2020/10/12 by Yiming Li, Li, Yiming, Ziqi Zhang +10 · 14 citations
Computer Science · #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Artificial intelligence #Backdoor #Benchmark (surveying) #Class (philosophy) #Computer Vision and Pattern Recognition (cs.CV) #Computer science #Computer security #Cryptography and Security (cs.CR) #Data mining #Digital Media Forensic Detection #Digital watermarking #Embedding #FOS: Computer and information sciences #Generative Adversarial Networks and Image Synthesis #Image (mathematics) #Machine Learning (cs.LG) #Machine learning #cs.AI #cs.CR #cs.CV #cs.LG
paper · pdf · doi:10.48550/arxiv.2010.05821
published in arXiv (Cornell University) (Cornell University) · Accepted by the NeurIPS Workshop on Dataset Curation and Security, 2020. 6 pages
openalex publication_date 2020/10/12 · arxiv created 2020/11/19 · arxiv updated 2020/11/20 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
The rapid development of deep learning has benefited from the release of some high-quality open-sourced datasets (e.g., ImageNet), which allows researchers to easily verify the effectiveness of their algorithms. Almost all existing open-sourced datasets require that they can only be adopted for academic or educational purposes rather than commercial purposes, whereas there is still no good way to protect them. In this paper, we propose a backdoor embedding based dataset watermarking method to protect an open-sourced image-classification dataset by verifying whether it is used for training a third-party model. Specifically, the proposed method contains two main processes, including dataset watermarking and dataset verification. We adopt classical poisoning-based backdoor attacks (e.g., BadNets) for dataset watermarking, ie, generating some poisoned samples by adding a certain trigger (e.g., a local patch) onto some benign samples, labeled with a pre-defined target class. Based on the proposed backdoor-based watermarking, we use a hypothesis test guided method for dataset verification based on the posterior probability generated by the suspicious third-party model of the benign samples and their correspondingly watermarked samples (i.e., images with trigger) on the target class. Experiments on some benchmark datasets are conducted, which verify the effectiveness of the proposed method.