Black-box Dataset Ownership Verification via Backdoor Watermarking
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；School of Information Science and Technology, Southwest Jiaotong University（西南交通大学信息科学与技术学院）；Research Center of Artificial Intelligence, Peng Cheng Laboratory（鹏城实验室人工智能研究中心）；Ant Group（蚂蚁集团）
This paper is accepted by IEEE TIFS. 15 pages. The preliminary short version of this paper was posted on arXiv (arXiv:2010.05821) and presented in a non-archival NeurIPS Workshop (2020)
Deep learning, especially deep neural networks (DNNs), has been widely and successfully adopted in many critical applications for its high effectiveness and efficiency. The rapid development of DNNs has benefited from the existence of some high-quality datasets ($e.g.$, ImageNet), which allow researchers and developers to easily verify the performance of their methods. Currently, almost all existing released datasets require that they can only be adopted for academic or educational purposes rather than commercial purposes without permission. However, there is still no good way to ensure that. In this paper, we formulate the protection of released datasets as verifying whether they are adopted for training a (suspicious) third-party model, where defenders can only query the model while having no information about its parameters and training details. Based on this formulation, we propose to embed external patterns via backdoor watermarking for the ownership verification to protect them. Our method contains two main parts, including dataset watermarking and dataset verification. Specifically, we exploit poison-only backdoor attacks ($e.g.$, BadNets) for dataset watermarking and design a hypothesis-test-guided method for dataset verification. We also provide some theoretical analyses of our methods. Experiments on multiple benchmark datasets of different tasks are conducted, which verify the effectiveness of our method. The code for reproducing main experiments is available at \url{https://github.com/THUYimingLi/DVBW}.
Open-sourced Dataset Protection via Backdoor Watermarking
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学清华深圳国际研究生院）；School of Data Science, The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳）数据科学学院）；Shenzhen Research Institute of Big Data（深圳大数据研究院）
深度学习的快速发展得益于一些高质量开源数据集（$e.g.$，ImageNet）的发布，这使得研究人员可以轻松验证其算法的有效性。几乎所有现有的开源数据集都要求它们只能用于学术或教育目的，而不能用于商业目的，然而仍然没有很好的方法来保护它们。在本文中，我们提出了一种\emph{backdoor embedding based dataset watermarking}方法，通过验证它是否用于训练第三方模型来保护开源图像分类数据集。具体而言，所提出的方法包含两个主要过程，包括\emph{dataset watermarking}和\emph{dataset verification}。我们采用经典的基于中毒的后门攻击（$e.g.$，BadNets）的数据集水印，即通过添加特定的触发器（$e.g.$，一个本地补丁）到一些良性的样本，与预定义的目标类标记产生一些中毒的样本。在提出的基于后门的水印算法的基础上，采用假设检验指导的方法，基于可疑第三方模型生成的良性样本及其对应的水印样本（$i.e.$，带触发器的图像）在目标类上的后验概率进行数据集验证。在一些基准数据集上的实验验证了该方法的有效性。
SSCL-BW: Sample-Specific Clean-Label Backdoor Watermarking for Dataset Ownership Verification
School of Control and Computer Engineering（控制与计算机工程学院）；North China Electric Power University（华北电力大学）；Research Institute（研究院）；China Unicom（中国联合网络通信集团）；Technical Department（技术部）
PointNCBW: Towards Dataset Ownership Verification for Point Clouds via Negative Clean-label Backdoor Watermark
State Key Laboratory of Blockchain and Data Security, Zhejiang University（浙江大学区块链与数据安全国家重点实验室）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新区（滨江）区块链与数据安全研究院）；College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）；Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）
State Key Laboratory of Mathematical Sciences, Academy of Mathematics and Systems Science, Chinese Academy of Sciences（数学科学国家重点实验室，数学与系统科学研究院，中国科学院）；University of Chinese Academy of Sciences（中国科学院大学）；Institute of AI for Industries, Nanjing, China（产业人工智能研究院，南京，中国）
CBW: Towards Dataset Ownership Verification for Speaker Verification via Clustering-based Backdoor Watermarking
College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）；School of Mathematics, Sun Yat-sen University（中山大学数学学院）；Zhejiang University（浙江大学）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新区（滨江）区块链与数据安全研究院）；Tsinghua University（清华大学）；Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；Research Center of Artificial Intelligence, Peng Cheng Laboratory（鹏城实验室人工智能研究中心）
Watermarking Vision-Language Pre-trained Models for Multi-modal Embedding as a Service
Institute of Information Engineering, Chinese Academy of Science（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；Beijing Institute of Technology（北京理工大学）；University of Adelaide（阿德莱德大学）
HoneyImage: Verifiable, Harmless, and Stealthy Dataset Ownership Verification for Image Models
Department of Information Systems, Business Statistics and Operations Management (ISOM), Hong Kong University of Science and Technology (HKUST)（信息系统、商业统计与运营管理系（ISOM），香港科技大学）
Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution
Zhejiang University（浙江大学）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新区（滨江）区块链与数据安全研究院）；Nanyang Technological University（南洋理工大学）
Tsinghua University（清华大学）；Shandong University（山东大学）；Wuhan University（武汉大学）；Zhongguancun Laboratory（中关村实验室）；Shandong Institute of Blockchain（山东省区块链研究院）；National Financial Cryptography Research Center（国家金融密码研究中心）
Forging the Unforgeable: On the Feasibility of Counterfeit Watermarks in Backdoor-Based Dataset Ownership Verification
College of Cyber Security, Jinan University（济南大学网络安全学院）；School of Artificial Intelligence, Beihang University（北京航空航天大学人工智能学院）；School of Advanced Technology, Xi’an Jiaotong-Liverpool University（西交利物浦大学前沿技术学院）
Neural Honeytrace: Plug&Play Watermarking Framework against Model Extraction Attacks
School of Cyberspace Security, Beijing University of Posts and Telecommunications（北京邮电大学网络安全学院）；Cyberspace Institute of Advanced Technology, Guangzhou University（广州大学网络空间技术研究院）；Huangpu Research School of Guangzhou University（广州大学黄埔研究学院）
Revisiting Black-Box Model Ownership Verification through Information Theory
Anhui University of Technology（安徽工业大学）；University of Cambridge（剑桥大学）；Microsoft（微软）；Nanjing University of Posts and Telecommunications（南京邮电大学）；Tylogi AI Lab（Tylogi AI实验室）；The Hong Kong Polytechnic University（香港理工大学）；Southeast University（东南大学）
Functional Subspace Watermarking for Large Language Models
University of Electronic Science（电子科学与技术大学）；Mohamed bin Zayed University of Artificial Intelligence, Abu Dhabi, United Arab Emirates（阿布扎赫德人工智能 Mohamed bin Zayed 大学）；South China University of Technology, Guangzhou, China（华南理工大学）
SSL-WM: A Black-Box Watermarking Approach for Encoders Pre-trained by Self-supervised Learning
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；Department of Computer Science, Metropolitan College, Boston University（波士顿大学大都会学院计算机科学系）
