owner will generate and release its watermarked version ( i.e. , D w ). Specifically, D w = D m ∪D b , where D m consists of the modified version of samples from a small selected subset D s of D ( i.e. , D s ⊂ D ) and D b contains remaining benign samples ( i.e. , D b = D-D s ). The D m is generated by the defender-specified image generator G x : X → X and the label generator G y : Y → Y , i.e. , D m = { ( G x ( x ) , G y ( y )) | ( x , y ) ∈ D s } . For example, G x = ( 1 -m ) ⊙ t + m ⊙ x and G y = y t in BadNets [17], where m ∈ { 0 , 1 } C × W × H is the trigger mask, t ∈ [0 , 1] C × W × H is the trigger pattern, ⊙ denotes the element-wise product, and y t is the target label. In particular, γ ≜ |D m | |D w | is called the watermarking rate . All models trained on the protected dataset D w will have special prediction behaviors on G x ( x ) for ownership verification. Specifically, let C : X → Y denotes a third-party suspicious model that could be trained on the protected dataset, existing backdoor-based methods will examine whether it conduct unauthorized training by testing whether C ( G x ( x )) = y t . Since y t = y in most cases, these backdoor-based watermarks are harmful.

3.2 Problem Formulation

As described in previous sections, existing backdoor-inspired dataset ownership verification (DOV) methods [3, 4, 5] would cause malicious misclassification on watermarked samples to all models trained on the protected dataset, therefore they are harmful. This limitation of backdoor-based DOV methods cannot be eliminated because their inherent mechanism is to lead the watermarked model to have particular mispredicted behaviors for verification, although the misclassification could be random and less harmful [18]. In this paper, we intend to design a truly harmless DOV method so that the watermarked models will correctly classify watermarked samples . Before we formally define the studied problem, we first provide the definition of harmful degree of a DOV method.

̸

Definition 1 (Harmful and Relatively Harmful Degree) . Let ˆ D = { ( ˆ x i , y i ) } N i =1 indicates a set of watermarked samples used for ownership verification of a DOV method, where ˆ x i is the verification sample with y i ∈ Y as its ground-truth label (instead of its given label). Let ˆ C and C represent a classifier trained on the protected and unprotected datasets, respectively. The harmful degree is H ≜ 1 N ∑ N i =1 I { ˆ C ( ˆ x i ) = y i } and the relatively harmful degree is ˆ H ≜ 1 N ( ∑ N i =1 I { ˆ C ( ˆ x i ) = y i } -∑ N i =1 I { C ( ˆ x i ) = y i } ) where I {·} is the indicator function.

̸

̸

To design a harmless DOV method, we intend to make watermarked DNNs correctly classify some 'hard' samples that will be misclassified by the model trained on the unprotected benign dataset. Inspired by the generalization property of DNNs, we intend to find a hardly-generalized domain of the benign dataset, which can be easily learned with the protected dataset containing the modified samples. In this paper, we call this watermarking method as domain watermark , defined as follows.

Definition 2 (Domain Watermark) . Given a benign dataset D = { ( x i , y i ) } N i =1 , let C : X → Y denotes a model trained on D . Assume that G d denotes a domain generator such that G d ( x i ) owns the same ground-truth label as x i but belongs to a hardly-generalized domain, i.e. , ∑ ( x i ,y i ) ∈D I { C ( x i ) = y i } ≫ ∑ ( x i ,y i ) ∈D I { C ( G d ( x i )) = y i } . We intend to find a watermarked

version of D ( i.e. , D d ) with watermarking rate γ , such that the watermarked model ˆ C trained on it have two properties: (1) 1 N ∑ ( x i ,y i ) ∈D I { ˆ C ( x i ) = y i } ≥ β and (2) 1 N ∑ ( x i ,y i ) ∈D ( I { ˆ C ( x i ) = y i } -I { ˆ C ( G d ( x i )) = y i } ) ≤ τ , where β, τ ∈ [0 , 1] are given parameters. In this paper, D d is defined as the domain watermark of the benign dataset D .

3.3 Generating the Hardly-Generalized Domain

As illustrated in Definition 2, finding a hardly-generalized target domain T (with domain generator G d ) of the source domain S is the first step of our domain watermark. To guide the construction of the domain T , we have the following Lemma 1.

Lemma 1 (Generalization Bound [38]) . The bound of expected risk on a given target domain T is negatively associated with mutual information between features for source S and target T domains:

̸

where R T ( f ) = E ( ˆ x ,y ) ∼T [ I { C ( ˆ x ) = y } ] , R S ( f ) = E ( x ,y ) ∼S [ I { C ( x ) = y } ] . I ( z ; ˆ z ) is mutual information between features from S and T . d H△H ( p ( z ) , p ( ˆ z )) is H△H -divergence for measuring the divergence of feature marginal distributions of two domains, and H ( · ) is the entropy.

̸

Lemma 1 reveals the upper bound of generalization performance on T . Since d H△H ( · ) is intractable and hard to directly optimize, as well as [38] shows that only a I ( · ) is enough for generalization across domains, we propose to increase the expected risk on T by minimizing I ( z ; ˆ z ) .

Specifically, we formulate the design of the target domain T (with the domain generator G d ( · ; θ ) ) as a bi-level optimization, as follows:

where λ 1 , λ 2 are two positive hyper-parameters, and L ( · ) is the loss function ( e.g. , cross entropy).

Following previous works [38] in domain adaption and generalization, we propose to optimize the upper bound approximation for I ( z ; ˆ z ) instead of itself and leverage a transformation module consisting of multiple convolutional operations as G d ( · ; θ ) to generate the domain-watermarked image ˆ x . Specifically, we aim to craft ˆ x via minimizing the upper bound approximation for mutual information [39] between x ∈ D and ˆ x in the latent feature space Z :

where z and ˆ z are the latent vectors obtained by passing x and ˆ x through f ( · ; w ) 's feature extractor. L c ( · ) is the class-conditional maximum mean discrepancy (MMD) computed on the latent space Z and proposed to limit the potential semantic information distortion between x and ˆ x , follows:

where n j , n represent the number for x and ˆ x from class j , and ϕ · is the kernel function.

s j t ( )

The configurations, parameter selections, and model architectures are included in Appendix A.

3.4 Generating the Protected Dataset

Once we obtain the hard-generalized domain generator G d with the method proposed in Section 3.3, the next step is to generate the protected dataset based on it. Before we present its technical details, we first deliver some insight into the data quantity impact for the domain watermark.

Theorem 1 (Data Quantity Impact) . Suppose in PAC Bayesian [40], for a target domain T and a source domain S , any set of voters (candidate models) H , any prior π over H before any training, any ξ ∈ (0 , 1] , any c > 0 , with a probability at least 1 -ξ over the choices of S ∼ S n s and T ∼ T n t X , for the posterior f over H after the joint training on S and T , we have

where ̂ R T ( f ) and ̂ R S ( f ) are the target and source empirical risks measured over target and source datasets T and S , respectively. Ω is a constant and KL( · ) is the Kullback-Leibler divergence. β ∞ ( T ∥S ) is a measurement of discrepancy between T and S defined as

where SUPP( S ) denotes the support of S . When S and T are identical, β ∞ ( T ∥S ) = 1 .

Theorem 1 reveals the upper bound of R T ( f ) is negatively associated with the number of samples for source and target domains ( i.e. , n t and n s ). Assuming n t is fixed, increasing n s can still increase generalization on the target domain. As such, it is possible to combine some domain-watermarked samples with benign samples to achieve target domain generalization. Its proof is in Appendix B.

In general, the most straightforward method to generate our domain watermark for the protected dataset is to randomly select a few samples ( x , y ) from the original dataset D and replace them with their domain-watermarked version ( G d ( x ) , y ) . However, as we will show in the experiments, the domain-watermarked image is usually significantly different from its original version. Accordingly, the adversaries may notice watermarked samples and try to remove them to bypass our defense. To ensure the stealthiness of our domain watermark, we propose to optimize a set of visually-indistinguishable modified data { ( x ′ i , y i ) | x ′ i = x i + δ i } having similar effects to domainwatermarked samples . This is also a bi-level optimization problem, as follows.

where E ( x ,y ) ∼T [ L ( f ( x ; w ( δ )) , y )] represents the expected risk for the watermarked model on other unseen domains ( i.e. , T ) and B = { δ : || δ || ∞ ≤ ϵ } where ϵ is a visibility-related hyper-parameter.

