Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand

Summary

The authors study copyright projection problem for open datasets. They note that the previous method based on back door attacks are harmful. They propose to watermark some samples such that model training on this sample can correctly classify hard sample, which cannot be correctly classified by benign DNN. Technically, the authors exploit knowledge and techniques in transfer learning to derive domain generator for this task. The authors provide a set theoretical justification and perform a series of experiments to evaluate the proposed scheme.

Strengths

The proposed method is supported by both theory and experiments. The proposed idea using hard sample for database copyright protection should be novelty.

Weaknesses

The basic idea of this work is illustrated in Fig. 1. (Stage III). If many hard samples (which cannot be classified by benign DNN) can be correctly classified by a suspicious model, it is not necessary that the suspicious model is trained on the copyright dataset. If the owner of suspicious model claims that their model is trained on an extremely large dataset covering numerous hard samples and uses a proprietary architecture, augmentation method and learning scheme, it will be a very reasonable explanation why it can perform better the benign DNN, which is trained on a “small” dataset. Fig. 3 in fact gives a good illustration. The verification sample of the proposed method in Fig. 3 is clearly a dog to human being and the classification output is a dog. We only can say that the model can handle the hard sample. However, we cannot conclude that the model is trained on the watermarked dataset. Although the paper offers a lot of mathematical justification and experimental results, the authors need to explain the practicality of the proposed method. Although I do read the paper from beginning to the end, I am not working on this area. I let other reviewers commenting on the technical and experimental issues.

Questions

See the weaknesses.

Rating

4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.

Confidence

2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

2 fair

Presentation

3 good

Contribution

3 good

Limitations

See the weaknesses.

Summary

This paper first revisits the backdoor-based dataset ownership verifications and claims that these methods are harmful since they introduce the malicious misclassification. Given this, authors propose a truly harmless dataset copyright protection via making watermarked models correctly classify hard samples which will be misclassified by the benign models. They first generate domain watermark and then modify a set of benign samples which have similar effects to domain watermarked samples to insert the watermark into the dataset. Finally, they propose a hypothesis testing to verify whether a suspect model has unauthorized dataset usage. Experiments on CIFAR-10, Tiny-ImageNet and STL-10 show the effectiveness.

Strengths

1. The proposed method is novel to some extend. This paper proposes to protect the intellectual property of dataset from another perspective, i.e., making watermarked models correctly classify hard samples which will be misclassified by the benign models, differed from previous backdoor-based methods. 2. The theoretical analysis is reasonable and the experiments are extensive.

Weaknesses

Section 3.3 and 3.4 are not clear and well-written. For example, (a) lemma 1 (line 172~176) mentions the z and \hat_{z}, the features for source and target domains. However, the specific meaning of z/\hat_{z} and how to obtain z/\hat_{z} are not explained until line 189; (b) it's better to give the specific meanings of \theta, \omega and f in equation 2; Although authors have conducted extensive experiments, it's better to test with more model structures instead of only two (VGG and ResNet). Besides, Section 5.3.2 in the main manuscript and Section J in the appendix discuss the resistance to some potential adaptive methods. However, I think the true adaptive method are out-of-domain detection in the inference stage which does not involved in either main manuscript or the appendix.

Questions

1. In Equation (2), it seems that both z and \hat_{z} are relative to \omega while in the second term of \omega * , i.e., , \hat_{z} is not relative to \omega. 2. In line 262, authors set the watermarking rate \gamma=0.1 for their method and other baselines. However, for the most of baselines, they need to set one class as the target class, which means all of samples in the target class are perturbed for 10-class datasets (CIFAR-10 and STL-10) and a few classes are selected to be target classes for Tiny-ImageNet (200-class). I wonder the concrete settings. 3. In the Experiments, authors describe that they conduct experiments with two model structures VGG and ResNet, while results in table 1&2 do not reflect this setting, and the detailed settings of these results are not clear.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

2 fair

Contribution

3 good

Limitations

Please refer to the questions above.

Summary

This paper presents a method to use invisible domain watermarks for dataset ownership verification. Compared to previous methods, the motivation of this paper is to avoid harmful practice which negatively affects the model performance. The method is validated on CIFAR and Tiny-Imagenet datasets.

Strengths

1.[reference] The paper provides a comprehensive literature review. 2.[clarity] Extensive experimental results and ablation studies demonstrate the effectiveness of the proposed method. 3.[clarity] The paper has a clear motivation, which is to avoid harmful practice compared to existing methods. In particular, the proposed method is invisible, clear-label, and effective.

