Open-sourced Dataset Protection via Backdoor Watermarking

Abstract

The rapid development of deep learning has benefited from the release of some high-quality open-sourced datasets (e.g., ImageNet), which allows researchers to easily verify the effectiveness of their algorithms. Almost all existing opensourced datasets require that they can only be adopted for academic or educational purposes rather than commercial purposes, whereas there is still no good way to protect them. In this paper, we propose a backdoor embedding based dataset watermarking method to protect an open-sourced image-classification dataset by verifying whether it is used for training a third-party model. Specifically, the proposed method contains two main processes, including dataset watermarking and dataset verification. We adopt classical poisoning-based backdoor attacks (e.g., BadNets) for dataset watermarking, i.e., generating some poisoned samples by adding a certain trigger (e.g., a local patch) onto some benign samples, labeled with a pre-defined target class. Based on the proposed backdoor-based watermarking, we use a hypothesis test guided method for dataset verification based on the posterior probability generated by the suspicious third-party model of the benign samples and their correspondingly watermarked samples (i.e., images with trigger) on the target class. Experiments on some benchmark datasets are conducted, which verify the effectiveness of the proposed method.

Data Isotopes for Data Provenance in DNNs

“…Solutions requiring dataset-level modifications. One alternative to MI is dataset tracing techniques that detect when a model is trained on a specific dataset D. Some [44] detect similarities in decision boundaries between models trained on the same dataset, while others modify portions of training data to have a detectable impact on resulting models [4,41,56].…”

Benchmarking Adversarial Patch Against Aerial Detection

“…8, gradient-based adversarial attack methods aim to generate adversarial perturbations that are farthest from the decision boundary within the specified perturbation range. On the other hand, optimizationbased methods aim to minimize the size of the adversarial perturbation, i.e., the distance between the adversarial and (a) Pixel [16] (b) Watermark [84] (c) Trigger [85] (d) Patch [86] (e) Viewpoint [87] (f) Style [88] (g) Erosion [89] (h) Sticker [72] (i) Light [90] (j) Laser [91] (k) Color [92] (l) Zoom [93] (m) Texture [94] (n) 3D object [95] (o) Projection [96] (p) Makeup [97] (q) PS [98] (r) Location [99] Fig. 6: Adversarial perturbations in different forms.…”

“…Finally, we summarize digital attacks against image classification ( [15], [16], [19], [20], [60]- [63], [79], [82], [84], [85], [89], [100], [103], [104], [108]- [153]) in Table III.…”