These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Dataset ownership verification, the process of determining if a dataset is
used in a model's training data, is necessary for detecting unauthorized data
usage and data contamination. Existing approaches, such as backdoor
watermarking, rely on inducing a detectable behavior into the trained model on
a part of the data distribution. However, these approaches have limitations, as
they can be harmful to the model's performances or require unpractical access
to the model's internals. Most importantly, previous approaches lack guarantee
against false positives. This paper introduces data taggants, a novel
non-backdoor dataset ownership verification technique. Our method uses pairs of
out-of-distribution samples and random labels as secret keys, and leverages
clean-label targeted data poisoning to subtly alter a dataset, so that models
trained on it respond to the key samples with the corresponding key labels. The
keys are built as to allow for statistical certificates with black-box access
only to the model. We validate our approach through comprehensive and realistic
experiments on ImageNet1k using ViT and ResNet models with state-of-the-art
training recipes. Our findings demonstrate that data taggants can reliably make
models trained on the protected dataset detectable with high confidence,
without compromising validation accuracy, and demonstrates superiority over
backdoor watermarking. Moreover, our method shows to be stealthy and robust
against various defense mechanisms.