The second term in Eq.(7) is to prevent the watermarked model can achieve a similar generalization performance on other unseen domains as the target domain T to preserve the uniqueness of T for verification purposes. We introduce two parameters λ 3 and λ 4 for preventing the second term dominant in the optimization procedure. λ 4 is set as E ( x ,y ) ∼T [ L ( f ( x ; w ∗ ) , y )] , where w ∗ is obtained by training on the original dataset D . Please find more optimization details in Appendix C.

In particular, our domain watermark is clean-label, i.e. , we do not modify the label of modified samples as have done in most backdoor-based methods. As such, it is more stealthy.

4 Dataset Ownership Verification via Domain Watermark

In this section, we introduce how to conduct dataset ownership verification via our domain watermark. The overview of the entire procedure is shown in Figure 2.

As described in Section 3.2, models trained on our protected dataset (with domain watermark) can correctly classify some domain-watermarked samples while other benign models cannot. Accordingly, given a suspicious third-party model f , the defenders can verify whether it was trained on the protected dataset by examining whether the model has similar prediction behaviors on benign samples and their domain-watermarked version. The model is regarded as trained on the protected

Domain Generator

Minimize Mutual

Information

Benign data

DW data

DW data

Benign data

Generating Domain Watermark

Benign Sample

Modified

Sample

Generating Protected Dataset

Selected

Bi-level

Optimazation

DW data

Benign data

Suspicious DNN

Probability on the

Ground-truth Label

Hypothesis Test:

Ownership Verification

Probability on the

Ground-truth Label

Similar

Effect

dataset if it has similar behaviors . To verify it, we design a hypothesis-test-guided method following previous works [3, 4], as follows.

Proposition 1. Suppose f ( x ) is the posterior probability of x predicted by the suspicious model. Let variable X denotes the benign image and variable X ′ is its domain-watermarked version ( i.e. , X ′ = G d ( X ) ), while variable P b = f ( X ) Y and P d = f ( X ′ ) Y indicate the predicted probability on the ground-truth label Y of X and X ′ , respectively. Given the null hypothesis H 0 : P b = P d + τ ( H 1 : P b < P d + τ ) where the hyper-parameter τ ∈ [0 , 1] , we claim that the suspicious model is trained on the protected dataset (with τ -certainty) if and only if H 0 is rejected.

In practice, we randomly sample m different benign samples to conduct the pairwise T-test [41] and calculate its p-value. The null hypothesis H 0 is rejected if the p-value is smaller than the significance level α . Besides, we also calculate the confidence score ∆ P = P b -P d to represent the verification confidence. The smaller the ∆ P , the more confident the verification .

Theorem 2. Let f ( x ) is the posterior probability of x predicted by the suspicious model, variable X denotes the benign sample with label Y , and variable X ′ is the domain-watermarked version of X . Assume that P b ≜ f ( X ) Y > η . We claim that dataset owners can reject the null hypothesis H 0 at the significance level α , if the verification success rate (VSR) V of f satisfies that

where t α is α -quantile of t-distribution with ( m -1) degrees of freedom and m is sample size.

In general, Theorem 2 indicates that our dataset verification can succeed if the VSR of the suspicious model f is higher than a threshold (which is not necessarily 100%). In particular, the assumption of Theorem 2 can be easily satisfied by using benign samples that can be correctly classified with high confidence. Its proof is included in Appendix D.

5 Experiments

In this section, we conduct experiments on CIFAR-10 [1] and Tiny-ImageNet [42] with VGG [43] and ResNet [44], respectively. Results on STL-10 [45] are in Appendix F.

5.1 The Performance of Domain Watermark

Settings. Weselect seven baseline methods, containing three clean-label backdoor watermarks ( i.e. , Label-Consistent, Sleeper Agent, and UBW-C) and four poisoned-label watermarks ( i.e. , BadNets, Blended, WaNet, and UBW-P). Following the previous work [4], we set the watermarking rate γ = 0 . 1 , perturbation constraint ϵ = 16 / 255 in all cases, and adopt the same watermark patterns and parameters. The example of samples used in different watermarks is shown in Figure 3. For our

WaNet

Golden Fish

Blended

Golden Fish

Golden Fish

BadNets

Golden Fish

UBW-P

Horse

Horse

Label-Consistent

Golden Fish

Sleeper Agent

Golden Fish

UBW-C

Seagull

Seagull

Bear

Ours

Spider

Spider

Dog

Benign

Sample

Modified

Sample

Verification

Sample

method, we set λ 3 = 0 . 3 . We implement all baseline methods based on BackdoorBox [46]. Each result is averaged over five runs. Please find more details in Appendix E.

Evaluation Metrics. We adopt benign accuracy (BA) and verification success rate (VSR) to verify the effectiveness of dataset watermarks. Specifically, the VSR is defined as the percentage that verification samples can be classified as the assigned label ( i.e. , target label of baselines and groundtruth label of our method) by watermarked DNNs. We exploit harmful degree ( H ∈ [0 , 1] ), and relatively harmful degree ( ˆ H ∈ [ -1 , 1] ) to measure watermark harmfulness. In general, the larger the BA and VSR while the smaller the H and ˆ H , the better the dataset watermark.

Results. As shown in Table 1, the benign accuracy of our domain watermark is higher than cleanlabel backdoor watermarks in most cases, especially on the Tiny-ImageNet dataset. In particular, only our method is harmless. For example, both H and ˆ H are 0.7 smaller than those of all baseline methods on CIRAR-10 datasets. Besides, as we will show in the next subsection, the VSR of our method is sufficiently high for correct ownership verification, although the VSR of our method is smaller than that of backdoor-based watermarks (especially on complicated datasets). The VSRs of benign models with our domain-watermarked samples on CIFAR-10 and Tiny-ImageNet are merely 13% and 6%, respectively. This mild potential limitation is because our VSR is restricted by the BA of watermark models. It is an unavoidable sacrifice for harmlessness.

5.2 The Performance of Dataset Ownership Verification via Domain Watermark

Settings. We evaluate our domain-watermark-based dataset ownership verification under three scenarios, including 1) independent domain (dubbed 'Independent-D'), 2) independent model (dubbed

4

8

12

16

Perturbation Budget

/epsilon1

(pixel)

70

80

90

BA / VSR (%)

CIFAR-10

BA

VSR

4

8

12

16

Perturbation Budget

/epsilon1

(pixel)

0

20

40

60

BA / VSR (%)

Tiny-ImageNet

BA

VSR

0 1

4

7

10

Watermarking Rate

γ

(%)

25

50

75

BA / VSR (%)

CIFAR-10

BA

VSR

0 1

4

7

10

Watermarking Rate

γ

(%)

0

20

40

60

BA / VSR (%)

Tiny-ImageNet

BA

VSR

0

20

40

60

80

100

Epoch

0

25

50

75

100

BA / VSR (%)

CIFAR-10

BA

VSR

0

20

40

60

80

100

Epoch

0

20

40

60

BA / VSR (%)

Tiny-ImageNet

BA

VSR

0

20

40

60

80

100

Pruning Rate (%)

0

20

40

60

80

100

BA / VSR (%)

CIFAR-10

BA

VSR

0

20

40

60

80

100

Pruning Rate (%)

0

20

40

60

BA / VSR (%)

Tiny-ImageNet

BA

VSR

'Independent-M'), and 3) unauthorized dataset training (dubbed 'Malicious'). In the first case, we used domain-watermarked samples to query the suspicious model trained with modified samples from another domain; In the second case, we test the benign model with our domain-watermarked samples; In the last case, we test the domain-watermarked model with corresponding domainwatermarked samples. Notice that only the last case should be regarded as having unauthorized dataset use. More setting detail are described in Appendix G.

Evaluation Metrics. Following the settings in [4], we use ∆ P ∈ [ -1 , 1] and p -value ∈ [0 , 1] for the evaluation. For the first two independent scenarios, a large ∆ P and p -value are expected. In contrast, for the third scenario, the smaller ∆ P and p -value, the better the verification.

