Title: Provable Watermarking for Data Poisoning Attacks
Venue: NeurIPS 2025
Accepted: yes
Keywords: data poisoning

provable watermarking

generalization theory
Abstract: In recent years, data poisoning attacks have been increasingly designed to appear harmless and even beneficial, often with the intention of verifying dataset ownership or safeguarding private data from unauthorized use. However, these developments have the potential to cause misunderstandings and conflicts, as data poisoning has traditionally been regarded as a security threat to machine learning systems. To address this issue, it is imperative for harmless poisoning generators to claim ownership of their generated datasets, enabling users to identify potential poisoning to prevent misuse. In this paper, we propose the deployment of watermarking schemes as a solution to this challenge. We introduce two provable and practical watermarking approaches for data poisoning: post-poisoning watermarking and poisoning-concurrent watermarking. Our analyses demonstrate that when the watermarking length is $\Theta(\sqrt{d}/\epsilon_w)$ for post-poisoning watermarking, and falls within the range of $\Theta(1/\epsilon_w^2)$ to $O(\sqrt{d}/\epsilon_p)$ for poisoning-concurrent watermarking, the watermarked poisoning dataset provably ensures both watermarking detectability and poisoning utility, certifying the practicality of watermarking under data poisoning attacks. We validate our theoretical findings through experiments on several attacks, models, and datasets.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a provably detectable watermarking schemes for poisoned datasets, aiming to bring transparency and accountability to the increasingly common use of data poisoning for protective purposes (e.g., copyright enforcement or model misuse prevention). The authors introduce two methods—post-poisoning watermarking and poisoning-concurrent watermarking—which embed subtle, random perturbations into poisoned data using a secret key. They provide theoretical guarantees on detection reliability, showing that the watermark can be statistically verified with high probability without harming the effectiveness of the original poisoning attack. The watermark is invisible to adversaries without the key and remains undetectable unless actively searched for using a tailored test. Experiments on CIFAR-10 across multiple poisoning strategies (e.g., backdoor and availability attacks) confirm that watermark detection is accurate and that the watermark preserves the utility of the poisoning. This work bridges the gap between data poisoning and verifiable data provenance by enabling poisoned data to be both effective and transparently marked.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. The paper beyond the empricall experiements and want to provide some theorical ganrantee\n\nWeakness:\n1. The overall setting feels disconnected from practical use cases. While the paper introduces a theoretically elegant watermarking mechanism for poisoned datasets, it's unclear who the target users of such a system would be in real-world scenarios. The authors mention legitimate uses of poisoning, such as for copyright protection or to prevent unauthorized model training, but these applications remain underdeveloped in the paper. There is little discussion of actual deployment contexts, potential adopters, or how the watermarking would interact with existing machine learning pipelines. Without a compelling, concrete example of where this would be applied in practice the proposed solution feels somewhat speculative.\n\n2. The writing and presentation could be improved for clarity and accessibility. A notable issue is the inclusion of symbols like “d, ϵ” directly in the abstract and introduction without clear explanation. Readers will not understand what these symbols refer to, and dropping a theoretical scaling law into the abstract hurts readability. Throughout the paper, several mathematical notations and definitions are introduced abruptly, assuming too much background from the reader. Additionally, some sections, such as the experimental setup, could benefit from more structured exposition, as they currently mix theoretical and empirical points in a way that’s hard to follow. Improving clarity in writing would make the paper more accessible to a broader audience.\n\n3. The scope of the experimental evaluation is too limited, especially given the paper’s broader claims. In the introduction, the authors highlight the importance of LLMs and large-scale model training, yet all experiments are conducted on small image datasets like CIFAR-10 using convolutional networks. This creates a significant mismatch between the motivation and the actual evaluation. The effectiveness of the proposed watermarking techniques for high-dimensional or complex data modalities (e.g., text or multimodal data used in LLMs) remains entirely untested. Moreover, real-world model training typically involves significant data preprocessing, augmentation, and noise, none of which are accounted for in the current experiments. As a result, it’s unclear how robust or applicable the method would be in more realistic and challenging settings.\n\nQUESTIONS:\nCan you clarify the practical scenarios in which your watermarking scheme would be deployed, and who the intended users are (e.g., researchers, data providers, regulators)? It would be helpful to understand a concrete use case where verifiable watermarking of poisoned data is both necessary and realistically actionable.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-21"}

comments: SUMMARY:
1.  Theoretical soundness: Formal bounds on watermarking length for detectability and utility.

