Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand

TL;DR

This paper introduces a novel dataset copyright protection method using domain watermarks, which ensures model ownership verification without harmful backdoor risks, by leveraging the generalization properties of DNNs and a bi-level optimization approach.

Contribution

The paper proposes a harmless, effective dataset watermarking technique based on domain watermarks, avoiding malicious behaviors associated with backdoor-based methods, and provides theoretical and experimental validation.

Findings

The method effectively verifies dataset ownership on benchmark datasets.

It resists adaptive attacks aiming to remove watermarks.

The approach maintains model accuracy and stealthiness.

Abstract

The prosperity of deep neural networks (DNNs) is largely benefited from open-source datasets, based on which users can evaluate and improve their methods. In this paper, we revisit backdoor-based dataset ownership verification (DOV), which is currently the only feasible approach to protect the copyright of open-source datasets. We reveal that these methods are fundamentally harmful given that they could introduce malicious misclassification behaviors to watermarked DNNs by the adversaries. In this paper, we design DOV from another perspective by making watermarked models (trained on the protected dataset) correctly classify some `hard' samples that will be misclassified by the benign model. Our method is inspired by the generalization property of DNNs, where we find a \emph{hardly-generalized domain} for the original dataset (as its \emph{domain watermark}). It can be easily learned with the protected dataset containing modified samples. Specifically, we formulate the domain generation as a bi-level optimization and propose to optimize a set of visually-indistinguishable clean-label modified data with similar effects to domain-watermarked samples from the hardly-generalized domain to ensure watermark stealthiness. We also design a hypothesis-test-guided ownership verification via our domain watermark and provide the theoretical analyses of our method. Extensive experiments on three benchmark datasets are conducted, which verify the effectiveness of our method and its resistance to potential adaptive methods. The code for reproducing main experiments is available at \url{https://github.com/JunfengGo/Domain-Watermark}.