Results. As shown in Table 2, our method can achieve accurate verification in all cases. Specifically, our approach can identify the unauthorized dataset usage with high confidence ( i.e. , ∆ P ≈ 0 and p -value ≪ 0.01), while not misjudging when there is no unauthorized dataset utilization ( i.e. , ∆ P ≫ 0 and p -value ≫ 0.05). Especially on the CIFAR-10 dataset (with high VSR), the p -values of independent cases are already 1 while that of the malicious scene is 50 powers smaller than a correct verification needs. These results verify the effectiveness of our dataset ownership verification.

5.3 Discussions

5.3.1 Ablation Studies

We hereby discuss the effects of two key hyper-parameters involved in our method ( i.e. , ϵ and γ ). Please find more experiments regarding other parameters and detailed settings in Appendix I.

Effects of Perturbation Budget ϵ . We study its effects on both CIFAR-10 and Tiny-ImageNet datasets. As shown in Figure 4, the VSR increases with the increase of ϵ . In contrast, the BA remains almost stable with different ϵ . However, increasing ϵ would also reduce the invisibility of modified samples. Defenders should assign it based on their specific needs.

Effects of watermarking Rate γ . As shown in Figure 6, similar to the phenomena of ϵ , the VSR increases with the increase of γ while the BA remains almost unchanged on both datasets. In particular, even with a low watermarking rate ( e.g. , 1%), our method can still have a promising VSR. These results verify the effectiveness of our domain watermark again.

5.3.2 The Resistance to Potential Adaptive Methods

We notice that the adversaries may try to detect or even remove our domain watermark based on existing methods in practice. In this section, we discuss whether our method is resistant to them.

Due to the limitation of space, following the previous work [4], we only evaluate the robustness of our domain watermark under fine-tuning [47] and model pruning [48] in the main manuscript. As shown in Figure 6, fine-tuning has minor effects on both the VSR and the BA of our method. Our method is also resistant to model pruning for the BA decreases with the decrease of VSR. We have

also evaluated our domain watermark to more other representative adaptive methods. Please find more setting details and results in our Appendix J.

5.3.3 A Closer Look to the Effectiveness of our Method

In this section, we intend to further explore the mechanisms behind the effectiveness of our domain watermark. Specifically, we adopt tSNE [49] to visualize the feature distribution of different types of samples generated by the benign model and its domain-watermarked version. As shown in Figure 8, the domain-watermarked samples stay away (with the normalized distance as 1.84) from those with their ground-truth label ( i.e. , '0'), although they still cluster together, under the benign model. In contrast, these domainwatermarked samples lay close (with the normalized distance as 0.40) to benign samples having the same class under the watermarked model.

0

1

2

3

4

5

Benign Model

8

DW

6

7

9

These phenomena are consistent with the predictive behaviors of the two models and can partly explain the mechanism of our domain watermark. We will further explore it in our future works.

6 Conclusion

In this paper, we revisited the dataset ownership verification (DOV). We revealed the harmful nature of existing backdoor-based methods because their principle is making watermarked models misclassify 'easy' samples. To design a genuinely harmless DOV method, we proposed the domain watermark by leading watermarked DNNs to correctly classify some defender-specified 'hard' samples. We provided the theoretical analyses of our domain watermark and its corresponding ownership verification. We also verified its effectiveness on benchmark datasets. As the first non-backdoor-based method, our method can provide new angles and understanding to the design of dataset ownership verification to facilitate trustworthy dataset sharing.

Acknowledgments

Junfeng Guo and Heng Huang were partially supported by NSF IIS 1838627, 1837956, 1956002, 2211492, CNS 2213701, CCF 2217003, and DBI 2225775. Cong Liu was supported by the National Science Foundation under Grants CNS Career 2230968, CPS 2230969, CNS 2300525, CNS 2343653, and CNS 2312397.

References

Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009.

Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR , 2009.

Yiming Li, Mingyan Zhu, Xue Yang, Yong Jiang, Tao Wei, and Shu-Tao Xia. Black-box dataset ownership verification via backdoor watermarking. IEEE Transactions on Information Forensics and Security , 2023.

Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, and Bo Li. Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection. In NeurIPS , 2022.

Ruixiang Tang, Qizhang Feng, Ninghao Liu, Fan Yang, and Xia Hu. Did you train on my dataset? towards public dataset protection with clean-label backdoor watermarking. ACM SIGKDD Explorations Newsletter , 2023.

Lixu Wang, Shichao Xu, Ruiqi Xu, Xiao Wang, and Qi Zhu. Non-transferable learning: A new approach for model ownership verification and applicability authorization. In ICLR , 2022.

Dan Boneh and Matt Franklin. Identity-based encryption from the weil pairing. In CRYPTO , 2001.

Paulo Martins, Leonel Sousa, and Artur Mariano. A survey on fully homomorphic encryption: An engineering perspective. ACM Computing Surveys , 2017.

Hua Deng, Zheng Qin, Qianhong Wu, Zhenyu Guan, Robert H Deng, Yujue Wang, and Yunya Zhou. Identity-based encryption transformation for flexible sharing of encrypted data in public cloud. IEEE Transactions on Information Forensics and Security , 2020.

Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In NeurIPS , 2019.

Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In IEEE S&P , 2017.

Jiawang Bai, Yiming Li, Jiawei Li, Xue Yang, Yong Jiang, and Shu-Tao Xia. Multinomial random forest. Pattern Recognition , 2022.

Sahar Haddad, Gouenou Coatrieux, Alexandre Moreau-Gaudry, and Michel Cozic. Joint watermarking-encryption-jpeg-ls for medical image reliability control in encrypted and compressed domains. IEEE Transactions on Information Forensics and Security , 2020.

Run Wang, Felix Juefei-Xu, Meng Luo, Yang Liu, and Lina Wang. Faketagger: Robust safeguards against deepfake dissemination via provenance tracking. In ACM MM , 2021.

Zhenyu Guan, Junpeng Jing, Xin Deng, Mai Xu, Lai Jiang, Zhou Zhang, and Yipeng Li. Deepmih: Deep invertible network for multiple image hiding. IEEE Transactions on Pattern Analysis and Machine Intelligence , 2022.

Yushi Cheng, Xiaoyu Ji, Lixu Wang, Qi Pang, Yi-Chao Chen, and Wenyuan Xu. { mID } : Tracing screen photos via { Moiré } patterns. In USENIX Security , pages 2969-2986, 2021.

Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access , 2019.

Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems , 2022.

Jonathan Hayase and Sewoong Oh. Few-shot backdoor attacks via neural tangent kernels. In ICLR , 2023.

Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. In NeurIPS , 2020.

Yiming Li, Haoxiang Zhong, Xingjun Ma, Yong Jiang, and Shu-Tao Xia. Few-shot backdoor attacks on visual object tracking. In ICLR , 2022.

Jianshuo Dong, Han Qiu, Yiming Li, Tianwei Zhang, Yuanjie Li, Zeqi Lai, Chao Zhang, and Shu-Tao Xia. One-bit flip is all you need: When bit-flip attack meets model training. In ICCV , 2023.

Xiangyu Qi, Tinghao Xie, Yiming Li, Saeed Mahloujifar, and Prateek Mittal. Revisiting the assumption of latent separability for backdoor defenses. In ICLR , 2023.

Hanqing Guo, Xun Chen, Junfeng Guo, Li Xiao, and Qiben Yan. Masterkey: Practical backdoor attack against speaker verification systems. In MobiCom , 2023.

Rishi Jha, Jonathan Hayase, and Sewoong Oh. Label poisoning is all you need. In NeurIPS , 2023.

Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 , 2017.

Anh Nguyen and Anh Tran. Wanet-imperceptible warping-based backdoor attack. In ICLR , 2021.

Yinghua Gao, Yiming Li, Linghui Zhu, Dongxian Wu, Yong Jiang, and Shu-Tao Xia. Not all samples are born equal: Towards effective clean-label backdoor attacks. Pattern Recognition , 2023.

Hossein Souri, Liam H Fowl, Rama Chellappa, Micah Goldblum, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. In NeurIPS , 2022.

Ronald Rivest. The md5 message-digest algorithm. Technical report, 1992.

Chiou-Ting Hsu and Ja-Ling Wu. Hidden digital watermarks in images. IEEE Transactions on image processing , 1999.