2.  Practical applicability: Demonstrated effectiveness on real-world poisoning attacks.

3.  Transparency: Addresses ethical concerns by enabling poisoned dataset identification.

STRENGTHS AND WEAKNESSES:
Strengths

Quality: Rigorous theoretical analysis with proofs in appendices. Experiments validate claims across diverse attacks and models.

Clarity: Well-structured; theoretical and empirical sections are clearly separated. Figures/tables aid understanding.

Significance: Addresses a critical gap in responsible data poisoning (e.g., ownership verification, misuse prevention).

Originality: First work to integrate watermarking with poisoning attacks, with novel distinctions between post-poisoning and concurrent schemes.

Weaknesses

Evaluation Scope: Limited to imperceptible clean-label attacks; broader attack types (e.g., noisy-label) could strengthen generality.

Practical Constraints: Assumes large N and d for theoretical guarantees; impact on small-scale datasets is unclear.

Defense Robustness: Watermarking detectability degrades under diffusion purification (Table 12), though poisoning utility is also neutralized.

QUESTIONS:
1. Generalizability: Could the framework extend to noisy-label or targeted poisoning attacks? If not, what are the fundamental barriers?

2. Scalability: How does watermarking perform on low-dimensional data (e.g., tabular) where  d is small?

3. Defense Mitigation: Could adaptive watermarking (e.g., dynamic watermark)   improve robustness against purification attacks?

LIMITATIONS:
Yes, limitations are acknowledged (e.g., necessity of large N, sensitivity to defenses).
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 4
DATE: 2025-06-30