Weaknesses

1.[technical soundness] Adaptive attack against this proposed method is not discussed. 2.[limitation] The paper relies on assumption on generalization. For standard training the assumptions should hold. But what if the dataset to protect is used for domain adaptation, which has higher generalization capability across domains? This is not adaptive attack by design, but it might coincidently break the core assumptions of the proposed method.

Questions

Overall, the paper is comprehensive. My main concerns are about the adaptive attacks and domain generalization training methods coincidently breaking the assumption of the proposed method.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

See weaknesses.

Summary

This paper proposes domain watermark (DW), a new watermark technique for dataset verification. Domain watermark focuses on watermarking the dataset without introducing the harmful side effect. This paper first proposes to generate the hardly generalized domain by minimizing the mutual information between the dataset and hardly generalized domain. Then this paper perturbs some of the inputs to have similar effects as the domain-watermarked samples. Then the dataset contains its original domain and the watermarked domain. The model trained on it also learns the watermarked domain can be exposed by correctly classifying the watermarked domain images. The evaluation is done on CIFAR-10 and Tiny-ImageNet and shows that the watermarked model can be effectively distinguished from model trained on data from another dataset or model trained on the unwatermarked dataset.

Strengths

I think the area this paper studies is important and I agree that the watermark should not introduce harms or vulnerabilities that can be exploited by the attackers. In general, I like the idea of embedding the model with a harmless distribution that is orthogonal to the main distribution as the watermark. This paper is well-written and easy to understand.

Weaknesses

1. My biggest concern with this approach is that it just optimizes to find the most hardly generalized domain. It is possible that two watermark domains on two datasets of one similar domain collide. Suppose there are two dataset owners A and B. They have dataset from the similar domains and they both use this paper’s method to do the domain watermark. An attacker C trains on A’s dataset, would B’s WM images also have high VSR on C’s model? If so, it would be hard for A to claim that C trained on A’s model as the high VSR on the WM images does not prove the model trained on A (it could also be trained on B or trained on another model from the similar domain). I suggest adding a new experiment on this hypothetical scenario or include a new mechanism to avoid/reduce the possibility of collision of the watermark domains. 2. The general idea of this paper is that the watermarked dataset contains two distributions, the dataset’s domain and the watermark domain. Many of the existing backdoor poison samples detection methods also depend on this assumption. Will the watermark domain bypass some of the existing backdoor detection techniques, e.g.[1-3]? I suggest this paper to be evaluated against backdoor samples detection techniques. 3. I am not able to find the clear definition of the Harmful degree and relative harmful degree. Could you put these definitions in the main text? [1] Effective Backdoor Defense by Exploiting Sensitivity of Poisoned Samples [2] Demon in the variant: Statistical analysis of {DNNs} for robust backdoor contamination detection [3] Pre-activation Distributions Expose Backdoor Neurons

Questions

Please see the questions I raise in the weakness section.

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

2 fair

Presentation

3 good

Contribution

2 fair

Limitations

This paper discusses the limitation of this paper is bounded by the accuracy of the watermark models.

Summary

The authors propose a novel dataset ownership verification method that relies on correctly classifying 'hard' samples rather than classifying 'easy' samples which is harmless to the benign data. The proposed method is inspired by the generalization property of DNNs. Experiments verify the effectiveness of proposed method.

Strengths

1) Interesting insight. The insight of the harmless DOV method is interesting. 2) Clear writing: The paper is overall well-organized and easy to follow. The authors discuss the details of their design choices.

Weaknesses

1. While hyper-parameter selection in ablation studies section is crucial, I think the impact of the module block on the algorithm more intriguing. Specifically, I am interested in understanding how the generation of similar-effect samples during the creation of the protected dataset affects the final performance. 2. I think that the Domain Generator plays a crucial role in the overall algorithm. Therefore, it is essential to address the performance evaluation of this module. 3. The experiments were conducted on relatively small datasets (e.g., CIFAR-10 and Tiny-ImageNet). The transferability of the algorithm's effectiveness to larger datasets remains a question. For instance, it is crucial to examine whether the training of the Domain Generator is affected when applied to larger datasets. I believe this issues should be addressed at least in the "Discussion" section.

Questions

1) Similar-effect samples' influence to the final performance. 2) The performance of the proposed method on the larger dataset.

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

See part ‘Strengths And Weaknesses’.