Did You Train on My Dataset? Towards Public Dataset Protection with Clean-Label Backdoor Watermarking
This addresses dataset protection for data owners against license violations, offering a stealthy and effective solution, though it is incremental as it builds on existing backdoor methods.
The paper tackles the problem of unauthorized commercial use of public datasets by proposing a clean-label backdoor watermarking framework that inserts imperceptibly perturbed samples to embed a secret function, enabling tracking of illegally used models with minimal performance impact, demonstrated by injecting a traceable watermark with just 1% of samples across text, image, and audio datasets.
The huge supporting training data on the Internet has been a key factor in the success of deep learning models. However, this abundance of public-available data also raises concerns about the unauthorized exploitation of datasets for commercial purposes, which is forbidden by dataset licenses. In this paper, we propose a backdoor-based watermarking approach that serves as a general framework for safeguarding public-available data. By inserting a small number of watermarking samples into the dataset, our approach enables the learning model to implicitly learn a secret function set by defenders. This hidden function can then be used as a watermark to track down third-party models that use the dataset illegally. Unfortunately, existing backdoor insertion methods often entail adding arbitrary and mislabeled data to the training set, leading to a significant drop in performance and easy detection by anomaly detection algorithms. To overcome this challenge, we introduce a clean-label backdoor watermarking framework that uses imperceptible perturbations to replace mislabeled samples. As a result, the watermarking samples remain consistent with the original labels, making them difficult to detect. Our experiments on text, image, and audio datasets demonstrate that the proposed framework effectively safeguards datasets with minimal impact on original task performance. We also show that adding just 1% of watermarking samples can inject a traceable watermarking function and that our watermarking samples are stealthy and look benign upon visual inspection.