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a provable watermarking framework for poisoned datasets, addressing the question of how to embed a detectable signal alongside backdoor or availability poisons. The core idea is to add an additional perturbation to the poisoned data so that a trusted user with the correct key can verify whether the data was poisoned intentionally. The authors formalize the detection condition, provide theoretical bounds showing that the watermark is statistically detectable under budget constraints, and run extensive experiments across different poisoning methods (e.g., backdoors, unlearnable examples) on standard image benchmarks. They show that the watermark achieves high AUROC for detection while preserving the intended poisoning effect.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n\n- **Clear formal framework:** The paper presents a clean mathematical formulation, deriving explicit scaling laws for detection probability and showing how the watermark perturbation budget relates to detectability.\n\n- **Sound empirical validation:** The experiments cover multiple threat types (backdoors, availability poisons) and confirm the theoretical soundness. They check that adding the watermark does not significantly degrade the poison’s intended effect.\n\n- **Robustness checks:** The authors evaluate the watermark under basic data augmentations and simple regeneration defenses, and show that random incorrect keys produce only random-guess detection performance, which supports the claim that the key is non-trivial to guess.\n\n\nOverall, the paper’s theoretical contributions are sound and well-supported by experiments. However, the idea of combining poisoning with a provable watermark is questionable.\n \n\n\n\n### Weaknesses\n\n1- **Practical Threat Model and Real-World Use**\n\nThe formal analysis and proofs are clear, but the practical story here still feels pretty abstract. The authors assume there’s a scenario where someone deliberately poisons their own data to protect it (like using unlearnable examples) and wants to help “good” users avoid accidentally using that poison by adding a watermark and secret key. But in practice, it’s not obvious who would really do this. If you want to protect your data from misuse, you can just license it properly, publish a hash, or provide a clean version for trusted partners — you don’t necessarily need an extra hidden signal inside the data.\n\nI’d like to see a concrete example of how this actually plays out: Who exactly is sharing poisoned data and a watermark key? Who runs the detection? How is the key managed and trusted in real-world distribution? For instance — an artist uploading watermarked UE images to the internet doesn’t really have a clear way to send keys to every possible good-faith user. Without this piece, it’s hard to see how this idea moves beyond an interesting theoretical guarantee.\n\nOverall, I’d encourage the authors to ground this threat model in a realistic scenario and explain who the real users are and how they’d benefit. This would help connect the theory to a clearer real-world story.\n\n---\n\n2- **Use of Separate Watermark and Poison Perturbations**\n\nThe authors do not sufficiently motivate why the poison itself cannot be designed to serve as a watermark, or vice versa. For backdoor attacks, it is well established that the backdoor trigger itself naturally functions as a watermark: for example, [arXiv:1802.04633v3], [arXiv:2208.00563v2], and [arXiv:2305.12502] all demonstrate that hidden backdoor patterns can double as watermarks to prove intellectual property ownership without requiring any additional watermark noise.\n\nMore generally, for both backdoor and availability attacks, the paper does not analyze whether the watermark perturbation could itself be crafted to serve as the poison — that is, whether a unified perturbation could achieve both detectability and attack effectiveness simultaneously. For availability poisoning, this might require designing the unlearnable noise to embed a structured, provable pattern, rather than adding a separate signal. Such a joint design could reduce the total perturbation budget, simplify implementation, and remove the need to split the signal across separate dimensions or budgets.\n\nOverall, I recommend the authors clarify and empirically test whether separate perturbations are truly necessary for both attack classes, or whether a combined poison–watermark perturbation could achieve the same provable guarantees while simplifying the threat model and deployment.\n\n---\n\n3- **Key Management and Forgery Risk**\n\nThe proposed watermark relies entirely on the secrecy of the key vector \\(\\zeta\\), which determines the detection mechanism. While the paper demonstrates that using a random incorrect key results in random-guess performance (AUROC ≈ 0.5), it does not discuss how this key should be securely generated, stored, or distributed to legitimate users in real-world scenarios. If the key were to leak or be exposed during dataset sharing or verification, an adversary could potentially remove the watermark by reversing or masking the known perturbation, or forge a similar watermark on unrelated clean data.\nTo strengthen this aspect, I suggest the authors clarify:\n- How the key \\(\\zeta\\) should be generated and kept confidential in practical deployment.\n- How authorized users should receive or verify the key without risking exposure.\n- Whether there are simple binding or signature mechanisms that could make the watermark non-forgeable if the key is ever leaked.\n\nWithout addressing this, the scheme’s detectability guarantee depends entirely on perfect secrecy of the key, which may be unrealistic in open data sharing settings.\n\n---\n\n4- **Adaptive Removal Risk Due to Poison–Watermark Separation**\n\nA core feature of the proposed method is that the poisoning and watermarking perturbations are explicitly separated into different sets of dimensions (or partially separated). While this makes the theoretical analysis clear, it also creates a practical risk: an adaptive attacker who knows or estimates which dimensions carry the watermark could remove only the watermark perturbation while preserving the poison effect. For example, an attacker could analyze multiple samples to identify the watermark dimensions, then mask, smooth, or overwrite only those dimensions, leaving the poison untouched. If this works, the watermark detectability would fail while the attack’s intended effect would remain intact, undermining the claimed provable ownership.\n\nRecent work ([arXiv:2309.16952v2]) shows that even stronger adaptive attacks are feasible: attackers can use optimization-based surrogate key recovery and iterative removal to erase hidden watermarks with minimal visible distortion. This result demonstrates that modern watermark removal is not purely theoretical but practical, and particularly relevant for sparse, separable perturbations like the one proposed here.\nTo clarify real-world robustness, I strongly recommend that the authors add an experiment that directly tests this threat. Concretely, they could: (1) simulate an attacker who removes or masks only the known watermark dimensions; (2) test whether the watermark detection AUROC drops to random; (3) verify whether the poison’s effect (e.g., attack success rate or degradation of model performance) stays intact; and (4) optionally compare with a simple optimization-based removal approach as demonstrated by Lukas et al. If the watermark is easily removed while the poison remains, this would show that the explicit separation makes the signal vulnerable and highlight the need to consider partial overlap or a hybrid joint design.\n\nQUESTIONS:\nThe points raised in the **Weaknesses** section already outline my main questions and requests for clarification. In particular, I would appreciate clear answers or additional evidence regarding the real-world threat model and use cases, the practical management and security of the watermark key, the justification for separating poison and watermark instead of unifying them, and whether the method can withstand adaptive removal targeting only the watermark signal.\n\nAddressing these questions would directly strengthen the practical relevance of the paper and would contribute to revising my rating positively.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes using provable watermarking to allow creators of harmlessly poisoned data to transparently declare their modifications. The authors introduce two schemes: post-poisoning and poisoning-concurrent watermarking. They provide theoretical guarantees for the detectability of the watermark and the preservation of the poison's utility, tying these properties to the watermark's length. The theories are then validated on several common clean-label data poisoning attacks.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\nThe paper addresses the important problem of transparency for harmlessly data poisoning. The application of provable watermarking is meaningful to this emerging area.\n\nThe work is theoretically sound, providing clear, provable bounds for the proposed schemes under both sample-wise and universal settings. The paper is clearly structured.\n\nWeaknesses:\nThe paper is motivated by recent \"data poisoning for good\" methods like Nightshade and Glaze. However, the experiments are conducted on more traditional clean-label backdoor and availability attacks. It is not immediately clear if the paper's theoretical model, which assumes imperceptible additive noise, directly applies to the complex, style-based perturbations of tools like Glaze. Experiments of such an attack would have made the connection stronger.\n\nThe experiments are conducted on small and traditional architectures (e.g., ResNet-18, VGG-19). This limits the generalizability of the findings to the large-scale scenarios that motivate the work.\n\nThe experiments lack statistical rigor. Results are based on single runs without error bars, as noted in the appendix, which makes it difficult to assess the variance and significance of the empirical claims.\n\nQUESTIONS:\nThe lack of error bars is a key weakness. Can you provide results from multiple random seeds for even a small subset of experiments to demonstrate the variance of your metrics?\n\nHow does your theoretical framework apply to the complex perturbations of poisoning-for-good tools like Nightshade, which motivated your work?\n\nThe DP noise defense invalidates the model's utility. Can you discuss a more realistic adaptive attack where an adversary tries to remove the watermark while preserving model utility?\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}