Ming-Shing Hsieh, Din-Chang Tseng, and Yong-Huai Huang. Hiding digital watermarks using multiresolution wavelet transform. IEEE Transactions on industrial electronics , 2001.

Yuanfang Guo, Oscar C Au, Rui Wang, Lu Fang, and Xiaochun Cao. Halftone image watermarking by content aware double-sided embedding error diffusion. IEEE Transactions on Image Processing , 2018.

Zuobin Xiong, Zhipeng Cai, Qilong Han, Arwa Alrawais, and Wei Li. Adgan: Protect your location privacy in camera data of auto-driving vehicles. IEEE Transactions on Industrial Informatics , 17(9):6200-6210, 2020.

Yiming Li, Peidong Liu, Yong Jiang, and Shu-Tao Xia. Visual privacy protection via mapping distortion. In ICASSP , 2021.

Honghui Xu, Zhipeng Cai, Daniel Takabi, and Wei Li. Audio-visual autoencoding for privacypreserving video streaming. IEEE Internet of Things Journal , 2021.

Linghui Zhu, Xinyi Liu, Yiming Li, Xue Yang, Shu-Tao Xia, and Rongxing Lu. A finegrained differentially private federated learning against leakage from gradients. IEEE Internet of Things Journal , 2021.

Haiteng Zhao, Chang Ma, Qinyu Chen, and Zhi-Hong Deng. Domain adaptation via maximizing surrogate mutual information. In IJCAI , 2022.

Pengyu Cheng, Weituo Hao, Shuyang Dai, Jiachang Liu, Zhe Gan, and Lawrence Carin. Club: A contrastive log-ratio upper bound of mutual information. In ICML , 2020.

David A McAllester. Some pac-bayesian theorems. In COLT , 1998.

Leopold Schmetterer. Introduction to mathematical statistics , volume 202. Springer Science &Business Media, 2012.

Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N , 2015.

Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. ICLR , 2014.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR , 2016.

Adam Coates, Andrew Ng, and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. In AISTATS , 2011.

Yiming Li, Mengxi Ya, Yang Bai, Yong Jiang, and Shu-Tao Xia. BackdoorBox: A python toolbox for backdoor learning. In ICLR Workshop , 2023.

Yuntao Liu, Yang Xie, and Ankur Srivastava. Neural trojans. In ICCD , 2017.

Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models. In NeurIPS , 2021.

Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research , 2008.

Zijian Wang, Yadan Luo, Ruihong Qiu, Zi Huang, and Mahsa Baktashmotlagh. Learning to diversify for single domain generalization. In ICCV , 2021.

Chenxi Liu, Lixu Wang, Lingjuan Lyu, Chen Sun, Xiao Wang, and Qi Zhu. Deja vu: Continual model generalization for unseen domains. In ICLR , 2023.

Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearnable examples: Making personal data unexploitable. ICLR , 2021.

Xin Dong, Junfeng Guo, Ang Li, Wei-Te Ting, Cong Liu, and HT Kung. Neural mean discrepancy for efficient out-of-distribution detection. In CVPR , 2022.

Léon Bottou. Large-scale machine learning with stochastic gradient descent. In ICCS , 2010.

Pascal Germain, Amaury Habrard, François Laviolette, and Emilie Morvant. A new pacbayesian perspective on domain adaptation. In ICML , 2016.

Alexandre Lacasse, François Laviolette, Mario Marchand, Pascal Germain, and Nicolas Usunier. Pac-bayes bounds for the risk of the majority vote and the variance of the gibbs classifier. NeurIPS , 2006.

Pascal Germain, Alexandre Lacasse, Francois Laviolette, Mario March, and Jean-Francis Roy. Risk bounds for the majority vote: From a pac-bayesian analysis to a learning algorithm. Journal of Machine Learning Research , 2015.

Shichao Xu, Lixu Wang, Yixuan Wang, and Qi Zhu. Weak adaptation learning: Addressing cross-domain data insufficiency with weak annotator. In ICCV , 2021.

Tim Van Erven and Peter Harremos. Rényi divergence and kullback-leibler divergence. IEEE Transactions on Information Theory , 2014.

Hossein Souri, Micah Goldblum, Liam Fowl, Rama Chellappa, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. In NeurIPS , 2022.

Jonas Geiping, Liam Fowl, W Ronny Huang, Wojciech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. Witches' brew: Industrial scale data poisoning via gradient matching. In ICLR , 2021.

Junfeng Guo and Cong Liu. Practical poisoning attacks on neural networks. In ECCV , 2020.

Yiming Li, Tongqing Zhai, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor attack in the physical world. In ICLR Workshop , 2021.

Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. SCALE-UP: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. In ICLR , 2023.

Junfeng Guo, Ang Li, and Cong Liu. Aeva: Black-box backdoor detection using adversarial extreme value analysis. In ICLR , 2022.

Junfeng Guo, Ang Li, Lixu Wang, and Cong Liu. Policycleanse: Backdoor detection and mitigation for competitive reinforcement learning. In ICCV , 2023.

Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE S&P , 2019.

Jonathan Hayase, Weihao Kong, Raghav Somani, and Sewoong Oh. Spectre: Defending against backdoor attacks using robust statistics. In ICML , 2021.

Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. In ICLR , 2022.

Shuaiqi Wang, Jonathan Hayase, Giulia Fanti, and Sewoong Oh. Towards a defense against federated backdoor attacks under continuous training. Transactions on Machine Learning Research , 2023.

Appendix

Table of Contents

Feature Shift

Module

Feature Shift

Module

Feature Shift

Module

Feature Shift

Module

Conv 1

Conv 2

Conv 3

Conv 4

TranConv 1

TranConv 2

TranConv 3

TranConv 4

Shift

Varinace

Normalized

Shift mean

A Technical Details for Generating Hardly-Generalized Domain

This process is mainly motivated by [50, 51], which leveraged a transformation module with different convolution transformations to minimize the mutual information ( I ) between features from the source dataset ( i.e. , z ) and data from the target domain ( i.e. , ˆ z ). Our work is also partially inspired by previous work on generating unlearnable samples [52], which crafted effective unlearnable samples by performing the bi-level optimization within each iteration.

A.1 The Implementation of Transformation Module

We follow previous work [53, 38, 50] to implement the transformation module for generating samples from a different domain (as shown in Fig. 9). Specifically, we design the transformation module as an ensemble of multiple ( i.e. , 4 ) convolution operations. Each convolution operation contains a convolution layer Conv , a feature shift module, and a corresponding transposed convolution layer TranConv . The detailed parameters for each convolution layer Conv i are detailed in Tab. 3. Following each convolution layer Conv i , we add a feature shift module to enhance the diversity of the generated samples. Specifically, each feature shift module contains two learnable parameters µ i and σ i as mean shift and variance shift, following:

where µ and σ represent the mean and covariance value for Conv i ( x ) . Notably, µ and σ are not learnable parameters. Moreover, the parameters µ i and σ i has the same dimension as the output of Conv i ( x ) . After that, we use a transposed convolution layer TranConv to turn the feature maps generated by the above operations into a real instance, which has the same dimension as x .

Putting all above, we generate the hard-generalized domain samples ˆ x following:

where tahn represents the tahn activation function. w i is a scalar and weights the contribution of each activated instance produced by TransposedConv to ˆ x . w i is randomly sampled from normal distribution w i ∼ N (0 , 1) . Notably, for each input x , we first up-sample it to 224 × 224 size and down-sample produced ˆ x to the original size for x .

A.2 The Optimization Process

During the optimization process of Eq. (2), we first initialized a surrogate model f ( · ; w ) and a benign dataset D . Then during each iteration for solving the bi-level optimization Eq. (2), we first minimize the I ( z ; ˆ z ) and L c by optimizing the parameters of our proposed transformation module:

After that, we maximize I ( z ; ˆ z ) and minimize the training loss by optimizing the parameters w :

Since I ( z ; ˆ z ) is intractable, we propose to optimize its upper bound instead:

Since the conditional distribution p ( ˆ z | z ) is also intractable thus the upper bound of I ( z ; ˆ z ) can't be optimized, we follow previous work to adopt a variational distribution q ( ˆ z | z ) to approximate the upper bound of I ( z ; ˆ z ) :

where q ( ˆ z | z ) is obtained by employing the backbone neural network to approximate.