comments: SUMMARY:
The author explores the use of watermarking to enable poisoners to provably declare the presence of poisoning, thereby promoting transparency and reducing potential disputes. The paper introduces two provable and practical watermarking approaches for data poisoning.

STRENGTHS AND WEAKNESSES:
Strengths
1. The idea is novel.

Weaknesses
1. Unrealistic threat model.
2. No evaluation on other model types.
3. Dense, undefined notation—add a symbol table.

QUESTIONS:
How the watermark performs on other model families, such as transformers or GNNs?

LIMITATIONS:
There are several limitations should be addressed to further strengthen the work:

1. The stated goal of watermarking in data poisoning is to allow authorized users to detect whether a dataset has been poisoned using a secret key. However, this threat model appears unrealistic. If the data provider is trustworthy, they would claim whether poisoning is present without requiring watermark-based detection. Conversely, if the provider is untrustworthy, there is little reason to expect them to share the key needed for detection, undermining the proposed verification mechanism.

2. The paper lacks discussion on how the proposed watermarking techniques generalize to different victim models, such as transformers, or GNNs. Evaluating a broader range of architectures would enhance the practical relevance of the work.

3. There is significant notation overload. Many symbols are introduced before being properly defined, which impairs readability. A dedicated symbol table or an overview figure early in the paper would help readers more effectively.
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-01