We optimize the above bi-level optimization Eq. (2) with 100 iterations. We set the learning rate as 0.005 for optimizing the parameters of the proposed transformation module and 0.001 for parameters for the backbone model f ( · ) following [50]. The batch size is 64. For both the transformation module and the backbone model f ( · ) , we use SGD [54] as the optimizer with Nesterov momentum and weight decay rate of 0.0005. We use ResNet-18 as the backbone model for extracting z and ˆ z throughout the paper. We introduce λ 1 and λ 2 for balancing each optimization objective. Following the implementation of [50], we set λ 1 and λ 2 as 0.1 and 1.0.

B The Proof for Theorem 1

Theorem 1 (Data Quantity Impact) . Suppose in PAC Bayesian [40], for a target domain T and a source domain S , any set of voters (candidate models) H , any prior π over H before any training, any ξ ∈ (0 , 1] , any c > 0 , with a probability at least 1 -ξ over the choices of S ∼ S n s and T ∼ T n t X , for the posterior f over H after the joint training on S and T , we have

where ̂ R T ( f ) and ̂ R S ( f ) are the target and source empirical risks measured over target and source datasets T and S , respectively. Ω is a constant and KL( · ) is the Kullback-Leibler divergence. β ∞ ( T ∥S ) is a measurement of discrepancy between T and S defined as

where SUPP( S ) denotes the support of S . When S and T are identical, β ∞ ( T ∥S ) = 1 .

Proof. Theorem 6 in Germain et al . 's work [55] demonstrates that suppose in PAC Bayesian [40], for a target domain T and a source domain S , any set of voters (candidate models) H , any prior π over H before any training, any ξ ∈ (0 , 1] , any c > 0 , with a probability at least 1 -ξ over the choices of S ∼ S n s and T ∼ T n t X , for the posterior f over H after the joint training on S and T :

where R T ( f ) denotes the expected Gibbs risk of voter f over the target domain. ̂ d T ( f ) and ̂ e S ( f ) are the empirical estimation of the target voters' disagreement and the source joint error, measured over target and source datasets T and S , respectively. Ω is a constant and KL( · ) is the Kullback-Leibler divergence. β ∞ ( T ∥S ) measures the discrepancy between T and S , defined as:

where SUPP( S ) denotes the support of S .

In the following proof, in particular, the Gibbs risk R A ( f ) , the voters' disagreement d A ( f ) , and the joint error e A ( f ) of a certain domain A are defined as follows.

̸

̸

̸

̸

where I [True] = 1 if the inner condition is true, and otherwise I [False] = 0 , and A X is the marginal distribution of domain A . h and h ′ are votes sampled from the posterior distribution f over H . With these definitions, studies [56, 57] reveal a relationship among the Gibbs risk, the voters' disagreement, and the joint error as

̸

̸

̸

In this case, we can extend this relationship to the empirical estimations (suppose a dataset A is sampled from domain A ) as

̸

̸

̸

Then we can use ̂ R T ( f ) and ̂ R S ( f ) to replace ̂ d T ( f ) and ̂ e S ( f ) in Eq. (17), respectively. In the end, we can follow Xu et al . [58] to regard these empirical risks as data quantity-irrelevant when analyzing the impact of data quantity.

Next, we focus on the proof of the numerical relationship β ∞ ( T ∥S ) ≥ 1 . First of all, β ∞ ( T ∥S ) comes from a more general definition that is parameterized by a real value q > 0 , shown as

For any q > 0 , β q ( T ∥S ) can be also written as a ´ Renyi Divergence-based form [55], i.e. ,

where D q ( T ∥S ) is the ´ Renyi Divergence between T and S with the order q . For ´ Renyi Divergence with any order q > 0 , there is a property of positivity [59], i.e. , D q ( T ∥S ) ≥ 0 . In this case, when q → ∞ , Eq. (25) becomes β q ( T ∥S ) = 2 D q ( T ∥S ) ≥ 1 , and β q ( T ∥S ) = 2 D q ( T ∥S ) = 1 when T = S , in other words, D q ( T ∥S ) = 0 when T = S [59].

C Technical Details for Generating Protected Dataset

C.1 The Optimization Solution for Generating Protected Dataset

Recall that Eq. (7) is formulated as follows.

where E ( x ,y ) ∼T [ L ( f ( x ; w ( δ )) , y )] represents the expected risk for the watermarked model on other unseen domains ( i.e. , T ) and B = { δ : || δ || ∞ ≤ ϵ } where ϵ is a visibility-related hyper-parameter.

The aforementioned problem is a standard bi-level problem, we following previous work [60, 61] to leverage gradient matching to solving it. Specifically, we first make the following definition:

According to the gradient-matching technique [60, 61], we have the Upper-level Sub-problem as:

where we aim to maximize the gradient matching degree between ▽ w L t and ▽ w L i using cosine ( · ) similarity as the metric through optimizing δ . We solve the above upper-level subproblem via projected gradient ascend. We here use calculate E ( ˆ x ,y ) ∼T [ L ( f ( ˆ x ; w ) , y )] following:

Regarding the lower-level sub-problem, we have:

After obtaining the poisoned dataset ( i.e. , D s ∪ D b ), we can optimize the model ( i.e. , ResNet18) parameters w via solving the above Lower-level Upper-sub problem. The above Lower-level Upper-sub problem is solved via stochastic gradient descent.

We optimize the Upper-level and Lower-level Sub-problems alternatively for each optimization iteration. Specifically, we first train the model under benign dataset D . Then for each iteration, we first optimize the Upper-level Sub-problem based on the trained model and obtain the perturbation δ . After that, we optimize the Lower-level Sub-problem based on the obtained poisoned dataset. During each iteration for optimizing the above bi-level optimization problems, we optimize the Upper-level Sub-problem with 50 iterations, and optimize the Lower-level Sub-problem with 100 iterations. We optimize the entire bi-level optimization with five epochs. The other details for optimization hyperparameters as well as configuration are consistent with [61, 29].

In particular, to ensure the effectiveness of solving the aforementioned bi-level optimization problem, we have two additional strategies, as follows:

Domain I

Domain II

Domain III

Domain IV

Domain V

Strategy 1: Instead of randomly selecting samples from benign dataset D , we here choose to select training samples with the largest gradient norms, following the previous work [60].

Strategy 2: Instead of selecting samples from all classes, we follow the previous work [4] to select those from a specific class and the selected class is set as the target label. This strategy can enhance the effectiveness for solving the above bi-level optimization problem while preserving the verification performance for our approach.

C.2 The Process of Generating Samples from Other Domains

In this part, we describe how to generate samples from other domains ( i.e. , ( x , y ) ∼ T ).

After obtaining the transformation module G d ( · ) , we can generate hard-generalized domain samples from a specific domain. We here propose to generate samples from other domains by setting different configurations of { w i } 4 1 . For example, we can generate samples from the other domain by sampling { w i } 4 1 with another values following w i ∼ N (0 , 1) .

We here show some demonstration of samples from other domains in Fig. 10.

We here generated samples from other domains, and estimate E ( x ,y ) ∼T [ L ( f ( x ; w ) , y )] following:

where T j represents the i -th unseen domain generated by the above approach.

C.3 The Selection of Hyper-parameters

After generating other unseen domains T , we here describe the selection of hyper-parameters ( i.e. , J and λ 3 ) for generating protected dataset.

We here propose a heuristic approach for selecting J and λ 3 . Specifically, we first keep λ 3 fixed ( i.e. ,1) and adjust J . We conduct empirical study on CIFAR-10 tasks, the results are shown in Fig. 11.

We use ResNet-18 as the evaluated model. We generate several unseen domains using the above approach. We randomly select J of these domains for optimizing the Eq. (7), and select 3 unseen domains as the validation data. Notably, the validation domains are ensured visually different from the domains used for optimization.

From Fig. 11, we find that using ≥ three unseen domains is sufficient to constrain the generalization performance for validation unseen domains. Therefore, we set J as 3 for our approach.

After that, we keep J fixed, and adjust λ 3 gradually, the results are shown in Fig. 12. We find that when λ 3 becomes smaller, the constraint for performance on other unseen domains reduces. Accordingly, we set λ 3 as 0.3 for our approach since it can achieve a close generalization capacity compared to the benign DNN model ( i.e. , 24 . 3% ).

0

1

2

3

4

10

20

30

40

50

60

70

80

90

0.1

0.2

0.3

0.4

0.5

λ

3

14

16

18

20

22

24

26

D The Proof for Theorem 2

Theorem 2. Let f ( x ) is the posterior probability of x predicted by the suspicious model, variable X denotes the benign sample with label Y , and variable X ′ is the domain-watermarked version of X . Assume that P b ≜ f ( X ) Y > η . We claim that dataset owners can reject the null hypothesis H 0 at the significance level α , if the verification success rate (VSR) V of f satisfies that

where t α is α -quantile of t-distribution with ( m -1) degrees of freedom and m is sample size.

Proof. Since P b > η , the original hypothesis H 1 can be converted to

Let E indicates the event of whether the suspect model f predicts a watermark sample as its groundtruth label y . As such, E ∼ B (1 , p ) , where p = Pr( C ( X ′ ) = Y ) indicates the verification success probability and B is the Binomial distribution [41].

Let ˆ x 1 , · · · , ˆ x m denotes m domain-watermarked samples used for dataset verification and E 1 , · · · , E m denote their prediction events, we know that the verification success rate V satisfies

According to the central limit theorem [41], the verification success rate V follows Gaussian distribution N ( p, p (1 -p ) m ) when m is sufficiently large. Similarly, ( P d -η + τ ) also satisfies Gaussian distribution. Accordingly, we can construct the t-statistic as follows:

where s is the standard deviation of ( V -η + τ ) and V , i.e. ,

To reject the hypothesis H 0 at the significance level α , we need to ensure that

where t α is the α -quantile of t-distribution with ( m -1) degrees of freedom.

According to equation (38)-(39), we have

E The Detailed Settings for Experimental Datasets and Configurations

E.1 Datasets

We evaluate our approach on three benchmark datasets ( i.e. , CIFAR-10 [1], Tiny-ImgaeNet [42], and STL-10 [45]). We here describe each benchmark dataset in detail.

CIFAR-10. CIFAR-10 dataset contains 10 labels, 50,000 training samples, and 10,000 validation samples. The training and validation samples are distributed evenly across each label. Each sample is resized as 32 × 32 by default.

Tiny-ImageNet. Tiny-ImageNet dataset contains 200 labels, 100,000 training samples, and 10,000 validation samples. The training and validation samples are distributed evenly across each label. Each sample is resized as 64 × 64 by default.

STL-10. STL-10 dataset contains 10 labels and 13,000 labeled samples and 100,000 unlabeled samples. We divide the labeled samples into the training and validation dataset with a ratio of 8 : 2 . The training and validation samples are distributed evenly across each label. Each sample is resized as 96 × 96 by default.

E.2 The Demonstration of Domain Watermark for Each Dataset

We here show the domain watermark used for evaluating the effectiveness of our approach in the experiments. The demonstrations are shown in Figure 13, Figure 14, and Figure 15 for CIFAR-10, Tiny-ImageNet, and STL-10 datasets, respectively.

E.3 Training Configurations

In the experiments, we train each model with 150 epochs with an initialized learning rate of 0.1. Following previous work [29, 62], we schedule learning rate drops at epochs 14, 24, and 35 by a factor of 0.1. For all models, we employ SGD with Nesterov momentum, and we set the momentum coefficient to 0.9. We use batches of 128 images and weight decay with a coefficient of 4 × 10 -4 . For each run, we report the verification success rate (VSR) averaged over the last 10 epochs when the models' accuracy converges. We report the results for each approach averaged over 5 runs.

E.4 The Details for Implementing each Approach

We implement each backdoor technique using Backdoorbox library 3 following the default training configurations. Specifically, for patch-based triggers, we use 3 × 3 , 6 × 6 , and 9 × 9 for CIFAR-10, Tiny-ImageNet, and STL-10. Following previouw work [4], for each approach, we randomly select a label as the target label for ownership verification purposes. For the other input-specific trigger ( i.e. , WaNet [27]), we follow its default configuration to generate its specific trigger pattern.

F The Additional Results for the Performance of Domain Watermark

We first show the summary for the performance of our approach and benign samples on samples from different domains. The results are shown in Table 4. We also show additional results for STL-10 dataset with ResNet-34 as shown in Table 5.

G The Detailed Settings for Dataset Ownership Verification

We evaluate our domain-watermark-based dataset ownership verification under three scenarios, including 1) independent domain (dubbed 'Independent-D'), 2) independent model (dubbed 'Independent-M'), and 3) unauthorized dataset training (dubbed 'Malicious'). In the first case, we used domain-watermarked samples to query the suspicious model trained with modified samples from another domain; In the second case, we test the benign model with our domain-watermarked samples; In the last case, we test the domain-watermarked model with corresponding domainwatermarked samples. Notice that only the last case should be regarded as having unauthorized dataset adoption. All other settings are the same as those used in [4].

Consistent with previouw work [4], we adopt the trigger used in the training process of the watermarked suspicious model in the last scenario. Moreover, we sample m = 100 samples on CIFAR10, STL-10, and Tiny-ImageNet and set τ = 0 . 25 for the hypothesis-test in each case for our approach. Since Tiny-ImageNet has only 50 samples for each class in the validation dataset, we combine additional 50 training samples with the validation samples for ownership verification. The additional 50 training samples are not used in generating the protected dataset.

H The Additional Results for Dataset Ownership Verification

We here investigate the effectiveness of ownership verification via our domain watermark. The results are shown in Table 6. The settings are consistent with Section 5.

I Additional Results of Discussions

I.1 The Effects of λ 3

We have investigated the effects of λ 3 , as shown in Fig. 12. We find that the generalization performance decreases on other unseen validation domains with the increase of λ 3 . When λ 3 increases up to 0 . 3 , the generalization performance on other unseen validation domains decreases close to the generalization performance for benign models.

I.2 Performance under Different Domain Watermarks

We here investigate the effective of protected dataset generation for different domain watermarks. Wehere craft domain watermarks following the Appendix A but initialized with different parameters

for crafting different domain watermarks. The demonstrations for different domain watermarks for CIFAR-10 are shown in Figs. 16 to 18.

We here use CIFAR-10 with ResNet-34 to investigate the performance of our approach for different domain watermarks. The results are summarized in Tab. 7. We can see our approach can still achieve effectiveness for different domain watermarks.

I.3 The Transferability of Domain Watermark

Recall that in the optimization process of our approach, we leverage a surrogate model ( i.e. , ResNet18) for crafting modified samples. In the experiment section, we test the effectiveness of our approach under models ( i.e. , VGG-16-BN and ResNet-34) having different architectures and parameters from the surrogate model. In practice, dataset users may adopt different model structures since dataset owners have no information about the model training. In this section, we conduct additional experiments on evaluating the effectiveness of our approach under different structures compared to the one used for generating modified samples ( i.e. , transferability).

Settings. We evaluate the transferability of our method on CIFAR-10. We adopt ResNet-18, ResNet-34, VGG-16-BN, and VGG-19-BN to peform domain watermark, based on which to train

different models ( i.e. , ResNet-18, ResNet-34, VGG-16-BN, and VGG-19-BN). Except for the model structure, all other settings are the same as those used in Section 5.

Results. As shown in Table 8-11, our method has high transferability across model structures. Accordingly, our methods are practical in protecting open-sourced datasets.

J Additional Results for the Resistance to Potential Adaptive Methods

Robustness against ShrinkPad. We hereby discuss the robustness of our method against ShrinkPad [63], which is a well-known watermarked sample detection approach based on a set of input transforamtions. We follow BackdoorBox to implement ShrinkPad for filtering watermarked samples. We use CIFAR-10 with ResNet-34 to implement domain watermark and craft 1,000 watermarked samples based on the validation dataset for investigation. We first filter 900 watermarked samples that can be correctly classified. We find ShrinkPad can only filter 87 effective watermarked samples among 900 samples ( ≤ 10% ), i.e. , our domain watermark is robust against ShrinkPad.

Robustness against Scale-UP. We also evaluate our method under the most advanced input-level watermark detection ( i.e. , SCALE-UP [64]). We follow their released code 4 to implement SCALEUPand use the AUROC score as the metric to report the results. We test our approach on SCALE-UP with 1,000 watermarked and 1,000 benign samples. We here use CIFAR-10 with ResNet-34.

We find that SCALE-UP yields around 0 . 58 AUROC score on our proposed domain watermark . Such results imply that SCALE-UP can not perform against our domain watermark, with the filtering performance close to random guesses. We think it may be caused by that, different from the previous backdoor-inspired watermark causing misclassification, domain watermark leads the watermarked model correctly classifying the watermarked samples. Therefore, the watermarked samples would have a similar scaled prediction consistency as benign samples, since they all belong to the groundtruth label and can be clustered closely as shown in Section 5.3.2.

Robustness against Neural Cleanse. Following previous work [60], we also evaluate our approach against reverse-engineering based approaches [65, 66, 67].We here evaluate our approach

0

1

2

3

4

5

6

7

8

9

0

2

4

6

8

1.0

0.5

0.0

0.5

1.0

1.5

Anomoly Index

against Neural Cleanse [67], which is the most widely-adopted approach. We select label 0 as the target label and use CIFAR-10 with ResNet-34. The results are shown in Figure 19-20. We can see the reversed trigger pattern produced by Neural Cleanse for the target label is extremely dense. We further follow [67] to calculate the anomaly index for each label using MAD outlier detection. We find that the target label's anomaly index is smaller than 2, thus it would not be detected.

We notice that there are still many other backdoor defenses ( e.g. , [68, 69, 70]). We will discuss the resistance of our domain watermark method to them in our future works.

K Can We Identify Domain-watermarked Samples by Training on a Large Dataset or with Complicated Data Augmentation?

In general, our method is developed on the foundation that only models trained on our protected dataset can successfully identify domain-watermarked samples. However, people may worry about whether the suspicious model can also generalize well on domain-watermarked samples because its good training strategies or structures instead of because being trained on the protected dataset. In this section, we discuss this potential problem.

Firstly, we cannot ensure this problem will never happen since training with more samples and complicated data augmentations may indeed increase the general generalizability of suspicious models. However, the probability of it happening is very small in practice, as follows.

Hardly-generalized domain is an exclusive and special domain where only defenders know what it is. Accordingly, the adversaries ( i.e. , malicious dataset users) cannot know it and use it to break our verification.

It is unlikely that a benign user can develop data augmentation that can generate (sufficiently) similar hard samples without knowing our specific settings, since the space of hardly-generalized domain is huge and our watermark is sample-specific and not unique.

As shown in Figures 2-3 in the main manuscript as well as Figures 5-10 in the Appendix, domain-watermarked samples and not natural and very special. In other words, it is impossible that dataset users can collect them without using our protected dataset. Accordingly,

it is not reasonable to claim that a model has good performance on domain-watermarked samples because their dataset is extremely large covering numerous hard samples.

Lemma 1 indicates that we can find a hardly-generalized domain for the dataset, no matter what the model architecture is. Accordingly, it is not reasonable to claim that a model has good performance on domain-watermarked samples due to its well-designed architecture.

Currently, no model can have similar generalizability to humans, although it was trained on a huge dataset with complicated data augmentation strategies and a well-designed structure.

Domain generalization is still an important yet unsolved problem in computer vision. Accordingly, there is no existing method can make DNNs generalize to all unseen domains (with performance on par to that of the source domain) for breaking our method.

Our hypothesis-testing-based verification process ensures that suspicious models will be treated as trained on our protected dataset only when they have sufficiently high (not just certain) generalizability over a large number (not just a small number) of hard samples. Accordingly, our method can reduce the side effects of randomness to a large extent.

We admit that using data augmentation or other domain adaption techniques may increase the generalization ability of trained DNNs on domain-watermarked samples, although adversaries have no information of hardly-generalized domains and those augmented samples used for training are significantly different from those of domain-watermarked ones. However, this improvement is limited since these adapted domains are significantly different from the hardly-generalized domain (the domain space is high-dimensional and enormous). Accordingly, this mild improvement cannot break our method. To further verify it, we evaluate our method on models with classical automatic data augmentations ( e.g. , color shifting) and domain adaption in Appendix K.1-K.2.

In particular, it does not diminish the practicality of our method, even if this rare event is likely to happen. Using verification-based defenses (in a legal system) requires an official institute for arbitration. Specifically, all commercial models should be registered here, based on the unique identification ( e.g. , MD5 code) of their model files and training datasets, before being used online. When this official institute is established, its staff should take responsibility for the verification process. For example, they can require the company to provide the dataset with the same registered identification and then check whether it contains our protected samples (via algorithms). Of course, if the suspect model is proven to be benign, the user will need to pay a settlement to its company to prevent casual malicious ownership verification. In this case, even if our method misclassifies in rare cases, it does not compromise the interest of the suspect model. Our method is practical in this realistic situation, as long as it has a sufficiently high probability of correct verification.

K.1 The Resistance to Data Augmentation

Settings. We adopt strong data augmentations to train models on benign datasets with the same settings used in our paper. Specifically, we adopt random flip, random rotation, random affine transformations, random color shifting as the augmentations on CIFAR-10 and Tiny-ImageNet datasets.

Results. As shown in Table 12, our method will not misjudge (p-value ≫ 0 . 05 ), although data augmentation can (slightly) increase the accuracy on our domain-watermarked samples. These results verify that our method is resistant to data augmentations.

K.2 The Resistance to Domain Adaption

Settings. In this part, we adopt L2D [50] as the representative method to investigate the robustness of our domain watermark against domain adaption techniques. Specifically, we train both the watermarked and benign DNNs with L2D on CIFAR-10 and Tiny-ImageNet datasets.

Results. As shown in Table 13-14, our method is still highly effective under the domain adaption setting. It is mostly because the VSR improvement caused by domain adaption is mild and therefore cannot fool our verification. Moreover, domain generalization has side effects on the benign accuracy, especially on complicated datasets ( e.g. , Tiny-ImageNet).

L Reproducibility Statement

In the appendix, we provide detailed descriptions of the datasets, models, training and evaluation settings, and computational facilities. We provide the codes and model checkpoints for reproducing the main experiments of our evaluation in the supplementary material. In particular, we also release our training codes at https://github.com/JunfengGo/Domain-Watermark .

M Societal Impacts

In this paper, we focus on the copyright protection of (open-sourced) datasets. Specifically, we reveal the harmful nature of backdoor-based dataset ownership verification (DOV) and propose the first non-backdoor-based DOV method that is truly harmless. This work has no ethical issues in general since our method is purely defensive and does not reveal any new vulnerabilities of DNNs. However, our method requires a sufficiently large watermarking rate and therefore can not be used to protect a few or a single image. In addition, although our method is resistant to existing adaptive methods, adversaries may try to develop more effective attacks against our DOV method, given the exposure of this paper. People should not be too optimistic about dataset protection.

N Discussions about Adopted Data

In this paper, all adopted samples are from the open-sourced datasets ( i.e. , CIFAR-10, TinyImageNet, and STL-10). The Tiny-ImageNet dataset may contain a few human-related images. We admit that we modified a few samples for watermarking and verification. However, our research treats all samples the same and the verification samples and modified samples have no offensive content. Accordingly, our work fulfills the requirements of these datasets and has no privacy violation.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors study copyright projection problem for open datasets. They note that the previous method based on back door attacks are harmful. They propose to watermark some samples such that model training on this sample can correctly classify hard sample, which cannot be correctly classified by benign DNN. Technically, the authors exploit knowledge and techniques in transfer learning to derive domain generator for this task. The authors provide a set theoretical justification and perform a series of experiments to evaluate the proposed scheme.\n\nSTRENGTHS:\nThe proposed method is supported by both theory and experiments. \n\nThe proposed idea using hard sample for database copyright protection should be novelty.\n\nWEAKNESSES:\nThe basic idea of this work is illustrated in Fig. 1. (Stage III). If many hard samples (which cannot be classified by benign DNN) can be correctly classified by a suspicious model, it is not necessary that the suspicious model is trained on the copyright dataset. If the owner of suspicious model claims that their model is trained on an extremely large dataset covering numerous hard samples and uses a proprietary architecture, augmentation method and learning scheme, it will be a very reasonable explanation why it can perform better the benign DNN, which is trained on a “small” dataset.  Fig. 3 in fact gives a good illustration. The verification sample of the proposed method in Fig. 3 is clearly a dog to human being and the classification output is a dog. We only can say that the model can handle the hard sample. However, we cannot conclude that the model is trained on the watermarked dataset. Although the paper offers a lot of mathematical justification and experimental results, the authors need to explain the practicality of the proposed method. \n\nAlthough I do read the paper from beginning to the end, I am not working on this area. I let other reviewers commenting on the technical and experimental issues.\n\nQUESTIONS:\nSee the weaknesses.\n\nLIMITATIONS:\nSee the weaknesses.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper first revisits the backdoor-based dataset ownership verifications and claims that these methods are harmful since they introduce the malicious misclassification. Given this, authors propose a truly harmless dataset copyright protection via making watermarked models correctly classify hard samples which will be misclassified by the benign models. They first generate domain watermark and then modify a set of benign samples which have similar effects to domain watermarked samples to insert the watermark into the dataset. Finally, they propose a hypothesis testing to verify whether a suspect model has unauthorized dataset usage. Experiments on CIFAR-10, Tiny-ImageNet and STL-10 show the effectiveness.\n\nSTRENGTHS:\n1. The proposed method is novel to some extend. This paper proposes to protect the intellectual property of dataset from another perspective, i.e., making watermarked models correctly classify hard samples which will be misclassified by the benign models, differed from previous backdoor-based methods.\n2. The theoretical analysis is reasonable and the experiments are extensive.\n\nWEAKNESSES:\nSection 3.3 and 3.4 are not clear and well-written.  For example, (a) lemma 1 (line 172~176) mentions the z and \\hat_{z}, the features for source and target domains. However, the specific meaning of z/\\hat_{z} and how to obtain z/\\hat_{z} are not explained until line 189; (b) it's better to give the specific meanings of \\theta, \\omega and f in equation 2;\n\nAlthough authors have conducted extensive experiments, it's better to test with more model structures instead of only two (VGG and ResNet). Besides, Section 5.3.2 in the main manuscript and Section J in the appendix discuss the resistance to some potential adaptive methods. However, I think the true adaptive method are out-of-domain detection in the inference stage which does not involved in either main manuscript or the appendix.\n\nQUESTIONS:\n1. In Equation (2), it seems that both z and \\hat_{z} are relative to \\omega while in the second term of \\omega * , i.e., , \\hat_{z} is not relative to \\omega.\n2. In line 262, authors set the watermarking rate \\gamma=0.1 for their method and other baselines. However, for the most of baselines, they need to set one class as the target class, which means all of samples in the target class are perturbed for 10-class datasets (CIFAR-10 and STL-10) and a few classes are selected to be target classes for Tiny-ImageNet (200-class). I wonder the concrete settings.\n3. In the Experiments, authors describe that they conduct experiments with two model structures VGG and ResNet, while results in table 1&2 do not reflect this setting, and the detailed settings of these results are not clear.\n\nLIMITATIONS:\nPlease refer to the questions above.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-05"}

comments: SUMMARY:
This paper presents a method to use invisible domain watermarks for dataset ownership verification. Compared to previous methods, the motivation of this paper is to avoid harmful practice which negatively affects the model performance. The method is validated on CIFAR and Tiny-Imagenet datasets.

STRENGTHS:
1.[reference] The paper provides a comprehensive literature review.

2.[clarity] Extensive experimental results and ablation studies demonstrate the effectiveness of the proposed method.

3.[clarity] The paper has a clear motivation, which is to avoid harmful practice compared to existing methods. In particular, the proposed method is invisible, clear-label, and effective.

WEAKNESSES:
1.[technical soundness] Adaptive attack against this proposed method is not discussed.

2.[limitation] The paper relies on assumption on generalization. For standard training the assumptions should hold. But what if the dataset to protect is used for domain adaptation, which has higher generalization capability across domains? This is not adaptive attack by design, but it might coincidently break the core assumptions of the proposed method.

QUESTIONS:
Overall, the paper is comprehensive.
My main concerns are about the adaptive attacks and domain generalization training methods coincidently breaking the assumption of the proposed method.

LIMITATIONS:
See weaknesses.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-06

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes domain watermark (DW), a new watermark technique for dataset verification. Domain watermark focuses on watermarking the dataset without introducing the harmful side effect. This paper first proposes to generate the hardly generalized domain by minimizing the mutual information between the dataset and hardly generalized domain. Then this paper perturbs some of the inputs to have similar effects as the domain-watermarked samples. Then the dataset contains its original domain and the watermarked domain. The model trained on it also learns the watermarked domain can be exposed by correctly classifying the watermarked domain images.\nThe evaluation is done on CIFAR-10 and Tiny-ImageNet and shows that the watermarked model can be effectively distinguished from model trained on data from another dataset or model trained on the unwatermarked dataset.\n\nSTRENGTHS:\nI think the area this paper studies is important and I agree that the watermark should not introduce harms or vulnerabilities that can be exploited by the attackers. \n\nIn general, I like the idea of embedding the model with a harmless distribution that is orthogonal to the main distribution as the watermark.\n\nThis paper is well-written and easy to understand.\n\nWEAKNESSES:\n1. My biggest concern with this approach is that it just optimizes to find the most hardly generalized domain. It is possible that two watermark domains on two datasets of one similar domain collide.  \nSuppose there are two dataset owners A and B. They have dataset from the similar domains and they both use this paper’s method to do the domain watermark. An attacker C trains on A’s dataset, would B’s WM images also have high VSR on C’s model? \nIf so, it would be hard for A to claim that C trained on A’s model as the high VSR on the WM images does not prove the model trained on A (it could also be trained on B or trained on another model from the similar domain). \nI suggest adding a new experiment on this hypothetical scenario or include a new mechanism to avoid/reduce the possibility of collision of the watermark domains.\n\n2. The general idea of this paper is that the watermarked dataset contains two distributions, the dataset’s domain and the watermark domain. Many of the existing backdoor poison samples detection methods also depend on this assumption. Will the watermark domain bypass some of the existing backdoor detection techniques, e.g.[1-3]? I suggest this paper to be evaluated against backdoor samples detection techniques.\n\n3. I am not able to find the clear definition of the Harmful degree and relative harmful degree. Could you put these definitions in the main text? \n\n\n[1] Effective Backdoor Defense by Exploiting Sensitivity of Poisoned Samples\n[2] Demon in the variant: Statistical analysis of {DNNs} for robust backdoor contamination detection\n[3] Pre-activation Distributions Expose Backdoor Neurons\n\nQUESTIONS:\nPlease see the questions I raise in the weakness section.\n\nLIMITATIONS:\nThis paper discusses the limitation of this paper is bounded by the accuracy of the watermark models.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-25"}

comments: SUMMARY:
The authors propose a novel dataset ownership verification method that relies on correctly classifying 'hard' samples rather than classifying 'easy' samples which is harmless to the benign data. The proposed method is inspired by the generalization property of DNNs.  Experiments verify the effectiveness of proposed method.

STRENGTHS:
1)	Interesting insight. The insight of the harmless DOV method is interesting.
2)	Clear writing: The paper is overall well-organized and easy to follow. The authors discuss the details of their design choices.

WEAKNESSES:
1. While hyper-parameter selection in ablation studies section is crucial, I think the impact of the module block on the algorithm more intriguing. Specifically, I am interested in understanding how the generation of similar-effect samples during the creation of the protected dataset affects the final performance.

2. I think that the Domain Generator plays a crucial role in the overall algorithm. Therefore, it is essential to address the performance evaluation of this module.

3. The experiments were conducted on relatively small datasets (e.g., CIFAR-10 and Tiny-ImageNet). The transferability of the algorithm's effectiveness to larger datasets remains a question. For instance, it is crucial to examine whether the training of the Domain Generator is affected when applied to larger datasets. I believe this issues should be addressed at least in the "Discussion" section.

QUESTIONS:
1)  Similar-effect samples' influence to the final performance.
2) The performance of the proposed method on the larger dataset.

LIMITATIONS:
See part ‘Strengths And Weaknesses’.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-25